Topic
Functional Safety
Safety functions implemented by electrical, electronic or programmable systems.
Documents
- 2026Sep
Shell Polymers Furnace Explosion and Fire — Furnace Explosion and Fire at Shell Polymers
Investigates the June 2025 furnace explosion and fire at Shell Polymers Monaca following coke-trap cleaning. Inadvertent opening of isolation valves allowed cracked gas to enter the firebox and ignite. The report examines reliance on administrative safeguards, safety instrumented system bypasses, alarm suppression and confusing valve interfaces, recommending engineered protection and improved interface design.
- 2026Mar
Production PINCs
Numbered regulatory inspection questions address production safety systems, well barriers and casing-pressure diagnostics. Checks cover shutdown valve operation, gas and fire detection calibration, firewater pumps, pressure relief and protective devices on process equipment. Conditional approval requirements and specified testing intervals support inspection of production facilities and subsea components.
- 202521 Oct
Risk assessment guidance note
Guidance for offshore petroleum operators on assessing major accident and wider health and safety risks. It explains qualitative, semi-quantitative and quantitative methods, likelihood and consequence analysis, control reliability and uncertainty. Safety-case documentation, ALARP arguments, workforce participation, assessment review and quality assurance underpin selection of appropriate controls.
- 20252 Oct
Dropped object due to over-ridden limit switch
A vessel crane operator bypassed limit switches while raising the hook for an overboarding lift. A mini beacon struck the clump weight and fell to the deck; a restraint and sensor cable also parted. Nobody was injured. The flash examines knuckle-boom configuration, override decisions, safety-system verification and safer equipment design.
- 202519 Aug
UK HSE: Motion Compensated Gangways Auto-Retraction
This IMCA flash summarises UK HSE concerns about unplanned retraction of motion-compensated gangways following power or control-system failures. It explains why simultaneous alarms provide inadequate warning and outlines required reviews of gangway arrangements and automatic-function testing, alongside recommended technical risk assessment and rigorous assessment of operator overrides.
- 20259 Jun
BSEE Safety Alert 501-BSEE Identifies Bypassed Safety Device Deficiencies
BSEE inspections of five production platforms identified poorly documented safety-device bypasses, non-operational data historians and overly broad maintenance bypasses. Findings included pressure protection disabled during startup and unreverted ladder-logic changes. Recommendations address bypass logs, electronic records, interface visibility, construction changes and verification of procedural compliance.
- 202513 Mar
Marathon Martinez Renewable Fuels Fire
Investigation of a renewable diesel startup fire at Martinez, California, following heater tube rupture. Low process flow and afterburning caused overheating, releasing diesel and hydrogen and seriously injuring an operator. The report examines valve alignment, instrumented safeguards, combustion monitoring, alarm responses, human factors and corporate oversight, with recommendations and comparisons to earlier incidents.
- 202414 Oct
Inappropriate automatic activation of fixed fire-fighting system
A harbour tug’s fixed engine-room firefighting system discharged all its gas after two blackouts within 24 hours. Activation was linked to a battery-voltage rise following a pilot-cylinder solenoid valve malfunction. Nobody was harmed. Lessons address electrical supply adequacy, emergency-system functionality and blackout drill protocols.
- 20241 Apr
Functional Safety Inspection Guide
Inspection guidance for assessing dutyholders’ management of functional safety against BS EN 61511. It covers lifecycle assessments, competence, SIL allocation and verification, safety requirements, commissioning, proof testing, maintenance and modifications. The Functional Safety Assessment Framework links compliance gaps to performance scores and initial enforcement expectations.
- 202311 Dec
Foundation Food Group Fatal Chemical Release
Investigation of a fatal liquid nitrogen overflow at Foundation Food Group’s poultry plant. A deformed bubbler tube disabled freezer level control and overflow protection, producing an oxygen-deficient room atmosphere. The report examines design dependencies, missing monitoring and ventilation, emergency preparedness, process safety management and regulatory gaps.
- 2023Dec
Overfill of vapour recovery units
HSE warns that a gasoline overfill exposed dependence between a vapour recovery unit’s process controls and overfill protection, resulting in loss of containment. The notice calls for risk assessment, physical verification, inspection, maintenance and testing of safety functions, with independent safeguards and control-system modifications where required, managed through change procedures.
- 202327 Nov
Failure of proportional valve in saturation chamber control
A proportional valve feedback fault interrupted saturation diving, without injury or equipment damage. Automatic safeguards isolated the line and transferred control to a manual valve. Unauthorised dismantling obscured the origin of potentiometer damage; debris was also found. Lessons address manufacturer-led maintenance, critical spares, training and testing before diving resumes.
