Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

Contents lists available at SciVerse ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Evacuation, escape, and rescue experiences from offshore accidents including the Deepwater Horizon
Jon Espen Skogdalen a, *, Jahon Khorsandi b, Jan Erik Vinnem a
a b

Department of Industrial Economics, Risk Management and Planning, University of Stavanger, 4036 Stavanger, Norway Center for Catastrophic Risk Management, University of California, Berkeley, Berkeley, CA, United States

a r t i c l e i n f o
Article history: Received 10 May 2011 Received in revised form 10 August 2011 Accepted 11 August 2011 Keywords: Evacuation, escape and rescue Major accident Deepwater Horizon

a b s t r a c t
When a major hazard occurs on an installation, evacuation, escape, and rescue (EER) operations play a vital role in safeguarding the lives of personnel. There have been several major offshore accidents where most of the crew has been killed during EER operations. The major hazards and EER operations can be divided into three categories; depending on the hazard, time pressure and the risk inuencing factors (RIFs). The RIFs are categorized into human elements, the installation and hazards. A step by step evacuation sequence is illustrated. The escape and evacuation sequence from the Deepwater Horizon offshore drilling platform is reviewed based on testimonies from the survivors. Although no casualties were reported as a result of the EER operations from the Deepwater Horizon, the number of survivors offers a limited insight into the level of success of the EER operations. Several technical and non-technical improvements are suggested to improve EER operations. There is need for a comprehensive analysis of the systems used for the rescue of personnel at sea, life rafts and lifeboats in the Gulf of Mexico. 2011 Elsevier Ltd. All rights reserved.

1. Introduction The Deepwater Horizon accident and the Macondo blowout on the 20th of April 2010 raised serious concerns regarding the safety level of offshore drilling. The Deepwater Horizon offshore rig was considered to be a safe and efcient drilling unit. The very same day as BP ofcials were visiting the rig to praise seven years without lost time incidents, gas exploded up the wellbore onto the deck of the rig and caught re. Eleven workers were killed in the explosions (DHJIT, 2010). Evacuation, escape, and rescue (EER) operations played a vital role in safeguarding the crew members lives. Two lifeboats were launched in an effort for the crew to evacuate the rig, however eleven crew members were left behind. Because it was not clear that they could safely reach the two remaining lifeboats at the opposite end of the Mobile Offshore Drilling Unit (MODU), the master elected to launch a life raft. Because of intense heat and smoke, and crew fears that the raft would burn or melt, the life raft

Abbreviations: BOP, blowout preventer; DPO, dynamic positioning operator; EER, evacuation, escape, and rescue; ESD, emergency disconnect system; HOF, human and organizational factors; MODU, Mobile Offshore Drilling Unit; OCS, Outer Continental Shelf; POB, Personnel on Board; PSA, Petroleum Safety Authority Norway; RIF, risk inuencing factor; USCG, U.S. Coast Guard; TSR, temporary safe refuge. * Corresponding author. Tel./fax: 47 99 02 41 71. E-mail address: jon.espen.skogdalen@gmail.com (J. E. Skogdalen). 0950-4230/$ e see front matter 2011 Elsevier Ltd. All rights reserved. doi:10.1016/j.jlp.2011.08.005

was launched with only seven crew members aboard. Judging that there was not enough time to launch another life raft, the master and three remaining crew members jumped over 50 feet into the water. No casualties were reported as a result of the EER operations (USCG, 2011). Two days later, the Deepwater Horizon rig sank (DHJIT, 2010). The results of the EER operations from the Deepwater Horizon must not be taken for granted. There are several risks associated with EER operations from offshore installations as illustrated in the examples below. In 1980, 123 people were killed when the Alexander Kielland platform capsized and sank in the Norwegian sector of the North Sea. A fatigue crack in one of the legs caused the oating hotel to lose one of ve legs and capsize. Lifeboats were smashed against the rigs legs, causing them to break. Only one lifeboat was launched successfully. Many of the men were swept away. Only 89 of the 212 men onboard survived (Nsheim, 1981). In 1982 the Ocean Ranger semisubmersible capsized and sank on the Grand Banks of Newfoundland during a severe winter storm packing 90-knot winds and high seas. The Royal Commission on the Ocean Ranger Marine Disaster indicated that a huge wave had swept over the rig, breaking a porthole in the ballast control room, shorting circuits, opening ballast inlet valves and causing the rig to list to an extent that the crew could not rectify. All 84 crew members died, at least some of which during or following attempts to transfer survivors from the lifeboat to a vessel without rescue facilities (Hickman, 1984).

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

149

In 1988 a medium gas condensate leak resulted in an explosion and re on board the Piper Alpha production platform in the North Sea, killing 167 workers and leaving only 59 survivors, resulting in one of the worst offshore accidents ever. Many crew members lost their lives because they were not able to successfully evacuate the installation (Leaoor, 2006). A more recent example is the Usumacinta accident on October 23, 2007, where 22 people died after launching the lifeboats and abandoning the mobile drilling unit. Various decisions such as opening the hatches or prematurely abandoning the lifeboats resulted in the death of the crew (Leis et al., 2008). When a major hazard occurs on an installation, EER operations play a vital role in safeguarding the lives of personnel by safely removing them from the danger zone. However, as shown in the examples above, evacuation operations can have tragic outcomes, and although such accidents have had major impacts on legislation, training, and operating procedures, the risks pertaining to EER operations continue to exist. Therefore, there is a need for a further understanding of the performance of barriers (both technical and not-technical) in EER operations. 1.1. Objective Different accident scenarios cause different risk inuencing factors (RIFs) during the EER operations. A RIF is dened as an aspect (event/condition) of a system or an activity that affects the risk level of this system or activity (ien, 2001). The objectives of this article are to: 1. Categorize offshore accidents according to RIFs during the EER operations 2. Review the EER operations from the Deepwater Horizon based on testimonies 3. Suggest possible improvements based on the ndings Research related to EER operations during re in buildings is included in this study due to the similarities with offshore accidents which also often include res and in some cases explosions. The EER operations from the Deepwater Horizon are reviewed based on testimonies provided by the crew members during the Joint Investigation by the Unites States Coast Guard and the Bureau of Ocean Energy Management. The joint investigation board conducted the hearings in several sessions. Session one was held May 11e12, 2010, and investigated the circumstances surrounding the re, explosion, pollution and sinking of the Deepwater Horizon. The second session was held May 26e29, 2010, with the focus on gathering information on the Deepwater Horizons materiel condition, crew qualications, emergency preparedness, and casualty timeline. The third session of hearings, which could be considered the technical verication phase, was held July 19e23, 2010, with the focus on the how and the why of the accident. The fourth session was held Aug. 23e27, 2010, with a focus on the recovery, analysis, and evaluation of the critical drilling equipment. The fth session of hearings was held Oct. 4e8, 2010, with the focus on safety management systems, organizational decision making and safety culture (DHJIT, 2010). Experience from the regulations and standards used in the North Sea are compared with the review from Deepwater Horizon. The review includes the sequence of events from when the blowout was detected, until the crew was outside the platform safety zone (500 m) and thereby judged to be in safe distance from hazards caused by the installation. There are several other studies related to EER which review the mustering phase but do not include the abandoning phase. However, there are several accidents related to the abandoning phase, (e.g., lowering of lifeboats). The Abandonment phase is therefore included in this work.

