Podcast: Catastrophe At The Hands Of Legacy Design Issues

Traci: You know, it's the same old, same old. I can't believe that we're about to enter into August this weekend. I don't know where the summer is going. I'm not doing a whole lot, but it's flying by as usual. So, I guess that happens when we get older.

Trish: I think it does. Yes.

Traci: Well, just a few days ago was the 15th anniversary of the Mumbai High North Platform disaster located in the Arabian Sea. This incident started off as a rather mundane issue. The cook at the site was injured and needed evacuation. A series of unfortunate events precipitated by weather conditions caused 22 deaths that day. All said, 362 people needed to be rescued. That was just a quick overview on my part. Trish, can you give us a little more detail into what happened that afternoon in 2005?

Trish: Yeah. Sure. So, there was a whole lot of things that went wrong on that particular day as we often see in these incidents. So, as you mentioned, the cook on what was a multi-purpose support vessel had actually injured his hand, he'd cut off two of his fingertips. And so, he needed to get back on the platform complex for medical treatment, but there was a problem. There was a monsoon bearing down. So, all of the helicopter flights had been stopped. There was no really effective way for that injured person to be taken off the boat and put back onto the platform. After a number of discussions, the offshore installation manager finally agreed, at first, he wasn't terribly sure about the idea of bringing the multi-purpose support vessel alongside to transfer the patient. But he eventually agreed because there was no other way to really effectively render the care to that injured person. And they agreed to do it via a basket using the cargo loading cranes because there was no effective way to bring the vessel alongside either.

Now, there was all sorts of different other issues that were going on. The vessel was having problems with its dynamic positioning system. It didn't have any dynamic positioning control as it came alongside either. It was just trying to use its reverse thrusters to maintain position in a very, very stormy sea. You can see that...we're seeing lots of different things go wrong at this particular point in time. After they had actually transferred the cook then there was a massive leave of the sea. A big wave came through and the helideck of the multi-purpose support vessel then struck, I guess, rise up on the platform. And that caused a high-pressure gas release. There was then an explosion and a very intense fire that followed. It escalated rapidly, and eventually, the platform was abandoned. Within two hours, it had collapsed into the sea because of the ferocity of the fire. There were several adjacent platforms. There was a lot of bridge-linked platforms in that area as well. And they were all effectively abandoned and damaged as part of it. The multi-purpose support vessel was eventually towed away and it did later sink, but there were six divers in saturation chambers that were working with the vessel that were abandoned as well. And they were eventually rescued about 36 hours later. I couldn't imagine what it was like for those six people trapped in saturation chambers underwater waiting for someone to come and get them while there's a fire burning on the surface. A range of things that went wrong, a range of decisions that were made for the very best reasons of providing care and first-aid to the injured party. But tragically, as you said, 22 people died that day.

Traci: My anxiety level was going up as you were describing it. It’s almost like a movie scene that you were describing and I can picture the storm coming in and them rushing around trying to get this all together. And it just seems like everything that could go wrong did go wrong that day. I know that there's been a lot of regulatory progress made since this incident. Can you detail some of those specifics?

Trish: We certainly saw that within India itself where this was governed from, they did then set up a regulatory body to provide oversight of their offshore oil and gas industry. That was a big step that was taken there. We saw some changes to how riser is treated, you know, making sure that there's adequate riser protection in place. In this case, as well, it was interesting that the risers weren't protected beneath the shadow of the platform, but they were also on the prevailing weather side as well. You would want to bring a boat in on that side because that's where you're going to potentially get the best weather to deal with coming alongside, yet that's where the risk was exposed to where those risers were. Things like jackets on the risers, protective means around them, having them under the shadow of the platform, all of these things are now very commonly done. Riser isolation as well. When that gas line was ruptured, there was no effective way to isolate it quickly. There's a lot of contents of gasoline and we talk about riser isolation a lot in different things. And people say, "Well, you should just have isolation valves and close them off." And that's a really important part.

But the thing you also need to remember is there's a lot of quantity in there that unless your valves are very close together and the breach is right between the valves, then there's going to be a lot of depressurization of gas that's going to come out. There is still going to be a substantial release of gas, even when you do have isolation valves. But they are still very important to have. The location of where we build the riser as I said, you know, making sure it is adequately protected by the shadow of the platform is important. And we also saw some changes in some hyperbaric evacuation as well. So, how we're dealing with divers underwater in saturation chambers, how we can make sure that we can safely get them out. And sadly, there have been other instances where similar things have happened and divers have had to be abandoned and come back and collected later. You know, this is a concern when you've got people working underwater and they can't come to the surface without proper decompression processes taking place. There's no option to come to the surface. If they come to the surface, they will die, or they will be very severely maimed and injured as a result. We've got to have ways to bring them back safely from where they are because they are in a hostile environment relying on life support.

Traci: Yeah. Thinking of all of this happening, why weren't these sorts of regulations in place beforehand? There were no other incidents similar, this was just, you know, pardon the pun, but was this the perfect storm that caused all of these incidents to happen in succession to lead to catastrophe?

