Brazilian Navy Directorate of Ports and Coasts

Superintendence of Waterway Traffic Safety

Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

BRAZILIAN NAVY
DIRECTORATE OF PORTS AND COASTS

MARITIME ACCIDENT SAFETY INVESTIGATION REPORT

FPSO CIDADE DE SO MATEUS

EXPLOSION FOLLOWED BY FLOODING WITH CASUALTIES.

TH
FEBRUARY 11 2015

FPSO Cidade de So Mateus on the day of the investigation.

Reference
Accident Investigation Code of the International Maritime Organization
MSCMEPC.3/Circ.2 13 June 2008/Resolution MSC.255(84)
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

TABLE OF CONTENTS

LIST OF ACRONYMS ..................................................................................................................................... 2

I INTRODUCTION ...................................................................................................................... 3
II BACKGROUND ....................................................................................................................... 3
III GENERAL INFO ...................................................................................................................... 3
IV ACCIDENT SITE INFO ............................................................................................................ 7
V HUMAN FACTORS AND CREW ............................................................................................. 7
VI TIMELINE OF THE EVENTS ................................................................................................... 8
VII POST-ACCIDENT PROCEDURES ......................................................................................... 11
VIII ACCIDENT CONSEQUENCES ............................................................................................... 11
IX EXPERT SURVEYS ................................................................................................................. 20
X CAUSAL FACTORS AND ANALYSIS ..................................................................................... 20
XI PRELIMINARY LESSONS LEARNED AND CONCLUSION ................................................... 36
XII SAFETY RECOMMENDATIONS ............................................................................................. 38
XIII LIST OF ANNEXES ................................................................................................................. 39
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

LIST OF ACRONYMS

ABS Classification Society American Bureau of Shipping

ANP National Agency of Petroleum, Natural Gas and Biofuels

AJB Brazilian Jurisdictional Waters

CCM Engine Control Center

CPES Ports Authority of the State of Espirito Santo.

DHN Directorate of Hydrography and Navigation

DNV-GL Det Norske Veritas/Norway and Germanischer Lloyd/Germany

DPEM Mandatory Insurance of Personal Injury Caused by Vessels or Cargo.

MSDS Material Safety Data Sheet

FPSO Stationary Unit of Floating, Production, Storage and Offloading of Oil and Gas Export

OIM Offshore Installation Management

IMO International Maritime Organization

ISAIM Safety Investigation of Maritime Accidents and Incidents

ISM Code International Safety Management Code

MCA Auxiliary Combustion Engine

NR 33 Regulatory Standard No. 33 Safety and Health at Works in Confined Spaces

HSEQ Health, Safety, Environment and Quality.

STCW 78 International Convention on Standards of Training, Certification and Watchkeeping for

Seafarers, 1978.

VHF - Very High Frequency (from 30 MHz to 300 MHz).

2
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

I INTRODUCTION
With the purpose of gathering and analyzing evidences, identifying causal factors and preparing
the safety recommendations deemed required in order to prevent future similar maritime accidents
and/or incidents, the Directorate of Ports and Coasts (DPC) performed this Safety Investigation of
Maritime Accidents and Incident in compliance with the extent set out in the Investigation Code for
Maritime Accident Investigation of the International Maritime Organization (IMO) adopted by
Resolution MSC.255(84).
This Final Report is a technical document reflecting the results obtained by the DPC regarding the
circumstances that contributed or may have contributed to trigger the occurrence and therefore it
makes no use of any proof-related procedures to ascertain civil or criminal liability.
Notwithstanding, it must be highlighted the importance of safeguarding the individuals in charge of
providing the information related to the occurrence of the accident, and the use of the information
herein for purposes other than preventing future similar accidents may induce to erroneous
interpretations and conclusions.

II BACKGROUND
th
On the morning of February 11 , 2015 onboard FPSO CIDADE DE SO MATEUS, it was being
performed the transfer of water and condensate mix from the central cargo tank 6C to the portside
slop tank with the purpose of inspecting it and testing its valves. This operation started at 8:53am by
starting the stripping pump installed in the pump room. At 11:30am the closed-circuit television (CCTV)
displayed a leak of condensate in a stretch of the pump discharge main and immediately after a gas
alarm was automatically sounded. Following that occurrence, decisions were made, actions were
deployed and the crisis reached its peak with an explosion within the pump room, causing severe
damages to the platform, killing nine (09) and injuring twenty-six (26) crewmen. The timeframe of the
accident will be further detailed below.

3
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

III GENERAL INFO

(a) Details of the FPSO CIDADE DE SO MATEUS
The FPSO CIDADE DE SO MATEUS (Picture 1) is a Stationary Unit of Stationary Unit of
Floating, Production, Storage and Offloading of Oil and Gas Export (FPSO) with capacity to produce
4,000m/day of oil and 10,000,000m/day of gas. It bears the flag of Panama, with registry in the Port
of Panama at the ownership of PROSAFE PRODUCTION SERVICES PTE. LTD, whose class is
maintained by the Classification Society American Bureau of Shipping (ABS). This platform is
authorized to operate in Brazilian Jurisdictional Waters (AJB) as per the Concession Contract issued
by the National Agency of Petroleum, Natural Gas and Biofuels (ANP), on behalf of Petrobras. Its
average production in values related to 2013 corresponds to 2,484,717.79m/day of gas and
426.66m/day of condensate (resulting from gas production) without the production of oil.
(1) Main info and physical features:
Operator: PPB DO BRASIL, SERVIOS MARTIMOS LTD.
Enrollment Number: 341E001031
IMO Number: 8706014
International call sign: 3ENO
Gross Tonnage: 143,323
Hull material: steel
Year of Construction: 1989
Year of Conversion: 2008
Overall length: 311.7m
Length between perpendiculars: 310m
Breadth: 54.50m
Depth: 29.50m
Design Draft: 19.8m
Propulsion: no propulsion
Accommodations: up to 85 individuals

4
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 01 FPSO CIDADE DE SO MATEUS on 13-Feb-2015, two days after the accident.

