ce

VvanCA,

Deepwater Horizon

ursg thas bcatecate

and thconceater Hrillingpraise s

on the Grand Banks of Newfoundland during a severe winter stormpacking 90-knot winds and high seas. The Royal Commission on theOcean Ranger Marine Disaster indicated that a huge wave hadswept over the rig, breaking a porthole in the ballast control room,shorting circuits, opening ballast inlet valves and causing the rig tolist to an extent that the crew could not rectify. All 84 crewmembers died, at least some of which during or following attemptsto transfer survivors from the lifeboat to a vessel without rescuefacilities (Hickman, 1984).

Abbreviations: BOP, blowout preventer; DPO, dynamic positioning operator;EER, evacuation, escape, and rescue; ESD, emergency disconnect system; HOF,human and organizational factors; MODU, Mobile Offshore Drilling Unit; OCS, OuterContinental Shelf; POB, Personnel on Board; PSA, Petroleum Safety AuthorityNorway; RIF, risk inuencing factor; USCG, U.S. Coast Guard; TSR, temporary saferefuge.* Corresponding author. Tel./fax: 47 99 02 41 71.

Contents lists available at

Journal of Loss Prevention

journal homepage: www.

Journal of Loss Prevention in the Process Industries 25 (2012) 148e158E-mail address: jon.espen.skogdalen@gmail.com (J. E. Skogdalen).time incidents, gas exploded up the wellbore onto the deck of therig and caught re. Eleven workers were killed in the explosions(DHJIT, 2010). Evacuation, escape, and rescue (EER) operationsplayed a vital role in safeguarding the crew members lives. Twolifeboats were launched in an effort for the crew to evacuate the rig,however eleven crewmembers were left behind. Because it was notclear that they could safely reach the two remaining lifeboats at theopposite end of the Mobile Offshore Drilling Unit (MODU), themaster elected to launch a life raft. Because of intense heat andsmoke, and crew fears that the raft would burn or melt, the life raft

associated with EER operations from offshore installations asillustrated in the examples below.

In 1980, 123 people were killed when the Alexander Kiellandplatform capsized and sank in the Norwegian sector of the NorthSea. A fatigue crack in one of the legs caused the oating hotel tolose one of ve legs and capsize. Lifeboats were smashed againstthe rigs legs, causing them to break. Only one lifeboat waslaunched successfully. Many of the men were swept away. Only 89of the 212 men onboard survived (Nsheim, 1981).

In 1982 the Ocean Ranger semisubmersible capsized and sank1. Introduction

The Deepwater Horizon accidentthe 20th of April 2010 raised seriouslevel of offshore drilling. The Deepwconsidered to be a safe and efcient das BP ofcials were visiting the rig to0950-4230/$ e see front matter 2011 Elsevier Ltd.doi:10.1016/j.jlp.2011.08.005offers a limited insight into the level of success of the EER operations. Several technical and non-technicalimprovements are suggested to improve EER operations. There is need for a comprehensive analysis ofthe systems used for the rescue of personnel at sea, life rafts and lifeboats in the Gulf of Mexico.

2011 Elsevier Ltd. All rights reserved.

e Macondo blowout onrns regarding the safetyorizon offshore rig wasunit. The very same dayeven years without lost

was launched with only seven crew members aboard. Judging thatthere was not enough time to launch another life raft, the masterand three remaining crew members jumped over 50 feet into thewater. No casualties were reported as a result of the EER operations(USCG, 2011). Two days later, the Deepwater Horizon rig sank(DHJIT, 2010). The results of the EER operations from the DeepwaterHorizon must not be taken for granted. There are several risksEvacuation, escape and rescueMajor accident were reported as a result of the EER operations from the Deepwater Horizon, the number of survivorsKeywords:evacuation sequence is illustrated. The escape and evacuation sequence from the Deepwater Horizonoffshore drilling platform is reviewed based on testimonies from the survivors. Although no casualtiesEvacuation, escape, and rescue experienincluding the Deepwater Horizon

Jon Espen Skogdalen a,*, Jahon Khorsandi b, Jan ErikaDepartment of Industrial Economics, Risk Management and Planning, University of StabCenter for Catastrophic Risk Management, University of California, Berkeley, Berkeley,

a r t i c l e i n f o

Article history:Received 10 May 2011Received in revised form10 August 2011Accepted 11 August 2011

a b s t r a c t

When a major hazard occa vital role in safeguardinwhere most of the crew hcan be divided into threefactors (RIFs). The RIFs areAll rights reserved.s from offshore accidents

innem a

ger, 4036 Stavanger, NorwayUnited States

on an installation, evacuation, escape, and rescue (EER) operations playe lives of personnel. There have been several major offshore accidentseen killed during EER operations. The major hazards and EER operationsgories; depending on the hazard, time pressure and the risk inuencinggorized into human elements, the installation and hazards. A step by step

SciVerse ScienceDirect

in the Process Industries

elsevier .com/locate/ j lp

Before the testimonies are reviewed EER operations are system-atized according to denitions, sequence, success factors and RIFs.Hazard prevention, control and mitigation are not covered in this

(environmental, re, smoke etc.). The command and control hazardsare those due to poor procedures, inadequate communications and

ion in the Process Industries 25 (2012) 148e158 149In 1988 a medium gas condensate leak resulted in an explosionand re on board the Piper Alpha production platform in the NorthSea, killing 167 workers and leaving only 59 survivors, resulting inone of the worst offshore accidents ever. Many crew members losttheir lives because they were not able to successfully evacuate theinstallation (Leaoor, 2006).

A more recent example is the Usumacinta accident on October23, 2007, where 22 people died after launching the lifeboats andabandoning the mobile drilling unit. Various decisions such asopening the hatches or prematurely abandoning the lifeboatsresulted in the death of the crew (Leis et al., 2008).

When a major hazard occurs on an installation, EER operationsplay a vital role in safeguarding the lives of personnel by safelyremoving them from the danger zone. However, as shown in theexamples above, evacuation operations can have tragic outcomes,and although such accidents have hadmajor impacts on legislation,training, and operating procedures, the risks pertaining to EERoperations continue to exist. Therefore, there is a need for a furtherunderstanding of the performance of barriers (both technical andnot-technical) in EER operations.

1.1. Objective

Different accident scenarios cause different risk inuencingfactors (RIFs) during the EER operations. A RIF is dened as anaspect (event/condition) of a system or an activity that affects therisk level of this system or activity (ien, 2001). The objectives ofthis article are to:

1. Categorize offshore accidents according to RIFs during the EERoperations

2. Review the EER operations from the Deepwater Horizon basedon testimonies

3. Suggest possible improvements based on the ndings

Research related to EER operations during re in buildings isincluded in this study due to the similarities with offshore accidentswhich also often include res and in some cases explosions. The EERoperations from the Deepwater Horizon are reviewed based ontestimonies provided by the crew members during the Joint Inves-tigation by the Unites States Coast Guard and the Bureau of OceanEnergy Management. The joint investigation board conducted thehearings in several sessions. Session one was held May 11e12, 2010,and investigated the circumstances surrounding the re, explosion,pollution and sinking of the Deepwater Horizon. The second sessionwas held May 26e29, 2010, with the focus on gathering informationon the Deepwater Horizons materiel condition, crew qualications,emergency preparedness, and casualty timeline. The third session ofhearings, which could be considered the technical vericationphase, was held July 19e23, 2010, with the focus on the how andthe why of the accident. The fourth session was held Aug. 23e27,2010, with a focus on the recovery, analysis, and evaluation of thecritical drilling equipment. The fth session of hearingswas held Oct.4e8, 2010, with the focus on safety management systems, organi-zational decision making and safety culture (DHJIT, 2010).

