Petrobras 36 (P-36) was a semi-submersible oil platform. Prior to its sinking on 20 March 2001, it was the largest in the world. It was operated by Petrobras, a semi-public Brazilian oil company headquartered in Rio de Janeiro.
The proximate cause for the sinking was a series of explosions that killed 11 crew. In terms of lives lost, this was the worst offshore oil and gas accident in Brazil since 1984, when a rig blowout and explosion caused 36 fatalities, and the worst worldwide since the explosion of a platform off Nigeria in January 1995, which killed 13.
Vessel
The platform was built at the Fincantieri shipyard in Genoa, Italy between 1984 and 1994.It was an oil production unit integrated with a drilling rig. The project – initially named SANA 15,000 – was speculative, as a lessee or a buyer had not been identified. It was a Friede & Goldman L-1020 Trendsetter semi-submersible, designed to operate at depths of 500 m. It had been ordered and was owned by Società Armamento Navi Appoggio S.p.A. (SANA). In 1990 Midland and Scottish Resources (MSR), acquired SANA's parent company, effectively becoming the owners of the rig, which was then renamed Spirit of Columbus. However, the planned development of the Emerald field in the North Sea proved to be commercially unviable. Petrobras selected the unit for the development of their oil resources. After being considered for the Marlim Sul field, the platform was assigned to the Roncador oil field
in the
Campos Basin
.
A conversion project became necessary to adapt the platform to the new field. The project, commenced in March 1997 (merely five months after the discovery of the oil field), was assigned to contractor Marítima Petróleo Engenharia, a company owned by Bolivian entrepreneur Germán Efromovich – who was personally connected to a former president and financial director of Petrobras – and with little experience in projects the size and complexity of P-36. The contractor was selected by Petrobras without open competitive bidding. Marítima selected subcontractors Noble Denton for design of the hull, Amec for the design of the topsides, and Davie Shipbuilding for construction. Petrobras was directly in charge of the mooring system, the flexible marine risers, and the subsea infrastructure. The decision was taken to keep the original Italian flag, which entitled the owners to receive subsidies from the Italian government.The associated agreement obliged the project to keep RINA as the classification society.The American Bureau of Shipping (ABS) was selected to verify the conformity of topsides equipment.
The rig was converted into a 31,400-tonnes oil production platform (with no drilling capacity) in Lévis, Quebec, starting in September 1997.With construction activities ongoing, Davie went bankrupt, which obliged Petrobras to conclude construction in the Mauá shipyard in Niterói, state of Rio de Janeiro.
P-36 left the Canadian yard in late October 1999. It first had to navigate the St. Lawrence River to Sept-Îles at the mouth of the river.This passage was carried out using three tugboats and took four days.The inclining test was executed at Sept-Îles.At the St. Lawrence estuary, the semi-sub was loaded onto the faster Mighty Servant 1, a heavy-lift ship. The 32,700-ton lift was the heaviest ever executed up to that time. The Mighty Servant 1 had to undergo dedicated structural works to accommodate the large rig. The dry tow to Niterói took nineteen days at an average speed of 12 knots (whereas a wet tow by way of tugboats would have required 50 days).
The change of shipyard pushed the cost of the project from US$354 million to over US$500 million (from US$ to US$ considering inflation). P-36 went on to operate for Petrobras on the Roncador oil field, 150 km off the Brazilian coast. Production started on 16 May 2000.
P-36 produced oil from 21 wells and injected water into the reservoir through five wells. A total of 90 marine risers were connected to the platform. As part of the conversion project, the original process plant on the topsides was completely replaced with new production equipment and utilities. The platform's nominal oil production capacity was 180,000 oilbbl per day, which at the time of construction was nearly twice the average production of the largest floating facility in operation. It also had gas production capacity of 254,000,000 cuft per day. By the time of the accident, six out of 21 wells were producing. Production had reached about 84000 oilbbl of crude – about 5–6% of the total oil produced by Petrobras – and 45,000,000 cuft of gas per day. The rest of the wells were scheduled to be connected to the platform by the end of 2005.