(b) Documents and Certificates of the platform effective as of the day of the accident:
Verified statutory and classification society-related certificates and documents the platform should
be carrying are listed below:

Certificate Name
Issuing Authority Issuance Date Validity
Portuguese/English Acronym
Certificado de Classe / Certificate of Classification ABS 27-Aug-2014 18-Mar-2019
Certificado de Proteo de Segurana / International Flag State
19-Sep-2014 15-Sep-2019
Ship Security Certificate ISPS Code (Panama)
Certificado de Unidade Mvel de Produo / Mobile Flag State
27-Aug-2014 18-Mar-2019
Offshore Unit Safety Certificate MODU (Panama)
Gerenciamento de Segurana / Safety Managment
DNV-GL 02-Feb-2015 15-Sep-2019
Certificate SMC
Certificado Internacional de Borda Livre /
ABS 27-Aug-2014 18-Mar-2019
International Load Line Certificate- LL
Certificado Internacional de Preveno de Poluio
por leo / International Oil Pollution Prevention ABS 27-Aug-2014 18-Mar-2019
Certificate IOPP
Carto de Tripulao de Segurana / Minimum Safe Ports Authority of
27-Apr-2010 19-Feb-2015
Manning Certificate CTS Rio de Janeiro
Certificado Internacional de Arqueao /
ABS 04-Aug-2008 Indeterminate
International Tonnage Certificate (1969)
Certificado de Registro / Navigation Statutory Flag State
23-Sep-2014 07-Oct-2019
Registry (Panama)

5
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Certificado Internacional de Preveno a Poluio

ABS 27-Aug-2014 18-Mar-2019
do Ar / Air Pollution Certificate - IAPP
Certificado de Preveno de Poluio por Esgoto /
International Sewage Pollution Prevention ABS 27-Aug-2014 18-Mar-2019
Certificate
Atestado de Inscrio Temporria de Embarcao
Ports Authority of
Estrangeira AIT / Foreign Vessel Temporary 20-Feb-2009 19-Feb-2015
Espirito Santo
Enrollment Certification
Atestado de Inscrio Temporria de Embarcao
Ports Authority of
Estrangeira AIT / Foreign Vessel Temporary 14-Jan-2015 03-Oct-2018
Rio de Janeiro
Enrollment Certification
Declarao de Conformidade para Operao nas
Ports Authority of
guas Jurisdicionais Brasileiras / Statement of 19-Jul-2013 18-Apr-2015
Espirito Santo
Compliance for Operation in Brazilian Waters
Seguro Obrigatrio de Danos Pessoais Causados
por Embarcaes ou por sua carga DPEM / Bradesco Seguros
25-Mar-2014 25-Mar-2015
Mandatory Insurance of Personal Injury Caused by e Previdncia
Vessels or Cargo
Seguro P&I / Certificate of Entry Mobile Offshore
Gard P&I 13-Feb-2014 13-Feb-2015
Unit Entry
Registro Contnuo de Dados / Continuous Flag State
17-Sep-2013 Indeterminate.
Synopsis Record CSR (Panama)

(c) Condition of the platform during investigation

th
On February 13 , 2015, at the first visit onboard, the platform presented an aft-oriented inclination
due to the flooding of the engine and pump rooms. All operations were shutdown. At the main deck,
there were kinked lockers, bent doors, damaged pieces of personal protective and communication
equipment, as well as a great deal of debris expelled from inner quarters of the superstructure due to
the effects of the explosion. Salvage material was incomplete due to the lack of two lifeboats and
several life-jackets used during abandon-ship procedures. There was no generation of electric energy
onboard due to damages in parts of power cables and circuit breaker panels, which explains the
utilization of handheld flashlights. Stairs to access engine and pump rooms were not safe to be used
due to deformations and/or gaps resulting from the explosion. Access to the pump room and to the
upper levels of the engine room required the monitoring of possible gas leaks by using handheld
detectors. Only two crewmen were onboard the unit monitoring its stability and performing procedures
to implement salvage plans, whose initial actions were to arrange for the external covering of sea
chests (to be performed by divers) in order to isolate the engine and pump rooms from the contact
with the sea. Seawater network were damaged following the explosion and such situation prevented
the depletion of both the engine and pump rooms, which is required to ensure the safety of the
platform and to search the bodies of crewmembers still missing.

6
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

IV ACCIDENT SITE INFO

(a) Location: geographic coordinates at Lat: 1955.35S and Long: 03938.0W, Camarupim Field,
Espirito Santo Basin at a depth of 792m. It is an open seas navigation area 40km far from shore as
nd
seen by the plotting in the Nautical Chart DHN 22800, 2 edition (Picture 02).

nd
Picture 02 Position of FPSO CIDADE DE SO MATEUS in Nautical Chart DHN-22800, 2 edition, from
Conceio da Barra to Vitoria, Lat. 1955.35S and Long. 03938.0W.

(b) Environmental conditions at the time of the accident: North wind at 8 knots, calm waters,
good weather and visibility. Environmental conditions did not contribute to the accident.

V HUMAN FACTORS AND CREW

(a) POB list and safety crew.

7
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

On the day of the accident there were 74 personnel onboard, among crew and non-crew
professionals. Crew certificates and documents (specialization courses, enrollment and registry books,
social security and employment record books, employment contracts and record sheets related to BW
Offshore) were examined and the following noncompliances were found:
(1) there is no Vessel Supervisor proficiency certificate as provided in item 0117 item e subitem
3 of NORMAM-01/DPC; and
(2) noncompliance with the Safety Crew Card (CTS) one of the crewmen (fatal casualty) that
should be working as Able Seaman as detailed in the platforms Safety Crew Card was exercising the
job of pumper. Consequently, the platform did not operate in compliance within the extent provided in
referred CTS.
(b) Working and rest hours
No lack of compliance was evidenced concerning minimum rest periods as established in
Convention STCW/78.
(c) Onboard accommodations
Accommodations were appropriate for the crew and in compliance with the standards of
conformity, hygiene, temperature, light and noise found in such platforms.
(d) Alcohol, drugs and medications
It was not found any proof concerning the use of alcohol, drug or medication without medical
prescription by the crew.
(e) Safety Management
Platform ha a Safety Management Certificate issued by the classification society Det Norske
Veritas/Norway and Germanischer Lloyd/Germany (DNV-GL) under the terms of the International
th
Safety Management Code (ISM Code) valid until September 15 , 2019. This document certified the
platform was audited and its safety management system meets ISM Code requirements.

VI TIMELINE OF THE EVENTS

The accident sequence of events described below is grounded in records found in the Status Board
of the control room during the emergency situation, information received from crew, examination of
documents received by PETROBRAS and BW Offshore, records from the platforms automation
system and in observations by investigators during the four visits performed onboard.

