Vous êtes sur la page 1sur 231

Title:

PETROBRAS 10000

SAFETY CASE

Revision Status:

Manual Number: PBS-HSE-SC-001


Issue Number: 02
Revision Number: 00
Revision Date: December 13, 2016

NON
CONTROLLED
Hard copies are printed from an electronic
system and are not controlled
Petrobras 10000 Safety Case
Table of Contents

TABLE OF CONTENTS

DOCUMENT CONTROL / REVISION HISTORY

PART 1 SAFETY CASE INTRODUCTION

1.1 INTRODUCTION TO THE IADC HSE CASE GUIDELINES


1.2 EXTERNAL STAKEHOLDERS SAFETY CASE EXPECTATIONS
1.3 DESIGN AND COMMISSIONING OF NEW FACILITIES

PART 2 HSE MANAGEMENT SYSTEM

2.0 INTRODUCTION
2.1 POLICIES AND OBJECTIVES
2.2 ORGANIZATION, RESPONSIBILITIES AND RESOURCES
2.3 STANDARDS AND PROCEDURES
2.4 PERFORMANCE MONITORING
2.5 MANAGEMENT REVIEW AND IMPROVEMENT
2.6 REFERENCES
2.7 ATTACHMENTS

PART 3 RIG DESCRIPTION AND SUPPORTING INFORMATION

3.0 INTRODUCTION
3.1 GENERAL INFORMATION
3.2 PRIMARY STRUCTURE
3.3 DRILLING, COMPLETION AND WELL CONTROL
3.4 PLANT AND UTILITIES
3.5 FIRE AND EXPLOSION PROTECTION
3.6 EVACUATION AND ESCAPE SYSTEMS
3.7 ACCOMMODATION
3.8 WELL TESTING
3.9 DIVING SUPPORT
3.10 OTHER THIRD PARTY EQUIPMENT
3.11 RECOMMENDED DRAWING AND SCHEMATIC LIST
3.12 REFERENCES
3.13 ATTACHMENTS

PART 4 RISK MANAGEMENT

4.0 INTRODUCTION
4.1 RISK MANAGEMENT PROCESS OVERVIEW
4.2 STRUCTURED HAZARD IDENTIFICATION AND CONTROL (SHIDAC)
PROCESS
4.3 IDENTIFICATION OF HAZARDS AND RISK SOURCES
4.4 RISK ESTIMATION
4.5 RISK EVALUATION
4.6 RISK TREATMENT
4.7 RISK ACCEPTANCE
4.8 RISK COMMUNICATION
4.9 REFERENCES

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 2


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Table of Contents

4.10 ATTACHMENTS

PART 5 EMERGENCY RESPONSE

5.0 INTRODUCTION
5.1 EMERGENCY RESPONSE MANAGEMENT
5.2 COMMAND AND COMMUNICATION
5.3 TRAINING FOR EMERGENCIES
5.4 TEMPORARY REFUGE ASSESSMENT
5.5 DETAILS OF EVACUATION AND ESCAPE EQUIPMENT
5.6 ESTABLISHING AND APPROVING LOCATION SPECIFIC
EMERGENCY RESPONSE ARRNAGEMENTS
5.7 REFERENCES

PART 6 PERFORMANCE MONITORING

6.0 INTRODUCTION
6.1 PERFORMANCE MONITORING
6.2 MONITORING
6.3 AUDIT AND AUDIT COMPLIANCE
6.4 VERIFICATION OF HSE CRITICAL ACTIVITIES / TASKS AND
EQUIPMENT / SYSTEM
6.5 CERTIFICATION
6.6 REFERENCES
6.7 ATTACHMENTS

ATTACHMENTS

4.1 HAZARD REGISTER


4.2 BOWTIE DIAGRAMS
4.3 COMPARTMENT RISK ASSESSMENT
4.4 SUMMARY OF OPERATION BOUNDARIES
6.1 SAFETY CRITICAL ACTIVITIES MATRIX

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 2


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

CONTENTS

1 Safety Case Introduction ..................................................................................................... 2


1.1 Introduction to the IADC HSE Case Guidelines ........................................................... 2
1.2 External Stakeholders Safety Case Expectations ........................................................ 3
1.2.1 Senior Management Demonstration......................................................................... 3
1.2.2 Safety Case Scope and Arrangements .................................................................... 4
1.2.3 Drilling Contractor Overview .................................................................................... 4
1.2.4 Safety Case Responsibilities.................................................................................... 5
1.2.5 Safety Case Reviews and Updates .......................................................................... 6
1.2.6 Continual Improvement ............................................................................................ 7
1.2.7 Remedial Action Plan / Recommendations .............................................................. 8
1.2.8 Safety Case Presentation ........................................................................................ 8
1.2.9 Regulatory Requirements ........................................................................................ 9
1.2.10 HSE Management.............................................................................................. 10
1.2.11 Environmental Impact and Aspect Assessments ................................................ 12
1.2.12 Justification for Continued Operation ................................................................. 12
1.3 Design and Commissioning of New Facilities ............................................................ 14