Oil produced by P-36 was exported to turret-moored FSO P-47 via subsea pipelines for later transportation to shore.P-47 was a floating storage and offloading facility converted from VLCC oil tanker Eastern Strength at the AESA shipyard in Cádiz, Spain.A part of the fuel gas produced by P-36 was also sent to the FSO for power generation.The semi-submersible also exported produced gas through a 10 in subsea pipeline connected to a platform manifold and from there through a 20 in pipeline to fixed platform PNA-1, from where the gas was sent to shore.
The unit had two pontoons, four columns, a large central caisson, and three decks.In order to accommodate the larger production facilities, a 13-m long cantilevered extensions was added to the aft main deck, spanning its entire breadth. Each column was retrofitted with a "stability box" that provided extra buoyancy. Additional stability boxes were installed on the pontoons.
P-36 was attached to the seabed with mooring lines using polyester ropes and vertically loaded anchors. This was the result of un upgrade of the mooring system of Spirit of Columbus, which had twelve lines reaching depths of approximately 500 m, whereas P-36 had sixteen, 1800 m long and designed for depths between 1200 m and 1520 m and minimum breaking load of 1000 tons (9.8 MN).
Technical innovations introduced in the project garnered acclaim in the industry. The Offshore Technology Conference (OTC) awarded Petrobras a distinguished achievement award in 2001 "[f]or outstanding advancements to deepwater technology and economics in the development of the Roncador Field; a timeline of 27 months from discovery to first oil production in a water depth of more than 1800 meters; made possible by the use of a dynamically positioned early production system, and a dedicated production system using steel catenary exporting risers, taut-leg polyester mooring, and subsea production hardware."
Columns
The starboard column at aft of the hull housed an emergency drain tank (EDT), ballast tanks, a waste oil tank, a deareator for pretreatment of injected water, a fresh water tank, and associated pumps and piping. The tanks were not standalone but integrated in the column outer shell. The spaces were ventilated through a dedicated set of ducts. A dedicated space within the starboard pontoon housed seawater pumps that supplied the plant with cooling water and firewater. The pumps were also serving as secondary source of ballast water.
The emergency drain system also included another EDT, housed in the port aft column. The tanks were connected to the production facilities on the topsides and between each other. Fluid transfer capacity to and from the tanks was provided by dedicated pumps, one in each column. Both tanks had a capacity of 450m3. Their purpose was to provide temporary storage for water and oil from the topsides process equipment during certain maintenance activities.
Accident
EDT burst and gas explosion
In the early hours of 15 March 2001 there were two explosions in the starboard aft column. The first explosion was caused by an overpressure event, the second by the ignition of leaking hydrocarbon vapors.
The first event was the burst of the starboard aft emergency drain tank (EDT). This had been mechanically isolated because its pump had been removed for maintenance. The atmospheric vent pipe of the tank was isolated with a blind flange to prevent water intake from other equipment on upper decks. However, a valve exposed to backflow from the production header was leaking. This allowed oil from the process plant on the topsides to flow into the starboard aft EDT. The leaking valve was also exposed to the discharge side of the port aft emergency drain pump. When this pump was started, water from the port aft emergency drain tank flowed through the valve into the starboard aft EDT (although this resulted in a decreased inflow to the tank). The pump had been started in the late evening of 14 March. It took about two hours for the pressure in the tank to reach about 10 bar(g). The EDT was not a pressure vessel. Being continuously open to the atmosphere through a vent pipe (which had been temporarily isolated), it was designed to withstand pressures barely higher than the atmospheric. As a result, the EDT walls started to deform. At 12:22 am the tank shell gave way. At this moment, 50% of the starboard aft EDT was filled with water, with a 4-meters oil layer on top of it. Water and oil spilled into the column from the tank. The 18 in seawater line that run along its wall failed, resulting in flooding of the column space. Additionally, the firewater system lost pressure due to the pipe failure. Because of the logic programmed in the control and safety system, this resulted in the platform shutdown and the activation of the firewater pump in the starboard aft column, which was trying to compensate for the loss of pressure. This further exacerbated the flooding. The passage of water between different compartments within the column was facilitated by the ventilation dampers failing to close automatically. This allowed a path for the flooding to extend to other levels. Some manholes in the lower part of the column had been left open.This furthered the flooding in lower spaces including one of the stability boxes and a ballast tank.The seawater pump short-circuited because it became submerged; however, flooding continued because the sea chest valves allowing inflow of seawater from the ocean were designed to fail in their set position and therefore they remained open.The flammable vapors from the EDT dispersed and climbed to the decks above the column through watertight doors and ventilation ducts that had been left open in preparation for unrelated maintenance activities.The presence of the vapors was revealed by the gas detectors on the main deck.
