Presentation on theme: "1 Cause and event analysis Non-conformity Barrier failure Natoil is the supplier of SIMOPS cranes to Valhall Flank North (VFN) order of 8 November 2002."— Presentation transcript:
1 Cause and event analysis Non-conformity Barrier failure Natoil is the supplier of SIMOPS cranes to Valhall Flank North (VFN) order of 8 November 2002 October 2002: West Epsilon (WE) starts the assignment on Valhall Flank South (VFS) Design and production of hatches and beams was carried out by Bjørge Offshore in Stavanger. The facility was carried out in Rotterdam BP requires Smedvig to install so-called ”dropped object” hatches on the BOP deck Heerema (Tønsberg) was the main contractor for BP. In the order it is specified that the SIMOPS crane must be identical to the one on VFS. The anti-collision system was an option in the order (spec.6.5) August 2002: After start-up on VFS, the employees were given location and crane specific training on the SIMOPS crane by personnel from Natoil After this the training is communicated from person to person Instructor with inadequate competence (inadequate training programme): Training from person to person is inadequate. Activities Regulations Section 19 relating to competence. The HSE directive 26, section 6.11.4 Normal : All training to be done by qualified personnel appointed by the line management New: All personnel who have received training can be used as instructors 5.2.1
2 Normal : All safety systems must be a part of the FAT programme New: FAT did not comprise checking of the anti-collision system. Cause and event analysis Non- conformity Barrier failure 25 November 2002 the scope was extended to include the anti-collision system for VFN (og VFS) The anti-collision system was back-ordered for the SIMOPS cranes for VFN and VFS 12 December 2002. Executed as part of crane delivery for VFN FAT (Factory Acceptance Test) was carried out 10 April 2003 Inadequate inspection under FAT (inadequate test programme): FAT lacks a description of the anti-collision system, lack of testing and documentation of the system was not discovered. Activities Regulations Section 14 relating to facility and commissioning, ref. Machinery Regulations Section 7, attachment 1, subsection 4.2.4 inspection before use. FMEA completed 23 January 2003, as built 25 April 2003 Deficiencies in FMEA (inadequate safety analysis): Management Regulations Section 13 regarding general requirements to analyses, Activities Regulations Section 43 relating to classification, Machinery Regulations Section 7 ref. attachment 1 5.2.3 Normal: The FMEA should be a documentation of the effect of failure modes on the operation of the crane including safety system 5.2.2 New: The anti-collision system of the crane is not part of the analysis The mechanical completion check list made by Natoil 11 April 2003 includes check of mechanical completion for limit switches ”boom up” and ”telescope out”.
3 Normal: Certificate of application in accordance with AF Section 14 og NORSOK R003N chapter 5.1 New: Maritime (load test) certificate Cause and event analysis Non-conformity Barrier failure Inadequate certification of application and approval of the SIMOPS crane (insufficient preparation for use): The crane does not have a Certificate of application. Instead a load test has been carried out with maritime certification Activities Regulations Section 40 relating to use of work equipment, ref. Regulation relating to use of work equipment section 14, Inspection of work equipment The Activities Regulation Section 44 relating to Maintenance programme subsection f) ref. NORSOK R-003 N subsection 6.1 BP’s Guide for lifting equipment document no 1.70.010 chapter 8.5.3 BP’s HSE directive chapter 26 6.3 Normal: All safety systems must be a part of the test programme New: Commissioning does not comprise the anti-collision system Commissioning for the SIMOPS crane to be carried out approx. 7 July 2003 Inadequate inspection during commissioning (inadequate procedures relating to change): Missing description of the anti-collision system was not discovered Activities Regulations Section14 relating to completion The Machinery Regulations Section 7, Attachment 1, subsection 4.2.4 Inspection prior to use Probably 30 May 2003 Allum Marine as issues Certificate of application in May 2003. This was done while the VFN facility was at the building site in Tønsberg Certification carried out in accordance with the requirements of the Maritime Directorate’s regulations The certificate does not mention testing of the crane’s safety systems, and no reference has been made to criteria for the scope of the testing – nor acceptance criteria. The certificate does not fulfil the requirements of a Certificate of application 5.2.4 5.2.5 The document ”Functional Design Specification, Crane” dated 25 April 2003 mentions briefly that the anti- collision system has been installed and its mode of operation The document describes the crane ”as built”, and was available on the computer system for personnel on VFN.
