Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

Contents lists available at SciVerse ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Evacuation, escape, and rescue experiences from offshore accidents

including the Deepwater Horizon
Jon Espen Skogdalen a, *, Jahon Khorsandi b, Jan Erik Vinnem a
a
Department of Industrial Economics, Risk Management and Planning, University of Stavanger, 4036 Stavanger, Norway
b
Center for Catastrophic Risk Management, University of California, Berkeley, Berkeley, CA, United States

a r t i c l e i n f o a b s t r a c t

Article history: When a major hazard occurs on an installation, evacuation, escape, and rescue (EER) operations play
Received 10 May 2011 a vital role in safeguarding the lives of personnel. There have been several major offshore accidents
Received in revised form where most of the crew has been killed during EER operations. The major hazards and EER operations
10 August 2011
can be divided into three categories; depending on the hazard, time pressure and the risk influencing
Accepted 11 August 2011
factors (RIFs). The RIFs are categorized into human elements, the installation and hazards. A step by step
evacuation sequence is illustrated. The escape and evacuation sequence from the Deepwater Horizon
Keywords:
offshore drilling platform is reviewed based on testimonies from the survivors. Although no casualties
Evacuation, escape and rescue
Major accident
were reported as a result of the EER operations from the Deepwater Horizon, the number of survivors
Deepwater Horizon offers a limited insight into the level of success of the EER operations. Several technical and non-technical
improvements are suggested to improve EER operations. There is need for a comprehensive analysis of
the systems used for the rescue of personnel at sea, life rafts and lifeboats in the Gulf of Mexico.
Ó 2011 Elsevier Ltd. All rights reserved.

1. Introduction was launched with only seven crew members aboard. Judging that
there was not enough time to launch another life raft, the master
The Deepwater Horizon accident and the Macondo blowout on and three remaining crew members jumped over 50 feet into the
the 20th of April 2010 raised serious concerns regarding the safety water. No casualties were reported as a result of the EER operations
level of offshore drilling. The Deepwater Horizon offshore rig was (USCG, 2011). Two days later, the Deepwater Horizon rig sank
considered to be a safe and efficient drilling unit. The very same day (DHJIT, 2010). The results of the EER operations from the Deepwater
as BP officials were visiting the rig to praise seven years without lost Horizon must not be taken for granted. There are several risks
time incidents, gas exploded up the wellbore onto the deck of the associated with EER operations from offshore installations as
rig and caught fire. Eleven workers were killed in the explosions illustrated in the examples below.
(DHJIT, 2010). Evacuation, escape, and rescue (EER) operations In 1980, 123 people were killed when the Alexander Kielland
played a vital role in safeguarding the crew members’ lives. Two platform capsized and sank in the Norwegian sector of the North
lifeboats were launched in an effort for the crew to evacuate the rig, Sea. A fatigue crack in one of the legs caused the floating hotel to
however eleven crew members were left behind. Because it was not lose one of five legs and capsize. Lifeboats were smashed against
clear that they could safely reach the two remaining lifeboats at the the rig’s legs, causing them to break. Only one lifeboat was
opposite end of the Mobile Offshore Drilling Unit (MODU), the launched successfully. Many of the men were swept away. Only 89
master elected to launch a life raft. Because of intense heat and of the 212 men onboard survived (Næsheim, 1981).
smoke, and crew fears that the raft would burn or melt, the life raft In 1982 the Ocean Ranger semisubmersible capsized and sank
on the Grand Banks of Newfoundland during a severe winter storm
packing 90-knot winds and high seas. The Royal Commission on the
Abbreviations: BOP, blowout preventer; DPO, dynamic positioning operator;
Ocean Ranger Marine Disaster indicated that a huge wave had
EER, evacuation, escape, and rescue; ESD, emergency disconnect system; HOF, swept over the rig, breaking a porthole in the ballast control room,
human and organizational factors; MODU, Mobile Offshore Drilling Unit; OCS, Outer shorting circuits, opening ballast inlet valves and causing the rig to
Continental Shelf; POB, Personnel on Board; PSA, Petroleum Safety Authority list to an extent that the crew could not rectify. All 84 crew
Norway; RIF, risk influencing factor; USCG, U.S. Coast Guard; TSR, temporary safe
members died, at least some of which during or following attempts
refuge.
* Corresponding author. Tel./fax: þ47 99 02 41 71. to transfer survivors from the lifeboat to a vessel without rescue
E-mail address: jon.espen.skogdalen@gmail.com (J. E. Skogdalen). facilities (Hickman, 1984).

0950-4230/$ e see front matter Ó 2011 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2011.08.005
 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 149

In 1988 a medium gas condensate leak resulted in an explosion Before the testimonies are reviewed EER operations are system-
and fire on board the Piper Alpha production platform in the North atized according to definitions, sequence, success factors and RIFs.
Sea, killing 167 workers and leaving only 59 survivors, resulting in Hazard prevention, control and mitigation are not covered in this
one of the worst offshore accidents ever. Many crew members lost article. These activities influence the RIFs during EER operations, and
their lives because they were not able to successfully evacuate the are described in research related to risk management (e.g. Aven &
installation (Leafloor, 2006). Vinnem, 2007).
A more recent example is the Usumacinta accident on October
23, 2007, where 22 people died after launching the lifeboats and
abandoning the mobile drilling unit. Various decisions such as
2. Evacuation, escape and rescue (EER)
opening the hatches or prematurely abandoning the lifeboats
resulted in the death of the crew (Leis et al., 2008).
The terms “evacuation”, “escape” and “rescue” are defined as
When a major hazard occurs on an installation, EER operations
following (Cullen, 1990; HSE, 1997): Evacuation refers to the plan-
play a vital role in safeguarding the lives of personnel by safely
ned method of leaving the installation without directly entering the
removing them from the danger zone. However, as shown in the
sea. Successful evacuation results in those on board the installation
examples above, evacuation operations can have tragic outcomes,
being transferred to an onshore location or to a safe offshore
and although such accidents have had major impacts on legislation,
location or vessel. Evacuation means may include helicopters,
training, and operating procedures, the risks pertaining to EER
lifeboats and bridge-links.
operations continue to exist. Therefore, there is a need for a further
Escape is the process of leaving the installation in an emergency
understanding of the performance of barriers (both technical and
when the evacuation system has failed. It may involve entering the
not-technical) in EER operations.
sea directly and is the ‘last resort’ method of getting personnel off
the installation. Means of escape cover items which assist with
1.1. Objective
descent to the sea, such as life rafts, chute systems, ladders and
individually controlled descent devices, as well as items in which
Different accident scenarios cause different risk influencing
personnel can float on when reaching the sea such as throw-over
factors (RIFs) during the EER operations. A RIF is defined as ‘an
life rafts.1
aspect (event/condition) of a system or an activity that affects the
Rescue is the process of recovering of persons following their
risk level of this system or activity’ (Øien, 2001). The objectives of
evacuation or escape from the installation, and rescuing of persons
this article are to:
near the installation and taking such persons to a place of safety.
Rescue also refers to the process by which man overboard (MOB)
1. Categorize offshore accidents according to RIFs during the EER
survivors are retrieved to a safe place where medical assistance is
operations
available.
2. Review the EER operations from the Deepwater Horizon based
Some of the hazards which can potentially lead to EER are (IADC,
on testimonies
2009; Norsok, 2001):
3. Suggest possible improvements based on the findings
 Blowouts, including shallow gas and reservoir zones; unignited
Research related to EER operations during fire in buildings is
and ignited
included in this study due to the similarities with offshore accidents
 Process leaks; unignited and ignited
which also often include fires and in some cases explosions. The EER
 Utility areas and systems fires and explosions
operations from the Deepwater Horizon are reviewed based on
 Fire in accommodation areas
testimonies provided by the crew members during the Joint Inves-
 Helicopter crash on platform
tigation by the Unites States Coast Guard and the Bureau of Ocean
 Collisions, including fields related traffic, and external traffic,
Energy Management. The joint investigation board conducted the
drifting and under power
hearings in several sessions. Session one was held May 11e12, 2010,
 Drifting objects that may threaten the installation
and investigated the circumstances surrounding the fire, explosion,
 Riser and pipeline accidents
pollution and sinking of the Deepwater Horizon. The second session
 Accidents from subsea production systems
was held May 26e29, 2010, with the focus on gathering information
 Structural collapse, including collapse of bridges between fixed
on the Deepwater Horizon’s materiel condition, crew qualifications,
and/or floating installations
emergency preparedness, and casualty timeline. The third session of
 Foundation failure
hearings, which could be considered the “technical verification”
 Loss of rig stability/position
phase, was held July 19e23, 2010, with the focus on the “how” and
 Extreme weather
the “why” of the accident. The fourth session was held Aug. 23e27,
2010, with a focus on the recovery, analysis, and evaluation of the
The hazards that a crew can be exposed to during EER can mainly
critical drilling equipment. The fifth session of hearings was held Oct.
be divided into three categories (HSE, 1995): physical, command and
4e8, 2010, with the focus on safety management systems, organi-
control and behavioral. The physical hazards are those due to
zational decision making and safety culture (DHJIT, 2010).
equipment (design, malfunction or failure) and physical conditions
Experience from the regulations and standards used in the
(environmental, fire, smoke etc.). The command and control hazards
North Sea are compared with the review from Deepwater Horizon.
are those due to poor procedures, inadequate communications and
The review includes the sequence of events from when the blowout
breakdown of safety management systems. The behavioral hazards
was detected, until the crew was outside the platform safety zone
are those due to human factors as well as undesirable human
(500 m) and thereby judged to be in safe distance from hazards
behaviors.
caused by the installation. There are several other studies related to
EER which review the mustering phase but do not include the
abandoning phase. However, there are several accidents related to 1
It should be noted that Petroleum Safety Authority Norway (PSA) uses the term
the abandoning phase, (e.g., lowering of lifeboats). The Abandon- ‘escape’ for all actions to leave the place of the accident and to move away from the
ment phase is therefore included in this work. installation.
150 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