At 12:39 am the vapors ignited. The ensuing gas explosion killed eleven people – all Petrobras employees – who were in the area taking part in the emergency response. Of the 11, ten perished immediately and one died a week later.
Sinking
Within five minutes of the gas explosion, the rig started developing a list. Operators tried to contain it by filling the port forward ballast tank, i.e., the one diagonally opposite the column affected by the explosions. However, this operation was unsuccessful and probably contributed to make the situation even worse. At the time of the accident, there were 175 people on the rig, of whom 85 crew members. Evacuation of non-essential personnel started at 1:44 am. In about two and a half hours 138 non-essential workers were evacuated using a crane and a personnel transfer basket. The evacuees were taken onboard FSO P-47, which was 12 km away. When all options to level the platform seemed exhausted, it was decided to evacuate all remaining personnel on board. This was completed by 6:03 am using helicopters, with the platform tilting at an angle of 6°. The list increased to about 20° by 8:15 am. This was sufficient to allow further down-flooding through the hawseholes (or openings to the anchor chain lockers). This event made the later sinking of the platform inevitable. Later, the starboard aft pontoon tanks also began to flood through their vent ducts.
A team of close to 350 engineers worked to reduce the listing in the following days. Twelve vessels were deployed to assist in the emergency. By 4:30 pm on 16 March, divers and other specialists were on board. Attempts were made to recover the bodies of the workers killed in the blast. However, the space in which the bodies rested were completely flooded at this point. Later that evening, around 30 people were on the listing platform, trying to seal off leaks in order to avert sinking. Smit International were among those contracted for the emergency operations.The technicians from the Dutch marine salvage company arrived by the afternoon of 17 March with 50 tons of equipment.At 4:30 pm the salvage team started injecting 200,000 liters/hour of nitrogen in the flooded compartments in order to displace the water that was flooding them.
Oil spill
P-36 had an estimated 1200 m3 of diesel oil and 350 m3 of crude oil remaining on board.About 350 m3 of hydrocarbons surfaced in the hours after the sinking.Thirteen ships intervened to deploy containment booms.The hydrocarbon sheen was partly recovered with the rest dispersed using chemicals. The environmental impact of the accident was limited thanks to the successful isolation of the wells. According to Petrobras, a sampling campaign was carried out 8 to 10 days after the accident and did not identify abnormal changes in the seawater quality. However, the Brazilian Institute of Environment and Renewable Natural Resources (IBAMA) later imposed significant fines on the company, judging there had been substantial water pollution and the use of dispersants had itself negatively impacted the environment.