8
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

th
February 11 , 2015:
- 8:30am: crew shift, with emphasis to the shifts of the Offshore Installation Manager (OIM) and of
the Maintenance Supervisor. Handover Reports for the OIM and Maintenance Supervisor are detailed
in Annexes D and E, respectively.
- 8:53am: opening of valves from suction and discharge network of the oil stripping pump at the
pump room in order to transfer water and condensate from cargo tank 6C to slop tank at portside.
- 9:00am: startup of stripping pump.
- 9:30am: starting of videoconference in meeting room between the Onshore Operations
Management, OIM, Vessel Supervisor, Maintenance Supervisor, Production Supervisor, Planner and
a Safety Technician.
- 10:00am: end of videoconference, OIM returned to his office in order to finish reading the Shift
Handover Report.
- 11:30am: waste from condensate leak inside pump room is detected by camera 5 of the CCTV
but is not seen by whoever was in the control room at that particular time.
- 11:31am: Gas sensor TAG 73AB370 at the pump room warned about the presence of gas, being
automatically sounded and exhaustion was automatically stopped as provided in the ESD, FIRE &
GAS SYSTEM CAUSE AND EFFECTS MATRIX. OIM left the office and headed towards the control
room. Upon his arrival and aware of what sensor was triggered, he disclose by Public Addressing
System an order for the whole crew to head to their muster stations. Next, upon being informed by the
Vessel Supervisor about the condensate transfer operation with the stripping pump he ordered the
operation to be shut down. It was then started a personnel headcount at the muster stations,
coordinated by a designated person from the control room.

9
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

- 11:32am: Gas sensor TAG 73AB326 also sounded and accused the presence of gas inside the
pump room.
- 11:36am: Gas sensor TAG 73AB327 inside pump room also sounded accusing the presence of
as in the compartment. General alarm resulting from the triggering of several gas sensors was muted
in order to improve communication. OIM had doubts concerning the gas leak source and ordered a
party composed by a Safety at Work Technician, an Instrumentation Technician and a Pumper, to
head to the pump room and identify the gas source.
- 11:40am: emergency situation reported to the company base (BW Offshore), located in Vitoria.
- 11:44am: technical party went down to the pump room while at the control room the OIM, Vessel
Supervisor and Maintenance Superintendent assessed the situation.
- 11:47am: technical party returned from the pump room and informed the OIM that there was a
pool of liquid on the compartment floor leaking from valve OP-068 and that handheld gas detectors
used by the team found high levels of gas in the atmosphere of the pump room and dripping continued
near valve OP-068. The OIM asked them if there was another source of gas leak and was informed
that there was a single pool, which could be removed by spraying water. The OIM decided the
cleaning was to be done by using absorbers and tasked the Maintenance Supervisor to assess how
the valve could be repaired.
- 11:58am to 12:02pm: another party was composed and instructed to head to the pump room and
investigate what can be done to solve the leak. This team was formed by the Safety at Work
Technician of the previous party, the Maintenance Supervisor and a Maintenance Technician.
- 12:09pm: at the pump room the party requested shoves and a ladder.
- 12:10pm: the party left the pump room to breathe fresh air and rest.
- 12:15pm: three crewmembers from the fire party at the main deck and surroundings of the pump
room arranged absorbing materials to remove the condensate pool. The OIM released the mustered
personnel not required for the task to the lunch break.

10
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

- 12:20pm: OIM instructed another party to be assembled to go to the pump room and proceed to
the cleaning and containment of the leak. Two Roustabouts and three Maintenance Technicians were
designated for the task.
- 12:22pm to 12:26pm: the party headed to the pump room and started the containment and
cleaning of the leak, first with absorbing blankets then by using seawater from the fire network (a hose
of 1.5 inch and 45 meters length was introduced in the location by openings from starboard decks).
- 12:35pm to 12:37pm: explosion occurred in the pump room and immediate effects were felt by the
control room, which was filled by smoke and debris. All platform systems were shut down and the
room was evacuated. Flooding started inside pump and engine rooms caused by burst of the fire
network (pressurized at the time) and of the seawater network (sea chests). The first casualties were
identified and the OIM, jointly with PETROBRAS Supervisor, requested helicopters to evacuate the
injured. At the deck, disoriented personnel sought shelter at the aft, under the helideck and at the bow
of the platform, fearing more explosions and possible sinking of the unit. Procedures to abandon the
unit were deployed, all onboard were instructed to head to their muster stations. The Vessel
Supervisor guided 32 crewmen to embark on the starboard lifeboat.
- 12:47pm: it was ordered the abandonment of the platform by the starboard lifeboat. The OIM and
the Medic remained onboard along with other crewmembers to take care of the medevac of
casualties.
th
February 12 , 2015:
- 2:00pm: platform is completely abandoned, no personnel onboard.

VII POST-ACCIDENT PROCEDURES

After the accident it was carried out the shutdown of the whole operation of the platforms followed
by procedures of abandonment and rescue of the casualties with onshore support. After abandonment
the platform stayed under monitoring to check its stability and floatability by using offshore supply
vessels, while the salvatagem plan was being prepared.

VIII ACCIDENT CONSEQUENCES

11
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

(a) Personal Damages:

This accident killed nine (09) and injured twenty-six (26) workers. Qualification of the casualties, as
well as the Death Certificates and medical information on the health condition of the injured workers
are provided in the List of Deaths and Injuries. There is no missing person.
(b) Environmental Damages:
No environmental damages.
(c) Property Damages:
The platform suffered several structural damages at the aft section, the explosion affected living
quarters, engine room, pump room and structural fittings and equipment located in those quarters.
Such damages are characterized by kinking, falling and breaking of bulkheads, ribs and girders.
Additionally, effects from flooding in the engine and pump rooms caused the disabling of engines,
pumps, switchboards and general equipment that cannot be watered. The pictures below show the
severity of the damages that caused the shutdown of all operations and the abandonment of the
platform. There is no evidence of damages to the condensate and oil cargo existing in cargo tanks.
(1) Aft outer deck, living quarters hallways and access to the elevator.

Picture 03 Picture 04
Lockers deformed by the explosions and expelled from the inner quarters of the superstructure.

12
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 05 watertight door to access pump room,

Picture 06 - parts of a flashlight used onboard.
portside, destroyed by the explosion.

Picture 07 access door to the elevator in the Picture 08 hallway to access control room at the main
superstructure deformed by the explosion. deck level.
(2) Engine Room
Flooding of the engine room after explosion disabled the Auxiliary Combustion Engines (MCA) and
switchboards, including the Main Switchboard. Structural reinforcing elements and the network system
running through the room were severely damaged by the explosion. The Engine Control Center (CCM)
was destroyed by the pressure wave caused by the explosion, which was originated in the Pump
Room.

13
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 09 Flooding in the engine room seen by the hatch on the main deck, aft

Picture 11 Engine Room next to the starboard

Picture 10 Upper portion of the Engine Room
broadside presented signs of destruction in network and
partially destroyed.
structural elements.

14
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 12 - CCM in the Engine Room destroyed by the effects of the explosion.

(3) - Pump Room:

Pump Room is vertically divided in five levels from the main deck down to the bottom of the
compartment, as per the following drawings:

15
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 13 Aft side view of the platform, highlighting the Pump Room.