4 Cause and event analysis Non-conformity Barrier failure WE arrives on VFN approx 4 - 6 August 2003 Normal: RFO certification is a confirmation that all systems have been checked and described in the documentation New: It was not recorded that a description of the anti-collision system was missing from the operating manual Deficiencies when taking over from project to operation, RFOC (inadequate change procedures): Missing documentation for the anti-collision system was not discovered during the take-over from project to operation. Activities Regulations Section 14 relating to installation and commissioning The Machinery Regulations Section 7, Attachment 1, subsection 4.2.4 Inspection prior to use Activities Regulations Section 18 Start-up and operation of facilities Documentation of maintenance and operation inclduing the SIMOPS crane must be a part of the take-over documentation No records concerning faults of the anti-collision system in the RFO Take-over from project to operation : RFOC (ready for operation certificate) form was prepared 6 August 2003 Consent to use VFN was given 14 July 2003 Hook up starts approx. 4 august RFOC shall provide an overview of outstanding work on the SIMOPS crane The RFOC check list describes: Operational Manual available in Dokumentum, i.e. the operations manual is available in an electronic database 5.2.6
5 Normal : The Certificate of application must be easily accessible on the facility New: Certificate/Certificate of application cannot be produced until three weeks after the incident Cause and event analysis Non-conformity Barrier failure BP cannot produce Certificate of application for the SIMOPS crane until 21 April 2004 BP has now started using the SIMOPS crane on VFN. No Certificate of application exists on the facility Natoil was out 14 August 2003. The proximity switch (boom angle limit switch) was damaged during work on the window washer system on the SIMOPS crane Natoil replaces the proximity switch. Closed 10 September 2003 (The report has been erroneously dated to 9 October.) No documentation of function testing after the repair work Insufficient documentation (document missing): Certificate of application is not available on the facility. BP did not know if a Certification of application existed. Activities Regulations Section 14 relating to facility and commissioning ref. NORSOK R-003 N subsection 18.104.22.168 BP’s Manual for lifting equipment subsection 8.3 relating to files offshore During the period 1-10 September 2003, the crane was in daily use, ref. form for daily check of SIMOPS crane on VFN. This in spite of the fact that the switch was inoperable. The SIMOPS crane is operated while the limit switch is defective (non-conformity with procedure): Regulations relating to use of working equipment Section 15 subsection c) working equipment which could involve special danger in use Inadequate testing: This is work on the safety system, and consequently it should be documented Activities Regulations Section 28 relating to Actions during conduct of activities, ref. NORSOK R-003 N subsection 6.1 Activities Regulations Section 83 relating to lifting operations ref. NORSOK R-003 N subsection 5.5.6 Normal: The lifting equipment must never be operated when parts of the safety system are inoperable New: The SIMOPS crane is operated while a switch is defective 5.2.7 5.2.8
6 Normal: Adequate user documentation must be available in the crane manual New: Documentation from the crane supplier is not available on the facility Cause and event analysis Non-conformity Barrier failure BP has now started to use the SIMOPS crane on VFN. Documentation is missing from the crane manual. Documentation from the crane supplier is not available on the facility, or it is inadequate: -maintenance procedures - description of anti- collision system - operating instructions User manual (crane handbook) is insufficient Missing /inadequate documentation for the SIMOPS crane: Documentation for the SIMOPS crane is non-existent or not available to the user. Activities Regulations Section18 relating to start-up and operation of facilities Activities Regulations Section 14 relating to facility and commissioning ref. NORSOK R-003 N subsection 22.214.171.124. (crane handbook must be available) Activities Regulations Section 83 relating to lifting operations NORSOK R-003 N subsection 4.1 f) Lifting equipment manual subsection 8.3 relating to files offshore. Basic crane operator training. The relevant personnel have completed the basic requirements for operating a 20 tonne hydraulic crane General crane operator training is required to operate a SIMOPS crane, (Minimum G20) 5.2.9