Experience from the regulations and standards used in theNorth Sea are compared with the review from Deepwater Horizon.The review includes the sequence of events fromwhen the blowoutwas detected, until the crew was outside the platform safety zone(500 m) and thereby judged to be in safe distance from hazardscaused by the installation. There are several other studies related toEER which review the mustering phase but do not include theabandoning phase. However, there are several accidents related tothe abandoning phase, (e.g., lowering of lifeboats). The Abandon-

J.E. Skogdalen et al. / Journal of Loss Preventment phase is therefore included in this work.breakdown of safety management systems. The behavioral hazardsare those due to human factors as well as undesirable humanbehaviors.

1 It should be noted that Petroleum Safety Authority Norway (PSA) uses the termarticle. These activities inuence the RIFs during EER operations, andare described in research related to risk management (e.g. Aven &Vinnem, 2007).

2. Evacuation, escape and rescue (EER)

The terms evacuation, escape and rescue are dened asfollowing (Cullen, 1990; HSE, 1997): Evacuation refers to the plan-nedmethod of leaving the installationwithout directly entering thesea. Successful evacuation results in those on board the installationbeing transferred to an onshore location or to a safe offshorelocation or vessel. Evacuation means may include helicopters,lifeboats and bridge-links.

Escape is the process of leaving the installation in an emergencywhen the evacuation system has failed. It may involve entering thesea directly and is the last resort method of getting personnel offthe installation. Means of escape cover items which assist withdescent to the sea, such as life rafts, chute systems, ladders andindividually controlled descent devices, as well as items in whichpersonnel can oat on when reaching the sea such as throw-overlife rafts.1

Rescue is the process of recovering of persons following theirevacuation or escape from the installation, and rescuing of personsnear the installation and taking such persons to a place of safety.Rescue also refers to the process by which man overboard (MOB)survivors are retrieved to a safe place where medical assistance isavailable.

Some of the hazards which can potentially lead to EER are (IADC,2009; Norsok, 2001):

Blowouts, including shallow gas and reservoir zones; unignitedand ignited

Process leaks; unignited and ignited Utility areas and systems res and explosions Fire in accommodation areas Helicopter crash on platform Collisions, including elds related trafc, and external trafc,drifting and under power

Drifting objects that may threaten the installation Riser and pipeline accidents Accidents from subsea production systems Structural collapse, including collapse of bridges between xedand/or oating installations

Foundation failure Loss of rig stability/position Extreme weather

The hazards that a crew can be exposed to during EER canmainlybe divided into three categories (HSE,1995): physical, command andcontrol and behavioral. The physical hazards are those due toequipment (design, malfunction or failure) and physical conditionsescape for all actions to leave the place of the accident and to move away from theinstallation.

2.1. Evacuation sequence

Fig. 1 shows the different steps pertaining to an evacuation froman offshore installation e from the initiating incident, through theabandonment of the vessel. In the case of the Deepwater Horizon,this refers to when the blowout was rst recognized, to when thelifeboats abandoned the platform zone (500 m).

Fig. 1 includes the steps of an evacuation process, but does notinclude the means of escape.

The main factors which can lead to the success of EER fromoffshore installations can be summarized as (HSE, 1995):

Hazard prevention, control and mitigation Appropriate installation physical design (e.g., escape routes,muster area)

The performance of equipment in an emergency (e.g., alarmsystems, re-ghting equipment, helicopters, lifeboats and fastrescue crafts)

The action of the personnel concerned (e.g., offshore emer-gency response teams and general Personnel on Board (POB),often summarized as human and organizational factors (HOFs).

2.2. HOFs during EER operations

all, the organizational factors which inuence safety relatedbehavior at work (Goodwin, 2007).

Organizational factors are characterized by the division of tasks,design of job positions including selection, training and culturalindoctrination, and their coordination to accomplish the activities.The factors also include elements such as complexity (chemical/process, physical, control, and task); size and age of plant, andorganizational safety performance shaping factors such as leader-ship, culture, rewards, manning, communications and coordina-tion, and social norms and pressures (Bellamy, Geyer, & Wilkinson,2006). The human and organizational factors (HOFs) inuencebehavior during hazards.

The rst scientic research into human behavior in the event ofa re was conducted in the 1950s in the United States. Sinceresearchers at that time assumed that buildings were engineered insuch away that theywere safe enough in a re, the focuswas on therelationship between the (social) behavior of people and redevelopment, and much less on the interaction between buildingdesign and a safe escape (Kobes, Helsloot, de Vries, & Post, 2010).Research has been performed related to modeling of evacuationsituations both for offshore installations (Basra & Kirwan, 1998;Bercha, Brooks, & Leaoor, 2003; Jacobsen, 2010; Veitch, 2003)and maritime evacuations (Kim, Park, Lee, & Yang, 2004; Park, Lee,Kim, & Yang, 2004). Few simulation models are based on humanbehavior in evacuation scenarios, such as the preference for specic

orkpf tim

alongrout

ose erout

Initiating incident Awareness Evaluation a

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158150Initial incidert

Decision to muster

Activate alarm and PA-announcment

Make w(i

Move

Detect alarm

Identify alarm

ChoListen and follow PA announcementHuman error and human factors are often used interchangeably,thus creating confusion and compromising the quality of humanreliability assessments (DiMattia, 2005). Therefore, dening humanfactors and human error is necessary to establish a basis for thediscussion in the current paper. A denition of human factors,modied slightly from the UKs Health and Safety Executive (HSE,1999), is as follows: Environmental, organizational and jobfactors, system design, task attributes, and human characteristicsthat inuence behavior and affect health and safety. Humanfactors are a range of issues including the perceptual, physical andmental capabilities of people and the interactions of individualswith their job and the working environments, the inuence ofequipment and system design on human performance, and aboveFig. 1. The evacuation sequence (routes or exits, or the time needed to gather and interpret infor-mation. This is because there is insufcient quantitative researchdata available on these factors (Sime, 2001). Relevant for EERmodels are variables or parameters used in theories and ndings ofdisaster psychology (e.g. Leach, 1994).

Important human factors are the personality traits of the peoplein a building, their knowledge and experience, their powers ofobservation and judgment, and their mobility. In Social CognitiveTheory, it is assumed that most people have an internal systemwhich enables them to control their thoughts, feelings, motivationsand actions to some extent (Kobes et al., 2010). This internal controlis based on personal knowledge, feelings, biological characteristics,actions and their inuence on surroundings. Judgment enables

lace safe e)

egress e

Register at TSRgress e

Dress in survival suits

Enter lifeboat

Decision to abandon

Drop lifeboat

Abandon platform zone

nd egress POB control AbandoningSkogdalen & Vinnem, 2010).

a human to estimate the threat of danger by going through a cuevalidation process based on what he or she sees, hears, smells andfeels. The cue validation process is of signicant importance giventhat decision making during an evacuation depends upon the cuesthat the occupants perceive, and their interpretation of those cues(Graham & Roberts, 2000). Important factors are awareness,physical position (passive or in motion) and familiarity with thelayout of a building. In the study, a number of individuals who hadtried to leave a building by passing through a smoky environmentreported that they had to change direction, or even retrace theirsteps, due to breathing problems, reduced vision, fear, or otherreasons (Gwynne, Galea, Lawrence, & Filippidis, 2001). Experi-ments show that in the case of limited visibility, people tend towalk alongside walls for guidance (Kobes et al., 2010; Nagai,Nagatani, Isobe, & Adachi, 2004).