Before the testimonies are reviewed EER operations are systematized according to denitions, sequence, success factors and RIFs. Hazard prevention, control and mitigation are not covered in this article. These activities inuence the RIFs during EER operations, and are described in research related to risk management (e.g. Aven & Vinnem, 2007).

2. Evacuation, escape and rescue (EER) The terms evacuation, escape and rescue are dened as following (Cullen, 1990; HSE, 1997): Evacuation refers to the planned method of leaving the installation without directly entering the sea. Successful evacuation results in those on board the installation being transferred to an onshore location or to a safe offshore location or vessel. Evacuation means may include helicopters, lifeboats and bridge-links. Escape is the process of leaving the installation in an emergency when the evacuation system has failed. It may involve entering the sea directly and is the last resort method of getting personnel off the installation. Means of escape cover items which assist with descent to the sea, such as life rafts, chute systems, ladders and individually controlled descent devices, as well as items in which personnel can oat on when reaching the sea such as throw-over life rafts.1 Rescue is the process of recovering of persons following their evacuation or escape from the installation, and rescuing of persons near the installation and taking such persons to a place of safety. Rescue also refers to the process by which man overboard (MOB) survivors are retrieved to a safe place where medical assistance is available. Some of the hazards which can potentially lead to EER are (IADC, 2009; Norsok, 2001):  Blowouts, including shallow gas and reservoir zones; unignited and ignited  Process leaks; unignited and ignited  Utility areas and systems res and explosions  Fire in accommodation areas  Helicopter crash on platform  Collisions, including elds related trafc, and external trafc, drifting and under power  Drifting objects that may threaten the installation  Riser and pipeline accidents  Accidents from subsea production systems  Structural collapse, including collapse of bridges between xed and/or oating installations  Foundation failure  Loss of rig stability/position  Extreme weather The hazards that a crew can be exposed to during EER can mainly be divided into three categories (HSE, 1995): physical, command and control and behavioral. The physical hazards are those due to equipment (design, malfunction or failure) and physical conditions (environmental, re, smoke etc.). The command and control hazards are those due to poor procedures, inadequate communications and breakdown of safety management systems. The behavioral hazards are those due to human factors as well as undesirable human behaviors.

1 It should be noted that Petroleum Safety Authority Norway (PSA) uses the term escape for all actions to leave the place of the accident and to move away from the installation.

150

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

2.1. Evacuation sequence Fig. 1 shows the different steps pertaining to an evacuation from an offshore installation e from the initiating incident, through the abandonment of the vessel. In the case of the Deepwater Horizon, this refers to when the blowout was rst recognized, to when the lifeboats abandoned the platform zone (500 m). Fig. 1 includes the steps of an evacuation process, but does not include the means of escape. The main factors which can lead to the success of EER from offshore installations can be summarized as (HSE, 1995):  Hazard prevention, control and mitigation  Appropriate installation physical design (e.g., escape routes, muster area)  The performance of equipment in an emergency (e.g., alarm systems, re-ghting equipment, helicopters, lifeboats and fast rescue crafts)  The action of the personnel concerned (e.g., offshore emergency response teams and general Personnel on Board (POB), often summarized as human and organizational factors (HOFs).

2.2. HOFs during EER operations Human error and human factors are often used interchangeably, thus creating confusion and compromising the quality of human reliability assessments (DiMattia, 2005). Therefore, dening human factors and human error is necessary to establish a basis for the discussion in the current paper. A denition of human factors, modied slightly from the UKs Health and Safety Executive (HSE, 1999), is as follows: Environmental, organizational and job factors, system design, task attributes, and human characteristics that inuence behavior and affect health and safety. Human factors are a range of issues including the perceptual, physical and mental capabilities of people and the interactions of individuals with their job and the working environments, the inuence of equipment and system design on human performance, and above

all, the organizational factors which inuence safety related behavior at work (Goodwin, 2007). Organizational factors are characterized by the division of tasks, design of job positions including selection, training and cultural indoctrination, and their coordination to accomplish the activities. The factors also include elements such as complexity (chemical/ process, physical, control, and task); size and age of plant, and organizational safety performance shaping factors such as leadership, culture, rewards, manning, communications and coordination, and social norms and pressures (Bellamy, Geyer, & Wilkinson, 2006). The human and organizational factors (HOFs) inuence behavior during hazards. The rst scientic research into human behavior in the event of a re was conducted in the 1950s in the United States. Since researchers at that time assumed that buildings were engineered in such a way that they were safe enough in a re, the focus was on the relationship between the (social) behavior of people and re development, and much less on the interaction between building design and a safe escape (Kobes, Helsloot, de Vries, & Post, 2010). Research has been performed related to modeling of evacuation situations both for offshore installations (Basra & Kirwan, 1998; Bercha, Brooks, & Leaoor, 2003; Jacobsen, 2010; Veitch, 2003) and maritime evacuations (Kim, Park, Lee, & Yang, 2004; Park, Lee, Kim, & Yang, 2004). Few simulation models are based on human behavior in evacuation scenarios, such as the preference for specic routes or exits, or the time needed to gather and interpret information. This is because there is insufcient quantitative research data available on these factors (Sime, 2001). Relevant for EER models are variables or parameters used in theories and ndings of disaster psychology (e.g. Leach, 1994). Important human factors are the personality traits of the people in a building, their knowledge and experience, their powers of observation and judgment, and their mobility. In Social Cognitive Theory, it is assumed that most people have an internal system which enables them to control their thoughts, feelings, motivations and actions to some extent (Kobes et al., 2010). This internal control is based on personal knowledge, feelings, biological characteristics, actions and their inuence on surroundings. Judgment enables

Initiating incident

Awareness

Evaluation and egress

POB control

Abandoning

Initial incidert

Decision to muster

Detect alarm

Activate alarm and PA-announcment

Identify alarm

Make workplace safe (if time)

Listen and follow PA announcement

Choose egress route

Register at TSR

Move along egress route

Dress in survival suits

Decision to abandon

Enter lifeboat

Drop lifeboat

Abandon platform zone

Fig. 1. The evacuation sequence (Skogdalen & Vinnem, 2010).