- 20235 Jul
Lack of Uninterruptible Power Supply
Three offshore production incidents illustrate uninterruptible power supply failures affecting emergency power, communications and process controls. The alert examines capacitor damage, battery overcharging, inadequate maintenance instructions and outdated drawings. It recommends operators consider maintenance and testing programmes, thermal scanning, redundancy and emergency response arrangements for power loss.
- 202324 May
Loss of redundancy in diving bell launch and recovery PLC system
A diving bell launch and recovery system lost automatic PLC redundancy when a synchronisation module developed a faulty transmitting diode. Unavailable spares delayed repair. Following risk assessment and successful testing of independent processors and manual changeover, the vessel resumed work using temporary manual redundancy. Automatic redundancy was subsequently restored in port.
- 202221 Dec
Kuraray Pasadena Release and Fire
Investigation of an ethylene release and fire during reactor startup at Kuraray’s Pasadena plant, injuring 23 workers. It examines unsafe atmospheric pressure-relief discharge, disabled interlocks, alarm flooding, conflicting operating instructions and restricted flare use. Recommendations address safe discharge design, worker exclusion, operating limits, training and independent process safety assessment.
- 202224 Mar
Blackout Condition Results in Loss of Station Keeping Ability and Activates an Emergency Disconnect from the Well
During drillship well completion, an erroneous watermist-release signal caused the fire and gas system to shut down and block all engines, preventing automatic blackout recovery. The emergency generator operated as designed. The vessel drifted off location, and the driller activated emergency disconnection at the red watch circle limit, securing the well.
- 202111 Aug
UK HSE: Oil company fined for hydrocarbon release – lack of written procedures
This safety flash describes prosecution following a release of more than 1000 kg of hydrocarbon gas at Beryl Alpha during well depressurisation. Missing risk assessment and written procedures left a technician relying on memory. Inadvertent defeat of emergency shutdown prolonged the release, while workers remained at muster for more than six hours.
- 202123 Feb
Disabled audible alarm on fire alarm panel
Routine testing revealed a fire alarm panel giving a visual warning but no audible alarm. Inspection identified a disconnected cable, although how it became disconnected remained unknown. The flash records inadequate testing and maintenance oversight, and suggests members may wish to verify audible and visual alarm functions.
- 202111 Feb
Failure of remote control/emergency stop on rescue boat winch
During rescue-boat recovery, remote control and emergency-stop functions failed, and the limit switch did not stop retrieval. Inspection found a contactor stuck closed; frequent short switching intervals were considered the most probable cause. The flash emphasises correct retrieval procedures, component inspection and replacement, and regular emergency-stop function testing within planned maintenance.
- 201912 Aug
Fire in incinerator exhaust gas manifold
A vessel incinerator fire followed undetected flame failure, continued sludge pumping and subsequent reignition by the automatic diesel burner. An incorrectly set control resistor and a tampered exhaust sensor were identified. The flash describes firefighting and shutdown effects, and recommends testing flame-failure devices through planned maintenance.
- 201826 Nov
Revision of Standards for Powered Doors, Gates & Barriers
HSE explains why revised standards for powered doors, gates and barriers do not alone demonstrate legal compliance. The alert addresses assessment of users and operating environments, protective design, post-installation force testing, conditional checks before movement and suspension-failure detection. It also discusses reassessment and upgrades of existing products.
- 20183 Aug
Floating production platform evacuated amid power outage
A floating production platform in the US Gulf of Mexico was evacuated following a power outage. Failure of its sole operating UPS removed battery backup, while vessel management system logic obstructed emergency power restoration. The flash reports BSEE recommendations for consideration covering blackout procedures, protective features, technician knowledge and evacuation arrangements.
- 201811 May
Safety Alert 333 - Floating Production Platform Evacuated Amid Power Outage
This alert examines a floating production platform blackout and evacuation involving UPS failure, a potentially hazardous hydrogen release, deficient battery-room ventilation and shutdown logic that obstructed power restoration. Two further power incidents provide context. BSEE recommends considering reviews of black-start arrangements, electrical handover, ventilation maintenance and blackout-specific evacuation procedures.
- 201824 Apr
Packaging Corporation of America Hot Work Explosion
Investigation of a foul condensate tank explosion at PCA’s DeRidder mill that killed three contractors and injured seven. Air ingress created an explosive atmosphere; nearby hot work was the probable ignition source. The report examines turpentine recovery, outage conditions, permit limitations, process safety boundaries and explosion safeguards, with comparisons to earlier incidents.