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

1 SAFETY CASE INTRODUCTION


Transocean Ltd. (Transocean) is an offshore drilling contractor and leading provider of
drilling management services worldwide. The main scope of Transocean (the Company)
operations is drilling exploration, oil and gas wells, well work overs and well completions.
As part of its global fleet, Transocean owns, manages and operates the Petrobras 10000
(herein called ‘the Rig’). The Petrobras 10000 is a dynamically positioned Mobile
Offshore Drilling Unit (MODU). The Rig was designed and built by Samsung Heavy
Industries, as an IMO DP Class 3, Dynamically Positioned Drillship, for exploration and
drilling activities worldwide.

This document presents the Safety Case (sometimes referred to as an HSE Case) for
the Rig. The Safety Case is presented in six parts in accordance with IADC Guidelines
Issue 3.6. The Safety Case demonstrates how Transocean applies a systematic risk
management approach to maintain and improve Health, Safety and Environmental
(HSE) and operational performance on board the Rig. As such, the Safety Case has two
primary purposes:

1. Demonstrate to Transocean senior management that the Rig’s HSE risk


management systems meet Company expectations

2. Demonstrate to external stakeholders (including customer and, where applicable,


regulators) that HSE risk management systems meet Company expectations, and
where applicable, regulatory requirements

Developing and maintaining this Safety Case provides continual assurance that existing
HSE risks are effectively managed. It also provides assurance that risks associated with
changes to equipment, activities or locations, as well as any systemic weaknesses
identified by incident analyses and audits, are effectively managed.

1.1 Introduction to the IADC HSE Case Guidelines


The International Association of Drilling Contractors (IADC) HSE Case Guidelines were
developed by members to provide a Safety Case methodology specifically for drilling
contractors that addresses the requirements and scope of operations related to their
business activities and that is aligned with international standards. They also:

 Allow easier review of drilling contractors’ Safety Cases by international regulators,


enabling rigs to operate in different global regulatory jurisdictions

 Demonstrate compliance with the International Safety Management (ISM) Code


requirements of the International Maritime Organizations (IMO) and any additional
regulatory and contractually agreed HSE requirements

 Demonstrate that internal processes and the Company’s HSE Management System’s
risk reducing measures meet senior management and stakeholders’ expectations

These Guidelines are not considered compulsory; however, their use is recommended to
not only align with good industry practice, but also ensure methodologies are consistent
with recognized practices and standards and to demonstrate management assurance
applicable to worldwide operations.

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

The Rig Safety Case comprises a number of parts; Part 1 – Introduction (this part), Part
2 – HSE Management System, Part 3 – Rig Description and Supporting Information, Part
5 – Emergency Response, and Part 6 – Performance Monitoring are applied in
conjunction with the structured risk management process described in Part 4 – Risk
Management to demonstrate that the Rig HSE risks are managed effectively.

Part 1 – The Rig Safety Case Introduction provides an introduction including senior
management commitment and overall Safety Case expectations.
Figure 1-1 Interrelationship of Safety Case Parts

A summary of the purpose of each of the Safety Case Parts is given in section 1.2.2
Safety Case Scope and Arrangements.

1.2 External Stakeholders Safety Case Expectations


1.2.1 Senior Management Demonstration

This Safety Case demonstrates that the operations performed onboard the Rig comply
with the expectations imposed by Transocean’s senior management and other
stakeholders including:

 Employees and contractors

 Customers

 Regulators

These expectations include that:

 There is an effective HSE Management System in place for managing major


hazards, other workplace hazards and environmental aspects

 All potential major hazards have been identified

Issue 02 / Revision 00 Hard copies are not controlled Page 3 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

 Risks associated with identified major hazards have been defined, assessed and are
being managed with any residual risk reduced to a tolerable level

 The Rig is designed, built, operated and maintained taking account of these major
hazards and risks, and in accordance with good industry practice and relevant
mandatory rules and regulatory requirements
1.2.2 Safety Case Scope and Arrangements

The scope of the Safety Case covers the facilities and associated activities as described
in Part 3 – Rig Description and Supporting Information.