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

151

a human to estimate the threat of danger by going through a cue validation process based on what he or she sees, hears, smells and feels. The cue validation process is of signicant importance given that decision making during an evacuation depends upon the cues that the occupants perceive, and their interpretation of those cues (Graham & Roberts, 2000). Important factors are awareness, physical position (passive or in motion) and familiarity with the layout of a building. In the study, a number of individuals who had tried to leave a building by passing through a smoky environment reported that they had to change direction, or even retrace their steps, due to breathing problems, reduced vision, fear, or other reasons (Gwynne, Galea, Lawrence, & Filippidis, 2001). Experiments show that in the case of limited visibility, people tend to walk alongside walls for guidance (Kobes et al., 2010; Nagai, Nagatani, Isobe, & Adachi, 2004). There are three distinct strategies for surviving a re. The rst strategy is to (try to) extinguish it. The second strategy is to take shelter and wait to be rescued, and the third is evacuation (Kim et al., 2004). Large jet-res like seen in the case of Deepwater Horizon and Piper Alpha left most of the personnel with just one option; to try to evacuate or escape. The re could not be extinguished. There was no organized search and rescue by emergency response teams onboard the installations. The presence of social bonds within groups has implications for models predicting an array of possible disaster outcomes, including the emergence of panic. Organizational breakdown models assume that social bonds within groups engaging in collective ight weaken under intense threat (Cornwell, 2003). A key personality trait is the level of stress resistance, and thereby the power of observation, judgment and movement. During a re, a persons stress levels may rise to a level where their capacity for processing information is exceeded (Proulx, 1993). Too much stress can impair cognitive processes and how an individual

responds to a given situation (Proulx, 1993). An increased stress level is not the same as panic, which can be dened as irrational, illogical and uncontrolled behavior (Kobes et al., 2010). The engineered features, and thereby the RIFs of an offshore installation which determine re response performance is mainly related to its layout, re and blast walls, materials, re compartments and size of the facility. Relevant components of the layout are the escape route signage, the design of the escape routes and the design and location of the (emergency) exits and the (emergency) staircases. Physical barriers, like re and smoke compartments, the maximum walking distance to (re) exits, and re safety installations are the main components of egress and life safety systems. Fig. 2 summarizes the different factors that inuence the EER performance. 3. Three different EER situations The HOFs and RIFs described in Fig. 2 will differ depending on the initial hazard. The potential and speed of escalation also differ depending on the hazard. The escalation speed will inuence which evacuation and escape means are available. Three examples of hazards that an offshore installation may encounter are presented below, followed by a table which categorizes the hazards. 3.1. 2004 Hurricane season and evacuation The 2004e2005 hurricane seasons in the Gulf of Mexico were the worst in the history of offshore production, and the most destructive and costliest natural disasters in the history of the United States (Cruz & Krausmann, 2008). The hurricanes Katrina and Rita destroyed 136 structures, representing 1.7% of Gulf oil production and 0.9% of natural gas output. Another 53 platforms

Evacuation, Escape and Rescue performance

Human and Organsational Factors Personality Knowledge and experience Power of observation Powers of judgement Powers of movement S Social features Affiliation (e.g. family) Role/responsibility S Situational features Awareness Physical condition Familiarity with layout Command and control C Managment/leadership Procedures Communication Safety managment system Work practice Competence

Installation RIFs Layout Materials Size of installation (No. Of decks levels Floating, Condeep, Jack-up e.g. Normally unmanned Number of POB onboard Robustness of platform structure, escape routes, muster points, TR, evacuation equipment etc. Active systems (deluge etc.) Passive systems (fire protection, fire- and blast walls etc.) Escape routes E Length to muster area Complexity (junctions, stairs, etc.) Equipment passed Protection of muster area

Hazard RIFs Visual features Smelling features Audible features Escalation speed (e.g. fire growth speed, explosions) Smoke yield Toxity Heat

Fig. 2. EER performance, partly based on Kobes et al. (2010).

152

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

suffered signicant damage. Five rigs were destroyed and 19 rigs sustained signicant damage (Kaiser, 2007). A large scale precautionary evacuation was conducted in advance, for which no deaths were reported (Cruz & Krausmann, 2008). 3.2. Snorre A On the 28th of November 2004 an uncontrolled situation occurred during work in a well on the Snorre A tension leg platform on the Norwegian Shelf. The work consisted of pulling pipes out of the well in preparation for drilling a sidetrack well. During the course of the day, the situation developed into an uncontrolled gas blowout outside the casing with cratering on the seabed, resulting in gas under the facility. Personnel who were not involved in work to remedy the situation were evacuated by helicopter to nearby facilities after rst being mustered in lifeboats. The work to regain control over the well was complicated by the gas under the facility which, among other things, prevented supply vessels from approaching the facility to unload additional drilling mud. Mixed mud was available as part of the well uid chemicals, and pumped into the well. The well was stabilized the day after. The PSA characterizes this incident as one of the most serious to occur on the Norwegian shelf (Brattbakk, stvold, Zwaag, & Hiim, 2005). Under slightly different circumstances, the incident could have resulted in (1) ignition of the gas and (2) buoyancy and stability problems. Only chance and fortunate circumstances prevented a major accident with the danger of loss of many lives, damage to the environment and additional loss of material assets (Brattbakk et al., 2005). 3.3. Piper Alpha At about 10 pm on the 6th of July, 1988 a medium gas condensate leak resulted in an explosion and re on board the Piper Alpha platform on the British Continental Shelf. The system for control in the event of a major emergency was rendered almost entirely inoperative. Smoke and ames outside the accommodation made evacuation by helicopter or lifeboat impossible. Diving personnel, who were on duty, escaped to the sea along with other personnel on duty at the northern end and the lower levels of the platform. Other survivors of the initial explosions made their way to the accommodation. A large number of the crew congregated near the galley on the top level of the accommodation, which was the mustering area. Conditions there were tolerable at rst but deteriorated greatly as a result of smoke. Some of the crew, which among them 28 whom survived, decided on their own initiative to exit the accommodation. The survivors reached the sea by the use of ropes and hoses or by jumping off the platform from various levels. To remain in the accommodation meant certain death. At the time of the initial explosion 226 persons were on board the platform, of whom 62 were on night-shift. The great majority of the remaining crew were in the

accommodation. Overall, 61 persons from Piper Alpha survived. 39 had been on night-shift and 22 had been off duty (Cullen, 1990). The three incidents/accidents described above vary depending on the escalation speed and RIFs. The hurricane allowed for pre-warned hours in advance. Time was available to conduct an arranged and structured evacuation of the installations. The gas blowout at Snorre A was not immediately ignited. The incident posed a threat and personnel were mustered in lifeboats in a structured manner according to emergency preparedness plans. The lifeboats would have been dropped if the incident had escalated by the gas being ignited. The Piper Alpha accident, for most of the crew, instantly lead to a life-threatening situation with multiple RIFs such as smoke, heat and explosion loads. The accident escalated quickly and no structured evacuation occurred. The incidents/accidents are categorized in Table 1. 4. Legislation and standards Legislation and standards inuence the technical development, organization, procedures and training related to evacuation from offshore installations and facilities. To illustrate the different approaches toward legislation, the Norwegian and the U.S. regulations are briey described. The Norwegian performance based regulations specify the performance or function which is to be attained or maintained by the industry. The regulatory role involves dening the safety standards and acceptance criteria which companies must meet. Norways intention of such a regulatory regime is to get the operator to be focused and be self-regulatory when it comes to Health, Safety and Environment (HSE) performance, rather than relying on the regulators efforts in controlling that the HSE requirements are met. Within the Norwegian regime it is to a larger degree a responsibility for the operator to demonstrate how their safety management system and performance comply with the regulations (DNV, 2010). In the PSA Activity Regulation Section 77 it is required that the party responsible shall ensure that necessary actions are taken as soon as possible in the event of situations of hazard and accident so that (PSA, 2010):     The right alert is given immediately Situations of hazard do not develop into situations of accidents Personnel can be rescued in situations of accident The personnel on the facility can be quickly and efciently evacuated at all times  The condition can be normalized when the development of a situation of hazard and accident has been stopped In addition, the Norwegian performance based regulations provide details on some technical requirements related to EER. For instance, there is a requirement to use lifeboats of the free-fall type, and two independent systems for rescue of personnel who fall into the sea. There are further requirements that personnel may be