16
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Bulkhead affected
by the explosion

Explosion
Epicenter

Picture 14 Vertical Structure of the Pump Room

Damages in that compartment are partially shown in the pictures below:
Ceiling of the pump room: located above the main deck, it was displaced and severely damaged by
st
the explosion. Right under the 1 level the vertical plumb reinforcements of the aft bulkhead that
isolates the Pump Room from the Engine Room were severely kinked and unable to perform their role
of increasing the rigidity of the panel formed by the bulkhead.

17
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 15 Pump Room Ceiling in the main deck

Fire network damaged by the explosion, which contributed to the flooding of the compartment as it was kept
pressurized
nd
2 level of the Pump Room: damaged floor near the starboard air extraction pipeline.

nd
Picture 16 Floor located at the 2 level presenting Picture 17 Vertical air vent totally destroyed by the
severe deformation explosion pressure wave

18
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

rd
3 level of the Pump Room: air extraction pipes were destroyed by the pressure caused by the
explosion. Access stairs were also destroyed. Access to the lower levels of the Pump Room was only
possible after installation of scaffolds by the crew. Bulkhead that separates the Pump and Engine
Rooms were deformed and tumbled to aft, opening sections bordering both rooms. Bulkhead was
separated in its upper welded joint with the unit structure due to the ascending pressure caused by the
explosion at the lower part of the compartment.

Picture 18 Tumbled aft bulkhead between the Pump Picture 19 Collapsed bulkhead between the Pump
and Engine Rooms was tumbled and Engine Rooms

th
5 level of the Pump Room: the lower level of the Pump Room is divided by an intermediate floor
formed by skids that allow access to equipment such as the stripping pump. Such skids were severely
affected by the explosion. The stripping pump presented superficial damages on the thermal isolation
of the housing and of the draining system manifold.

19
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 20 Stripping pump presented superficial damages

At the Pump Room floor it was noticed a strong deformation at the junction of the sixth girder
(longitudinal structural reinforcement of the bottom plating) from the starboard bulkhead with a
Samson post (vertical beam that supports the ceiling at the lower panel).

th
Picture 21 Severely damaged 6 bottom plating Picture 22 Vertical detail of the collapsed and
reinforcement girder of the Pump Room deformed structure

20
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

th
Picture 23 Severely damaged 6 bottom plating Picture 24 Under the damaged structure there are
reinforcement girder of the Pump Room remnants of oily mixture

The shape of the deformation on these structural reinforcements means that the pressure caused
by the explosion was concentrated at the compartment bottom near the condensate leak and then
expanded vertically upwards, which explains the deformations found in the structure and bulkhead of
Pump Room upper levels. The compartment also presented oily water at the bottom between the
structural reinforcements of the compartments bottom plating.

IX EXPERT SURVEYS
Expert surveys started soon after the platforms safety conditions were deemed satisfactory. Four
visits took place in order to map equipment and network of the pump room, estimate damages and
evaluate the conditions of network and valves of the stripping pump.
In addition to the visits onboard, platforms certificates and plans were inspected, along with
several documents provided by PETROBRAS and BW Offshore, upon request by the surveyors. They
also analyzed data from the automation system and heard people that could assist in elucidating the
accident.

X CAUSAL FACTORS AND ANALYSIS

(a) Data from automation system

21
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Data from the automation system referred herein were in the computers and data disks taken from
the platform after the accident and transported to BW Offshores office in the capital city of Vitoria,
State of Espirito Santo. The recorded information will aid in the technical understanding of the
operation and activation of equipment and in the visualization of the condensate leak, including the
activation of a gas alarm lamp inside the pump room by means of images from the CCTV. For this
survey, in addition to the CCTV images, data related to valves, oil stripping pump and gas sensors
within the pump room were also extracted. This information, obtained as electronic spreadsheets, are
in the data disk.
(b) Data recovery and reading
Recovery and reading of data by technicians from BW Offshore occurred at the facilities of
th th
Petrobras, city of Maca, State of Rio de Janeiro, from 24 to 28 of February, 2015.
(c) Criterion adopted to select data for this investigation
CCTV images and data selected to be inspected were those contained in the HD Cargo Ballast N/S
9RX7JG4S (Cargo-EventLog.xlsx) and HD Server B N/S 3LN2CQ1H (1E4F-AlarmLog-
th
MostRecent.xlsx) dated February 11 , 2015 concerning the equipment located inside the platforms
pump room, as that is the date when the condensate leak occurred (stripping pump discharge
network), followed by automatic sounding of gas sensors and explosion.
(d) Synchronism method of the computers and CCTV hours
(1) - Computers.
When computers were turned on it was verified that there was no synchronism of the respective
hours. Considering the need to use information to describe the chain of events that led to the
explosion, technicians compared the hours of the computers against information from a cell phone and
then prepared photographic reports. The following images show the results from the comparisons
concerning the aforementioned systems.

22
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 25 - HD Cargo Ballast N/S 9RX7JG4S

Computer that controls the ballast and cargo maneuvers of the platform

Date and time of the computer: 26/02/2015 10h07m01s

Date and time of the cell phone: 27/02/2015 09h03m
The picture shows that:
a) The computer had a delay of one day in relation to the date on the cell phone.
b) The computer time was ahead 1h4m01s.
Synchronizing seconds not included:
Considering that the computer was in a delay of one day and that it was taken during summer time (from 12:00am
th nd
of October 19 , 2014 to 12:00am of February 22 , 2015) sync is done by:
a) adding 1 day to the computer date.
b) reducing 1h4m from the computer time.

Therefore, considering this sync criteria, the following example is now presented:

The text on the first row of table Cargo-EventLog.xlsx, Appendix 2:

Time Description
2/10/2015 12:29:17 Wrote new value (1) to ICONICS.ModbusEthernetDA.2\Sixnet.DO.HMI_BA002_Close

Now reads:
Time Description
2/11/2015 11:25:17 Wrote new value (1) to ICONICS.ModbusEthernetDA.2\Sixnet.DO.HMI_BA002_Close

23
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 26 - HD Server B N/S 3LN2CQ1H

Server that records the platform alarms

Date and time of the computer: 27/02/2015 12h09m

Date and time of the cell phone: 27/02/2015 11h02m
The picture shows that the computer time was for 7 minutes in advance.

Synchronizing:
Reduce the computer time in 7 minutes.

