Investigation Report Unofficial translation Report Report title Activity number Investigation of the incident "Man over board resulting in fatality on Saipem 7000 on 12 August 2007"

12F11

Classified

Public Exempt publ. disc.

Restricted Confidential

Highly confidential

Summary A 48-year-old Philippine sailor died on Sunday, 12 August 2007 on Saipem 7000 in connection with installation of the Tordis subsea separator. He fell into the sea from a winch platform approximately 30 meters above sea level and drowned. Statoil is the operator of the Tordis field, and the installation of the module constitutes part of the expansion of the Tordis subsea facility for improved recovery of reserves. The work was performed using the lifting vessel Saipem 7000. The work is part of a framework contract between Statoil and Saipem UK Ltd. The deceased was a member of a work team consisting of four people that worked together near a winch with a hydraulic hose on its reel, on the right hand side of Crane 1 on the port side of the vessel. The hose went from the winch via a sheave in the crane boom down to the module itself. The sheave had become stuck, resulting in tension in the hose from the sheave down to the module and slack from the sheave down to the winch. A loop of the hose was laying on the winch platform next to the winch after failed attempts to free the hose. The deceased was in all probability hit by the hydraulic hose as it suddenly was tightened. The person in question was then either hit or pushed over the railing by the hose.

Involved Main group Approved by / date T1-StatoilHydro Kjell Arild Anfinsen

Members of the investigation team Investigation leader Sigurd Jacobsen Bjørn Olsgård

Oddvar Øvestad

2

Contents 1 SUMMARY...................................................................................................................... 3 2 INTRODUCTION ............................................................................................................ 4

2.1 PSA investigation team ........................................................................ 4 2.2 Mandate ................................................................................................ 4 2.3 PSA follow-up of the incident.............................................................. 4 2.4 Method.................................................................................................. 5

3 COURSE OF EVENTS .................................................................................................... 5 4 INCIDENT POTENTIAL................................................................................................. 9

4.1 Actual consequences ............................................................................ 9 4.2 Potential consequences......................................................................... 9

5 OBSERVATIONS.......................................................................................................... 10 5.1 Nonconformances............................................................................... 10

5.1.1 Nonconformance: Incorrect design of sheave arrangement. .. 10 5.1.2 Nonconformance: Deficient engineering and risk assessment10 5.1.3 Nonconformance: No evaluation of the use of technology to reduce risk 11 5.1.4 Nonconformance: Deficient analysis of risks and understanding of risks 11 5.1.5 Nonconformance: Deficient distribution of responsibility and communication lines........................................................................... 12 5.1.6 Nonconformance: Deficient handover/communication ......... 12 5.1.7 Nonconformance: Deficient follow-up by operator ............... 13

6 DISCUSSION REGARDING UNCERTAINTY........................................................... 14 7 APPENDICES ................................................................................................................ 14

3

1 SUMMARY A 48-year-old Philippine sailor died on Sunday, 12 August 2007 on Saipem 7000 in connection with installation of the Tordis subsea separator. He fell into the sea from a winch platform approximately 30 meters above sea level and drowned. Statoil is the operator of the Tordis field, and the installation of the module constitutes part of the expansion of the Tordis subsea facility for improved recovery of reserves. The work was performed using the lifting vessel Saipem 7000. The work is part of a framework contract between Statoil and Saipem UK. The deceased was a member of a work team consisting of four people that worked together near a winch with a hydraulic hose on its reel, on the right hand side of Crane 1 on the port side of the vessel. The hose went from the winch via a sheave in the crane boom down to the module itself. The sheave had become stuck, resulting in tension in the hose from the sheave down to the module and slack from the sheave down to the winch. A loop of the hose was laying on the winch platform next to the winch after failed attempts to free the hose. The deceased was in all probability hit by the hydraulic hose as it suddenly was tightened. The person in question was then either hit or pushed over the railing by the hose. The Petroleum Safety Authority (PSA) appointed an investigation team on the same day, which also assisted the police during their investigation of the accident. The mandate of the investigation team includes mapping the course of events, identifying direct and root causes and identifying any lack of compliance with regulations. The investigation has identified the following nonconformances:

• Incorrect design of sheave arrangement • Deficient engineering and risk assessment • No evaluation of the use of technology to reduce risk • Deficient analysis of risks and understanding of risks • Deficient distribution of responsibility and communication lines • Deficient handover/communication • Deficient follow-up of operator

Nonconformances have been identified at both Statoil and Saipem.