Trish: No, I think in a lot of parts of the world, in the very early days of offshore exploration, we saw expedited establishment of platforms. We wanted to get the oil out quickly and the gas out quickly, so people went in and they built things and they just got it done. There are issues with legacy design issues. If you've got a platform that's been there for a while, then chances are it was built to a different design standard to what we build it to today because we've learned the lessons of the past and where we've made mistakes. And so, the idea of having some of these older rigs around, we need to make sure that we adequately assess the risk of incidents and make sure that we've got the processes in place to deal with them. But even more important than that, if we can actually retrospectively fit or redesign aspects of it to apply some of the safety that we've now learned about through the hard way. And this is not the first rig disaster that caused us to reconsider how we do things. Piper Alpha changed how we manage all sorts of aspects of a rig, in particular, permit to work systems. Montara in the Timor Sea in Australia. Most people don't know about Montara. It was quite a significant fire and oil spill that occurred on a rig after a well blowout. No one was killed in it though, so that's why it doesn't get a lot of attention possibly.

But that led to the Australian regulator incorporating safety, that was environmental management in their remit. Obviously, Macondo, we've seen changes in the Gulf of Mexico following Macondo and some of the aspects of deepwater drilling and those sorts of things. The list goes on and on where we've had incidents and then we have changed what we're doing in response to those incidents. The Alexander Kielland, I believe it was, was a combination facility that sank in rough weather as well. You know, Ocean Ranger off the coast of Canada. There's an endless list tragically of rigs that have had problems or facilities that have had problems. What we need to get better at in industry is actually fixing those problems before we wait for the next one to tell us what regulation to pass or what law to put in or what thing to fix. That's where I think we're letting ourselves down. We're not assessing the risk adequately and assessing it broadly enough to understand what we need to do to make sure we don't have an incident occur.

Traci: Now, you talk about assessing risks, but how can you assess for every risk out there? To me this seems almost like an unforeseen, the cook gets hurt. It's not something that you think of when you think of an accident of this magnitude, it starts with somebody hurting themselves. How do you ascertain that type of risk?

Trish: That's very true. But there are...whilst the cook injuring his hand is not the sort of thing you would discuss in a risk assessment in reality, but you actually might discuss emergency medical evacuation for all sorts of reasons, particularly if it's a very rough sea. What would they have done had someone on the ship broken their leg because they slipped because the deck was leaning? It didn't need to be something as random as the cook cutting his hand. It could have been a very, very different scenario. The fact is that we need to be assessing the things that we can foresee. And I think if you go back and say, "Well, we've got a riser that sits in an exposed area, and we've got a vessel moving around that area and we've got rough seas and we've potentially got control issues of the vessel." You'd have to think it's possible that the riser could be struck by the vessel. That's not too broad a leap I don't think to be making in this scenario. It is too broad a leap to be saying, "Well, the cook cut his hand, therefore, we need to put him on the platform. And the only way we can do that is this." And I think that is too big a bone to be drawing. But we know that when we put something in the middle of the ocean where there are vessels moving around, there is a risk of ship collision. We assess the ship collision. We build the ship collision because we know it is a possibility. You put something stationary in the middle of the ocean where ships are moving, you have to be prepared for that to be hit by a ship.

That would be like putting a toll booth on a highway and expecting that no toll booth will ever be hit by a vehicle in the middle of a tollway. The fact is the toll booth is going to get hit at some point. So, we build barriers around the toll booth so that it doesn't get hit and people don't get injured when a truck loses steering control or blows a tire and accidentally hits a toll booth. So, there are some things that I think we can foresee reasonably. And the things that...you know, we can also foresee that weather prevents helicopter flights at times. Absolutely we know that. And that is why we also need to make sure that we have adequate emergency evacuation processes as well because if something else had have happened on that platform, they needed a way to evacuate in rough weather. Well, you can evacuate by helicopter in this particular instance. It's interesting to note that there were evacuation problems in this particular incident as well. So, there were eight lifeboats launched. So there were eight lifeboats on that rig, on that complex, and only two of them managed to be launched. There were an additional 10 life rafts, and only one of those was actually launched. So this is how we rescue people in an emergency, and it didn't work for a range of different reasons. So, there are some things that I agree you kind of go, "Well, that is a little bit farfetched." But for example, a helicopter crash into a rig is not unforeseen because helicopter fly through rigs all the time. You know, I wouldn't suggest we should be out there assessing whether a meteor is going to hit a rig. You know, there are some things that you go, "Well, that is just too farfetched." But talking about ships and aircraft hitting something that's sitting stationary in the ocean that ships an aircraft moved to I think you'd have to suggest that they're probably foreseeable issues. Aren't they?

Traci: Well, you're talking farfetched and we're also in 2020. So, I think that pretty much anything is possible, not to make light of the situation. But I think that, you know, the absurd happens every day now. You were talking of, you know, great analogy of the toll booth and putting up those barriers, something very easy to visualize in your mind. What is the lifespan of these platforms and when you put those barriers in place, then are there checks on those barriers that you have to do every year?