7 Normal: BP checks and ensures that training is in accordance with requirements New: BP has not verified the location and crane-specific expertise Normal: Competence requirements include basic training and location-specific training for the crane to be operated New: Location-specific training has not been provided for the SIMOPS crane with the equipment on VFN Cause and event analysis Non-conformity Barrier failure Inadequate inspection of requirements for crane- and location-specific training (insufficient QA programme): BP has not verified the training. No training has been carried out on the anti- collision systems, as the training material does not contain any description of it. Activities Regulations Section 19 relating to competence, ref NORSOK R-003 N subsection 4.5.1 relating to training of operators. Crane- and location-specific training. The crane training from VFS was carried on to VFN by having a crane operator who had already been ”cleared” act as an instructor for the new crane operator. The training was given in August 2002 before the anti-collision system had been ordered and installed on the SIMOPS cranes at VFS. Personnel on VFN and WE have no knowledge of the anti- collision system and its operation Crane- and location-specific skills were inadequate (insufficient competence) Crane operators do not have knowledge of the anti-collision system. Activities Regulations Section 19 relating to competence, ref. NORSOK R-003 N subsection 4.5.1 relating to training of operators. Activities Regulations Section 40 relating to use of work equipment, ref. Regulations relating to use of work equipment, Section 10 relating to training, drills and instruction of employees. Through the supervisor the field manager is responsible for implementing training on the SIMOPS crane, ref. HSE directive 26 Demands will be made on safeguarding competence. This entails making demands on, verifying and maintaining this competence through exercise, drills, training and education 5.2.10 5.2.11
8 Normal: Work on safety system is evaluated with high criticality New: Planned work on safety system defined as ”non-critical” Cause and event analysis Non-conformity Barrier failure Natoil is requisitioned to repair the defect Inadequate risk assessment during the planning of work on safety systems. (The potential risk is not understood): The work is defined as non-critical. Activities Regulations Section 43 relating to classification and 45 relating to planning and priorities. 4 January 2004 Work order (KAO-032703) for wire for limit switch on telescope is broken ”replace wire and limit switch if necessary” At the turn of the year 2003/2004, a defect in the limit switch for telescope out was discovered Natoil also establishes a defect in the limit switch for boom angle and hook up Approx. 17-19 February 2004 Natoil repairs wire on limit switch for telescope out BP stopped operation of the crane owing to lack of parts 19 February 2004 Natoil cannot complete the repair of the limit switch for boom angle and hook up, owing to lack of parts Subsequent facility of anti- collision system on VFS 25 October 2003 5.2.12 Normal: Handling of non- conformity in BP New: No handling of non-conformity 19 February 2004. Natoil reports that there is no documentation for electricity and hydraulics for the SIMOPS crane 5.2.13 Inadequate handling of non- conformities (insufficient QA programme) Management Regulations Section 20 relating to handling of non- conformities
9 Cause and event analysis Non-conformities Barrier failure 24 February 2004 Parts for the two other limit switches arrive at VFN/BP 21 February 2004. A work order is established in Work Mate for repair of the anti- collision system Work order for replacement of upper hook limit switch (KAO- 033706): ”Limit switch is defective/broken. The function is tested after facility and connection.” Normal: Work on safety equipment must be carried out or checked by competent personnel New: No inspection by competent personnel (expert activity) Inadequate planning of work on safety system (insufficient planning): Work on safety systems is planned with personnel without the necessary expertise and without the necessary drawings. No planned verification by expert body. Activities Regulations Section 44 relating to maintenance programme subsection f) ref. NORSOK R-003 N subsection. 6. Inspection, examination and testing subsection 6.1 Activities Regulations Section 43 relating to classification and 45, planning and prioritisation, Activities Regulations Section 40 relating to work equipment, ref. regulation relating to use of work equipment Section 14 inspection of work equipment. Work order for replacement of boom angle limit switch XS440 (KAO-033708): ”Defective boom angle limit switch replaced. The function is tested after facility and connection” 5.2.14
