OTC 14159

The Accident of P-36 FPS

Pedro Barusco, Petrobras E&P
Copyright 2002, Offshore Technology Conference
This paper was prepared for presentation at the 2002 Offshore Technology Conference held in
Houston, Texas U.S.A., 69 May 2002.
This paper was selected for presentation by the OTC Program Committee following review of
information contained in an abstract submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Offshore Technology Conference and are subject to
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Offshore Technology Conference or its officers. Electronic reproduction,
distribution, or storage of any part of this paper for commercial purposes without the written
consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print
is restricted to an abstract of not more than 300 words; illustrations may not be copied. The
abstract must contain conspicuous acknowledgment of where and by whom the paper was
presented.

Abstract
The semi submersible platform P-36 was operating in
Roncador Field, in Campos Basin, producing 84.000 bopd,
with capacity to reach the peak production of 180.000 bopd.
On the 15th of March of 2001 an accident took place on board
of the unit causing the death of 11 crewmembers and the
sinking of the platform five days later.
An inquiry commission was formed just after the
accident in order to investigate the causes and set up
recommendations in order to prevent similar events.
This paper describes the methodology applied by the
commission during the investigation phase, the work
developed by them, what happened on board on that day, the
conclusions about the main causes which led to the sinking of
the unit and the recommendations addressing design, operation
and safety of floating offshore units.
The results, conclusions and recommendations relative
to this accident were used by Petrobras as bases to create a
program inside the company called Operational Excellence
Program whose main goal is to implement several actions
toward increasing of the safety of offshore operations.
As for Petrobras, the information disclosed in this
article can help other oil companies improve their
HSE programs.
The detailed description of the events which took place
the moment of the accident until the sinking, the main causes,
conclusions, observations and recommendations of the inquiry
commission and a general picture of the content of the
Operational Excellence Program of Petrobras are addressed by
this article.

Description of the P-36 platform

The P-36, formerly called Spirit of Columbus, was a
floating production unit (FPU) based on a conversion of a
Friede & Goldman L-1020 Trendsetter type semi submersible
platform .It was initially designed and built, in Italy, as a FPU
to operate at 500m water depth, with a capacity to process
100,000 bopd and 2 million cubic meters per day of gas. The
design and construction began in 1984 and ended in 1994.
The field, which it was intended to produce, did not
prove to be commercial during the development phase. As a
consequence it was offered to Petrobras that analyzed the
possibility of converting the unit to produce in Campos Basin.
After the evaluation for use in Marlin South and Roncador
fields, Petrobras decided to select the unit to be the first FPU
of the giant Roncador field.
The main modifications done during the conversion
phase were: complete substitution of the process plant,
installation of a new power generation plant, removal of the
drilling equipment and propulsion system, changing the
mooring system and increasing the payload by the addition of
stability boxes in the pontoons and blisters in the columns.
After the conversion, which lasted from September 1997
to October 1999, the platform had the capacity to produce
180,000 bopd, to handle 7.2 million cubic meters per day of
gas and could be installed at water depths around 1500m.
The P-36 started producing in Roncador field on the 16th
of May 2000, through the Roncador-09 well. When the
accident happened, in March 2001, it was already producing
84,000 bopd and 1.3 million cubic meters per day of gas from
wells located as deep as 1853m.
Figures 1 and 2 show a general view of the unit. It has
two pontoons, four columns, a large central caisson, three
decks called tank top deck, second deck and main deck and
another structure below the main deck were the risers,
pipelines and umbilical were connected.
Figure 3 shows the interior of the starboard aft column
where the accident began. Among several equipment inside
this column, such as piping, waste oil tank, ballast tanks, deaerator for the water injection system and fresh water tank,
there were some which played a role in the accident: the
ventilation system, the emergency drain tank and the cooling
seawater pipe.