Together, the parts of the Safety Case demonstrate that:

 There are effective HSE Management Systems in place for managing major hazards,
other workplace hazards and environmental aspects (see Part 2 – HSE Management
System, and Part 5 – Emergency Response)

 All potential major hazards and associated risks have been identified, assessed and
managed with residual risks reduced to tolerable levels (see Part 4 – Risk
Management)

Assurance and verification of the overall HSE risk management processes, as described
above, is detailed in Part 2 – HSE Management System and Part 6 – Performance
Monitoring.
1.2.3 Drilling Contractor Overview

Transocean is an offshore drilling contractor and leading provider of drilling management


services worldwide. The main scope of the Company operations is drilling exploration,
oil and gas wells, well work overs and well completions. Transocean is incorporated in
Switzerland at the following address:

Transocean Ltd
Chemin de Blandonnet 10
CH-1214 Vernier
Switzerland

Transocean’s Values

Transocean’s Health, Safety and Environment polices support our goal of achieving our
Company’s Strategic Initiative. All of our actions will be guided by our Shared Values:

 Focused: We will consistently exceed the expectations of customers, shareholders


and employees.

 Innovative: We will continuously advance our position as technical leaders, and


relentlessly pursue improvement in all that we do.

 Reliable: We will execute flawlessly by ensuring that our equipment, processes and
systems always perform as and when intended, and that our people are properly
trained and motivated.

Issue 02 / Revision 00 Hard copies are not controlled Page 4 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

 Safe: Above all else, we will protect each other, the environment and our assets.
We will conduct our operations in an incident-free environment, all the time,
everywhere.

 Trusted: We will always act with integrity and professionalism, honor our
commitments, comply with laws and regulations, respect local cultures, and be
fiscally responsible.

Transocean’s Strategic Initiatives

Transocean recognize that we are a capital intensive, increasingly commoditized, highly


competitive and cyclical business. Therefore, the leadership team has outlined several
strategic initiatives that will distinguish our organization.

 Align with our Customers

We will actively support our customers in the delivery of their business objectives,
and be recognized as their universal first choice.

 Operate with Distinction

We will be recognized and rewarded by our customers for consistently delivering the
industry’s safest and most efficient offshore well solutions.

 Optimize Performance

We will urgently and continuously optimize our organization to maximize margins and
returns.

 Invest in our Future

We will attract, develop and retain the industry’s best workforce, and we will operate,
maintain, and systematically upgrade and renew the industry’s most efficient fleet of
offshore rigs.
1.2.4 Safety Case Responsibilities

Preparation of the Case

The Manager, Operations Integrity and his/her team coordinate overall preparation of the
Safety Case and its revisions, providing authorship and reviewing services. Their role is
to support the development of a Safety Case which meets both the intent of IADC Safety
Case Guidelines for MODUs (Issue 3.6) as well as applicable regulatory requirements.

To complete the initial Safety Case for the Rig, Transocean secured specialist technical
advice and assistance from Blade Offshore Services Ltd, who facilitated the
development of the Safety Case to meet the requirements of Transocean’s management
system and IADC Guidelines.

The Rig Manager is responsible for ensuring resources are available to assist in
updating the Safety Case as needed. His/her staff monitors compliance and ensures
that revisions and updates are added as required. Each revision reflects the current
status of the Company Management System (CMS), the management of health and
safety aspects and the rig equipment. It details any new risk assessments which have

Issue 02 / Revision 00 Hard copies are not controlled Page 5 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

taken place since the previous submission, together with any deficiencies and
recommendations which may have been made to reduce risks to As Low As Reasonably
Practicable (ALARP). Revisions also shows the status of any recommendations which
have been made during the preparation of any previous revisions.

This Safety Case has been prepared using the accumulated knowledge and significant
experience of personnel assigned to work on the Rig, the management staff of the
Company and internal / external subject matter personnel.

The Safety Case records the ongoing process of assessing risk and subsequent risk
reduction measures, including any prompted by engineering modifications and CMS
improvements. Both onshore and offshore personnel are continually involved in this
process to maintain the Safety Case as a dynamic and ‘living’ document.

Safety Case Owner

The Safety Case Owner is the Rig Manager. He/she is ultimately responsible for the
HSE management of the operations covered by the Safety Case and is the final approval
authority for the contents of the Safety Case. The Owner is responsible for issuing the
Statement of Justification for Operations, thus accepting accountability for the HSE
management of the operations. The Statement of Justification is a declaration that all
reasonably foreseeable HSE hazards that could occur have been identified and are
under control, subject to the close-out of the outstanding actions in the Remedial Action
Plan and continual management.

