This plain-text version of the United States Coast Guard report on the BP Deepwater Horizon oil spill disaster is provided as a public service by the law firm of Aylstock, Witkin, Kreis & Overholtz. For those users who have the Adobe Acrobat reading/viewing software, there is a PDF version on the USCG website.

United States Coast Guard

Report of Investigation into the Circumstances Surrounding the Explosion, Fire, Sinking and Loss of Eleven Crew Members Aboard the MOBILE OFFSHORE DRILLING UNIT DEEPWATER HORIZON

In the GULF OF MEXICO
April 20 – 22, 2010





Volume I
MISLE Activity Number: 3721503



Table of Contents

Volume I (Systems and responsibilities within U.S. Coast Guard purview under the U.S. Coast
Guard-Minerals Management Service Memorandum of Agreement dated March 27, 2009)

Table of Contents i
Prologue iii
Executive Summary ix
Chapter 1 | Explosion 1
Chapter 2 | Fire 34
Chapter 3 | Evacuation / Search and Rescue 46
Chapter 4 | Flooding and Sinking 72
Chapter 5 | Safety Systems (Personnel and Process) 89
Chapter 6 | Summary of Conclusions 113
Chapter 7 | Safety Recommendations 121
Chapter 8 | Administrative Recommendations 128
Appendices
Appendix A | List of Abbreviations A-1
Appendix B | Lists of Figures and Tables B-1
Appendix C | Parties in Interest C-1
Appendix D | Crew Data D-1
Appendix E | Vessel Particulars E-1
Appendix F | Weather Information F-1
Appendix G | Final Action Report on the SAR Case Study into the Mass G-1
Rescue of Personnel off the Mobile Offshore Drilling Unit

DEEPWATER HORIZON

i


Appendix H | Critical Events Timeline H-1

Appendix I | Potential Legal Issues Associated with Vessels Employing I-1
Dynamic Positioning Systems

Appendix J | Synopsis of Audits and Surveys J-1

Appendix K | Examples of Transocean’s Non-compliance with the K-1
International Safety Management Code

Appendix L | Post-sinking Analysis for DEEPWATER HORIZON L-1

Appendix M | Operational Risk Assessment M-1

Appendix N | BP DEEPWATER HORIZON Follow Up Rig Audit, Marine N-1
Assurance Audit and Out Of Service Period, September 2009

Appendix O | Results of Inspections & Surveys of Deepwater Horizon O-1
(2009-2010)

Appendix P | Convening Order Joint Department of the Interior and P-1
Department of Homeland Security Statement of Principles and
Convening Order Regarding Investigation into the Marine
Casualty, Explosion, Fire, Pollution, and Sinking of Mobile
Offshore Drilling Unit DEEPWATER HORIZON, with Loss
of Life in the Gulf of Mexico 21-22 April 2010

Appendix Q | USCG Investigation Team Members Q-1

ii


PROLOGUE


On April 20, 2010, the Mobile Offshore Drilling Unit (MODU) DEEPWATER HORIZON was
dynamically-positioned at location 28o-44’ North 088o-21’ West in the Mississippi Canyon
Block 252 of the U.S. Outer Continental Shelf (OCS). The MODU was performing drilling
operations on the Macondo Well, which had been previously started by another vessel. That
evening, a series of events began that would result in an explosion and fire, taking 11 lives,
injuring 16 others, and ultimately causing the MODU to become severely crippled and sink. The
casualty resulted in a continuous flow of hydrocarbons into the Gulf of Mexico for 87 days
before the well was capped, causing the largest oil spill in U.S. history and significant
environmental damage to the Gulf of Mexico. The tragedy affected the lives of hundreds of
thousands of people who live along the Gulf Coast or rely on the various economies associated
with the Gulf of Mexico.

Within six days of the incident, the Department of Homeland Security and the Department of the
Interior determined that a joint investigation of the DEEPWATER HORIZON’s explosion,
sinking, and the associated loss of life was the best strategy for determining the events, decisions,
actions, and resultant consequences of this marine casualty. The joint investigation was
conducted by the U.S. Coast Guard (USCG) and the Bureau of Ocean Energy Management,
Regulation and Enforcement (BOEMRE). The Joint Investigation Team (JIT) used the
combined investigative powers and authorities afforded to the USCG and BOEMRE. Personnel
from each agency were specifically assigned to the JIT to accommodate the collection of
evidence, conduct public hearings and inquiries, and coordinate forensic testing.

The agencies operated under the 2009 Memorandum of Agreement (MOA) that identifies
responsibilities of the Minerals Management Service (MMS) (predecessor to BOEMRE) and the
USCG. The USCG and MMS entered this agreement under the authority of Title 14, United
States Code (USC) § 141 – USCG Cooperation with other Agencies; 43 USC §§ 1347, 1348(a) –
the Outer Continental Shelf Lands Act (OCSLA), as amended; 33 USC § 2712(a)(5)(A) – the Oil
Pollution Act of 1990 (OPA); 43 USC §§ 1301-1315 – the Submerged Lands Act (SLA), as
amended; and the Energy Policy Act of 2005.

Per its Maritime Regulations, the Republic of the Marshall Islands (RMI), the flag state for
DEEPWATER HORIZON, is also responsible for investigating casualties that are categorized as
“Serious Marine Casualty” under the International Maritime Organization’s (IMO) Casualty
Investigations Code. The DEEPWATER HORIZON casualty falls in this category. To avoid
duplication of efforts, the USCG and RMI investigators shared data and coordinated requests for
information. Upon conclusion of the investigations, both countries are required to submit their
reports to the IMO for distribution of lessons learned and possible enhancement of safety
standards.

Regulatory Structure

The Outer Continental Shelf Lands Act (OCSLA), Title 43, United States Code, Chapter 29,
Subchapter III, provides regulatory authority over activities on the outer continental shelf (OCS)

iii


to the Secretary of the Interior, Secretary of Homeland Security, Secretary of the Army,
Secretary of Labor, Secretary of Transportation and Secretary of Energy. The Secretary of the
Interior and the Coast Guard (which has received a delegation of the relevant authorities from the
Secretary of Homeland Security) are responsible for requiring, wherever practicable, the best
available and safest technologies that are economically feasible, wherever failure of equipment
would have a significant effect on safety, health, or the environment. The Coast Guard also
promulgates regulations or standards applying to unregulated hazardous working conditions
related to activities on the OCS when it is necessary. OCSLA specifically requires the Secretary
of the Interior and the Coast Guard to individually or jointly enforce these safety and
environmental regulations at least once a year. Such enforcement should include inspecting all
safety equipment designed to prevent or ameliorate blowouts, fires, spillages, or other major
accidents, and performing a periodic onsite inspection without advance notice to the operator.

To meet these requirements, the Coast Guard and MMS signed a memorandum of understanding
(MOU) to delineate inspection responsibilities between both the agencies. The MOU is further
broken down into five memoranda of agreement (MOAs): OCS-01 Agency Responsibilities,
OCS-02 Civil Penalties, OCS-03 Oil Discharge Planning, Preparedness and Response, OCS-04
Floating Offshore Facilities and OCS-05 Incident Investigations. OCS-01 established
responsibilities for each agency and clarified overall responsibility where jurisdiction
overlapped.

Based on these memoranda of agreement, the Coast Guard performs annual inspections on U.S.flagged
MODUs/floating offshore installations and annual examinations on foreign-flagged
MODUs. These visits focus on the safe manning and operation of MODUs and include
inspection of: lifesaving, fire-fighting, hull integrity, vessel stability, means of egress, locations
containing hazardous electrical equipment, machinery systems, electrical systems, helicopter
facilities, cranes, navigation and occupational health and safety. In the case of foreign-flagged
MODUs, the flag state has primary responsibility for ensuring compliance with applicable
international standards. However, the United States can set requirements and conditions for
conducting activities on the U.S.OCS, including those that are applicable to foreign-flagged
MODUs. Pursuant to Coast Guard regulations specified in 33 CFR § 146.205, foreign-flagged
MODUs engaged in OCS activities must comply with one of three regulatory schemes, one of
which is the International Maritime Organization (IMO) MODU Code, which contains
recommended design criteria, construction standards, and other safety measures for MODUs.

DEEPWATER HORIZON was a foreign-flagged MODU that engaged in oil drilling activities on
the OCS. It was built and operated in accordance with the 1989 IMO MODU Code. Its flag
state, RMI, used the American Bureau of Shipping and Det Norske Veritas as recognized
organizations to conduct its required surveys and audits. The USCG periodically performed a
limited safety examination, which included verifying statutory certificates, testing of safety
devices, and witnessing emergency drills. At the time of the casualty, DEEPWATER HORIZON
possessed all required valid documents certifying compliance with applicable international, RMI
and USCG requirements.

iv


The Investigation

Under the MOAs, BOEMRE is responsible for investigating incidents related to systems
associated with exploration, drilling, completion, workover, production, pipeline and
decommissioning operations for hydrocarbons and other minerals on the OCS. The USCG is
responsible for investigating marine casualties involving deaths, injuries, property/equipment
loss, vessel safety systems, and environmental damage resulting from incidents aboard vessels
subject to U.S. jurisdiction. The MOA assigns responsibility in joint investigations according to

these responsibilities. Volume I addresses the areas of USCG responsibility and Volume II will
address the areas of BOEMRE responsibility.
The DEEPWATER HORIZON catastrophic casualty was comprised of a number of events. The
initiating event was the well blowout, which was preceded by a number of operational decisions
by the lessee and vessel operators. In this Volume I, the subsequent events, including explosion,
fire, evacuation, vessel sinking and vessel safety systems are examined. It focuses on the period
from approximately 2150 on April 20, when hydrocarbons reached the Drill Floor and the
drilling crew reported a “well control situation,” until 1026 on April 22, when DEEPWATER
HORIZON sank.

The marine casualty investigation into this incident began almost immediately after the USCG
received a distress alert from DEEPWATER HORIZON. Three Coast Guard investigators were
dispatched to the scene. They, along with MMS investigators, were transported by helicopter to
the platform MATTERHORN TLP, where they boarded the offshore supply vessel DAMON B.
BANKSTON, which had rescued the survivors, and began conducting interviews and gathering
documentary evidence. Coast Guard marine casualty investigators also ensured that the post-
casualty drug tests were conducted upon the DAMON B. BANKSTON’s arrival in Port Fourchon,
Louisiana.

The joint investigation began on April 27, when the Department of Homeland Security and the
Department of the Interior issued a Convening Order for the investigation. Captain Hung
Nguyen, USCG, and Mr. MMS, were assigned as co-chairs. Later, Captain Mark
Higgins, Captain (USCG, retired), and Lieutenant Commander
were designated as Coast Guard members. Additionally, Lieutenant Commander was
assigned as Coast Guard Counsel to the Joint Investigation Team.

USCG marine casualty investigation activities are guided by statute, regulations, and the Marine
Safety Manual, Volume V. Significant Coast Guard resources were devoted to this investigation.
The Board received technical, public affairs, legal and administrative support from the following
Coast Guard units and Headquarters offices:

. Marine Safety Unit Houma
. Marine Safety Unit Morgan City
. Marine Safety Unit Port Arthur
v


. Sector Honolulu
. Sector Houston-Galveston
. Sector New Orleans
. Sector San Francisco
. Public Affairs Detachment Houston
. District Eight External Affairs
. Investigations National Center of Expertise
. Offshore National Center of Expertise
. Marine Safety Center
. Commandant (CG-094, CG-52, CG-53, CG-54)
In determining causal factors and identifying potential improvement, an “Investigation
Roadmap,” Figure 1 was developed to focus investigators on potential problem areas. Initial
public hearings were organized to evaluate the adequacy of vessel design standards, casualty
response and Government oversight. As information became available, additional hearings were
held to examine the results of forensic testing of physical evidence, the effectiveness of vessel
safety management, and corporate safety culture. The oil spill response efforts associated with
the explosion and extending beyond April 26th are outside the scope of this investigation.
Information dealing with the oil spill response may be obtained by contacting the Coast Guard in
Washington, DC.1

Relating to vessel safety, the USCG members of the Board identified a number of subjects for
inclusion in the investigation:

. The materiel condition and emergency preparedness of DEEPWATER HORIZON;
. The vessel’s dual-command organizational structure and how it impacted the crew’s
situational awareness, risk assessment and decision making;
. The role that Transocean’s safety management system played leading up to and during
this casualty;
. The Republic of the Marshall Islands’ safety oversight of DEEPWATER HORIZON;
1 United States Coast Guard, Attn: Commandant (CG-5), 2100 Second Street, S.W., Stop 7355, Washington, DC
20593-7355

vi


. The Coast Guard’s regulatory requirements for U.S. and foreign-flagged MODUs that
engage in activities on the U.S. OCS;
. The “flag state/coastal state” oversight regime for foreign MODUs, which engage in
activities on the U.S. OCS;
. The application of the1989 IMO MODU Code to DEEPWATER HORIZON; and
. The international standards and Coast Guard regulations pertaining to vessels with
dynamic positioning systems.


Figure 1 – Investigation Roadmap – DEEPWATER HORIZON Casualty

Safety recommendations have been developed to promote a higher safety standard, a more
effective Government oversight program, and a more prepared response posture for complex and
dangerous offshore oil and gas drilling operations.

In each chapter of this Volume I, the following are included:

. An overview of the event;
vii


. A discussion of the relevant safety systems and any failures; and
. A discussion on how certain actions or decisions impacted the safety systems or caused
them to fail.
viii


EXECUTIVE SUMMARY


On April 20, 2010 at approximately 2150, hydrocarbons rising up from BP’s Macondo well
ignited and caused an explosion on DEEPWATER HORIZON, a mobile offshore drilling unit
(MODU) that was drilling approximately 40 miles off the coast of Louisiana. A short time later,
a second explosion rocked the unit. These explosions triggered a massive fire that burned out of
control. Crew members evacuated by lifeboat and liferaft, and some jumped from the burning
unit. U.S. Coast Guard and other vessels and aircraft searched for survivors and sought to
salvage the vessel. Because DEEPWATER HORIZON had not been able to shut in (close) the
well or disconnect from the well head, the hydrocarbons that were fueling the fire continued to
flow unabated. At 1026 on April 22, DEEPWATER HORIZON sank into the Gulf of Mexico.
115 people aboard successfully evacuated and survived. However, 11 crew members are
missing and presumed deceased, and 16 were injured.

The Joint Investigation Team (JIT) comprised of members from the U.S. Coast Guard and
Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) examined five
aspects of this disaster relating to areas of responsibility of the U.S. Coast Guard: the
explosions, the fire, the evacuation, the flooding and sinking of the MODU, and the safety
systems of DEEPWATER HORIZON and its owner-operator, Transocean. Although the events
leading to the sinking of DEEPWATER HORIZON were set into motion by the failure to prevent
a well blowout, the investigation revealed numerous systems deficiencies, and acts and
omissions by Transocean and its DEEPWATER HORIZON crew, that had an adverse impact on
the ability to prevent or limit the magnitude of the disaster. These included poor maintenance of
electrical equipment that may have ignited the explosion, bypassing of gas alarms and automatic
shutdown systems that could prevent an explosion, and lack of training of personnel on when and
how to shutdown engines and disconnect the MODU from the well to avoid a gas explosion and
mitigate the damage from an explosion and fire. These deficiencies indicate that Transocean’s
failure to have an effective safety management system and instill a culture that emphasizes and
ensures safety contributed to this disaster.

This investigation also revealed that the oversight and regulation of DEEPWATER HORIZON by
its flag state, the Republic of the Marshall Islands (RMI), was ineffective in preventing this
casualty. By delegating all of its inspection activities to “recognized organizations,” without
itself conducting on board oversight surveys, the RMI effectively abdicated its vessel inspection
responsibilities. In turn, this failure illustrates the need to strengthen the system of U.S. Coast
Guard oversight of foreign-flagged MODUs, which as currently constructed is too limited to
effectively ensure the safety of such vessels.

This report covers the areas under the cognizance of the U.S. Coast Guard investigated by the
Joint USCG/BOEMRE Investigation Team (JIT). It includes USCG JIT recommendations to
enhance the safety and effective oversight of foreign-flagged MODUs operating on the U.S.
OCS. Many of these recommendations are for the Commandant of the Coast Guard to work with
the International Maritime Organization (IMO) to amend its MODU Code, which is intended to
provide guidance to flag state administrations in promulgating their own regulations.

ix


I. Explosions
During the evening of April 20, 2010, as the master (captain) of DEEPWATER HORIZON was
conducting a tour of the MODU for visiting BP and Transocean officials, the drilling crew
observed abnormal pressures in the pipe leading to the well and began initiating steps to shut in
the well to prevent the release of hydrocarbons. Around 2150, however, there was a well
blowout, as drilling mud and hydrocarbons came shooting up from the well. Although the crew
tried to divert the flow to the mud gas separator (MGS), a system that separated out and released
gas through an outlet at the top of the derrick, the mud and hydrocarbons began discharging onto
the Drill Floor. Alarms activated, signaling that flammable gases were in various locations on or
near the Drill Floor. The MODU was rocked by an explosion followed by a fire. As additional
gas alarms activated, the MODU then suffered a second more violent explosion, which caused a
total loss of electrical power.

After the explosions, the master asked for and received permission from the offshore installation
manager (OIM) to activate the emergency disconnect system (EDS), designed to shut in the well
and disconnect the MODU from the well, thereby cutting off the flow of hydrocarbons fueling
the fire. By this time, however, the subsea supervisor on the bridge had already attempted to
activate the EDS. Although the control panel displayed what appeared to be proper indications
of operation, he determined that the signal had never left the control panel, and that the MODU
could not be disconnected from the well.

A. Causal Analysis
As the well blowout occurred, an uncontrolled volume of gas consisting of methane, ethane,
propane, and hydrocarbons flowed up from the wellhead and likely formed a gas cloud over
large areas on several decks. The explosions likely occurred when gas from this cloud
encountered one or more ignition sources on the Drill Floor or elsewhere on DEEPWATER
HORIZON.

. Points of Origin: The first explosion and fire occurred on the Drill Floor. Several
witnesses observed drilling mud and liquids flowing out of a vent on the derrick
connected to the MGS system, followed by an explosion. The second explosion
occurred in Engine Room # 3 or in one of the adjacent switchgear or electrical rooms.
Personnel in the Engine Control Room (ECR) saw and heard the explosion come
from the direction of Engine Room #3 and force inward the port side door to the
ECR.
. Ignition Source: Although the exact location of the ignition sources cannot be
conclusively identified, the evidence best indicates that flammable gases were ignited
by (1) electrical equipment on or near the Drill Floor, and/or (2) electrical equipment
in or near the main engines and switchgear rooms.
. Impact on Personnel: All of the missing and presumed deceased crew members
were last seen on or near the Drill Floor area or in the Mud Pits. Although cause of
death cannot be definitively established, the crew members in the Drill Floor area are
x


believed to have suffered fatal injuries during the initial explosions, because the
layout of the Drill Floor provided no protection from the force and heat of an
explosion. The type of barrier between the Mud Pits and the Drill Floor area did not
provide substantial protection for crew members against an explosion originating on
the Drill Floor.

B. Key Investigative Findings
The JIT investigation identified several system deficiencies and crew decisions that may have
affected the explosions or their impact, including:

. Failure to Use the Diverter Line: When the drilling crew directed the uncontrolled
well flow through the MGS, the high pressure exceeded the system’s capabilities and
caused gas to discharge on the Main Deck. Alternatively, the crew could have
directed the well flow through a “diverter line” designed to send the flow over the
side of the MODU. Although the diverter line also may have failed under the
pressure, had it been used to direct the flow overboard, the majority of the flammable
gas cloud may have formed away from the Drill Floor and the MODU, reducing the
risk of an onboard explosion.
. Hazardous Electrical Equipment: At the time of the explosions, the electrical
equipment installed in the “hazardous” areas of the MODU (where flammable gases
may be present) may not have been capable of preventing the ignition of flammable
gas. Although DEEPWATER HORIZON was built to comply with IMO MODU
Code standards under which such electrical equipment is required to have safeguards
against possible ignition, an April 2010 audit found that DEEPWATER HORIZON
lacked systems to properly track its hazardous electrical equipment, that some such
equipment on board was in “bad condition” and “severely corroded,” and that a
subcontractor’s equipment that was in “poor condition” had been left in hazardous
areas. Because of these deficiencies, there is no assurance that the electrical
equipment was safe and could not have caused the explosions.
. Gas Detectors: Although gas detectors installed in the ventilation inlets and other
critical locations were set to activate alarms on the bridge, they were not set to
automatically activate the emergency shutdown (ESD) system for the engines or to
stop the flow of outside air into the engine rooms. The bridge crew was not provided
training or procedures on when conditions warranted activation of the ESD systems.
Thus, when multiple gas alarms were received on the bridge, no one manually
activated the ESD system to shut down the main engines. Had it been activated
immediately upon the detection of gas, it is possible that the explosions in the engine
room area could have been avoided or delayed.
. Bypassed Systems: A number of gas detectors were bypassed or inoperable at the
time of the explosions. According to the chief electronics technician, it was standard
practice to set certain gas detectors in “inhibited” mode, such that gas detection would
be reported to the control panel but no alarm would sound, to prevent false alarms
from awakening sleeping crew members. Similarly, the crew bypassed an automatic
xi


shutdown system designed to cut off electrical power when ventilation system safety
features failed, possibly allowing flammable gas to enter an enclosed area and reach
an ignition source. The chief electrician had been told that it had “been in bypass for
five years” and that “the entire fleet runs them in bypass.”

. Design of the Main and Emergency Power Sources: Although the arrangement of
main and emergency generators on DEEPWATER HORIZON met IMO MODU Code
requirements to have completely independent engine-generator rooms along with
independent power distribution and control systems, it did not prevent a total failure
of the main electrical power system, when the explosions and fire damaged multiple
generators and their related power distribution and control equipment. The design did
not adequately take into account that the proximity of the air inlets to each other
created a risk that flammable gases could impact all six generators at once.
. Crew Blast Protection: DEEPWATER HORIZON did not have barriers sufficient to
provide effective blast protection for the crew. Although the barriers separating the
Drill Floor from adjacent crew quarters met the standards of the IMO MODU Code,
those specifications are only designed to slow the spread of fire, not to resist an
explosion. They did not prevent personnel in the crew accommodations area from
sustaining injuries.
. Command and Control: Because of a “clerical error,” by the Republic of the
Marshall Islands, DEEPWATER HORIZON was classified in a manner that permitted
it to have a dual-command organizational structure under which the OIM was in
charge when the vessel was latched on to the well, but the master was in charge when
the MODU was underway between locations or in an emergency situation. When the
explosions began, however, there was no immediate transfer of authority from the
OIM to the master, and the master asked permission from the OIM to activate the
vessel’s EDS. This command confusion at a critical point in the emergency may have
impacted the decision to activate the EDS.
C. Key Recommendations
The JIT recommends that the IMO MODU Code be amended to:

. Include clear requirements for labeling and control of electrical equipment in
hazardous areas and to require continued inspection, repair, and maintenance of such
electrical equipment;
. Provide more detailed guidance for the design and arrangement of gas detection and
alarm systems and to identify recommended automatic and manual emergency
shutdown actions to be performed following gas detection in vital areas;
. Require that ventilation inlets for machinery spaces containing power sources be
located as far as possible from hazardous locations; and
xii


. Require an explosion risk analysis to determine whether the barriers around a
MODU’s accommodation areas, escape paths and embarkation stations provide
adequate protection.
The JIT also recommends that the Commandant of the Coast Guard pursue regulatory changes to
provide clear designation of the person in charge under both operating and emergency conditions
for all MODUs operating on the U.S. Outer Continental Shelf (OCS).

II. The Fire
As alarms sounded following the explosions, personnel assigned to DEEPWATER HORIZON’s
firefighting team began to assemble at the designated staging area. With no electrical power,
however, the MODU’s fire pumps could not be operated to supply water to the fire main and
sprinkler system. The chief engineer tried to start the standby generator in order to bring one of
the main generators on line to supply electrical power for the fire pumps. He was unsuccessful.
The firefighting team soon concluded that fighting the fire would be futile. When it became
apparent that there was no electrical power and the EDS had not disconnected the MODU from
the well, the master made the decision to abandon ship.

DEEPWATER HORIZON was equipped with several firefighting systems, including (1) a fire
main system, consisting of fire pumps to draw water from the sea and send it to hose stations, a
single fire monitor (water cannon), and a “deluge system” for the area separating the drill floor
from crew quarters; (2) a sprinkler system over the crew quarters and dining area; (3) a carbon
dioxide fire extinguishing system to fight fires in key systems areas; and (4) a foam system to put
out fires involving helicopters and their fuel. In addition, in certain critical locations, such as
between the Drill Floor and crew quarters, DEEPWATER HORIZON used fire resistant
bulkheads (barriers between sections of the MODU) designed to slow the spread of fire.

A. Key Investigative Findings
. Because the fire main system depended exclusively on electric motor driven fire
pumps, it was rendered useless when the explosions caused a total loss of power.
Although the IMO MODU Code does not require the availability of a non-electric fire
pump, this system vulnerability could have been addressed by having at least one
diesel-powered fire pump.
. Without electricity to operate the fire pumps, and without being able to cut off the
source of fuel to the fire, the fire brigade members’ decision not to attempt to fight
the fire was reasonable.
. The crew’s approach to fire drills may have influenced its lack of response to the fire.
Given that drills were held at the same time and on the same day every week, that
drilling personnel were excused from these exercises, and that records indicate that
the crew was not treating fire drills as “the real deal,” the routine, repetitive nature of
the fire drills may have led to a degree of complacency among the crew members.
xiii


. The spread of the fire after the explosions was not limited by the “A-class bulkheads”
(barriers) on DEEPWATER HORIZON and resulted in one of the visiting Transocean
executives suffering serious burns. These barriers were never designed to stand up to
explosions and the extreme heat of a hydrocarbon fire.
B. Key Recommendations
The JIT recommends that the IMO MODU Code be amended to enhance fire safety on MODUs
by:

. Requiring that MODUs have available a non-electrically powered fire pump to
provide fire main pressure during a loss of electrical power;
. Requiring a fixed water deluge system to fight fires on or near the Drill Floor, which
may automatically activate upon gas detection; and
. Requiring hydrocarbon fire-resistant bulkheads between the drilling area, adjacent
accommodation spaces, and spaces housing vital safety equipment.
III. The Evacuation
When the master (captain) gave the order to abandon ship, crew members assembled near the
two lifeboats at the bow of DEEPWATER HORIZON. Although designated personnel sought to
take a headcount prior to evacuation, they were unable to do so effectively because of confusion
and panic. As debris fell around the crew, several crew members chose to jump overboard rather
than wait for the lifeboats.

When the two lifeboats were launched, eleven crew members were left behind. Because it was
not clear that they could safely reach the two remaining lifeboats at the opposite end of the
MODU, the master elected to launch a liferaft. Because of intense heat and smoke, and crew
fears that the raft would burn or melt, the liferaft was launched with only seven crew members
aboard. Judging that there was not enough time to launch another liferaft, the master and three
remaining crew members jumped over 50 feet into the water.

At the time of the explosions, the DAMON B. BANKSTON, an offshore supply vessel, was
alongside DEEPWATER HORIZON to receive drilling mud to be transported ashore. After the
first crew members jumped in the water, DEEPWATER HORIZON requested that DAMON B.
BANKSTON launch its “fast rescue craft,” a small boat, which was then used to rescue the
personnel who had jumped from the MODU and to tow the liferaft to safety. After the two
lifeboats reached the DAMON B. BANKSTON safely, the first complete headcount since the
explosions revealed that 115 personnel had successfully evacuated, but that 11 crew members
were still missing.