Table 1 Categories of EER situations. Category 1 e Arranged and structured EER 2 e Incident and structured EER 3 e Major accident Escalation speed Slow Medium RIFs (ref. Fig. 1) No Limited Typical evacuation means Helicopter Helicopter or fe boats Lifeboats, escape chutes, life rafts and jumping into sea E.g. hazard Extreme weather Process leak, unignited, utility res, ship on collision course Structural collapse, ignited HC leak E.g. incident 2004e2005 Hurricane evacuation GoM Snorre A blowout

Fast

Multiple factors

Piper Alpha, Alexander Kielland, Ocean Ranger, Deepwater Horizon

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

153

evacuated and rescued in what is termed situations involving hazard and accident, i.e. major hazard scenarios dened in Quantitative Risk Analysis, accidental events of limited extent and situations implying temporary increase of risk. In the U.S., prescriptive regulations specify technical requirements for structures, technical equipment and operations in order to prevent accidents and mitigate hazards. The regulatory authorities dene the requirements for HSE, and monitor that the companies comply with these. The United States Coast Guard (USCG) regulates the safety of life and property on the Outer Continental Shelf (OCS) (DNV, 2010). USCG regulations 33 sub-parts B (Manned OCS facilities) and C (Mobile Offshore Drilling Units) in 33 CFR 146 have requirements for operators to develop and submit approval Emergency Evacuation Plans (EEP) to the USCG. The EEP submissions must include, amongst other requirements (USCG, 1998):  A description of the recognized circumstances, such as res or blowouts, and environmental conditions, such as approaching hurricanes or ice oes, in which the facility or its personnel would be placed in jeopardy and a mass evacuation of the facilitys personnel would be recommended  For each of the circumstances and conditions described a list the pre-evacuation steps for securing operations, whether drilling or production, including the time estimates for completion and the personnel required  For each of the circumstances and conditions described a description of the order in which personnel would be evacuated, the transportation resources to be used in the evacuation, the operational limitations for each mode of transportation specied, and the time and distance factors for initiating the evacuation  For each of the circumstances and conditions described, identication of the means and procedures for retrieving and transferring personnel during emergency situations and the ultimate evacuation of all personnel Even though the approach toward regulation is different, the practical follow-up by the rig owners are very much the same worldwide, and the equipment used on offshore oil and gas installations for evacuations are mainly similar (e.g. lifeboats, escape chutes and life rafts). Drilling vessels like the Deepwater Horizon, follow marine regulations and often have conventional lifeboats. 5. EER from the Deepwater Horizon Evacuation from the Deepwater Horizon began within minutes after the blowout and subsequent explosions on board the rig. It is impossible to know exactly what happened during the crisis on the night of April 20th, 2010. However, based on the various accounts and testimonies of crew members during the Deepwater Horizon Joint Investigation, an overall sequence of events, including various hazards associated with those events has been outlined (DHJIT, 2010). The outline follows the main sequence described in Fig. 1 and is related to the factors illustrated in Fig. 2. 5.1. Initiating incident At approximately 9:45 pm, a blowout and subsequent explosions and re erupted on the rig (Graham et al., 2011). The sequence of events leading to the blowout and explosions has been examined in detail in the National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling Meeting 5 (Commission, 2010; Graham et al., 2011).

5.2. Awareness The sudden occurrence and impact of the explosion made it difcult for members on the bridge to assess the situation immediately following the incident. Also, various alarms were sounding and lights were ashing, making it difcult for the crew to acknowledge what was going on. The senior dynamic positioning operator (DPO) who was located on the bridge at the time of the incident recalls the scene as follows: [October 5th, 2010 (DHJIT, 2010)]:
. they[alarms] were going off like crazy, so we were trying to nd where these alarms were actually coming from. Question: So the alarms went off and you silenced them to try and respond to what the casualties were; is that the way that worked? Answer: Yeah. But every time you silence those At that point in time, it did no use to silence an alarm, because there were some alarms that were just one on top of each other. It was just going crazy....

Another DPO on the bridge that evening also recalls the scene on the bridge as follows [October 5, 2010 (DHJIT, 2010)]:

Question: Answer: Question: Answer: Question: Answer: Question: Answer:

.why didnt you signal immediately the general alarm when two of the sensors came up magenta on the combustible gas alarms? It was a lot to take in. There was a lot going on. And soon after, I went over and hit the alarms. But you didnt do it immediately, correct? No, sir. And, in fact, at the time there were, by your testimony, more than ten to 20 magenta combustible gas alarms going off? Correct. And did you consider at any time initiating an emergency shutdown of any ventilation aboard the rig? No, sir.

Question: Did anyone discuss it [ESD]? Did you hear anyone discussing it on the bridge at that time? Answer: Not that I remember. Question: It was not an option put forth at any period of time that you were on the bridge following the jolt? Answer: No. Not that I remember. Question: Answer: Question: Answer: Did anyone tell you after the rst explosion that the situation was under control? Yeah, I did hear someone say that. That was probably said to calm people down. Do you recall who said that? The captain.

Transocean employees testied that the Deepwater Horizons general alarm systems were inhibited prior to the explosion to avoid waking crew members in the middle of the night due to false alarms. [July 23, 2010; August 23, 2010] (DHJIT, 2010)]. According to the Chief Electronics Technician, inhibited alarms mean that the sensors continue to detect hazards and forward the information to the computer; however the computer will not automatically trigger the alarm upon detecting a hazard. [July 23, 2010 (DHJIT, 2010)]. This implies that on the Deepwater Horizon, the general alarm system designated to notify the crew in the event of a re required manual activation by a member on the bridge. In turn, several crew members on the rig oor and those closer to the location of the explosion had become aware of the severity of the incident before the general alarms were sounded. In addition, it has been testied that the general alarm did not sound prior to the rst explosion on the platform [October 5, 2010; July 23, 2010 (DHJIT, 2010)]. Traditionally, mustering would occur once the alarms were sounded, and the decision to muster was announced on the PA system. However, as noted in the testimony below[August 24, 2010 (DHJIT, 2010)], some crew members recall that they did not see or hear any alarms after the explosion. As

154

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

a result, they had begun evacuating the rig as soon as they witnessed and experienced the hazard RIFs of the blowout.