P. BARUSCO

Description of the emergency drain system

The emergency drain system of the P-36, shown in Figure 4,
had two tanks of 450 cubic meters capacity each, called
emergency drain tank (TDE), placed on the fourth level of
each aft column. The main purpose of these tanks was to serve
as oil and water storage tank during maintenance of a large
process plant vessel or in case of any emergency in the process
plant.
Both tanks were connected to the oil production header
of the process plant and to the production caisson. A single
line that was used as intake or outtake lines made each of these
connections. The intake branch had a valve, normally opened,
and the outtake branch had a pump and a valve, normally
closed.
The TDEs had a vent system, which was interconnected
to the atmospheric vent system of the process plant.
During normal operation the valves of the outtake lines
remained closed as well as the valves, which connected these
tanks to the production header and caisson, while the intake
valves remained opened. In case of a drainage operation from
any process vessel, the system was aligned with the production
header and the correspondent valve opened.
After the drainage, to empty the TDEs, the intake valves
were closed, the system was aligned to the caisson or
production header, the outtake valves were opened and the
pumps were started up.
Description of the ballast, seawater and firefighting
systems
The seawater system was composed of the original one,
involved in the accident, plus another supplementary system
installed during the up grading phase mainly to supply the
needs of the new process plant.
The original seawater system was in fact a three in
one system because it could supply the process plant with
cooling water, it was used as the secondary ballast system and
it pressurized the firewater ring.
This system had four branches, one in each column.
Each branch had two sea chests and an 18 inches diameter
water pipe connecting the sea chests to the main ring in the
upper deck. This main seawater ring was the only supplier of
the firewater ring. There was a jockey pump, permanently on
duty, to keep pressure in the firewater ring.
There were also four fire pumps, fed by the seawater
ring, remotely operated or automatically controlled by the fire
fighting logics of the central control system of the platform.
Each branch of the seawater system had a high capacity
seawater pump in the correspondent pump room on the
pontoon level. They could keep a flow rate of up to 1550 cubic
meters per hour. The identification of these pumps proved to
be very important in the investigation process:
Portside aft seawater pump...................................... XA-039 A
Portside fore seawater pump ................................... XA-039 B

OTC 14159

Starboard fore seawater pump................................. XA-039 C

Starboard aft seawater pump................................... XA-039 D
In case of a fire alarm the logics of the automatic
control system tried to start, with the highest priority, two
seawater pumps beginning with the pump A, then B and so on,
and two fire pumps. All the valves of the four branches of the
seawater system, including the sea chest valves, were of the
fail-set or fail as is type.
The seawater pumps B and C were fed directly by the
emergency power generator and the pumps A and D could be
fed by the same emergency power generator trough a manual
selection on a back feed switchboard on the central control
room.
The platform had two independent ballast systems. The
dedicated one was powered by the main generators and is not
worth describing because it was a well known and
conventional ballast system for semi submersible platforms.
The other ballast system was the already mentioned three in
one seawater system .The pumps could operate at lower
speeds thus reducing the flow rate down to half of the
maximum capacity.
Main operations before the accident
The inquiry commission classified the operations, which
contributed to trigger the sequence of happenings, in two
groups: the ones executed in the 24 hours preceding the
accident and the other previous operations.
Among the previous operations, which had an influence
in the accident, some can be listed:

The pump of the starboard aft TDE was removed for

repair, its suction and outflow openings were closed with
a blind flange and the outtake valve was closed.
Due to the suspicion that there could be a reverse flow
from the vent pipe of the same TDE the operator closed
the vent with a blind spectacle flange.
The intake valve of the same TDE was closed because
this tank was out of service due to the removal of the
correspondent pump.
There was a task undergoing in order to repair some
cracks in the welds of the stability boxes of the pontoons
(Void tanks 61S and 61P).
Due to the constant failure of the actuators of the sea chest
valves and watertight dampers, the substitution of the
actuators had just begun.
Two seawater pumps XA-039 A and XA-039 B, both
from portside were removed for repairs.

Among the operations done 24 hours before the

accident, which started at 00h 22min on March 15, 2001, the
following shall be mentioned:

OTC 14159

THE ACCIDENT OF P-36 FPS

As the repair of the cracks in the stability boxes finished,

between 18h 00min and 19h 00min the watch stander
decided to open the void tank 61S to ventilate for survey.
As the hatch of the 61S tank was placed inside the ballast
tank 26S, which in turn was contiguous to the pump
room, both tanks 61S and 26S were opened to the
starboard aft pump room in the pontoon.
The operator who opened these compartments came back
from the pump room and reported that the tanks were
open and all the watertight doors, in the pump room and
in the elevator shaft, were closed.
At 22h 21min they decided to empty the portside TDE,
because the level was considered high and the starboard
TDE was out of service. They began the procedure to start
the operation.
At 23h 15min they started to pump oily water from the
portside TDE to the production header.
At 00h 00min an increase was noticed in the production
rate, which indicated the incoming flow in the process
plant from the TDE.
At 00h 22min the first event of the accident took place.