A. Key Investigative Findings
. The DEEPWATER HORIZON crew did not follow its own emergency procedures for
notifying the crew of an emergency and taking steps to prepare for evacuation. For
xiv


example, contrary to standard procedure, the crew failed to sound the general alarm
after two gas detectors activated. This failure may be attributable to the presence of
the BP and Transocean executives onboard, which had also prevented key personnel
from attending to the well control issues immediately prior to the blowout. A senior
drilling crew member acknowledged that if he and the master had not been
conducting a tour for the company executives, he would have been on the Drill Floor
while key tests were being conducted.

. Although DEEPWATER HORIZON conducted a number of emergency drills, it never
conducted drills on how to respond to a well blowout that leads to the need to
abandon ship. In the confusion of the evacuation, no complete muster (headcount) of
personnel was conducted onboard DEEPWATER HORIZON.
. The current lifeboat design and testing requirements do not adequately ensure the safe
loading of a stretcher or permit adequate seating to accommodate the physical build
of the average offshore worker today.
. The liferaft launch area had no effective barrier to shield it from the intense heat of
the fire that threatened to incinerate the liferaft. Without a regulatory requirement to
launch liferafts during evacuation drills, the crew had not practiced such an evolution,
and struggled to launch the raft and failed to release a line connecting it to the
MODU, which caused the raft to toss the occupants about and eject one crew member
upon contact with the water.
. The evacuation of DEEPWATER HORIZON was substantially aided by the presence
of the DAMON B. BANKSTON and the use of its “fast rescue craft,” which assisted at
least 15 survivors. Although there was no regulatory requirement for a MODU to
have a “standby vessel” at its side for safety purposes or to have its own fast rescue
craft, the role DAMON B. BANKSTON played in saving lives demonstrates the value
that such requirements could provide.
B. Key Recommendations
The JIT recommends that the IMO MODU Code be amended to:

. Include the type, frequency, extent, randomness and evaluation criteria for all
emergency contingency drills;
. Amend the Lifesaving Appliances (LSA) Code and its testing recommendations to
ensure the adequacy of design and performance standards for lifeboats and liferafts;
. Establish standards on the maximum allowable heat exposure for personnel at the
muster stations and lifeboat/liferaft lowering stations; and
. Address the need for a fast rescue boat/craft onboard MODUs.
xv


The JIT also recommends that the Commandant revise regulations to:

. Require the crew to practice launching liferafts during evacuation drills; and
. Establish requirements for designated standby vessels for MODUs engaging in oil
and gas drilling activities on the U.S. OCS.
IV. Flooding and Sinking
During the two days following the explosions, the Coast Guard engaged in search and rescue
efforts aimed at finding the 11 missing personnel. They were never found and are presumed to
have died. During the same period, 11 different vessels arrived on scene to fight the fire on
DEEPWATER HORIZON using fire monitors (water cannons). At the outset, there was little
coordination of the firefighting efforts until SMIT Salvage Americas, a contractor engaged by
Transocean, began to take charge late on April 21. With the large volumes of water applied to
the fire, some portion of that water likely began to accumulate inside of, and migrated within, the
hull. By the morning of April 22, as more openings became submerged, DEEPWATER
HORIZON began taking on increasing amounts of water until at 1026, it sank.

A. Causal Analysis
. Although the exact cause of the loss of stability and sinking of DEEPWATER
HORIZON cannot be determined based on the limited information available, possible
factors include (1) damage to the MODU from the explosions and fire; (2)
accumulation of water from firefighting efforts in the interior portions of the MODU,
known as “downflooding”; and (3) migration of water within the MODU through
watertight barriers that were damaged, poorly maintained, or left open by crew at the
time of evacuation.
. Some amount of water from firefighting efforts remained onboard, increased the
weight of the vessel, and reduced its stability. Although there is insufficient data to
determine what percentage of such water remained onboard, a Coast Guard post-
casualty stability analysis (Appendix L) revealed that the MODU’s displacement of
water increased by an amount that was too great to have been caused by the shifting
of loads onboard prior to the explosion.
. In the absence of the volume of firefighting water applied to DEEPWATER
HORIZON, the MODU’s structure would likely have been exposed to more extreme
heat, which could have expedited a catastrophic structural failure. It is therefore not
possible to conclude that the water from the firefighting vessels accelerated its
sinking.
B. Key Investigative Findings
. Prior to the explosions, DEEPWATER HORIZON was not in compliance with
established requirements for maintaining the watertight integrity of its internal
compartments. Audits in September 2009 and April 2010 found watertight integrity
xvi


issues, one of which “directly affect[ed] the stability of the rig.” Faulty watertight
closures could have accelerated progressive flooding on the MODU.

. Pursuant to its Search and Rescue Policy, the Coast Guard prioritized search and
rescue efforts and thus did not take charge of, or coordinate, the marine firefighting
effort. Such coordination did not occur until over 24 hours after the explosions, when
Transocean’s contractor, SMIT Salvage Americas, began to actively direct the
firefighting efforts and seek to minimize downflooding. As a result, massive
quantities of water were directed toward DEEPWATER HORIZON without careful
consideration of the potential effects of water entering the hull.
. Transocean never developed a salvage plan for DEEPWATER HORIZON. The only
document it generated, an introductory guidance document, did not designate a
specific person on scene to direct response vessels and did not warn of the possible
impact of downflooding on the stability and buoyancy of the MODU. The lack of a
salvage plan with such information extended the amount of time DEEPWATER
HORIZON was exposed to an uncoordinated firefighting effort.
. Although Transocean had a vessel response plan for DEEPWATER HORIZON that
addressed how to respond to an emergency or casualty that could result in an oil spill,
Transocean personnel engaged in the response were not familiar with the plan and
deviated from it without appropriate justification when they selected a salvage
company different from the one identified in the plan.
. During and after the casualty, Transocean did not have available loading information
on DEEPWATER HORIZON at the time of the explosions. The lack of loading
information prevented responders from assessing the damage to the MODU and
determining the amount of time available until sinking. It also prevented
investigators from determining the cause of the sinking.
. Contrary to the IMO MODU Code and the DEEPWATER HORIZON operations
manual, Transocean failed to conduct a deadweight survey within the past five years
to determine the weight of DEEPWATER HORIZON. This failure made it difficult
for responders and investigators to evaluate the stability of the vessel.
C. Key Recommendations
The JIT recommends that the Commandant:

. Review all applicable policies on marine firefighting to ensure consistency;
. It is recommended that Commandant require that MODUs and floating production,
storage and offloading vessels engaging in oil and gas drilling activities on the U.S.
OCS be subject to the salvage and marine firefighting requirements of 33 CFR § 155,
Subpart I;
xvii


. Evaluate possible regulatory requirements for MODUs engaging in oil and gas
drilling activities on the U.S. OCS to, on a daily basis, relay their loading information
ashore; and
. Update regulations to include a requirement to conduct a deadweight survey every
five years for all (U.S. and foreign-flagged) MODUs conducting activities on the U.S.
OCS.
V. Safety Systems
The catastrophic well failure and explosions on DEEPWATER HORIZON represented a failure
of the “maritime safety net” established to ensure safety on offshore drilling MODUs on the U.S.
OCS. Multiple stakeholders are entrusted with ensuring safety. During day-to-day operations,
Transocean (the vessel operator) had primary responsibility for ensuring the safety of
DEEPWATER HORIZON and its personnel. RMI (the flag state) was responsible for conducting
inspections to ensure DEEPWATER HORIZON met international standards and flag state
regulations. RMI delegated these duties to two “recognized organizations,” American Bureau of
Shipping (ABS) and Det Norske Veritas (DNV). Finally, the Coast Guard (the coastal state),
relying heavily on the flag state’s oversight of its vessels, conducted limited safety examinations
to assess whether the vessel was in substantial compliance with U.S. laws and regulations.

This “maritime safety net” system, however, failed to prevent this disaster. The investigation
revealed that DEEPWATER HORIZON and its owner, Transocean, had serious safety
management system failures and a poor safety culture. It has also shown that RMI’s oversight of
safety issues was inadequate and created an environment in which the casualty could occur.
These failures have exposed the weaknesses of the United States regulatory scheme in which the

U.S. Coast Guard is called upon to conduct only limited oversight of foreign-flagged vessels
engaged in OCS activities.
A. Transocean
The investigation has shown that over a period of years and in the time leading up to the
casualty, Transocean amassed numerous deficiencies in the area of safety, including:

. International Safety Management Code Violations: Both Transocean and
DEEPWATER HORIZON were required to have a safety management system that
complied with the ISM Code, the purpose of which is to ensure safety at sea, prevent
injury or loss of life, and avoid damage to the environment. The investigation,
however, determined that Transocean had a history of ISM Code violations on
DEEPWATER HORIZON and other vessels.
. Poor Maintenance Record: Two recent audits of DEEPWATER HORIZON found
numerous maintenance deficiencies that could impact safety, including problems with
firefighting, electrical, and watertight integrity systems. In particular, the audits
found that, contrary to the manufacturer’s guidelines which called for inspection and
certification of the blowout preventer (BOP) every three to five years, Transocean did
not arrange to have the DEEPWATER HORIZON BOP recertified for over ten years.
xviii


In addition, key BOP parts had “significantly surpassed the recommended
recertification period” and needed to be replaced.

. History of Safety Incidents: In 2008, DEEPWATER HORIZON had two significant
incidents which could have seriously affected the safety of the vessel or the
environment – a loss of power that jeopardized the MODU’s ability to maintain its
position above the well and the flooding of a compartment resulting from a failure to
close valves. Neither of these incidents was properly investigated and addressed.
. Crew Training and Knowledge: Transocean failed to ensure that its onboard
management team and crew had sufficient training and knowledge to take full
responsibility for the safety of the vessel. The master acknowledged that the training
he received on the Safety Management System consisted of viewing a PowerPoint
presentation, the content and whereabouts of which he was unable to recall. The
master was not aware that he had the authority to activate the Emergency Disconnect
System, a critical step to cut off the flow of flammable gases to the MODU, and the
official who received gas alarms was unaware of procedures relating to the activation
of the emergency shutdown system in response to such alarms, even though shutting
down the engines could have averted an explosion.
. Emergency Preparedness: Transocean failed to require that systems and personnel
emphasize maximum emergency preparedness. As discussed above, Transocean
allowed the DEEPWATER HORIZON crew to inhibit or bypass gas alarms and
automatic shutdown systems, and it did not require robust emergency drills.
Collectively, this record raises serious questions whether Transocean’s safety culture was a
factor that contributed to the disaster.

B. Flag State
The Republic of the Marshall Islands (RMI) failed to directly ensure that DEEPWATER
HORIZON was in compliance with all applicable requirements, including those relating to the
electrical equipment in hazardous zones, degradations in watertight integrity, crew training,
emergency preparedness, and others. RMI entrusted these duties to ABS and DNV, and did not
conduct sufficient monitoring of those classification societies to detect oversight failures. This
incident raises serious questions about the regulatory model under which a flag state may rely
entirely on classification societies to do its inspection and investigative work.

C. Coast Guard
The Coast Guard conducted limited safety examinations of DEEPWATER HORIZON in 2008
and 2009, but did not identify safety concerns. Given the flag state’s oversight deficiencies, the
Coast Guard’s regulatory scheme, which defers heavily to the flag state to ensure the safety of
foreign-flagged MODUs, is insufficient. Among the system’s weaknesses are that under Coast

xix


Guard regulations:

. A foreign-flagged MODU is only required to undergo a Coast Guard safety
examination, a much less rigorous review than a Coast Guard inspection of a U.S.flagged
MODU.
. A foreign-flagged MODU is only required to report to the Coast Guard incidents
resulting in death or serious or numerous injuries, but not other accidents or
mechanical failures that could affect the vessel’s seaworthiness or fitness for service.
D. Key Recommendations
The JIT recommends that the Commandant:

. Require and coordinate expanded ISM Code examinations of all Transocean vessels
that are subject to the ISM Code and that engage in oil and gas drilling activities on
the U.S. OCS;
. Work with the RMI to require an immediate annual verification of the safety
management system of the main and North American offices of Transocean;
. Develop more comprehensive inspection standards for foreign-flagged MODUs
operating on the U.S. OCS and a risk-based program to provide additional Coast
Guard oversight of such vessels;
. Work with the IMO to evaluate the need to require flag states to audit classification
societies acting on their behalf as a Recognized Organization and to develop a code of
conduct for Recognized Organizations; and
. Make marine casualty reporting requirements for foreign-flagged MODUs operating
on the U.S. OCS consistent with the requirements for U.S.-flagged MODUs.
xx


Chapter 1 | EXPLOSION

This section describes the events onboard the mobile offshore drilling unit (MODU)
DEEPWATER HORIZON on April 20, 2010 from 2100 hours local time to the secondary
explosion at 2150. It provides an overview of the preliminary indications and warnings of well
control problems leading up to the explosion; a description of the introduction of hydrocarbons
onto the MODU; discussion of possible ignition sources, emergency power systems, fire and gas
detection systems, crew blast protection systems and their failure; discussion of actions and
decisions that may have increased the likelihood or impact of the explosions; and a description of
government and third party oversight of vessel inspection and survey.

I. Overview
A. The Explosions and Emergency Disconnect System Activation
On April 20, the crew began the temporary well abandonment2 process by running tests to
determine the integrity of the well, following procedures sent to the MODU by a BP drilling
engineer that morning.3 The crew first conducted a positive pressure test to determine whether
the well casing could sustain pressure exerted on it from the inside by the well formation and
received satisfactory results.4 During the afternoon of the April 20, the crew pumped mud up
from the well and onto the DAMON B. BANKSTON, an offshore supply vessel working at
Macondo.

Next, crew members turned to conducting a negative test, which would give the crew indications
whether the final cement job was capable of keeping hydrocarbons out of the well. The first
negative test gave uncertain results, so the decision was made to run a second negative test.5
Shortly before 2000, both the Transocean crew and the BP well site leader on the MODU
concluded that the second negative test was successful, indicating that the final cement job was
satisfactory.6 After moving mud between various mud pits, the crew opened the blowout
preventer (BOP) and pumped seawater down the drill pipe to displace mud and a spacer out of
the riser. Although there were changes in drilling pressure while these well activities were
continuing, personnel monitoring the well did not recognize these changes to be a sign of a “well
kick,” a problematic influx of fluids into the wellbore.

From approximately 2100 to 2150 hours, however, the drilling crew observed abnormal
pressures on the drill pipe and began initiating steps to shut in the well and divert flow to the
mud gas separator (MGS). At 2150, the assistant driller called the senior toolpusher and
informed him that “we have a situation … [t]he well is blown out … [w]e have mud going to the


2 Definitions of drilling terms can be found at http://www.boemre.gov/glossary/ or
http://www.osha.gov/SLTC/etools/oilandgas/glossary of terms/glossary of terms a html.
3 BP –HZN-MBI-000021237.
4 BP-HZN-MBI-00136947.
5 Testimony 5/27/2010 pp 26-27.
6 Testimony 5/27/2010 pp 90-91; Testimony 5/28/2010 p 247.


1



crown.”7 When asked if the well was shut in, the on-watch assistant driller advised that the on-
watch toolpusher was doing so.8

At approximately 2150, the on-watch dynamic positioning officer (DPO) in the Central Control
Room/Bridge (CCR)9 felt the MODU jolt.10 A series of alarms indicating the presence of
flammable gas on the Drill Floor and in the Shale Shaker House appeared on the main fire and
gas detection system control panel.11 The on-watch senior dynamic positioning officer (SDPO)
tried to investigate by repositioning the closed circuit television system (CCTV) video monitor
(Camera 21) to focus in the starboard aft direction. He observed drilling mud being ejected onto
the Drill Floor, but was unable to determine its source.12 At this time, the on-watch DPO
received a call from the Drill Floor informing her of a “well control situation.”13 Immediately
after, the first explosion occurred and the on-watch SDPO observed flames on the CCTV, but
was again unable to determine their source. Additional gas alarms activated, indicating the
presence of flammable gas in the Shale Shaker House. The on-watch SDPO attempted to call the
Shale Shaker House to warn personnel, but there was no answer.14 At about the same time, the
on-watch DPO received a call from the Engine Control Room (ECR) inquiring into the events
onboard.15 The MODU suffered a second more violent explosion and fire and a loss of electrical
power.16 The Bridge crew was unable to rapidly determine the source of the explosion or the
extent of the fire. As the event was unfolding, the chief mate arrived in the CCR; he reported
that the fire was not controllable and advised the master that the MODU should be abandoned.17


Following the first explosion, the crew on watch in the CCR began taking actions to ascertain the

status of the thrusters, which were needed to move off the well site to a safe location if the
emergency disconnect system (EDS) was activated. 18 The on-watch SDPO was unable to
confirm the operability of the dynamic positioning system (DPS) because he was receiving a
position drop-out.19 However, he was able to evaluate the trends of the MODU’s pitch and roll
as well as the vessel’s draft to determine that the vessel was not listing.20 At the same time, the


7 Testimony 5/28/2010 pp 283.
8 Ibid.
9 For additional information on the facilities and features of DEEPWATER HORIZON referenced throughout the
report, and their specific location on the MODU and in relation to each other, see the descriptions and maps/floor
plans contained in Appendix E.
10 Testimony 10/5/2010 p 13.
11 Ibid.
12 Testimony 10/5/2010 p 13; Testimony 10/5/2010 p 150.
13 Testimony 10/5/2010 p 150.
14 Ibid., pp 150-151.
15 Testimony 10/5/2010 pp 13-14.
16 Testimony 10/5/2010 p 151; Testimony 10/5/2010 pp 13-14.
17 Testimony 10/5/2010 p 19.
18 The Emergency Disconnect System (EDS) is a critical safety system that is intended to allow personnel to
disengage the MODU from the well. It is operated in emergencies to disconnect the drill pipe from the well,
allowing the MODU to move away from the well site.
19 Testimony 10/5/2010 pp 240-241. A position drop-out occurs when the MODU’s Global Positioning
Systems (GPS) reference systems are no longer working. In this instance, the SDPO believed that three of the
MODU’s positioning antennae located on top of the crown of the derrick were damaged by the fire in the derrick,
and thus could not accurately determine the position of the MODU.
20 Testimony 10/5/2010 p 152.


2



on-watch DPO called up a series of thruster menus on her control console, which showed
numerous alarms, indicating that the thrusters were not available.21

Shortly thereafter, the on-watch subsea supervisor arrived in the CCR and advised the master,
“I’m EDSing.” The master responded, “No, calm down. We’re not EDSing.” The on-watch
subsea supervisor proceeded to the EDS panel. The on-watch well site leader standing by the
EDS panel told the subsea supervisor, “They got the well shut in.”22 The on-watch subsea
supervisor observed a number of alarms flashing. He then told the on-watch well site leader
“I’m getting off here,” to which the on-watch well site leader responded “Yeah, hit the button.”
The on-watch subsea supervisor activated the EDS and observed on the panel what appeared to
be a proper sequence of operation; however, he then determined that the signal never left the
control panel because no hydraulic power was available.23

Approximately five minutes later, the offshore installation manager (OIM) arrived in the CCR.
The master asked and received permission from the OIM to EDS.24 The master then told the on-
watch subsea supervisor to EDS; the subsea supervisor responded, “I already hit it.”25

B. Origin of the Explosions
Although the exact cause and origin of the explosions and fire cannot be definitively established,
crew testimony identified two locations from which the explosions and fire may have started,
one on or near the Drill Floor and a second on or near Engine Room #3. There is conclusive
testimony that two explosions occurred along with a loss of electrical power; however, the
testimony conflicts on the order in which the three events occurred. As the discussion below
shows, the loss of electrical power is the key indicator of the sequence of events, and likely was
caused by the second explosion damaging the electrical power distribution and control
equipment in the switchgear rooms and ECR adjacent to the Engine Room # 3.

1. Drill Floor
of the derrick.27

Personnel in a position to see the Main Deck and Drill Floor of DEEPWATER HORIZON
reported that they saw drilling mud and other liquids discharging first from somewhere on the
Drill Floor, and then from the top of the derrick located on the Drill Floor.26 Drilling mud and
other liquids then discharged from the area of the MGS gooseneck vent on the starboard aft side
21 Testimony 10/5/2010 pp 44-45.
22 Testimony 5/28/2010 p 123.
23 Ibid.
24 Testimony 8/26/2010 p 440; Testimony 10/5/2010 pp 21, 26.
25 Testimony 5/28/2010 pp 144-145.
26 Testimony 5/29/2010 p 144; Testimony 5/11/2010 pp 98-99; Testimony 5/29/2010 p 9;
Testimony 5/11/2010 p 136.
27 Testimony 5/29/2010 p 10; Testimony 5/11/2010 p 243.


3



The portside crane operator testified that after the initial discharge of drilling mud from the top
of the derrick, he saw drilling mud coming from the MGS vent, followed by the first explosion:

“And it come out of it so strong and so loud that it just filled up the whole back deck with a
gassy smoke.....Then something exploded. I’m not sure what exploded, but just looking at it,
it was where the degasser was sitting, it’s a big tank and it goes into a pipe. I’m thinking that
the tank exploded. And that started the first fire, which was on top of the motor shed and on
the starboard side of the derrick.”28

The crane operator stated that his first action after the explosion was to turn off the air
conditioner in the cab of the crane because he was concerned that the gas he observed was
flammable,29 which indicates that electrical power was still available at that time. He then stated
that “about that time everything in the back just exploded at one time. It went -- the whole back
deck.”30

The crew members on board DAMON B. BANKSTON also had a good view of the derrick and
testified that the first explosion was on the Main Deck area aft of the derrick, on or near the Drill
Floor:

Captain “I was stationed on the center console steering the boat and through the
support window. The green flash was coming from the Main Deck area aft of the
derrick....The height of my vessel is pretty much even with the Main Deck of the
HORIZON.”31

***


Chief Mate “My recollection was that it was about amidships aft. I saw an eruption
of liquid that looked like seawater. It didn’t look brown as mud coming up out of the deck.
It was a pretty heavy eruption of liquid because it was higher than the eight-foot high
containers that were on deck. I could see the liquid boiling out of the deck and shortly after
that, a flash of fire on top of the liquid above it and it continued to burn.”

Q. So kind of in the derrick area?
A: Yes, sir, aft of the derrick center, [a]midships center.32
***

Chief Engineer “I saw a small explosion behind the aft of the derrick.”33


28 Testimony
29 Ibid.
5/29/2010 pp 10-11.
30 Ibid.
31 Testimony
32 Testimony33 Testimony
5/11/2010 p 137.
5/11/2010 p 243.
5/11/2010 p 183.

4



The on-watch SDPO testified that from his vantage point on the bridge, he was observing the
Drill Floor through the CCTV system when the first explosion occurred. He was unable to see
from where the explosion had originated, but he did see flames. Following the first explosion, he
testified that a number of gas alarms were received on the fire and gas detection system control
panel just “before that generator exploded.”34 When asked what led him to believe that the
second explosion was the generator exploding, he replied “Because the rig blacked out.”35

2. Engine Room
According to personnel located in the ECR and the adjacent Electronics Technician Room on the
second deck (below the Main Deck) at the time of the explosions, Engines # 3 and # 6 increased
in rpm just prior to the explosion. They believed that the explosion came from Engine Room #
3, since Engine # 3 was located on the port side of the ECR, and the first explosion forced
inward the port side door to the ECR. Another explosion, coming from the direction of Engine #
6, caused the starboard door into the ECR to forcibly open inward.36

The chief electrician testified that damage he observed while evacuating from the ECR to the aft
part of the MODU indicated that the explosion involved Engine # 3.

“At that point I looked up at the wall, and the exhaust stacks for Engine Number 3, the wall,

the handrail, the walkway, all those things were missing. They were completely blown off

the back of the rig.”37

The chief mechanic reported similar observations.

“Well, the first explosion basically came from the port side in the direction that Number 3

engine is located at, and plus, when we went back out on the aft lifeboat deck, there was

As a result of the explosions and fire, 11 persons were reported missing and are presumed dead.
16 persons reported sustaining injuries either during the initial explosions or during the
evacuation process. The locations of the presumed dead and injured crew members are
summarized in Table 1.

Table 1 – Locations of Missing and Injured Crew Members

damage coming from the back of Engine Room 3.”38
Missing Employer Position
Last Known Location On
DEEPWATER HORIZON
Transocean Toolpusher Drill Floor
Transocean Crane Operator Crane Deck


34 Testimony 10/5/2010 p 168.
35 Ibid., pp 220-221.
36 Testimony 5/26/2010 p 97; Testimony 5/29/2010 pp 32-33; Testimony 7/23/2010 pp
14-15; Testimony 5/28/2010 pp 341-342.
37 Testimony 7/23/2010 p 16.
38 Testimony 5/26/2010 p 130.


5


Missing Employer Position
Last Known Location On
DEEPWATER HORIZON
Transocean Assistant Driller Mud Pump Room
Transocean Assistant Driller Mud Pump Room
MI Swaco Mud Engineer Shaker House
Transocean Derrick Hand Mud Pump Room
Transocean Floorhand Drill Floor
MI Swaco Mud Engineer Shaker House
Transocean Driller Drill Floor
Transocean Floorhand Drill Floor
Transocean Floorhand Mud Pump Room
Injured Employer Position Location
Transocean Chief Mechanic Engine Control Room
Art Catering Bedroom Utility Stairway between 2nd & 3rd Deck
Art Catering Baker Galley
Transocean Floorhand 2nd Deck Gym
Transocean Roustabout Portside Crane
Art Catering Cook Hallway outside Galley
Transocean 1st Assistant Engineer Engine Control Room
Transocean Motorman Engine Control Room
Art Catering Galley Hand Hallway outside Galley
Art Catering Galley hand Galley
Art Catering Laundry Laundry
Transocean Motorman Engine Control Room
Transocean Division manager 2nd deck outside OIM Office
Art Catering Laundry Room 239
Transocean Toolpusher 2nd deck near Toolpusher’s Office
Transocean Chief Electronics Technician Engine Control Room

* Denotes injury occurred while en route to or boarding lifeboat.
II. Systems
As the well control incident unfolded, an uncontrolled volume of gas flowed up from the
wellhead to the MODU and onto the Drill Floor and Main Deck. Gas samples collected by
Woods Hole Oceanographic Institute on July 27, 2010 show that the composition of the
uncontrolled gas discharged from the well was primarily methane (69.9 %), with lesser amounts

6



of ethane (6.9 %) and propane (4.5 %). The remainder of the gas consisted of a mixture of
various weight hydrocarbons.39 The flammable range of the gas is estimated to be from 5-14%
by volume.