Therefore, considering this sync criteria, the following example is now presented:

The text on the row of table1E4F-AlarmLog-MostRecent.xlsx:

ActiveTime EventTime Source
2/11/2015 13:51:31 2/11/2015 13:51:31 P_73BF319-FAULT

Now reads:
ActiveTime EventTime Source
2/11/2015 13:51:31 2/11/2015 13:44:31 P_73BF319-FAULT

(2) - CCTV.
The CCTV recording system was delayed 1h23m16s in relation to the local time in Brasilia BRT
(conference held on 27-02-2015 at 16h19m Brasilia Time).
(e) Transfer of water and condensate content from cargo tank 6C to the portside slop tank:
The operation consisted in the transfer of water and condensate from central cargo tank 6C to the
portside slop tank. The valve and network arrangement is shown in drawing 1. The stretch in question
(suction and discharge flow) is marked in red. From the start of the center suction header up to the
pump, there are valves OP-041, OP-050 OP-047 and OP-071 and from the discharge to the slop tank
there are valves OP-079 and OP-084. All such valves should be opened during transfer.
The diagram also shows another derivation in the pump discharge to the slop tank highlighted in
yellow color. This stretch comprises a flanged connection and valve OP-068 and is shorter than the

24
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

representation of the arrangement in red. However, it could not be used because valve OP-068 was
damaged (internal passage). Therefore, this valve was unable to retain the tanks content was the
th
reason why the flanged connection was obstructed by a racket on January 12 , 2014. This change
will soon reveal itself as the weak spot of the network system used in the maneuver that will lead to
the accident as will be further detailed.

___________________________________
1
Flanged connections are easily disassembled connections mostly used for 51mm (2) pipes or larger in the following cases: to connect pipes to
valves and equipment (pumps, compressors, tanks, etc.) and also in certain stretches throughout the pipeline to facilitate disassembly. Note: as a
general rule it is recommended to use the minimum amount of flanged connections as possible. A flanged connection is composed by two flanges,
a set or case of bolts or case with threads and a sealing joint. (MARITIME, Professional Learning. Ministry of the Navy Directorate of Ports and
Coasts. Principles of Machinery. Rio de Janeiro, 1989).

2
Rackets: used in network when it is needed a rigorous and absolute block. It is widely used onboard to isolate from pipes that are sporadically
used. They are normally installed between two flanges forming a perfect sealant. (MARITIME, Professional Learning. Ministry of the Navy
Directorate of Ports and Coasts. Principles of Machinery. Rio de Janeiro, 1989).

25
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Discharges to the portside oil

This mains could not be used slop tank
to discharged in tank because
there is a racket in this flange
Stripping Pump

Cargo tank 6C suction

header

Drawing 1 network diagram

(f) Change in the alignment of the aspiration and discharge network during transfer
maneuver and condensate leak:
th
On February 11 , 2015 after starting transfer it was seen that the level of tank 6C failed to lower,
even with the stripping pump still running. Such fact may be explained by the malfunctioning of inner
valves in tank 6C and slop tank, as the used suction network passed through both tanks. In an attempt
to solve the issue the Vessel Supervisor decided to change the suction network of tank 6C from the
central section to starboard (stbd suction header) through valves OP-042, OP-051, OP-048 and OP-
071 in order to avoid passage through valves that could be defective. The temporary discharge
destination in this arrangement was changed from the slop tank to cargo tank 2C through valve OP-
080 as the starboard suction line was filled with raw condensate that should not be stored in the
portside slop tank, also by decision of the Vessel Supervisor. Therefore, valve OP-084 should be
closed. Consequently, by implementing this arrangement, the discharge network should be free up to
tank 2C.

26
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

It was detected that, indeed, valve OP-084 was closed, but it was done while the stripping pump
was still running at 8% of tis working capacity, without the discharge flow to tank 2C (according to the
new arrangement) being unblocked by valve OP 080. Table 1 clarifies this issue with the records of
opening and close of valves, as well as the stripping pump start and stop commands obtained from
the automation system logs.

Table 01 valve and stripping pump HD Cargo Ballast N/S 9RX7JG4S.

Events related to start and stop of stripping pump and handling of valves from the suction and
discharge network.
Suction line valves OP047, OP048, OP050 and OP071
Discharge line valves: OP079 and OP084.

Computer Local Time Suction network valves Discharge network valves

Event Stripping Pump
Time corrected (-)4min OP047 OP048 OP050 OP071 OP079 OP084

01 08:57:09 08:53:09 open

02 08:57:14 08:53:14 open
03 08:57:20 08:53:26 open
04 08:57:26 08:53:26 open
05 08:57:34 08:53:34 open
06 08:57:55 08:53:55 open
07 09:04:31 09:00:31 start (10%)
08 11:31:35 11:27:31 started (8%)
09 11:31:48 11:27:48 close
10 11:32:02 11:28:02 close
11 11:33:44 11:29:44 open
12 11:34:28 11:30:28 started (7%)
13 11:34:30 11:30:30 stop (0)
14 11:34:33 11:30:33 open
15 11:42:52 11:38:52 close
16 11:42:59 11:38:59 close
17 11:43:02 11:39:02 close
18 11:43:08 11:39:08 close
19 11:43:14 11:39:14 close
20 11:43:38 11:39:38 close
21 11:43:52 11:39:52 close
22 12:10:03 12:06:03 open

Event 09 - at 11h31m48s valve OP084 (pump discharge line) was closed while the pump was
still running.
Event 13 pump stopped at 11h34m30s.

27
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

As the stripping pump is of the positive displacement type, its operation for more than two minutes
with both valves OP-080 and OP-084 closed, caused the pressure to build up inside the discharge
network provoking the leak of condensate by the flanged connection joint at upstream of valve OP-
068. This arrangement is marked in blue color on Drawing 2 below.

Valve OP084
closed

Valve OP080
closed Leak of condensate
through the flanged
connection

Operating
stripping
pump

Drawing 2 network diagram indicating closed valves during operation of the stripping pump.

___________________________________
3
Positive displacement pumps have one or more cameras, where inside the movement of a propulsion component communicates pressure
energy to the liquid, causing tis flowing. They are of the type that each complete revolution demands the same amount of liquid and in order to
vary the demand we have to alter the speed. The resistance imposed to the flowing does not change the demand (it is the amount of liquid a pump
discharges in the time unit and at a certain discharge pressure, expressed in m/h or l/min). (MARITIME, Professional Learning. Ministry of the
Navy Directorate of Ports and Coasts. Ancillary Machinery II. Rio de Janeiro, 1989).

28
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

CCTV images extracted from the recording of camera 05 installed at the portside pump room show
the leak of condensate:

Picture 27 Picture 28 Picture 29

Camera 05 11-Feb-2015 Camera 05 11-Feb-2015 Camera 05 11-Feb-2015
10h07m01s local time 10h07m07s local time 10h28m55s local time
11h30m17s no signs of leak. 11h30m23s the first signs of 11h52m11s 22 minutes later
condensate leak appear (red traces of leak are considerable
Leaked condensate will be seen circle). reduced. At this time the stripping
dripping in this sector. Its source is pump was already shut down.
in a positioned network, Camera lens with drops from (11h30m30s).
approximately 03 meters above that condensate waste.
The black spot with traces of
point as shown by the following
condensate on the pipe is smaller,
image.
but the camera lens is more blurred
with the product drops.