Investigation process
After the accident, Petrobras formed an inquiry commission
with the participation of senior representatives from several
areas of the Company. Moreover other entities were invited to
take part of the commission and have sent representatives such
as the oil workers union and the Federal University of Rio de
Janeiro. A classification society, experienced in major
accidents investigation, followed the investigation process,
giving consultancy and auditing the commission work
development, with the intuit of certifying the final report of
the commission according to the best practices of major
accident investigation.
Besides these people directly involved full time in the
investigation process that took four months to be completed, a
side group of about 60 experts from Petrobras E&P
Department, Research Center and Engineering Service also
collaborated with the commission. Several contracts with
engineering companies were used to investigate specific issues
like explosion analyses, gas dispersion analyses, three
dimensional computer simulations of the accident, etc.
The methodology, shown in Figure 5, included several
steps as data and information collection, construction of the
time line of the accident, establishing hypotheses for the
accident, testing of the hypotheses with the selection of the
plausible ones, checking of the possible hypothesis with the
time line and determining the most probable hypotheses for
the accident. It should be emphasized that the best source of
information was lost, as the platform now lies upside down on
the seabed at more than 1300m of water depth.
During the data and information collection phase, the
design drawings, operational reports, documents from each
phase of life of the unit (design, construction, upgrading,
installation and surveys during and after the accident)

photographs, video tapes were all put together and made

available for the members of the commission. Sixty-four
members of the crew were interviewed, some more than once.
To establish the time line (Figure 6), the records of the
fire, gas and shut down alarm system were used as a basis. The
offshore installation manager has saved these data before the
abandonment of the unit .The remaining information were
collected during the interviews and inserted in the time line.
Many hypotheses for the accident were listed .To
support or to reject each of them it was necessary to perform
several analysis. A complete and detailed stability analysis
was done, for each step between the first events till the
capsizing. Several scenarios of explosions inside the column
were investigated and analyzed as well as a gas dispersion
evaluation. A set of hazard and operability analyses
(HAZOPs) was made with different teams of experts.
Members of the commission visited a platform in the North
Sea, with the same hull design, to check the hypotheses and to
record, in video tape, details of the similarities to the P-36, like
the compartment inside the column where everything started.
The hypothesis considered by the commission were:

Overpressure and rupture of the Emergency Drain

Tank
Rupture of the waste oil tank
Leakage from the gas compression system
Riser failure
Problems in the pontoon bilge system
Blockage of the atmospheric vent system
Hydraulic hammer in the seawater pipe
Collision of a vessel against the platform
Cargo handling problem
Sabotage
Problem with the diesel oil system

After all these tasks, a cross check with the time line
was done for the remaining hypotheses in order to evaluate the
feasibility of each. By using this cyclic approach, making
more and more detailed analyses and cross checking with the
evidences of the time line, the possibilities were discarded one
by one and finally, the commission ended up with one single
and most probable cause for the accident.
Main
analysis
investigations

performed

to

support

the

With the intuit of getting the necessary information to confirm

or to reject the hypothesis selected, for the accident, by the
inquiry commission, some analysis were performed .The
major ones were:

Emergency Drain Tank structural analysis

Analysis of the logs from the gas&fire and shut down
systems
Gas dispersion analysis
Gas explosion analysis

P. BARUSCO

Emergency drain tank structural analysis

The objective of this analysis was to define internal pressure
necessary to break the Emergency Drain Tank on P-36
starboard aft column .A non-linear static analysis was run
considering geometric and material non linearitys .The full
Newton-Raphson approach was applied using the
plastic
shells and beams as element type. The model had 5367 nodes,
5334 shell elements and 1156 beam elements .The software
used was the ANSYS 5.7.The steel was AH-36 with 355 Mpa
yield strength and 490~620 Mpa ultimate strength.
The conclusions reached was that the inner struts broke
when internal pressure reached 7.3 kgf/ cm2 . With the rupture
of the struts, the tank internal
shell deformed like a bubble
th
between the 3rd and 4 floor .A complementary analysis was
carried out to estimate the pressure level at rupture of the
internal shell without struts support .The result showed that
after the rupture of the struts, the internal shell would burst
under a pressure of 10.0 kgf/cm2.
Another additional analysis was carried out to check the
structural integrity of the inlet and outlet connections of the
Emergency Drain Tank pipes and the conclusion was that the
stress levels in the inlet and outlet pipes were lower than those
at other points of tank internal shell and they were not
sufficient to damage the connections.
Figures 7 and 8 show the portion of the Emergency Drain
Tank that was modeled and the result of the analyses of the
stress on the internal shells after the rupture of the struts.
Analysis of the logs from the gas&fire and shut
down systems
The automation and control system concept was based on a
digital control system with high capacity, similar to the
standard architecture used on other units of Petrobras. It
basically had an integration system in charge of controling the
process, fire&gas and emergency shut down systems. There
was another supervisor, safety and interlocking system
addressing the fire&gas, emergency shut down, ventilation
and air conditioning systems.
This supervisor system received information from the
sensors, call points, status of the fire fighting equipments, fire,
smoke and gas detectors as well as from the equipments
involved in the shut down operation such as safety valves,
alarms and, switches from the process plant and from the
power management system.
Before the abandonment of the unit, the offshore
installation manager recorded two back up files on a floppy
disk with the information from the supervisor system. A total
of 11800 logs were recovered (2628 ESD + 9172 F&G Logs).
The period of the logs was from March 14th, 8:00 am to March
15th, 4:42 am .The qualification of the logs was; 5986 alarms
and warnings and 5814 returns and acknowledgment. Before
the first event there were 4506 logs, between first and second
events 1722 logs and after the second event 5572 logs.