4

2 INTRODUCTION A 48-year-old Philippine sailor died on Sunday, 12 August 2007 on Saipem 7000 in connection with installation of the Tordis subsea separator. He fell into the sea from a winch platform approximately 30 meters above sea level. The MOB (Man Over Board) boat was launched and reached the last observed position of the deceased within three to four minutes. In spite of the fast emergency response, it proved impossible to reach the person before he was observed sinking in the sea. He was found drowned on the seabed at a depth of 200 meters after approximately 1.5 hours by the vessel's ROV (Remotely Operated Vehicle). Statoil is the operator of the Tordis field, and the installation of the module is part of an expansion of the Tordis subsea facility to improve the recovery of reserves. The work was performed using the lifting vessel Saipem 7000. The work is part of a framework contract between Statoil and Saipem UK.

2.1 PSA investigation team

Statoil notified the PSA of the incident on 12 August 2007 at 11:45 hours in accordance with the requirements. The PSA established an investigation team to assist the police during their investigation, as well as to carry out a separate investigation of the incident. The members of the PSA investigation team were as follows: Oddvar Øvestad Investigation leader, Discipline area logistics and emergency

preparedness Sigurd Jacobsen Discipline area logistics and emergency preparedness Bjørn Olsgård Discipline area logistics and emergency preparedness (from 15 August

2007)

2.2 Mandate Mandate for the investigation team: 1. Assist the police 2. Map the course of events 3. Identify direct and root causes with focus on Man, Technology and Organisation (MTO) 4. Map and evaluate emergency preparedness issues, including responsibilities,

communication lines and available emergency response equipment 5. Identify lack of compliance with regulations, recommend further follow-up as well as

identify any need for policy instruments 6. Report status internally 7. Evaluate resource requirements and identify any need for assistance

2.3 PSA follow-up of the incident

5

There was an official inspection after the PSA and the police arrived on Saipem 7000 on Monday, 13 August 2007. The installation of the subsea module was completed on Sunday, 12 August 2007 (after stopping for a few hours) after consultation with the police and the PSA. There was no reconstruction of the incident, partly because of the practical challenges involved in carrying out a simulation, but also because the course of events and physical causes were sufficiently clarified after the inspection at the scene and reading Saipem's internal incident report. Information was obtained from leading personnel on the installation, from the crew that participated in the operation on the winch platform and from personnel that worked on the main deck through questioning by the police with the PSA present. In addition to questioning on board, there were also meetings with Statoil in Stavanger and Saipem UK Ltd. in London. The purpose of these meetings was to ascertain the responsibilities for engineering, execution of the activity and follow-up in relation to applicable regulatory requirements. Video recordings and still images of the activities on board Saipem 7000 before, during and after the accident have been reviewed. The investigation team stayed on the installation for 4 days. An overview of documents reviewed in connection with the investigation is available in Appendix B. A list of personnel that have participated in questioning, interviews or meetings is available in Appendix C.

2.4 Method A Man, Technology and Organisation (MTO) diagram describing the course of events and direct and underlying causes as well as nonconformances is available in Appendix A.

3 COURSE OF EVENTS The lifting operation was planned through engineering and preparation of an installation manual and associated risk assessments (HAZID/HAZOP). This work had taken more than one year and had been performed by Saipem UK in London. The handover and review of the project were carried out at a separate meeting on board Saipem 7000. The Safe Job Analysis (SJA) was performed by personnel on board Saipem 7000. On the day before the accident took place, the module was prepared and rigged, and there were only a few final preparations left before the module could be lifted clear of the deck and installed on the seabed. As the work was to continue past midnight, an ordinary shift meeting and toolbox meetings were held for the ongoing shift between 11 and 12 August 2007 (shift plan 00 to 12).