10 Normal: Work on safety system to be checked by expert New: Work on safety system without inspection by expert New: Drawings missing Normal: Drawings available for work to be done Cause and event analysis Non-conformities Barrier failure 26 February 2004 Automation expert connected to Valhall (SWAT) replaces ”hook up” limit switch on SIMOPS crane VFN 27 February 2004 Automation expert from Valhall (SWAT) replaces ”boom angle” limit switch on SIMOPS crane VFN Work on safety systems with the necessary technical Documentation (Documentation missing): Activities Regulations Section 28 relating to Action during conduct of activities. The Machinery regulations, attachment 1 subsection 1.7.4 og subsection 4.4.2. Activities Regulations Section 40 relating to Use of work equipment, ref. regulation relating to use of work equipment Section 9, Information to employees 26 February 2004: ”Have replaced the entire limit switch. Test OK, NN” Instrument 27/02/04: ”Have replaced 90-xs-128057 with new limit switch. Test OK, NN” The switches are replaced without access to electric or hydraulic drawings According to interviews the switches are installed in the same way as the ones removed - the automation expert makes a sketch before replacing them On request the automation expert feels competent to replace the switches The automation expert has no experience with work on cranes Work on safety systems was carried out by personnel without the necessary skills (insufficient competence): Activities Regulations Section 19 Competence Activities Regulations Section 40 relating to Use of work equipment,ref. regulation relating to use of work equipment, Section 9 Information to employees, 10 Training, drill and instructions to employees and 14 inspection of work equipment BP’s manual for lifting equipment Section 9.5 (i.e. requirements related to use of competent controller) 5.2.15 5.2.16
11 Cause and event analysis Non-conformities Barrier failure During the period August 2003 - 2 April 2004 several other repairs have been carried out on the SIMOPS crane 19 February 2004: Repair of loop on hook block??. (carried out by Natoil) 30 December 2003: Loose cable tray at the top of boom 20 February 2004: Motor for window cleaner inoperable Faulty facility means that the limit switch is disconnected The SIMOPS crane does not have a functioning anti- collision system New: The fact that the crane’s safety system was inoperable was not known Normal: Status of the crane’s safety system must be known Certain parts of the crane’s safety system do not function. Status unknown (insufficient preparation before use): Lifting appliances must never be operated if the safety systems or parts of the safety systems are out of order. Activities Regulations Section 24 relating to safety systems Activities Regulations Section 83 relating to lifting operation, ref. NORSOK R-003 N subsection 5.5.6 relating to safe use of lifting equipment After the repair the limit switch for the ”boom angle” was installed with incorrect polarity. It is not known whether it was installed incorrectly prior to the repair 5.1.1
12 Cause and event analysis Non-conformities Barrier failure 1 April 2004 The whole work team involved in the incident came onboard the same evening and start their watch at 23:00. Schlumberger is on downtime owing to equipment fault Approx. 01:15 Overall supervisor Schlumberger has been on duty for 16 hours and cannot assist in the work relating to troubleshooting on this equipment Normal: The crane operator is familiar with the crane’s condition before use New: The crane operator has limited knowledge of the crane’s condition/ status of corrective maintenance The crane operators on VFN have no access to the maintenance system (Workmate ) Repairs are not recorded in the maintenance system, only in the daily inspection form for the crane There were, e.g. multiple faults in the window shield wipers/washers during the period Nov/Dec 2003 og March 2004. Only the flank foreman on VFN has access to the maintenance system Lacking/insufficient access to the maintenance system (insufficient work preparation/basis for work). The crane operator on the SIMOPS crane does not have access to the maintenance system. Activities Regulations Section 23, Use of facilities (relating to status of maintenance) Activities Regulations Section 14, Installation and commissioning, Ref. NORSOK R-003 N subsection 126.96.36.199 (requirements regarding available documentation) Activities Regulations Section 83, Lifting operations, ref. NORSOK R-003 N subsection 188.8.131.52 follow-up of maintenance. Activities Regulations Section 24, Safety systems. BP’s HSE directive 26, chapter 6.3. 5.2.17