There are three distinct strategies for surviving a re. The rststrategy is to (try to) extinguish it. The second strategy is to takeshelter and wait to be rescued, and the third is evacuation (Kimet al., 2004). Large jet-res like seen in the case of DeepwaterHorizon and Piper Alpha left most of the personnel with just oneoption; to try to evacuate or escape. The re could not be extin-guished. There was no organized search and rescue by emergencyresponse teams onboard the installations.

The presence of social bonds within groups has implications formodels predicting an array of possible disaster outcomes, includingthe emergence of panic. Organizational breakdownmodels assumethat social bondswithin groups engaging in collectiveightweakenunder intense threat (Cornwell, 2003).

A key personality trait is the level of stress resistance, andthereby the power of observation, judgment andmovement. During

responds to a given situation (Proulx, 1993). An increased stresslevel is not the same as panic, which can be dened as irrational,illogical and uncontrolled behavior (Kobes et al., 2010).

The engineered features, and thereby the RIFs of an offshoreinstallation which determine re response performance is mainlyrelated to its layout, re and blast walls, materials, re compart-ments and size of the facility. Relevant components of the layoutare the escape route signage, the design of the escape routes andthe design and location of the (emergency) exits and the (emer-gency) staircases. Physical barriers, like re and smoke compart-ments, the maximumwalking distance to (re) exits, and re safetyinstallations are the main components of egress and life safetysystems.

Fig. 2 summarizes the different factors that inuence the EERperformance.

3. Three different EER situations

The HOFs and RIFs described in Fig. 2 will differ depending onthe initial hazard. The potential and speed of escalation also differdepending on the hazard. The escalation speedwill inuencewhichevacuation and escape means are available. Three examples ofhazards that an offshore installation may encounter are presentedbelow, followed by a table which categorizes the hazards.

3.1. 2004 Hurricane season and evacuation

The 2004e2005 hurricane seasons in the Gulf of Mexico werethe worst in the history of offshore production, and the mostdestructive and costliest natural disasters in the history of the

nd R

stallaelsCond

unmf POss of escaints,n eqstem

stem, fire

)

musty (j.)t pa of m

tion

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 151a re, a persons stress levelsmay rise to a level where their capacityfor processing information is exceeded (Proulx, 1993). Too muchstress can impair cognitive processes and how an individual

Evacuation, Escape a

LayoutMaterialsSize of indecks levFloating, e.g.NormallyNumber oRobustnestructure,muster poevacuatioActive syetc.)Passive syprotectionwalls etc.

Escape routesLength toComplexistairs, etc

E

EquipmenProtection

Installa

PersonalityKnowledge and experiencePower of observationPowers of judgementPowers of movement

Social featuresAffiliation (e.g. family)Role/responsibility

Situational featuresAwarenessPhysical conditionFamiliarity with layout

Command and controlManagment/leadershipProceduresCommunicationSafety managment systemWork practice

S

S

C

Competence

Human and Organsational FactorsFig. 2. EER performance, partly bUnited States (Cruz & Krausmann, 2008). The hurricanes Katrinaand Rita destroyed 136 structures, representing 1.7% of Gulf oilproduction and 0.9% of natural gas output. Another 53 platforms

escue performance

Visual featuresSmelling featuresAudible features

Escalation speed (e.g. fire growth speed, explosions)

Smoke yieldToxityHeat

Hazard RIFs

tion (No. Of

eep, Jack-up

annedB onboard platform pe routes, TR, uipment etc.s (deluge

s (fire - and blast

ter areaunctions,

sseduster area

RIFsased on Kobes et al. (2010).

suffered signicant damage. Five rigs were destroyed and 19 rigssustained signicant damage (Kaiser, 2007). A large scale precau-tionary evacuation was conducted in advance, for which no deathswere reported (Cruz & Krausmann, 2008).

3.2. Snorre A

On the 28th of November 2004 an uncontrolled situationoccurred during work in a well on the Snorre A tension leg plat-form on the Norwegian Shelf. The work consisted of pulling pipes

accommodation. Overall, 61 persons from Piper Alpha survived. 39had been on night-shift and 22 had been off duty (Cullen, 1990).

The three incidents/accidents described above vary depending onthe escalation speed and RIFs. The hurricane allowed for pre-warnedhours in advance. Time was available to conduct an arranged andstructured evacuation of the installations. The gas blowout at SnorreA was not immediately ignited. The incident posed a threat andpersonnel were mustered in lifeboats in a structured manneraccording to emergency preparedness plans. The lifeboats wouldhave been dropped if the incident had escalated by the gas beingignited. The Piper Alpha accident, for most of the crew, instantly lead

icalns

1 e Arranged and Slow No Helicop

copboat

oattes,

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158152structured EER2 e Incident and

structured EERMedium Limited Heli

fe

3 e Major accident Fast Multiple factors LifebchuAt about 10 pm on the 6th of July, 1988 a medium gas condensateleak resulted in an explosion and re on board the Piper Alphaplatform on the British Continental Shelf. The system for control inthe event of a major emergency was rendered almost entirely inop-erative. Smoke and ames outside the accommodation made evac-uation by helicopter or lifeboat impossible. Diving personnel, whowere on duty, escaped to the sea along with other personnel on dutyat the northern end and the lower levels of the platform. Othersurvivors of the initial explosions made their way to the accommo-dation. A large numberof the crewcongregated near the galleyon thetop level of the accommodation, which was the mustering area.Conditions there were tolerable at rst but deteriorated greatly asa result of smoke. Some of the crew, which among them 28 whomsurvived, decided on their own initiative to exit the accommodation.The survivors reached the sea by the use of ropes and hoses or byjumping off the platform from various levels. To remain in theaccommodation meant certain death. At the time of the initialexplosion 226 personswere on board the platform, of whom62wereon night-shift. The great majority of the remaining crew were in the

Table 1Categories of EER situations.

Category Escalationspeed

RIFs (ref. Fig. 1) Typmeaout of the well in preparation for drilling a sidetrack well. Duringthe course of the day, the situation developed into an uncontrolledgas blowout outside the casing with cratering on the seabed,resulting in gas under the facility. Personnel who were notinvolved in work to remedy the situation were evacuated byhelicopter to nearby facilities after rst being mustered in life-boats. The work to regain control over the well was complicatedby the gas under the facility which, among other things, preventedsupply vessels from approaching the facility to unload additionaldrilling mud. Mixed mud was available as part of the well uidchemicals, and pumped into the well. The well was stabilized theday after. The PSA characterizes this incident as one of the mostserious to occur on the Norwegian shelf (Brattbakk, stvold,Zwaag, & Hiim, 2005). Under slightly different circumstances,the incident could have resulted in (1) ignition of the gas and (2)buoyancy and stability problems. Only chance and fortunatecircumstances prevented a major accident with the danger of lossof many lives, damage to the environment and additional loss ofmaterial assets (Brattbakk et al., 2005).

3.3. Piper Alphaand jumto a life-threatening situationwithmultiple RIFs such as smoke, heatand explosion loads. The accident escalated quickly and no struc-tured evacuation occurred.

The incidents/accidents are categorized in Table 1.