Safety Case Custodian

The Safety Case Custodian is the Master / OIM. The Custodian is responsible to the
Owner for the management of the Safety Case. The Custodian is also responsible for
initiating the appropriate programs to ensure awareness and proper use of the Safety
Case by the organization. The Custodian is responsible for the technical accuracy of the
contents of the Safety Case and for ensuring periodic reviews are completed and
revisions and updates are prepared when necessary.
1.2.5 Safety Case Reviews and Updates

The Safety Case is a ‘living’ document and is subject to periodic update. Circumstances
where review, and if applicable revision, is required include:

1. Changes in the operation or equipment which significantly change the overall risk
(including changes related to geographical and environmental conditions)

2. Significant changes to manning levels or the organizational structure

3. Significant changes to the HSE Management System (or industry standards) referred
to in the Safety Case

4. Developments in risk assessment methodology or lessons learned from incidents


that may alter the results of existing risk assessments or risk management
barriers/controls

5. Changes in legislation / regulatory requirements, including rig move to new waters

Issue 02 / Revision 00 Hard copies are not controlled Page 6 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

6. Expiry of any thorough review or resubmission interval specified by legislation /


regulation

7. Expiry of the specified review interval of five (5) years

The above ensures that the Safety Case and Company Management System are not
static but are ‘living’; responding to improvements in industry understanding of hazards
and risks, changing technology and new legislation by improving systems and upgrading
equipment as applicable

In addition to the above review/revision of the Safety Case, activities relevant to


maintenance, review and update include:

 Ensuring that all personnel newly assigned to the vessel are familiarized with the
appropriate aspects of the Safety Case.

 Ensuring the relevance of the critical activities by frequent review. As part of this,
any personnel promoted to a position that has been assigned critical tasks will be
made aware of their responsibilities through established competency and training
processes located in the CMS.

 Updating the Remedial Action Plan if/when deficiencies are identified during Safety
Case maintenance activities.

 Reviewing the risk assessments conducted to identify major hazards and updating
the Safety Case as necessary due to identification of increased risks or changes to
preventative or mitigating barriers/controls etc.

 Ensuring that new approval authorities are communicated, should they change. This
means ensuring that any new owners or custodians of the Safety Case are
thoroughly briefed on their responsibilities outlined in the HSE Case.

 Re-issuing updated parts of all documents as necessary

The processes followed for the review of the Safety Case under different circumstances
are shown in a series of flowcharts provided in Part 2, Attachment 2-2 a – e.
1.2.6 Continual Improvement

Transocean is committed to continual improvement in the management of risk and


environmental aspects associated with the operation of its fleet. One aspect of that
commitment is the participation of Transocean personnel at various levels in industry
committees and in industry conferences. Through this participation and attendance,
Transocean personnel are directly involved in the identification and development of
industry standards, best practices, legislation and regulations, and assessment of new
technology. Transocean ensures that any new industry standards and best practices
are, where applicable, integrated into Transocean Safety Cases as deemed necessary
for the type of MODU and geographical location.

Transocean, as appropriate, implements changes in the CMS based on requirements of


new and revised legislation and regulations. These are described in section 1.2.9
Regulatory Requirements.

Issue 02 / Revision 00 Hard copies are not controlled Page 7 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

1.2.7 Remedial Action Plan / Recommendations

The Remedial Action Plan provides a means to follow-up, resolve and close-out any
outstanding recommendations, actions, shortfalls, or improvements identified as part of
the risk assessment process within the Safety Case. The Remedial Action Plan includes
responsibilities for actions, targeted completion dates and planned progress reviews.
Remedial Actions will be entered into the FOCUS module within the Company’s Global
Management System (GMS) for reporting that facilitates tracking and close out of action
items. The FOCUS entry should include:

 Reference to the risk assessment or study which originated the action;

 Name of the responsible person to close-out the recommendation/action;

 The target date for closure of the action;

 Notification process which alerts management that actions have been completed or
are overdue.

It is the responsibility of the Safety Case Custodian to ensure that these


recommendations are addressed and suitably resolved.
1.2.8 Safety Case Presentation

The Safety Case is presented in both printed and electronic formats.

Printed documents, if required, are uncontrolled and as such may not reflect the most up
to date revision of the Safety Case. These printed copies will be maintained on the rig in
various locations including the Master / OIM’s office.

Electronic copies are maintained in the Safety Case Repository located online in
Transocean’s SharePoint site. These are controlled and represent the most current
revision of the Safety Case.

The Safety Case Repository is maintained by the Operational Integrity (OI) Department.
Access to this site is restricted, however access is provided as necessary. The Rig
Manager and Master / OIM have access to the site; but do not have the authority to
approve access for other personnel.

An uncontrolled printed or electronic copy may be issued, as required, to relevant


stakeholders.

The Safety Case is communicated, as applicable, to company, customer and contractor


personnel by means of training and presentations.