OTC 14159

A dedicated group of specialists assembled to give support to

the analysis of the inquiry commission. No logs were
discarded during the analysis. An intensive work was done
based on the design documents and automation logics. An
approach segregated by systems (Ventilation, fire and gas, fire
water, drains, etc) was adopted to support hazardous
operability analysis. This group gave important information
for the gas dispersion and explosion analysis and explosion
propagation, they created a bases of the timeline and found out
how the ventilation system has actuated during the accident.
Gas dispersion analysis
In order to identify the possible sources of gas, that could
result in the effects reported and accordingly with the logs
from the gas detectors, several gas dispersion analysis were
performed. The main objectives were to get the necessary
information to determine what was the cause of the presence
of gas and the consequent damages, to check for other possible
hypotheses of gas leakage, to determinate the development of
the gas dispersion process until the 2nd explosion and to make
the correlation between gas dispersion and other information.
A computational fluid dynamic (CFD) model, with
finite elements was applied, considering transient and nonlinear approach. The external wind and the ventilation system
with its dampers opening and closing during the analysis were
taking into account. The complete model, shown in Figure 9,
had 378.283 elements and 84941 nodes. The output of the
analysis was validated against results obtained from
measurements of existing installations and mass balance for
the ventilation system.
Some analysis deserve being highlighted such as the
leakage from the Emergency Drain Tank and the migration to
upper and lower decks, between the first and second event
(Figure 10), with various gas flows and points of leakage inside
the 4th level of the column and the external leakages from the
fuel gas skid, process skid of turbo compressors and export
header.
Gas explosion analysis
The main objectives of the explosion analysis were to help
validate or reject the hypothesis pointed by the inquiry
commission along the investigation process, to understand the
mechanism of the explosion and to estimate the explosion
pressure.
The model used was able to simulate the ventilation,
dispersion of gas and the explosion itself. It is a 3-dimensional
computational fluid dynamics model with space discretization
by finite volumes.
The first analyses performed was the gas leakage from
the flange at the Emergency Drain Tank with a gas leak rate
between 0.05 and 1 kg/s and two gas composition, 21 and
38kg/kmole, which correspond to the compositions founded in
the first and second stage of the separation process. It should
be emphasized that at that time, the causes for the
pressurization of the tank were unknown.