- 20182 Mar
Loss of Containment (LoC) - Version 2 March 2018
Inspection guidance for assessing offshore oil and gas duty holders’ containment safeguards. It covers design, commissioning, operating limits, instrumented protection, relief, isolation, reinstatement and change management. Specialist sections address process hazards, FPSOs, tubing and hoses, alongside investigation, performance indicators, assurance and leadership.
- 201720 Apr
AirGas Facility Fatal Explosion
CSB investigates the fatal nitrous oxide explosion at Airgas in Cantonment, Florida, on 28 August 2016. Probable initiation involved transfer-pump heating during trailer loading, although the initiating event remains uncertain. Analysis examines flame arrestors, interlock design, pump changes and process safety management, alongside earlier explosions and recommendations for inherently safer design.
- 201616 Dec
Offshore crane safety systems
This flash summarises two crane boom failures involving ineffective upper hoist limits. One involved a missing pneumatic valve blanking plug and a hydraulic pump actuator fault; the other involved a defeated operational limit and incorrectly set ultimate limit. It recommends robust inspection and functional testing against manufacturers’ specified boom angles.
- 201625 Nov
Electrolytic Chlorination Units (Electrolysis) in Marine Ballast Treatment Systems
Safety alert following catastrophic failure of an electrolytic ballast-water treatment unit on a UKCS semi-submersible installation. It describes projectile damage and potential overpressure or hydrogen explosion hazards, including continued electrode operation during low or absent flow. Operators should assess risks, with attention to pressure relief and instrumented protection assurance.
- 20163 Oct
Fire-fighting water jet hits antenna – Failure of limits, stops and safeties
During monthly testing, a fire-fighting monitor’s water jet damaged a nearby MF/HF whip antenna. Investigation identified incorrect adjustment of the turning limit switch following contractor maintenance. The flash describes resetting the operating sector and recommends post-maintenance acceptance testing, verification of safety limits before tests and stopping unsafe work.
- 20157 Oct
Disabled and Non-Functional Safety Devices Leads to Destruction of Derrick Board
A drilling alert describes elevators bending a derrick diving board as the drill string was lowered. The driller attempted to float the elevators but did not notice that they remained extended. The link-tilt warning light was non-functional, and the electronic anti-collision shutdown system had been manually switched off.
- 201420 Nov
Functional safety in the Australian offshore petroleum industry
This technical bulletin explains functional safety risks in programmable and software-based control systems used in Australian offshore petroleum operations. It discusses software design faults, limitations of exhaustive testing, duty-holder obligations and Safety Case demonstrations. Standards-based hazard assessment, validation and ongoing testing are presented as recommended approaches, with equally effective alternatives permitted.
- 20145 Jun
Macondo Volume 2 Final Report
Volume 2 examines the Deepwater Horizon blowout preventer’s failure to seal the Macondo well, including off-centre drillpipe buckling, miswired solenoid valves and emergency-system assurance gaps. It uses forensic testing and modelling to assess barrier performance, comparing regulatory approaches and recommending lifecycle management and independent verification of safety-critical elements.
- 201421 Jan
Uncontrolled descent of diving bell
A diving bell underwent two uncontrolled descents during lowering into a vessel’s moonpool. Umbilical damage during the second descent caused loss of bell pressure, without injury. Investigation identified operator error, failed programmable safeguards, gaps in risk documentation and supervisory understanding, and insufficiently defined emergency arrangements and safety scrutiny.
- 2013Jan
Drill-floor machinery and tubular-handling safety
Guidance for users, suppliers and integrators addresses automated drilling machinery and tubular handling. It explains system-wide hazard identification through HAZOP, FMEA, FMECA and collision or contention matrices, alongside safety-function specification and integrity assessment. Fifteen incident examples illustrate shortcomings in design, protective systems, software management and operator interfaces.
- 20129 Mar
Safety Alert 300 - Unplanned Emergency Disconnect Sequence (EDS) of the Lower Marine Riser Package
An unplanned emergency disconnect occurred during powered troubleshooting of a semisubmersible rig’s BOP control panel, activating shear rams and disconnecting the lower marine riser package. Completion fluid escaped through failed-open valves. The alert distinguishes network faults from the activation mechanism and recommends job safety analysis, power disconnection, supervisory consultation and ribbon cable retention.
- 201114 Dec
Functional safety of control systems
This alert describes design weaknesses encountered in safety-related control systems across diverse applications. It explains how incorrect control functions can create hazards and highlights potentially hidden risks from programmable devices. Operators should audit systems to identify safety-related functions and assure adequate design, construction and maintenance.