2.1. Evacuation sequence all, the organizational factors which influence safety related
behavior at work (Goodwin, 2007).
Fig. 1 shows the different steps pertaining to an evacuation from Organizational factors are characterized by the division of tasks,
an offshore installation e from the initiating incident, through the design of job positions including selection, training and cultural
abandonment of the vessel. In the case of the Deepwater Horizon, indoctrination, and their coordination to accomplish the activities.
this refers to when the blowout was first recognized, to when the The factors also include elements such as complexity (chemical/
lifeboats abandoned the platform zone (500 m). process, physical, control, and task); size and age of plant, and
Fig. 1 includes the steps of an evacuation process, but does not organizational safety performance shaping factors such as leader-
include the means of escape. ship, culture, rewards, manning, communications and coordina-
The main factors which can lead to the success of EER from tion, and social norms and pressures (Bellamy, Geyer, & Wilkinson,
offshore installations can be summarized as (HSE, 1995): 2006). The human and organizational factors (HOFs) influence
behavior during hazards.
 Hazard prevention, control and mitigation The first scientific research into human behavior in the event of
 Appropriate installation physical design (e.g., escape routes, a fire was conducted in the 1950s in the United States. Since
muster area) researchers at that time assumed that buildings were engineered in
 The performance of equipment in an emergency (e.g., alarm such a way that they were safe enough in a fire, the focus was on the
systems, fire-fighting equipment, helicopters, lifeboats and fast relationship between the (social) behavior of people and fire
rescue crafts) development, and much less on the interaction between building
 The action of the personnel concerned (e.g., offshore emer- design and a safe escape (Kobes, Helsloot, de Vries, & Post, 2010).
gency response teams and general Personnel on Board (POB), Research has been performed related to modeling of evacuation
often summarized as human and organizational factors (HOFs). situations both for offshore installations (Basra & Kirwan, 1998;
Bercha, Brooks, & Leafloor, 2003; Jacobsen, 2010; Veitch, 2003)
and maritime evacuations (Kim, Park, Lee, & Yang, 2004; Park, Lee,
2.2. HOFs during EER operations Kim, & Yang, 2004). Few simulation models are based on human
behavior in evacuation scenarios, such as the preference for specific
Human error and human factors are often used interchangeably, routes or exits, or the time needed to gather and interpret infor-
thus creating confusion and compromising the quality of human mation. This is because there is insufficient quantitative research
reliability assessments (DiMattia, 2005). Therefore, defining human data available on these factors (Sime, 2001). Relevant for EER
factors and human error is necessary to establish a basis for the models are variables or parameters used in theories and findings of
discussion in the current paper. A definition of human factors, disaster psychology (e.g. Leach, 1994).
modified slightly from the UK’s Health and Safety Executive (HSE, Important human factors are the personality traits of the people
1999), is as follows: Environmental, organizational and job in a building, their knowledge and experience, their powers of
factors, system design, task attributes, and human characteristics observation and judgment, and their mobility. In Social Cognitive
that influence behavior and affect health and safety. ‘Human Theory, it is assumed that most people have an internal system
factors’ are a range of issues including the perceptual, physical and which enables them to control their thoughts, feelings, motivations
mental capabilities of people and the interactions of individuals and actions to some extent (Kobes et al., 2010). This internal control
with their job and the working environments, the influence of is based on personal knowledge, feelings, biological characteristics,
equipment and system design on human performance, and above actions and their influence on surroundings. Judgment enables

Initiating incident Awareness Evaluation and egress POB control Abandoning

Initial incidert

Decision to
Detect alarm
muster

Activate alarm and Make workplace safe

Identify alarm
PA-announcment (if time)

Listen and follow PA Choose egress

announcement Register at TSR
route

Move along egress Decision to

Dress in survival suits
route abandon

Enter lifeboat Drop lifeboat

Abandon platform
zone

Fig. 1. The evacuation sequence (Skogdalen & Vinnem, 2010).