4. Legislation and standards

Legislation and standards inuence the technical development,organization, procedures and training related to evacuation fromoffshore installations and facilities. To illustrate the differentapproaches toward legislation, the Norwegian and the U.S. regu-lations are briey described.

The Norwegian performance based regulations specify theperformance or function which is to be attained or maintained bythe industry. The regulatory role involves dening the safetystandards and acceptance criteria which companies must meet.Norways intention of such a regulatory regime is to get the oper-ator to be focused and be self-regulatorywhen it comes to Health,Safety and Environment (HSE) performance, rather than relying onthe regulators efforts in controlling that the HSE requirements aremet. Within the Norwegian regime it is to a larger degreea responsibility for the operator to demonstrate how their safetymanagement system and performance comply with the regulations(DNV, 2010). In the PSA Activity Regulation Section 77 it is requiredthat the party responsible shall ensure that necessary actions aretaken as soon as possible in the event of situations of hazard andaccident so that (PSA, 2010):

The right alert is given immediately Situations of hazard do not develop into situations of accidents Personnel can be rescued in situations of accident The personnel on the facility can be quickly and efcientlyevacuated at all times

The condition can be normalized when the development ofa situation of hazard and accident has been stopped

In addition, the Norwegian performance based regulationsprovide details on some technical requirements related to EER. Forinstance, there is a requirement to use lifeboats of the free-fall type,and two independent systems for rescue of personnel who fall intothe sea. There are further requirements that personnel may be

evacuation E.g. hazard E.g. incident

ter Extreme weather 2004e2005 Hurricaneevacuation GoM

ter ors

Process leak, unignited,utility res, ship oncollision course

Snorre A blowout

s, escapelife rafts

Structural collapse,ignited HC leak

Piper Alpha, AlexanderKielland, Ocean Ranger,ping into sea Deepwater Horizon

avoid waking crew members in the middle of the night due to falsealarms. [July 23, 2010; August 23, 2010] (DHJIT, 2010)]. According tothe Chief Electronics Technician, inhibited alarms mean that thesensors continue to detect hazards and forward the information tothe computer; however the computer will not automatically triggerthe alarm upon detecting a hazard. [July 23, 2010 (DHJIT, 2010)].This implies that on the Deepwater Horizon, the general alarmsystem designated to notify the crew in the event of a re required

Question: .why didnt you signal immediately the general alarm when twoof the sensors came up magenta on the combustible gas alarms?

Answer: It was a lot to take in. There was a lot going on. And soon after,I went over and hit the alarms.

Question: But you didnt do it immediately, correct?Answer: No, sir.Question: And, in fact, at the time there were, by your testimony, more than

ten to 20 magenta combustible gas alarms going off?Answer: Correct.Question: And did you consider at any time initiating an emergency shutdown

of any ventilation aboard the rig?Answer: No, sir.

Question: Did anyone discuss it [ESD]? Did you hear anyone discussing it onthe bridge at that time?

Answer: Not that I remember.Question: It was not an option put forth at any period of time that you were on

the bridge following the jolt?Answer: No. Not that I remember.

Question: Did anyone tell you after the rst explosion that the situation wasunder control?

Answer: Yeah, I did hear someone say that. That was probably said to calmpeople down.

Question: Do you recall who said that?Answer: The captain.

ion ievacuated and rescued inwhat is termed situations involving hazardand accident, i.e. major hazard scenarios dened in QuantitativeRisk Analysis, accidental events of limited extent and situationsimplying temporary increase of risk.

In the U.S., prescriptive regulations specify technical require-ments for structures, technical equipment and operations in orderto prevent accidents and mitigate hazards. The regulatory author-ities dene the requirements for HSE, and monitor that thecompanies comply with these. The United States Coast Guard(USCG) regulates the safety of life and property on the OuterContinental Shelf (OCS) (DNV, 2010). USCG regulations 33 sub-partsB (Manned OCS facilities) and C (Mobile Offshore Drilling Units) in33 CFR 146 have requirements for operators to develop and submitapproval Emergency Evacuation Plans (EEP) to the USCG. The EEPsubmissions must include, amongst other requirements (USCG,1998):

A description of the recognized circumstances, such as res orblowouts, and environmental conditions, such as approachinghurricanes or ice oes, in which the facility or its personnelwould be placed in jeopardy and a mass evacuation of thefacilitys personnel would be recommended

For each of the circumstances and conditions described a list thepre-evacuation steps for securing operations, whether drilling orproduction, including the time estimates for completion and thepersonnel required

For each of the circumstances and conditions describeda description of the order in which personnel would be evacu-ated, the transportation resources to be used in the evacuation,the operational limitations for each mode of transportationspecied, and the time and distance factors for initiating theevacuation

For each of the circumstances and conditions described, iden-tication of the means and procedures for retrieving andtransferring personnel during emergency situations and theultimate evacuation of all personnel

Even though the approach toward regulation is different, thepractical follow-up by the rig owners are very much the sameworldwide, and the equipment used on offshore oil and gasinstallations for evacuations are mainly similar (e.g. lifeboats,escape chutes and life rafts). Drilling vessels like the DeepwaterHorizon, follow marine regulations and often have conventionallifeboats.

5. EER from the Deepwater Horizon

Evacuation from the Deepwater Horizon began within minutesafter the blowout and subsequent explosions on board the rig. It isimpossible to know exactly what happened during the crisis on thenight of April 20th, 2010. However, based on the various accountsand testimonies of crew members during the Deepwater HorizonJoint Investigation, an overall sequence of events, including varioushazards associated with those events has been outlined (DHJIT,2010). The outline follows the main sequence described in Fig. 1and is related to the factors illustrated in Fig. 2.

5.1. Initiating incident

At approximately 9:45 pm, a blowout and subsequent explo-sions and re erupted on the rig (Graham et al., 2011). The sequenceof events leading to the blowout and explosions has been examinedin detail in the National Commission on the BP Deepwater HorizonOil Spill and Offshore Drilling Meeting 5 (Commission, 2010;

J.E. Skogdalen et al. / Journal of Loss PreventGraham et al., 2011).manual activation by a member on the bridge. In turn, several crewmembers on the rig oor and those closer to the location of theexplosion had become aware of the severity of the incident beforethe general alarms were sounded.

In addition, it has been testied that the general alarm did notsound prior to the rst explosion on the platform [October 5, 2010;July 23, 2010 (DHJIT, 2010)]. Traditionally, mustering would occuronce the alarms were sounded, and the decision to muster wasannounced on the PA system. However, as noted in the testimonybelow[August 24, 2010 (DHJIT, 2010)], some crew members recallTransocean employees testied that the Deepwater Horizonsgeneral alarm systems were inhibited prior to the explosion to5.2. Awareness

The sudden occurrence and impact of the explosion made itdifcult for members on the bridge to assess the situation immedi-ately following the incident. Also, various alarms were sounding andlights were ashing, making it difcult for the crew to acknowledgewhat was going on. The senior dynamic positioning operator (DPO)who was located on the bridge at the time of the incident recalls thescene as follows: [October 5th, 2010 (DHJIT, 2010)]:

Another DPO on the bridge that evening also recalls the scene onthe bridge as follows [October 5, 2010 (DHJIT, 2010)]:

. they[alarms] were going off like crazy, so we were trying to ndwhere these alarms were actually coming from.

Question: So the alarms went off and you silenced them to try and respond towhat the casualties were; is that the way that worked?