Several minutes after the start of the release of gas from the wellhead, a gas cloud within the
flammable range formed over large areas on several decks. The explosions likely occurred when
gas from this cloud encountered one or more ignition sources on the Drill Floor or elsewhere on
the MODU. The precise location of the ignition sources that caused the two explosions cannot
be definitively established. The investigation, however, has identified several possible ignition
sources. The possible sources that are best supported by the evidence are:

. Hazardous Area Electrical Sources: Flammable gas may have been ignited by
unguarded electrical equipment in hazardous areas on or near the Drill Floor. (see
additional discussion below)
. Main Engines: Flammable gas may have traveled through ventilation inlets to one of the
main engines, which ignited the gas. (see additional discussion below)
. Switchgear Room Electrical Equipment: Personnel located in the ECR testified
conclusively that they experienced blast forces that destroyed the bulkheads, deck,
overhead surfaces, and the exterior bulkhead of Switchgear Room # 3.40 This indicates
that flammable gases may have traveled through a ventilation inlet system (located on the
aft Main Deck, amidships) to that switchgear room and reached unguarded electrical
equipment in the 11 kV switchboard compartments, the 480 V switchboard rooms
(located adjacent the ECR, port and starboard) or any of the switchgear rooms located
behind each engine.
Additional possible ignition sources include:

. Temporary Electrical Circuits: Another potential ignition source could have been
temporary electrical circuits installed in hazardous areas on the Drill Floor to support
current operations.
. Mechanical Sources: The Drill Floor had numerous mechanical components that if not
properly maintained might have caused circumstance where excessive friction was
developed leading to hot spots. These hot spots could have been a source of ignition for
the explosions. For example, the April 2010 ModuSpec USA, Inc. audit commissioned
by Transocean (Section 4.4) found that the port forward air winch wire was rubbing
against a steel plate on the lower derrick level, and recommended the installation of a
guide roller, or removal of the plate.41 It is not known if this condition had been
corrected at the time of the explosion.
39 Analysis Report, Isotech Laboratories dated 8/2/2010 Sample #s WHOI-IGT6 and WHOI-IGT8.
40 Testimony 5/26/2010 p 97; Testimony 5/29/2010 pp 32-33; Testimony 7/23/2010, pp
14-15; Testimony 5/28/2010 pp 341-342.
41 MODU Condition Assessment DEEPWATER HORIZON, ModuSpec USA, Inc., 4/1-14/2010, TRN-
USCG_MMS-00038609--95.


7



. Non-Hazardous Area Sources: If the flammable gas cloud dispersed beyond the
hazardous areas on the rig to other deck levels with unclassified equipment, then an
untold number of ignition sources could have sparked an explosion. For example,
ventilation fans for non-hazardous spaces were not of non-sparking construction and
could have been an ignition source.42
. Electrostatic Discharge: The gas could have been ignited without an onboard ignition
source, but instead by an electrostatic discharge from the high velocity flow of flammable
liquids and gases being released from the well head.43
The following sections will discuss the main systems relating to the cause or effects of the
explosions and how they performed or failed to perform during the casualty.

A. Drill Floor Ignition Source Safeguard Systems
To the extent that the explosion may have originated on the Drill Floor, the most likely source of
ignition would be electrical equipment located there. Because the hazardous areas of a MODU
may be exposed to flammable vapors in the course of normal operations, electrical equipment
installed in these areas must either prevent ignition of such vapors or safely contain any ignited
vapors.

DEEPWATER HORIZON was constructed in accordance with the 1989 International Maritime
Organization (IMO) Mobile Offshore Drilling Unit (MODU) Code. Chapter 6 of the Code
classifies hazardous areas into three categories. Zone 0 areas are those where explosive gas/air
mixtures are normally present. Zone 1 areas are those where explosive gas/air mixtures are
likely to occur in normal operation. Zone 2 areas are those where explosive gas/air mixtures are
not likely to occur, but if they do occur, they are expected to be present for only a short period of
time. For each type of hazardous area, all installed electrical equipment is to be certified as
suitable for the explosive gas/air mixtures that may be encountered.

On DEEPWATER HORIZON, the Drill Floor at elevation 46 m (151 ft) was classified as a Zone
2 area. All electrical equipment in this area was classified safe for such a location except for the
electrical equipment in the Drill Shack, the Drilling Equipment Room (DER), and the mud
logging and the measurement while drilling (MWD) units. These areas were not equipped with
classified electrical fixtures, but were maintained under positive pressure in accordance with
safeguard 3, explained below. All other areas on the Drill Floor that were within the wind walls
and intermediate levels of the Moon Pool44 directly beneath the Drill Floor from elevation 33 m
(108 ft), up to the drawworks blowers on the starboard side, and up to approximately elevation
66 m (216 ft) on the port side, were classified as either Zone 1 or Zone 2 areas. In addition, the
mud gas separator (MGS) vent at the very top of the derrick was classified as a Zone 1 area for a
distance of 1.5 m (4.9 ft) from the outlet, and as a Zone 2 area for an additional 1.5 m (4.9 ft)

42 DEEPWATER HORIZON Operations Manual March 2001 Section 9.1.1, ABSDWH000533.
43 Fire Protection Handbook, National Fire Protection Association, Quincy, MA, 19th ed., p 210.
44 The Oil Gas Glossary defines a “Moon Pool” as : a walled round hole or well in the hull of a drill ship (usually in
the center) through which the drilling assembly and other assemblies pass while a well is being drilled, completed,
or abandoned from the drillship.


8



beyond that point. The extent of the electrically classified areas is shown in yellow in Figures 2
through 5.

Electrical equipment in designated hazardous areas must be subject to one of three safeguards: it
must be contained in explosion-proof enclosures, be intrinsically-safe, or be purged and
pressurized:

. Explosion-proof enclosures are robust housings built to contain electrical equipment and
prevent contact with flammable gases. If such gases leach into the enclosure and are
ignited by a spark, they remain contained within the enclosure and are cooled during
venting so as to prevent any ignition of the gases outside of the enclosure.
. Intrinsically-safe equipment is low energy electrical equipment that does not have
sufficient energy to ignite flammable gases, even if a spark occurs.
. Purged and pressurized equipment consists of electrical equipment that is contained
within enclosures supplied with fresh air from a safe location at a pressure higher than the
pressure of the surrounding area. Because of the pressure differential within and outside
the enclosure, flammable gas cannot leach into the enclosure and therefore cannot be
ignited by the equipment.
DEEPWATER HORIZON was designed in accordance with the 1989 IMO MODU Code
requirements, and proper electrical equipment was originally installed in the hazardous areas.
On the MODU, the use of properly maintained and certified explosion-proof, intrinsically-safe,
or purged and pressurized equipment on the Drill Floor should have prevented the ignition of
flammable gases by any electrical equipment installed in the hazardous area. If poorly
maintained, however, such equipment could have provided an ignition source for flammable
gases. The IMO MODU Code, however, does not contain any requirements for the continued
control and maintenance of electrical equipment in hazardous areas.

Investigative findings concerning DEEPWATER HORIZON’s failure to properly maintain
electrical equipment are discussed in Section 3 of this Chapter.

B. Main Engine Room Ignition Source Safeguard Systems
Another possible ignition source for the explosion was one of the main engines. Certain crew
members testified that the explosion originated with Engine #3. At the time of the casualty,
Engines # 3 and # 6 and their associated generators were supplying electrical power to the
MODU. The other four generators were kept in a reserve mode. In the case of a fault or loss of
power, one of the reserve generators would automatically start up and function as the emergency
power source.

9



Figure 2 – Drill Floor Plan
10


Figure 3 – Main Deck
11


Figure 4 – Second Deck
12


Figure 5 – Third Deck
13


To the extent that the explosion initiated with an engine, the ventilation inlets for the engine
rooms may have allowed the flammable gas cloud to travel to the main engines located aft of the
Drill Floor. Because each of the six Wärtsilä diesel engines did not have (and were not required
to have) independently ducted combustion air vents, the engines drew combustion air from the
air supplied to the individual engine rooms by the ventilation inlets.

The ventilation inlets for Engine Rooms # 3 and # 4 were located together on the Main Deck,
amidships under the aft deck catwalk and next to the ventilation inlets for the Mud Pump Rooms.
The ventilation inlets for Engines # 5 and # 6 were located on the starboard side of the Main
Deck, aft, outboard of the riser storage area. The ventilation inlets for Engines # 1 and # 2 were
located on the port side of the Main Deck, aft, outboard of the riser storage area. According to
the chief mechanic, the ventilation inlets for Engine Room # 3 were located within
approximately 4.5 m (15 ft) to 6.1 m (20 ft) of the Drill Floor, while the ventilation inlets for
Engine Room # 6 were located approximately 7.6 m (25 ft) to 10.7 m (30 ft) from the Drill
Floor.45

Gas detectors were installed in the ventilation inlets. Upon gas detection, they would activate an
audible and visible alarm at the fire and gas detection system control panel in the CCR, but they
were not set to automatically activate the emergency shutdown (ESD) system for the engines or
close the engine room ventilation dampers to stop the flow of outside air into the engine rooms.

If flammable gases entered Engine Rooms # 3 and # 6 through the vents, they may have
contacted numerous unguarded electrical sources of ignition, since the engine rooms were not
classified as Zone 1 or Zone 2 hazardous areas. The gases could also have caused an increase in
rpm of the engines. If an engine were to “overspeed” in this manner, it may have led to a
catastrophic mechanical failure and caused the ignition of the flammable gas when it came in
contact with hot metal fragments, triggering an explosion.

Each of the six Wärtsilä diesel engines had three separate safety devices designed to prevent the
engine from overspeeding:

. Diesel Engine Speed Measuring System: Each engine is outfitted with a Diesel Engine
Speed Measuring System (DESPEMES) that provides a hardwire logic signal to the
Simrad Integrated Automated Control System (IACS). The IACS uses this signal to
determine if the engine is operating within its design specification. If the IACS receives
a signal from the DESPEMES that the engine speed has risen 13% above the normal
operating speed, it sends a signal to an electro-pneumatic overspeed trip device and the
air charge cut off valves. This action will cut both the fuel and air supply to the engine,
resulting in an engine shutdown.46
. Woodward Governor/Actuator: Should the DESPEMES fail to detect an overspeed
condition and the engine reaches a speed 15% above its normal operating speed, then the
45 Testimony 5/26/2010 p 101.
46 Wartsila North America Written Submission to JIT 10/14, 2010 (forwarding details of the Wärtsilä Vasa 32
engines).


14



engine’s Woodward 723 governor47 is programmed to send a signal to the

governor/actuator to move the fuel rack to zero and send a shutdown signal to the IACS

system.

. Mechanical Overspeed Trip Device: Finally, if the engine still continues to overspeed
and reaches 18% above its normal operating speed, a direct-acting mechanical overspeed
trip device, independent of the Woodward governor and DESPEMES systems,
automatically stops the engine. The mechanical overspeed trip device is a centrifugal
force-tripping mechanism fastened to the engine camshaft. Once the device reaches its
set point, it will move the entire fuel rack to the zero position and notify the IACS of a
shutdown.48
In addition, the engine’s air charge cut-off valves provide another safety mechanism against
overspeeding. The valves are designed to close in an emergency situation to prevent flammable
gases from entering the diesel engine and ensure that the engine will not overspeed. The valves
can be activated in one of three different ways: (1) automatically by the IACS, after receiving a
signal from DESPEMES, as described above; (2) manually by a crew member at the IACS
operator station who activates the emergency shutdown function; or (3) manually by a crew
member closing the valve at the engine.

Despite the presence of these safety mechanisms, crew members testified that before the
explosions, they heard the online engines “rev up,” increasing in rpm, which could indicate that
flammable gases were feeding the engines and causing “overspeeding.”49 To the extent that the
engines did overspeed, without access to the engines that sank along with the MODU, the reason
that the multiple overspeed safety features did not prevent the operating engines from increasing
in RPM cannot be determined.

C. Main and Emergency Power Systems
The explosions caused the loss of the main and emergency power systems and limited
DEEPWATER HORIZON to transitional power that could only operate the emergency lighting
and communications systems, but could not reestablish the main power system. The design of
the system, though consistent with applicable standards, was insufficient to overcome the
casualty.

1. Main Power System Design
DEEPWATER HORIZON’s main electrical power was supplied by six seven-megawatt diesel
engine-generator sets consisting of Wärtsilä 18V32 LN(E) engines and ABB AMG 0900XU10
generators.50 The engine-generator sets were located in six separate engine rooms protected by


47 A governor is a mechanical safety device installed on internal combustion engines to automatically limit the speed
of the engine by regulating the intake of fuel or similar means.
48 Wartsila North America Written Submission to JIT 10/14, 2010 (forwarding details of the Wärtsilä Vasa 32
engines).
49 Testimony 5/26/2010 p 97; Testimony 7/23/2010 p 13.
50 DEEPWATER HORIZON Operations Manual March 2001 Section 8.1, ABSDWH000364-367.


15



A-60 fire resistant bulkheads and located on the aft portion of the MODU on the second and
third decks. Each engine room was constructed with its own supply and exhaust fan. The supply
fans and ducting for each generator space were located on the Main Deck aft of the Drill Floor,
outside any hazardous class locations.51 The engine room ventilation system exhaust outlets
were located on the aft deck next to each of the main engine exhaust pipes.

The power system could be arranged with one or more generators in reserve mode, so that if a
loss of power occurred, one of the reserve generators would automatically start and pick up the
load. This arrangement complies with paragraph 5.3.5 of the 1989 IMO MODU Code, which
permits one of the reserve generators to function as the emergency source of power.

The standby means of electrical power was supplied by a four-hundred kW diesel engine-
generator set consisting of a Caterpillar 3408C D1-TA Engine and a Caterpillar SR4 generator,
located on the port side of the Main Deck, about amidships. It would be used to re-start the
power plant (a cold start) and would power emergency lighting and communications systems.52
This standby generator was the only generator on DEEPWATER HORIZON installed away from
the six main engines.

This design generally complied with applicable standards. DEEPWATER HORIZON was
designed in compliance with American Bureau of Shipping (ABS) Mobile Offshore Drilling Unit
Rules, ABS Rules for Building and Classing Steel Vessels, 1989 IMO MODU Code, and the
Panamanian MODU Standards and Regulations.53 Accordingly, ABS had to verify compliance
with ABS Rules, check the soundness of the MODU structure and design to ensure an acceptable
level of safety was provided, and assign a “class notation” that clarifies the environmental
conditions and operating criteria under which the unit is suited to operate.54

Because the MODU was constructed with an ABS DPS-3 class “dynamic positioning system,” it
was required to be capable of providing a main and emergency source of power adequate to
continue maintaining position in the event that any single compartment was damaged due to fire
or flooding. To meet this classification, ABS requires generators and their main engines to be
located in at least two separate compartments.55 Further, ABS also requires two separate power
management (control) systems so that loss of a single compartment will not render the control
system inoperable.56 To satisfy this requirement, DEEPWATER HORIZON’s redundant power
management systems were located in the CCR and the ECR.57

51 Hazardous Area Drawings, ABSDWH004274-82.
52 DEEPWATER HORIZON Operations Manual March 2001 Section 8.2, ABSDWH000448-470.
53 Ibid., Sections 1.7-1.8, ABSDWH000046-47. These regulations, rules and standards combined to form a
regulatory scheme that is accepted by the U.S. Coast Guard (USCG) as an equivalent to U.S. regulations, 33 CFR
143.207, 146.205. After DEEPWATER HORIZON was reflagged to the Republic of the Marshall Islands (RMI) in
2005, it also met the RMI MODU Standards and Regulations, which are accepted by the USCG as an equivalent
regulatory scheme.
54 ABS is a Classification Society that maintains Rules, Guides, standards and other criteria for the design and
construction of drilling units, consistent with the IMO MODU Code. ABS was also contracted by the vessel owner
to confirm that DEEPWATER HORIZON met the standards of the RMI.
55 ABS Rules for Building and Classing Steel Vessels Part 4 Chapter 3 Section 5 15.5.2.
56 Ibid., Part 4 Chapter 3 Section 5 15.5.3.
57 DEEPWATER HORIZON Operations Manual March 2001 Section 6.1, ABS DWH0000248-59.


16



Both ABS rules58 and IMO standards59 allow a vessel to be designed without a dedicated
emergency generator and electrical bus if the design is arranged so that a fire or other casualty in
one space will not affect the power distribution from the other spaces. This includes the use of
class A-60 fire resistant boundaries for each space.

Although DEEPWATER HORIZON met DPS-3 and IMO MODU Code requirements by having
completely redundant generator/engine rooms, the design did not prevent a total failure of the
main electrical power system. When the explosions caused damage to both Engine Rooms # 3
and # 6, the damage was more than the design criteria contemplated. The other engines were
supposed to start up to replace the lost engines, but the design of the emergency power system
failed to take into account the close proximity of the engine space ventilation inlets to each other.
Thus, even if the engines were sufficiently spaced apart, the presence of flammable gases near
the ventilation inlets could, and likely did, immediately affect all six engine rooms. The IMO
MODU Code does not consider this possible failure.

2. Transitional Power
In the event of a loss of electrical power, DEEPWATER HORIZON had a number of
uninterruptible power supply (UPS) and charger/battery systems available to support certain
limited functions. These were:

. Four charger/battery systems for the lifeboat embarkation area, one per quadrant
. One UPS system for drilling control system
. One charger/battery system for radio communication equipment
. Two UPS systems for the blowout preventer system (located in MUX room)
. One redundant fire and gas UPS System
. One redundant emergency shutdown (ESD) UPS system
. Five redundant IACS UPS systems
. Eight redundant thruster UPS systems
. Eight charger/battery systems for 11 kV switchgear control power
. Two redundant Hydroacoustic Reference System (HPR/HIPAP) UPS systems
. Two charger/battery systems for the emergency generator
. Two public address/general alarm (PA/GA) UPS systems
58 ABS Mobile Offshore Drilling Unit Rules Part 4 Chapter 3 Section 2 Section 5.1.3.
59 Code for the Construction and Equipment of Mobile Offshore Drilling Units 1989 Chapter 5 Section 5.3.5.


17



. One charger/battery system for the obstruction lights
. One charger/battery system for the warning horns60
These systems were designed to provide continuous power to critical systems at all times for a
period of no less than 18 hours.61
Table 2 – Status of Uninterruptible Power Supply

UPS System Condition Post-Explosion
Lifeboat Embarkation Areas No data to validate
Drilling Control System Drill Floor area damaged
Radio Communication Equipment62 Working
BOP system (Bridge Panel)63 The OIM and subsea
supervisor testified seeing
indicator lights on the panel
after arriving on the Bridge
Fire & Gas System (Bridge)64 The DPO testified that she
continued to acknowledge
alarms after the explosions
IACS System (Simrad SVC Bridge)65 Working
Redundant Thruster No data to validate
Switchgear Control Power No data to validate
HPR/HIPAP No data to validate
Charger/battery for emergency generator66 Working
PA/GA67 Working
Obstruction Lights No data to validate
Warning Horns No data to validate
During the casualty, the transitional electrical power on board DEEPWATER HORIZON was
operational in the CCR and throughout the MODU, unless the location supplied by the UPS was
too damaged to function. As a result, the crew was able to hear and acknowledge alarms, had
working IACS panels, utilized the PA/GA systems and utilized the communications system in
the CCR. There is no indication of a failure of transitional power. Further, there is no evidence


60 DEEPWATER HORIZON Operations Manual March 2001 Section 8.1.5, ABS DWH0000370.

61 Code for the Construction and Equipment of Mobile Offshore Drilling Units 1989 Section 5.3.10.
62 Testimony 7/19/10 p 43; Testimony 10/5/10 pp 152-153.
63 Testimony 5/27/10 pp 66-67; Testimony 5/28/10 pp 123, 145.
64 Testimony 10/5/2010 p 14.
65 Testimony 7/19/10 p 36.
66 Ibid., p 41.
67 Testimony 5/27/10 p 327; Testimony 5/28/10 p 232; Testimony 5/29/10 p 148.



18



available that shows transitional power having severely impacted the crew’s ability to evacuate
the MODU.68

D. Gas Detection System Design
The main fire and gas detection system control panel was located in the CCR, and was arranged
to monitor the fire detection system as well as the flammable and toxic gas detection system.69
Two remote repeater panels were installed on the MODU, located in the Driller’s Work Station
(DWS) and the ECR. These panels provided indication of any alarms that appeared on the main
control panel at these alternate locations. The system also monitored the status of the hazardous
area ventilation systems, carbon dioxide (CO2) fire extinguishing systems, sprinklers, and other
fire-fighting systems.

The gas detection system included flammable gas and toxic (H2S) gas detectors, which were
installed at selected locations along the drilling mud path and in other locations where gas could
have been expected as a result of drilling activities. H2S gas detectors were installed in the
following locations:

. Moon Pool area, near the diverter housing, just below the Drill Floor;
. Drill Floor;
. DWS and Drilling Equipment Room purge fan air intakes;
. Drill Shack (internal);
. Drilling Equipment Room (internal);
. Shaker / Mud Process Room;
. Mud Pit Room;
. Mud Pump Room;
. Accommodations and galley ventilation air intakes; and
. Well Test Area.
Flammable gas detectors were provided in the following locations:
. Engine room air intakes;
68 There was testimony that during the evacuation, crew members had difficulty finding their way because the
emergency lighting was inadequate. See Chapter 3. As noted in the above description of the Transitional Power
System, the emergency lighting in the accommodation areas was not supplied by this system.
69 DEEPWATER HORIZON Operation Manual March 2001 Sections 9.2.1 to 9.2.3, ABSDWH000547-548.


19



. Welding Shop; and
. Battery Room.
The fire detection system was arranged with individually addressable fire detectors located
throughout the MODU to allow rapid identification of the affected area. With this arrangement,
each individual detector had a system “address” that indicated the location of the detector on the
control panel.70 Fire detection devices included heat, smoke, and infrared flame detectors,
selected for reliable operation in the areas in which they were installed. Fire detection devices
and manual pull alarm stations were installed in all machinery spaces, all normally occupied
areas, and all spaces within the accommodations area.

A September 2009 audit of DEEPWATER HORIZON on behalf of BP revealed problems with
both the operability of the fire and gas detection system and the training and knowledge of
personnel charged with operating it. The audit found that two flammable gas detectors and seven
fire detection devices on the MODU were inoperable and required repair.71 In addition, at the
time of the audit, the Drill Shack’s fire and gas detection system panel was displaying numerous
active alarm conditions, including fire alarm, fault emergency shutdown, fault fire and gas, and
fire and gas override. These fault conditions rendered the fire and gas detection system
inoperable at that time. However, the driller and assistant driller on duty at the time of the audit
were unaware of the fault conditions.72

1. Fire and Gas Detection System Logic
Activation of a gas or fire detector would result in immediate audible and visual alarms in the
CCR, ECR, and DWS. The system was arranged so that the alarms would be acknowledged by
personnel in one of the three control locations and allow them to direct other personnel to
investigate and report based on the location of the alarm and levels of gas detected. Subsequent
alarms, including the general alarm to all personnel, would need to be manually activated from
one of these control locations.73

In addition, the chief electronics technician testified that it was standard practice to have a
number of detectors set in “inhibited” mode, such that the detection of gas would be reported to
the control panel but no alarm would sound, to prevent false alarms from awakening sleeping
crew members during the night.74

The gas and fire detection system was not arranged to automatically stop the engines and other
machinery or close ventilation dampers if flammable gas was detected; it instead relied on
personnel on watch in the CCR to manually activate the ESD systems.75 However, the crew was

70 Non-addressable fire detection systems have their detectors connected on wiring loops, and activation of any
detector will cause the entire loop to indicate on the control panel, in which case personnel need to go to the affected
are to determine which detector has alarmed.
71 BP Common Marine Inspection Document Section 11.4, BP-HZN-MBI00170650.
72 BP DEEPWATER HORIZON Follow-up Rig Audit p 40, BP-HZN-IIT-0008910.
73 Testimony 10/5/2010 pp 54-55.
74 Testimony 7/23/2010 pp 30-34.
75 Kongsberg Cause and Effect Matrix, ABSDWH001090-1227.


20



not provided with training or procedures to clarify when conditions warranted activation of the
ESD systems and what actions to take in such an event.76 Thus, when multiple gas alarms were
received in the CCR during the well control event, no personnel manually activated the ESD
systems for the operating main engines.77

Similarly, DEEPWATER HORIZON had a ventilation monitoring and control system that was
designed to monitor and indicate ventilation failures in those areas where positive or negative
pressure was required to control potentially hazardous gas levels. In the event that a loss of
pressure was detected, an alarm would have appeared in the IACS and in the CCR, but the alarm
would not automatically cause equipment shutdown.78

Section 9.8 of the 1989 IMO MODU Code states that a gas detection and alarm system should be
provided to the satisfaction of the MODU’s flag Administration. The Code does not indicate
whether the gas detection system should provide an alarm only, or if it should be arranged to
activate emergency shutdown of equipment in the affected areas. In addition, it provides no
guidance regarding the type and number of gas detectors, their arrangement, alarm set points,
response times, wiring protocols or survivability requirements.

While Section 6.5 of the 1989 MODU Code specifies criteria for the emergency shutdown of
selected equipment in case of emergency conditions due to drilling operations, it does not clearly
indicate whether the gas detection system should be arranged to automatically activate these
emergency shutdown provisions or if they are to be manually activated.

For a MODU using a dynamic positioning system, there is a particular concern that a gas
explosion that impacts the generators would threaten the MODU’s station keeping ability. The
2009 IMO MODU Code includes a further recommendation for dynamic positioned units such as
DEEPWATER HORIZON:

“6.5.2 In the case of units using dynamic positioning systems as a sole means of position

keeping, special consideration may be given to the selective disconnection or shutdown of

machinery and equipment associated with maintaining the operability of the dynamic

positioning system in order to preserve the integrity of the well.”

The intent of this new recommendation is not clear, as the IMO MODU Code does not provide a
recommended hierarchy of automatic and manual emergency shutdown actions following gas
detection in areas that may impact the dynamic positioning system, or the emergency power
sources necessary for maintaining the MODU’s position in the event of a flammable gas release.

E. Crew Blast Protection Failures
During and following the explosions, 11 personnel were missing and are presumed dead, and 16
others were injured. The primary means of protection from the effects of an explosion are the
bulkhead divisions that separate different areas on the MODU. On DEEPWATER HORIZON, A


76 Testimony 10/5/2010 pp 60-61.
77 Ibid.
78 DEEPWATER HORIZON Operations Manual March 2001 Section 9.2, ABS DWH0000547-558.


21



60 class bulkheads were provided in accordance with section 9.1.3 of the 1989 IMO MODU
Code, to separate the exterior boundaries of superstructures from the Drill Floor.79 This section
will discuss the effectiveness of these barriers.

1. Placement of Barriers on DEEPWATER HORIZON
The 1989 IMO MODU Code does not include any safety measures for blast resistance.
Regulation 9.1.3 of the Code requires exterior boundaries of superstructures and deckhouses
enclosing accommodation areas to be constructed of A-60 class divisions for the whole of the
portion which faces and is within 30 m (98.4 ft) of the center of the rotary table. On
DEEPWATER HORIZON, the rotary table was located in the center of the Drill Floor on the
centerline of the unit.80 Because of this requirement, A-60 bulkheads surrounded the drilling
area on the second and third decks. The drilling area on the Main Deck at elevation 41.5 m (136
ft), and the Drill Floor at elevation 46 m (150 ft) did not abut any accommodations and
consequently were not bounded by fire rated divisions. The Drill Shack located on the Drill
Floor was considered part of the industrial process area and was not subjected to any structural
fire protection requirements; thus it was designed with large windows for viewing the Drill Floor
operations.

2. Limitations of A-Class Bulkheads
On July 6, 1988, an explosion occurred on the platform PIPER ALPHA in the North Sea, causing
the loss of 165 persons, the largest single loss of life in the history of offshore operations.
Research done for the PIPER ALPHA inquiry indicated that depending on their specific design,
A-class bulkheads may be capable of withstanding a blast pressure of about 0.01 N/mm2 (0.1
bar). Typical explosion pressures expected from the ignition of hydrocarbon vapors during a
blowout approach the range of 0.02-0.04 N/mm2 (0.2 – 0.4 bar).81 Thus, without further means
of blast protection, personnel cannot be effectively shielded from a Drill Floor explosion by A-
class bulkheads.

In general, the blast resistance necessary to ensure the survivability of accommodation spaces,
service areas and control stations located adjacent to hazardous areas can be calculated based on
the volume enclosed within the affected spaces and a determination of the relative level of
congestion. Various international safety guides provide suggested calculation techniques based
on an accidental explosion load defined by a maximum explosion overpressure and pulse
duration period (i.e., the force and duration of the explosion).82 None of this information is
provided in the IMO MODU Code.