 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 151

a human to estimate the threat of danger by going through a cue responds to a given situation (Proulx, 1993). An increased stress
validation process based on what he or she sees, hears, smells and level is not the same as panic, which can be defined as irrational,
feels. The cue validation process is of significant importance given illogical and uncontrolled behavior (Kobes et al., 2010).
that decision making during an evacuation depends upon the cues The engineered features, and thereby the RIFs of an offshore
that the occupants perceive, and their interpretation of those cues installation which determine fire response performance is mainly
(Graham & Roberts, 2000). Important factors are awareness, related to its layout, fire and blast walls, materials, fire compart-
physical position (passive or in motion) and familiarity with the ments and size of the facility. Relevant components of the layout
layout of a building. In the study, a number of individuals who had are the escape route signage, the design of the escape routes and
tried to leave a building by passing through a smoky environment the design and location of the (emergency) exits and the (emer-
reported that they had to change direction, or even retrace their gency) staircases. Physical barriers, like fire and smoke compart-
steps, due to breathing problems, reduced vision, fear, or other ments, the maximum walking distance to (fire) exits, and fire safety
reasons (Gwynne, Galea, Lawrence, & Filippidis, 2001). Experi- installations are the main components of egress and life safety
ments show that in the case of limited visibility, people tend to systems.
walk alongside walls for guidance (Kobes et al., 2010; Nagai, Fig. 2 summarizes the different factors that influence the EER
Nagatani, Isobe, & Adachi, 2004). performance.
There are three distinct strategies for surviving a fire. The first
strategy is to (try to) extinguish it. The second strategy is to take 3. Three different EER situations
shelter and wait to be rescued, and the third is evacuation (Kim
et al., 2004). Large jet-fires like seen in the case of Deepwater The HOFs and RIFs described in Fig. 2 will differ depending on
Horizon and Piper Alpha left most of the personnel with just one the initial hazard. The potential and speed of escalation also differ
option; to try to evacuate or escape. The fire could not be extin- depending on the hazard. The escalation speed will influence which
guished. There was no organized search and rescue by emergency evacuation and escape means are available. Three examples of
response teams onboard the installations. hazards that an offshore installation may encounter are presented
The presence of social bonds within groups has implications for below, followed by a table which categorizes the hazards.
models predicting an array of possible disaster outcomes, including
the emergence of panic. Organizational breakdown models assume 3.1. 2004 Hurricane season and evacuation
that social bonds within groups engaging in collective flight weaken
under intense threat (Cornwell, 2003). The 2004e2005 hurricane seasons in the Gulf of Mexico were
A key personality trait is the level of stress resistance, and the worst in the history of offshore production, and the most
thereby the power of observation, judgment and movement. During destructive and costliest natural disasters in the history of the
a fire, a person’s stress levels may rise to a level where their capacity United States (Cruz & Krausmann, 2008). The hurricanes Katrina
for processing information is exceeded (Proulx, 1993). Too much and Rita destroyed 136 structures, representing 1.7% of Gulf oil
stress can impair cognitive processes and how an individual production and 0.9% of natural gas output. Another 53 platforms

Evacuation, Escape and Rescue performance

Human and Organsational

Installation RIFs Hazard RIFs
Factors
Personality Layout Visual features
Knowledge and experience Materials Smelling features
Power of observation Size of installation (No. Of Audible features
Powers of judgement decks levels
Powers of movement Floating, Condeep, Jack-up Escalation speed (e.g. fire
e.g. growth speed, explosions)
S
Social features Normally unmanned
Affiliation (e.g. family) Number of POB onboard Smoke yield
Role/responsibility Robustness of platform Toxity
structure, escape routes, Heat
S
Situational features muster points, TR,
Awareness evacuation equipment etc.
Physical condition Active systems (deluge
Familiarity with layout etc.)
Passive systems (fire
Command
C and control protection, fire- and blast
Managment/leadership walls etc.)
Procedures
Communication Escape
E routes
Safety managment system Length to muster area
Work practice Complexity (junctions,
Competence stairs, etc.)
Equipment passed
Protection of muster area

Fig. 2. EER performance, partly based on Kobes et al. (2010).

152 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

suffered significant damage. Five rigs were destroyed and 19 rigs accommodation. Overall, 61 persons from Piper Alpha survived. 39
sustained significant damage (Kaiser, 2007). A large scale precau- had been on night-shift and 22 had been off duty (Cullen, 1990).
tionary evacuation was conducted in advance, for which no deaths The three incidents/accidents described above vary depending on
were reported (Cruz & Krausmann, 2008). the escalation speed and RIFs. The hurricane allowed for pre-warned
hours in advance. Time was available to conduct an arranged and
structured evacuation of the installations. The gas blowout at Snorre
3.2. Snorre A
A was not immediately ignited. The incident posed a threat and
personnel were mustered in lifeboats in a structured manner
On the 28th of November 2004 an uncontrolled situation
according to emergency preparedness plans. The lifeboats would
occurred during work in a well on the Snorre A tension leg plat-
have been dropped if the incident had escalated by the gas being
form on the Norwegian Shelf. The work consisted of pulling pipes
ignited. The Piper Alpha accident, for most of the crew, instantly lead
out of the well in preparation for drilling a sidetrack well. During
to a life-threatening situation with multiple RIFs such as smoke, heat
the course of the day, the situation developed into an uncontrolled
and explosion loads. The accident escalated quickly and no struc-
gas blowout outside the casing with cratering on the seabed,
tured evacuation occurred.
resulting in gas under the facility. Personnel who were not
The incidents/accidents are categorized in Table 1.
involved in work to remedy the situation were evacuated by
helicopter to nearby facilities after first being mustered in life-
4. Legislation and standards
boats. The work to regain control over the well was complicated
by the gas under the facility which, among other things, prevented
Legislation and standards influence the technical development,
supply vessels from approaching the facility to unload additional
organization, procedures and training related to evacuation from
drilling mud. Mixed mud was available as part of the well fluid
offshore installations and facilities. To illustrate the different
chemicals, and pumped into the well. The well was stabilized the
approaches toward legislation, the Norwegian and the U.S. regu-
day after. The PSA characterizes this incident as one of the most
lations are briefly described.
serious to occur on the Norwegian shelf (Brattbakk, Østvold,
The Norwegian performance based regulations specify the
Zwaag, & Hiim, 2005). Under slightly different circumstances,
performance or function which is to be attained or maintained by
the incident could have resulted in (1) ignition of the gas and (2)
the industry. The regulatory role involves defining the safety
buoyancy and stability problems. Only chance and fortunate
standards and acceptance criteria which companies must meet.
circumstances prevented a major accident with the danger of loss
Norway’s intention of such a regulatory regime is to get the oper-
of many lives, damage to the environment and additional loss of
ator to be focused and be “self-regulatory” when it comes to Health,
material assets (Brattbakk et al., 2005).
Safety and Environment (HSE) performance, rather than relying on
the regulator’s efforts in controlling that the HSE requirements are
3.3. Piper Alpha met. Within the Norwegian regime it is to a larger degree
a responsibility for the operator to demonstrate how their safety
At about 10 pm on the 6th of July, 1988 a medium gas condensate management system and performance comply with the regulations
leak resulted in an explosion and fire on board the Piper Alpha (DNV, 2010). In the PSA Activity Regulation Section 77 it is required
platform on the British Continental Shelf. The system for control in that the party responsible shall ensure that necessary actions are
the event of a major emergency was rendered almost entirely inop- taken as soon as possible in the event of situations of hazard and
erative. Smoke and flames outside the accommodation made evac- accident so that (PSA, 2010):
uation by helicopter or lifeboat impossible. Diving personnel, who
were on duty, escaped to the sea along with other personnel on duty  The right alert is given immediately
at the northern end and the lower levels of the platform. Other  Situations of hazard do not develop into situations of accidents
survivors of the initial explosions made their way to the accommo-  Personnel can be rescued in situations of accident
dation. A large number of the crew congregated near the galley on the  The personnel on the facility can be quickly and efficiently
top level of the accommodation, which was the mustering area. evacuated at all times
Conditions there were tolerable at first but deteriorated greatly as  The condition can be normalized when the development of
a result of smoke. Some of the crew, which among them 28 whom a situation of hazard and accident has been stopped
survived, decided on their own initiative to exit the accommodation.
The survivors reached the sea by the use of ropes and hoses or by In addition, the Norwegian performance based regulations
jumping off the platform from various levels. To remain in the provide details on some technical requirements related to EER. For
accommodation meant certain death. At the time of the initial instance, there is a requirement to use lifeboats of the free-fall type,
explosion 226 persons were on board the platform, of whom 62 were and two independent systems for rescue of personnel who fall into
on night-shift. The great majority of the remaining crew were in the the sea. There are further requirements that personnel may be

Table 1
Categories of EER situations.