6

At approximately 07:00 hours on 12 August 2007 the lifting operation itself commenced. Lashings were removed and the module was lifted clear of the deck. The person responsible for the lift held a meeting with relevant leading personnel, with special focus on the high risk activity of installing lanyards between the crown blocks and guide lines. At approximately 08:00 hours the module was hanging in the two co-lifting cranes over the side of Saipem 7000, and the work of connecting the lanyards between the crown blocks and the guide lines could be performed. After the guide lines were connected, the operation continued and the module was lowered into the sea. The module was lowered down to a depth of approximately 190 meters, where there was a break in the lifting operation to allow for a survey of the seabed and a final check of the position, before the module was landed on the seabed.

The module being lowered Winch platform The accident took place at approximately 10:18 hours, shortly after the lowering of the module had stopped. "Man over board" was shouted and a life buoy thrown down on the sea. The rescue operation was initiated immediately and the MOB (Man Over Board) boat was launched. The deceased sank shortly thereafter. He was found on the seabed at a depth of 200 meters after approximately 1.5 hours by the vessel's ROV. Detailed description of the work and the incident The deceased was a member of a work team consisting of four people that worked together near a winch with a hydraulic hose on its reel, on the right hand side of Crane 1 on the port side of the vessel. The crew consisted of an Italian supervisor, an Italian mechanic and two

7

Philippine engine men. They were responsible for operating a winch with local controls and a hydraulic hose on the reel. The hose was routed from the winch via a sheave in the crane boom down to the module itself. The purpose of the hydraulic hose was to provide hydraulic power for the release mechanism for hydraulically operated shackles that connected the slings to the subsea module. When the module had landed on the seabed, the hydraulic shackles were actuated and the slings disengaged and lifted back on deck. In order to avoid tension in the hydraulic hose during the lowering of the module, the hydraulic hose had to be reeled out. This was done by operating the winch locally using the control lever fastened to the winch.

Hydraulic hose

Winch platform

It was observed early on during the lifting operation that the hydraulic hose was in contact with the barrier chain on the winch platform in front of the winch. There are two chains fitted in front of the winch to protect against falling into the sea. The hydraulic hose was initially routed between these two chains. To prevent the hydraulic hose from being in contact with the upper barrier chain, this chain was removed to allow the hydraulic hose to pass without any

8

obstacles. After a while, the upper chain was put back in place, and the hydraulic hose could now freely pass above the upper chain. It was observed early that there was tension on the hydraulic hose between the sheave and the module, while it was hanging slack between the sheave and the winch. It was concluded that the disc on the sheave was in contact with the crane boom structure, thus preventing it from rotating freely.

Sheave arrangement

Contact point between sheave and crane boom

Hydraulic hose sheave - winch

Hydraulic hose sheave - module

The work team by the winch thought they were told by the rig foreman to shake/pull the hydraulic hose in an attempt to free it and allow it to pass over the sheave. This shaking did to some extent make it possible for the hose to pass through the sheave, but for the work team on the winch platform the problem appeared to increase as the module was lowered down into the sea. When the lifting operation was stopped at a water depth of 190 meters (10 meters above the seabed), there were several attempts to make the hose clear the sheave by shaking the hose. In addition, the hose was reeled out to ensure more slack so that it could be pulled sideways. These attempts were abandoned, however, when it proved impossible to have the hose pass through the sheave. It was hoped that the problem would resolve itself when the module was lowered further. As a result of having paid out slack and pulling the hose sidewise, there was now a 3-4 meter long loop of the hydraulic hose lying on deck. Two persons moved away from the area, while the deceased and one more person remained standing in the area where the loop in the hose was located. It is assumed that the deceased was standing inside the loop.

9

Image showing the location of the work team on the winch platform

Motor man

Deceased

Mechanic

Foreman

Nothing abnormal was noticed before the deceased was observed falling down towards the sea. It was stated that no one in the work team by the winch had seen or heard how the deceased fell into the sea. They only observed that the hydraulic hose had been tightened. Based on this, it is probable that the hydraulic hose, which had tension between the sheave and the module, could pass freely over the sheave, thus tightening the slack in the hose between the sheave and the winch. It is assumed that the deceased was hit by the hydraulic hose as it was tightened. The person in question was then either hit or pushed over the railing by the hose.