- 2011Dec
Catastrophic failure of capacitor in aft harmonic filter room on passenger cruise ship RMS Queen Mary 2
Investigates a capacitor explosion aboard RMS Queen Mary 2 approaching Barcelona, followed by propulsion shutdown and blackout. The report examines undetected capacitor deterioration, defective imbalance protection, likely arc-flash, harmonic distortion, maintenance records and alarm design. It analyses protection testing and water-mist arrangements, and recommends improved monitoring and failure analysis.
- 20112 Nov
Mobile crushing plant - unintended movement of tracks
HSE warns of unintended mobile-crusher track movement following a fatal maintenance incident. Damaged control-cable insulation allowed an earth fault to trigger a track valve. The alert recommends additional cable protection and secure routing, consideration of fault monitoring, and inspection and maintenance where protection lacks monitoring, alongside appropriate isolation for maintenance.
- 2011May
Safety warning after malfunction of proximity switch results in failure of fall wire with loss of 1 life
This bulletin examines a fatal rescue-boat hoisting accident aboard Tombarra at Royal Portbury Docks. A defective proximity switch allowed powered hoisting to continue, causing the fall wire to part. It addresses winch overload potential, switch suitability and installation, and recommends pre-hoisting tests, manufacturer-led maintenance and verification of electrical equipment seals.
- 201114 Apr
Safety Alert 294 - Blowout Preventer Automatic Mode (Deadman) Activation
BOEMRE warns that a blowout preventer’s blind shear ram may reopen when power is restored following deadman activation. The alert recommends reviewing activation procedures and control logic, describes a possible blocking procedure, and explains requirements for seafloor testing and regulatory review during drilling permit approval.
- 20111 Apr
Crane motion reference unit (MRU) malfunctions after overheating
During FPSO mooring-chain inspection, a crane unexpectedly left active heave compensation mode and paid out approximately three to four metres of wire. An overheated motion reference unit supplied spurious signals, triggering shutdown. The flash describes cooling improvements, an air-conditioning trip alarm and start-up inspection, alongside further measures considered.
- 201127 Jan
Functional safety of control systems
This IMCA safety flash signposts NOPSA Safety Alert 45 on functional safety. It highlights potential control-system problems affecting cranes, diving systems and pipe-handling equipment, noting possible relevance to IMCA members. The supplied page provides no incident account, technical analysis or specific control recommendations.
- 201120 Jan
Bayer CropScience Pesticide Waste Tank Explosion
Investigation of a fatal residue-treater explosion during restart of Bayer’s methomyl unit at Institute, West Virginia. It examines runaway decomposition, bypassed interlocks, deficient startup preparation, operator training and emergency coordination. Detailed modelling assesses the adjacent methyl isocyanate tank’s blast shield, distinguishing actual damage from hypothetical release scenarios.
- 201030 Jun
Safety Alert to operators of "COMAH" oil/fuel storage sites & other storing hazardous substances in large tanks
HSE alerts bulk oil and hazardous-substance storage operators to installation and testing requirements for TAV high-level switches. Test levers or plates must be correctly returned and secured to avoid apparent test functionality masking inoperative protection. The June 2010 amendment extends applicability to some single-pole, single-throw switches, depending on magnet configuration.
- 2009Sep
INDSPEC Chemical Corporation Oleum Release — INDSPEC Case Study
This case study analyses an oleum tank overflow at INDSPEC’s Petrolia facility, producing sulfuric acid mist and prompting community evacuation or shelter-in-place. It examines an alternative pump power supply that bypassed automatic shutdown, undocumented weekend practices and shortcomings in hazard analysis, change management, operating procedures and safeguard evaluation.
- 200819 Dec
Failure of pipe handling system causes injuries and fatalities
A J-lay control-system reset led to the release of two quadruple pipe joints when hydraulic power restarted. One destroyed an access platform, injuring eight people, four fatally. The flash identifies software design and uncontrolled access as primary causes and describes revised controls, operating procedures and personnel restrictions.
- 200823 Sep
Safety Alert 266 - Trouble Shooting Production Platform Upset Problems
A platform flash fire followed separator level-safety malfunction, condensate carry-over and wind-blown hydrocarbon mist reaching hot generator exhaust piping. The alert recommends troubleshooting upstream level set points, cleaning sight glasses, monitoring flare-scrubber accumulation and minimising disabled safety devices during restart. Flare-piping relocation may be required to avoid ignition sources.
- 20089 Jul
Safety Alert 265 - Pipeline Ruptures Spilling 870 Barrels of Crude Oil
A vessel anchor severed a 14-inch crude oil pipeline, spilling approximately 870 barrels into the Gulf of Mexico. The alert examines delayed isolation, unsuitable pressure-sensor settings and shutdown-valve arrangements that increased the release. It recommends considering emergency communication agreements and reiterates regulatory requirements for pipeline protection and shutdown systems.