OTC 14159

THE ACCIDENT OF P-36 FPS

All the main equipments on the 4th level were

considered such as the de-aerator tower, Emergency Drain
Tanks, potable water transfer pumps, waste oil pump, waste
oil tank, seawater supply pipe, piping associated with the
vessels, light fixtures, ladders, ventilation ducts, etc.
The dispersion simulation (Figure 11) was made
considering a total of seven scenarios with leak rate between
0.05 to 1 kg/s, leak jet speed between 10 to 150m/s, leak jet
direction to starboard, up and down and release temperature of
25 deg C.
The main conclusion was that given the strength of the
3rd and 4th decks, and the lack of noticeable damage on the
3rd deck, it would be unlikely that a flammable gas explosion
on the 4th level could cause the seawater pipe to stretch
sufficiently to cause it to rupture. Other purely pressure effects
(Figure 12) from a flammable gas explosion was also unlikely
to rupture the seawater line.
Another gas explosion analysis was the migration of the
gas from the 4th level of the column to the upper parts of the
column, which caused the second event, the big explosion.
The dispersion simulation showed that the 3rd level, open 2nd
level, tank top and 2nd decks could have had explosive gas
concentrations. All of these areas had potential sources of
ignition. The tank top, 2nd, 3rd and 4th level could fill rapidly
with gas. Within 5-10 seconds these areas were basically too
rich to burn, i.e. above the upper flammability limit.
The analysis showed that an explosive gas mixture was
possible in both the 3rd/2nd level or in the tank top. There
were ignition sources available in either of these areas. An
explosion could have produced a high explosion overpressure
up to a maximum of 7.5 barg. More detailed gas dispersion
and explosion simulations of the 2nd event would give a
clearer picture of where the gas cloud ignited and what
flammable mass was involved. These may be of interest but
would be unlikely to change the main conclusions of the P-36
investigation commission.
The first event: mechanical rupture of the emergency
drain tank.
Of all scenarios studied, overpressure and rupture of the
starboard emergency drain tank was considered the most
probable hypothesis.
This starboard TDE was out of service since its pump
was being repaired ashore. Although isolated from the rest of
the drainage system, this tank had its intake/outtake line
shared with the port side TDE (see Figure 4). The TDEs,
although they were structural tanks and resistant to pressures
above the operating pressure, were conceived to operate as
atmospheric tanks, connected to the atmospheric vent system
of the unit. As they were always ready to receive fluids, their
intake/outtake lines were always at normal atmospheric
pressure.
When the pump was taken out from the Starboard TDE,
in February 2001, the intake and discharge pipes were closed
with blind flanges. The manual valve on the tank intake line
was closed, since the tank could not be emptied without the

pump.
Although level measurements did not indicate it, there
was a suspicion that liquids mainly water from deck
cleaning, deluge system and rain were returning to the tank
through the vent line. This vent line was shared with the
hazardous areas open drain gathering vessel, which was
designed to collect the fluids mentioned above. An overflow
of this vessel would, in extreme cases, carry fluids back into
the TDE through the vent line. To prevent this, it was decided
to install blind spectacles on the vent line, which was executed
on March 9.
On March 14, at 22:21h, an operation to drain the other
TDE (Portside) started, with the pump discharge being aligned
with the production header of the process plant, which
operated with oil and gas coming from the production wells at
10 kgf/cm2. Before doing this, the manual intake valve of this
tank was closed and the same valve of the Starboard TDE was
checked and confirmed closed. The next step was to start up
the pump, which was tried several times from the central
control room with no success, since this pump, for safety
reasons, could only be started from the local command panel
located next to the pump. With the intake lines for both TDEs
closed, the remaining intake/discharge lines were filled with
fluid from the production header, at the headers pressure.
This situation remained until 23:15h, when the pump was
finally started locally and water started to flow from the
Portside TDE to the production header. The intake line to the
Starboard TDE was then first under a pressure of at least
10 kgf/cm2, with oil and gas for 54 minutes and, following the
pump start-up, under a maximum of 19 kgf/cm2, with water,
for 1h 17 min, till the first event took place.
Due to an unclear reason, the manual valve on the intake
line of the Starboard TDE allowed fluids to pass into the tank,
which had all its lines blocked, including the vent line. This
fluid intake caused pressure and level to build up inside the
tank. Studies made with the fluids, pressure levels and
durations mentioned above have shown that a flow rate of
about 20% of the full flow through the valve was allowed into
the tank between the operation start-up and the probable
mechanical failure of the tank.
Structural analyses have shown that at around
7.3 kgf/cm2 of pressure inside the tank, the ties connecting the
internal and external tank shell fail. After this failure, the
internal shell should fail when the internal pressure reaches
about 10 kgf/cm2.
Overpressure inside the TDE would cause the internal
shell to deform about 1m inside the fourth column level,
damaging nearby piping (ventilation, tank vents, seawater
service pipe and fire hydrant pipe). After the internal shell
burst, fluids from the TDE flooded the column compartment.
An estimated 1,300m3 of gas, at environment conditions, were
inside the Starboard TDE when it burst.
This bursting caused a great dull thud, like a muffled
explosion or as if a heavy load was set down too heavily on
the deck. Actions were taken to investigate, including sending
the duty fire brigade to the starboard aft column.

P. BARUSCO

The second event: gas explosion.