4 INCIDENT POTENTIAL

4.1 Actual consequences

The actual consequence of the incident was that a person fell over board and drowned.

4.2 Potential consequences

There were several persons working on the hydraulic hose earlier in the day and just before the accident took place. Several persons could have been injured when the hose was tightened. Several persons could also have fallen over board.

10

5 OBSERVATIONS

The PSA's observations are generally divided into two categories: • Nonconformances: This category is for observations that, in the opinion of the PSA,

indicate lack of compliance with regulatory requirements. • Improvement items: Used for observations of deficiencies, but where the information is

insufficient to prove a lack of compliance with regulatory requirements. This investigation has only identified nonconformances.

5.1 Nonconformances

5.1.1 Nonconformance: Incorrect design of sheave arrangement. Incorrect design of the sheave arrangement resulted in the sheave itself being prevented from rotating freely and in tension in the hydraulic hose from the sheave arrangement and down to the subsea module. When this tension was released and the hydraulic hose tightened and hit the deceased, this most likely resulted in this person being knocked over board and drowned. Grounds: The rigging of the sheave arrangement did not take into consideration the steep angle of the boom for Crane 1 on the port side of the vessel. The design of the arrangement resulted in a collision between the sheave and steel structure of the crane boom, thus preventing the sheave itself from rotating freely. An open sheave was used where the sheave was not protected against contact with surrounding structures. Verification or testing of the functionality of the sheave arrangement was not part of the rigging operation prior to the lift. Requirements:

• Section 1 of the Management Regulations on risk reduction • Section 28 of the Activities Regulations on actions during conduct of activities

5.1.2 Nonconformance: Deficient engineering and risk assessment The engineering and risk assessments of the sheave arrangement for supporting the hydraulic hose in the crane boom were deficient. Grounds: The arrangement around the sheave for supporting the hydraulic hose in the crane boom was not included in the detailed engineering, and the solution was improvised. The interviews showed that the selected solution was copied from another project. It was not taken into consideration that the angle was steeper because the crane boom was at a steeper angle, thus making it impossible to copy the previous solution. As the sheave arrangement was not part of the detailed engineering, it was also not included in the risk assessments (HAZID/HAZOP) during the design and engineering phase. The HAZID/HAZOP processes also did not identify this issue. Requirements:

11

• Section 27 of the Activities Regulations on planning

5.1.3 Nonconformance: No evaluation of the use of technology to reduce risk An evaluation of the use of technology to reduce personnel risk could not be presented. Grounds: The investigation showed no evaluation of whether to install constant tension control and/or remote operation of the hydraulic hose winch or use of other technology in order to reduce the number of persons and thus the risk for personnel working on the winch platform. The review of pictures and film also show that the solutions selected involve a large number of persons working in high exposure areas, for example during rigging of anti-spin guide lines and the work being performed on the winch platform. It was also observed that there was a person on top of the module during the tensioning of the slings. No documents have been presented to confirm that the use of personnel for carrying out activities in exposed areas is optimum as regards ensuring the lowest possible risk. There is also no documentation showing risk-reducing measures implemented out of consideration for personnel safety. Requirements:

• Section 1 of the Management Regulations on risk reduction • Section 27 on planning and Section 31, first subsection, first sentence of the Activities

Regulations on arrangement of work (..., and so that the probability of mistakes that can lead to situations of hazard and accident, is reduced.)

5.1.4 Nonconformance: Deficient analysis of risks and understanding of risks The analysis of risks was inadequate for execution of the work. Grounds: The Safe Job Analysis (SJA) does not analyse the risks for the activities related to the hydraulic hose. The shift meeting and toolbox meeting did not focus on safety and risk issues related to the activities on this day other than the use of personal protective equipment. Personnel are located in strategic places with regard to problems that may arise during the operation. There was no definition of which problems could appropriately be remedied without further planning and analysis of risks. It appears that the personnel on board were not sufficiently trained in stopping, planning and assessing risks in the event of unforeseen changes. The deceased was wearing a safety harness, but it was not fastened at the time of the accident. This is not required as long as the person is located on a platform with railings. However, the investigation showed that the personnel on the winch platform carried out work in front of the winch with the barrier chain removed without using the safety harness. This continued until it was pointed out by the leader.