A summary of each of the Parts is then given in Table 1-1.

Issue 02 / Revision 00 Hard copies are not controlled Page 8 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

Table 1-1 Summary of Safety Case Parts

Part 1 – Safety Case Introduction


Part 1 provides an overview of Transocean (the Company), identifies ownership of
the Safety Case and responsibility for its management and upkeep, and
summarizes some of the key processes which support compliance with regulations
and those which drive continuous improvement.
The Introduction also summarizes the justification for safe operation of the Rig.

Part 2 – HSE Management System


Part 2 describes the management system through which the Company:
Sets policies and expectations for HSE
 Provides organizational structures, clear responsibilities, training and
competence assurance for personnel
 Provides plans, systems, standards and procedures for personnel safety,
work practices, and operations carried out on the vessel
 Monitors, measures, verifies and audits vessel management systems and
offshore compliance
 Reviews performance of personnel and operations and sets improvement
plans when necessary

Part 3 – Rig Description and Supporting Information


Part 3 describes the layout, equipment, and control systems of the Rig, in
particular those systems that are safety critical.

Part 4 – Risk Management


Part 4 describes the risk management arrangements for how hazards are
identified and risks assessed through a hierarchical process of evaluation, risk
reduction, setting and meeting Performance Standards.

Part 5 – Emergency Response


Part 5 describes the arrangements for emergency response management,
including how the emergency response analysis has been incorporated into plans,
training, and arrangements for communication, and how these are tested during
drills and exercises.

Part 6 – Performance Monitoring


Part 6 describes the arrangements for monitoring key risk management measures
to ensure they are implemented, maintained, and remain effective. Key
performance monitoring activities include active and reactive monitoring, audits,
verification, and classification activities.

1.2.9 Regulatory Requirements

The Safety Case has been developed using the IADC Safety Case Guidelines for
MODUs Issue 3.6. These guidelines provide a demonstration of good industry practice
for drilling contractors and are structured to provide a template for the development of a
Safety Case suitable for a non-regulated environment. The IADC Guidelines are

Issue 02 / Revision 00 Hard copies are not controlled Page 9 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

supported by specific HSE regulatory, prescriptive requirements for a number of coastal


states.

Transocean has dedicated resources that monitor compliance. Compliance is confirmed


by internal verification, internal and external audits and scheduled START
Conversations.

Use of Maritime Certificates and Class

The basis for the design of the Rig is the international standards defined in Class, Flag
administration and port state control.

Classification entails verification against a set of requirements during design,


construction and operation of ships and offshore units.

The Rig, including its hull, equipment and machinery is constructed under the survey of
ABS (herein called the "Classification Society"), and is distinguished in the register by
the symbols of:

ABS, +A1, +Drilling Unit, (E), +AMS, +ACCU, +DPS-3, SH-DLA

The Rig is registered under the Marshall Islands flag administration.

Regulatory Compliance

The Rig has been designed to comply with the following rules and regulations:

1. International Convention on Load Lines, 1966 with the Protocol of 1988 and
Amendment 2008.

2. International Convention for the Prevention of Pollution from Ships, 1973 (Annex I,
IV, V & VI), as modified by the Protocol 1978/1997 and Amendments up to 2009
(herein called "MARPOL 73/78").

3. Convention on the International Regulations for Preventing Collisions at Sea, 1972


with the Amendments up to 1993.

4. International Convention on Tonnage Measurement of Ships, 1969.

5. International Code for the Construction and Equipment of Mobile Offshore Drilling
Unit (herein called “MODU Code”).

6. International Telecommunication Union (ITU) Radio Regulation, 2008.

7. Marshall Island Maritime Act and Regulations.


1.2.10 HSE Management

The HSE portion of the CMS includes regular performance monitoring of the HSE
Management System for all of Transocean’s vessels worldwide. Auditors periodically
review aspects of the CMS to ensure they are robust and correctly implemented and
maintained.

Transocean ensures the continual improvement in the management of major and other
workplace hazards on all Company rigs through the application of five key aspects of the

Issue 02 / Revision 00 Hard copies are not controlled Page 10 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

Health and Safety Policies and Requirements; Task Planning and Risk Assessment
process, START Conversations, Time Out for Safety (TOFS), Management of Change
(MoC) and FOCUS.

The purpose of the Task Planning and Risk Assessment process is to ensure that:

 that all jobs are planned and it is safe to commence work,

 hazards are identified and eliminated where possible, and

 where hazards cannot be eliminated, the associated risks are effectively managed
and controlled at all times.