Aftermath
Impact of the accident and criticism of Petrobras
In terms of lives lost, P-36 was the worst offshore oil and gas accident in Brazil since the 1984 blowout and explosion on a Petrobras drilling rig in the Enchova field (also part of the Campos Basin), which caused 36 fatalities, and the worst worldwide since the explosion of a Mobil platform off Nigeria in January 1995, which killed 13. Total damages from the accident were estimated to be in the region of US$1 billion. The salvage operation alone cost an estimated US$100 million. By July 2001, Petrobras had received a US$500-million (or US$-million counting inflation) insurance settlement for the loss of the platform. The revenue loss was substantial, as the platform was making the company an estimated US$40-million (or US$-million counting inflation) monthly. As a consequence of the accident, Petrobras' insurance premium increased from US$10 million to US$48.8 million (or from US$ million to US$ million counting inflation) for a diminished insured value (US$20.9 billion – or US$ billion counting inflation – compared to US$32 billion – or US$ billion counting inflation – from before the accident).
The slow sinking of the platform attracted significant attention from the media. A national debate over the responsibilities for the accident and whether the platform could have been salvaged was sparked in Brazil as a result. Two days after the rig sank, Brazilian oil workers went on a nationwide strike. Petrobras were criticized by trade union organization Unified Federation of Oil Workers (Federação Única dos Petroleiros, FUP) for the lack of measures put in place to ensure the safety of their workers, citing the deaths of 81 workers over the three years leading to the accident. The FUP blamed the company for their cost-cutting initiatives (in spite of recent growth in revenue and activities), referring to excessive outsourcing to poorly trained contractors and the substantial downsizing of their own workforce in the decade prior to the P-36 sinking (from 62,000 employees in 1989 to 34,000). The decision to place the EDTs in the columns has been cited as a direct consequence of the company's focus on financial performance. Both Sindipetro (Sindicato dos Petroleiros, Oil Workers Union) and AEPET (Associação dos Engenheiros da Petrobrás, Petrobras Engineers Association) blamed the high number of safety and environmental accidents occurred in the organization on the neoliberal management approach adopted by chief executive officer. Reichstul resigned in late 2001. Although he cited personal reasons, the string of accidents occurred during his three-year tenure may have played a role in his move. Petrobras received further criticism for operating the platform with systems (such as the production caisson) not yet fully commissioned by the date of the accident. It also transpired that the electronic maintenance management system had not yet been set up and the emptying of the port aft EDT was not supervised. As a direct result of the disaster, the company implemented an operational excellence program.
Investigations
A governmental investigation commission was appointed shortly after the accident by the Chamber of Deputies.Another dedicated commission was formed by the National Agency of Petroleum, Natural Gas and Biofuels (ANP) and the Directorate of Ports and Coasts (DPC), an agency of the Brazilian Navy. This included members from both organs and had the mandate to investigate the causes of the accident and propose recommendations for the offshore oil and gas industry. Other independent investigations were carried out by the Rio de Janeiro Regional Council of Engineering and Agronomy (CREA-RJ) and the Maritime Court (Brazil). Petrobras organized their own investigation around a team of internal experts and representatives invited from the Oil Workers Union and the Federal University of Rio de Janeiro.Certification body Det Norske Veritas (DNV) was hired to oversee the integrity of the investigation.
The ANP–DPC report was published in July 2001. It identified a series of non-conformities that led to the loss of the platform. The first cited in the report is the practice to store large amounts of water contaminated with hydrocarbons in the emergency drain tanks, contrary to the operations manual. Other problems identified were systematic errors in the manual level measurement of the EDT; issues with the discharge of the open drain vessel (possibly due to the malfunction of its pump) that resulted in regular overflow through its vent pipe into the EDT; poor isolation of the starboard aft EDT, in concomitance with the blind flange isolation of its atmospheric vent, which was the factor that allowed backflow in otherwise sealed EDT and ultimately to its failure; the necessity of lining up the EDTs to the high-pressure production header, which caused exposure to backpressure, instead of low-pressure production caisson; absence of adequate supervision of the emptying of the EDT; inadequate hazardous area classification and absence of gas detectors in the column internals; ineffective emergency response, in terms of both communication and organizational aspects; failure of the ventilation dampers to close and isolate adjacent column spaces, which facilitated the progressive flooding of the column; multiple manholes to key spaces providing buoyancy, which led to the flooding of a ballast tank and a stability box; ineffectiveness of the flooding containment response and insufficient training of the personnel in charge of this operation; two seawater pumps out of operations, which led the automatic safety system to start the seawater pump in the damaged column, thus causing its flooding.