Once the TDE and probably also the Waste Oil Tank ruptured,
there was enough gas to fill the fourth column level
completely.
The ventilation ducts and the fire brigade actions,
opening the hatches and watertight doors to gain access to the
column interior, propitiated ways for the gas to reach other
areas, such as the Tank Top Deck and the Second Deck.
The water, flooding the fourth column level, pushed the
gas through the opened accesses and accelerated dispersion.
This rich gas mixture, while propagating to other spaces,
mixed with air and, after some time, reached the upper
explosivity level.
So, 17 minutes later the gas, contained inside the column for
the process plant had already shut down automatically and
there were no other gas sources was displaced to the upper
levels and ignited, causing the explosion which killed 11
people from the fire brigade.
During this period of time, a huge number of alarms
and other control information were reaching the control room
operators, making it extremely difficult to work out what was
really happening and to decide what corrective actions to take.
The third event: flooding and sinking
The first event took place inside the fourth level of the
starboard aft column. The Emergency drain Tank (TDE)
ruptured and this also ruptured the service sea water pipe, fire
hydrant pipe and vent pipe for tank 26S, which were near the
ruptured tank shell.
At the time of its bursting, the TDE was almost
completely full of water, oil and gas and all the fluids were
dumped into the fourth level, beginning the flooding process.
As the fire alarm was raised, the control system
automatically started up the service sea water supply for fire
fighting. Two pumps were started, one in the starboard aft
pump room and another in the starboard fore pump room.
Since the sea water pipe was ruptured at the starboard aft
column fourth level, sea water lifted by the starboard aft pump
was in fact filling up the forth column level, increasing the
flooding.
Liquid level (oil and water) inside this column
compartment rose rapidly, reaching the ventilation ducts. The
watertight dampers in this system failed and the liquid
invaded, through the ventilation ducts, all starboard aft
pontoon rooms: pump room, propulsion room, water injection
room and access tunnel.
Tanks 26S and 61S, which had been opened for
inspection, had their access ellipses inside the pump room and
so were also flooded.
After around 7 minutes from the first event, the water
inside the pump room reached the electrical parts of the
seawater pump and it stopped. The valves connecting the
pump intake to the sea chest remained open, as they were of
fail-set type. It is worth stressing that these valves were fail-

OTC 14159

as is and that, since the unit was in fire fighting mode they
would be always open so that sea water could be lifted for fire
fighting purposes.
Flooding then proceeded through the sea chest and also
intermittently by water pumped by the forward seawater pump
through the upper part of the severed sea water pipe. When
this was perceived, the starboard aft section of the seawater
ring pipe was isolated. This took place at about 01:40h on
March 15th. From then on, all flooding was due to the opened
sea-chest valves, till the first down-flooding point was
reached.
By 08:15h, the chain locker hawse pipes began to
submerge, initiating down flooding. A few moments earlier, a
dark gas cloud was seen coming out of the damaged corner
column. This was probably due to the sudden escape of
combustion products trapped inside column compartments and
ascribed to structural failure of dampers or localized structural
failure.
During the first hours of flooding, the ballast control
group added ballast to the Port forward column, trying to
maintain an even keel and permitting normal activities aboard.
After the complete flooding of the aforementioned
compartments, including the chain lockers, a slow flooding of
the starboard aft pontoon tanks began, by way of their vent
pipes, which were already submerged. The column fourth
level was completely flooded and, as all hatches and doors
above were open, the entire column was eventually flooded
(Figure 7).
Simultaneously to the pontoon tanks, deck box
compartments were also being slowly flooded; till water
reached the central caisson and the unit started its final heeling
and sinking.
Conclusions
The conclusions presented hereinafter are the most probable
causes of the accident, because as already mentioned, P-36
was lost and it is extremely difficult to set up absolutely
proved causes. These conclusions are based on reports given
during the interviews, files recorded by the fire&gas and
emergency shut down system, documents recovered from the
platform, design files and reports of the inquiry commission.
The conclusions can be split in two groups: the facts and the
causes.
The facts, it was concluded that an overpressure in the
starboard aft emergency drain tank, placed in the same
column, caused the mechanical rupture of the tank at 00:22h
on March 15th, 2001.
As a consequence oil, water and gas from the ruptured tank
were released inside the fourth level of the column. The tank
rupture also damaged the seawater pipe, which initiated the
flooding process. The gas filled the interior of the fourth level
and migrated to the upper areas of the column.