Category Escalation RIFs (ref. Fig. 1) Typical evacuation E.g. hazard E.g. incident
speed means
1 e “Arranged and Slow No Helicopter Extreme weather 2004e2005 Hurricane
structured EER” evacuation GoM
2 e “Incident and Medium Limited Helicopter or Process leak, unignited, Snorre A blowout
structured EER” fife boats utility fires, ship on
collision course
3 e “Major accident” Fast Multiple factors Lifeboats, escape Structural collapse, Piper Alpha, Alexander
chutes, life rafts ignited HC leak Kielland, Ocean Ranger,
and jumping into sea Deepwater Horizon
 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 153

evacuated and rescued in what is termed ‘situations involving hazard 5.2. Awareness
and accident’, i.e. major hazard scenarios defined in Quantitative
Risk Analysis, accidental events of limited extent and situations The sudden occurrence and impact of the explosion made it
implying temporary increase of risk. difficult for members on the bridge to assess the situation immedi-
In the U.S., prescriptive regulations specify technical require- ately following the incident. Also, various alarms were sounding and
ments for structures, technical equipment and operations in order lights were flashing, making it difficult for the crew to acknowledge
to prevent accidents and mitigate hazards. The regulatory author- what was going on. The senior dynamic positioning operator (DPO)
ities define the requirements for HSE, and monitor that the who was located on the bridge at the time of the incident recalls the
companies comply with these. The United States Coast Guard scene as follows: [October 5th, 2010 (DHJIT, 2010)]:
(USCG) regulates the safety of life and property on the Outer
Continental Shelf (OCS) (DNV, 2010). USCG regulations 33 sub-parts “. they[alarms] were going off like crazy, so we were trying to find
B (Manned OCS facilities) and C (Mobile Offshore Drilling Units) in where these alarms were actually coming from.
33 CFR 146 have requirements for operators to develop and submit Question: So the alarms went off and you silenced them to try and respond to
what the casualties were; is that the way that worked?
approval Emergency Evacuation Plans (EEP) to the USCG. The EEP Answer: Yeah. But every time you silence those – At that point in time, it did
submissions must include, amongst other requirements (USCG, no use to silence an alarm, because there were some alarms that were
1998): just one on top of each other. It was just going crazy....”

 A description of the recognized circumstances, such as fires or Another DPO on the bridge that evening also recalls the scene on
blowouts, and environmental conditions, such as approaching the bridge as follows [October 5, 2010 (DHJIT, 2010)]:
hurricanes or ice floes, in which the facility or its personnel
would be placed in jeopardy and a mass evacuation of the
facility’s personnel would be recommended Question: .why didn’t you signal immediately the general alarm when two
 For each of the circumstances and conditions described a list the of the sensors came up magenta on the combustible gas alarms?
pre-evacuation steps for securing operations, whether drilling or Answer: It was a lot to take in. There was a lot going on. And soon after,
production, including the time estimates for completion and the I went over and hit the alarms.
Question: But you didn’t do it immediately, correct?
personnel required
Answer: No, sir.
 For each of the circumstances and conditions described Question: And, in fact, at the time there were, by your testimony, more than
a description of the order in which personnel would be evacu- ten to 20 magenta combustible gas alarms going off?
ated, the transportation resources to be used in the evacuation, Answer: Correct.
the operational limitations for each mode of transportation Question: And did you consider at any time initiating an emergency shutdown
of any ventilation aboard the rig?
specified, and the time and distance factors for initiating the Answer: No, sir.
evacuation
Question: Did anyone discuss it [ESD]? Did you hear anyone discussing it on
 For each of the circumstances and conditions described, iden-
the bridge at that time?
tification of the means and procedures for retrieving and Answer: Not that I remember.
transferring personnel during emergency situations and the Question: It was not an option put forth at any period of time that you were on
ultimate evacuation of all personnel the bridge following the jolt?
Answer: No. Not that I remember.

Even though the approach toward regulation is different, the Question: Did anyone tell you after the first explosion that the situation was
practical follow-up by the rig owners are very much the same under control?
Answer: Yeah, I did hear someone say that. That was probably said to calm
worldwide, and the equipment used on offshore oil and gas
people down.
installations for evacuations are mainly similar (e.g. lifeboats, Question: Do you recall who said that?
escape chutes and life rafts). Drilling vessels like the Deepwater Answer: The captain.
Horizon, follow marine regulations and often have conventional
lifeboats.
Transocean employees testified that the Deepwater Horizon’s
5. EER from the Deepwater Horizon general alarm systems were inhibited prior to the explosion to
avoid waking crew members in the middle of the night due to false
Evacuation from the Deepwater Horizon began within minutes alarms. [July 23, 2010; August 23, 2010] (DHJIT, 2010)]. According to
after the blowout and subsequent explosions on board the rig. It is the Chief Electronics Technician, inhibited alarms mean that the
impossible to know exactly what happened during the crisis on the sensors continue to detect hazards and forward the information to
night of April 20th, 2010. However, based on the various accounts the computer; however the computer will not automatically trigger
and testimonies of crew members during the Deepwater Horizon the alarm upon detecting a hazard. [July 23, 2010 (DHJIT, 2010)].
Joint Investigation, an overall sequence of events, including various This implies that on the Deepwater Horizon, the general alarm
hazards associated with those events has been outlined (DHJIT, system designated to notify the crew in the event of a fire required
2010). The outline follows the main sequence described in Fig. 1 manual activation by a member on the bridge. In turn, several crew
and is related to the factors illustrated in Fig. 2. members on the rig floor and those closer to the location of the
explosion had become aware of the severity of the incident before
5.1. Initiating incident the general alarms were sounded.
In addition, it has been testified that the general alarm did not
At approximately 9:45 pm, a blowout and subsequent explo- sound prior to the first explosion on the platform [October 5, 2010;
sions and fire erupted on the rig (Graham et al., 2011). The sequence July 23, 2010 (DHJIT, 2010)]. Traditionally, mustering would occur
of events leading to the blowout and explosions has been examined once the alarms were sounded, and the decision to muster was
in detail in the National Commission on the BP Deepwater Horizon announced on the PA system. However, as noted in the testimony
Oil Spill and Offshore Drilling Meeting 5 (Commission, 2010; below[August 24, 2010 (DHJIT, 2010)], some crew members recall
Graham et al., 2011). that they did not see or hear any alarms after the explosion. As
154 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