Legal proceedings and fines
The Federal Public Prosecutor's Office filed a public civil action demanding compensation from Petrobras in the amount of R$100 million (US$42.6 million, or US$ counting inflation). Petrobras later appealed this decision and managed to reduce the fine by 50%.
IBAMA imposed fines for R$17 million (US$7.2 million, or US$ counting inflation) for the environmental damage caused by the hydrocarbon spill and the use of chemical dispersants. Petrobras challenged the decision. In 2023 the Superior Court of Justice confirmed Petrobras had to pay R$5 million (US$1 million, or US$ million counting inflation) for the environmental damage caused.
In July 2005, the Maritime Court ordered Petrobras to pay a fine of R$12,000 (US$, or US$ counting inflation) for negligence in the maintenance of the platform and for placing the EDT in an inappropriate location in disregard of safety standards. The military court also ordered five employees of the state-owned company to pay R$1,200 (US$, or US$ counting inflation).
Eleven indemnification lawsuits were filed by the families of the deceased. Petrobras paid the relatives the equivalent of lifetime salaries. They also provided the families' children with fully-paid education scholarships through college.
Petrobras and Marítima (through its subsidiaries Petrodeep and Petromec) entered a litigation around the insurance settlement. When the state oil company received the settlement monies (US$500 million, or US$ million counting inflation), they passed on to the trustee in charge of redistribution to the creditors – Arab Banking Corporation, later substituted by Den Norske Bank – the amount they would have paid the contractors through the
Redevelopment of the Roncador field
P-36 was replaced by FPSO Brasil, a ship-shaped floating platform leased from SBM Offshore. The FPSO started its lease contract with Petrobras in December 2002. It was demobilized in 2014. In November 2007, the semi-submersible platform P-52, built in Singapore and Brazil, came into operation to further supplement production.FPSO P-54, converted from an oil tanker at the Jurong shipyard in Singapore and the Mauá shipyard in Niterói, followed in December 2007.
Impact on process safety
The accident stressed the importance of upholding key elements of process safety management. It is now commonly used as a case history to illustrate the criticality of the process safety elements that failed on the occasion of the accident, among which were:
It has been suggested that the hazardous area classification of the column spaces was not correct. The spaces were identified as safe, while the presence of the emergency drain tanks – vessels containing flammable hydrocarbons – with associated pumps and pipework should have required a less optimistic zone classification and dedicated gas detectors should have been provided in those spaces. Poor alarm management has also been cited as a contributing factor. In the 17 minutes between the mechanical failure of the EDT and the gas explosion 1,723 alarms went off, with no prioritization system in place to support operator decisions.
Following the accident, some rule-making bodies proposed banning storage of hydrocarbons in the columns of semi-sub platforms and recommended new requirements for additional reserve buoyancy installed on the upper decks.
The P-36 disaster was a catalyst for the reformation of the regulatory regime of offshore oil and gas activities in Brazil. In 2007 the ANP issued their Resolution 43, which established an operational safety regime for offshore drilling and production installation. The resolution imposed the adoption of an operational safety management system based on seventeen key management practices.
Safe work practices:
Mechanical isolation of the starboard aft emergency was not carried out properly. The accident proximate cause was a valve passing that allowed the tank to become pressurized beyond its mechanical limits. The tank should not have been isolated by only closing its valves, but positive isolation should have been achieved by placing a blind flange in the flow path from the port aft emergency drain pump.
The use of the EDTs in the columns had become normalized, although the operations philosophy would have required only sparing use of the vessels.