were difculties when trying to accurately account for all members. In his testimony, the Crane Operator describes his account of the events, and the difculties in obtaining a proper headcount [May 29, 2010] (DHJIT, 2010)]: We was still trying to get people on the boat and trying to calm them down enough to trying to calm them down enough to get everybody on the boat. And there was people jumping off the side. We was trying to get a count and just couldnt get an accurate count because people were just jumping off the boat. And we were trying to get people to count 1, 2, 3 around the boat trying to see how many we had in there and people couldnt even count right because they was too scared. So, what we done is we just went ahead and lled the boats up to their max and loaded the wounded we got on there and then lowered the boat. The Chief Mechanic describes the situation as follows [May 16, 2010 (DHJIT, 2010)] Upon entering the bridge, it was complete chaos. They were trying to get systems going, they were trying to get control back, and I asked the captain, Were here, Mike ... has an injury. So he told us to go to the lifeboats and nd the medic. We proceeded to the lifeboats, whereupon I lost track of Mike. And so I went to my lifeboat that I was stationed to go to. And we waited around outside the lifeboat, waiting to receive orders. And it was just complete mayhem, chaos, people were scared, they were crying. The Operations Manager describes [August 23, 2010 (DHJIT, 2010)]: And I heard somebody yelling in the background that theyre jumping overboard. So I ran back down the stairs. And in between the two life boats, on the outside of the handrail, there was an individual hanging on the outside of the handrail, and I said, Hey, where you going? Theres a perfectly good boat here. Do you trust me? The Subsea Engineer also describes the scene as follows [July 22, 2010 (DHJIT, 2010)]. It was a raging re, it was out of control. There was a sense of urgency, we needed to go. And people were frozen up, they couldnt move. And I saw a couple of people jump off the side. I grabbed people and asked them if they checked in. I told them to get into the lifeboat and, you know, did that for a few people. People started going. I got in the lifeboat myself and everybody lled in, closed the doors, we deployed the life vessel

Question: Do you recall the order of the alarms on the bridge when the incident occurred, what alarms sounded and in what order? Answer: We received the alarms from the re and gas after the rst explosion. Question: . Did you ever see any sort of visible alarms on that rig once you heard the loud noise you heard and started experiencing the things with the rig that you experienced, did you see any visual alarms anywhere on the rig of any type? Answer: Not from the the place I was at on the boat deck or in the short distance through the hallways in the accommodations did I see any visual alarms, nor did I hear any.

5.3. Evaluation and egress Egress routes are the routes crew members use to escape from their current workplace or location and arrive to the designated muster stations on board the vessel. These routes are pre-planned, and provide the safest means of evacuation of a hazardous area. As the crew was making their way to the muster stations, many of the egress routes and stairways were blocked or impaired [May 27, 2010 (DHJIT, 2010)]. According to the Chief Electronics Technician on board the Deepwater Horizon, egress routes were severely impaired as a result of the explosions. His accounts of the events were as follows: [July 23, 2010 (DHJIT, 2010)]: That [rst] explosion blew the re door that was between me and those spaces off the hinges. .as I reached the next door, I reached up and grabbed the handle for it. It then exploded. That was Explosion Number 2. .I remember getting really angry. I dont know why I got angry. I was mad at the doors. The doors were They were beating me to death. Two doors in a row had hit me right in the forehead and, you know, planted me against the wall somewhere. My arm wouldnt work, my left leg wouldnt work, I couldnt I couldnt breathe, I couldnt see. All the panels for the ooring were missing. There was nothing but grid work. So I was tripping and falling kind of through this grid work, trying to make my way to the outside water-tight door. So I turned to the right, and as I did, I got my bearings, got my eyes cleaned out enough where I could see, and noticed there was no walkway, there were no handrails, and there was no stairwell left. One more step and I would have went in the water. At that point I looked up at the wall, and the exhaust stacks for Engine Number 3, the wall, the handrail, the walkway, all those things were missing. They were completely blown off the back of the rig. Flames and impaired egress routes had cut off access to the aft lifeboats for some of the crew, rerouting them to their secondary muster stations. The Senior Tool Pusher describes the wreckage in the living quarters as a result of the explosion: [May 28, 2010 (DHJIT, 2010)]: .we had to remove debris. It was hanging from the ceiling and the walls was jutted out, the oor was jutted up. I mean it was just total chaos in that area of the living quarters. 5.4. Personnel on Board (POB) control Typically as part of the evacuation procedure, once crew members reach the designated muster stations, they register their names so that a proper headcount can be conducted and missing members can be accounted for. Based on the testimonies provided, there were efforts to prepare such a headcount, however there

5.5. Abandoning While crew members on the bridge were trying to assess the situation, others were already mustering near the lifeboats. Some were urging for the lifeboats to be launched despite them being only partially full. Deepwater Horizon did have a split command depending on what was the status of the rig; latched up, underway, or in an emergency situation. The decision to evacuate the rig rested upon the Captain when the rig was in an emergency situation, but from the testimonies it seems to be unclear who was in charge due to missing procedures of handover and interpretation if the rig was latched up, underway or in an emergency situation (DHJIT, 2010). In his testimony during the joint investigation by the United States Coast Guard and the Bureau of Ocean Energy Management, the crane operator described the scene as follows [May 29, 2010 (DHJIT, 2010)] .it was a lot of screaming, just a lot of screaming, a lot of hollering, a lot of scared people, including me, was scared. And

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

155

trying to get people on the boats. It was a very unorganized e we had some wounded we was putting in the boat. Had people on the boat yelling Drop the boat, drop the boat and we still didnt have everybody on the boat yet. We was still trying to get people on the boat and trying to calm them down enough to trying to calm them down enough to get everybody on the boat. And there was people jumping off the side. One of the crew members jumped to the sea, and recalls the situation [May 28, 2010 (DHJIT, 2010)]:

The senior DPO who was located on the bridge at the time of the incident signaled for help from the nearby supply ship, the Damon Bankston, which in response launched a Fast Rescue Craft (FRC) to help rescue those at sea. Two lifeboats were launched from the Deepwater Horizon, and the crew made their way to the Damon Bankston. Some of the members who were left behind on the rig used a life raft to evacuate. However, after the raft was lowered to sea, the remaining crew members on the rig, who were left behind by both the lifeboats and life raft, jumped to the sea. The Chief Engineer, who was in the life raft below the rig, describes the scene as he witnessed members who had jumped [July 19, 2010 (DHJIT, 2010)]: I saw a persons boots and his clothing and stuff come shooting through the smoke. Just before he landed, ...He landed approximately ve feet from me. Within seconds, a half a second later, another pair of boots and person came ying out of the smoke and he was approximately ten feet from me. Just before he hit the water, .. As were swimming, trying to pull this life raft away from the rig, I got to a point where I could see the helideck. I witnessed an individual running at full speed across the helideck. When he jumped off the end of the helideck, he was still running. Just before he splashed into the water, he was actually looking over at us . The crew that had launched the life raft faced various challenges in their attempt to evacuate and escape the vicinity of the burning rig. The following excerpts are from the testimony of the rigs Chief Engineer, who was one of the crew members who evacuated using the life raft [July 19, 2010 (DHJIT, 2010)]: All the ames and heat from the rig oor were coming down the forward part of that deck, as well as all of the ames and the heat from under the rig. They were meeting, I guess, in like a vortex or something right there at the life raft. At that point, I honestly thought that we were going to cook right there. The life raft, I guess from hurriedness and jumping in there and so forth, it actually fell. At that point, the life raft actually dipped forward and back. It started rocking back and forth. There was smoke.. .I noticed that shortly after that, that we were not going any further from the rig. About that time, somebody hollered out, Oh, my God, the painter line is tied to the rig. I looked back over my shoulder past the life raft and noticed the white painter line going up into the smoke. At that point, I heard ..., which was right behind me, started screaming for help, Help. We need help over here. I looked out to see and I would have to say probably 50, 60 yards away there was the fast rescue craft, the FRC, from the Dameon Bankston. I saw two ashing lights in the water. Just as I looked at it, one of those was getting hauled into the boat and seconds later, the second person was hauled into that boat. The fast rescue craft started driving towards us and we were hollering, We need a knife. We need a knife. When they got probably ten or 15 feet from us, an individual came up to the bow of the boat with a very large, foldable pocket knife. Curt swam out, grabbed the knife, and swam to the back of the life raft. I followed Curt to the back of the life raft to assist if he needed it. He cut the rope. Within minutes, the FRC which had been launched by the crew of the Damon Bankston was able to rescue the crew members from the water and make its way to the life raft tied to the rig, cut the line, and tow it to safety. One of the crew members who had helped lower the life raft, but was left behind on the rig described how he made his decision to jump [October 5, 2010 (DHJIT, 2010)]:

Question:

Answer: Question: Answer: Question:

Answer: Question:

Question: Answer:

[.] if you had been through all those drills and you had condence that you thought basically the folks knew what they were doing, what was it that basically made you decide to go one deck down and jump? Were you frustrated, were you, you know, overly concerned? Was it getting hot? Im just really kind of curious. It was a decision that I made because I didnt think we had time to wait. You thought it was taking too long to get the boat out? I just they had a series of explosions, its time to go. That was my thought process. Can you estimate for us from the time that you heard the rst explosion, you went to the boat deck, before you made your decision to go down and jump how much time elapsed? Fifteen minutes maybe. And, when you were on that fast rescue boat, did they retrieve other people from the water or did they rescue you and take you back over? Okay. There were four guys that had jumped.

It seems unclear as to when exactly the decision to abandon was made and by whom. A senior Transocean employee visiting the rig at the time of the incident, described how he instructed the lifeboats to depart [August 23, 2010 (DHJIT, 2010)]:

.looking up at the derrick, you can see the derrick, and everything was ablaze there, and there was some individuals yelling, Weve got to go. Weve got to go. Weve got to go. And I said, Weve got plenty of time. And right about that time is when the traveling equipment, the drilling blocks and whatnot on the derrick fell. They were probably 40 to 50 foot in the air, you know, weigh 150,000 pounds, and they didnt make any noise. So at that time, I instructed the boat to my right, which would have been the port survival boat, to depart. They did. Question: If you were not in command, why would the life boat coxswain lower his boat based on your communication and evacuate away from the Deepwater Horizon? Answer: I only know that when we left the bridge that we were going to abandon the vessel. Question: If you werent in management-performance, would the coxswain take your word and leave and lower the boat and release? Answer: I dont know why he would take orders from me. Im not the master of the vessel. But he did.

The crew eventually launched the lifeboats, leaving eleven crew members behind (USCG, 2011). The following is an excerpt of the testimony of the subsea supervisor for the Deepwater Horizon: [August 25, 2010 (DHJIT, 2010)]:

Question: Answer: Question: Answer: Question: Answer:

So what was the atmosphere like inside the lifeboats? It was a little hectic. A lot of yelling and things like that? Yes. A lot of people was wanting to lower the boat before we got all the people in it. So by the time you got the boat was lowered, there was still enough room inside the lifeboat, sir? Yes.

156

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

Question: Other than jumping from the rig at that point, were there any other alternatives to evacuate the rig? Answer: Yeah. I mean, if I wanted to sit there and crank up the life raft davit, crank the hook back up and hook up another one. In a situation like this, you never know how much time you got, so I did, you know, the best thing I thought. Question: Im certainly not criticizing your decision to jump. Im just looking at alternative evacuation methods. Were there ladders that would go down to the waters edge? Answer: There was a ladder that was right there, but those ladders were severely damaged due to running from hurricanes, that you would have to jump from them anyway. Question: So my understanding from what you said is there were ladders designed, but the ladders had suffered damage, so they were not functional; is that correct? Answer: Those ladders were designed I dont know if they were designed for an emergency escape route, but I know they were used during the shipyard for people to get up to the rig. I dont know if they were emergency use. Question: Do you know if the ladders could have been used to go from the deck to the water? Answer: They could have, but like I stated earlier, the bottom 15, 20 feet was so severely damaged from waves that you still would have had to jump.

6. Discussion The majority of the casualties from the Alexander Kielland, Ocean Ranger, Piper Alpha and Usumacinta offshore accidents occurred during EER operations. The Deepwater Horizon experienced a similar category 3 accident (ref. Table 1). The accident escalated fast and included multiple RIFs. Even so, no deaths were reported as result of the EER operations (USCG, 2011). The high number of people evacuated from the Deepwater Horizon offers a signicant, however limited insight into the level of success of the EER operations. Testimonies have revealed that several of the safety critical systems on Deepwater Horizon failed partly or totally. These systems included the general alarm, blowout preventer, emergency disconnect system and the power supply. The systems were intended for hazard prevention, control and mitigation. Several of the crew members did not hear the abandon platform alarm. Some of the egress routes were partially blocked. The free-fall technology with skid launch lifeboats and drop lifeboats is according to PSA the safest method for ensuring that the means of evacuation moves personnel away from the offshore facility as quickly and safely as possible (PSA, 2008). This is particularly the case in the North Sea, North Atlantic and Norwegian Sea, where the sea is almost never without swell and waves. The Deepwater Horizon had conventional lifeboats. New production installations in the Norwegian sector are required by law to have free-fall lifeboats. However mobile drilling units in Norway are not required to have free-fall lifeboats as they follow maritime regulations, and not petroleum legislation. There are some companies which claim that evacuation by helicopter is the primary evacuation mean. This causes some confusion. Helicopters cannot be used in situations where re or gas clouds are present at the platform. Evacuation via helicopter will also take far longer time on installations that demand several ights due to the restricted capacity on each ight (Vinnem, 2008). Helicopter can therefore only be seen as a primary evacuation means in situations where the abandonment is planned in advance, as in the case of hurricanes in the Gulf of Mexico. Explosions, re and smoke were life-threatening hazards during the EER from the Deepwater Horizon. Experiences from res in buildings can be comparable, although there are some important differences as well. On offshore installations, the crew is familiar with the facility and escape routes. They also participate in regularly (usually weekly) muster and lifeboat drills. To determine which measures that would reduce the time to make decisions, and which steps that would lead to people choosing the right egress routes, information is needed regarding the HOFs. Of special interest are the perceptions, intentions and motives of the personnel when faced with such situations. Some information is available through the testimonies, but additional information is needed to sort of the importance of the individual factors and their coherence. One of the important roles of the master of the vessel is to take charge during a crisis, and to give the order to abandon ship if necessary. The master should assess the severity of the situation properly, and if the decision to abandon is made, the master would then give the order to launch the lifeboats and evacuate the installation. Lowering the lifeboats at the right time is critically important for an effective evacuation, because there are a limited number of lifeboats on an installation. If not communicated properly, lifeboats can be launched only partially lled, resulting in personnel being left behind. On the other hand, if members wait too long to launch the lifeboats, they risk being harmed by the explosions, re, smoke, and possibly falling objects. The Deepwater Horizon had a split chain of command between the Offshore Installation Manager and the Captain, which seemed to have caused confusion as the lines of authority and shift of responsibility