The purpose of the START Conversation process is to:

 Engage people in observing activities and work areas,

 Identify and correct at-risk behaviors and conditions,

 Identify and reinforce safe behaviors and conditions,

 Require people to have effective conversations about behaviors,

 Track and trend safe and at-risk behaviors and conditions, and

 Demonstrate that personnel are committed to achieving and maintaining a safe


working environment.

The purpose of the TOFS process is to:

 ensure personnel understand they have the obligation to stop the job when a real or
perceived unsafe condition or unsafe act is observed, without fear of adverse
repercussions, and

 also to have a planned Time Out For Safety during a task.

The purpose of MoC process is to:

 Ensure personnel understand the process to manage change, and to prevent


unplanned events.

The purpose of the FOCUS process is to:

 Provide a consistent means to ensure action plans are approved, tracked and
completed.

Implementation of the identified barriers/controls as well as site specific work practices


ensures that risks from major hazards are reduced to ALARP. The management of
major hazards will be subject to continual performance monitoring, regular auditing and
periodic management review to assure that practice meets management system
requirements.

Issue 02 / Revision 00 Hard copies are not controlled Page 11 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

1.2.11 Environmental Impact and Aspect Assessments

The Rig management and operations teams systematically identify and assess all
environmental impacts and aspects associated with their scope of operations.

Once identified, these environmental impacts are evaluated for risk and are either
mitigated to the lowest tolerable level or to applicable legislative requirements, whichever
is more stringent.

Planned environmental impact and aspect identification and assessments are carried out
as described in the Environmental Management System section (see Part 2 – HSE
Management System). The potential aspects and their associated impacts are entered
into a Register of Aspects and Impacts that is located, maintained and updated at least
annually at each location.
1.2.12 Justification for Continued Operation

The IADC HSE Case Guidelines require duty holders of offshore installations to
demonstrate that major accident risks are controlled to ensure compliance with the
relevant statutory provision.

Commitment to Operate the Rig in Accordance with this Safety Case

Transocean management is committed to operate the Rig in accordance with the


arrangements detailed within this Safety Case. This commitment is supported by actions
such as:

 Provision of resources to develop this Safety Case and ensure effective


implementation of the described management system arrangements as detailed in
Part 2 – HSE Management System and Part 6 – Performance Monitoring.

 The Rig workforce participation in the development of the Safety Case including;
major accident hazard risk assessments (bowtie analysis), compartment risk
assessments, technical information, emergency response arrangements, proposing
and assessing recommendations, implementing agreed recommendations

 Periodic HSE Management System Audits relating to the components of the Safety
Case

Systematic Management of all Hazards (and Environmental Aspects)

A systematic process has been followed to identify and assess all hazards, and to
ensure that effective management system arrangements have been developed and are
implemented. Identification, assessment and management of major hazards and
associated risks are detailed in Part 4 – Risk Management and Part 2 – HSE
Management System.

Key aspects include:

 Comprehensive HSE Management System arrangements

 Hazard identification and risk assessment involving the Rig workforce

Issue 02 / Revision 00 Hard copies are not controlled Page 12 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

 Bow-Tie analysis of major accident hazards detailing preventative and mitigating


barriers/controls

 Performance Standards developed for safety critical systems including the periodic
assurance of continued suitability

Rigorous Process to Identify Potential Hazards and Ensure Risks are Managed to
Tolerable Levels

The hazard identification and risk assessment/evaluation process described in Part 4 –


Risk Management provides the necessary demonstration that all major hazards have
been identified and understood. This, along with Part 2 – HSE Management System and
Part 5 - Emergency Response, demonstrate how these major hazards are effectively
managed.

Part 4 – Risk Management describes how the risk from identified major hazards is
assessed and managed. It has been concluded that the risk levels on the Rig are
tolerable. Key aspects include:

 A risk assessment and ranking of events in the hazards register.

 A Bow-Tie analysis to identify and further evaluate all the barriers/controls associated
with each major hazard.

 An ALARP assessment to demonstrate that risks have been reduced to a tolerable


level.

Mandatory and Regulatory Requirements are Complied With

Rig operations comply with all mandatory and regulatory requirements, including Class
and those of the specific offshore jurisdiction where the Rig is operating.

Responsibility for ensuring that such requirements are identified and met rests with Rig
and HSE management.

Commitment to complete all Remedial Actions

Following development of this Safety Case, remedial actions that remain as part of the
ongoing process of continual improvement will be completed in a timely manner. These
items are detailed in the Remedial Action Plan and tracked through to completion and
close-out.

Statement of Justification for Continued Operation and Commitment from Senior


Management

Transocean commits to operate the Rig in accordance with the arrangements detailed in
this Safety Case. All operations will be performed within the Rig’s operational
boundaries and in compliance with the Company’s management system, relevant
regulations, industry norms, good practices and Company objectives. The required
barriers/controls to manage identified major hazards will be implemented tested, verified
and monitored.