Lining up the EDTs with the production header was not a standard operation, as it created a high pressure-low pressure interface liable to enable backflow from the topsides to the marine spaces. Fluid transfer should have been to the low-pressure production caisson instead.
Process knowledge management. The failure of this process safety element was manifested by the emergency response team not understanding how a designated safe space (the column internals) could become unsafe due to the presence of hydrocarbon-containing vessels. A gas test should have been carried out before entering the space, which would have prevented the ignition of the flammable cloud.
Emergency management. In particular, it is likely that the intervention of the emergency response team caused the ignition of the gas cloud.
By 11:30 am on the following day, it appeared as if the platform had stopped sinking.
The tilt had been reduced from 30° to 24°.
At 4:00 pm, Smit began injecting compressed air in another flooded compartment.
Work continued through the night.
However, on the morning of Monday 19 March, the rig resumed sinking and was abandoned due to bad weather.
The platform sank at 11:40 am on 20 March in 1360 m of water.
It now lies upside down on the seafloor.
The investigation commission recommended improvements in the operations management system; establishment and enforcement of robust design review processes; improved hazardous area classification; establishment of clear criteria for the selection of which systems may or may not be commissioned after the initial start-up of the platform; reassessment of the size and required skills of personnel; better management of conversion projects; assessment of the need for implementation of the IMO's International Safety Management Code; and improvement of emergency response plans.
The CREA-RJ report was issued in October 2001. It pointed to failures in management as the underlying causes of the accident. In particular, CREA found fault in the failure to complete construction and commissioning works prior to starting production. It also cited failure to shut down production when the platform would have needed it for equipment replacement.
The conclusions of the commission appointed by the Chamber of Deputies were published in March 2002. The commission found that it was not possible to pinpoint a single cause or an individual party responsible for the accident. Multiple faults were found with Petrobras as well as regulating and enforcing agencies. The commission pointed out that there were conflicts and overlaps between the government agencies – namely, the ANP, the Navy, and IBAMA – involved in the regulation, control, and law enforcement in the domain of offshore oil and gas activities. These agencies also did not have sufficient capability and competence. Among other recommendations addressed to Petrobras, the commission required that the company provide equal treatment to their own employees and external contractors and clarify their respective responsibilities in case of emergency situations; ensure that only Petrobras staff with sufficient competence and authority be assigned to emergency management duties; improve the training of external contractors; define a limit for the activities that may be executed by external contractors, as opposed to own staff; revise the organization of the field personnel in charge of operations, maintenance, and ship stability; reduce the bureaucratic workload on field supervisors to ensure they can focus on operations and safety; exclude lagging safety performance indicators (such as the number of accidents) from the criteria used to decide personnel promotions and bonuses, because this may lead to underreporting of accidents with a negative impact on their investigation and the implementation of lessons learned within the organization; reduce production targets; and give preference to Brazilian construction and service contractors over foreign companies.
Petrobras presented the results of their investigation at the Offshore Technology Conference in Houston in May 2002, one year after receiving an award at the previous edition of the conference for the innovations put in practice in the execution of the P-36 project. Petrobras' openness in sharing the details of the accidents was considered unprecedented. Their investigation focused mainly on confirming the source of the flammable gas that exploded. Different scenarios were modeled using computational fluid dynamics for the gas dispersion and structural response calculations to assess the deformation of the EDT walls and the failure of the seawater pipe.
However, Petrobras retained the balance of the sum.
Marítima's chief Germán Efromovich sued Petrobras on the basis that his company should be entitled to the entire settlement.
In 2004, Petrobras won the legal dispute in a London court.
This was one of several litigations between the two companies, which took place in Brazilian, British, and American courts.
Proceedings were brought about concerning different services and contracts, including for the construction of six drilling rigs that had been cancelled by Petrobras and the execution of the projects for the P-36, P-37, P-38, and P-40 platforms, which Petrobras claimed went over budget and schedule.