79 A-class bulkheads are defined in the SOLAS Convention as fire rated separations capable of preventing the spread
of fire for a period of one hour.
80 See Appendix E for further details.
81 The Public Inquiry into the PIPER ALPHA Disaster, Hon. Lord Cullen, November 1990, Volume 1, pp 65-69.
82 UKOOA/HSE Fire and Explosion Guidance, Parts 0 & 1, October 2003; ISO/FDIS 13702, Petroleum and Natural
Gas Industries – Control and Mitigation of Fires and Explosions on Offshore Production Installations, 1998.
NORSOK Standard S-001, Rev. 3 Technical Safety, 2001; API RP2A, Recommended Practice for Planning,
Designing and Constructing Fixed Offshore Platforms, Section 18, 21st edition.


22



3. Impact on Personnel
All of the missing and presumed deceased crew members were located in one of two areas on
DEEPWATER HORIZON when the well blowout and explosions began. Seven members of the
drilling crew were last seen on or near the Drill Floor or near the Driller’s Shack, Shale Shaker
House or starboard side crane pedestal.83 The remaining four missing crew members were last
seen in the Mud Pump Room, between Mud Pumps # 2 and # 3.84

Witness testimony suggests that one of the explosions occurred in the vicinity of the derrick on
the Drill Floor or the nearby MGS. The layout of the Drill Floor on DEEPWATER HORIZON
provided no protection from blast overpressure or thermal radiation (the force and heat of an
explosion) to the personnel working there. Accordingly, although cause of death cannot be
definitively established, the crew members in the Drill Floor area are believed to have suffered
fatal injuries during the two initial explosions.

The Mud Pump Room and the Shale Shaker House were separated from the Drill Floor area by
an A-class bulkhead. Thus, the personnel last known to be in those areas would not have had
substantial protection from the explosion if it originated on the Drill Floor. Moreover, because
one witness testified that the gas alarms for the Mud Pump Room and the Shale Shaker House
sounded before the explosions occurred, flammable gas vapors may have entered the Mud Pit
ventilation system and ignited within the Mud Pump Room and the Shale Shaker House.85

The majority of non-fatal injuries caused by the explosion occurred in two separate areas on the
second deck – the ECR located on the centerline aft, and the accommodation area, laundry and
galley complex located in the forward starboard corner. One injury was reported on the Main
Deck by the operator of the port side gantry crane. One crew member reported being injured
while moving from the third deck up to the second deck, when he was thrown down the stairway
by the force of the explosion. Another was injured while traveling to the lifeboats.86

The ECR was separated from the drilling area by three successive A-class bulkheads that
bounded the intervening mud pump rooms and switchgear rooms. Personnel in the ECR,
however, testified that blast forces also originated in Engine Room # 3 located on the port side of

the ECR. Their injuries occurred despite the intervening A-class bulkheads.87
The second deck accommodation area was separated from the drilling area by an A-class
bulkhead. The personnel located in these areas did not report smelling any sign of hydrocarbon
vapors prior to the explosion. Thus, it appears that the explosion occurred outside this area, and
that the blast forces damaged the intervening A-class bulkhead and were transmitted to the
corridors and cabins within the accommodation area.
83 Testimony 5/29/2010 p 156; Testimony 12/7/2010 pp 243-245.
84 Testimony 5/27/2010 pp 335-336.
85 Testimony 10/05/2010 pp 292-293.
86 Witness Statement 4/21/2010.
87 Testimony 5/26/2010 p 97; Testimony 5/29/2010 pp 32-33; Testimony 7/23/2010 pp
14-15; Testimony 5/28/2010 pp 341-342.


23



The locations of the missing and injured crew members are shown in Figures 2 through 4. Areas
highlighted in green are the locations of injured personnel; the areas highlighted in red depict the
last known locations of the missing. A-class bulkheads are shown as heavy black lines.

4. Blast Protection for Vital Systems
The 2009 IMO MODU Code, which will apply to new MODUs constructed after January 1,
2012, includes new requirements for an engineering analysis to verify that the level of blast
resistance of any barriers separating the occupied areas from the hazardous areas should be
determined adequate for the likely hazard:

“In general, accommodation spaces, service spaces and control stations should not be located
adjacent to hazardous areas. However, where this is not practicable, an engineering
evaluation should be performed to ensure that the level of fire protection and blast resistance
of the bulkheads and decks separating these spaces from the hazardous areas is adequate for
the likely hazard.”88

MODUs not designed to avoid having such spaces adjacent to the Drill Floor will need to
consider stronger barriers than A-60 bulkheads for spaces adjacent to the Drill Floor. However,
an engineering evaluation is only required when a Type 1 space (control station), Type 2 space
(corridor), Type 3 space (accommodation) or Type 4 space (stairway) is adjacent to a hazardous
area. This limited application fails to consider vital safety systems and equipment such as fire
extinguishing systems, fire pumps, emergency generators, Dynamic Positioning controls and
other equipment that could be located in machinery spaces or service spaces. The DEEPWATER
HORIZON casualty highlights the need to ensure the availability of such systems to mitigate the
effects of an explosion or fire. Thus, it is important that all safety equipment located adjacent to
hazardous areas be considered in the engineering evaluation specified by paragraph 9.3.1,
regardless of the type of space where this equipment is located.

III. Actions/Decisions Contributing to System Failure
A. The crew diverted the gas from the wellhead to the Mud Gas Separator instead of the
Diverter Line.
At the outset of the blowout, the drilling crew appears to have aligned the uncontrolled well flow
through the MGS, located on the starboard side of the derrick, which is designed to separate gas
from the returned drilling mud and vent it through the outlet at the top of the derrick. The high
pressure well flow, however, exceeded the system’s limitations, causing failure of the MGS
system. The gas then could have discharged not just from the MGS vent located at the top of the
derrick as designed, but also from other places along the MGS system not typically used to
release gas: the MGS rupture disk on the Main Deck, and the MGS vacuum breaker located on
the starboard derrick leg about 23 m (75 ft) above the Main Deck.

Alternatively, the crew could have directed the well flow through the port or starboard 356 mm
(14-in) diverter lines, designed to “divert” high volume well flow over the side of the MODU in

88 Code of the Construction and Equipment of Mobile Offshore Drilling Units 2010 Section 9.3.1.

24



a well control situation. Since DAMON B. BANKSTON was operating on the port side of the
MODU, the starboard side diverter would have been used. Had the flow been diverted
overboard, the majority of the flammable gas cloud may have formed away from the Drill Floor
and the MODU, reducing the risk of an onboard explosion.

Nevertheless, this action ultimately may not have prevented an explosion. Because of the
extremely large volume of gas flowing from the well under high pressure, significant levels of
flammable gas may still have been released, through slip joints and other riser components that
failed under pressure, into the Moon Pool or onto the Drill Floor. It then could have reached
unguarded ignition sources and caused an explosion.

B. Transocean failed properly to track and maintain Drill Floor electrical equipment that
could have served as an ignition source.
As discussed above, in order not to run the risk of serving as an ignition source, electrical
equipment installed in hazardous areas must be safe for the expected atmosphere (environment).
The IMO MODU Code provides the applicable requirements, and proper operation of such
equipment is essential to maintain continued safe operation in hazardous areas.

Based on the design drawings made available to the Joint Investigation Team, the electrical
equipment on the Drill Floor and in other hazardous classified areas where explosive gas/air
mixtures could be present was reported to be certified safe for use in explosive atmospheres.89

However, the April 2010 ModuSpec USA, Inc. audit found that DEEPWATER HORIZON lacked
systems to properly track its hazardous electrical equipment and that the hazardous area
electrical equipment on board was in “bad condition.”90 The audit determined that contrary to
the IMO International Safety Management (ISM) Code,91 none of the classified electrical
equipment on the Drill Floor had been tagged with an identification number, and the MODU did
not have on board a hazardous area equipment registry or hazardous area drawing that would
have identified both the classified electrical equipment and the boundaries of the hazardous
areas.92 Since the crew did not have any means to clearly identify the classified electrical
equipment or the extent of the hazardous areas, there can be no assurance that no unclassified
fixtures were introduced into the hazardous areas during maintenance or modifications.

In addition, several of the shale shaker motor starters were “extremely dirty and covered in
mud,” drilling mud agitator frames were “severely corroded,” and both types of equipment had
missing or illegible certification labels.93 The audit also noted that a subcontractor’s drilling

89 ABS Letter dated 1/5/2001, ABSDWH004303-4310; Hyundai Heavy Industries Hazardous Area Classification
Drawings HRBS-E81-000-H0015 Rev. A. Sheets 4-7, ABSDWH004278-81.90 MODU Condition Assessment DEEPWATER HORIZON, ModuSpec USA, Inc., 4/1-14/2010, Section 4.16, TRNUSCG_
MMS-00038689.
91 Section 11.2 of the IMO International Safety Management (ISM) Code specifies that the company should ensure
that valid documents are available at all relevant locations, and that changes to documents are reviewed and
approved by authorized personnel.
92 MODU Condition Assessment DEEPWATER HORIZON, ModuSpec USA, Inc., 4/1-14/2010, Section 4.16, TRNUSCG_
MMS-00038689--38690.

93 Id.

25



mud processing equipment, had been brought on board and placed on the Main Deck and in the
Moon Pool areas, and that it was in “poor condition.”94 Such equipment could have presented an
ignition risk. As a result of these problems, the auditors recommended that a third party perform
a hazardous equipment inventory, label the equipment, and then perform a survey “to establish
the true condition of all electrical equipment installed in the hazardous areas on the rig.”95

Because of the failure properly to track and maintain the electrical equipment, there is no
assurance that on the date of the casualty, approximately one week after the audit was completed,
the classified electrical equipment was safe and could not serve as an ignition source.

C. The DEEPWATER HORIZON crew bypassed an automatic shutdown system designed
to prevent flammable gas from reaching ignition sources.
There were several electrical installations on the Drill Floor that were maintained safe by
enclosing them in a “purged and pressurized” enclosure. For example, the mud logger testified
that the Halliburton Mud Logger’s Unit, adjacent to the Drill Floor, was maintained under a
positive pressure and would shut down if gas vapors were detected in the unit. He testified that,
at the time of the explosion, he smelled gas just prior to the unit losing power:

“When I started smelling the gas fumes, my monitors vibrated real hard on my walls and I

heard a loud noise, like a whistling sound, and by then, I went to grab my hard hat, which I

always keep right here on the side of me, and by the time I picked it up, all my lights and all

that had went out due to the gas coming in my unit.”96

Another such location was the Drill Shack, which housed the blowout preventer (BOP) control
panel. The chief electrician testified that if the access door to the Drill Shack was held open for
an extended period of time the work station would “lose purge.” Because the BOP control panel
was kept separate under a positive pressure, if the BOP control panel doors were opened causing
it to “lose purge,” it would automatically shut down electrical power, requiring the panel to be
cleared and restarted. As a result, the crew had set the positive pressure feature of the BOP
control panel in a continuously bypassed condition to avoid unnecessary shutdown of the system.
The chief electrician had been told by a crew member that it had “been in bypass for five years”
and that “the entire fleet runs them in bypass.”97 With the positive pressure feature bypassed,
any flammable gases that entered the BOP control panel could be exposed to unguarded ignition
sources without an automatic power shutdown.

Thus, during the well control efforts immediately prior to the explosion, if crew members entered
and exited the Drill Shack to such a degree that it resulted in a loss of positive pressure,
flammable gases could have entered and made contact with the BOP control panel or other
electrical ignition sources within the area.


94 Ibid.
95 Ibid.
96Testimony97 Testimony
12/7/2010 p 62.
7/23/2010 pp 39-42.

26



D. The crew failed to activate the engine room emergency shutdown system upon receiving
gas alarms.
When the Bridge crew began receiving the gas alarms, they did not immediately activate the
ESD system to prevent ignition by the engines. This delay may be attributed to a lack of clear
procedures and training. Beginning at approximately 2100 hours, the drilling crew observed
abnormal pressures on the drill string and was initiating steps to shut in the well. At 2150, the
on-watch assistant driller called the senior toolpusher and advised him of a well control
situation.98 Likewise, the on-watch toolpusher called the well site leader and advised him that he
was diverting returns to the gas buster.99

Just before the initial explosion, the on-watch DPO received a call from the Drill Floor informing
her of a well control situation, followed by a call from the ECR inquiring into the current
circumstances on board. By this time, the on-watch DPO was aware of multiple flammable gas
alarms. However, she did not inform the ECR personnel of the alarms, nor did she advise them
to shut down the engines; she had not been trained to take such actions.100 The on-watch DPO
had access to the controls for the engine room ESD system and the general alarm from the CCR,
but did not activate the ESD systems after the flammable gas alarms sounded because she was
not aware of any procedures requiring her to do so.101

Had the ESD system for the main engines been activated immediately upon the detection of gas
in the area, it is possible that the explosions in the engine room area could have been avoided or
delayed. However, the decision to activate the ESD system for the main engines had to be
balanced with the need to maintain electrical power to ensure the station keeping ability of the
dynamic positioning system. If the main engines were shut down prior to the explosions and the
unit drifted off position, the riser and its connection to the well may have been damaged.

E. Transocean used a dual-command organization structure that created command
confusion during the well control incident and the decision to activate the EDS.
At the time of the casualty, there was confusion on DEEPWATER HORIZON about who was in
charge of the MODU arising from the dual-command organizational structure instituted by

98 Testimony 5/28/2010 p 283.

interview notes, BP-HZN-MBI00021406-432.
100 Testimony 10/5/2010 p 40.
101 Ibid., pp 60-61.
102 The Republic of the Marshall Islands letter to the Joint Investigation Team dated 8/25/2010.
103 The Republic of Marshall Islands Marine Notice No. 7-038-2, Revised 12/2009.

Transocean. The Minimum Safe Manning Certificate (MSMC) issued by the Republic of the
Marshall Islands (RMI) for DEEPWATER HORIZON listed the vessel as a self-propelled MODU
rather than as a dynamic positioned vessel. RMI has since acknowledged that listing the unit as a
self-propelled MODU was the result of a “clerical error.”102 For self-propelled MODUs, the
RMI requires a master to be on board when the vessel is underway and allows an OIM to be in
charge when it is latched-up. For dynamically positioned vessels, the RMI requires a master to
be on board at all times but does not clearly define the chain of command. 103 As a result,
Transocean implemented a dual-command organizational structure, in which the master was in
27



charge whenever the MODU was underway between locations, and the OIM was in charge when
the MODU was latched up and using the dynamic positioning system to maintain position. In
any emergency situation, the master was to assume full control over the unit. DEEPWATER
HORIZON’s operations manual states that “the Master has overriding authority and
responsibility to make decisions with respect to safety and pollution prevention and to request all
internal company assistance as necessary.” The operational guidance is clear that only one
individual can be the person in charge at any given point.104

During the normal course of operations, if an emergency were to occur while the MODU was
latched up, command was to shift from the OIM to the master. The transfer of responsibility and
authority could be done verbally, with the time noted and a formal documented transfer
completed when time allowed. Whenever possible, a PA system broadcast was to be made at the
time of transfer to ensure that all personnel were aware of any change in command.105

This arrangement may have impacted the decision to activate the vessel’s EDS. At the time of
the casualty, the master was in the CCR conducting a familiarization tour for BP and Transocean
executives. The OIM was below in his stateroom and did not arrive in the CCR for several
minutes after the explosions. Upon his arrival, there was no immediate transfer of responsibility
between the OIM and the master and no verbal or PA announcement to indicate that the master
had relieved the OIM as the person in charge. This failure to clearly delineate that the
responsibility for the operation of DEEPWATER HORIZON had shifted from the OIM to the
master created a situation in the CCR where it was unclear who was in charge. The lack of
clarity is evidenced by the fact that the master asked the OIM for permission to activate the
EDS.106 The confusion was further demonstrated by the fact that by this time, the subsea
supervisor had already activated the EDS.107

Current U.S. regulations regarding manning requirements for MODUs require self-propelled
MODUs to be under the control of the master when underway.108 MODUs that are bottom
bearing or moored with anchors are considered on location, and no longer underway.109
However, the existing regulations do not account for the use of dynamic positioning (DP)
systems. U.S. flagged MODUs using DP for station keeping are considered self-propelled motor
vessels that are underway, and cannot be considered on-location as defined in 46 CFR § 10.107.
Thus, a dual command structure is not permitted on a U.S. flagged DP MODU. The regulations
are less clear about the division of responsibilities between the vessel master and the OIM for
foreign flagged DP MODUs operating on the U. S. OCS. Further discussion of the shortcomings
of the existing U.S. regulations is provided in Appendix I.


104 DEEPWATER HORIZON Operations Manual March 2001 Section 2.1, ABSDWH000062.
105 Ibid., Section 2.1.1.
106 Testimony 8/26/2010 p 440.
107 Testimony 5/28/2010 p 123.
108 46 CFR § 15.520(d).
109 46 CFR § 10.107.


28



IV. U.S. Government / Class / Flag Oversight
A. Responsibilities for Vessel Inspections and Surveys
DEEPWATER HORIZON was flagged by the RMI, classified by the ABS, contracted to BP and
was operating on the U.S. Outer Continental Shelf. This created an inspection/survey regime
from five different entities: RMI, USCG, ABS, Det Norske Veritas (DNV), and BP. Transocean
also used an independent auditor, ModuSpec USA Inc., to perform its internal survey of the
vessel’s materiel conditions.

B. Company Inspections and Surveys
Classification Societies are non-governmental organizations that grew out of the marine
insurance industry primarily during the 18th and 19th centuries to set neutral and impartial
standards and "class rules" to promote maritime safety in a manner that protected the often
competing interests of ship owners, the insurers, and the public. Vessels meeting class rules and
standards are issued a Certificate of Classification. As permitted by several international
conventions, Classification Societies also may be delegated authority by the flag state to act on
their behalf in conducting specified audits, surveys, and certifications required by those
conventions.

Transocean elected to use the services of ABS to perform Classification Society Surveys that
included the issuance of the Certificate of Classification for Machinery and Hull, and verification
of the vessel dynamic positioning system, elevators, and lifting gear. The machinery survey in
particular provides for a continuous survey of the main engines and components, which can be
drawn out for an extended period of time until the Certificate renews. Transocean elected in
2005 to discontinue the ABS survey services for the Drilling Equipment.

As a contracted vessel of BP, DEEPWATER HORIZON underwent inspection audits to ensure
that the vessel was in compliance with BP policies and international and U.S. regulations. Two
independent audits were conducted: one audit was conducted in September 2009 by BP utilizing
the International Marine Contractor’s Association Common Marine Inspection Document; a
second audit was initiated by Transocean and conducted by ModuSpec USA, Inc. in April 2010,
a week before the casualty.

C. Flag State
The RMI and the USCG were mandated by international and U.S. regulatory requirements to
perform inspections and examinations on the MODU. The RMI did not physically evaluate the
MODU. All of DEEPWATER HORIZON Ship Statutory Certification Services were performed
by the recognized organizations (RO) acting on behalf of the RMI. ABS acted as the RO for the
review and survey of technical issues such as engineering and design, while DNV was the RO
for the review and audit of the safety management system (SMS) for compliance with the ISM
Code. The RO is required to submit an annual report using the Republic of the Marshall Islands
Report of Safety Inspection for MODU/MOU form (form number MSD 252 MODU/MOU rev.

29



6/07). The RMI review was limited to administrative subjects and relied on ABS reports and
documentation for the review of all technical matters.

ABS used checklists for the relevant surveys that the surveyor was expected to perform and
made multiple visits to DEEPWATER HORIZON to perform a total of 22 different surveys over
a one-year period. These surveys combined regulatory and classification society responsibilities
and were performed by multiple surveyors.

Per Appendix O, ABS was on DEEPWATER HORIZON in March 2009 to perform a dry-dock
extension survey. During that survey, the watertight doors were noted as being in satisfactory
condition. ABS was also present in September 2009 to conduct several surveys, during which it
made no findings relating to the vessel’s ability to prevent a fire or explosion. BP then
conducted its audit and found several deficiencies relating to watertight integrity, fire and gas
systems, ventilation systems and fire doors. ABS returned in December 2009 to carry out
additional surveys and perform a flag state annual inspection. On the inspection report to the
RMI, ABS noted no deficiencies and characterized the MODU’s overall condition as clean and
acceptable. ABS returned to DEEPWATER HORIZON in February 2010 to continue its survey.
During this visit, it noted no discrepancies that affected the vessel’s ability to mitigate fire or
explosion. Finally, in April 2010, ModuSpec USA, Inc. attended the vessel on behalf of
Transocean and conducted an audit which noted discrepancies with the ventilation system but
resulted in an overall report listing the entire ventilation system to be in fair condition.

D. Coast Guard Inspections
Foreign-flagged MODUs are subject to the requirements of Title 33, Code of Federal
Regulations (CFR), Subchapter N. 33 CFR § 143.207 requires foreign-flagged MODUs to
demonstrate that they provide a minimum level of safety consistent with 46 CFR Parts 107, 108
and 109. Owners of foreign-flagged MODUs have three options to show compliance with this
regulation: they may elect to comply with the regulations in 46 CFR Parts 107, 108 and 109 for

U.S. flag MODUs; they may show compliance with the IMO MODU Code; or they may
conform to the regulations of the documenting nation, if it is determined that these regulations
provide an adequate level of safety. To ensure compliance with Subchapter N, the Coast Guard
conducts annual Certificate of Compliance (COC) examinations of foreign-flagged MODUs to
verify statutory certificates, test safety devices, and witness emergency drills. These
examinations are much less detailed than those used by Classification Societies to verify full
compliance with their classification regulations.
The scope of inspections required during COC examinations of foreign-flagged MODUs is not
stated in 46 CFR Subchapter I-A. Instead, guidance to inspectors is provided in Navigation and
Vessel Inspection Circular (NVIC) 3-88 CH-1.110 Coast Guard inspectors consequently rely on
this and other informal inspection guidance documents when attending foreign-flagged MODUs.

110 NVICs are Coast Guard guidance documents that are not a substitute for applicable legal requirements, nor are
they regulations. NVICs are not intended to nor do they impose legally-binding requirements on any party. They
represent the Coast Guard’s current thinking on certain topics and are issued for guidance purposes to outline
methods of best practice for compliance with the applicable law. MODU operators may use an alternative approach
if the approach satisfies the requirements of the applicable statutes and regulations.

30



As a result, inspection records do not provide a consistent level of information that may be of use
during reinspections by different inspectors.

On July 29, 2009, Coast Guard Inspectors from Marine Safety Unit (MSU) Port Arthur
conducted a COC examination and issued a two-year COC. The inspection results documented
in the Coast Guard Marine Information for Safety and Law Enforcement (MISLE) database
noted that ventilation systems, fire systems, and hazardous locations were in satisfactory
condition at the time of the inspection.111 The Coast Guard files do not reference the exact
systems tested or whether they were tested in whole or in part. It does not appear that the COC
examination extended beyond a spot check inspection. The inspector narrative supplement for
the 2009 inspection does address the fact that testing fire pumps, reviewing records related to
testing and the preventive maintenance system for generators, testing fire boundary doors and
testing ventilation shutdowns were conducted without incident. However, the narrative
supplement for the COC examination case is not specific and does not list the exact systems that
were tested (i.e., what fire pump was run, which engines the shutdowns were tested on, which
ventilation fans successfully shutdown). Further, it does not address the condition of any
watertight doors (satisfactory or unsatisfactory). Therefore, it is difficult to determine what was
witnessed during the Coast Guard inspection in comparison to any other inspection.

A review of the previous COC annual examination performed on October 15, 2008 by MSU
Morgan City revealed even less detail in the examination results, since the inspection report112
did not reference any deficiencies. In fact, the October examination notes, “No 835 deficiencies
were issued.”113

V. Conclusions
A. The exact location of the ignition source or sources that caused the initial and subsequent
explosions and fire on DEEPWATER HORIZON cannot be conclusively identified. A
number of possible ignition sources may have been present on the MODU, the most likely of
which are electrical equipment on the Drill Floor, in the engine rooms, or in the switchgear
rooms.
B. The first explosion and fire occurred on the Drill Floor in or near the mud gas separator
system. The second explosion occurred in Engine Room # 3 or in one of the adjacent
switchgear or electrical rooms.
C. The second explosion caused a total loss of electrical power by damaging electrical power
distribution and control equipment and circuits in or near Engine Room # 3.
D. The classified electrical equipment installed on DEEPWATER HORIZON at the time of the
incident may not have been capable of preventing the ignition of flammable gas. Previous
audit findings showed a lack of control over the maintenance and repair of such equipment;
111 Coast Guard Activity report dated 7/29/2009, MSU Port Arthur, Activity # 3513781.
112 Coast Guard Activity report dated 10/15 2008, MSU Morgan City, Activity # 3378271.
113 CG 835, Notice of Merchant Marine Inspection Requirements, is a form issued by an attending Marine Inspector
noting the requirement to rectify deficiencies found during inspection of domestic vessels.


31



therefore, it cannot be determined whether the classified electrical equipment was in proper
condition. The 1989 International Maritime Organization (IMO) Mobile Offshore Drilling
Unit (MODU) Code is insufficient because it does not have clear requirements for the long
term labeling and control of classified electrical equipment, nor does it establish
requirements or guidance for the continued inspection, repair and maintenance of such
equipment. The 2009 IMO MODU Code includes criteria for the identification of classified
electrical equipment, but does not require an on board maintenance program.

E. The fire and gas detection system was not arranged to automatically activate the emergency
shutdown (ESD) system if flammable gases were detected in critical areas. The system
relied upon the crew on watch in the Central Control Room/Bridge to take manual actions to
activate the necessary ESD systems; however, inadequate training was provided to clarify
each crew member’s responsibilities in the event of fire or gas detection. As a result, the
Engine Control Room was not immediately notified to shut down the operating generators
following the detection of gas, nor was the ESD systems activated for these areas.
Additionally, a number of fire and gas detectors may have been bypassed or inoperable at the
time of the casualty. The 1989 IMO MODU Code is insufficient because it does not include
specific requirements for the design and arrangement of gas detection and alarm systems.
This concern has not been corrected in the 2009 IMO MODU Code.
F. Separation of the Drill Floor from the adjacent occupied areas by A-class bulkheads, as
specified by the 1989 IMO MODU Code, did not provide effective blast protection for the
crew. The majority of injuries occurred in the accommodations areas separated from the
Drill Floor by A-class bulkheads. The 1989 MODU Code is insufficient because it does not
include minimum standards for the blast resistance of occupied structures. The 2009 IMO
MODU Code is also insufficient because it only requires an evaluation to ensure the level of
blast resistance of accommodation areas adjacent to hazardous areas is adequate, and fails to
address structures housing vital safety equipment.
G. The arrangement of main and emergency generators on DEEPWATER HORIZON met the
requirements of the 1989 IMO MODU Code for separation by A-60 divisions; however, the
arrangement of air inlets was not adequately taken into account. Flammable gases may have
affected all six engine rooms since their air inlets were not exclusively located. The 1989
IMO MODU Code is insufficient because it does not require the separation of the emergency
generator air inlets from likely sources of flammable gases. This concern has not been
corrected in the 2009 IMO MODU Code.
H. The Republic of the Marshall Islands’ (RMI’) “clerical error” in listing DEEPWATER
HORIZON as a self-propelled MODU instead of a dynamic positioned vessel enabled
Transocean to implement a dual-command organizational structure on board the vessel. This
arrangement may have impacted the decision to activate the vessel’s emergency disconnect
system (EDS). Even though the master, who was responsible for the safety of his vessel, was
in the CCR at the time of the well blowout, it cannot be conclusively determined whether his
questionable reaction was due to his indecisiveness, a lack of training on how to activate the
EDS or the failure to properly execute an emergency transfer of authority as required by the
vessel’s operations manual. U.S. regulations do not address whether the master or OIM has
32



the ultimate authority onboard foreign registered dynamic positioned MODUs operating on
the U.S. Outer Continental Shelf.