a result, they had begun evacuating the rig as soon as they wit- were difficulties when trying to accurately account for all members.
nessed and experienced the hazard RIFs of the blowout. In his testimony, the Crane Operator describes his account of the
events, and the difficulties in obtaining a proper headcount [May
29, 2010] (DHJIT, 2010)]:
Question: “Do you recall the order of the alarms on the bridge when the
incident occurred, what alarms sounded and in what order?
“We was still trying to get people on the boat and trying to calm
Answer: We received the alarms from the fire and gas after the first explosion. them down enough to – trying to calm them down enough to get
Question: . Did you ever see any sort of visible alarms on that rig once you everybody on the boat. And there was people jumping off the side.
heard the loud noise you heard and started experiencing the things We was trying to get a count and just couldn’t get an accurate
with the rig that you experienced, did you see any visual alarms
count because people were just jumping off the boat.”
anywhere on the rig of any type?
Answer: Not from the – the place I was at on the boat deck or in the short “And we were trying to get people to count “1, 2, 3” around the boat
distance through the hallways in the accommodations did I see any trying to see how many we had in there and people couldn’t even
visual alarms, nor did I hear any.” count right because they was too scared. So, what we done is we
just went ahead and filled the boats up to their max and loaded the
5.3. Evaluation and egress wounded we got on there and then lowered the boat.”
The Chief Mechanic describes the situation as follows [May 16,
Egress routes are the routes crew members use to escape from 2010 (DHJIT, 2010)]
their current workplace or location and arrive to the designated
muster stations on board the vessel. These routes are pre-planned, “Upon entering the bridge, it was complete chaos. They were trying
and provide the safest means of evacuation of a hazardous area. As to get systems going, they were trying to get control back, and I
the crew was making their way to the muster stations, many of the asked the captain, ’We’re here, Mike ... has an injury.’ So he told us
egress routes and stairways were blocked or impaired [May 27, to go to the lifeboats and find the medic. We proceeded to the
2010 (DHJIT, 2010)]. lifeboats, whereupon I lost track of Mike. And so I went to my
According to the Chief Electronics Technician on board the lifeboat that I was stationed to go to. And we waited around outside
Deepwater Horizon, egress routes were severely impaired as a result the lifeboat, waiting to receive orders. And it was just complete
of the explosions. His accounts of the events were as follows: [July 23, mayhem, chaos, people were scared, they were crying.”
2010 (DHJIT, 2010)]: The Operations Manager describes [August 23, 2010 (DHJIT,
“That [first] explosion blew the fire door that was between me and 2010)]:
those spaces off the hinges.” And I heard somebody yelling in the background that they’re jumping
“.as I reached the next door, I reached up and grabbed the handle overboard. So I ran back down the stairs. And in between the two life
for it. It then exploded. That was Explosion Number 2.” boats, on the outside of the handrail, there was an individual hanging
“.I remember getting really angry. I don’t know why I got angry. I on the outside of the handrail, and I said, “Hey, where you going?
was mad at the doors. The doors were – They were beating me to There’s a perfectly good boat here. Do you trust me?”
death. Two doors in a row had hit me right in the forehead and, you
know, planted me against the wall somewhere. My arm wouldn’t The Subsea Engineer also describes the scene as follows [July 22,
work, my left leg wouldn’t work, I couldn’t – I couldn’t breathe, I 2010 (DHJIT, 2010)].
couldn’t see.” “It was a raging fire, it was out of control. There was a sense of
“All the panels for the flooring were missing. There was nothing but urgency, we needed to go. And people were frozen up, they couldn’t
grid work. So I was tripping and falling kind of through this grid move. And I saw a couple of people jump off the side. I grabbed
work, trying to make my way to the outside water-tight door.” people and asked them if they checked in. I told them to get into the
“So I turned to the right, and as I did, I got my bearings, got my eyes lifeboat and, you know, did that for a few people. People started
cleaned out enough where I could see, and noticed there was no going. I got in the lifeboat myself and everybody filled in, closed the
walkway, there were no handrails, and there was no stairwell left. doors, we deployed the life vessel”
One more step and I would have went in the water. At that point I
looked up at the wall, and the exhaust stacks for Engine Number 3, the
wall, the handrail, the walkway, all those things were missing. They 5.5. Abandoning
were completely blown off the back of the rig.”
Flames and impaired egress routes had cut off access to the aft While crew members on the bridge were trying to assess the
lifeboats for some of the crew, rerouting them to their secondary situation, others were already mustering near the lifeboats. Some
muster stations. were urging for the lifeboats to be launched despite them being
The Senior Tool Pusher describes the wreckage in the living only partially full. Deepwater Horizon did have a split command
quarters as a result of the explosion: [May 28, 2010 (DHJIT, 2010)]: depending on what was the status of the rig; latched up, underway,
or in an emergency situation. The decision to evacuate the rig
“.we had to remove debris. It was hanging from the ceiling and rested upon the Captain when the rig was in an emergency situa-
the walls was jutted out, the floor was jutted up. I mean it was just tion, but from the testimonies it seems to be unclear who was in
total chaos in that area of the living quarters.” charge due to missing procedures of handover and interpretation if
the rig was latched up, underway or in an emergency situation
(DHJIT, 2010).
5.4. Personnel on Board (POB) control
In his testimony during the joint investigation by the United
States Coast Guard and the Bureau of Ocean Energy Management,
Typically as part of the evacuation procedure, once crew
the crane operator described the scene as follows [May 29, 2010
members reach the designated muster stations, they register their
(DHJIT, 2010)]
names so that a proper headcount can be conducted and missing
members can be accounted for. Based on the testimonies provided, “.it was a lot of screaming, just a lot of screaming, a lot of
there were efforts to prepare such a headcount, however there hollering, a lot of scared people, including me, was scared. And
 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 155

trying to get people on the boats. It was a very unorganized e we The senior DPO who was located on the bridge at the time of the
had some wounded we was putting in the boat. Had people on the incident signaled for help from the nearby supply ship, the Damon
boat yelling “Drop the boat, drop the boat” and we still didn’t have Bankston, which in response launched a Fast Rescue Craft (FRC) to
everybody on the boat yet. We was still trying to get people on the help rescue those at sea. Two lifeboats were launched from the
boat and trying to calm them down enough to – trying to calm Deepwater Horizon, and the crew made their way to the Damon
them down enough to get everybody on the boat. And there was Bankston. Some of the members who were left behind on the rig
people jumping off the side.” used a life raft to evacuate. However, after the raft was lowered to
sea, the remaining crew members on the rig, who were left behind
One of the crew members jumped to the sea, and recalls the
by both the lifeboats and life raft, jumped to the sea. The Chief
situation [May 28, 2010 (DHJIT, 2010)]:
Engineer, who was in the life raft below the rig, describes the scene
as he witnessed members who had jumped [July 19, 2010 (DHJIT,
2010)]:
Question: [.] if you had been through all those drills and you had confidence
that you thought basically the folks knew what they were doing, “I saw a person’s boots and his clothing and stuff come shooting
what was it that basically made you decide to go one deck down
through the smoke. Just before he landed, ...He landed
and jump? Were you frustrated, were you, you know, overly
concerned? Was it getting hot? I’m just really kind of curious. approximately five feet from me. Within seconds, a half a second
Answer: It was a decision that I made because I didn’t think we had time later, another pair of boots and person came flying out of the smoke
to wait. and he was approximately ten feet from me. Just before he hit the
Question: You thought it was taking too long to get the boat out?
water, .. As we’re swimming, trying to pull this life raft away
Answer: I just – they had a series of explosions, it’s time to go. That was my
thought process. from the rig, I got to a point where I could see the helideck. I wit-
Question: Can you estimate for us from the time that you heard the first nessed an individual running at full speed across the helideck.
explosion, you went to the boat deck, before you made your When he jumped off the end of the helideck, he was still running.
decision to go down and jump how much time elapsed? Just before he splashed into the water, he was actually looking over
Answer: Fifteen minutes maybe.
at us .”
Question: And, when you were on that fast rescue boat, did they retrieve
other people from the water or did they rescue you and take The crew that had launched the life raft faced various challenges
you back over?
Question: Okay.
in their attempt to evacuate and escape the vicinity of the burning
Answer: There were four guys that had jumped. rig. The following excerpts are from the testimony of the rig’s Chief
Engineer, who was one of the crew members who evacuated using
the life raft [July 19, 2010 (DHJIT, 2010)]:
It seems unclear as to when exactly the decision to abandon was
made and by whom. A senior Transocean employee visiting the rig “All the flames and heat from the rig floor were coming down the
at the time of the incident, described how he instructed the life- forward part of that deck, as well as all of the flames and the heat
boats to depart [August 23, 2010 (DHJIT, 2010)]: from under the rig. They were meeting, I guess, in like a vortex or
something right there at the life raft.”
“At that point, I honestly thought that we were going to cook right
there. The life raft, I guess from hurriedness and jumping in there
“.looking up at the derrick, you can see the derrick, and everything and so forth, it actually fell. At that point, the life raft actually
was ablaze there, and there was some individuals yelling, ‘We’ve got dipped forward and back. It started rocking back and forth. There
to go. We’ve got to go. We’ve got to go.’ And I said, ‘We’ve got plenty
was smoke..”
of time.’ And right about that time is when the traveling equipment,
the drilling blocks and whatnot on the derrick fell. They were “.I noticed that shortly after that, that we were not going any
probably 40 to 50 foot in the air, you know, weigh 150,000 pounds, further from the rig. About that time, somebody hollered out, ‘Oh,
and they didn’t make any noise. So at that time, I instructed the my God, the painter line is tied to the rig.’ I looked back over my
boat to my right, which would have been the port survival boat,
shoulder past the life raft and noticed the white painter line going
to depart. They did.
Question: If you were not in command, why would the life boat coxswain lower up into the smoke. At that point, I heard ..., which was right
his boat based on your communication and evacuate away from the behind me, started screaming for help, ‘Help. We need help over
Deepwater Horizon? here.’ I looked out to see and I would have to say probably 50, 60
Answer: I only know that when we left the bridge that we were going to yards away there was the fast rescue craft, the FRC, from the
abandon the vessel.
Dameon Bankston. I saw two flashing lights in the water. Just as I
Question: If you weren’t in management-performance, would the coxswain
take your word and leave and lower the boat and release? looked at it, one of those was getting hauled into the boat and
Answer: I don’t know why he would take orders from me. I’m not the master seconds later, the second person was hauled into that boat. The
of the vessel. But he did.” fast rescue craft started driving towards us and we were
hollering, ‘We need a knife. We need a knife.’ When they got
The crew eventually launched the lifeboats, leaving eleven crew probably ten or 15 feet from us, an individual came up to the bow
members behind (USCG, 2011). The following is an excerpt of the of the boat with a very large, foldable pocket knife. Curt swam
testimony of the subsea supervisor for the Deepwater Horizon: out, grabbed the knife, and swam to the back of the life raft. I
[August 25, 2010 (DHJIT, 2010)]: followed Curt to the back of the life raft to assist if he needed it.
He cut the rope.”