12

Pictures reviewed in connection with the investigation also show one person supporting himself on the tensioned hydraulic hose. Requirements:

• Section 25 of the Activities Regulations on critical activities

5.1.5 Nonconformance: Deficient distribution of responsibility and communication lines

The investigation showed deficient allocation of responsibilities in addition to ambiguous communication lines. Grounds: The SJA did not allocate responsibility for follow-up of risk factors for the work on the winch platform with the hydraulic hose or other surrounding activities related to the lifting operation. There was no work specification for the personnel. Four leading personnel (operation manager, lift responsible leader, mechanical foreman, rig foreman) discussed the problem that had occurred with the hydraulic hose via radio. The supervisor for the winch platform was not involved in this discussion. Someone on the deck (not formally a leader) said to shake the hose. The supervisor on the winch platform assumed this to be an order from the deck/"leader group" to shake the hose to allow it to pass over the sheave that was stuck. During the further lowering of the module, the person responsible for the lift checked the status of the hydraulic hose and sheave twice with the rig foreman without involving the supervisor on the winch platform. There was no direct communication between the supervisor on the winch platform and his superior in spite of the fact that both were equipped with radios and used the same channel. Requirements:

• Section 3 of the Management Regulations on management of health, environment and safety

5.1.6 Nonconformance: Deficient handover/communication The handover of the project to Saipem 7000 was deficient. There was also deficient communication regarding risk factors that had been identified and documented during the SJA process at the shift meeting and toolbox meeting. Grounds: The handover and review of information from the project to the executive section on board Saipem 7000 was handled at a meeting lasting 25 minutes. During the meeting, the project reviewed the general activity plan step by step. There was no review of the HAZID /HAZOP or other risk assessments at this handover. According to the procedure, the shift meeting is intended to be a review of planned activities and related safety issues. The minutes show that the meeting does not address issues related to

13

safety in connection with individual activities, but is a meeting for review of the work program for the ongoing shift. According to the minutes, the toolbox meeting does not address issues related to safety in connection with individual activities, but is a meeting for reviewing the work program for the ongoing shift in addition to focusing on the use of personal protective equipment, checking of tools, isolation of equipment to be worked on and the use of chemicals. The investigation showed that the person responsible for the lift ordered the lifting operation stopped at a water depth of 190 meters. This order was intended to include all activities associated with the lifting operation, but it was not perceived this way by the personnel working on the winch platform. Thus, the work of trying to make the hydraulic hose run freely over the sheave continued after the stop order was given. The investigation has shown that the personnel that participated in the lifting operation spoke different languages (Italian, English and Philippine/Indonesian). Risk assessments such as HAZID/HAZOP and SJA are documented solely in English, and the risk factors identified must be safeguarded by those performing the lifting operation. In addition, the personnel participating in the lifting operation must also contribute additional details during the risk assessments. Language barriers will prevent this flow of information. Important governing documents, such as Lifting Operations, Work Permit System, Safe Job Analysis, are only available in English. Requirements:

• Section 12 of the Management Regulations on information • Section 83, second subsection, second sentence of the Activities Regulations (The party

responsible shall ensure that the communication takes place in a clear and unambiguous way and without disturbance.)

5.1.7 Nonconformance: Deficient follow-up by operator The operator's follow-up was deficient. Grounds: Interviews of leading personnel on board show that Saipem 7000 complies with maritime regulations in addition to the Installation Manual prepared for installation of the module. There is no documentation or any other form of communication that has specified vis-à-vis Saipem 7000 that the relevant requirements are those stipulated in the petroleum regulations. The fault resulting from not reviewing the risk factors at the handover of the project/project documentation from engineering to Saipem 7000, was not pointed out by Statoil. Statoil was represented at this handover. No representatives of Statoil have participated in, reviewed or provided comments regarding the SJA. Statoil has not made any HSE observations on board. Statoil has not reacted to the fact that many people had to break barriers to perform their work. Statoil's representatives on board have also not reacted to technical aids not being used to a greater extent rather than a large number of personnel for certain sub-activities.