I. By not visiting and inspecting DEEPWATER HORIZON, RMI lacked the ability to validate
or audit its recognized organizations (ROs) in order to ensure that their inspection reports
were accurate and that the RO was adequately performing its role.
J. Class surveyors may not always perform regulatory oversight on a specific system unless it is
part of the survey. Pieces of the statutory inspection are integrated into the classification
survey which results in an incremental examination. Even though a surveyor is frequently on
board, the possibility exists that a system may not be inspected until it is required by
regulations.
K. The Coast Guard’s current guidance for inspectors performing MODU Certificate of
Compliance examinations and the casework process contained in the Coast Guard Marine
Information for Safety and Law Enforcement database system do not provide inspectors with
a sufficient level of detail for documenting and entering examination activities. Only the
main categories of inspected systems are provided. As a result, it is impossible to understand
which specific systems were satisfactorily examined by the Coast Guard.
L. The guidance circulars used by Coast Guard MODU inspectors and the offshore industry are
inadequate.
33



Chapter 2 | FIRE

This section describes the events onboard the offshore mobile drilling unit (MODU)
DEEPWATER HORIZON following the explosions and fire on April 20, 2010 at 2150 hours
local time until April 22, 2010 when the vessel sank. It provides an overview of the fire-fighting
and emergency response by the crew, describes the fire-fighting and fire protection systems
onboard the vessel and the vessel’s structural fire protection measures, and identifies system
limitations and deficiencies and crew actions and decisions that may have impacted the course of
the fire and fire-fighting activities.

I. Overview
As a result of the flammable gas explosion on the Drill Floor at approximately 2150 on April 20,
2010, DEEPWATER HORIZON experienced a significant fire that lasted until approximately
1026 on April 22, 2010, when the MODU sank. Crew members on the vessel’s fire brigade
initially attempted to respond to the fire as assigned by the MODU’s emergency procedures. The
chief mate, who was the assigned on-scene fire brigade team leader, testified that after the initial
explosion, he responded to the fire equipment locker, but was not immediately joined by the
other assigned fire brigade members, and “was basically waiting for any fire team-wise to show
up.”114

“I grabbed my radio back off my desk and headed out of the starboard door and went to the
Fire Gear Locker Number 1, which is port forward and just aft of the bridge. And I began --
I grabbed a jacket at first, was the only thing I grabbed as far as suiting up and waited.... I
got reports that there was a man down over by the starboard crane so I made my way over
there.... I knew I couldn't move him myself so I went to get help. I went back to the gear
locker and one more person showed up there. They suited up in fire gear.”115

After the second explosion, the chief mate decided to abandon fire-fighting efforts and focus on
evacuation.

At that point.... another explosion went off and we couldn't get back to him basically. The
area was obstructed.... We basically started making our way to the boats.... We were just
trying to get people out of there.”116

Concurrently, the chief engineer and two other members of the crew left the Central Control
Room/Bridge (CCR) and made an unsuccessful attempt to start the standby generator in order to
bring one of the main generators on line to supply electrical power for the fire pumps.117 The
chief engineer testified that he believed that if the emergency disconnect system (EDS) could
have been activated and the MODU unlatched from the riser, the fire could have been fought
with the available fire-fighting equipment on DEEPWATER HORIZON.

114 Testimony 5/27/2010 p 287.
115 Ibid., pp 264-266,
116 Ibid., pp 265-266.
117 Testimony 7/19/2010 p 191.


34



“After I had spoken with about EDSing, my thinking was that if the BOP had
separated, then we would have cut off the source of the fuel. At that time, all the fuel that
would be in the riser would burn out and we were going to -- then we're facing a fire that we
could actually control and put out. And to do that, we needed power and we need fire
pumps. That's why I went to the standby generator to get it started to get us more power if
we needed the compressors or whatever to get the main engines started then it would be
online and running.”118

When efforts to start the standby generator failed, and it became apparent that the EDS had not
disconnected the riser from the well and the hydrocarbons fueling the fire, the master made the
decision to abandon ship. In his testimony, the master provided his reasoning behind the
decision:

“Q. In a situation such as occurred on DEEPWATER HORIZON on the 20th of April, at what
point did you draw the line and say fire-fighting was no longer an option and abandonment
was required?

A. When we blacked out and had no power to run the fire pumps.
***

Q. After you gave the direction to go ahead and exercise the EDS, what happened after that?
A. Well, it was pretty straightforward. No -- the fuel to the fire wasn't -- wasn't shut off. We
had -- we were dark. We had no fire pumps. There was nothing left else to do but leave the
vessel -- abandon.”119
The officers in charge and the visiting company executives in the CCR were faced with making
rapid decisions regarding the emergency actions to take after the explosions and fire occurred.
There is, however, no evidence that prior to the abandonment of the MODU, there was any
organized effort to determine the condition or location of crew members who may have been
injured or trapped.

II. Systems
DEEPWATER HORIZON was equipped with a range of fire-fighting and fire safety systems that
included (1) a fixed fire main system designed to supply seawater to fire hose stations located
throughout the unit; (2) an automatic sprinkler system for the protection of the accommodations
and service areas; (3) fixed total flooding carbon dioxide systems for the protection of the main
engine and control rooms and other critical areas; (4) a fixed foam system for the protection of
the helideck; and (5) a structural fire protection system comprised of fire resistant bulkheads and
decks, intended to prevent or delay the spread of fire between discrete areas. This section will

118 Testimony 7/19/2010 p 191.
119 Testimony 5/27/2010 pp 182, 191.

35



describe the specifications of these systems and identify specific limitations and deficiencies in
these systems made apparent by the fire on DEEPWATER HORIZON.

A. Fire-fighting System Specifications
1. Fire Main
DEEPWATER HORIZON was equipped with a fixed fire main system throughout all decks that
was pressurized by two electric motor driven fire pumps located in Engine Rooms # 1 and # 6 on
the second deck. Each fire pump was sized to provide 100% of the maximum fire water demand,
and was rated for 125 m3/hr at 55 m head (550 gpm at 78 psi). The fire main pumps draw water
from the salt water system used to supply cooling water to the main engines and other drilling
related equipment. The fire pumps automatically started upon detection of pressure drop in the
fire main. Both pumps could be started locally in the pump rooms and were furnished with local
and remote pressure gauges located on the suction and discharge flanges. If the fire pumps were
inoperable, the electric motor driven ballast pumps and salt water service pumps could be
aligned to supply the fire main.120

Main and emergency electrical power for the fire pumps was supplied by the six main engines.
The standby generator was not configured to operate the fire pumps.121

Because of the height of the MODU above the water surface, the salt water service pumps were
used to boost pressure to the fire pumps. The salt water service pumps were located in the four
lower pump rooms, one in each quadrant of the pontoons. Each salt water service pump was
rated for 525 m3/hr at 83 m head (2312 gpm at 118 psi). The salt water service pumps took
water directly from the sea through fittings in the hull below the waterline located in each
column, to supply a number of onboard systems, including cooling water for the thrusters and
main engines and service water for the mud pits, water makers, sanitary system, and fire
protection systems. Pressure in the salt water service main was controlled by two back-pressure
controllers that opened and closed valves as needed to control flow in the system. Excess flow
from the system was discharged overboard.122

The fire main system supplied water to hose stations located on the third deck and above. Hose
stations in the columns below the third deck were supplied directly from the salt water service
system instead of the fire main, because of the lower elevation of the hose stations. The
elevation difference between the fire pumps and lower hose stations would have caused
excessive system pressure. Hose stations on the Drill Floor, Main Deck and at the lifeboats were
63 mm (2-1/2 in) diameter. Elsewhere on the rig and in the crew accommodation areas, the hose
stations were 38 mm (1-1/2 in). Each hose station included collapsible hose stowed on a hose

120 DEEPWATER HORIZON Operations Manual March 2001 Section 7.1.6, ABSDWH000310; Section 9.4.1,
ABSDWH000593.
121 DEEPWATER HORIZON Operations Manual March 2001 Section 7.1.6, ABSDWH000310; Section 9.4.1,
ABSDWH000593; DEEPWATER HORIZON Safety and Fire Control Plan, ASBDWH000599-611.
122 DEEPWATER HORIZON Operations Manual March 2001 Section 7.1.3, ABSDWH000308.


36



rack with an angle valve, nozzle, and spanner wrench. Hose stations in the engine rooms were
supplied with applicator type nozzles.123

In addition to the hose stations, the fire main supplied water to an 80 m3/hr (350 gpm) stationary
monitor124 (nozzle) that protected the well test equipment area, the automatic sprinkler system
protecting the crew accommodations area, and the Drill Floor cellar deck deluge system
protecting the bulkhead that separated the crew accommodations area from the Moon Pool. The
Drill Floor cellar deck deluge system was designed to provide cooling water at a rate of at least 6
lpm/m2 (0.15 gpm/ft2) over the bulkhead that separated the Moon Pool from the forward
accommodations area. The system was manually actuated when needed by a crew member
opening the system valve located near the port crane.125

2. Accommodation Area Automatic Sprinkler System
A wet pipe automatic sprinkler system was installed for the protection of the crew
accommodation and service areas on the second and third decks. The sprinkler heads were
Automatic Sprinkler Company of America (ASCOA) ½ inch orifice model H sprinkler heads
that automatically opened at a temperature of 68°C (154°F). The system also included ten
sprinkler heads in the galley with a 93° C (200°F) operating temperature. The system was
hydraulically designed to provide a water application rate of 5 lpm/m2 (0.12 gpm/ft2) over the
most remote area of 280 m2 (3,000 ft2).

The system was supplied through a 3000 liter (792 gal) fresh water pressure tank located in the
starboard forward column at elevation 28.5 m (94 ft). The pressure in the tank was maintained
by a connection from the unit’s air compressor system. Water supply to the tank was provided
by a feed from the fresh water system. A seawater connection from the fire main was also
provided downstream from the tank. The pressure tank discharged through separate 100 mm (4
inch) diameter risers to each deck through ASCOA Model 353 alarm check valves.126

If power was lost to the fire pumps, the residual water supply in the storage tank was capable of
supplying the sprinkler system for a period of slightly over two minutes. It is possible that this
occurred during the casualty: one of the cementers testified that during his escape from the
accommodation areas, he observed the sprinklers discharging even though there was no fire in
the immediate area.127

123 Applicators are fire-fighting nozzles consisting of a metal “L” shaped pipe about 2 m (6 feet) in length fitted with
a water fog fire nozzle on the short segment of the device.
124 A monitor nozzle, sometimes called a water cannon, is a large bore fire-fighting nozzle permanently fixed to
installed piping that is used to discharge large volumes of water from a distance. Monitor nozzles discharge greater
quantities of fire-fighting water than can be safely controlled by fire-fighters using hand hose lines.
125 DEEPWATER HORIZON Operations Manual March 2001 Section 7.1.6, ABSDWH000311.
126 Water Sprinkler Fire Extinguishing System Drawings, Hyundai Heavy Industries Co., LTD, ABSDWH004187-
4235.
127 Testimony 5/28/2010 p 261.


37



3. Fixed Carbon Dioxide Systems
DEEPWATER HORIZON was also fitted with three fixed total flooding carbon dioxide (CO2)
systems. The main carbon dioxide system provided fire protection for:

. Engine Rooms # 1-3 (port)
. Engine Rooms # 4-6 (starboard)
. 11 kV Switchgear Rooms # 1-3 (port)
. 11 kV Switchgear Rooms # 4-6 (starboard)
. 11 kV Switchboard Rooms (port & starboard)
. 600 V Switchgear Rooms (port & starboard)
. 480 V Switchboard Rooms (port & starboard)
. Motor Control Center rooms (port & starboard)
. Fuel Oil Rooms (port & starboard)
. Engine Control Room
. Mud Pit Room
The system consisted of twenty-four 45 kg (100 lb) capacity high pressure CO2 cylinders fitted
with manual pneumatic remote and local releasing controls. The CO2 cylinders were located in a
room on the centerline aft on the Main Deck above the engine rooms. When the systems were
activated, a 30 second time delay was provided to allow personnel to escape from the protected
space prior to the discharge of gas. CO2 powered sirens would sound in each space to warn of
impending discharge. In areas with operating machinery, visible alarms would activate to
provide additional warning.

A second CO2 system, consisting of four 45 kg (100 lb) high pressure CO2 cylinders protected
the standby generator room and paint locker. The cylinder storage room for this system was
located on the Main Deck adjacent to the standby generator.

The third CO2 system was designed for the protection of the occupied CCR. The system
consisted of ten 45 kg (100 lb) CO2 cylinders that were stored in a dedicated room, just aft of the
control room. CO2 powered pre-discharge alarms along with a 30-second time delay were
installed in the protected space.

All of the systems were designed to be manually activated by crew members from remote release
stations located near the entrances to the protected spaces, and in the respective CO2 storage
rooms. Except for the systems protecting the standby generator room and paint locker, each
system had pressure operated switches installed in the discharge piping between the stop valves

38



and time delays to automatically shut down ventilation systems in the protected areas before CO2
was discharged.128

4. Helideck Foam System
The DEEPWATER HORIZON helideck and adjacent JP-5 fueling equipment was protected by a
fixed foam system. The system utilized 3% Aqueous Film Forming Foam (AFFF) as an
extinguishing medium, stored in a 750 liter (200 gal) Ansul horizontal bladder tank located on
the roof of the central control room. Foam could be discharged from three 63 mm (2-1/2 in)
hose reels and three 76 mm (3 in) fixed monitors located at each of the three access stairways to
the helideck. The JP-5 fuel unit was protected by six Grinnell model B-1 overhead foam/water
sprinklers that were supplied through a separate discharge line from the foam system.

5. Structural Fire Protection
DEEPWATER HORIZON’s structure was subdivided by fire-resistant bulkheads and decks
designed to contain fires to the space or area of origin, and to limit fire spread to uninvolved
areas. These structural fire protection measures were designed to comply with standards
contained in Table 9.1 of the 1989 International Maritime Organization (IMO) MODU Code.
There are two defined levels of protection in the Code. A-class divisions are intended to prevent
the spread of fire for 60 minutes, while B-class divisions prevent the spread of fire for 30
minutes. These levels of protection are intended to shield the crew for a sufficient time period to
allow escape from the affected areas, and allow the fire brigade to safely assemble and begin
fire-fighting efforts. In accordance with this table, the CCR and CO2 room were separated from
adjacent areas by A-60 class divisions.129 The paint locker, warehouse, and electrical equipment
rooms were surrounded by A-0 class boundaries. The standby generator room was separated
from adjacent areas by A-0 class divisions, except for an A-60 starboard bulkhead which
separated the generator room from the paint locker. The galley was separated from the adjacent
mess area by A-class bulkheads. The sack storage room was separated by A-class divisions
except that the forward bulkhead which shared a boundary with the accommodation spaces, and
the aft bulkheads which shared a boundary with Engine Rooms # 5 and # 6, were A-60 class
divisions.

In addition to the bulkhead and deck classification requirements in Table 9-1, paragraph 9.1.3 of
the 1989 IMO MODU Code requires exterior boundaries of superstructures and deckhouses
enclosing crew accommodation areas to be constructed of A-60 class divisions for the entire
portion which faces and is within 30 m (98 ft) of the center of the Drill Floor rotary table.
Because of this requirement, A-60 bulkheads were used to surround the drilling area on the
second and third decks. The drilling area on the Main Deck (at elevation 41.5 m (136 ft)), and

128 High Pressure CO2 Fire Extinguishing System Drawings, Hyundai Heavy Industries Co., LTD,
ABSDWH004163-4180.
129 In addition to 60 minutes of fire resistance, fire rated divisions may be insulated to limit the temperature rise on
the fire unexposed side of the division. Such divisions are designated by an alpha-numeric rating system, where the
letter indicates whether the division provides 30 or 60 minutes of fire resistance, while the numeral indicates the
insulating value of the division. An A-60 bulkhead, for example, provides both 60 minutes of fire integrity and 60
minutes of temperature rise limitation. An A-0 bulkhead (typically a bare 3 mm (1/8 inch) thick steel bulkhead) will
have 60 minutes of fire integrity, but no insulating capability.

39



drilling floor (at elevation 46 m (151 ft)) did not abut any accommodations and consequently
were not bounded by fire rated divisions. Because the driller’s work station located on the Drill
Floor was considered part of the industrial process area, it was not subject to any structural fire
protection requirements, and thus was permitted to have large windows facing the Drill Floor to
allow the Drillers to view ongoing operations.

B. System Limitations and Deficiencies
The DEEPWATER HORIZON fire exposed several limitations and deficiencies of the MODU’s
fire safety systems. This investigation identified the following areas of concern:

1. Operation of the fire main system was not possible after the main generators were
disabled.
Paragraph 9.4.2 of the 1989 IMO MODU Code requires that “at least one of the required fire
pumps should be dedicated for fire-fighting duties and be available at all times.” The
requirement to “be available at all times” was satisfied by the presence of electric motor driven
fire pumps in both Engine Rooms #1 and #6. Once the explosions had disabled all of the main
and emergency generators, however, the electric motor driven fire pumps could not be operated.
The standby generator did not have sufficient capacity to operate the fire pumps, as it was only
sized to supply a limited electrical load sufficient to power back-up lighting and the air
compressors needed to restart the main engines.130 Thus, even had the fire brigade laid out the
hoses and tried to fight the fire, or activated the Drill Floor cellar deck deluge system, it would
not have been possible to pressurize the systems. This incident illustrates that a fire main system
that has only electric motor driven fire pumps is vulnerable to a total loss of electrical power. A
system that included diesel engine driven fire pumps as well may have provided the ability to
operate the fire main under such circumstances.

2. A-class structural fire protection barriers were not effective against a hydrocarbon fire
exposure.
A-class bulkheads are not expected to function as effective fire barriers when exposed to a
hydrocarbon fire source. The IMO MODU Code structural fire protection requirements were
taken from the International Convention for the Safety of Life at Sea (SOLAS) Chapter II-2
regulations for passenger and cargo ships. The fire scenarios envisioned are typical
accommodation area fires involving ordinary combustibles.131 The approval of A-class
bulkheads is based on a standard SOLAS fire test method intended to replicate the burning of
materials found in staterooms, such as wood, paper and plastic. The fire risk posed by different
fire sources is linked to the fuel’s heat of combustion, which for ordinary combustible materials,
is in the range of 16-19 MJ/kg (7,000 to 8,000 BTU/lb). Hydrocarbons are capable of causing
more severe fires since their heat of combustion is expected to be in the 44-51 MJ/kg (19,000


130 Testimony 7/23/2010 p 19.
131 Senate Report No. 184, March 1937, pp 70-73, “Fire Tests on the Steamship NANTASKET, Transactions of the
Society of Naval Architects and Marine Engineers, Volume 45, Fire Protection Handbook, National Fire Protection
Association, Quincy, MA, 19th Edition, pp 14-103 to 14-104.


40



22,000 BTU/lb) range.132 The 1989 IMO MODU Code does not include any specific fire safety
measures to protect against hydrocarbon based fires.

In this instance, the spread of fire after the initial explosions was not limited by the A-class
bulkheads onboard DEEPWATER HORIZON, and resulted in one of the visiting Transocean
executives suffering serious burns. At the time of the blowout, the executive was in the hallway
outside the offshore installation manager (OIM) office on the second deck, near the doorway to
the Sack Room. Although an A-class bulkhead and fire door separated the Sack Room from the
hallway, the visiting executive nevertheless suffered serious injuries.133 Thus, in this instance,
the use of A-class bulkheads to separate the drilling area from the accommodation spaces,
service spaces and control stations did not provide an adequate level of protection to limit the
spread of a hydrocarbon fire.

Accepted standards are available to resolve this issue. A more stringent laboratory fire test
method has been developed to simulate exposure to large scale hydrocarbon fires. Fire barriers
that have met the standards of the hydrocarbon fire test are designated as H-class fire barriers.
Details of the H-class fire test may be found in ASTM E 1529, Standard Test Methods for
Determining Effects of Large Hydrocarbon Pool Fires on Structural Members and Assemblies.

Moreover, the IMO MODU Code was revised in 2009 and now contains the following new
standard:

“In general, accommodation spaces, service spaces and control stations should not be located
adjacent to hazardous areas. However, where this is not practicable, an engineering
evaluation should be performed to ensure that the level of fire protection and blast resistance
of the bulkheads and decks separating these spaces from the hazardous areas are adequate for
the likely hazard.”

Footnote (e) of Table 9.1 clarifies that this requirement only applies to Type 1 spaces (control
stations), Type 2 spaces (corridors), Type 3 spaces (accommodations) or Type 4 spaces
(stairways) that are adjacent to a hazardous area. This application, however, fails to consider the
need to protect vital safety systems and equipment such as fire extinguishing systems, fire
pumps, emergency generators, dynamic positioning controls and other equipment that could be
located in Type 5 through 11 spaces such as machinery spaces or service spaces. The
DEEPWATER HORIZON fire illustrates the importance of including consideration of all safety
equipment located adjacent to hazardous areas in the engineering evaluation specified by
paragraph 9.3.1, irrespective of the type of space where this equipment is located.

Notably, the IMO MODU Code does not provide guidelines for performing the engineering
evaluation or determining acceptance criteria. Rather, the generally worded requirement to
ensure that the level of fire protection of the bulkheads and decks separating accommodation
spaces from the hazardous areas is adequate for the likely hazard, does not clearly indicate how

the necessary fire protection measures are to be determined.

132 Fire Protection Handbook, National Fire Protection Association, Quincy, MA, 19th Edition, Tables A-1 through
A-3.
133 Witness Statement 4/26/2010.


41



3. No fixed fire-extinguishing system was installed for the protection of the Drill Floor and
adjacent areas.
The IMO MODU Code does not require the installation of deluge systems for the protection of
the Drill Floor and adjacent areas. In this instance, had the crew been able to successfully
disconnect from the riser and regain electrical power, the fire brigade would have had to fight the
fire manually using hoses and the single 80 m3/hr (392 gpm) fixed monitor located on the
starboard Main Deck near the well test equipment. The cellar deck deluge system was designed
to protect only the rear bulkhead of the crew accommodation area, and thus did not provide
protection for the rest of the main Drill Floor. The fitting of a fixed deluge system or multiple
high capacity monitors for the protection of the entire Drill Floor area would enable crews to
more effectively control well head fires, and could also provide a degree of shielding for crew
members in the area. Deluge systems automatically activated by a gas detection system could
potentially mitigate blast damage within the protected area.

4. The use of prescriptive standards alone does not provide an adequate level of fire
protection safety for MODUs.
The DEEPWATER HORIZON fire revealed that compliance with prescriptive standards is not
sufficient to provide adequate fire safety. The arrangement of the main and emergency
generators, and the use of all electric motor driven fire pumps, met the standards of the MODU
Code. However, a performance-based analysis of these arrangements could have identified the
vulnerabilities in locating the main and emergency generator air inlets within close proximity
and the limitations in the use of all electric motor-driven fire pumps.

Although the 1989 IMO MODU Code was amended and significantly improved in 2009,
compliance with these prescriptive standards alone does not assure that an adequate level of fire
protection safety will be provided, except for limited fire hazard scenarios such as those
occurring in accommodation or galley areas. The Code does not contain fire protection
standards to protect onboard personnel and safety equipment from hydrocarbon fires. The only
section in the Code that addresses emergency conditions due to drilling operations focuses on the
selective shutdown of ventilation and electrical power equipment.134 The Code also does not
consider the unique aspects or operations of each MODU. A supplemental risk analysis, beyond
the limited prescriptive standards in the Code, would provide a method of evaluating the specific
design and arrangement of each MODU to determine if safety improvements could be made by
reconfiguring the arrangement or location of systems and structures.

III. Actions/Decisions Contributing to System Failure
Although there is insufficient evidence to conclude that crew decisions relating to fire-fighting
would have had a demonstrable impact on the course of events, two decisions by the crew may
have reduced the overall effectiveness of the fire safety system.

134 Code for the Construction and Equipment of Mobile Offshore Drilling Units, 1989, Chapter 6, Section 6.5.

42



A. The fire brigade members quickly decided that the fire was not controllable and did not
begin active fire-fighting efforts.
Crew members testified that they believed onboard fire-fighting efforts would have been to no
avail:

“And that time my first thought was to go to the fire-fighting equipment. Being that when I
got there I wasn't the only one there, I was -- I was -- as I was untying my boots to put on the
fire-fighting equipment. I noticed that I was the only one there. I looked up at the derrick
again and by that time I knew that we were not going to be able to fight this fire. So, I
decided to tie my boots back on and make myself -- my way to the lifeboat deck. When I got
down there was some other members of the roustabout crew and they told me that they had
been to the fire-fighting equipment, but they thought the same as I did that there was no way
that we were going to be able to put the fire out.”135

Although the decision to not fight the fire is considered a reasonable response in this case, post-
casualty review of onboard weekly fire drill records found some evidence that drills may have
become routine and that the crew was not fully engaged in them. Fire drills were held at the
same time, on the same day every week, on Sunday at 1030.136 Personnel involved in drilling
activities whose responsibilities at that time were to continue monitoring important systems were
excused from the drills.137 The record of the fire drill held on April 18, 2010, just two days prior
to the casualty, recommended that more focus be given to the proper donning of personal
protective equipment during drills, since it was observed that the brigade members were hesitant
to put on hoods during exercises because they were hot and uncomfortable. Further, the OIM
placed a comment in the record that fire drills need to be treated as “the real deal.” 138 The
crew’s approach to fire drills may have influenced its response to the fire during this casualty.

B. The responsible officers took no actions to discharge any of the fixed CO2 systems
protecting important equipment.
Following the initial explosions, the crew did not attempt to activate any of the manually
released CO2 systems protecting the Engine Rooms, Switchgear Rooms, Motor Control Center
Rooms, Fuel Oil Rooms, Engine Control Room and Mud Pit Rooms. This was most likely
attributable to the very short time period between the onset of the incident and when the abandon
ship order was given. As previously noted, the assembled members of the fire brigade had
quickly decided that the fire was uncontrollable, and that abandonment was the more prudent
course of action. Moreover, it is likely that blast damage to the enclosure bulkheads of the
protected areas had caused enough damage to the structure to prevent the total flooding
extinguishing systems from operating effectively.

135 Testimony 5/29/2010 pp 145-146.
136 Testimony 5/26/2010 pp113-114; Testimony 5/27/2010 pp 46-47.
137 Testimony 5/27/2010 pp 204-205; Testimony 10/5/2010 pp 200-201.
138 Safety Drill Report, 18 April 2010, Document Number DWH-2010-Apr-045-SAF, TRN-USCG_MMS-
00042610.



43



Even without manual activation, witness testimony revealed that the CO2 system in the
Electronics Technician Room forward of the ECR discharged after the initial explosions.139
While it is unknown what caused the system to operate, it is believed that the force of the
explosion may have produced this unintended operation. If the explosion had also caused one of
the fixed carbon dioxide systems protecting the main engine rooms to discharge, the pressure
operated switches on the control piping would have shut down the ventilation systems for the
engine rooms. Thus, although the discharge may have extinguished the fire in that location, the
discharge of the full extinguishing concentration of carbon dioxide would likely have disabled
the engines and generators, to the extent that the explosions had not already done so.