Another hazard facing those who had jumped to sea was the presence of oil and other possible toxic and ammable material which had covered the surface of the water following the explosion. One of the nal remaining crew members on board the Deepwater Horizon, described the problems he faced once he had jumped in to the sea [July 23, 2010 (DHJIT, 2010)]: Once I hit the water, when I came back up, I couldnt see anything again because now Ive got a new set of problems. Ive got oil, hydraulic uid, gasoline, diesel, whatever it is thats oating on the water is now burning my entire body. Im now covered in this sludge. I dont know what it is. Its burning, I cant hardly breathe, but I can feel the heat from the re underneath the vessel. At that point I started back stroking with the one arm and one leg that would work until I remember feeling no pain, I remember feeling no heat and thinking that that was it, I had died. The Damon Bankston played a critical role in rescuing and providing a safe-haven to personnel who had abandoned the Deepwater Horizon. The FRC launched by the Bankston not only rescued crew members from the water; it also rescued the life raft which had been unexpectedly tied to the rig. The rescued crew received medical attention on board the Damon Bankston, and the seriously injured were airlifted and evacuated by the USCG from the deck of the Bankston. The USCG reports that although there was no regulatory requirement for a MODU to have a standby vessel at its side for safety purposes or to have its own fast rescue craft, the role Bankston played in saving lives demonstrates the value that such requirements could provide (USCG, 2011). The following is an excerpt from the testimony of the Chief of incident response for the USCG 8th District [October, 4, 2010 (DHJIT, 2010)]:
Question: Are you aware of any unique challenges they [USCG] face in deepwater emergency response? Answer: Oh, yes, a number. I mean, it is a fairly conned area. There is nowhere to go other than the water. And also, to get assets there, oating assets there, it takes quite a while. Roughly, you know, for just for the Deeepwater Horizon, we are looking at about 12 hours to get patrol boats on the scene. Question: Specically, how do you plan to rescue 126 personnel with, I believe you said, 11 helos in the Gulf of Mexico, in an evacuation similar to this if there was no DAMON BANKSTON? Answer: Typically, we dont have those assets to do that. We rely on our industry partners out there. And there are a lot of vessels in that area just e for instance, this particular incident kind of sheds a little light on it, and we have e there are a lot of resources out there. Typically, we are helping each other out. So that is kind of SOP for us.

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

157

in the event of an emergency seemed unclear to some of the crew members. The control, behavior and execution of commands depend on several human RIFs (ref. Fig. 2). A critical question to be considered is how can it be relied upon that the master of the vessel will be in good enough condition to perform critical tasks in time, such as properly assessing the situation, activating the alarm, and giving the order to muster and abandon ship? This was also a problem the crew faced following the explosion on board the Piper Alpha. The crew waited on instructions from the master who had the authority to order an evacuation; however they were not aware that the explosion had destroyed the control room killing most of the personnel inside; therefore valuable time was lost waiting for the order to evacuate the installation. In addition, several of the crew waited for helicopters to arrive, unaware that helicopters cannot approach an installation on re. During a crisis, it is possible that situations will occur where bypassing the chain of command is unavoidable and necessary; however, the situation must be properly assessed by the individuals such that the result is not detrimental to the safety and success of the operations. This can be accomplished through proper training of worst case scenarios. It is expected that in some cases, not all members will be able to evacuate using the primary means of evacuation and therefore rescue means are necessary to ensure the safe evacuation of the personnel left behind or not able to make it to temporary safe refuge (TSR). As seen in the case of the Deepwater Horizon, there was a need for secondary means of evacuation. In addition to life rafts, these can be escape chutes and ladders. Personal survival suits with splash protection extend the available rescue time due to increased protection from waves and hydrocarbons in the sea. They also extend time before hypothermia. The survival suits should include emergency beacons to improve chances of locating a survivor, as is the case in Norway and the UK. Technical systems exist that provide automated real time accounting of personnel during an emergency evacuation. The systems provide a list of Personnel on Board (POB) or personnel on premise, including key data, trade certicates, cabin number, work area and primary duties during an evacuation or muster drill. At the check-in point the muster ofcer and master get a real time report of who is expected, who is missing and who has shown up at a secondary muster station. In the event that rst responders are called in, management can direct them to the work areas or cabin numbers of missing personnel. Several hazards faced those on the Deepwater Horizon who prepared to jump to sea. Among those hazards were the height from the platform deck to the surface of the water from which they have to jump, the possible res on the sea level and smoke inhalation. Ideally, the crew would had to get as close as possible to the water surface before jumping or entering the sea. Under some circumstances jumping into the sea is necessary, and offshore personnel should be trained to do this as safely as possible. The supply ship Damon Bankston played a vital role in rescuing the survivors from the Deepwater Horizon. Given the remote location of deepwater operations, nearby vessels play a critical role in rescuing personnel from offshore installations in the case of a major accident. Fast response is especially important with a high number of personnel in the sea and/or in the case of bad weather. Custom designed third generation rapid response rescue vessels are available. They are specially designed to launch and recover a fast rescue craft or daughter craft from a slipway in the stern. The slipway can also be used to recover a lifeboat from the sea. The sea trials of these vessels are promising and it is generally considered possible to operate in sea conditions with signicant wave heights of up to Hs <9 m (Jacobsen, 2010). The distance from shore to the Deepwater Horizon (66 km) meant that it did take several hours for rescue boats to arrive. The

USCG scrambled HH-65C Dolphin helicopters when they received the mayday call from Deepwater Horizon. These helicopters have a limit of rescuing 3e4 persons. There is a need for a comprehensive analysis of the systems used for the rescue of personnel at sea, life rafts and lifeboats in the Gulf of Mexico. The system should include the rig owner, industry partners in the area, The Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE), as well as the UCGS. The capability to quickly and efciently rescue personnel at all times should be analyzed. The Norwegian system for area based emergency preparedness arrangements (OLF, 2000) should be reviewed for relevance. This system includes use of offshore based Search and Rescue (SAR) helicopters as well as fast rescue crafts, in order to provide rescue capabilities for the relevant number of personnel within 120 min from an emergency. Training, knowledge, experience, and competence are important throughout all steps of EER operations, and for some steps, it is purely the human actions that can ensure the success of the operation. Emergency drills and training have limitations on preparing the crew to deal with real-life emergency situations and unanticipated events. However, proper training and knowledge can give a basic ability to cope with evacuation scenarios. It is important that emergency drills include the RIFs shown in Fig. 2 to prepare for EER operations during major accident. HOFs play an important role in the successful completion as well as the failure of emergency procedures. Human factor analysis is rooted in the concept that humans make errors, and the frequency and consequences of these errors are related to humans, the installation and hazardous factors. This can only partly be accounted for in the design of equipment, structures, processes and procedures. As stress increases, the likelihood of human error also increases. Offshore installations are generally located in harsh environments, and therefore incidents can cause extremely stressful situations. The consequences of human error in an offshore emergency can be severe. Extensive knowledge of human behavior when faced with a hazard such as a re and an explosion is essential for the provision of the appropriate measures for safe evacuation and escape from an installation.