- 200810 Apr
Fatal accident in connection with the operation of an A-frame based launch and recovery system (LARS) used for ROV operations
A safety flash describes a fatal trapping incident during ROV umbilical maintenance aboard a vessel in a floating dock. A blackout coincided with uncontrolled winch spooling that lifted the tether management system. Analysis identifies six interacting technical mechanisms and details wiring, controller software and hydraulic isolation modifications to improve emergency stopping.
- 2008Mar
Do your shutoff systems actually work? — Process Safety Beacon, March 2008
A chemical feed tank overflowed despite its high-level shutoff interlock because liquid downstream of the closed valve could still fill the tank. The bulletin explains the importance of valve location and switch height, and recommends testing complete safety systems rather than individual components.
- 2008
Advice on gas detection strategies for HVAC duct inlets
This information sheet advises duty holders on detecting flammable gas entering offshore HVAC ducts, with possible relevance to onshore installations. It examines uneven gas mixing and recommends reviewing detector sensitivity, alarm thresholds, positioning and cross-sectional coverage. It also discusses infrared and aspirated systems, mixing elements and limitations of downstream detector placement.
- 2007Jun
Emergency Shutdown Systems for Chlorine Transfer — Safety Bulletin
This bulletin contrasts chlorine transfer hose failures at DPC Enterprises and Honeywell, showing how emergency shutdown performance affected release consequences. It explains excess flow valve limitations, recommends reliable detection and isolation arrangements with periodic testing and maintenance, and examines regulatory gaps in chlorine railcar unloading.
- 2007Mar
Formosa Plastics Vinyl Chloride Explosion — Final Investigation Report
Investigation of the fatal vinyl chloride release, explosion and fire at an Illinois PVC plant. It examines reactor valve interlock bypassing, operator access to status information, safeguard assessment and missed learning from earlier incidents. Emergency procedures, training and deluge limitations underpin recommendations for stronger process safeguards and preparedness.
- 2005Mar
Accidental release of vinyl chloride monomer from liquid gas carrier Coral Acropora exposing at least 33 people to vapours
MAIB investigates a vinyl chloride monomer release aboard Coral Acropora at Runcorn during preparation for cargo discharge. Pump-assisted sampling transferred cargo between tanks, with open valves and overridden safeguards contributing to over-pressurisation. The report examines segregation, alarm overrides, sampling precautions, ship–shore coordination and emergency arrangements.
- 20031 Sep
Fire inside Falcom steamer
A galley steamer fire involved glowing heating elements and a blocked water feed. Closing the door deprived the fire of oxygen, and power was switched off. The investigation identified missing low-water warning and fail-safe protection. Recommendations called for daily water-flow checks and enquiries to manufacturers about installing a fail-safe device.
- 198520 Jun
Safety Alert 142 - Pollution Because of Failure of Level Safety High Sensor and Level Controller
An oil tank’s level controller and high-level safety sensor failed, allowing oil into a low-pressure flare scrubber. Two barrels were blown overboard when the compressor shut down and routinely vented gas. Paraffin blocked the float cage, and the controller float was set too high. Planned measures include float repositioning and periodic solvent injection.
- 19818 Jun
Safety Alert 101 - Explosion
An alert describes a Gulf of Mexico platform explosion after a malfunctioning automatic control system was bypassed and a heater’s fuel shutdown valve removed from service. An employee attempted manual ignition without purging the firebox, suffering serious injury; the heater was destroyed. The operator subsequently instructed employees against bypassing burner controls.
- 197721 Jan
Safety Alert 55 - Safety Equipment Failure
An offshore production platform spilled approximately twelve barrels of oil following failures of pump controls and a tank high-level shut-in device. The alert describes the lead pump shutdown, lag pump failure to start and alternative shut-in failure explanations, alongside replacement devices, a timing reset and modifications enabling shutdown-circuit testing.
- Undated
Gas Leak Triggered Equipment and Production Well Shutdown
BSEE investigates a gas leak on unmanned West Delta 30 Platform P that triggered shutdown of a compressor, separator and nine production wells. Findings attribute piping corrosion to poorly maintained coatings. The report examines low-pressure shutdown functions and records installation of a temporary clamp before production resumed.
- Undated
Gas Leak Prompts Shutdown and Muster on Ursa Platform
BSEE investigated a gas leak at Shell’s Ursa platform caused by failed recycle-valve packing. Gas detection prompted compressor shutdown, blowdown, emergency shutdown and a platform muster. No injuries or equipment damage occurred. Replacement packing was tested without detected emissions; BSEE made no recommendations.