IV. U.S. Government/Class/Flag Oversight
See related information in Chapter 1, “Explosion.”

V. Conclusions
A. The fire brigade members quickly decided that the fire was not controllable and did not begin
active fire-fighting efforts. Although that was a reasonable response in this case, there is
evidence to support the view that the routine, repetitive nature of the weekly fire drills had
led to a degree of complacency among the crew members and that personnel did not fully
embrace the importance of fire brigade exercises.
B. The fire main system was not capable of operation after all electrical power was lost, because
only electric motor driven fire pumps were provided. The 1989 IMO MODU Code as
amended in 2009 is insufficient because it does not require a portion of the pumping
capability to be supplied by diesel pumps or similar independent sources.
C. The A-class fire barriers surrounding the Drill Floor were not effective in preventing the
spread of the fire. A-class bulkheads are not tested for exposure to hydrocarbon fire sources.
The 1989 IMO MODU Code as amended in 2009 is insufficient because it does not require
fire separations between the drilling area and adjacent accommodation spaces or spaces
housing vital safety equipment to withstand such exposures.
D. There is no evidence that any consideration was given prior to abandonment of the MODU to
trying to determine the condition or location of crew members who may have been injured or
trapped, except for the chief mate’s independent attempt to organize the rescue of the
starboard crane operator, only to be driven back by subsequent explosions. It was not until
the safety of DAMON B. BANKSTON was reached that a full accounting of the crew was
undertaken by those in charge.
E. The use of manual fire hoses to fight a hydrocarbon fire of the magnitude experienced on the
Drill Floor and adjacent areas of DEEPWATER HORIZON could expose the onboard fire
brigade members to dangerous levels of fire and heat. A fixed deluge system for the
protection of these areas would not place the fire brigade members in jeopardy and could be
rapidly activated upon gas detection to mitigate the effects of a possible explosion.
139 Testimony 7/23/2010 p 14.

44



F. The prescriptive standards in the IMO MODU Code do not provide an adequate level of fire
protection when considering fires of the magnitude experienced on the Drill Floor and
adjacent areas of DEEPWATER HORIZON. The 1989 MODU Code is insufficient because it
does not require a supplemental performance-based risk analysis to calculate the necessary
levels of protection for the unique design, arrangement and operation of each MODU. The
2009 amendments to the IMO MODU Code now require an engineering evaluation to
determine the level of fire protection needed for occupied areas that are located adjacent to
the hazardous areas on the Drill Floor, but it does not provide guidance on the method for
performing the engineering evaluation or defining acceptance criteria.
45



Chapter 3 | EVACUATION / SEARCH AND RESCUE

This section describes and analyzes the events on board the mobile offshore drilling unit
(MODU) DEEPWATER HORIZON following a series of explosions and the ensuing fire
beginning at approximately 2150 on April 20, 2010 and continuing until approximately 1900 on
April 23, 2010 when the active Search and Rescue (SAR) efforts were suspended. This section
provides an overview of the initial emergency notification of the casualty on board
DEEPWATER HORIZON, mustering and evacuation of the crew, the available primary
lifesaving equipment and systems, and the effectiveness of these systems. This section also
reviews government and third party oversight of DEEPWATER HORIZON’s inspections and
surveys of the primary lifesaving equipment.

I. Overview
A. Notification of Emergency
At approximately 2150 on April 20, 2010, the master and the on-watch senior dynamic
positioning officer (SDPO) were escorting four members of the BP and Transocean leadership
team on a familiarization tour through the DEEPWATER HORIZON Central Control
Room/Bridge (CCR), including a hands-on experience operating the dynamic positioning (DP)
simulator.140 Suddenly, the on-watch dynamic positioning officer (DPO) yelled, “We’re in a
well control situation.”141 Soon thereafter, there were explosions causing a fire and a loss of
electrical power on board DEEPWATER HORIZON. The first official notice of the emergency
to the MODU crew came from the general alarm, which was activated by the DPO.142
Simultaneously, the on-watch SDPO verbally announced over the MODU’s public address
system, “This is not a drill … muster at your emergency stations.”143 A mud engineer on board
later testified that he heard an announcement, “Fire, fire, fire, this is not a drill … report to
secondary muster stations, do not go outside.”144

After learning that three personnel from DEEPWATER HORIZON had jumped into the water, the
SDPO called the offshore supply vessel DAMON B. BANKSTON¸ which was positioned
alongside DEEPWATER HORIZON, and asked it to launch its fast rescue craft (FRC) to retrieve
any persons in the water.145 DEEPWATER HORIZON also directed the DAMON B. BANKSTON
to move out to a 500 meter position because of the ongoing well condition and the ensuing
explosions and fire.146

Following the explosion, the performance coordinator on DEEPWATER HORIZON, a BP
contract employee from Expediters and Production Services, used a satellite telephone to call the
BP Shore Base in Texas to notify it of the fire, to request resources and advise BP of the

140 Testimony 5/10 p 149.
141 Ibid., p 220.
142 Testimony 10/5/2010 p 14.
143 Testimony 10/5/10 p 152.
144 Testimony 5/28/2010 pp 234-235.
145 Testimony 10/5/2010 pp 151-152.
146 Testimony 10/5/2010 p 14; DAMON B. BANKSTON Log.



46



evacuation.147 At 2206, the BP Shore Base Supervisor notified the U.S. Coast Guard by
telephone and advised the BP Houston, Texas Logistics Marine Operations Coordinator to
assemble a crisis team.148

At 2156, the on-watch DPO activated DEEPWATER HORIZON's Global Maritime Distress
Safety and System (GMDSS) Digital Select Calling (DSC) Alert, which was automatically
relayed first by M/V NORDSTERN to Maritime Rescue Coordinator Center Rome, Italy and then
sent to the Eighth Coast Guard District Command Center New Orleans, Louisiana for action.149

Coast Guard Sector Mobile, Alabama received DEEPWATER HORIZON’s DSC alert, as well as
a Good Samaritan VHF radio report from the recreational fishing vessel RAMBLIN’ WRECK that
DEEPWATER HORIZON was engulfed in fire and that the personnel were abandoning the
MODU.150 The Coast Guard issued an Urgent Marine Information Broadcast, and approximately
twenty vessels operating in the area responded to render assistance.151

Coast Guard Air Station New Orleans received the Search and Rescue (SAR) alarm at 2210 and
launched Coast Guard helicopter CG-6605 at 2228. At 2310, CG-6605 arrived on scene and
assumed the role of On-Scene Coordinator (OSC). 152

B. Crew Muster153
The chief mate and others went to their assigned Emergency Stations and attempted to execute
their Fire and Emergency (evacuation) duties as required by the DEEPWATER HORIZON
Station Bill.154 Upon arriving at his Fire and Emergency Station in the CCR, the chief engineer
heard “The master screaming at the on-watch DPO for pushing the distress button.”155 After
assessing the emergency condition on the Drill Floor and evaluating the fire condition, the chief
mate returned to the CCR, reported an uncontrolled fire and informed the master that the crew
needed to evacuate.156

Personnel attempted to reach their assigned Lifeboat Embarkation Stations at Lifeboat #1 or
Lifeboat #2 on the second deck. A crane operator testified that when he reported to his
secondary muster station at the galley, also known as the Temporary Refuge Area for Lifeboat #
1, the galley was completely collapsed.157 He waited with others for about ten seconds until they
noticed the door leading to the Lifeboat Deck was open. He and the others then made their way

147 Testimony 10/6/2010 pp 12-16.
148 Statement 10/5/2010; USCG Final Action Report on the SAR Case Study into the Mass Rescue of
Personnel off the Mobile Offshore Drilling Unit DEEPWATER HORIZON (Appendix G), pp G-2.
149 USCG Final Action Report on the SAR Case Study into the Mass Rescue of Personnel off the Mobile Offshore
Drilling Unit DEEPWATER HORIZON (Appendix G), p 2.
150 Ibid., p 8.
151 Ibid., pp 2-3.
152 Ibid., p 5.
153The term “muster” in a maritime setting means to assemble the crew for the purposes of accounting for personnel.
154 Statement 4/22/2010.
155 Statement 4/21/2010.
156 Testimony 10/5/2010 p 19.
157 Testimony 5/28/2010 pp 233-234.



47



to the Lifeboat Embarkation Deck where they found the assistant driller attempting to take a
headcount.158

During the muster of personnel at Lifeboat # 1, the on-watch compliance specialist thought the
muster was taking too long and left the Lifeboat Embarkation Deck, proceeded to the lower
smoking deck, and jumped overboard.159 As discussed above, he and two others were quickly
recovered from the water by DAMON B. BANKSTON’s FRC before either of DEEPWATER
HORIZON lifeboats was launched.160

As personnel continued to board Lifeboat # 1, crew members attempted to load a stretcher
transporting the visiting Transocean operations manager-assets. Once he was loaded, he was
taken off the stretcher and the stretcher was thrown out of the lifeboat.161 The BP Vice President
of Drilling & Completion for the Gulf of Mexico, who was assigned to Lifeboat # 2, was one of
the last people to enter Lifeboat # 1, along with the on-watch Subsea Engineer. The vice
president had to physically wedge himself into the cramped lifeboat to get a seat because some of
the injured were laid out. He described the environment inside the lifeboat as
“pandemonium.”162 There was “mass confusion” over how occupants could secure themselves
with the color coded shoulder harnesses.163

According to a crane operator, the muster of personnel at Lifeboat # 2’s Embarkation Deck was
so chaotic that they attempted to have the mustering personnel count off to determine how many
people were at the station. The personnel were so scared that they could not provide an accurate
count, so the decision was made that they would just to fill the boat to capacity, load the
wounded and launch.164

C. Lifeboat Evacuation
When the Transocean operations manager-performance arrived at the Lifeboat Embarkation
Deck from the CCR, he saw that neither lifeboat had launched. He believed that the coxswain of
Lifeboat # 2 was awaiting instructions to launch the lifeboat. In the absence of the master, and
having observed equipment falling down around them, he told the coxswain of Lifeboat # 2 to
“go.”165

After Lifeboat # 2 had departed, the launching of Lifeboat # 1 was delayed as the Transocean
operations manager-performance waited for the master, who was assigned to that boat, to arrive.
However, when the master finally appeared, he said, “We have other people. We are going to the
rafts.” The Transocean operations manager-performance waited for a minute or so and then
decided to launch the lifeboat.166

158 Testimony 5/28/2010 pp 224-225.
159 Ibid., pp 222-223.
160 Ibid., pp 223-224.
161 Statement 4/26/2010.
162 Testimony 8/26/2010 pp 396, 405.
163 Testimony 12/7/2010 pp 71-72.
164 Testimony 5/29/2010 p 13.
165 Testimony 8/ 24/2010 pp 15-16; Statement 4/26/2010.
166 Testimony 8/23/2010 p 453.



48



The Transocean operations manager-performance reported that on board Lifeboat #1, the
coxswain was “a bit excited” so he told the coxswain “to calm down.” He further instructed the
launching and movement of the lifeboat away from DEEPWATER HORIZON. He recalled the
coxswain was going to turn on the air supply to the lifeboat and the water spray system to cool
the boat; however, that was never done. While the coxswain maneuvered the lifeboat toward
DAMON B. BANKSTON, the Transocean operations manager-performance opened the lifeboat’s
door against the coxswain’s order and climbed on top of the lifeboat to activate the windshield
wiper and clean the lifeboat’s windshield of drilling mud that had accumulated as a result of the
well blowout.167

Both lifeboats reached the DAMON B. BANKSTON safely.

D. Liferaft Evacuation
After both lifeboats had been launched, eleven survivors remained aboard DEEPWATER
HORIZON and attempted to evacuate using davit-launched inflatable liferafts. See Figure 11
infra. On his way to the liferaft, the on-watch SDPO saw the master and a few others getting the
davit ready while the chief mate was preparing the liferaft.168 After the davit’s releasing hook
was attached to one of the three nearby rafts, the davit itself could not be rotated outboard from
the side of DEEPWATER HORIZON in order to position the raft for inflation. Upon closer
examination, the chief electronics technician noticed that a rope attached to the releasing hook
was secured to the davit by means of a shackle, which prevented the davit and liferaft from
rotating clear of DEEPWATER HORIZON. After he removed the shackle pin with a small tool,
the davit finally rotated to allow the liferaft to be inflated.169

Once the liferaft was inflated, the chief engineer ran over to a nearby stretcher containing the off-
watch toolpusher and proceeded to drag it across the deck to the Liferaft Embarkation Deck.
The master said, “Leave him,”170 referring to the injured man. Nevertheless, the chief mate and
the chief electrician boarded the raft first, then assisted the chief engineer in loading the stretcher
into the liferaft.171 After the stretcher was loaded, the chief engineer, electrical/electronics
supervisor, the senior toolpusher, and the DPO boarded the liferaft.172

During the loading of the liferaft, the raft was slowly rotating, swinging, filling with smoke and
becoming very hot. According to the chief engineer, the flames and heat coming down the
forward part of the deck and from under the column-stabilized hull of DEEPWATER HORIZON
created a vortex at the Liferaft Embarkation Station.173 After entering the raft, the chief engineer
felt the heat of the fire penetrating the clothing covering his knees and the leather gloves
protecting his hands. One occupant in the liferaft yelled, “We are going to die.”174

167 Testimony 8/23/2010 pp 453-455; Statement 4/26 /2010.
168 Testimony 10/5/2010 p 153.
169 Statement 4/21/2010.
170 Ibid.
171 Ibid.
172 Testimony 5/27/2010 pp 332-333.
173 Testimony 7/19/2010 p 45
174 Ibid., p 46.



49



The chief electronics technician, who was standing on the Liferaft Embarkation Deck and
waiting to board the liferaft, saw fire coming out of the top of the derrick and projectiles coming
from everywhere. This combination of events created a back draft underneath DEEPWATER
HORIZON. At that point, he felt unsure whether the liferaft would survive the heat or “was
going to pop and melt, and the people inside were going to cook.”175

As the master, on-watch SDPO and the chief electronics technician waited to board the liferaft, it
filled with black smoke and got so hot that the chief mate could not find the brake handle to
release the raft.176 Someone within the liferaft told the master, “Let’s go!” and “You all get in.”
But the master did not board and said “not to worry about him.”177 The chief mate finally pulled
the release handle that began the raft’s descent.178

The master, on-watch SDPO, the chief electronics technician and on-watch motorman were left
aboard DEEPWATER HORIZON at the Liferaft Embarkation Station. The master determined
there was not enough time to manually crank the davit’s releasing hook back to the davit to
deploy another liferaft.179 When the on-watch SDPO asked the master, “What about us?” the
master said, “I don’t know what you’re going to do, but I’m going to jump.”180 The master then
jumped approximately 50 feet181 into the water, followed by the on-watch SDPO182 and on-watch
motorman183. The chief electronics technician made his way to the Helicopter Landing Deck
from which he jumped approximately 71 feet into the water.184 They did not use the fixed metal
ladders extending from the embarkation deck to the surface of the water.185

As the liferaft quickly descended approximately thirty-five feet below the Liferaft Embarkation
Deck, the liferaft's painter line, which was still attached to the MODU, became taut.186 The
liferaft tilted approximately 90 degrees, ejecting the off-watch toolpusher from the stretcher
while the other occupants tumbled within the confines of the liferaft.187 Once the liferaft hit the
water, the on-watch DPO fell out of the raft and swam away.188 The chief mate, chief
electrician, and chief engineer exited the raft and began pulling it away from the burning

DEEPWATER HORIZON.189


175 Testimony 7/23/2010 p 23.
176 Testimony 5/27/2010 pp 268-269.
177 Testimony 10/5/2010 p 154.
178 Testimony 5/27/2010 p 333.
179 Testimony 5/27/2010 p 210.
180 Testimony 10/5/2010 pp 155-156.
181 Distance determined by DEEPWATER HORIZON outboard profile drawing using the drilling draft,
ABSDWH000074.
182 Testimony 10/5/2010 p 156.
183 Statement
184 Distance determined by DEEPWATER HORIZON outboard profile drawing using the drilling draft,



ABSDWH000074; testimony 7/19/2010 pp 47-48.
185 Testimony 10/5/2010 pp 172-173.
186 Testimony 5/27/2010 pp 269-270.
187 Ibid.
188 Testimony 10/5/2010 p 15.
189 Testimony 5/27/2010 p 334.


50



Someone then noticed the painter line was still attached to DEEPWATER HORIZON. None of
the occupants of the liferaft had a knife to cut the painter line, nor could they find the knife
stored on the liferaft despite the light provided from the fire.190 By this time, the master and the
SDPO had swum over to the liferaft, but neither had a knife.191 BP had a strict “Knife Free”
Policy for the crew while on board DEEPWATER HORIZON.192 As the FRC from DAMON B.
BANKSTON approached the liferaft, its crew pulled the on-watch DPO and the chief electronics
technician from the water and provided a knife to the master who then freed the liferaft.193 The
FRC then towed the raft and those clinging to its outer edges safely to DAMON B.
BANKSTON.194

E. Search and Rescue (SAR)
Please see Appendices G and H for details on SAR activities.

II. Systems
A. Notification of Emergency
The DEEPWATER HORIZON operations manual established duties and responsibilities by job
title for the personnel that make up the MODU’s emergency response organization.195 Chapter
10.4, Emergency Procedures for Uncontrolled Escape of Hydrocarbons, assigns the
responsibility of emergency response procedures via a tiered response approach. The severity of
the emergency is identified using a sliding scale of Phase I, Phase II and Phase III with
associated alarm signals to alert the MODU crew.196

At Phase I, the offshore installation manager (OIM) is in overall command of the emergency and
is responsible for advising the company shore-base management of the status of the emergency
and ensuring that the marine crew is ready to move off location. At Phase II, the OIM is
responsible for sounding the general alarm (GA), announcing the emergency to the crew and
requiring them to muster and prepare to leave the MODU. He must also request that the master
move the MODU off the location after consulting with the lessee operator’s drilling
representative. Phase III includes the sounding of abandon ship, moving off location, and giving
the command to launch the lifeboats.197

These procedures were not performed during the casualty. This failure may be attributable in
part to the presence of the BP and Transocean executives, also referred to as the “leadership

190 Statement 4/21/2010.
191 Testimony 5/27/2010 p 194.
192 Statement 4/21/2010; Transocean Health and Safety Policies and Procedures Manual, HQS-HSE-PP-01,
Section 4.9.
193 Testimony 7/23/2010 p 26.
194 Testimony 7/19/2010 p 49.
195 IMO MODU Code, Chapter 14 requires an Operating Manual. 46 CFR 109.121 requires that the Operating
Manual be approved by the Coast Guard.
196 DEEPWATER HORIZON Operations Manual March 2001 Chapter 10.4, Emergency Procedures for Uncontrolled
Escape of Hydrocarbons.
197 Ibid.


51



team,” on board DEEPWATER HORIZON during the casualty. Their presence may have
diverted the attention of the OIM and senior toolpusher from the ongoing well conditions and
may have caused the drill crew to limit their interactions with these senior drilling crew
members. Specifically, the senior toolpusher noted that as he accompanied the leadership team
on a tour of the Drill Floor around 1700, he spoke to the on-watch driller about the negative test
procedures and then told the on-watch toolpusher that he “would come back [to the Drill
Floor].”198

The on-watch toolpusher told the senior toolpusher, “No, I’ve got this,” “Don’t worry about it,”
and “If I need anything I will call you.”199 The senior toolpusher did not return to the floor
before the explosion.200 In fact, leading up to the blowout, neither the OIM, senior toolpusher
nor the master were actively supervising the performance of the negative test or the displacement
of the mud from the drilling riser with sea water.201 During this investigation’s hearings, the
senior toolpusher acknowledged that the tour took him away from the Drill Floor: when asked
“if the tour wasn’t going on, if there wasn’t visitors, would you have stayed [on the Drill Floor],”
he said, “Yes, sir. And I wouldn’t be here talking to you.”202 Thus, had the BP and Transocean
executives not been on board DEEPWATER HORIZON that evening, the OIM and the senior
toolpusher would likely have been more aware of the existing well conditions. In turn, once the
blowout occurred, there is a greater likelihood that they would have been engaged sufficiently to
implement the emergency procedures outlined in the operations manual.

B. Evacuation
On DEEPWATER HORIZON, the means of escape, also known as evacuation routes, were
arranged to comply with Section 9.3 of the 1989 International Maritime Organization (IMO)
MODU Code. The means of escape on DEEPWATER HORIZON consisted of two separate
evacuation routes from all occupied areas, situated as far apart as practicable, that provided
access to the Open Deck and Lifeboat Embarkation Stations.

The Accommodations and Service Areas were located on the forward sections of the Second and
Third Decks. The Second Deck had quarters for 55 persons distributed among nine 4-bunk
cabins, nine 2-bunk cabins and one 1-bunk cabin. The Third Deck had quarters for 91 crew
members, arranged in 43 2-bunk cabins and five 1-bunk cabins.203
The evacuation route from the Third Deck up to the Embarkation Area on the Second Deck went
up a central stairway located amidships at Frame 25U, or up either of two spiral stairways, one
each on the port and starboard at the end of the athwartship (from side to side; crosswise)
corridor. The spiral stairways discharged on the Second Deck adjacent to the Transit Room on
the port side, and the Transformer Room on the starboard side. An additional exterior stairway
up from the Third Deck was located forward of the Accommodations Area.204

198 Testimony 5/28/2010 pp 305-306.
199 Ibid.
200 Ibid.
201 Testimony 5/28/2010 pp 305-307; Statement 4/21/2010; Statement 4/21/2010.
202 Testimony 5/28/2010 pp 305-306.
203 Second and Third Deck, ABSDWH000609-610.
204 Third Deck, ABSDWH000610.



52



Escape from the Second Deck to the forward Life Boat Embarkation Stations was possible
through three doors, located on the centerline corridor, in the Transit Room and the Transformer
Room.205

From the CCR on the Main Deck, the evacuation route ran down a stairway located on the
starboard aft side of the space to the Second Deck. An exterior door from the CCR to an exterior
walkway with stairs down to the Second Deck was also available.206

There were four designated primary Muster Stations, two near the forward Lifeboat Embarkation
Stations on the bow and two near the aft Lifeboat Embarkation Stations on the stern. Secondary
Muster Stations, also known as Temporary Refuge Areas, were located on the Second Deck
inside the Accommodations Area in the mess room and the cinema room.207 In the event that the
forward Muster Stations were inaccessible, the crew could travel up to the Main Deck via
internal stairways and use exterior walkways and exterior stairs to go down to the aft Muster
Stations and lifeboats on the Second Deck.208

These means of escape on DEEPWATER HORIZON allowed the crew to readily evacuate to the
forward Muster Stations. Survivors reported no queuing problems or other chokepoint issues,
other than having to travel through debris from collapsed bulkheads and fallen ceiling panels
caused by the explosion.209 Some reported that in some areas of the Accommodations, the
automatic sprinklers were discharging, thus causing a slowdown in travel time.210 Many of the
survivors reported having difficulty traveling across open deck areas because the drilling mud
and other fluids made the deck very slippery.211

C. Protecting Embarkation Stations from Heat
As discussed above, several personnel recounted that the heat from the fire was so intense that
they were concerned they would not survive when launching the liferaft. Paragraph 9.3.5 of the
1989 IMO MODU Code specifies that:

“9.3.5 Consideration should be given by the Administration to the siting of superstructures

and deckhouses such that in the event of fire at the Drill Floor at least one escape route to

the embarkation position and survival craft is protected against radiation effects of that fire

as far as practicable.”

This general requirement can be met by situating the Embarkation Stations behind deckhouses;
however, there is no assurance that the intervening structure will adequately block the expected
radiant heat from a Drill Floor or a Moon Pool fire.


205 Second Deck, ABSDWH000609.
206 CCR, ABSDWH000608.
207 Second Deck, ABSDWH000609.
208 Main Deck, ABSDWH000608.
209 Testimony 5/27/2010 p 53; Testimony 5/28/2010 pp 228-232.
210 Testimony 5/28/2010 pp 260-264.
211 Statement 4/26/2010.



53



Figure 6 - Means of Escape Forward

D. Ladders from the Embarkation Deck to the Water
The master, on-watch SDPO and on-watch motorman evacuated the MODU by jumping from
the embarkation deck to the water.212 The 1989 IMO MODU Code specifies two standards for
the arrangement of embarkation decks:

“10.3.7 At least two widely separated fixed metal ladders or stairways should be provided
extending from the deck to the surface of the water. The fixed metal ladders or stairways and
sea areas in their vicinity should be adequately illuminated by emergency lighting.”

“10.3.8 If fixed ladders cannot be installed, alternative means of escape with the sufficient
capacity to permit all persons onboard to descend safely to the waterline should be provided.

The DEEPWATER HORIZON was fitted with fixed vertical ladders at the Embarkation Decks
that extended from the embarkation deck to the waterline.213 However, the on-watch SDPO
knew the bottom 15 to 20 feet of the ladders were severely damaged, so that even if he used one,
he would still have had to jump.214


The damaged condition of the fixed vertical ladders, also called emergency column escape
ladders, was noted during the BP Marine Audit in September 2009 and was assigned to be
repaired within six months.215 Those repairs were not completed. The MODU Spec Rig

212 Testimony 5/27/2010 p 210; Testimony 10/5/2010 pp 172-173.
213 DEEPWATER HORIZON outboard profile drawing using the drilling draft, ABSDWH000074.
214 Testimony, 10/5/2010, pp 172-173.
215 BP Marine Audit Report, CMID Annex, BP-HZN-MBI00170578 and BP-HZN-MBI00170608.



54



Condition Assessment completed just six days before the accident cited each of the ladders on
the lower part of all four columns as needing replacement.216

E. Emergency Lighting at Embarkation Stations
During the casualty, the only lighting for the escape routes was provided by the transitional
power system. The normal power system failed and was not restored.217 If all normal power
was lost, the 400kW standby generator was designed to automatically start in order to maintain
lighting and other standby power.218 In this incident, the standby generator did not automatically
start and could not be manually started despite attempts by the crew.219

The DEEPWATER HORIZON operations manual states that if normal and standby power were to
fail, lighting could still be provided at essential locations by 1.5 hour rated battery back-up
systems built into selected lights wired to the standby system.220 Many of the survivors reported
difficulty finding their way out of the Accommodations and Galley Areas due to darkness.221 It
is not clear if there was an inadequate level of battery lighting, if the battery lighting units had
been damaged by the explosion, or if they were inoperable because they had not been properly
maintained. Once the personnel arrived at the Embarkation Stations, there was no emergency
lighting to illuminate those areas.

The 1989 IMO MODU Code requires that Muster and Embarkation Stations as well as
alleyways, stairways and exits giving access to the Muster and Embarkation Stations should be
adequately illuminated by emergency lighting, but does not require emergency lighting for the
areas where the lifesaving appliances are to be lowered. The International Convention for the
Safety of Life at Sea (SOLAS) regulation III/16.7 requires that, “During preparation and
launching, the survival craft, its launching appliance, and the area of water into which it is to be
launched shall be adequately illuminated by lighting supplied from the emergency source of
electrical power.”

F. Lifeboats
DEEPWATER HORIZON was outfitted with four totally enclosed lifeboats measuring 8.50 x

2.89 x 1.25 m (28 x 9.5 x 4 ft), each with a capacity for 73-occupants. They were of the fire
protected type, equipped with a self-contained air supply and a water spray system. Each
lifeboat was served by davits and winches. Lifeboats were suitable for launching from the
Second Deck 38 m (126 ft) above the keel, down to any draft from the lowest transit draft to the
normal 23 m (76 ft) operating draft.222
The lifeboats were approved to SOLAS requirements and manufactured by Fassmer Schiffs
Service GmbH & Co.KG. Lifeboats # 1 and # 2 were located on the Second Deck amidships on

216 MODU Spec Rig Condition Assessment Report, TRN-USCG-MMS-00038618.
217 Statement 4/21/2010.
218 DEEPWATER HORIZON Operations Manual March 2001 Chapter 8.5.
219 Statement 4/21/2010.
220 DEEPWATER HORIZON, Operations Manual March 2001 Chapter 8.7.
221 Testimony 5/28/2010 pp 260-264.
222 DEEPWATER HORIZON, Operations Manual March 2001 Chapter 9.68.