(g) The weak point of the network system used in the maneuver
Considering the operational error of closing valve OP-084 while the pump was still running, this
action alone would not cause the leak of condensate if the integrity of the flanged connection
(obstructed by the racket) had been kept. It is worth emphasizing that the pump worked at 8% of its
working capacity, its hydrostatic pressure was of 30kg/cm and it had a safety system that would relief
the pressure after reaching 16.5 Kg/cm, in addition to the whole cargo network being tested after
manufacturing and installation with 1.5 times the working pressure (item 4.6.2 7.3 and 4.6.2 7.3.3
of ABS Rules).

29
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Valve OP068 (defective) on the stripping Flanged connection obstructed by the racket. It
pumps discharge network. This derivation was was under the stripping pumps discharge
not used pressure

On the other side of the bulkhead is the

portside slop tank

Condensate leak point

Stretch of the network without
pump pressure

Picture 30 portside pump room

Picture 31 Picture 32
Details of the flange joint wearing
(Images obtained after leak source PETROBRAS)

BW Offshore was asked about the installation racket and informed that the installation of such
component was treated as routine operation without the need of approval by the Classification
Society. The Classification Society ABS was also inquired, as the whole cargo as ballast transfer
system was maintained in class, and ABS responded that it received no request from the Shipowner
to install rackets and that it had not enough information to assess if the used material met all technical
parameters involved. Facts demonstrated that the fragility of the flanged and racketed connection
allowed leak of condensate to the inside of the pump room.

30
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

(h) Hydrocarbon inside pump room:

Condensate that leaked as per the information from the Material Safety Data Sheet (MSDS) is a
petroleum compound capable of forming hydrocarbon vapors, as provided by PETROBRAS.
Effectively, this gas cloud existed and was generated from the condensate that leaked by the joint,
sprinkled by the pressure and pool that was left on the floor. Moreover, soon after leak gas sensors
were automatically triggered along with the corresponding gas alarm. Table 2 shows the dynamics of
the gas sensors in the pump room according to the automation system logs.

Table 02 gas sensors - subsystem HD Server B N/S 3LN2CQ1H. Events that led to the
activation of gas sensors in pump room followed by the corresponding alarm level. Gas cloud was
concentrated at the lower levels of the compartment causing the triggering of the existing sensors at
the lower level of the compartment (main floor): TAG 73AB326, TAG 73AB327 and TAG 73AB37.

Local time TAG TAG TAG TAG TAG

Event Computer time
(corrected - 7min) 73AB326 73AB327 73AB370 73AB368 73AB369
01 11:38:04 11:31:04 HI
02 11:38:18 11:31:18 HIHI
03 11:39:16 11:32:16 HI
04 11:40:27 11:33:27 HIHI
05 11:41:59 11:34:59 FAULT
06 11:42:46 11:35:46 FAULT
07 11:43:06 11:36:06 HI
08 11:43:32 11:36:32 HIHI
09 11:44:34 11:37:34 FAULT
10 11:44:36 11:37:36 NORMALIZED
11 11:45:33 11:38:33 NORMALIZED
12 11:45:36 11:38:36 HI - HIHI
13 11:46:33 11:39:33 HI HIHI
14 11:47:22 11:40:22 HI - HIHI
15 11:50:26 11:43:26 INHIBIT
16 11:50:28 11:43:28 INHIBIT
17 11:50:31 11:43:31 INHIBIT
18 12:07:04 12:00:04 NORMALIZED
19 12:08:03 12:01:03 HI - HIHI
20 12:08:48 12:01:48 INHIBIT
21 12:08:52 12:01:52 INHIBIT
22 12:09:54 12:02:54 NORMALIZED
23 12:10:53 12:03:53 HI - HIHI
24 12:12:20 12:05:20 NORMALIZED
25 12:13:19 12:06:19 HI - HIHI
26 12:44:52 12:37:52 NORMALIZED NORMALIZED NORMALIZED

31
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

HI (High level): indicates 20% of the lower explosive limit (LEL).

HIHI (High-High level): indicates 80% of the LEL. With this indication the automation system
closed automatically the compartment dampers and stops venting.
FAULT: it means that the gas level is above 100% of the LEL (more than the sensor is capable
of recording).
NORMALIZED: sensor resumes its normal gas detection conditions.
HI HIHI (High and High-High level): it means the activation of the high and high-high levels
were too close and marked at the same time.
INHIBIT: it means that the sensor keeps detecting gas (if any) but it does not stop venting nor
close compartment dampers.

Gas alarm signaling light. Images taken from camera 04, positioned at starboard of the pump room.

Picture 33 Picture 34
Camera 04 - local time 11h31m52s. Camera 04 - local time 11h31m56s
Camera is positioned to visualize the red signaling light Red signaling light was turned on when the gas sensor
that is triggered when the gas alarm is sounded as TAG 73AB370 was activated with HIHI (11h31min18s)
shown in the following image. delay of 18 seconds.

It must be noticed that the platforms automation system turns off the exhausters of the pump room
in the event of a gas alarm as per the Matrix of Cause and Effect. Therefore, when alarms were
sounded, the properties of the atmosphere inside the pump room were changed creating an
emergency situation and turning the place into an area of high explosion risk. Therefore, the pump
room presented characteristics similar of a confined space as per the provision of the Regulatory
Standard No. 33 SAFETY AND HEALTH AT WORKS IN CONFINED SPACES (NR-33) of the
Ministry of Labor and Employment, which reads: 33.1.2 Confined Space is any area or environment
not designed for continuous human presence, which has limited means to get in and out and whose
inherent ventilation is not sufficient to remove contaminants or where there may be deficiency or
enrichment of oxygen. This Standard also sets out the concept of deficiency of oxygen as
atmosphere containing less than 20.9% oxygen in volume at normal atmospheric pressure, unless
the reduction of said percentage is duly monitored and controlled.

32
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

(i) Explosion:
Hydrocarbon cloud remained at the lower portion of the compartment as only the gas sensors
installed at the bottom of the pump room were triggered, thus evidencing the presence of flammable
gas (fuel) and oxygen (combustible). The source of the ignition that led to the explosion is still
unknown, it could have occurred by a spark following the use of tools by the crew in the attempt to
contain the leak, generation of static electricity following the use of fire hose during cleaning, or even
utilization of handheld VHF radios, or also by the natural heating the compartment was submitted to
after exhaustion stoppage, or an unknown cause. The CCTV images below show the exact moment of
the explosion.