7. Conclusion When a major hazard occurs on an installation, evacuation, escape, and rescue (EER) operations play a vital role in safeguarding the lives of personnel. Major accidents that quickly escalate and include several RIFs such as re, explosions and smoke are extremely challenging. The high number of people evacuated from the Deepwater Horizon offers an important, although limited insight into the level of success of the EER operations. Serious failures occurred related to several of the steps in the evacuation sequence, especially related to command and control. It is important that emergency drills include worst case scenarios to prepare for EER operations during major accidents. The consequences of human error in an offshore emergency can be severe. Extensive knowledge of human behavior when faced with a hazard such as a re and an explosion is essential for the provision of the appropriate measures for safe evacuation and escape from an installation. There is also a need for a comprehensive analysis of the systems used for the rescue of personnel at sea, life rafts and lifeboats in the Gulf of Mexico.

Acknowledgments The authors appreciate the comments and suggestions made by the reviewers. Vinnem and Skogdalen appreciate the nancial support from the Norwegian Research Council and Statoil.

158

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 HSE. (1995). A methodology for hazard identication on EER assessments. Health and Safety Executive Books. HSE. (1997). Prevention of re and explosion, and emergency response on offshore installations. Health and Safety Executive Books. IADC. (2009). Health, safety and environmental case guidelines for mobile offshore drilling units, International Association of Drilling Contractors. (p. 128). Issue 3.2.1. Jacobsen, R. S. (2010). Evacuation from petroleum facilities operating in the Barents Sea. (p. 47). Kaiser, M. J. (2007). World offshore energy loss statistics. Energy Policy, 35, 3496e3525. Kim, H., Park, J., Lee, D., & Yang, Y. (2004). Establishing the methodologies for human evacuation simulation in marine accidents. Computers & Industrial Engineering, 46, 725e740. Kobes, M., Helsloot, I., de Vries, B., & Post, J. G. (2010). Building safety and human behaviour in re: a literature review. Fire Safety Journal, 45, 1e11. Leach, J. (1994). Survival psychology. N.Y.: New York University Press. Leaoor, F. C. (2006). Survey of offshore escape, evacuation & rescue safety systems (post Ocean Ranger recommendations). Leis, B., Chidester, R., Flamberg, S., Olson, J., Rose, S., Aysa, J., et al. (2008). Root cause analysis of the Usumacinta e KAB-101 incident 23 October 2007. Nsheim, T. (1981). NOU, the Alexander L. Kielland-accident. (in Norwegian). Nagai, R., Nagatani, T., Isobe, M., & Adachi, T. (2004). Effect of exit conguration on evacuation of a room without visibility. Physica A: Statistical Mechanics and Its Applications, 343, 712e724. Norsok. (2001). Norsok standard: Risk and emergency preparedness analysis, Z-013. Norwegian Technology Centre. ien, K. (2001). Risk indicators as a tool for risk control. Reliability Engineering and System Safety, 74, 129e145. OLF. (2000). Guidelines for establishing area based emergency preparedness (in Norwegian). The Norwegian Oil Industry Association. Park, J. H., Lee, D., Kim, H., & Yang, Y. S. (2004). Development of evacuation model for human safety in maritime casualty. Ocean Engineering, 31, 1537e1547. Proulx, G. (1993). A stress model for people facing a re. Journal of Environmental Psychology, 13, 137e147. PSA. (2008). Free-fall lifeboats safest means of evacuation at sea. Petroleum Safety Authority Norway. PSA. (2010). Regulations relating to health, environment and safety in the petroleum activities (the activities regulations). Petroleum Safety Authority Norway. Sime, J. D. (2001). An occupant response shelter escape time (ORSET) model. Safety Science, 38, 109e125. Skogdalen, J. E., & Vinnem, J. E. (2010). Risk inuence factors related to evacuation from offshore installations, ESREL09. Prague: Taylor & Francis Group. USCG. (1998). 33 C.F.R. x 146.140 emergency evacuation plan. CGD 84-098b, 54 FR 21572, May 18, 1989, as amended by USCG-1998-3799, 63 FR 35530, June 30, 1998. United States Coast Guard. USCG. (2011). Report of investigation into the circumstances surrounding the explosion, re, sinking and loss of eleven crew members aboard the mobile offshore drilling unit Deepwater Horizon in the Gulf of Mexico April 20e22, 2010. United States Coast Guard. Veitch, B. (2003). Evacuation performance. Houston: Offshore Technology Conference. Vinnem, J. E. (2008). Offshore emergency preparedness, holistic evaluation (in Norwegian).

References
Aven, T., & Vinnem, J. E. (2007). Risk management: With applications from the offshore petroleum industry. London: Springer-Verlag London Limited. Basra, G., & Kirwan, B. (1998). Collection of offshore human error probability data. Reliability Engineering & System Safety, 61, 77e93. Bellamy, L. J., Geyer, T. A. W., & Wilkinson, J. (2006). Development of a functional model which integrates human factors, safety management systems and wider organisational issues. Safety Science, 46, 461e492. Bercha, F. G., Brooks, C. J., & Leaoor, F. (2003). Human performance in Arctic offshore escape, evacuation, and rescue (pp. 2755e2762). International Society of Offshore and Polar Engineers. Brattbakk, M., stvold, L., Zwaag, C., & Hiim, H. (2005). Investigation of gas blowout on Snorre A, well 34/7-P31A, 28 November 2004. Commission. (2010). Meeting 5: November 8e9, 2010. National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Cornwell, B. (2003). Bonded fatalities: relational and ecological dimensions of a re evacuation. Sociological Quarterly, 44, 617e638. Cruz, A. M., & Krausmann, E. (2008). Damage to offshore oil and gas facilities following hurricanes Katrina and Rita: an overview. Journal of Loss Prevention in the Process Industries, 21, 620e626. Cullen, W. D. (1990). The public inquiry into the Piper Alpha disaster. London: Department of Energy. DHJIT. (2010). USCG/BOEM Marine Board of investigation into the marine casualty, explosion, re, pollution, and sinking of mobile offshore drilling unit Deepwater Horizon, with the loss of life in the Gulf of Mexico April 21e27, 2010. Deepwater Horizon Incident Joint Investigation Team, The U.S. Coast Guard (USCG)/Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) Joint Investigation Team (JIT). DiMattia, D. (2005). Determination of human error probabilities for offshore platform musters. Journal of Loss Prevention in the Process Industries, 18, 488e501. DNV. (2010). Report OLF/NOFO e Summary of differences between offshore drilling regulations in Norway and U.S. Gulf of Mexico. Goodwin, S. (2007). Human factors in QRA. Report for International Association of Oil & Gas Producers. Det Norske Veritas Ltd. Graham, B., Reilly, W. K., Beinecke, F., Boesch, D. F., Garcia, T. D., Murray, C. A., et al. (2011). Deep water. The gulf oil disaster and the future of offshore drilling. Report to the President. The National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling. Graham, T. L., & Roberts, D. J. (2000). Qualitative overview of some important factors affecting the egress of people in hotel res. International Journal of Hospitality Management, 19, 79e87. Gwynne, S., Galea, E. R., Lawrence, P. J., & Filippidis, L. (2001). Modelling occupant interaction with re conditions using the building EXODUS evacuation model. Fire Safety Journal, 36, 327e357. Hickman, T. A. (1984). Report one: The loss of the semisubmersible drill rig Ocean Ranger and its crew. Royal Commission on the Ocean Ranger Marine Disaster. HSE. (1999). Reducing error and inuencing behaviour HSG48. Health and Safety Executive Books.