13 Cause and event analysis Non-conformities Barrier failure The danger of the crane touching the hatches on the BOP deck was not assessed in SAG (insufficient experience transfer / risk was not assessed): Despite previous experience, collision with WE is not considered a risk. Compensatory action is not implemented Management Regulations Section 22, Improvement (Experience transfer) Activities Regulations, Section 83, Lifting operations, ref. NORSOK R-003 N subsection 4.1 Activities Regulations, Section 28, Actions during conduct of activities (planning of work) Activities Regulations, Section 40, Use of work equipment, ref. regulation relating to use of all types of work equipment and Section 7 relating to the employer’s general obligations and Section 43 regarding use of all types of working equipment New: Only objects falling from the top deck to the Xmas tree deck were evaluated in SAS Normal: Falling objects from WE should have been a part of the risk assessment Safe work review (SAG) is initiated by Sclumberger’s personnel and implemented by the involved. The personnel have experience from WP and Maersk Guardian, where they also ”bumped into" the hatches on the deck of MG above Work permit prepared and approved Since the crane operator is unfamiliar with the anti- collision system, he should initiate measures to prevent collision with WE BP has not identified risk in the operation of the crane when the anti-collision system is out of order BP Well intervention supervisor (WIS) night shift, decides to use Sclumberger personnel to assist ABB in the work on well N14. Schlumberger personnel usually operate the SIMOPS crane, ref contract with BP subsection 5.8.1 5.2.18
14 Cause and event analysis Non-conformities Barrier failure The crane operator initiates cleaning of window in the operator’s cab owing to poor visibility. The skylight is not cleaned. The window cleaning system was out of order The window cleaner on the roof window is out of order Normal: Good visibility to the work area for the crane New: Lifting operation carried out without the necessary visibility There is no inspection of the crane before use (inspection prior to use). The crane operator does not have access to the maintenance system, and consequently not status for the SIMOPS crane No inspection of the anti-collision system. The crane operator is unfamiliar with the operation of the system (not referred to in the crane manual), and has not had training in the system No check of the safety system. No check of status for maintenance. No function testing. Normal : Operator/user of the lifting appliance has an independent responsibility to ensure that the lifting appliance is in proper condition New: inspection prior to use is limited to inspection of the oil level and visual inspection Poor visibility through the roof window (emphasis on time not safety): Cleaning is omitted because it would require work permit for working at heights. Therefore, a choice was made to work with poor visibility through the roof window. Activities Regulations Section 31, Arrangement of work, Section 32, Ergonomic aspects and the Facilities Regulations Section 19 relating to ergonomic design Activities Regulations Section 28, Actions during conduct of activities and 29, Monitoring and control 5.2.19: Inadequate procedure for daily check of the SIMOPS crane (insufficient procedure): Activities Regulations Section 22, Procedures. BP’s HSE directive 26 subsection 6.1.5 Activities Regulations Section 40, Use of work equipment, ref. regulation relating to use of work equipment, Section 14 relating to inspection of work equipment. 5.1.2: Inadequate inspection prior to use of the lifting appliance (insufficient preparation): Activities Regulations Section 83, Lifting operations ref. NORSOK R-003 N subsection 5.5.6 relating to safe use of lifting appliances Activities Regulations Section 19, Competence, ref. NORSOK R- 003 N subsection 184.108.40.206 Form prepared by BP for daily checks does not describe inspection of safety systems New: The check list is insufficient Normal : Check list for safety systems 5.2.19 5.1.2 5.2.20 Flagman fetches a high-pressure washer and washes the side windows of the operator’s cab. No cleaning because this would require work permit for working at heights.