Question: So what was the atmosphere like inside the lifeboats? Within minutes, the FRC which had been launched by the crew
Answer: It was a little hectic.
of the Damon Bankston was able to rescue the crew members from
Question: A lot of yelling and things like that?
Answer: Yes. A lot of people was wanting to lower the boat before we got
the water and make its way to the life raft tied to the rig, cut the
all the people in it. line, and tow it to safety.
Question: So by the time you got – the boat was lowered, there was still One of the crew members who had helped lower the life raft,
enough room inside the lifeboat, sir? but was left behind on the rig described how he made his decision
Answer: Yes.
to jump [October 5, 2010 (DHJIT, 2010)]:
156 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

6. Discussion
Question: Other than jumping from the rig at that point, were there any other
alternatives to evacuate the rig?
Answer: Yeah. I mean, if I wanted to sit there and crank up the life raft davit, The majority of the casualties from the Alexander Kielland,
crank the hook back up and hook up another one. In a situation like Ocean Ranger, Piper Alpha and Usumacinta offshore accidents
this, you never know how much time you got, so I did, you know, the occurred during EER operations. The Deepwater Horizon experi-
best thing I thought.
Question: I’m certainly not criticizing your decision to jump. I’m just looking
enced a similar category 3 accident (ref. Table 1). The accident
at alternative evacuation methods. Were there ladders that would escalated fast and included multiple RIFs. Even so, no deaths were
go down to the water’s edge? reported as result of the EER operations (USCG, 2011). The high
Answer: There was a ladder that was right there, but those ladders were number of people evacuated from the Deepwater Horizon offers
severely damaged due to running from hurricanes, that you would
a significant, however limited insight into the level of success of the
have to jump from them anyway.
Question: So my understanding from what you said is there were ladders EER operations. Testimonies have revealed that several of the safety
designed, but the ladders had suffered damage, so they were not critical systems on Deepwater Horizon failed partly or totally. These
functional; is that correct? systems included the general alarm, blowout preventer, emergency
Answer: Those ladders were designed – I don’t know if they were designed disconnect system and the power supply. The systems were
for an emergency escape route, but I know they were used during
the shipyard for people to get up to the rig. I don’t know if they
intended for hazard prevention, control and mitigation. Several of
were emergency use. the crew members did not hear the abandon platform alarm. Some
Question: Do you know if the ladders could have been used to go from the of the egress routes were partially blocked.
deck to the water? The free-fall technology with skid launch lifeboats and drop
Answer: They could have, but like I stated earlier, the bottom 15, 20 feet was
lifeboats is according to PSA the safest method for ensuring that the
so severely damaged from waves that you still would have had to jump.
means of evacuation moves personnel away from the offshore
facility as quickly and safely as possible (PSA, 2008). This is
Another hazard facing those who had jumped to sea was the
particularly the case in the North Sea, North Atlantic and Norwe-
presence of oil and other possible toxic and flammable material
gian Sea, where the sea is almost never without swell and waves.
which had covered the surface of the water following the explosion.
The Deepwater Horizon had conventional lifeboats. New produc-
One of the final remaining crew members on board the Deepwater
tion installations in the Norwegian sector are required by law to
Horizon, described the problems he faced once he had jumped in to
have free-fall lifeboats. However mobile drilling units in Norway
the sea [July 23, 2010 (DHJIT, 2010)]:
are not required to have free-fall lifeboats as they follow maritime
“Once I hit the water, when I came back up, I couldn’t see anything regulations, and not petroleum legislation.
again because now I’ve got a new set of problems. I’ve got oil, There are some companies which claim that evacuation by
hydraulic fluid, gasoline, diesel, whatever it is that’s floating on the helicopter is the primary evacuation mean. This causes some
water is now burning my entire body. I’m now covered in this confusion. Helicopters cannot be used in situations where fire or
sludge. I don’t know what it is. It’s burning, I can’t hardly breathe, gas clouds are present at the platform. Evacuation via helicopter
but I can feel the heat from the fire underneath the vessel. At that will also take far longer time on installations that demand several
point I started back stroking with the one arm and one leg that flights due to the restricted capacity on each flight (Vinnem, 2008).
would work until I remember feeling no pain, I remember feeling no Helicopter can therefore only be seen as a primary evacuation
heat and thinking that that was it, I had died.” means in situations where the abandonment is planned in advance,
as in the case of hurricanes in the Gulf of Mexico.
The Damon Bankston played a critical role in rescuing and
Explosions, fire and smoke were life-threatening hazards during
providing a safe-haven to personnel who had abandoned the
the EER from the Deepwater Horizon. Experiences from fires in
Deepwater Horizon. The FRC launched by the Bankston not only
buildings can be comparable, although there are some important
rescued crew members from the water; it also rescued the life raft
differences as well. On offshore installations, the crew is familiar
which had been unexpectedly tied to the rig. The rescued crew
with the facility and escape routes. They also participate in regularly
received medical attention on board the Damon Bankston, and the
(usually weekly) muster and lifeboat drills. To determine which
seriously injured were airlifted and evacuated by the USCG from
measures that would reduce the time to make decisions, and which
the deck of the Bankston. The USCG reports that although there was
steps that would lead to people choosing the right egress routes,
no regulatory requirement for a MODU to have a “standby vessel” at
information is needed regarding the HOFs. Of special interest are the
its side for safety purposes or to have its own fast rescue craft, the
perceptions, intentions and motives of the personnel when faced
role Bankston played in saving lives demonstrates the value that
with such situations. Some information is available through the
such requirements could provide (USCG, 2011).
testimonies, but additional information is needed to sort of the
The following is an excerpt from the testimony of the Chief of inci-
importance of the individual factors and their coherence.
dent response for the USCG 8th District [October, 4, 2010 (DHJIT, 2010)]:
One of the important roles of the master of the vessel is to take
charge during a crisis, and to give the order to abandon ship if
Question: “Are you aware of any unique challenges they [USCG] face in necessary. The master should assess the severity of the situation
deepwater emergency response? properly, and if the decision to abandon is made, the master would
Answer: Oh, yes, a number. I mean, it is a fairly confined area. There is
then give the order to launch the lifeboats and evacuate the
nowhere to go other than the water. And also, to get assets there,
floating assets there, it takes quite a while. Roughly, you know,
installation. Lowering the lifeboats at the right time is critically
for – just for the Deeepwater Horizon, we are looking at about important for an effective evacuation, because there are a limited
12 hours to get patrol boats on the scene. number of lifeboats on an installation. If not communicated prop-
Question: Specifically, how do you plan to rescue 126 personnel with, I believe erly, lifeboats can be launched only partially filled, resulting in
you said, 11 helos in the Gulf of Mexico, in an evacuation similar to
personnel being left behind. On the other hand, if members wait
this if there was no DAMON BANKSTON?
Answer: Typically, we don’t have those assets to do that. We rely on our too long to launch the lifeboats, they risk being harmed by the
industry partners out there. And there are a lot of vessels in that area explosions, fire, smoke, and possibly falling objects. The Deepwater
just e for instance, this particular incident kind of sheds a little light Horizon had a split chain of command between the Offshore
on it, and we have e there are a lot of resources out there. Typically,
Installation Manager and the Captain, which seemed to have
we are helping each other out. So that is kind of SOP for us.”
caused confusion as the lines of authority and shift of responsibility
 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158 157