55



the bow while Lifeboats # 3 and # 4 were located on the Second Deck amidships on the stern.223
Lifeboat # 2 was outfitted and designated to also serve as a rescue boat and was fully equipped to
meet HSE/ABS/USCG requirements.224

The lifeboat arrangement complied with 1989 IMO MODU Code regulation 10.2.4 and provided
availability of 200% lifeboat capacity for persons on board DEEPWATER HORIZON.

“Each unit should carry lifeboats complying with the requirements of regulations III/46,
installed in at least two widely separated locations on different sides of or ends of the unit.
The arrangement of the lifeboats should provide sufficient capacity to accommodate the total
number of person’s on board if: 1) all lifeboats in any one location are lost or rendered
unusable; or 2) all the lifeboats on any one side, any one end, or any one corner of the unit
are lost or rendered unusable.”

In the case of this casualty, the redundant arrangement and placement of lifeboats was sufficient
to provide alternate means for evacuation. 101 crew members safely evacuated DEEPWATER
HORIZON by using Lifeboats # 1 and # 2. The chief electronics technician considered using
Lifeboats # 3 or # 4 for evacuation as he escaped the Engine Control Room.225 The final eleven
persons to evacuate DEEPWATER HORIZON also considered Lifeboats #3 and #4 but because
safe transit to the aft deck could not be assured, they chose to use one of the liferafts.226 If the
explosions had damaged forward Lifeboats # 1 and # 2 instead of aft lifeboats # 3 and # 4, a dual
purpose lifeboat/rescue boat would not have been available, except for the rescue craft provided
by the DAMON B. BANKSTON. This incident illustrates that MODUs equipped with a single
rescue boat are vulnerable to the loss of the rescue boat in an explosion and fire scenario.
Further, if the rescue boat is a dual purpose lifeboat/rescue boat, the aggregate capacity of the
onboard lifesaving appliances may be impacted.

1. Lifeboat Design
The IMO standard for the design and capacities of lifeboats directly impacted the evacuation of
injured personnel on DEEPWATER HORIZON by not sufficiently providing suitable
arrangements for the timely loading or adequate placement of an occupied stretcher. The
International Lifesaving Appliance (LSA) Code section 4.4.3.4 requires an arrangement so that
helpless people can be brought on board either from the sea or by stretcher; however, the
preapproval testing recommendations only call for a demonstration to show that it is possible to
bring helpless people on board the lifeboat from the sea.


223 Lifesaving Appliance locations, ABSDWH000609.
224 DEEPWATER HORIZON, Operations Manual March 2001 Chapter 9.68; Lifesaving Appliance locations,
ABSDWH000609.
225 Testimony 7/23/2010 pp 17-22.
226 Ibid.


56



Figure 7 – Lifeboat # 2 Manufacturer Data Label

Due to the nature of his injuries, the Transocean operations manager-assets was carried on a
stretcher from the Accommodation Spaces to the Lifeboat Embarkation Deck. Upon arrival,
crew members assisted him into the lifeboat. By his account, “The crew helping me to get me in
the lifeboat had trouble getting the stretcher on which I was lying into the lifeboat. I requested
that they remove me from the stretcher and place me in the lifeboat to avoid any delay in the
evacuation.”227

The lifeboat design was not conducive to receiving an injured crew member on a stretcher. As
illustrated in Figure 8, when loading a stretcher via a side loading door, crew members must
maneuver it past the threshold. As shown in Figures 9 and 10, once loaded, the positioning of a
stretcher in the lifeboat significantly impedes egress and reduces seating capacity by eight to ten
occupants. Neither arrangement provides a means to secure a stretcher from shifting during
operation of the lifeboat.

The lifeboat design may also be inadequate to meet the needs of offshore drilling workers. It is
generally recognized that the average offshore worker weighs closer to 95 kg (210 pounds) rather
than the present standard of 82.5 kg (180 pounds).228 Thus, an approved lifeboat intended for the
carriage of offshore workers could have insufficient overall seat width to permit the maximum
number of persons the life boat was designed for to board. This also could result in the
suboptimal placement and function of the chest strap and waist belt restraints.


227 Statement 4/27/2010.
228 IMO Resolution.MSC 272(85), which entered into force on 7/1/2010.


57



Figure 8 - Typical Stretcher Loading


Figure 9 - Stretcher on the Seat Figure 10 - Stretcher on the Deck

G. Liferafts
DEEPWATER HORIZON was outfitted with six davit-launched liferafts approved to SOLAS
regulations and manufactured by Viking Life Saving Equipment A/S. The liferafts were self
inflating and came complete with a cover and survival gear from the manufacturer. The liferafts
were stored inside sealed containers mounted on-deck. Each liferaft was intended to be launched
by connecting the liferaft to the cable provided on the approved launching appliance and lowered
into the water. Although not recommended, the liferafts could also be deployed by rolling to the
edge of the deck and dropped into the water or by floating free of the MODU once submerged.

The liferaft arrangement complied with 1989 IMO MODU Code Section 10.2.5.

“In addition [to the lifeboats], each unit should carry liferafts complying with the
requirements of regulations III/39 or III/40, of such aggregate capacity as will accommodate
the total number of persons on board.”

58



The davit-launched liferafts were launched by a Schat-Harding SRR 360 liferaft launching
appliance. Figure 11 illustrates a typical liferaft deployed by a launching appliance. Such an
arrangement is only required by the 1989 IMO MODU Code, Section 10.2.6 for the type of
MODUs known as “self-elevating units” (aka Jack-up Units), where due to their size or
configuration they cannot carry widely separated lifeboats in accordance with Section 10.2.4.
Because DEEPWATER HORIZON was not a self-elevating unit, and its lifeboat arrangement
complied with requisite standard in Section 10.2.4, the installation of davit-launched liferafts was
in excess of the minimum survival craft requirements in the MODU Code.


Figure 11- Typical Liferaft – Deployed

There were two Liferaft Stations on DEEPWATER HORIZON, located on the Second Deck
amidships on the bow and on the stern, each comprised of a launching appliance and three
liferafts.229 Both stations were suitable for launching from the Second Deck, 38 m (126 ft) above
the keel, down to the normal operating draft of 23 m (76 ft).

The liferafts on DEEPWATER HORIZON were not designed or required to provide self-
contained air support to protect the occupants from harmful air pollutants, occupant restraints
(seat belts), means of self-propulsion, or a water spray system to protect occupants from heat and
fire.230

During the use of the liferaft on DEEPWATER HORIZON, occupants were subjected to extreme
environmental conditions. The entry of smoke into the canopy reduced the chief mate’s
visibility resulting in panic and deployment of the liferaft before it had been fully loaded.231 The
heat and flames emitted from the deck and from under the davit-launched liferaft caused the
chief electronics technician to leave the Liferaft Embarkation Deck.232 This experience showed
that the actual use of a liferaft served by a launching appliance on a column stabilized MODU,
during an uncontrolled well event, is particularly hazardous.


229 Lifesaving Appliance locations, ABSDWH000530.
230 SOLAS 73, Regulation III 39 or 40.
231 Testimony 5/27/2010 pp 268-269.
232 Testimony 7/23/2010 p 23.


59



H. Launching of Lifesaving Appliances
1. Lifeboats
The 1989 IMO MODU Code standards, Chapter 14, Operating Requirements provide adequate
guidance for the practice of musters and drills. The following regulations greatly enhanced
DEEPWATER HORIZON’s crew's emergency preparedness for abandonment of a MODU.

14.11.2.5 Lowering of at least one lifeboat as far as reasonably practicable, after any
necessary preparation for launch;
14.11.2.6 Starting and operating the lifeboat engine; and
14.11.5 Each lifeboat should, as far as reasonably practicable, be launched with its
assigned operating crew aboard and maneuvered in the water at least once every three (3)
months.
A review of the lifeboats’ records revealed that servicing, inspection and crew drills all were
carried out, including changing lifeboat falls,233 testing releasing gear,234 conducting weight tests
on davits, and launching the lifeboats in the water.235

Consistent with previous drills, DEEPWATER HORIZON evacuated personnel donned
lifejackets after being alerted of the emergency. In addition, previous practice lowering, starting
and operating the lifeboats proved critical as both boats were safely launched from
DEEPWATER HORIZON without serious incident.

2. Liferafts
As a result of the crew’s efforts to quickly launch the liferaft with a line still attached to the
MODU, all of the occupants were tossed about and one fell out of the liferaft upon its impact
with the water.236 DEEPWATER HORIZON’s Manual for Lifesaving Appliances outlines
detailed operating instructions from Schat-Harding, the manufacturer of the liferaft launching
appliance (davit), and requires the officers-in-charge of emergency procedures to further read the
liferaft manufacturer’s (VIKING) operating instructions. Notably, the two sets of instructions
differ in the sequence of actions to be performed by the officer-in-charge. The davit
manufacturer requires adjusting the attitude of the davit first while the liferaft manufacturer
requires the attaching of the liferaft first.237 Only the VIKING instructions, typically posted at
the operating station, remind crew members to disconnect the painter line.238

233

Lifeboat “falls” are wire rope(s) that raise or lower the boat into position by means of an electric motor or winch.
234 The servicing agent conducted the off load test of the releasing gear, but was unable to perform the on load test
due to weather conditions. The test was rescheduled for May 2010, TRN-USCG_MMS-00038496.

235

See Appendix H, p H-5 generally.

236

5/27/2010 pp269-270.
236 Testimony 10/5/2010 p 15.
237 Schat Harding launching procedures, TRN-USCG_MMS-00026915; VIKING launching procedures, TRNUSCG_
MMS-00026838.
238 TRN-USCG_MMS-00026838.

60



The 1989 IMO MODU Code, Section 14.11.2.7 and Coast Guard regulations, Title 46 Code of
Federal Regulations (CFR) § 109.213(d)(1)(vii), require that the davits used to launch liferafts be
operated during each weekly abandon unit drill. Testimony and drill records show that the davits
were operated at each drill. However, this requirement only tests the operation of the davit and
does not exercise the crew’s readiness to use the davit and liferaft together. This training
disparity is further exacerbated by removal of Section 14.11.2.7 from the 2009 IMO MODU
Code.

Moreover, the 1989 IMO MODU Code, Section 14.12.3 and 46 CFR § 109.213(g)(5), both
require on board training in the use of davit-launched liferafts at intervals of not more than four
months and prescribes that “when practicable,” the drill must include inflation and lowering of
the liferaft. The regulation’s inclusion of the condition “when practicable,” however, allows the
operator of a MODU to forego this critical training. As a result, it reduces the officer-in-charge’s
valuable training and experience in the actual preparation, boarding and launching of liferafts
served by davit launching appliances. No testimony or records were provided indicating whether
the crew had ever activated a liferaft during an abandonment drill on board DEEPWATER
HORIZON.

I. Search and Rescue
Please see Appendix G, Final Action Report On the SAR Case Study Into the Mass Rescue of
Personnel off the Mobile Offshore Drilling Unit DEEPWATER HORIZON. The Joint
Investigation Team concurs with the analysis in the report.

III. Actions/Decisions Contributing to System Failures
A. The Bridge crew did not follow standard procedure for providing notification of the
emergency.
The Bridge Crew of DEEPWATER HORIZON was likely overwhelmed by the multiple audible
and visual alarms immediately before and after the series of explosions and ensuing fire.239

The standard procedure for alerting the crew to flammable gas emergencies required the on-
watch DPO to manually activate the general alarm (GA) system after two or more gas detectors
were activated.240 In this case, multiple gas alarms had been activated and acknowledged, but
the GA was not sounded until the explosions occurred. When asked why the GA was not
immediately sounded after the first alarms were received, the on-watch DPO stated, “It was a lot
to take in. There was a lot going on.”241

239 Testimony 10/5/2010 pp 40, 47, 65.
240 Ibid., p 54.
241 Ibid., p 65.


61



B. The crew did not conduct a complete muster (headcount) to account for all personnel
prior to evacuation.
During the evacuation, there was confusion that resulted in an inability to achieve a full
accounting of personnel before departing DEEPWATER HORIZON. The first complete muster
of the one 115 persons evacuated was not completed until more than an hour later, after all of the
surviving crew members had boarded DAMON B. BANKSTON.242

This result could be attributed in part to the fact that the personnel on DEEPWATER HORIZON
who should have the most knowledge about coordinating a mass evacuation were its merchant
marine officers listed in Table 3. Of those officers, at least two of the four senior merchant
marine officers did not participate in the muster or the launching of either lifeboat, as they were
fulfilling other duties and responsibilities as outlined in DEEPWATER HORIZON Station Bill
“Fire & Emergency Stations.”243

Table 3 -DEEPWATER HORIZON Station Bill: “Abandon Unit Stations”

Life Boat 1
Position Assigned
In Charge Master
2nd In Charge DPO (off-watch)
3rd In Charge Chief Mechanic (off-watch)
Prepare Liferaft A/B Seamen
Take Muster Assistant Driller (off-watch)
Life Boat 2
Position Assigned
In Charge Chief Mate
2nd In Charge SDPO (off-watch)
3rd In Charge Boatswain-
Prepare Liferaft A/B Seamen
Take Muster Assistant Driller (off-watch)
Further, despite providing formal and shipboard training, Transocean’s training scenarios did not
prepare the merchant marine officers and industrial drilling crew to function as a team under
foreseeable hazards such as a well blowout, which was identified in DEEPWATER HORIZON
Major Hazards Risk Assessment.244 According to the records of drills, the marine crew and the
drill crew performed all required drills within their respective occupations, but the entire crew
did not collectively participate in the fire and abandonment drills because of drilling
operations.245 95% of the time, the drill crew would take their muster and emergency
preparations on the Drill Floor.246 Third party contractors were excused from the drills.247 The

242 BANKSTON Log; USCG Final Action Report on the SAR Case Study into the Mass Rescue of Personnel off the
Mobile Offshore Drilling Unit DEEPWATER HORIZON (Appendix G).
243 Statement 4/21/2010; Statement 4/21/2010; Statement 4/26/2010; Statement
4/21/2010. The chief mate was in charge of the fire team and the master was one of the last crew members to leave
the CCR.
244 DEEPWATER HORIZON Major Hazards Risk Assessment, 8/29/2004.
245 Testimony 10/5/2010 pp 200-201.
246 Ibid.
247 Ibid.


62



on-watch SDPO testified that to his knowledge, “Well control drills and [rig] abandonment drills
were never performed in combination.”248

The 1989 IMO MODU Code, Chapter 14, Operating Requirements, provided adequate guidance
for the practice of musters and drills every week. However, several standards were removed
from the 2009 IMO MODU Code:

14.11.2.1 Summoning of all on board to muster stations with the general emergency signal
and ensuring that they are aware the order to abandon the unit will be given;
14.11.2.2 Reporting to stations and preparing for the duties described in the muster list;
14.11.2.3 Checking that every person is suitably dressed; and
14.11.2.4 Checking that lifejackets and immersion suits are correctly donned.
Reinstating these prescriptive standards and the diligent performance of the Recommendations
on Training of Personnel on MODUs (Resolution A.891 (21)) recently adopted in the 2009
MODU Code would enhance the emergency preparedness of offshore personnel.

C. By summoning the fast response craft of the DAMON B. BANKSTON to recover
persons in the water, DEEPWATER HORIZON did not have to use Lifeboat #2 as a
rescue boat.
As allowed by the 1989 IMO MODU Code, Section 10.7, the Republic of the Marshall Islands
(RMI) designated Lifeboat # 2 as DEEPWATER HORIZON’s rescue boat thereby establishing it
as a dual-purpose lifesaving appliance. In practice, the rescue boat was intended to recover
persons from the water and assist in the marshalling (gathering) of other lifeboats or liferafts
once away from DEEPWATER HORIZON. In this case, Lifeboat #2 did not perform this
intended function due in part to the availability of the FRC on board DAMON B. BANKSTON.

According to the on-watch SDPO, the CCR was aware that crew members were jumping
overboard, but due to the bigger issue at hand [evacuation], no attempt was made to provide
DEEPWATER HORIZON’s rescue boat to recover them from the water.249 The on-watch SDPO
explained that using the rescue boat would have taken it out of commission as a lifeboat.250
Therefore, he summoned the assistance of DAMON B. BANKSTON and used its FRC to perform
the function.251 This quick decision allowed the dual-purpose lifeboat to serve its primary
function. Once the FRC was deployed, the on-watch compliance specialist and two others were
rescued before either of the lifeboats was launched from DEEPWATER HORIZON.252


248 Ibid.
249 Ibid., p 171.
250 Ibid., p 171.
251 Ibid., p 171.
252 Testimony 5/28/2010 pp 223-224.


63



D. The crew deploying the liferaft failed to efficiently operate the MODU’s liferaft
launching appliance and liferaft components.
As a result of the crew’s competing demands, such as responding to their “Fire and Emergency
Stations” or assisting injured personnel, eleven persons were unable to evacuate DEEPWATER
HORIZON in their predetermined lifeboats. Those personnel included the master, chief mate,
chief engineer, on-watch SDPO, on-watch DPO, chief electronics technician, off-watch
toolpusher, senior toolpusher, on-watch motorman, electrical/electronics supervisor and chief
electrician.

After struggling to prepare the liferaft launching appliance and inflating the liferaft, the
remaining personnel did not ensure the liferaft’s painter was freed from the MODU.253 By not
disconnecting the painter, the crew’s ability to quickly and safely descend from DEEPWATER
HORIZON was greatly impacted. The IMO Lifesaving Appliances Code requires liferaft painter
length to be not less than 10m (33 feet) plus the distance from the stowed position to the
waterline in the lightest seagoing condition, or 15 m (50 feet), whichever is greater.254 In this
case, it appears that the painter became tangled during launching, as the raft was ultimately able
to descend to the water, and then had to be cut to release the liferaft.

Occupants evacuating in the tethered liferaft adhered to a BP “Knife-Free” policy.255 However, a
knife was provided in the liferaft equipment and was later found when the raft was alongside
DAMON B. BANKSTON. Training and familiarity with the liferaft equipment, including the
location of such equipment, would have greatly assisted the occupants in quickly freeing
themselves once waterborne.

The International Convention on Standards of Training and Certification and Watchkeeping for
Seafarers (STCW) outline the minimum standards of competencies an officer must obtain before
receiving certification. Chapter VI prescribes mandatory minimum requirements for issuance of
certificates of proficiency in the use of survival craft, rescue boats, and fast rescue boats.

The standards of competencies included in the STCW Code A, Section VI/2-1, for an officer-incharge
include:

. Taking charge of a survival craft or rescue boat during and after launching;
. Operating a survival craft engine;
. Managing survivors and survival craft after abandoning ship;
. Using locating devices, including communication and signaling apparatus and
pyrotechnics; and
. Applying first aid to survivors.
253 Testimony 5/27/2010 pp 269-270.
254 IMO International Lifesaving Appliances Code, 2003, Section 4.1.3.2.
255 Statement 4/21/2010.


64



These recommendations, however, provide no practical training requirements for the
identification and use of the different types of liferaft launching appliances that may be on board
MODUs. Had the STCW provided DEEPWATER HORIZON crew members with practice with
various types of lifesaving appliances in realistic training conditions, much like it provides for
training in the use of portable fire extinguishers in STCW Code B, Section B-VI/1, the officer-
in-charge would have been better prepared to operate the launching appliance and liferaft more
efficiently.

E. Search and Rescue
Please see Appendix G, Final Action Report On the SAR Case Study Into the Mass Rescue of
Personnel off the Mobile Offshore Drilling Unit DEEPWATER HORIZON. The Joint
Investigation Team concurs with the analysis in the report.

IV. U.S. Government / Class / Flag Oversight
A. Standards of Training, Certification & Watchkeeping
The RMI established the crew complement for DEEPWATER HORIZON and issued a Minimum
Safe Manning Certificate (MSMC) identifying the required capacities such as master, OIM, chief
engineer, oiler, and the other positions on the MODU. The RMI confirmed DEEPWATER
HORIZON met its Manning Schedule for a dynamically positioned vessel (DPV) MODU at the
time of the casualty. According to that schedule, the minimum crew required to operate and
respond to emergencies on board DEEPWATER HORIZON was fourteen persons.256

However, the DEEPWATER HORIZON Station Bill require more than thirty additional
emergency positions including fire team leaders, person in charge of muster, and personnel to
clear accommodations, to be filled by industrial and catering crews, none of whom are subject to
the STCW.

The purpose of the STCW is to establish a minimum global standard of knowledge,
understanding, experience and professional competencies of seafarers. The IMO established
competencies that must be obtained and demonstrated before a seafarer becomes a certified
person. For example, the master must achieve competencies listed in STCW II/2 to receive
certification. Likewise, a chief engineer must achieve competencies listed in STCW III/2. There
are no STCW professional competency standards established by the IMO for the drilling crew
(e.g., OIM, toolpusher, driller).

STCW competencies do not include consideration of vessel types or services. For example, a
master certified to STCW Section II/2 is certified on any ship of 500 gross tons or more.
However, the 1994 amendments to STCW, which entered into force on January 1, 1996,
recognized that there are special training requirements for personnel on tankers. Likewise, the
1997 amendments to STCW, which entered into force on January 1, 1999, included special
training requirements for personnel assigned to passenger and “roll on, roll off” passenger ships.

256 Republic of the Marshall Islands, Marine Notice No. 7-038-2.

65



However, personnel assigned to MODUs are not required to undergo additional specialized
training in order to receive STCW certification.257

Had STCW special training requirements for all MODUs been the standard, the certified
personnel on DEEPWATER HORIZON would have been required to acquire additional
knowledge and an appreciation of the interrelationships of the industrial services and marine
operations unique to MODU operations. These competencies may have assisted such personnel
in better recognition of hazards and performance of crowd management techniques during the
mass evacuation of DEEPWATER HORIZON.

B. Emergency Evacuation Plan (EEP) and Standby Vessels
An EEP is an emergency contingency plan that addresses persons, resources and actions needed
if an evacuation of a MODU or an OCS facility is required and must be submitted by the lease
holder to the Coast Guard for review and approval pursuant to 33 C.F.R § 146.210. Per 33 CFR
§ 146.140, an EEP may apply to more than one facility, if the facilities are located in the same
general geographic location and within the same Coast Guard Officer in Charge, Marine
Inspection (OCMI) zone; if each facility covered by the EEP is specifically identified in the EEP;
and if the evacuation needs of each facility are accommodated. Although the leaseholder of a
MODU is required to prepare an EEP, the owner/operator of the MODU has no such
requirement. Additionally, current regulations do not establish performance and evaluation
criteria, or inclusion of external emergency response resources such as crisis action teams or
Federal agencies.

BP established an EEP for Mississippi Canyon Block 252.258 On March 8, 2007, the EEP for
DEEPWATER HORIZON was approved for use in Mississippi Canyon Block 562.259 However,
the EEP had not been checked by the OCMI Morgan City, since DEEPWATER HORIZON
returned to the OCMI’s zone.260 A copy of the original EEP was not retained, nor was the
approval of the EEP documented in the Coast Guard Maritime Information System for Law
Enforcement (MISLE) database.

A subsequent review of the EEP has revealed that although the EEP did not definitively list the
master of DEEPWATER HORIZON as the Person-in-Charge of the MODU, it met the
requirements of 33 CFR § 146.210.261 The EEP did not specifically designate a standby vessel
for DEEPWATER HORIZON. The purpose of such a vessel is to have an immediate resource

257 International Convention on Standards for Training, Certification and Watchstanding (STCW) for Seafarers,
1978 as amended in 1995 and 1997.
258 BP Emergency Evacuation Plan, Mississippi Canyon Block 252 DEEPWATER HORIZON (Jan. 2010).
259 Officer-in-Charge, Marine Inspection, 16711/Horizon, Serial EEP-07036, March 8, 2007.
260 Coast Guard Eight District Marine Safety Division, 16711/EEP Approval, 15 September 2003 encouraged each
Officers in Charge, Marine Inspection (OCMI) to exercise their authority under 33 CFR 140.15(a) and permit
alternative procedures to those specified in 33 CFR Subpart N, for the submission and approval of EEPs under 33
CFR 146.140 and 146.210, provided that the MODU was previously operating with the same OCMI Zone, changes
were minor and the plan was prepared by entities which have proven their competency in preparing EEPs. Revised
EEPs would be checked in the normal course of inspection. Initial review and approval requirements for newly
installed manned Outer Continental Shelf (OCS) facilities remained.
261 BP Emergency Evacuation Plan, Mississippi Canyon Block 252 DEEPWATER HORIZON (Jan. 2010), App. D.


66



available in the case of evacuation that can provide additional lifesaving capabilities. Although
there is no regulatory requirement that a MODU have a designated standby vessel, 33 CFR § 143
establishes the requisite operating capabilities of a standby vessel if one is designated in an EEP.

The EEP for DEEPWATER HORIZON, Appendix D, Evacuation Craft Details, listed four motor
vessels, including DAMON B. BANKSTON, as “evacuation craft.” None of the vessels were
“specifically designated” as a standby vessel, nor was DAMON B. BANKSTON’s Certificate of
Inspection endorsed for standby service.262 Nevertheless, during the casualty, DAMON B.
BANKSTON performed the services and duties of a standby vessel, and there is no doubt that
DAMON B. BANKSTON’s proximity to DEEPWATER HORIZON, its construction and
equipment standards, and its crew’s actions that night saved lives.


Figure 12 -DAMON B. BANKSTON

C. Fast Rescue Craft
At least 15 of the 115 personnel who evacuated DEEPWATER HORIZON were assisted by the
FRC deployed from DAMON B. BANKSTON. A benefactor of its capabilities testified, “Every
rig that’s designed needs a fast rescue craft…if the boat wouldn’t have had a fast rescue craft,
there may have been ten more lives that was lost.”263

DEEPWATER HORIZON was not outfitted or required to be outfitted with a FRC as identified in
SOLAS 74. The IMO noted in Resolution A.656 (16), adopted on 19 October 1989, the “current
extensive use of Fast Rescue Boats, in particular in offshore activities for rescue purposes.” In
addition, the IMO was of the opinion, “…that Fast Rescue Boats are of value in certain
circumstances for the rescue, in particular, of persons involved in offshore activities.” Despite
these positive endorsements, there remains no requirement for MODUs on the U. S. Outer
Continental Shelf to have a FRC.