14

No HSE issues have been pointed out during the daily meetings between the operation manager and the company's representative on board (SR). Statoil has not reacted to the Italian language being used as a working language during the lifting operation and that this reduces the opportunity for participants speaking other languages to know what is being communicated. Requirements:

• Section 5 of the Framework Regulations on the supervision obligation

6 DISCUSSION REGARDING UNCERTAINTY No one saw the deceased from the time he was observed on the winch platform until he was falling towards the sea. The deceased was in all probability hit by the hydraulic hose as it suddenly was tightened. The person in question was then either hit or pushed over the railing by the hose. This is also supported by the deceased's injuries as indicated in the autopsy report. There are some contradictory statements regarding what was said in connection with the problems that had occurred in connection with the hydraulic hose and the sheave. However, there are no contradictory statements as regards the lack of communication between the responsible supervisor on the winch platform and the person responsible for the lifting operation.

7 APPENDICES A: MTO incident and cause analysis. B: The following documents have been taken into account during the investigation:

Received on board Saipem 7000: • Doc. No. S7000-HSE-033-E report no 058/2007 dated 12 August 2007 "Event Report" • Folder containing:

- Doc. No S7000-PRO-HSE-06-E Man Riding Lifting Operation Plan (Guidance) - Man Over Board Time Report - Master Report - Medical Report - Periods on Board Report (deceased) - Doc. no. S7000-MAN-SMME-E "Ship Organization Chart" - Doc. no. TIOR-SAI-A-RD-2021 page 12 "Project org. chart for installation" - Crew list of 11 August 2007 - List of deck personnel 12 August 2007 - Time Sheet (deceased) - S 7000 Tool Box Talk Report Mechanics 12-08-2007 - Doc. no. S7000 HSE-029-E 08/09/10.08.2007 Safe Job Analysis - Doc. no. S7000-PRO-HSE-18-E "Work Permit System"

15

- Doc. no. TIOR-SAI-A-RD-2019 "Emergency Preparedness Analysis" - Documentation of completed training (Four persons working on the winch

platform) - Arrangement drawing for installation of the module - Doc. no. S7000-HSE-036-E "Site Event Report Log" (20-29.06.2007) - Minutes 11 August 2007 23:30 hours "Daily Work Program & Supervisor’s

Safety Meeting" - TIOR-ARI-001 "Agreement to Resume Installation" dated 12 August 2007 - Documentation of winch involved in the incident - Personnel details (deceased)

• Document no. S7000-PRO-HSE-06-E "Lifting Operations" (obtained upon request) • Several drawings prepared in connection with the installation. (obtained upon request)

The following documents have been received upon request afterwards:

• Hazid and risk analysis Tordis SSBI Transportation and Installation • Hazop Sea transport and installation of SSBI structure Tordis IOR project • Received at meeting on 24 August 2007 with Statoil: Contract No. SAP 4501000548

for Transportation and installation of the Tordis SSBI structure • Received at Statoil on 28 August 2007: Audit Report UPN PTT 03-03 Saipem UK

HSE Audit • Received after the meeting at Statoil on 28 August 2007:

o CD with copies of pictures from the lifting operation. o "Notes of meeting" – S7000 Daily Meeting 11 August 2007, Tordis o Work specification for function manager for marine and heavy lifts o Saipem Procedure Doc. No. GP-SUK-QHSE-313 "Accident Investigation"

C: List of personnel that have been questioned, interviewed or participated in meetings (not available on the Internet)

NAME FUNCTION COMPANY START-UP MEETING

INTERVIEWED DURING INVESTIGATION

SUMMARY MEETING

D: Abbreviations: HAZID Hazard Identification HAZOP Hazard and Operability HSE Health, Safety and the Environment MOB Man Over Board MTO Man Technology Organisation PSA Petroleum Safety Authority ROV Remotely Operated Vehicle SJA Safe Job Analysis SR Company Representative