- Undated
Compressor Piston Failure and Fire with Shutdown System Failure
BSEE investigates a compressor piston failure and fire at South Marsh Island 128 B. Operators extinguished the fire without injuries. The vibration switch tripped but failed to initiate shutdown; frozen condensation was suspected. The report records switch testing and desiccant dryers ordered for the pneumatic control supply.
- Undated
Flash Fire After Line Heater Overflow onto Compressor Exhaust
The investigation examines a flash fire at Main Pass 288-A after overheated glycol and antifreeze overflowed a line heater onto compressor exhaust. Findings address temperature-controller malfunction, failed protective shutdown and an obstructed burner viewing port. Recorded corrective actions include controller replacement, containment around the hatch and changes to level protection.
- Undated
Unintended Emergency Disconnect Releases Completion Fluid During BOP Control Troubleshooting
An investigation examines an unintended emergency disconnect on ENSCO 8500 that released 849 barrels of calcium chloride completion fluid to sea. Troubleshooting live BOP control-panel wiring caused a relay voltage drop. Findings identify absent work authorisation, task risk assessment and procedures, alongside failures to communicate and follow an engineering bulletin.
- Undated
Arc Flash and Fire at Tension Leg Platform
Investigation of an arc flash and resulting fire at the A-Auger tension leg platform. The report examines breaker resetting during continuing alarm conditions, unconfigured fault trips, fuse sizing and missing reclosure lockouts. It identifies electrical design and operational issues and records an estimated $500,000 in damage.
- Undated
Heater Backfire During Platform Restart After Emergency Shutdown Testing
This investigation examines an Ambitrol heater backfire during platform restart following emergency shutdown testing. Inadequate purging, unreliable air/fuel ratio valve operation and excess fuel admitted by the programmable logic controller allowed an explosive mixture to accumulate. The heater cover was dislodged; no personnel injury, environmental incident or fire resulted.
- Undated
Oil Discharge Through Sump Vent During Platform Restart
An investigation of a reported one-barrel oil spill during offshore platform restart identifies discharge from a relief scrubber before closed drain sump pumps were reset. Hydrostatic pressure forced oil through the sump vent. Findings discuss unfamiliarity with restart protocols, unchanged logic following pump replacement, and subsequent vent and safety-system modifications.
- Undated
Partial Power Loss Disables Safety Systems During Generator Fuel Switching
BSEE investigates partial power loss at the Appomattox platform during generator fuel switching. Failed UPS capacitors and undersized fuses disabled the fire and gas processor, preventing emergency generator starting. Bypassing the UPS restored this capability. No injuries or pollution were reported; the facility had not begun oil production.
- Undated
High-Pressure Gas Release Following Transmitter Replacement
BSEE investigates a high-pressure gas release on Atlantis following installation of unsuitable Teflon seals during transmitter replacement. Findings address contractor oversight, procedural knowledge, training and safety culture. Buyback gas prolonged the release, while bypassed shutdown functions and poorly positioned detectors undermined detection and emergency response.
- Undated
Discharge-Hose Fire During Drilling-Fluid Heater Commissioning
Investigates a discharge-hose fire during commissioning of a drilling-fluid heater aboard Deepwater Asgard. Incorrect junction-box connections and twisted wires produced false temperature signals, preventing heater shutdown. The report examines wiring tests, inadequate commissioning procedures and planned equipment and procedural changes. Portable extinguishers controlled the fire; no injuries were reported.
- Undated
Unplanned Travelling Block Descent During Automatic Drilling
An investigation examines an unplanned travelling-block descent during automatic drilling. The anti-collision system stopped block movement while the auto driller continued counting elapsed time. Disengaging the system resulted in an 18-foot descent. The report identifies software design as a contributing cause and records no equipment damage.
- Undated
Heater Treater Fire Following Oil Leak Through Fire-Tube Pinhole
An investigation examines a heater treater fire caused by produced oil leaking through a fire-tube pinhole near the burner. It identifies corrosion, inadequate inspection and unrepaired damage, alongside safety-system failures requiring manual platform shutdown. Operators extinguished the fire using firewater hoses; no injuries were reported.
- Undated
Uncontrolled Travelling-Block Descent During Casing Running
An investigation examines uncontrolled travelling-block descent during casing running on GSF Development Driller I. Motor connection faults, delayed slip detection and limitations in emergency braking are described. The block reached the cleared rig floor without injuries or pollution. Corrective actions included revised brake logic, shorter delays and motor torque checks.