Answer: Yeah. But every time you silence those At that point in time, it didno use to silence an alarm, because there were some alarms that werejust one on top of each other. It was just going crazy....

n the Process Industries 25 (2012) 148e158 153that they did not see or hear any alarms after the explosion. As

muster stations.The Senior Tool Pusher describes the wreckage in the living

quarters as a result of the explosion: [May 28, 2010 (DHJIT, 2010)]:

.we had to remove debris. It was hanging from the ceiling andthe walls was jutted out, the oor was jutted up. I mean it was justtotal chaos in that area of the living quarters.

5.4. Personnel on Board (POB) control

Typically as part of the evacuation procedure, once crew

to get systems going, they were trying to get control back, and I

Answer: We received the alarms from the re and gas after the rst explosion.

ion imembers reach the designated muster stations, they register theirnames so that a proper headcount can be conducted and missingmembers can be accounted for. Based on the testimonies provided,5.3. Evaluation and egress

Egress routes are the routes crew members use to escape fromtheir current workplace or location and arrive to the designatedmuster stations on board the vessel. These routes are pre-planned,and provide the safest means of evacuation of a hazardous area. Asthe crew was making their way to the muster stations, many of theegress routes and stairways were blocked or impaired [May 27,2010 (DHJIT, 2010)].

According to the Chief Electronics Technician on board theDeepwater Horizon, egress routes were severely impaired as a resultof the explosions. His accounts of the eventswere as follows: [July 23,2010 (DHJIT, 2010)]:

That [rst] explosion blew the re door that was between me andthose spaces off the hinges..as I reached the next door, I reached up and grabbed the handlefor it. It then exploded. That was Explosion Number 2..I remember getting really angry. I dont know why I got angry. Iwas mad at the doors. The doors were They were beating me todeath. Two doors in a row had hit me right in the forehead and, youknow, planted me against the wall somewhere. My arm wouldntwork, my left leg wouldnt work, I couldnt I couldnt breathe, Icouldnt see.All the panels for the ooring were missing. There was nothing butgrid work. So I was tripping and falling kind of through this gridwork, trying to make my way to the outside water-tight door.So I turned to the right, and as I did, I got my bearings, got my eyescleaned out enough where I could see, and noticed there was nowalkway, there were no handrails, and there was no stairwell left.One more step and I would have went in the water. At that point Ilookedupat thewall, and the exhaust stacks forEngineNumber 3, thewall, the handrail, the walkway, all those things were missing. Theywere completely blown off the back of the rig.

Flames and impaired egress routes had cut off access to the aftlifeboats for some of the crew, rerouting them to their secondary

Question: . Did you ever see any sort of visible alarms on that rig once youheard the loud noise you heard and started experiencing the thingswith the rig that you experienced, did you see any visual alarmsanywhere on the rig of any type?

Answer: Not from the the place I was at on the boat deck or in the shortdistance through the hallways in the accommodations did I see anyvisual alarms, nor did I hear any.a result, they had begun evacuating the rig as soon as they wit-nessed and experienced the hazard RIFs of the blowout.

Question: Do you recall the order of the alarms on the bridge when theincident occurred, what alarms sounded and in what order?

J.E. Skogdalen et al. / Journal of Loss Prevent154there were efforts to prepare such a headcount, however thereasked the captain, Were here, Mike... has an injury. So he told usto go to the lifeboats and nd the medic. We proceeded to thelifeboats, whereupon I lost track of Mike. And so I went to mylifeboat that I was stationed to go to. And wewaited around outsidethe lifeboat, waiting to receive orders. And it was just completemayhem, chaos, people were scared, they were crying.

The Operations Manager describes [August 23, 2010 (DHJIT,2010)]:

And I heard somebody yelling in the background that theyre jumpingoverboard. So I ran back down the stairs. And in between the two lifeboats, on the outside of the handrail, therewas an individual hangingon the outside of the handrail, and I said, Hey, where you going?Theres a perfectly good boat here. Do you trust me?

The Subsea Engineer also describes the scene as follows [July 22,2010 (DHJIT, 2010)].

It was a raging re, it was out of control. There was a sense ofurgency, we needed to go. And people were frozen up, they couldntmove. And I saw a couple of people jump off the side. I grabbedpeople and asked them if they checked in. I told them to get into thelifeboat and, you know, did that for a few people. People startedgoing. I got in the lifeboat myself and everybody lled in, closed thedoors, we deployed the life vessel

5.5. Abandoning

While crew members on the bridge were trying to assess thesituation, others were already mustering near the lifeboats. Somewere urging for the lifeboats to be launched despite them beingonly partially full. Deepwater Horizon did have a split commanddepending onwhat was the status of the rig; latched up, underway,or in an emergency situation. The decision to evacuate the rigrested upon the Captain when the rig was in an emergency situa-tion, but from the testimonies it seems to be unclear who was incharge due to missing procedures of handover and interpretation ifthe rig was latched up, underway or in an emergency situation(DHJIT, 2010).

In his testimony during the joint investigation by the UnitedStates Coast Guard and the Bureau of Ocean Energy Management,the crane operator described the scene as follows [May 29, 2010(DHJIT, 2010)]

.it was a lot of screaming, just a lot of screaming, a lot ofwere difculties when trying to accurately account for all members.In his testimony, the Crane Operator describes his account of theevents, and the difculties in obtaining a proper headcount [May29, 2010] (DHJIT, 2010)]:

We was still trying to get people on the boat and trying to calmthem down enough to trying to calm them down enough to geteverybody on the boat. And there was people jumping off the side.We was trying to get a count and just couldnt get an accuratecount because people were just jumping off the boat.And we were trying to get people to count 1, 2, 3 around the boattrying to see how many we had in there and people couldnt evencount right because they was too scared. So, what we done is wejust went ahead and lled the boats up to their max and loaded thewounded we got on there and then lowered the boat.

The Chief Mechanic describes the situation as follows [May 16,2010 (DHJIT, 2010)]

Upon entering the bridge, it was complete chaos. They were trying

n the Process Industries 25 (2012) 148e158hollering, a lot of scared people, including me, was scared. And

trying to get people on the boats. It was a very unorganized e wehad some wounded we was putting in the boat. Had people on theboat yelling Drop the boat, drop the boat and we still didnt haveeverybody on the boat yet. We was still trying to get people on theboat and trying to calm them down enough to trying to calmthem down enough to get everybody on the boat. And there waspeople jumping off the side.

It seems unclear as to when exactly the decision to abandonwas

The crew eventually launched the lifeboats, leaving eleven crew

Question: [.] if you had been through all those drills and you had condencethat you thought basically the folks knew what they were doing,what was it that basically made you decide to go one deck downand jump? Were you frustrated, were you, you know, overlyconcerned? Was it getting hot? Im just really kind of curious.

Answer: It was a decision that I made because I didnt think we had timeto wait.

Question: You thought it was taking too long to get the boat out?Answer: I just they had a series of explosions, its time to go. That was my

thought process.Question: Can you estimate for us from the time that you heard the rst

explosion, you went to the boat deck, before you made yourdecision to go down and jump how much time elapsed?

Answer: Fifteen minutes maybe.Question: And, when you were on that fast rescue boat, did they retrieve

other people from the water or did they rescue you and takeyou back over?

Question: Okay.Answer: There were four guys that had jumped.