in the event of an emergency seemed unclear to some of the crew USCG scrambled HH-65C Dolphin helicopters when they received
members. The control, behavior and execution of commands the mayday call from Deepwater Horizon. These helicopters have
depend on several human RIFs (ref. Fig. 2). A critical question to be a limit of rescuing 3e4 persons. There is a need for a comprehensive
considered is how can it be relied upon that the master of the vessel analysis of the systems used for the rescue of personnel at sea, life
will be in good enough condition to perform critical tasks in time, rafts and lifeboats in the Gulf of Mexico. The system should include
such as properly assessing the situation, activating the alarm, and the rig owner, industry partners in the area, The Bureau of Ocean
giving the order to muster and abandon ship? This was also Energy Management, Regulation and Enforcement (BOEMRE), as
a problem the crew faced following the explosion on board the well as the UCGS. The capability to quickly and efficiently rescue
Piper Alpha. The crew waited on instructions from the master who personnel at all times should be analyzed. The Norwegian system
had the authority to order an evacuation; however they were not for area based emergency preparedness arrangements (OLF, 2000)
aware that the explosion had destroyed the control room killing should be reviewed for relevance. This system includes use of
most of the personnel inside; therefore valuable time was lost offshore based Search and Rescue (SAR) helicopters as well as fast
waiting for the order to evacuate the installation. In addition, rescue crafts, in order to provide rescue capabilities for the relevant
several of the crew waited for helicopters to arrive, unaware that number of personnel within 120 min from an emergency.
helicopters cannot approach an installation on fire. During a crisis, Training, knowledge, experience, and competence are impor-
it is possible that situations will occur where bypassing the chain of tant throughout all steps of EER operations, and for some steps, it
command is unavoidable and necessary; however, the situation is purely the human actions that can ensure the success of the
must be properly assessed by the individuals such that the result is operation. Emergency drills and training have limitations on
not detrimental to the safety and success of the operations. This can preparing the crew to deal with real-life emergency situations and
be accomplished through proper training of worst case scenarios. unanticipated events. However, proper training and knowledge
It is expected that in some cases, not all members will be able to can give a basic ability to cope with evacuation scenarios. It is
evacuate using the primary means of evacuation and therefore important that emergency drills include the RIFs shown in Fig. 2 to
rescue means are necessary to ensure the safe evacuation of the prepare for EER operations during major accident. HOFs play an
personnel left behind or not able to make it to temporary safe important role in the successful completion as well as the failure
refuge (TSR). As seen in the case of the Deepwater Horizon, there of emergency procedures. Human factor analysis is rooted in the
was a need for secondary means of evacuation. In addition to life concept that humans make errors, and the frequency and conse-
rafts, these can be escape chutes and ladders. Personal survival suits quences of these errors are related to humans, the installation and
with splash protection extend the available rescue time due to hazardous factors. This can only partly be accounted for in the
increased protection from waves and hydrocarbons in the sea. design of equipment, structures, processes and procedures. As
They also extend time before hypothermia. The survival suits stress increases, the likelihood of human error also increases.
should include emergency beacons to improve chances of locating Offshore installations are generally located in harsh environ-
a survivor, as is the case in Norway and the UK. ments, and therefore incidents can cause extremely stressful
Technical systems exist that provide automated real time situations. The consequences of human error in an offshore
accounting of personnel during an emergency evacuation. The emergency can be severe. Extensive knowledge of human
systems provide a list of Personnel on Board (POB) or personnel on behavior when faced with a hazard such as a fire and an explosion
premise, including key data, trade certificates, cabin number, work is essential for the provision of the appropriate measures for safe
area and primary duties during an evacuation or muster drill. At the evacuation and escape from an installation.
check-in point the muster officer and master get a real time report
of who is expected, who is missing and who has shown up at
a secondary muster station. In the event that first responders are 7. Conclusion
called in, management can direct them to the work areas or cabin
numbers of missing personnel. When a major hazard occurs on an installation, evacuation,
Several hazards faced those on the Deepwater Horizon who escape, and rescue (EER) operations play a vital role in safeguarding
prepared to jump to sea. Among those hazards were the height the lives of personnel. Major accidents that quickly escalate and
from the platform deck to the surface of the water from which they include several RIFs such as fire, explosions and smoke are extremely
have to jump, the possible fires on the sea level and smoke inha- challenging. The high number of people evacuated from the Deep-
lation. Ideally, the crew would had to get as close as possible to the water Horizon offers an important, although limited insight into the
water surface before jumping or entering the sea. Under some level of success of the EER operations. Serious failures occurred
circumstances jumping into the sea is necessary, and offshore related to several of the steps in the evacuation sequence, especially
personnel should be trained to do this as safely as possible. related to command and control. It is important that emergency drills
The supply ship Damon Bankston played a vital role in rescuing include worst case scenarios to prepare for EER operations during
the survivors from the Deepwater Horizon. Given the remote major accidents. The consequences of human error in an offshore
location of deepwater operations, nearby vessels play a critical role emergency can be severe. Extensive knowledge of human behavior
in rescuing personnel from offshore installations in the case of when faced with a hazard such as a fire and an explosion is essential
a major accident. Fast response is especially important with a high for the provision of the appropriate measures for safe evacuation and
number of personnel in the sea and/or in the case of bad weather. escape from an installation. There is also a need for a comprehensive
Custom designed third generation rapid response rescue vessels are analysis of the systems used for the rescue of personnel at sea, life
available. They are specially designed to launch and recover a fast rafts and lifeboats in the Gulf of Mexico.
rescue craft or daughter craft from a slipway in the stern. The
slipway can also be used to recover a lifeboat from the sea. The sea
trials of these vessels are promising and it is generally considered Acknowledgments
possible to operate in sea conditions with significant wave heights
of up to Hs ¼ <9 m (Jacobsen, 2010). The authors appreciate the comments and suggestions made by
The distance from shore to the Deepwater Horizon (66 km) the reviewers. Vinnem and Skogdalen appreciate the financial
meant that it did take several hours for rescue boats to arrive. The support from the Norwegian Research Council and Statoil.
158 J.E. Skogdalen et al. / Journal of Loss Prevention in the Process Industries 25 (2012) 148e158