Issue 02 / Revision 00 Hard copies are not controlled Page 13 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 1: Safety Case Introduction

1.3 Design and Commissioning of New Facilities


The Rig has gone through a rigorous process of HSE risk reduction steps to reduce HSE
risks down to a tolerable level in accordance with Transocean requirements and IADC
Guidelines. In order to properly manage HSE risks related to operations of the Rig, the
following steps have been performed, which are further detailed in Part 4 – Risk
Management of this Safety Case:

1. Hazards have been reviewed and identified from ISO 17776:2000 and other
applicable sources, then populated into the Transocean Global HAZID Report and
Hazard Register.

2. The hazards entered into both the Global HAZID Report and the Hazard Register
have been screened through the use of the Transocean HAZID Risk Matrix.

3. Major hazards and the associated preventative and mitigating barriers/controls have
been identified and determined during the Petrobras 10000 Major Accident Hazard
Risk Assessment (MAHRA) bow-tie workshop.

4. Occupational and other workplace hazards have been identified and captured along
with the available barriers/controls in the Hazard Register. These hazards are
managed by following the requirements of Transocean’s Health and Safety
Management System arrangements described in Part 2 – HSE Management System
of this HSE Case.

5. Finally, an ALARP (As Low As Reasonably Practicable) assessment evaluated the


major hazards presented from these studies to ensure that risk had been reduced to
a tolerable level.

Part 3 – Rig Description and Supporting Information details the applicable regulations,
codes and standards used in the design along with the certifications carried by the Rig
for the installed HSE critical systems.

The decision for developing the Safety Case for Transocean’s drilling rigs are taken by
Transocean management based on applicable regulations and contractual requirements.
Transocean personnel are regularly trained and assessed in accordance with
Transocean’s Competency Assurance Management System (CAMS), including on the
job training (OJT) modules and marine licensing requirements.

Issue 02 / Revision 00 Hard copies are not controlled Page 14 of 14


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

CONTENTS
2 HSE Management System .................................................................................................. 2
2.0 Introduction.................................................................................................................. 2
2.0.1 Management System Elements ............................................................................... 3
2.0.2 Environmental, Health and Safety Standards (ISO 9001 and ISO 14001) ................ 4
2.0.3 Core Business Functions ......................................................................................... 4
2.0.4 Demonstrating Assurance of HSE Management Objectives .................................... 5
2.0.5 HSE Management Objectives .................................................................................. 5
2.1 Policies and Objectives................................................................................................ 8
2.1.1 Policies .................................................................................................................... 8
2.1.2 Objectives ................................................................................................................ 8
2.2 Organization, Responsibilities, and Resources ............................................................ 9
2.2.1 Organization ............................................................................................................ 9
2.2.2 Responsibilities ...................................................................................................... 12
2.2.3 Resources ............................................................................................................. 14
2.2.4 Competence .......................................................................................................... 19
2.3 Standards and Procedures ........................................................................................ 23
2.3.1 Planning and Risk Management ............................................................................ 23
2.3.2 Management of Change ........................................................................................ 24
2.3.3 Emergency Response............................................................................................ 24
2.3.4 Permit to Work System .......................................................................................... 25
2.3.5 Safe Working Practice ........................................................................................... 25
2.3.6 Environmental Management .................................................................................. 25
2.3.7 Occupational Health .............................................................................................. 27
2.3.8 HSE Procedures .................................................................................................... 28
2.3.9 HSE Communication ............................................................................................. 28
2.3.10 HSE Advisories, Alerts and Bulletins .................................................................. 30
2.3.11 MODU Security .................................................................................................. 30
2.3.12 Drilling and Well Control Operations .................................................................. 30
2.3.13 Marine Operations and Site Assessment ........................................................... 32
2.3.14 Engineering Management .................................................................................. 33
2.3.15 Lifting Operations and Material Handling ........................................................... 34
2.3.16 Logistics Management ....................................................................................... 34
2.3.17 Hazardous and Radioactive Substances ............................................................ 34
2.3.18 Procurement Management ................................................................................. 35
2.3.19 Maintenance Management ................................................................................. 36
2.3.20 Contractor Management .................................................................................... 36
2.4 Performance Monitoring ............................................................................................ 37
2.4.1 Periodic Monitoring ................................................................................................ 37
2.4.2 Incident Reporting and Analysis ............................................................................. 37
2.4.3 Behavior-Based Observation Systems................................................................... 38
2.4.4 Environmental Monitoring and Measurement ......................................................... 39
2.4.5 Audit and Audit Compliance ................................................................................... 39
2.4.6 Verification of HSE Critical Activities / Tasks and Equipment / Systems ................ 40
2.4.7 Certification............................................................................................................ 40
2.5 Management Review and Improvement..................................................................... 41
2.5.1 Review ................................................................................................................... 41
2.6 References ................................................................................................................ 41
2.7 Attachments .............................................................................................................. 42

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2 HSE MANAGEMENT SYSTEM

2.0 Introduction
Part 2 describes the Transocean Company Management System (CMS) as applied on
the Petrobras 10000 (herein called ‘the Rig’) and in particular those aspects of the CMS
relating to health, safety and the environment.