.looking up at the derrick, you can see the derrick, and everythingwas ablaze there, and there was some individuals yelling, Weve gotto go. Weve got to go. Weve got to go. And I said, Weve got plentyof time. And right about that time is when the traveling equipment,the drilling blocks and whatnot on the derrick fell. They wereprobably 40 to 50 foot in the air, you know, weigh 150,000 pounds,and they didnt make any noise. So at that time, I instructed theboat to my right, which would have been the port survival boat,to depart. They did.

Question: If you were not in command, why would the life boat coxswain lowerhis boat based on your communication and evacuate away from theDeepwater Horizon?

Answer: I only know that when we left the bridge that we were going toabandon the vessel.

Question: If you werent in management-performance, would the coxswaintake your word and leave and lower the boat and release?

Answer: I dont know why he would take orders from me. Im not the masterof the vessel. But he did.

J.E. Skogdalen et al. / Journal of Loss Prevention imembers behind (USCG, 2011). The following is an excerpt of thetestimony of the subsea supervisor for the Deepwater Horizon:[August 25, 2010 (DHJIT, 2010)]:

Question: So what was the atmosphere like inside the lifeboats?Answer: It was a little hectic.Question: A lot of yelling and things like that?Answer: Yes. A lot of people was wanting to lower the boat before we got

all the people in it.Question: So by the time you got the boat was lowered, there was still

enough room inside the lifeboat, sir?made and by whom. A senior Transocean employee visiting the rigat the time of the incident, described how he instructed the life-boats to depart [August 23, 2010 (DHJIT, 2010)]:One of the crew members jumped to the sea, and recalls thesituation [May 28, 2010 (DHJIT, 2010)]:Answer: Yes.The senior DPOwhowas located on the bridge at the time of theincident signaled for help from the nearby supply ship, the DamonBankston, which in response launched a Fast Rescue Craft (FRC) tohelp rescue those at sea. Two lifeboats were launched from theDeepwater Horizon, and the crew made their way to the DamonBankston. Some of the members who were left behind on the rigused a life raft to evacuate. However, after the raft was lowered tosea, the remaining crew members on the rig, who were left behindby both the lifeboats and life raft, jumped to the sea. The ChiefEngineer, who was in the life raft below the rig, describes the sceneas he witnessed members who had jumped [July 19, 2010 (DHJIT,2010)]:

I saw a persons boots and his clothing and stuff come shootingthrough the smoke. Just before he landed, ...He landedapproximately ve feet from me. Within seconds, a half a secondlater, another pair of boots and person came ying out of the smokeand he was approximately ten feet from me. Just before he hit thewater, .. As were swimming, trying to pull this life raft awayfrom the rig, I got to a point where I could see the helideck. I wit-nessed an individual running at full speed across the helideck.When he jumped off the end of the helideck, he was still running.Just before he splashed into the water, he was actually looking overat us .

The crew that had launched the life raft faced various challengesin their attempt to evacuate and escape the vicinity of the burningrig. The following excerpts are from the testimony of the rigs ChiefEngineer, who was one of the crew members who evacuated usingthe life raft [July 19, 2010 (DHJIT, 2010)]:

All the ames and heat from the rig oor were coming down theforward part of that deck, as well as all of the ames and the heatfrom under the rig. They were meeting, I guess, in like a vortex orsomething right there at the life raft.At that point, I honestly thought that we were going to cook rightthere. The life raft, I guess from hurriedness and jumping in thereand so forth, it actually fell. At that point, the life raft actuallydipped forward and back. It started rocking back and forth. Therewas smoke...I noticed that shortly after that, that we were not going anyfurther from the rig. About that time, somebody hollered out, Oh,my God, the painter line is tied to the rig. I looked back over myshoulder past the life raft and noticed the white painter line goingup into the smoke. At that point, I heard ..., which was rightbehind me, started screaming for help, Help. We need help overhere. I looked out to see and I would have to say probably 50, 60yards away there was the fast rescue craft, the FRC, from theDameon Bankston. I saw two ashing lights in the water. Just as Ilooked at it, one of those was getting hauled into the boat andseconds later, the second person was hauled into that boat. Thefast rescue craft started driving towards us and we werehollering, We need a knife. We need a knife. When they gotprobably ten or 15 feet from us, an individual came up to the bowof the boat with a very large, foldable pocket knife. Curt swamout, grabbed the knife, and swam to the back of the life raft. Ifollowed Curt to the back of the life raft to assist if he needed it.He cut the rope.

Within minutes, the FRC which had been launched by the crewof the Damon Bankston was able to rescue the crew members fromthe water and make its way to the life raft tied to the rig, cut theline, and tow it to safety.

One of the crew members who had helped lower the life raft,but was left behind on the rig described how he made his decision

n the Process Industries 25 (2012) 148e158 155to jump [October 5, 2010 (DHJIT, 2010)]:

Question: Other than jumping from the rig at that point, were there any otheralternatives to evacuate the rig?

Answer: Yeah. I mean, if I wanted to sit there and crank up the life raft davit,crank the hook back up and hook up another one. In a situation likethis, you never know how much time you got, so I did, you know, thebest thing I thought.

Question: Im certainly not criticizing your decision to jump. Im just lookingat alternative evacuation methods. Were there ladders that wouldgo down to the waters edge?

Answer: There was a ladder that was right there, but those ladders wereseverely damaged due to running from hurricanes, that you wouldhave to jump from them anyway.

Question: So my understanding from what you said is there were laddersdesigned, but the ladders had suffered damage, so they were not

J.E. Skogdalen et al. / Journal of Loss Prevention i156Another hazard facing those who had jumped to sea was thepresence of oil and other possible toxic and ammable materialwhich had covered the surface of thewater following the explosion.One of the nal remaining crew members on board the DeepwaterHorizon, described the problems he faced once he had jumped in tothe sea [July 23, 2010 (DHJIT, 2010)]:

Once I hit the water, when I came back up, I couldnt see anythingagain because now Ive got a new set of problems. Ive got oil,hydraulic uid, gasoline, diesel, whatever it is thats oating on thewater is now burning my entire body. Im now covered in thissludge. I dont know what it is. Its burning, I cant hardly breathe,but I can feel the heat from the re underneath the vessel. At thatpoint I started back stroking with the one arm and one leg thatwould work until I remember feeling no pain, I remember feeling noheat and thinking that that was it, I had died.

The Damon Bankston played a critical role in rescuing andproviding a safe-haven to personnel who had abandoned theDeepwater Horizon. The FRC launched by the Bankston not onlyrescued crew members from the water; it also rescued the life raftwhich had been unexpectedly tied to the rig. The rescued crewreceived medical attention on board the Damon Bankston, and the

functional; is that correct?Answer: Those ladders were designed I dont know if they were designed

for an emergency escape route, but I know they were used duringthe shipyard for people to get up to the rig. I dont know if theywere emergency use.

Question: Do you know if the ladders could have been used to go from thedeck to the water?

Answer: They could have, but like I stated earlier, the bottom 15, 20 feet wasso severely damaged from waves that you still would have had to jump.seriously injured were airlifted and evacuated by the USCG fromthe deck of the Bankston. The USCG reports that although therewasno regulatory requirement for aMODU to have a standby vessel atits side for safety purposes or to have its own fast rescue craft, therole Bankston played in saving lives demonstrates the value thatsuch requirements could provide (USCG, 2011).

The following is an excerpt from the testimony of the Chief of inci-dent response for theUSCG8thDistrict [October, 4, 2010 (DHJIT, 2010)]:

Question: Are you aware of any unique challenges they [USCG] face indeepwater emergency response?