15 Operation on well N14 starts. Well hatch is lifted off and put on N2 Cause and event analysis Non-conformities Barrier failure As per agreement in SAG meeting, a crane chaser, flagman and crane operator are directly involved in the lifting operation. Flagman and crane chaser put on vests Flagman uses lifeline Work on Xmas tree carried out together with ABB (pulling of plug BPV( back pressure valve)) Crane chaser goes down to the Xmas tree deck and manages the lifting of the plug from well N14 via radio. On the top deck work starts on re- installing the well hatch. Manning level during operation is not according to procedure (non-conformity with procedure): The jobs of the crane chaser and the flagman are mixed Activities Regulations Section 83, Lifting operations, NORSOK R-003 N subsection 220.127.116.11 BP’s HSE directive no. 26 chapter 6.1.6-7 clearly states the responsibilities and obligations of crane chaser and flagman New: Flagman carries out the work of the crane chaser directing the load not following the movements of the crane. Normal: Flagman directs safe movement of crane and hook load Flagman holds the guide rope fixed to the well hatch Flagman shoves the well hatch to position it over the hole. Flagman does not pay attention to the boom top The roles of crane chaser and flagman mixed during the lift. 5.2.21
16 5.1.3 Normal: Procedure for fastening is followed New: ”Dropped object” hatches were not fastened according to procedure 5.1.4 Cause and event analysis Non-conformities Barrier failure The crane operator extends the telescope to reach N14 with the well hatch. The boom is run into the deck of WE The crane operator has to lean forward during the lift to get a better view Smedvig had not made sure the ”dropped object” hatches were fastened according to procedures (non-conformity from procedure): Activities Regulations Section 22, Procedures Procedure WE-02-06-05,14 incl. facility and maintenance instruction. PBO-8250081-P-04 Hatches are not fastened according to procedures Smedvig’s procedure states requirements for work with this hatch. The procedure describes how it is to be fastened with chains and shackles to beams The boom lifts the ”dropped object” hatch on WE from its fastening 2 April 2004 approx. at 06:15 the ”dropped object” hatch from WE falls 14.9 m straight towards VFN Schlumberger has received assurances from Smedvig that the hatches cannot fall down New: The crane operator has no inspection with the position of the boom Normal: The crane must not be driven into obstructions (obstacles) Inadequate inspection of the position of the boom (insufficient self-monitoring to avoid errors): Compensatory actions to maintain inspection with the boom top were not initiated Activities Regulations Section 19, Competence, ref. NORSOK R-003 N subsection 18.104.22.168 and 4.1.h) BP’s HSE directive 26, subsection 6.7 Could have lowered the boom (two operations). Chose to extend the telescope (one operation)
17 Cause and event analysis Non-conformity Barrier failure The flagman is hit and injured in his right foot and face/jaw Notification of SAR and emergency preparedness on WE works The ”dropped object” hatch hits both the flagman and the well hatch when falling The well hatch is considered a hazard, and is set down by crane chaser when he arrives The crane operator, work supervisor from Schlumberger and BP’s WIS rush up to help the injured flagman The well hatch starts to swing approx. 1.5 m above the deck Nurse and OIM on WE are notified SAR from Ekofisk field centre is requisitioned The injured is transported onshore after receiving first aid treatment Normal : Crane operator must not leave the crane with load hanging from the hook. New: Crane operation leaves the crane with load hanging from the hook. The remaining hatches on WE are secured Inadequate securing of load (non-conformity from procedure): Activities Regulations Section 83, Lifting operations, ref. NORSOK R-003 N subsection 5.5.13. BP’s HSE directive 26 chapter 6.5.1. The crane chaser comes running up from the Xmas tree deck 5.2.22
18 Cause and event analysis Non-conformity Barrier failure 2 April 2004. Approx. at 17:00 Investigation group from the PSA/Police and BP arrive on VFN 2 April 2004 The authorities are notified. The PSA is notified at 07:18 In the notification the ”dropped object” hatch which fell down was reported to weigh 100 kgs, but it turned out to be 357 kgs. Natoil is requisitioned to go to VFN to assess the SIMOPS crane, and to find out if there is an electronic log in the crane. Arrival 4 April 2004 The accident area is secured There is no electronic log in this type of crane
19 Cause and event analysis Non-conformities Barrier failure Faults are established in the facility of limit switch for boom up. Limit switch is damaged It is established that the limit switch for hook up is broken off. Natoil does not have parts to repair the two limit switches This could have happened when the hatch fell down The PSA gives direct order prior to departure 5 April 2004 The order entails temporary termination of work with similar cranes 21 April 2004 PSA’s investigation group receives Maritime loading certificate for the SIMOPS crane on VFN from BP