OTC 14159

THE ACCIDENT OF P-36 FPS

After seventeen minutes, a big explosion was heard, probably

on the second deck of the unit, in the starboard aft area. This
explosion that also caused serious damage all around caught
the members of the fire brigade.
The flooding process was never controlled and the first down
flooding point, which was the inlet of the chain pipes, was
reached speeding up the flooding process. Other vents of
ballast tanks submerged.
Several measures were taken to rescue the unit, such as the
injection of air and nitrogen in ballast tanks and closure of
flooding points, but none of them proved able to revert the
flooding process.
At 00:30h on March 21st, the unit showed an abrupt increase
of inclination and started capsizing. At 11:41h P-36 was
completely under water.
The causes, like other major industrial accident, P-36 sinking
was not a consequence of a single action or mistake. There
was a set of causes that combined in a singular way caused the
accident.
The lack of any of the main causes would modify
completely or even avoid the accident .The inquiry
commission selected the ones listed below, which can be
pointed as the main causes:
An unexpected reverse flow trough the admission valve of the
starboard aft column emergency drain tank, associated with
the existence of a blind spectacle flange on the vent of the
same tank and the absence of a blind spectacle flange on its
admission.
The alignment of the portside aft emergency drain tank
towards the production header instead of towards the
production caisson, allowing the reverse flow.
Delay to start up the drain pump of the portside aft TDE
allowing the reverse flow for a long period.
Failure of the ventilation system watertight dampers actuators,
allowing the water to reach all the compartments served by the
ventilation system.
Opening of the ballast tank 26S and the stability void box 61S,
to the starboard aft pump room, without the existence of a
contingency procedure thus increasing the flooding volume.
Simultaneous removal for repairs of two seawater pumps from
the two portside pump rooms, causing the unit to operate with
a reduced safety margin.

Contingency plans not comprehensive and insufficient training

to operate the ballast system and stability control, in an
emergency situation.

Recommendations
As a result of the accident, the inquiry commission
recommended several actions devised to improve offshore
operations and to enhance safety on board offshore units.
Even before the final report, the inquiry commission
issued recommendations immediately approved and adopted
by Petrobras in its guidelines and directives for the design of
offshore production installations.
The main recommendation, although the practice is in
accordance with relevant international standards, was not to
install pressure vessels and atmospheric tanks, connected to
the production process facilities, inside columns or pontoons.
Units that are nowadays operating in these conditions shall be
reassessed by risk analysis and design re-evaluation.
Just after the P-36 accident, the Brazilian Governmental
Petroleum
Agency-ANP
and
the
Brazilian
Port
Administration- DPC implemented a joint inquiry
commission. The purpose was to perform an independent
investigation to analyze causes and reasons of the accident.
This investigation took place at the same time as the inquiry
commission created by Petrobras.
Conclusions and recommendations from this joint
inquiry commission did not reach differences results from the
Petrobras inquiry commission report. Similar improvement
areas were identified. However two other areas were
considered susceptible to improvements.
A review of the criteria for a number of simultaneous
work permit in offshore activities, especially during
construction, commissioning, maintenance and
offshore operations.
Review the content of the current contingency plans,
to guarantee the implementation of quick emergency
response when the situation can cause stability and
structural risks associated to the risk of sinking.
The recommendations, pointed out by these two inquiry
commissions, were approved by Petrobras which decided to
create a comprehensive program called Operational
Excellence Program - PEO, which would be in charge of
consolidating and implementing the recommended actions.
Actions implemented after the accident
The Operational Excellence Program PEO includes actions
related to offshore activities according to the following
subjects:
Engineering design;
Safety;
Ballast and stability;
Maintenance;

P. BARUSCO

Operation;
Human resources.

A Steering Committee was set up to assure the necessary

leadership .The program follow-up is performed by an
Executive Committee and an Executive Coordinator.To assure
the expertise, for each subject of the program a senior expert
was assigned. These experts are in charge of the consolidation
of the activities related to their subject and adequacy of the
targets and actions in each business unit.
The implementation has basically five steps, mobilization,
critical analysis, customisation, consolidation and audit.
The program started-up on October 1st of 2001 and
shall be concluded by December 31st of 2002. By then all
actions, listed below, shall be implemented and the routines
and procedures shall be part of the normal activities of each
business unit.
Review the activities of the supervision onboard
focusing on operational issues.
Reorganise maintenance activities.
Review the procedures for management of changes,
focusing on risk assessment.
Improve the procedures included in the emergency
plans.
Provide training and refreshment training for ballast
and stability professionals emphasizing emergency
control.
Provide easy and real time acess to updated unit
documents, both on-board and at the onshore base .
Review the procedures of recording and recovering
key operational and safety data to allow the
recuperation of such information before final
abandonment of the offshore unit.
Re-evaluate the Company design requirements and
the E&P safety criteria for offshore units.
Review the criteria to establish the maximum number
of simultaneous work permit in offshore activities.
Review the registration methodology and data
management of accidents and quasi-accidents.
Review actual contingency plans, to guarantee the
implementation of rapid emergency response for
accidents with major stability and structural risks.
With this program, we are taking a step towards the best
practices of the international industries, focusing on a policy to
enhance health, safety and environmental aspects of offshore
activities. In addition, through intensive reporting, Petrobras
plans to contribute to the petroleum industries. This
contribution can help improve operational and safety
performance by selecting safer procedures and practices.
Finally, it should be emphasized that some lessons
learned from P-36 event, such as that a big accident are always
caused by a combination of causes and all the industry should
learn from the accidents like Piper Alpha, Alexander Kielland,
P-36 and so on.
It is important as well to have commitment with the
investigation process and divulgation of the results with clarity