Answer: Oh, yes, a number. I mean, it is a fairly conned area. There isnowhere to go other than the water. And also, to get assets there,oating assets there, it takes quite a while. Roughly, you know,for just for the Deeepwater Horizon, we are looking at about12 hours to get patrol boats on the scene.

Question: Specically, how do you plan to rescue 126 personnel with, I believeyou said, 11 helos in the Gulf of Mexico, in an evacuation similar tothis if there was no DAMON BANKSTON?

Answer: Typically, we dont have those assets to do that. We rely on ourindustry partners out there. And there are a lot of vessels in that areajust e for instance, this particular incident kind of sheds a little lighton it, and we have e there are a lot of resources out there. Typically,we are helping each other out. So that is kind of SOP for us.6. Discussion

The majority of the casualties from the Alexander Kielland,Ocean Ranger, Piper Alpha and Usumacinta offshore accidentsoccurred during EER operations. The Deepwater Horizon experi-enced a similar category 3 accident (ref. Table 1). The accidentescalated fast and included multiple RIFs. Even so, no deaths werereported as result of the EER operations (USCG, 2011). The highnumber of people evacuated from the Deepwater Horizon offersa signicant, however limited insight into the level of success of theEER operations. Testimonies have revealed that several of the safetycritical systems on Deepwater Horizon failed partly or totally. Thesesystems included the general alarm, blowout preventer, emergencydisconnect system and the power supply. The systems wereintended for hazard prevention, control and mitigation. Several ofthe crew members did not hear the abandon platform alarm. Someof the egress routes were partially blocked.

The free-fall technology with skid launch lifeboats and droplifeboats is according to PSA the safest method for ensuring that themeans of evacuation moves personnel away from the offshorefacility as quickly and safely as possible (PSA, 2008). This isparticularly the case in the North Sea, North Atlantic and Norwe-gian Sea, where the sea is almost never without swell and waves.The Deepwater Horizon had conventional lifeboats. New produc-tion installations in the Norwegian sector are required by law tohave free-fall lifeboats. However mobile drilling units in Norwayare not required to have free-fall lifeboats as they follow maritimeregulations, and not petroleum legislation.

There are some companies which claim that evacuation byhelicopter is the primary evacuation mean. This causes someconfusion. Helicopters cannot be used in situations where re orgas clouds are present at the platform. Evacuation via helicopterwill also take far longer time on installations that demand severalights due to the restricted capacity on each ight (Vinnem, 2008).Helicopter can therefore only be seen as a primary evacuationmeans in situations where the abandonment is planned in advance,as in the case of hurricanes in the Gulf of Mexico.

Explosions, re and smokewere life-threatening hazards duringthe EER from the Deepwater Horizon. Experiences from res inbuildings can be comparable, although there are some importantdifferences as well. On offshore installations, the crew is familiarwith the facility and escape routes. They also participate in regularly(usually weekly) muster and lifeboat drills. To determine whichmeasures that would reduce the time tomake decisions, and whichsteps that would lead to people choosing the right egress routes,information is needed regarding theHOFs. Of special interest are theperceptions, intentions and motives of the personnel when facedwith such situations. Some information is available through thetestimonies, but additional information is needed to sort of theimportance of the individual factors and their coherence.

One of the important roles of the master of the vessel is to takecharge during a crisis, and to give the order to abandon ship ifnecessary. The master should assess the severity of the situationproperly, and if the decision to abandon is made, the master wouldthen give the order to launch the lifeboats and evacuate theinstallation. Lowering the lifeboats at the right time is criticallyimportant for an effective evacuation, because there are a limitednumber of lifeboats on an installation. If not communicated prop-erly, lifeboats can be launched only partially lled, resulting inpersonnel being left behind. On the other hand, if members waittoo long to launch the lifeboats, they risk being harmed by theexplosions, re, smoke, and possibly falling objects. The DeepwaterHorizon had a split chain of command between the OffshoreInstallation Manager and the Captain, which seemed to have

n the Process Industries 25 (2012) 148e158caused confusion as the lines of authority and shift of responsibility

rafts and lifeboats in the Gulf of Mexico. The system should include

concept that humans make errors, and the frequency and conse-

ion iin the event of an emergency seemed unclear to some of the crewmembers. The control, behavior and execution of commandsdepend on several human RIFs (ref. Fig. 2). A critical question to beconsidered is how can it be relied upon that the master of the vesselwill be in good enough condition to perform critical tasks in time,such as properly assessing the situation, activating the alarm, andgiving the order to muster and abandon ship? This was alsoa problem the crew faced following the explosion on board thePiper Alpha. The crew waited on instructions from the master whohad the authority to order an evacuation; however they were notaware that the explosion had destroyed the control room killingmost of the personnel inside; therefore valuable time was lostwaiting for the order to evacuate the installation. In addition,several of the crew waited for helicopters to arrive, unaware thathelicopters cannot approach an installation on re. During a crisis,it is possible that situations will occur where bypassing the chain ofcommand is unavoidable and necessary; however, the situationmust be properly assessed by the individuals such that the result isnot detrimental to the safety and success of the operations. This canbe accomplished through proper training of worst case scenarios.

It is expected that in some cases, not all members will be able toevacuate using the primary means of evacuation and thereforerescue means are necessary to ensure the safe evacuation of thepersonnel left behind or not able to make it to temporary saferefuge (TSR). As seen in the case of the Deepwater Horizon, therewas a need for secondary means of evacuation. In addition to liferafts, these can be escape chutes and ladders. Personal survival suitswith splash protection extend the available rescue time due toincreased protection from waves and hydrocarbons in the sea.They also extend time before hypothermia. The survival suitsshould include emergency beacons to improve chances of locatinga survivor, as is the case in Norway and the UK.

Technical systems exist that provide automated real timeaccounting of personnel during an emergency evacuation. Thesystems provide a list of Personnel on Board (POB) or personnel onpremise, including key data, trade certicates, cabin number, workarea and primary duties during an evacuation ormuster drill. At thecheck-in point the muster ofcer and master get a real time reportof who is expected, who is missing and who has shown up ata secondary muster station. In the event that rst responders arecalled in, management can direct them to the work areas or cabinnumbers of missing personnel.

Several hazards faced those on the Deepwater Horizon whoprepared to jump to sea. Among those hazards were the heightfrom the platform deck to the surface of the water fromwhich theyhave to jump, the possible res on the sea level and smoke inha-lation. Ideally, the crew would had to get as close as possible to thewater surface before jumping or entering the sea. Under somecircumstances jumping into the sea is necessary, and offshorepersonnel should be trained to do this as safely as possible.

The supply ship Damon Bankston played a vital role in rescuingthe survivors from the Deepwater Horizon. Given the remotelocation of deepwater operations, nearby vessels play a critical rolein rescuing personnel from offshore installations in the case ofa major accident. Fast response is especially important with a highnumber of personnel in the sea and/or in the case of bad weather.Custom designed third generation rapid response rescue vessels areavailable. They are specially designed to launch and recover a fastrescue craft or daughter craft from a slipway in the stern. Theslipway can also be used to recover a lifeboat from the sea. The seatrials of these vessels are promising and it is generally consideredpossible to operate in sea conditions with signicant wave heightsof up to Hs

References

Aven, T., & Vinnem, J. E. (2007). Risk management: With applications from the offshorepetroleum industry. London: Springer-Verlag London Limited.