Picture 35 Picture 36 Picture 37

Camera 01 local time Camera 01 local time Camera 01 local time
12h38m01s 12h38m03s 12h38m09s

33
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Picture 38 - camera 03 - Picture 39 - camera 03 - Picture 40 - camera 03 - 11/02/2015

11/02/2015 11h14m42s - local 11/02/2015 11h14m45s - local 11h14m48s - local time
time 12h37m58s time 12h38m01s 12h38m04s

(j) Noncompliance with the effective laws (standards, resolutions and codes):
- NORMAM-01/DPC sets out in item 0117 that the safety crew of fixed and mobile platforms,
FPSO, FSU and drillship of prospection or exploration of oil, is composed by offshore and non-
offshore crewmembers due to the operational circumstances in which the units are involved. The non-
offshore safety crew is set out in Resolution A.891 (21) of the International Maritime Organization
(IMO), known as Operations Section and depending on the type of platform, it can be composed by:
- Offshore Installation Management (OIM) Person officially designated by the shipowner, owner
of company, as the ultimate person in charge of the platform, to which every personnel onboard
is subordinated to;
- Vessel Supervisor In charge of the control and operation of ballast in mobile units (not
applicable to fixed platforms);
- Ballast Control Operator Person in charge of carrying out ballast operations in mobile units (not
applicable to fixed platforms); and
- Maintenance Supervisor Person in charge of the inspection, operation, test and maintenance of
machinery and equipment that is vital to the safety of the human life onboard and to prevent pollution
that may be caused by the platform or its operations. Level and hierarchy of the personnel onboard
platforms, FPSO, FSU and drillships will be prepared as per the flowchart below:

34
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

OFFSHORE INSTALLATION
MANAGER

MAINTENANCE SALVAGE GROUP

SERVICE VESSEL SUPERVISOR (ONLY TO MATTERS RELATED TO THE
SALVAGE GROUP)
(not applicable to Fixed Platforms)

OFFSHORE PERSONNEL OF OFFSHORE PERSONNEL OF THE

THE ENGINE SECTION BALLAST CONTROL
DECK SECTION
(LISTED BY LEVEL) OPERATOR
(LISTED BY LEVEL)
(not applicable to Fixed Platforms)
(Onboard Fixed Platform they will be directly
subordinated to the OIM)

Therefore, according to the aforementioned standard, it is clear that the OIM is the one with
ultimate responsible for the platform to whom every one onboard is subordinated to.

When performing his/her responsibility and authority onboard the platform, it shall fall upon the OIM
to assess risks and decide on the entry of personnel inside the pump room as described in the
Chronologic Summary of the Accident, although there was no doubt concerning the presence of
gas in its interior.
The decision made, submitting crewmembers to risk situations, contradicted the safety procedures
set out for such cases in several standards and instructions as described below:
- Code for the Construction and Equipment of Mobile Offshore Drilling Units (MODU Code
th
1989), adopted by Resolution A.649(16), on October 19 , 1989, by which the platform was certified.
Item 14.1 thereof, concerning the Platforms Operations Manual, sets out that the referred manual
must provide special procedures for events of uncontrolled leak of hydrocarbon and emergency
shutdowns. In item 14.5 is set out that procedure to enter confined spaces must be those established
in Resolution IMO A.1050(27).
- Resolution IMO A.1050(27) brings recommendations to get inside confined spaces onboard
ships. This Resolution sets out the need to assess risks, permit to entry, general precautions,
atmosphere tests, precautions during the staying of personnel inside confined spaces, etc. and also
clarifies that accidents may occur, among other reasons, due to lack of caution by the involved
personnel, and explicitly recommends the adoption of safety procedures.

35
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

- Technical Regulation of the Operating Safety Management System of Offshore

Installations of Drilling and Production of Oil and Natural Gas (SGSO), from the Brazilian National
Agency of Petroleum, Natural Gas and Biofuels (ANP), approved by Resolution ANP No. 3, of
th th
December 06 , 2007, published in Federal Official Gazette on December 07 , 2007, amended by the
th th
Federal Official Gazette on December 10 , 2007 and on December 12 , 2007. This Regulation
applies to all platforms operating within Brazilian waters and deals, among other subjects, with the
execution of works inside platforms risk areas as described below: 17.2 Permit-to-Work - 17.2.1 The
Installation Operator should establish a permit-to-work system and other means of control to manage
activities inside risk areas. During the preparation of said system it must be considered: 17.2.1.1 The
Installation Operator must set out the activity types that may pose risks to the Operating Safety and
that require Permit-to-Work. 17.2.1.2 The Permit-to-Work must include additional precaution and
mitigation measures that might be required for the execution of task with safety. 17.2.1.3 The need for
previous analysis of the safety conditions to execute tasks, as well as of the existing hazards in the
workplace. 17.2.2 The Installation Operator must ensure that the permit-to-work system: a) is
documented and instructions and authorization forms are clear and concise and b) Sets out that
controls and permits to work are approved by the appropriate level of management / supervision
onboard the Installation. 17.3 - Monitoring The Installation Operator will be in charge of: 17.3.1
Monitoring the performance of activities in compliance with the requirements set out in approved
procedures, in permits-to-work and in related documentation and information. 17.3.2 Assuring permits-
to-work and controls are used up to the conclusion of the works.
- Emergency Response and Contingency Plan of the FPSO Cidade de So Mateus. This Plan,
in item 4.1, presents the organizational chart of the emergency response and item 5 describes the role
of the OIM as the Strategist and Commander of Incidents. At the control room, he/she would have
the roles of implementing a command structure that would satisfy the organizational needs to protect
life, environment and the installation, as well as deploying quick and efficiency actions to control
incidents, as well as managing response actions to ensure that the escalating potential, risks of injury
to personnel and damages to the installation are minimized.

36
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Entry of personnel in the pump room without previous risk analysis, without the issuance of the
permit-to-work document and without monitoring the rooms atmospheric conditions, represents a
blatant case of noncompliance with the applicable standards.
(k) Failures in the onboard safety management system:
Platform has a Safety Management Certificate issued by classification society Det Norske
Veritas/Norway and Germanischer Lloyd/Germany (DNV-GL) under the terms of the Internal Safety
th
Management Code (ISM Code) valid until September 15 , 2019. This document attests that the
platform was audited and that its safety management system meets the requirements of the ISM
Code.
ISM Code is expressed in wide terms, capable of being applied in different management levels,
both onshore and offshore, requiring varied levels of knowledge and awareness. According to the
provision of the aforementioned Code, the groundings of a good safety management are the attitudes,
commitment, competence and motivation of individuals, in all levels. Therefore, the Safety
Management System must be structured and documented in order to allow the effective
implementation of the companys safety and environmental protection policy.
The goals of the Code are to ensure the safety at sea, prevention of human injuries and loss of life,
as well as prevention of damages to the environment, particularly to the marine environment and to
assets. In order to meet those goals the companys safety management must continuously improve
the personnels safety management skills both onshore and offshore, including emergency responses
related to safety and environmental protection by ensuring compliance with mandatory rules and
standards. Codes, guidelines and other applicable standards recommended by the Organization,
Administrations, classification societies and maritime industrial agencies must also be taken into
consideration.
The Code classifies the noncompliance of mandatory rules and standards in two types:
Noncompliance an observed situation where an objective evidence indicates the
noncompliance of a specified requirement; and