Trish: Yeah. So that would all be part of your structural integrity of your platform. You need to make sure that you are maintaining structural integrity in all parts of it, you know, including walkways and handrails, for example. They are an often neglected area of a platform from what I understand and, you know, they can cause quite significant incidents on the facility as well, but especially if they start to corrode away and can't then take the weight. But things like if you do have structures that are put in place to support or guard the risers, then yes, you do have to do the integrity inspection on them to make sure that they still have the right integrity level. You know, just like you might have a band around a tank on an onshore facility. You can't just assume because the band is there, the band working. You still have to inspect the band for cracks, for penetrations to make sure that it's going to hold if you need it to in an incident. So, even some of these passive safety measures that you put in place, you still need to assure the integrity of them over the life of the facility. And, you know, some of these facilities are built for, you know, 30-year life. Some of these 30-year life facilities are still operating 40 years later. So, life gets extended on facilities. If there's still more to be extracted, then life will be extended on the facility. And that's not necessarily wrong either, provided you do the appropriate risk assessment and integrity management activities to make sure that facility is as safe as it needs to be in that particular area and making sure that just because it's an older facility and it's had its life extended does not mean that it will be...you can't just assume it's going to be safe. You actually have to positively go out and check and maintain to get that safety.

Traci: Now, there was a tremendous oil spill that also occurred from this incident that they had to contend with. What sort of safety considerations had to be implemented for that cleanup? What do they do about the environmental cleanup that has to happen? Is there anything that they have to shore up in terms of safety for that?

Trish: Yeah. So, they obviously need to make sure that they capped the wells appropriately so that it didn't create further issues and didn't have further leakage occurring. I think the spills stretched for about 10 nautical miles from that particular incident, and it did happen during a monsoon as well. So, that makes a lot of your traditional oil spill response impossible. You know, you can't be out there with booms in a monsoon sea to try and contain the spill. So, that's certainly a challenge that they had at that particular point in time as well. It's really about making sure that you had appropriate isolation so that you could deal with the sub-sea structures and make sure that you could effectively kill the wells so that it wasn't going to continue to release hydrocarbon into the environment at that point. And we saw with Macondo, the challenge in killing that well eventually. It took several months for that one to actually be shut off.

So, I guess there's sort of the key things of what means if you got to actually stop the well releasing product, as well as dealing with the hydrocarbon you've got on the water that is potentially depending on where the facility is. It is likely to hit a shoreline somewhere, so you need to have onshore cleanup as well. Decontamination of sea life, in particular, birdlife is a big issue as well within a marine oil spill environment. That can be quite challenging. We've seen that happen a number of times. You know, we've seen shocking incidents around the world in terms of oil spills and some of the ecological damage it can do. So, you've got to make sure that you've got adequate response to minimize the quantity of the spill and then some way to try and tackle that spill in that instance as well. And that's not always easy. That's why we need to have detailed environmental management plans that have substantial oil spill response plans. So, first of all, let's get it right so we don't have the spill in the first place. But if it does happen, how are we going to respond to minimize the impact on our environment as well as the safety perspective? We're trying to minimize the impact on the people, but for the environmental perspective, we need to protect that environment too and minimize any impact that we have in that space.

Traci: Trish, is there anything you'd like to add? We've covered a lot of ground here, but is there anything you want to add in terms of lessons learned from this incident?

Trish: Look, I think the case for me is to make sure that you do think far and wide about the different implications or the different scenarios that could occur. You know, if you're building a platform in a monsoon area, you got to make sure it's capable of withstanding a monsoon. You got to make sure you can actually deal with it in that instance as well. So, you have to be willing to think of some of these things that are perhaps a little bit more strange. How do you deal with a natural hazard triggered technological accident, a Natech event? You know, these things occur; a cyclone, a monsoon, a hurricane. How are you going to respond when there's no response team coming to help you because they're all busy dealing with the broader societal impact that's occurred? So, sometimes you need to be able to think about...it might not be practical to implement control measures to prevent an incident occurring within a Natech situation. So, you've got to make sure you've got really robust response processes to deal with it. And that's where from a Natech perspective, it's important to refocus your shift. You may not be implementing control measures to prevent the earthquake because you actually can't, but you've go to make sure you've got robust control measures to address mitigating the impact of that earthquake, for example. So, a range of different natural events can cause all sorts of issues on our industrial facilities and how we deal with them. We need to be prepared to deal with that. And I think whilst you wouldn't necessarily say, "Well, this was an Natech event," a natural hazard had a significant part to play in this particular event as well. So, I think there are still learnings to draw from that perspective there. I guess it's probably the key takeaways is you got to be creative in thinking about what could go wrong. You might not always be able to prevent that going wrong. You've also got to make sure that you do take into account that sort of consequence in your mitigation strategies and response.

Traci: Well, proving once again, you are a great teacher digesting all the lessons learned from incidents in the past, and I'm sure that more than one of our readers wishes you could sit in on risk assessment meetings with them because of your critical thinking skills. Unfortunate events happen all over the world and we will be here to discuss and learn from them. On behalf of Trish, I'm Traci and this is "Process Safety With Trish & Traci."

Trish: Stay safe.

Check out all the episodes of Process Safety With Trish & Traci.

Want to be the first to know? Subscribe and listen to Process Safety With Trish & Traci on these platforms