Basra, G., & Kirwan, B. (1998). Collection of offshore human error probability data.Reliability Engineering & System Safety, 61, 77e93.

Bellamy, L. J., Geyer, T. A. W., & Wilkinson, J. (2006). Development of a functionalmodel which integrates human factors, safety management systems and widerorganisational issues. Safety Science, 46, 461e492.

Bercha, F. G., Brooks, C. J., & Leaoor, F. (2003). Human performance in Arctic offshoreescape, evacuation, and rescue (pp. 2755e2762). International Society ofOffshore and Polar Engineers.

Brattbakk, M., stvold, L., Zwaag, C., & Hiim, H. (2005). Investigation of gas blowouton Snorre A, well 34/7-P31A, 28 November 2004.

Commission. (2010). Meeting 5: November 8e9, 2010. National Commission on theBP Deepwater Horizon Oil Spill and Offshore Drilling.

Cornwell, B. (2003). Bonded fatalities: relational and ecological dimensions of a reevacuation. Sociological Quarterly, 44, 617e638.

Cruz, A. M., & Krausmann, E. (2008). Damage to offshore oil and gas facilitiesfollowing hurricanes Katrina and Rita: an overview. Journal of Loss Prevention inthe Process Industries, 21, 620e626.

Cullen, W. D. (1990). The public inquiry into the Piper Alpha disaster. London:Department of Energy.

DHJIT. (2010). USCG/BOEM Marine Board of investigation into the marine casualty,explosion, re, pollution, and sinking of mobile offshore drilling unit DeepwaterHorizon, with the loss of life in the Gulf of Mexico April 21e27, 2010. DeepwaterHorizon Incident Joint Investigation Team, The U.S. Coast Guard (USCG)/Bureauof Ocean Energy Management, Regulation and Enforcement (BOEMRE) JointInvestigation Team (JIT).

DiMattia, D. (2005). Determination of human error probabilities for offshore plat-form musters. Journal of Loss Prevention in the Process Industries, 18, 488e501.

DNV. (2010). Report OLF/NOFO e Summary of differences between offshore drillingregulations in Norway and U.S. Gulf of Mexico.

HSE. (1995). A methodology for hazard identication on EER assessments. Health andSafety Executive Books.

HSE. (1997). Prevention of re and explosion, and emergency response on offshoreinstallations. Health and Safety Executive Books.

IADC. (2009). Health, safety and environmental case guidelines for mobile offshore dril-ling units, International Association of Drilling Contractors. (p. 128). Issue 3.2.1.

Jacobsen, R. S. (2010). Evacuation from petroleum facilities operating in the BarentsSea. (p. 47).

Kaiser, M. J. (2007).World offshore energy loss statistics. Energy Policy, 35, 3496e3525.Kim, H., Park, J., Lee, D., & Yang, Y. (2004). Establishing the methodologies for

human evacuation simulation in marine accidents. Computers & IndustrialEngineering, 46, 725e740.

Kobes, M., Helsloot, I., de Vries, B., & Post, J. G. (2010). Building safety and humanbehaviour in re: a literature review. Fire Safety Journal, 45, 1e11.

Leach, J. (1994). Survival psychology. N.Y.: New York University Press.Leaoor, F. C. (2006). Survey of offshore escape, evacuation & rescue safety systems

(post Ocean Ranger recommendations).Leis, B., Chidester, R., Flamberg, S., Olson, J., Rose, S., Aysa, J., et al. (2008). Root cause

analysis of the Usumacinta e KAB-101 incident 23 October 2007.Nsheim, T. (1981). NOU, the Alexander L. Kielland-accident. (in Norwegian).Nagai, R., Nagatani, T., Isobe, M., & Adachi, T. (2004). Effect of exit conguration on

evacuation of a room without visibility. Physica A: Statistical Mechanics and ItsApplications, 343, 712e724.

Norsok. (2001). Norsok standard: Risk and emergency preparedness analysis, Z-013.Norwegian Technology Centre.

ien, K. (2001). Risk indicators as a tool for risk control. Reliability Engineering andSystem Safety, 74, 129e145.

OLF. (2000). Guidelines for establishing area based emergency preparedness(in Norwegian). The Norwegian Oil Industry Association.

Park, J. H., Lee, D., Kim, H., & Yang, Y. S. (2004). Development of evacuation modelfor human safety in maritime casualty. Ocean Engineering, 31, 1537e1547.

Proulx, G. (1993). A stress model for people facing a re. Journal of EnvironmentalPsychology, 13, 137e147.

J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158158Goodwin, S. (2007). Human factors in QRA. Report for International Association ofOil & Gas Producers. Det Norske Veritas Ltd.

Graham, B., Reilly, W. K., Beinecke, F., Boesch, D. F., Garcia, T. D., Murray, C. A., et al.(2011). Deep water. The gulf oil disaster and the future of offshore drilling. Reportto the President. The National Commission on the BP Deepwater Horizon OilSpill and Offshore Drilling.

Graham, T. L., & Roberts, D. J. (2000). Qualitative overview of some importantfactors affecting the egress of people in hotel res. International Journal ofHospitality Management, 19, 79e87.

Gwynne, S., Galea, E. R., Lawrence, P. J., & Filippidis, L. (2001). Modelling occupantinteraction with re conditions using the building EXODUS evacuation model.Fire Safety Journal, 36, 327e357.

Hickman, T. A. (1984). Report one: The loss of the semisubmersible drill rig OceanRanger and its crew. Royal Commission on the Ocean Ranger Marine Disaster.

HSE. (1999). Reducing error and inuencing behaviour HSG48. Health and SafetyExecutive Books.PSA. (2008). Free-fall lifeboats safest means of evacuation at sea. Petroleum SafetyAuthority Norway.

PSA. (2010). Regulations relating to health, environment and safety in the petroleumactivities (the activities regulations). Petroleum Safety Authority Norway.

Sime, J. D. (2001). An occupant response shelter escape time (ORSET) model. SafetyScience, 38, 109e125.

Skogdalen, J. E., & Vinnem, J. E. (2010). Risk inuence factors related to evacuationfrom offshore installations, ESREL09. Prague: Taylor & Francis Group.

USCG. (1998). 33 C.F.R. x 146.140 emergency evacuation plan. CGD 84-098b, 54 FR21572, May 18, 1989, as amended by USCG-1998-3799, 63 FR 35530, June 30,1998. United States Coast Guard.

USCG. (2011).Report of investigation into thecircumstances surrounding the explosion,re,sinking and loss of eleven crew members aboard the mobile offshore drilling unitDeepwaterHorizon intheGulfofMexicoApril 20e22, 2010.UnitedStatesCoastGuard.

Veitch, B. (2003). Evacuation performance. Houston: Offshore Technology Conference.Vinnem, J. E. (2008). Offshore emergency preparedness, holistic evaluation (in

Norwegian).

Evacuation, escape, and rescue experiences from offshore accidents including the Deepwater Horizon1 Introduction1.1 Objective

2 Evacuation, escape and rescue (EER)2.1 Evacuation sequence2.2 HOFs during EER operations

3 Three different EER situations3.1 2004 Hurricane season and evacuation3.2 Snorre A3.3 Piper Alpha

4 Legislation and standards5 EER from the Deepwater Horizon5.1 Initiating incident5.2 Awareness5.3 Evaluation and egress5.4 Personnel on Board (POB) control5.5 Abandoning

6 Discussion7 Conclusion Acknowledgments References