37
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

Major noncompliance an identifiable deviation that poses a serious threat to the safety of the
personnel and/or of the ship, or a serious risk to the environment that requires immediate corrective
action or lack of effective and systematic implementation of a requirement from the Code.
In this particular event, the following failures were recorded:
(1) Document presented by BW Offshore do Brasil Ltda as the Safety Management Manual
provides on its cover page the warning that procedures contained therein must be checked before
being used as they concern a manual under development. Such warning shows that there is no
procedure for immediate action in the event of emergency onboard, contradicting the safety
management certification issued by DNV-GL;
(2) The stripping pumps discharge network suffered change after installation of racket without the
knowledge or consent of the classification society ABS;
(3) change in alignment of the stripping pumps suction and discharge networks during condensate
transfer maneuver from cargo tank 6C not taking into account the fragility of the discharge network
against the installation of racket at the networks flanged connection;
(4) Undue block of the stripping pumps discharge network during the pumps operation when
draining cargo tank 6C by closing valve OP-084;
(5) Failure during shift handover between OIMs due to incomplete operational information.
Transfer maneuver of condensate from tank 6C was not mentioned in the Shift Handover Report of
the relieved OIM. OIM of the next shift was only aware of the mentioned maneuver after sounding of
the gas alarm;
(6) entrance of parties inside the pump room after detecting the presence of gas did not include
identification and analysis of risks nor the issuance of the corresponding permits-to-work; and
(7) Nonexistence in the manuals onboard of special procedures for events of uncontrolled
hydrocarbon leaks and emergency shutdowns inside pump room.
Such failures attest the inconsistency of the management system implemented onboard, allowing
the adoption of improvised decisions that resulted in the noncompliances.

38
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

XI PRELIMINARY LESSONS LEARNED AND CONCLUSION

(a) The existence of the Safety Management Certificate issued under the terms of the ISM Code
is not enough to ensure safe operations onboard the platform. The company and the platforms crew
must adhere to the safety principles in order to establish safe working conditions during all operations
onboard platforms.
(b) Inconsistency of the platforms operation manuals and of the contingency plan may reflect
disastrous consequences during emergency situations. Manuals need to be correctly prepared,
understood and followed by the platforms crew.
(c) It is required the commitment of operators and clients in maintaining the safety management
principles of the platforms.
(d) Ignore the importance of a hydrocarbon leak may lead to devastating consequences to assets
and lives onboard.
(e) Management of the platforms must be clear and adequately exercised. Shift changes must
allow the transmission of all information related to ongoing operations in order to ensure the
continuous control of planned actions. Shift changes must be done personally by following a preset
schedule rather than being based only on written reports.
(f) The classification society must always be informed on changes to equipment maintained in
class. In this particular case, it was verified that the change of the network without the knowledge and
consent of the classification society proved to be a disaster to the accidents outcome.
(g) Eventual modification needs in the selection of networks to perform pumping of hydrocarbons
must consider the current situation of equipment and risks resulting from such modifications must be
all assessed.
(h) Operations of the ballast system must have a training program with the purpose of keeping
operators updated with the technical skills that allow them to be able to assess failure consequences
in the command of valves and pumps.

39
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

(i) Training programs must emphasize requirements from the applicable laws concerning
platform operations with special attention to the Regulatory Standards of the Ministry of Labor and
Employment, of the Maritime Authority and of the National Agency of Petroleum, Natural Gas and
Biofuels. During crises onboard this knowledge must be applied to avoid accidents, for example,
unauthorized entrance inside compartment with confined space characteristics.
(j) Atmosphere inside a confined space may become lethal.
(k) It is mandatory to never get inside a space containing explosive atmosphere.
(l) The Platforms Operation Manual and Contingency Plan must contemplate al requirements set
out by the applicable laws.
(m) Crewmembers must comply with the procedures set out by Companies concerning safety
standards, especially those concerning the correct utilization of safety equipment related to each task.
In face of everything that was investigated, it can be concluded that the accident resulted from leak
of flammable substance in the pump room, which later allowed the formation of gas and consequent
creation of explosive atmosphere that caused the explosion, not being possible to determine the
ignition source.

XII SAFETY RECOMMENDATIONS

(a) The Company must establish in its Annual Training Program for the crew, regular drills on
procedures to get inside confined spaces and must designate, formally, the person in charge of the
compliance;
(b) The Company must establish controls to ensure the entrance of personnel inside confined
spaces to be done only after performing a risk analysis and issuing a Permit-to-Work, as well as to
prevent entrance inside spaces containing explosive atmospheres;
(c) The whole safety management system related to both the platform and the company must
be submitted to eventual audits by the classification society that issued the Safety Management
Certificate and the Compliance Document;

40
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

(d) Platforms Operation Manual and the Contingency Plan must be revised and updated according
to the applicable laws;
(e) the company must carry out the rigorous supervision of the procedure of informing the
classification society about changes in equipment and systems maintained in class; and
(f) ballast system operators must be submitted to a permanent training program with this system.

===========================================================

XIII - ANNEX
Features of Unit FPSO CIDADE DE SO MATEUS.

41
 Brazilian Navy Directorate of Ports and Coasts
Superintendence of Waterway Traffic Safety
Department of Inquiries and Investigations of Navigation Accidents
Explosion with casualties onboard FPSO CIDADE DE SO MATEUS
Maritime Safety Investigation Report

FEATURES OF UNIT
FPSO CIDADE DE SO MATEUS:

2.1. Main features of the Unit:

Description

FPSO Cidade de So Mateus is a floating unit of production, storage and

offloading of oil, as well as processing and exporting of gas with the following
characteristics:

2.1.1. Physical Characteristics:

a) Overall length = 322.07 m
b) Length between perpendiculars = 310.00 m
c) Boca = 54.50 m
d) Depth = 29.50 m
e) Tonnage = gross: 143,323; net: 42,996 metric tons
f) Design draft = 19.8 m
g) Accommodations = 85 personnel
This number may vary according to the life cycle of the installation or the
need to perform activities requiring extra manpower, and it will be determined
by the maximum allowed number of available slots for salvage equipment and
depending on the rules set by specific regulations of the MODU Code, Ministry
of Labor and Employment and of the Ministry of the Navy.

42