References HSE. (1995). A methodology for hazard identification on EER assessments. Health and
Safety Executive Books.
HSE. (1997). Prevention of fire and explosion, and emergency response on offshore
Aven, T., & Vinnem, J. E. (2007). Risk management: With applications from the offshore
installations. Health and Safety Executive Books.
petroleum industry. London: Springer-Verlag London Limited.
IADC. (2009). Health, safety and environmental case guidelines for mobile offshore dril-
Basra, G., & Kirwan, B. (1998). Collection of offshore human error probability data.
ling units, International Association of Drilling Contractors. (p. 128). Issue 3.2.1.
Reliability Engineering & System Safety, 61, 77e93.
Jacobsen, R. S. (2010). Evacuation from petroleum facilities operating in the Barents
Bellamy, L. J., Geyer, T. A. W., & Wilkinson, J. (2006). Development of a functional
Sea. (p. 47).
model which integrates human factors, safety management systems and wider
Kaiser, M. J. (2007). World offshore energy loss statistics. Energy Policy, 35, 3496e3525.
organisational issues. Safety Science, 46, 461e492.
Kim, H., Park, J., Lee, D., & Yang, Y. (2004). Establishing the methodologies for
Bercha, F. G., Brooks, C. J., & Leafloor, F. (2003). Human performance in Arctic offshore
human evacuation simulation in marine accidents. Computers & Industrial
escape, evacuation, and rescue (pp. 2755e2762). International Society of
Engineering, 46, 725e740.
Offshore and Polar Engineers.
Kobes, M., Helsloot, I., de Vries, B., & Post, J. G. (2010). Building safety and human
Brattbakk, M., Østvold, L., Zwaag, C., & Hiim, H. (2005). Investigation of gas blowout
behaviour in fire: a literature review. Fire Safety Journal, 45, 1e11.
on Snorre A, well 34/7-P31A, 28 November 2004.
Leach, J. (1994). Survival psychology. N.Y.: New York University Press.
Commission. (2010). Meeting 5: November 8e9, 2010. National Commission on the
Leafloor, F. C. (2006). Survey of offshore escape, evacuation & rescue safety systems
BP Deepwater Horizon Oil Spill and Offshore Drilling.
(post Ocean Ranger recommendations).
Cornwell, B. (2003). Bonded fatalities: relational and ecological dimensions of a fire
Leis, B., Chidester, R., Flamberg, S., Olson, J., Rose, S., Aysa, J., et al. (2008). Root cause
evacuation. Sociological Quarterly, 44, 617e638.
analysis of the Usumacinta e KAB-101 incident 23 October 2007.
Cruz, A. M., & Krausmann, E. (2008). Damage to offshore oil and gas facilities
Næsheim, T. (1981). NOU, the “Alexander L. Kielland”-accident. (in Norwegian).
following hurricanes Katrina and Rita: an overview. Journal of Loss Prevention in
Nagai, R., Nagatani, T., Isobe, M., & Adachi, T. (2004). Effect of exit configuration on
the Process Industries, 21, 620e626.
evacuation of a room without visibility. Physica A: Statistical Mechanics and Its
Cullen, W. D. (1990). The public inquiry into the Piper Alpha disaster. London:
Applications, 343, 712e724.
Department of Energy.
Norsok. (2001). Norsok standard: Risk and emergency preparedness analysis, Z-013.
DHJIT. (2010). USCG/BOEM Marine Board of investigation into the marine casualty,
Norwegian Technology Centre.
explosion, fire, pollution, and sinking of mobile offshore drilling unit Deepwater
Øien, K. (2001). Risk indicators as a tool for risk control. Reliability Engineering and
Horizon, with the loss of life in the Gulf of Mexico April 21e27, 2010. Deepwater
System Safety, 74, 129e145.
Horizon Incident Joint Investigation Team, The U.S. Coast Guard (USCG)/Bureau
OLF. (2000). Guidelines for establishing area based emergency preparedness
of Ocean Energy Management, Regulation and Enforcement (BOEMRE) Joint
(in Norwegian). The Norwegian Oil Industry Association.
Investigation Team (JIT).
Park, J. H., Lee, D., Kim, H., & Yang, Y. S. (2004). Development of evacuation model
DiMattia, D. (2005). Determination of human error probabilities for offshore plat-
for human safety in maritime casualty. Ocean Engineering, 31, 1537e1547.
form musters. Journal of Loss Prevention in the Process Industries, 18, 488e501.
Proulx, G. (1993). A stress model for people facing a fire. Journal of Environmental
DNV. (2010). Report OLF/NOFO e Summary of differences between offshore drilling
Psychology, 13, 137e147.
regulations in Norway and U.S. Gulf of Mexico.
PSA. (2008). Free-fall lifeboats safest means of evacuation at sea. Petroleum Safety
Goodwin, S. (2007). Human factors in QRA. Report for International Association of
Authority Norway.
Oil & Gas Producers. Det Norske Veritas Ltd.
PSA. (2010). Regulations relating to health, environment and safety in the petroleum
Graham, B., Reilly, W. K., Beinecke, F., Boesch, D. F., Garcia, T. D., Murray, C. A., et al.
activities (the activities regulations). Petroleum Safety Authority Norway.
(2011). Deep water. The gulf oil disaster and the future of offshore drilling. Report
Sime, J. D. (2001). An occupant response shelter escape time (ORSET) model. Safety
to the President. The National Commission on the BP Deepwater Horizon Oil
Science, 38, 109e125.
Spill and Offshore Drilling.
Skogdalen, J. E., & Vinnem, J. E. (2010). Risk influence factors related to evacuation
Graham, T. L., & Roberts, D. J. (2000). Qualitative overview of some important
from offshore installations, ESREL09. Prague: Taylor & Francis Group.
factors affecting the egress of people in hotel fires. International Journal of
USCG. (1998). 33 C.F.R. x 146.140 emergency evacuation plan. CGD 84-098b, 54 FR
Hospitality Management, 19, 79e87.
21572, May 18, 1989, as amended by USCG-1998-3799, 63 FR 35530, June 30,
Gwynne, S., Galea, E. R., Lawrence, P. J., & Filippidis, L. (2001). Modelling occupant
1998. United States Coast Guard.
interaction with fire conditions using the building EXODUS evacuation model.
USCG. (2011). Report of investigation into the circumstances surrounding the explosion, fire,
Fire Safety Journal, 36, 327e357.
sinking and loss of eleven crew members aboard the mobile offshore drilling unit
Hickman, T. A. (1984). Report one: The loss of the semisubmersible drill rig Ocean
Deepwater Horizon in the Gulf of Mexico April 20e22, 2010. United States Coast Guard.
Ranger and its crew. Royal Commission on the Ocean Ranger Marine Disaster.
Veitch, B. (2003). Evacuation performance. Houston: Offshore Technology Conference.
HSE. (1999). Reducing error and influencing behaviour HSG48. Health and Safety
Vinnem, J. E. (2008). Offshore emergency preparedness, holistic evaluation (in
Executive Books.
Norwegian).