- Undated
Deluge Wiring Fire Following Hot Work in Welding Enclosure
BSEE investigates a fire following hot work in a pressurised welding enclosure on Holstein platform. Slag entered incorrectly wrapped protective felt and ignited deluge wiring. The report examines firewatch positioning and disabled detection, recommending a second firewatch and continuous control-room monitoring, alongside planned separation of detection power supplies.
- Undated
Platform Fire After Pump Isolation Valve Released Oil onto Hot Exhaust
BSEE investigates a fire on the MC 547 A platform after a cracked pump isolation valve released oil onto hot engine exhaust. Findings identify inadequate support and fatigue damage. The report examines automatic shutdown, firefighting and muster, alongside evidence of unquantified pollution despite the operator’s initial denial. No injuries occurred.
- Undated
Transformer Failure Causes Total Power Loss During Well Completion
Investigation of a transformer failure aboard Deepwater Pontus during well completion operations. Total power loss led to vessel drift, emergency disconnection and seabed damage to the lower marine riser package. The well remained secure, with no injuries or pollution. Findings identify unmonitored breaker position and planned monitoring improvements.
- Undated
Fire in Rental Lube-Oil Filtration Unit
BSEE investigates a fire in a rental lube-oil filtration unit on Chevron’s Big Foot platform. Disabled safety devices, closed inlet and outlet valves after restart, and unattended operation contributed to overheating, hose rupture and oil ignition. The report describes foam firefighting, personnel muster and subsequent enforcement; no injuries were reported.
- Undated
Synthetic-Based Mud Discharges During Drilling
Investigates two synthetic-based mud discharges from Diamond Ocean Blackhawk during drilling in Walker Ridge 51. Software altered slip-joint packer alarm limits without crew awareness, while pressure monitoring was inadequate. Interim measures kept both packers energised and required hourly pressure checks and manual limit adjustments pending manufacturer updates.
- Undated
Explosion and Fires Aboard Liftboat Brazos Following Well Test
BSEE investigates an explosion and fires aboard liftboat Brazos following a well test, injuring two workers. Gas escaped through inadequately secured tank hatches and entered a diesel generator. Findings address deteriorated seals, failed automatic air-intake shutdown, nitrogen-assisted separator draining, missing procedures and inadequate job safety analysis.
- Undated
Heater Treater Overheating on Offshore Platform
BSEE investigates heater treater overheating at Castex’s Vermilion 252-A platform on 9–10 September 2019. The report examines burner adjustment, restricted exhaust flow, ineffective temperature shutdowns, inadequate thermowell installation and delayed shut-in. It records equipment damage, inspection deficiencies and subsequent liquid-level corrections, while retaining uncertainty over several contributing mechanisms.
- Undated
Platform Blackout During Uninterruptible Power Supply Replacement
Investigation of a Thunder Horse platform blackout during uninterruptible power supply replacement. It examines inverter failure, power synchronisation tolerances and a persistent abandon-platform signal, alongside battery-room gas readings and evacuation. Recommendations address black-start procedures, protective features, engineering handover, blackout evacuation arrangements and critical ventilation performance.
- Undated
Crown Motion Compensator Bracket Fell Following Drill-Line Slipping and Cutting
Investigation of a crown motion compensator incident following drill-line slipping and cutting on Deepwater Conqueror. Rapid cylinder retraction sheared bumper assembly bolts, allowing a bracket to fall to the drill floor. Findings identify procedural non-compliance and a software logic error; subsequent measures included revised procedures, training and tested software changes. No injuries were reported.
- Undated
Gas Release Following Sand Damage to Well Equipment
Investigation of sand damage and a subsequent gas release from well A-15 at HI-A571. Sand damaged the choke and pressure-relief discharge piping, blocked pressure-sensing lines and impeded safety-valve closure. Manual wing-valve closure stopped the leak. Investigators also found a gas-detection shutdown relay bypassed and identified inadequate monitoring for continued sand production.
- Undated
Pipeline Ruptures During Preparations for Hot Work
Investigation of a pipeline rupture during preparations for hot work at WC-294. The report identifies an unverified well shut-in, overlooked SCADA warnings and a shared solenoid that defeated pressure shutdown functions. It discusses deficient shutdown procedures and testing, and recommends verifying satellite well closure before closing the host facility’s incoming valve.
- Undated
Crane Overload Protection Lowered Basket onto Deck During Drilling Tool Offloading
Investigates a crane incident during offloading of drilling tools. A temporary weight-indicator repair caused the computer to count actual and simulated loads, triggering overload protection and lowering the basket onto the deck. No injuries occurred. Responses included personnel training, revised rig procedures and dissemination of lessons learnt.