OTC 14159

and openness. Petrobras promoted several presentations about

the accident through internal and external workshops, reaching
directly more than 1600 employees and around 1000 external
people from four different countries. In so doing, we can really
contribute with the industry reducing significantly the risk of
similar accidents.
References
1.
2.

Final report of the P-36 Accident Inquiry Commission,

June 20th 2001.
P-36 accident report Joint Inquiry Commission,
ANP/DPC, July 2001.

OTC 14159

THE ACCIDENT OF P-36 FPS

Figure 1 : General view of P-36 during dry tow from Canada to Brazil

Tank Top Deck

Main Deck

MAIN

Second Deck

Fairlead Box

Stability Box

Figure 2 : General view of the starboard aft column where the accident took place

10

P. BARUSCO

OTC 14159

SECOND DECK
TANK TOP

EMERGENCY
DRAIN TANK

THIRD LEVEL

VENTILATION PIPE

FOURTH
LEVEL

SEA WATER
OUTLET PIPE

FIFTH
LEVEL
Figure 3 : Starboard aft column internal details

PRODUCTION
HEADER

ATMOSPHERIC
VENT

CAISSON

CAISSON
VALVE

HEADER
VALVE

BLIND
SPECTACLES

PORTSIDE
EMERGENCY
DRAIN TANK

STARBOARD
EMERGENCY
DRAIN TANK

BLIND FLANGES
KEY:
OPEN VALVE
CLOSED VALVE
SEMI-OPENED VALVE

Figure 4 : Emergency drain system diagram

OTC 14159

THE ACCIDENT OF P-36 FPS

Witness Statements

Scope of Accident
Inquiry

Photos Videos

11

Computer Records

Documentation

Scope of
Verification
by DNV

Constructing Timeline of Accident

Establishing Hypotheses
Testing the Hypotheses

HAZOP

Stability
Analysis

Dispersion
Model

Explosion
Analysis

Interaction Timeline/Hypothesis

Visit Jack
Bates

Documentary
Analysis

Rejected Hypothesis
Final Report

Analysis of
Management

Formal Accident
Inquiry

Immediate Causes
Basic Causes
Recommendations

Figure 5 : Investigation methodology used by the inquiry commission

Figure 6: Time line sample sheet showing the number of the register , month , day , time , system
(Ballasting,ventilation,fire water..) and the description of the event.

12

P. BARUSCO

OTC 14159

Strut
Strut

InternalShell
shell
Internal

Figure 7 :Emergency Drain Tank portion used for

the computational structural analysis

Equivalent Stress
(p=9.9 kgf/cm2)

Figure 8: Stress in the internal shell of the Emergency Drain Tank

OTC 14159

THE ACCIDENT OF P-36 FPS

13

Figure 9 : Computer models used in the gas dispersion analysis.The global and the starboard aft column models

Figure 10: Result of the gas migration analyses from the 4th level of the column to upper and lower levels
after the mechanical rupture of the Emergency Drain Tank.

14

P. BARUSCO

OTC 14159

Figure 11 : Gas dispersion analyses in the 4th level of the column simulating a leakage from a
flange.Jet speed 0,05 to 1,00 kg/s,jet direction to starboard,up and down,release temperature 25 C.

Figure 12 : Pressure inside the 4th level of the column owing to a gas explosion in the
same compartment.

OTC 14159

THE ACCIDENT OF P-36 FPS

15

March 19 - 11h55min

Figure 13 : Situation on March 19th,at 11h55min.The starboard aft column is completely underwater
40.00

Heel
(degrees)
Anguangle
lodead
ernamento(graus)

35.00

30.00

25.00

20.00

15.00

10.00

5.00

Time from 15/03/2001

0.00
3/15/01 00:00

3/16/01 09:20

3/17/01 18:40

3/19/01 04:00

Tempo (a partir de 15/03/2001)

Figure 14 : Heel angle of the unit from March,15th ,00:00 to 20th 13:20min

3/20/01 13:20

16

P. BARUSCO

Figure 15: Final sinking at 11h41min of March,21st.

OTC 14159