262 Ibid.
263 Testimony 5/27/2010 pp 337-338.

67



As shown in Table 4, a comparison of vessels subject to SOLAS 74 highlighted that only roll-on
roll-off (RO-RO) Passenger Vessels were required to be fitted with a FRC.264

Table 4 - Fast Rescue Craft (FRC) Requirements

Vessel Type Regulation/No. requiring an FRC
MODU N/A
Passenger Vessel N/A
RO-RO Passenger Vessel SOLAS, III, 26.3/At least one rescue
boat must be a Fast Rescue Boat
Cargo Vessels N/A

DEEPWATER HORIZON and other MODUs like it typically operate for extended periods of
time using dynamic positioning technology to maintain a watch circle while latched-up to the
well head. Because of the operating conditions, MODUs are unable to maneuver to recover a
person who has fallen overboard. Furthermore, DEEPWATER HORIZON’s hull design (column-
stabilized) does not complement the rapid recovery of the rescue boat as the vessel’s hull does
not extend down to the water’s edge, similar to a traditional ship, to provide the rescue boat with
stability or a lee from wind and waves.265

The master of DEEPWATER HORIZON testified that additional precautions must be taken when
launching a lifeboat on a semi-submersible, “You need extremely calm weather to launch a
lifeboat because you don’t have a ship’s hull to turn to make a [lee] for it to come alongside. So
you’re trying to hit two swinging pennants with a lifeboat. It’s not safe, and it’s not worth
putting the crew at risk.”266

These conditions could be mitigated with the installation of an FRC. The FRC’s launching
appliance standards267 are intended to allow its recovery in Sea State 6, with 3 m (10 ft) waves.
This is particularly beneficial for MODUs that cannot maneuver to create a lee for recovery. In
addition, the FRC would eliminate the dual purpose lifeboat/rescue boat condition discussed
before and allow them to be used for their primary function, evacuation.

D. Man Overboard Drills
Neither the IMO MODU Code nor Coast Guard regulations provide for a man overboard drill on
MODUs. However, DEEPWATER HORIZON Operations Manual Section 9.8 does require the
drill “on a regular basis.” In addition, Transocean’s Training Manual for Lifesaving Appliances
and Station Bill provides specific guidance concerning how to complete the man overboard drill.


264 SOLAS 74 was amended as a result of the capsizing of RO-RO passenger ship ESTONIA in September 1994.

Windward is the direction upwind from the point of reference. Leeward is the direction downwind from the
point of reference. The side of the ship towards the leeward is the lee side. Masters of ships will create a “lee”
(windward shelter) when conducting small boat recovery operations.
266 Testimony 5/27/ 2010 p 181.
267 IMO Resolution MSC 81(70) Section 8.1.8.

68



Although DAMON B. BANKSTON was summoned to provide assistance, DEEPWATER
HORIZON did not execute the duties and responsibilities for a man overboard situation as
required by its Station Bill. For example, DEEPWATER HORIZON’s ship’s whistle was not
sounded and no instructions/orders were provided to post observers to monitor the persons in the
water. Had a regulatory or Code requirement to perform man overboard drills been established,
the MODU’s crew may have been better prepared to respond to a man overboard.

E. Search and Rescue
Please see Appendix G, Final Action Report On the SAR Case Study Into the Mass Rescue of
Personnel off the Mobile Offshore Drilling Unit DEEPWATER HORIZON. The Joint
Investigation Team concurs with the analysis in the report.

V. Conclusions
A. The presence of the visiting BP and Transocean executives in the Central Control
Room/Bridge of DEEPWATER HORIZON immediately prior to the casualty may have
diverted the attention of the offshore installation manager and senior toolpusher from the
developing well conditions, limited their interactions with the on-watch drilling crew, and led
to their failure to follow the emergency evacuation procedures.
B. The boundaries established at the bow Liferaft Embarkation Station were inadequate to
shield evacuating personnel from exposure to radiant heat emanating from under
DEEPWATER HORIZON’s column stabilized hull.
C. Once there was a loss of electrical power, the emergency lighting available in the
accommodations, the muster areas, and especially the lifeboat and liferaft lowering stations
was inadequate, and there was no lighting over the water into which the lifeboats/liferafts
were to be launched, making safe evacuation of personnel and launching of the
lifeboats/liferafts more hazardous.
D. The current lifeboat design and testing requirements do not adequately ensure the safe
loading of a stretcher or permit adequate seating to accommodate the physical build of the
average offshore worker today.
E. The International Convention on Standards for Training, Certification and Watchstanding
(STCW) does not currently identify a MODU as a “Special Ship,” for which marine
personnel would be required to undergo specialized training prior to certification. Masters,
officers, particular ratings and special personnel assigned to MODUs are not required to
receive specialized training for crowd control, crisis management or human behavior. Such
training could have helped minimize the chaos and confusion surrounding the muster and
evacuation of DEEPWATER HORIZON.
F. The International Maritime Organization (IMO) MODU Code and U.S. Coast Guard
subjective language that liferaft launch drills should be conducted “when practicable”
69



minimized the officer-in-charge’s opportunities to obtain training experiences in the actual
preparation, boarding and launching of liferafts served by davit launching appliances.

G. Transocean’s failure to include on board training in the use of davit-launched liferafts,
including the proper inflation and lowering of the liferafts at intervals of not more than four
months as prescribed by regulations, significantly reduced the crew’s competency in
performing these functions in an emergency.
H. Conducting weekly fire and abandonment drills at fixed times and on predetermined days did
not adequately prepare the crew to respond to the casualty “as if the drill was an actual
emergency.” The crew would have been better prepared if emergency drills were staggered
at different times of the day, on different days and during varying environmental conditions.
I. The failure to integrate weekly well control and evacuation drills limited the crew’s ability to
demonstrate knowledge and understanding of their duties and responsibilities as outlined in
DEEPWATER HORIZON’s operations manual and the emergency response manual.
J. The IMO has removed some previous standards concerning the performance of crew musters
and drills from the 2009 IMO MODU Code, such as demonstrating the ability to timely
muster all crew members and having them prepared to carry out their assigned duties, and
replaced them with recommendations. The implementation of the reduced standards will
likely lead to additional confusion during actual casualties.
K. The STCW does not adequately establish standards and competencies for officers-in-charge
of emergency procedures to operate lifesaving appliances that serve liferafts.
L. The inflatable liferafts on DEEPWATER HORIZON served by launching appliances did not
provide adequate protection for occupants under the circumstances. The exposure to extreme
heat due to the proximity of the fire to the launching area, combined with the lack of a water
spray system, placed them at greater risk during the evacuation.
M. The storage location of the knife in DEEPWATER HORIZON’s liferaft was not easily
identifiable to the occupants. Had reflective tape and standard IMO symbols been used, the
occupants likely could have found the knife and freed the raft from the painter line on their
own.
N. The quantity and location of rescue boats provided on MODUs should align with the “widely
separated location” philosophy adopted for lifeboats. The location of a secondary rescue
boat at the alternate lifeboat location would increase the availability of a rescue boat.
O. The proximity and operational capabilities of the offshore supply vessel DAMON B.
BANKSTON were critical to the successful evacuation of the one hundred-fifteen survivors of
this casualty.
P. The fast rescue craft from DAMON B. BANKSTON was extremely effective in ensuring the
safe recovery of crew members from DEEPWATER HORIZON.
70



Q. There currently are no IMO MODU Code standards or Coast Guard regulations to require
quarterly drills for a man overboard on MODUs. Failure to require these drills made
DEEPWATER HORIZON ill-prepared to efficiently recover persons in the water with either
DEEPWATER HORIZON’s designated rescue boat, or other predetermined emergency
response resources.
R. Pursuant to the regulations in Title 33, Code of Federal Regulations (CFR), Subchapter N,
only leaseholders of an area on the U.S. Outer Continental Shelf (OCS), where a MODU will
be operating, are required to develop and submit an Emergency Evacuation Plan (EEP).
Owners/operators of MODUs operating on the OCS need to have a comprehensive
understanding of the applicable EEP in order to ensure the safe evacuation of personnel in an
emergency.
S. Pursuant to the regulations in 33 CFR Subchapter N, there are no established performance
and evaluation criteria for an EEP, nor is there an annual requirement to exercise the EEP.
The combination of only requiring the leaseholder to develop an EEP and not requiring an
on-site demonstration of the MODU’s proficiency in executing the EEP significantly
undermines its value.
T. The Joint Investigation Team concurs with the conclusions that are documented in Appendix
G, Final Action Report On the SAR Case Study Into the Mass Rescue of Personnel off the
Mobile Offshore Drilling Unit DEEPWATER HORIZON.
71



Chapter 4 | FLOODING AND SINKING

This section describes the events on or near the mobile offshore drilling unit (MODU)
DEEPWATER HORIZON relating to its flooding and sinking, from the initial indications of the
emergency situation and explosions onboard the vessel on April 20, 2010 at 2150 hours local
time until the MODU sank on April 22, 2010 at 1026. It provides an overview of actions
impacting the stability and fire-fighting efforts, a description of the systems in place to address
the possible flooding and sinking of DEEPWATER HORIZON, and significant actions and
decisions leading up to the sinking, including decisions regarding the primary focus of response
activities, the failure to issue a salvage plan, and the failure to follow the Vessel Response Plan.

I. Overview
During normal operations prior to the event, the crew took active measures to maintain the
stability of DEEPWATER HORIZON by regularly adjusting weights and ballast to compensate
for any changes in the loading condition onboard. However, after DEEPWATER HORIZON was
evacuated and power was lost, the ability to actively maintain the MODU’s stability was lost.

A. Damage from Explosions and Fire
At the time of the explosions, DEEPWATER HORIZON carried a variety of fixed and liquid
loads. The explosions and fire aboard DEEPWATER HORIZON caused significant damage that
may have resulted in the loss of systems or watertight boundaries needed to keep the MODU in
an upright level condition. While it is not possible to determine the nature or extent of damage
to the underwater hull or internal structures, comparisons of DEEPWATER HORIZON’s attitude
before and during the casualty indicate that the weight of DEEPWATER HORIZON increased, or
buoyancy was lost, and that its center of gravity shifted aft and to starboard.268 Photographs
taken on the morning of April 22 reveal that there was serious deformation of topside structures
just prior to the sinking. Up to this point there were conflicting reports on the extent of damage.
The log from MAX CHOUEST, one of the vessels responding to the scene, indicated that another
vessel, “SEACOR WASHINGTON noticed a breach in Port Fwd Leg” at 1450 on April 21;269
however, Transocean’s on-scene salvage master, responsible for saving the MODU, reported at
0015 on April 22nd that “hull and leg structures appear primarily in-tact.”270 As the fire
progressed, the equipment on deck began to shift, including the derrick which toppled to
starboard.271 Although video footage taken from the ocean floor after the sinking indicated
damage to parts of the hull that were normally below the waterline, it is unclear if this damage
occurred before DEEPWATER HORIZON sank or as a result of sinking in approximately 5000
feet of water.

268 USCG Marine Safety Center Post Sinking Analysis for DEEPWATER HORIZON (Appendix L).
269 MAX CHOUEST Rough Log, 4/21/2010.
270 SMIT Salvage Americas Salvage Daily Progress Report DEEPWATER HORIZON dated 4/22/2010.
271 Ibid.


72



B. Marine Fire-fighting
According to the master of DAMON B. BANKSTON, at approximately 0055 on April 21, four
boats were on scene fighting the fire, with two more on the way. These were all offshore supply
vessels or crew boats fitted with high capacity fire-fighting monitor nozzles that were in the area
servicing other offshore facilities. When asked if anybody was coordinating the fire-fighting he
stated, “Not fully, no.”272 According to the log on DAMON B. BANKSTON, at 0130 on April 21,
DEEPWATER HORIZON “starts to show a list to stbd stern and rotating some with secondary
explosions” and at 0318 “a heavy list stbd-stern.”273 At 0500, the master of DAMON B.
BANKSTON noted in the log “many more vessel[s] on station to[o] many to list.”274 Based on
logs obtained from response vessels, 11 different vessels reported engaging in fire-fighting
efforts during the response. Transocean’s operations manager-performance, who was one of four
people on DEEPWATER HORIZON that remained on scene after the survivors departed, realized
that stability was a concern around 0800 or 0900 on the morning of April 21.275

The attempts to control the fire and cool the structure resulted in application of large volumes of
seawater. As discussed below, it is likely that some portion of that water accumulated inside the
hull. Internal damage to watertight subdivisions, poor maintenance of watertight closures, or
simply having left watertight closures open prior to the evacuation may have allowed the
migration of liquid loads and flooding throughout DEEPWATER HORIZON.

The only information regarding the orientation and drafts of DEEPWATER HORIZON during the
casualty came from SMIT Salvage Americas, Transocean’s contractor engaged to provide
salvage services. The contractor’s salvage logs indicated that DEEPWATER HORIZON was
“listing towards aft stbd @22 degrees w/8’ freeboard” at 0015 on April 22.276 The salvage
master notes indicated no change in this reported condition between 0300 and 0900.277
However, based on a stability analysis conducted by the Coast Guard (Appendix L), the heel
angle observed in pictures during this time frame was only about 12 degrees; and the logs from
the Transocean emergency response center reported that their “Naval Architect Assessment from
Smit 6:00 am observation. Trim of the MODU 7-8 degrees, Heel 12-13 degrees. Combination is
about 20 degrees.”278

Some unknown combination of damage, flooding, and shifting loads slowly trimmed, heeled,
and reduced the freeboard on DEEPWATER HORIZON, allowing previously un-submerged
openings in the hull to move closer to the waterline. On the morning of April 22, DEEPWATER

272 Testimony 5/11/2010, p 148.
273 DAMON B BANKSTON Log.
274 Ibid.
275 Testimony 8/23/2010, p 470.
276 SMIT Salvage Americas Salvage Daily Progress Report, DEEPWATER HORIZON, dated 22 April 2010.
277 SMIT Salvage Americas Salvage Master Observations, April 22, 2010.
278 Transocean emergency response center log, TRN-USCG_MMS-00038830.
It is not correct to add trim angles and heel angles together, but it appears this was done to get the 22 degrees
reported in the SMIT Salvage Master Observations.


73



HORIZON began taking on increasing amounts of water as more openings were submerged. By
1026, DEEPWATER HORIZON had sunk.279

Figure 13 shows DEEPWATER HORIZON as it came to rest on the ocean floor, depicting some
of the damage and showing that the upper hull was buried and is not visible.280


Figure 13 – DEEPWATER HORIZON on the Ocean Floor

II. Systems
A. Operations Manual – Watertight Integrity
Prior to the explosion on April 20, 2010, DEEPWATER HORIZON had established requirements
for maintaining the watertight integrity of its internal compartments. The investigation
identified, however, that during the month of the explosion, DEEPWATER HORIZON was not in
compliance with those requirements.

279 USCG Final Action Report on the SAR Case Study into the Mass Rescue of Personnel off the Mobile Offshore
Drilling Unit DEEPWATER HORIZON (Appendix G).
280 Phoenix International Drawing, DEEPWATER HORIZON Major Debris Distribution, Sheet 2 of 2, 10/13/2010.


74



The International Maritime Organization (IMO) Code for the Construction and Equipment of
Mobile Offshore Drilling Units (MODU Code) includes damage stability and subdivision
standards that require numerous watertight compartments. The IMO MODU Code essentially
requires a MODU to survive the flooding of any one compartment without exceeding accepted
conditions of list and trim, so it is vital to ensure that watertight barriers between each
compartment are maintained to prevent progressive flooding between multiple compartments.281

On DEEPWATER HORIZON, those compartments needing both watertight integrity, as well as
frequent access were required to have watertight doors or watertight hatches. In addition, all
openings in the watertight bulkheads that allowed for the passage of piping were to be protected
by valves that could be operated from the central ballast control room with remote visual
position indicators, in order to maintain watertight integrity and provide situational awareness to
the crewmembers on watch.282 Electrical cables that passed through watertight boundaries were
required to include watertight seals where they penetrated the boundary.283

The vessel’s operations manual stressed the importance of maintaining the proper operation of
all watertight closures to ensure readiness and stability during damage situations.284 However,
reports from two separate independent materiel condition audits identified issues with the
watertight integrity of DEEPWATER HORIZON relating to the maintenance and proper
operation of watertight doors and dampers. The first report, issued in September 2009 by
inspectors contracted by BP, reviewed watertight integrity and noted that “[t]here were failures
observed which have raised concerns.” It stated:

“In the worst case approximately four of these doors had the limit switch frozen in the closed
position. This then means the bridge would be unaware of the status of the door as the limit
switch always reports closed status. Additionally when reviewing alarm status conditions on
the vessel management system a number of doors had had the 100 second alarm timer
disabled. This means that if the doors are left open for more than 100 seconds then the
audible alarm will not be generated in line with the original requirements.”285

In addition, the report found, “The port aft quadrant watertight dampers failed to close when
tested.”286 The report also identified deficiencies with another vital stability system:

“During testing of the bilge system three of the four electric bilge pumps failed to take
suction, the priming devices being defective. Two emergency bilge suction check valves
also failed integrity checks when subject to flow back test.”287

281 IMO MODU Code, Chapter 3.
282 1989 IMO MODU Code 3.6.2.
283 Ibid., Section 3.6.1
284 DEEPWATER HORIZON Operations Manual March 2001 page 4.8, ABSDWH000152.
285 DEEPWATER HORIZON Follow Up Rig Audit, Marine Assurance Audit and Out of Service Period September
2009, BP-HZN-MBI00136223-136224.
286 Ibid., BP-HZN-MBI00136223-136213.
287 Ibid., BP-HZN-MBI00136223-136224.


75



In April 2010, a second report, from a survey conducted by inspectors contracted by Transocean,
identified one issue “that directly affect[s] the stability of the rig”:

“The watertight doors appeared to be in fair condition. The rig had two of the hydraulic
doors out of service and not working correct[ly], on the 28 1/2 m (94 ft) deck level and also
on the 24 m (79 ft) deck level, that have to be manually opened and closed.”288

With regard to the ballast control system, the report found issues with all four relays for the valve
controls, as they were heating up during operation and required replacement. The major concern
identified with the relays “would be a flooding problem or safety issues of the watertight
integrity of the rig.”289

In addition, when the BP auditors conducted a status update in March 2010, it identified a
remaining watertight integrity issue relating to the “Multiple Cable Transits” (MCIs):290

“[S]ince an MCT survey carried out in 2005/2006 it is reported that two MCTs have leaked
or failed under static head pressure. Inventory survey and inspection to be conducted and
documented to verify the integrity of MCTs installed in the pontoons, columns, moon pool
and Main Deck areas.”291

This recommendation was still outstanding as of March 29, 2010 when the auditors conducted a
status update.292 Dating back to December 2005, failed MCTs had been identified as a concern
for MODUs when MMS determined that they were responsible for a flooding and stability
problem on the THUNDERHORSE floating platform during Hurricane Dennis: “Preliminary
findings from the investigation indicate that water movement among the access spaces occurred
through failed multiple cable transits (MCTs).”293

Because of the sinking, the actual watertight integrity of DEEPWATER HORIZON at the time of
the casualty cannot be determined. Nevertheless, to the extent that the conditions identified in
the audits remained uncorrected, when water from fire-fighting vessels was applied onto the
MODU, those compartments with faulty watertight closures, leaking MCTs, or damage to their
closures could have led to progressive flooding of multiple compartments, creating a situation
well beyond the design criteria for withstanding the flooding of one compartment addressed by
the damage survivability requirements in the MODU Code.

288 MODU Condition Assessment DEEPWATER HORIZON, ModuSpec USA, Inc., 4/1-14/2010, TRN-
USCG_MMS-00038618.
289 Ibid., p 16.
Inoperable valves in the ballast system could allow for the unrestricted passage of flood water from one
compartment to another through the ballast piping. This problem becomes more severe as a vessel heels; flood
water previously contained in one or more compartments flows to the low side of the vessel through the piping,
increasing the heel of the vessel.
290 Multiple Cable Transits allow for the passage of cables through watertight bulkheads without compromising the
watertight integrity of the compartment.
291 BP CMID Audit Work list September 2009, Rev Date March 29, 2011, TRN-USCG_MMS-00043621.
292 Ibid.
293 MMS Safety Alert #235, 12/15/2005, http://www.gomr.boemre.gov/homepg/offshore/safety/safealt/SA_235.pdf.


76



B. Coast Guard Search and Rescue Policy – Marine Firefighting
Coast Guard Search and Rescue (SAR) responders are guided by a SAR policy that states:
. “Coast Guard units shall adopt a conservative response posture” and focus their actions
on activities not requiring unit personnel to enter into a hazardous environment.
. For fire-fighting in an Incident Command System (ICS) response structure, “a
Firefighting Group should be established to coordinate local authorities responsible for
fighting the fires. This should be coordinated prior to an incident.”
. “The Commandant recognizes the significance of the cautious approach the Coast Guard
has adopted for marine fire-fighting situations. High training, equipment, and staffing
thresholds will limit the response capability of many units, and in some areas, sources of
support will not be readily available. Consequently, there will be occasions when a unit
will be unable to mount a complete response to an incident. This circumstance is
preferred to attempting a complex and potentially hazardous job without the necessary
staffing, training and equipment.”294

C. Area Contingency Plan – Marine Fire-fighting
To assist governmental agencies in responding to oil and hazardous material spills, Coast Guard
Captains of the Port (COTP), as the likely Federal On Scene Coordinators (FOSC) in the event
of an oil spill, are required to develop an Area Contingency Plan (ACP) with members of federal,
state and local agencies to establish predetermined plans and strategies for multi-agency efforts
to respond to a spill resulting from a marine casualty.295 The ACP uses the Incident Command
System (ICS)296 as its framework and ordinarily contains procedures for marine fire-fighting. In
this instance, the Southeast Louisiana ACP did not contain a specific marine fire-fighting plan,
but the ACP did define the following inconsistent duties regarding marine fire-fighting:

. “In general, the USCG Captain of the Port is the Incident Commander for any fire aboard
a vessel that is at anchor or underway.”297
. The COTP is tasked to “Be prepared to assume the role of Incident Commander if the
fire-fighting response is inadequate or nonexistent”298 or “upon conclusion of fire-
fighting operations as appropriate.”299
294 United States Coast Guard, Commandant Instruction M16130.2E, “U.S. COAST GUARD Addendum to the
United States National Search and Rescue Supplement (NNS) to the International Aeronautical and Maritime Search
and Rescue Manual (IAMSAR)” September 21, 2009, Section 4.4 Firefighting Activities Policy.
295 40 CFR 300.210(c)
296 The Incident Command System (ICS) is a standardized but flexible, on-scene, all-hazards incident management
approach that allows for the integration of numerous entities and jurisdictions within a common organization
structure.
297 Southeast Louisiana Area Contingency Plan, 6 February 2003, 4520.3 p 4-34.
298 Ibid., 8332.113 p 8-6.
299 Ibid., 8330 p 8-4.


77



. “The COTP will advise the [Incident Commander] on unique vessel fire-fighting hazards
not normally associated with land based fires. Some of these hazards include: Vessel
stability due to water discipline, Free surface effect, Hull integrity, List correction/vessel
de-watering….”300
III. Actions / Decisions Contributing to System Failure
A. Decisions Relating to Fire-fighting
The parties involved in the fire-fighting and salvage efforts made two decisions that, taken
together, resulted in a marine fire-fighting effort that lacked direction and coordination and paid
insufficient attention to the risks of excess water destabilizing the MODU. These decisions were

(1) the Coast Guard’s decision to focus priority on Search and Rescue; and (2) the Transocean
salvage contractor’s decision not to develop a salvage plan.
1. Decision to Focus Priority on Search and Rescue
Both the ACP and SAR policies focus on near-shore or in-port fires and thus do not emphasize a
coordinated offshore marine fire-fighting effort. As discussed above, the ACP states that for
situations occurring within their zone, the COTP, as FOSC, has jurisdiction over marine fire-
fighting and that the first priority is the safety of the crew and other personnel in the area. The
secondary concerns are for environmental protection and vessel salvage.301 The Coast Guard
Search and Rescue Policy also prioritizes SAR over fire-fighting.302 Based on the reports of
missing persons, this policy was understandably followed. As a result, however, the marine fire-
fighting efforts lacked direction and coordination.

The investigation revealed that there was no formal establishment of a fire-fighting group.303
The Eighth Coast Guard District quickly took over the Search and Rescue Mission Coordinator
(SMC) responsibilities from Sector New Orleans as the event was categorized as a Mass Rescue
Operation. The FOSC duties, including marine fire-fighting, remained with the Sector New
Orleans sub-unit, Marine Safety Unit Morgan City.304 But it was the Eighth Coast Guard District
office that had the authority to launch Coast Guard boats and aircraft from throughout the Eighth
District, which covers most of the units near the Gulf of Mexico. The District established
communications with the assets it deployed and had good visibility over all of the directed subunits.
305

The initial Coast Guard assets on scene were operating under the SAR policy that takes a

cautious approach to marine fire-fighting and thus did not direct those activities. According to

300 Ibid., 8332.118(2) p 8-6.
301 Ibid., 9720.1 page 9-57.
302 United States Coast Guard, Commandant Instruction M16130.2E, “U.S. COAST GUARD Addendum to the
United States National Search and Rescue Supplement (NNS) to the International Aeronautical and Maritime Search
and Rescue Manual (IAMSAR)” September 21, 2009, Preface.
303 Testimony USCG, 10/4/2010, p 30, USCG Final Action Report on the SAR Case Study into the Mass



Rescue of Personnel off the Mobile Offshore Drilling Unit DEEPWATER HORIZON (Appendix G).
304 Testimony 10/4/2010 p 27.
305 Ibid., p 30.

78



the Commanding Officer of the Coast Guard Cutter ZEPHYR, who assumed On Scene
Coordinator duties at 0724 on April 21, “We gave no direction on fire-fighting.”306 Meanwhile,
on shore, the Executive Officer at Marine Safety Unit Morgan City, who was acting as the FOSC
and Incident Commander during the Commanding Officer’s absence, stated that, “Marine Safety
Unit didn’t fight the fire nor did we direct any efforts to fight the fire on the DEEPWATER
HORIZON.” According to the Executive Officer, “We (MSU) were told to stay back from any
fire-fighting, and to just work on pre-staging and getting ready for the possible need to respond
to any pollution.”307

At the same time, no one from DEEPWATER HORIZON took charge of marine fire-fighting.
The master was responsible for the safety of DEEPWATER HORIZON, but could not recall
leading a fire-fighting effort before he departed the scene on the morning of April 21.308
Transocean’s operations manager-performance, who remained on scene after the survivors
departed, indicated that he was not leading the fire-fighting effort,309 though when a responding
vessel requested permission to put water on DEEPWATER HORIZON over the radio, he
authorized it.310 When asked if he considered the impact of the water on the stability of
DEEPWATER HORIZON when he authorized the boats to use fire monitors (water cannons), the
operations manager-performance stated, “We didn’t go into great detail there.”311

Transocean’s salvor, SMIT Salvage Americas, initially did not take the lead either. When SMIT
Salvage Americas arrived at the Transocean Emergency Response Center in Houston, Texas at
approximately 0500 on April 21, it was not clear who was directing the fire-fighting effort on
scene.312 The first successful two-way communication between SMIT Salvage Americas at the
Transocean emergency response center and the operations manager-performance onboard MAX
CHOUEST was at 1300 on April 21.313 At 1315, the Captain on watch aboard the MAX
CHOUEST, logged “Informed C. G. Cutter ZEPHYR to have fire vessels redirect water flow to
legs as per Transocean - 314 Figure 14 shows at least 6 vessels providing water
to the fire.

According to SMIT Salvage Americas, it initially had “very little and erratic information”
regarding the condition of DEEPWATER HORIZON from on scene and “didn’t have any clear
lines of communication” until its chartered vessel SEACOR VANGUARD arrived on scene at
2345 on April 21.315 At that time, a full day into the response, SMIT Salvage Americas members
proceeded to take control of and actively direct the fire-fighting efforts and, by their account,

306 USCG Final Action Report on the SAR Case Study into the Mass Rescue of Personnel off the Mobile Offshore


This plain-text version of the United States Coast Guard report on the BP Deepwater Horizon oil spill disaster has been provided as a public service by the law firm of Aylstock, Witkin, Kreis & Overholtz (AWKO). For those users who have the Adobe Acrobat reading/viewing software, there is also a PDF version on the USCG website. Or, for a version without any HTML, a TXT version is available from AWKO.