- Undated
Cargo Box Fell Following Crane Winch Failure During Offloading
BSEE investigates an auxiliary crane winch failure during cargo offloading at Front Runner. A cargo box fell approximately 20–30 feet before striking a supply vessel and entering offshore waters. The report examines ring-gear fatigue, overloading, shock-loading, incorrect manifested weight, inspection records and alarm-triggered shutdown behaviour. No injuries occurred.
- Undated
Four Pollution Events on Offshore Production Platform
Investigation of four pollution events at SP 49-A platform during November and December 2006. The report describes treatment-system upsets, an unattended pig-trap valve and bypassed emergency shutdown safeguards. It identifies training, supervision, unsafe practices and fatigue as probable and contributing causes, and recommends an audit emphasising facility-specific operator training.
- Undated
Emergency Buoy Disconnect Failed Following Loss of Station
BSEE investigates a failed emergency buoy disconnect on Helix Producer 1 following weather-related loss of station. Subsea production shut in successfully, but a hydraulic piston failed to open. The report details disconnect-system testing, piston replacement and subsequent maintenance measures; teardown inspection found no cylinder failure, and no injuries or infrastructure damage were reported.
- Undated
Pipeline Rupture Following Closure of Incoming Boarding Valve
Investigation of a pipeline rupture at MP 69 Echo following closure of an incoming boarding valve at MP 69 Delta. Pinned-open safety-valve relays prevented the E-1 well from shutting in, causing pipeline overpressure. The report examines safety-panel logic, piping failure analysis and damage to platform equipment and structure.
- Undated
Waste-Oil Tank Flash Fire aboard Drillship
A waste-oil tank flash fire aboard the Pacific Sharav drillship distorted the tank and damaged an isolation valve, with no reported injuries. Investigators identified a failed level switch that allowed the heating element to become exposed. The report records isolation actions and a proposed relocation of the suction line above the heater.
- Undated
ConocoPhillips - Eldfisk - Investigation of emergency shutdown and acute oil spill
Investigation of emergency shutdown and an ensuing oil spill at the Eldfisk complex in August 2014. It examines output-card failure, safety-system design, production restart with an open blowdown valve, drainage limitations and operator interfaces. Findings address restart verification, maintenance testing, modification documentation and delayed personnel accounting.
- Undated
Cyber Security for Industrial Automation and Control Systems (IACS) Operational Guidance
Operational guidance helps inspectors assess cyber security for industrial automation and control systems affecting major accidents or essential services. It covers management systems, asset identification, zones and conduits, threat-based assessment and defence in depth. Technical measures address access, segregation, hardening, patching, monitoring and recovery, with cautions about testing operational systems.
- Undated
Equinor – Aasta Hansteen – investigation of gas leak
The PSA investigates a gas leak from a rupture-disc holder in Aasta Hansteen’s high-pressure flare system. It examines disc installation, bolt clamping, piping alignment and inconsistent flare-valve opening requirements. The combined leak rate was assessed as exceeding 0.1 kg/s. A subsequent similar incident leaves the relative importance of causal factors uncertain.
- Undated
Equinor – Gullfaks C - investigation of oil spill
Investigation of an oil discharge during Tordis production startup at Gullfaks C. Premature opening of a separator water outlet, combined with emulsion problems, allowed oil through the produced-water treatment system to sea. The report examines valve leakage, unavailable oil-in-water monitoring, shutdown overrides, deficient startup procedures and absent systematic risk assessment.
- Undated
Equinor – Njord A – investigation of oil spill
Investigation of an oil spill from Njord A through its produced water system. A manually fixed valve and failed low-level shutdown allowed discharge for two hours and twenty minutes. The report examines gamma-based level measurement, calibration and testing deficiencies, shared control and shutdown dependencies, and missing valve travel limitation.
- Undated
Equinor – Sleipner B – investigation of fire
This revised investigation examines the Sleipner B variable speed drive fire on 22 October 2024. The initiating cause remains uncertain. It analyses electrical supply dependencies, unavailable firewater, smoke containment, ventilation, maintenance and emergency response, identifying seven non-conformities. Material damage and prolonged production shutdown occurred, without reported injuries or discharges to sea.
- Undated
Teekay Petrojarl Production - Petrojarl Knarr - Investigation of fire
Investigation of an HVAC filter fire on Petrojarl Knarr examines steam-valve control, commissioning tests, maintenance and emergency response. It identifies inadequate fire-water provision and training assurance, while recording effective smoke detection and fire dampers. Laboratory testing did not establish an unequivocal ignition cause under actual offshore conditions.