The CMS, which is a structured set of elements, provides Company expectations


represented by principles, policies, procedures and requirements, including individual
responsibilities.

The CMS is designed to provide control and consistency, to effectively plan and execute
work, and to measure, analyze and improve performance. It contains the controls that
ensure Company processes meet internal, regulatory and customer agreed upon
requirements. Application of the requirements of the CMS is designed to enable
limitation of risks to a tolerable level.

The CMS is based on the following management system standards:

 International Management Code for the Safe Operation of Ships and for Pollution
Prevention (International Safety Management (ISM) Code)

 ISO 9001: 2008 Quality Management Systems

 ISO 14001: 2004 Environmental Management Systems

Senior management defines Company policies and provides the commitment and
resources for the development, implementation and continual improvement of the CMS.

Figure 2-1 Interrelationship of Safety Case Parts

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

To assure that Transocean (the Company) is managing the HSE risks effectively, Safety
Case Part 2 (this part) – HSE Management System, Part 3 – Rig Description and
Supporting Information, Part 5 – Emergency Response, and Part 6 – Performance
Monitoring are applied in conjunction with the structured risk management process
described in Part 4 – Risk Management.
2.0.1 Management System Elements

The Company has established a management system as a means of communicating key


management principles, policies, objectives and requirements to individuals and the
organization.

The management system provides the framework for the Global Functions and
Operation to communicate Company Requirements in a documented and controlled
manner.

Company Requirements are Company expectations, policies and procedures and where
applicable, Customer's agreed upon requirements, standards, codes and legal
requirements, including statutory and regulatory.

Management systems documents are organized in a hierarchical structure divided into


levels which are illustrated in Attachment 2-3 in section 2.7.

Management System Level 1 – Governing Principles

Level 1 – Governing Principles define executive management expectations and


requirements. The Governing Principles are approved by the Chief Executive Officer.

Level 1 has two (2) sub-levels:

 Level 1A – Global Function Policies and Procedures/Requirements defining the


expectations and requirements for each Global Function within the Company.

 Level 1B – Global Function support documentation providing additional direction and


guidance in achieving the requirements specified in Level 1A documents.

The Global Function Vice President/Senior Vice President is responsible for approving
Level 1A and Level 1B documents

Management System Level 2 – Operation and Country Specific Documents

Level 2 – Operation/Country specific documents are developed to address local, specific


business process requirements, local regulatory authorities and/or local customer
requirements not already covered in Level 1 documents. Level 2 documents follow the
Company’s procedures for management system documents and must align with Level 1
requirements.

Operation/Country documents are approved by the Operations Director and the relevant
Process Owner.

Issue 02 / Revision 00 Hard copies are not controlled Page 3 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Management System Level 3 – Installation, Facility, Office Specific Documents

Level 3 – Installation, Facility, Office specific documents are developed to describe the
steps, activities, tasks and work processes required to safely and consistently execute
work to meet Company expectations at installations, facilities and offices.

Level 3 documents are approved by the Installation, Facility, and Office Management as
specified.

The Governing Principles [10] is the highest level document in the CMS. The CMS is
developed to provide control and consistency, to effectively plan and execute work, and
to measure, analyze and improve performance. It contains the controls that ensure
Company processes meet internal, regulatory and customer agreed upon requirements.

The Governing Principles are organized into nine elements:

1. Management Leadership and Commitment

2. Planning and Risk Management

3. Emergency Management and Business Continuity

4. People

5. Service Provider Management

6. Asset Management and Asset Integrity

7. Operational Performance

8. Incident Reporting, Investigation and Analysis

9. Quality Management
2.0.2 Environmental, Health and Safety Standards (ISO 9001 and ISO 14001)

The Company Management System is based on the following management system


standards:

 International Management Code for the Safe Operation of Ships and for Pollution
Prevention (International Safety Management (ISM) Code)

 ISO 9001: 2008 Quality Management Systems

 ISO 14001: 2004 Environmental Management Systems


2.0.3 Core Business Functions

The Company’s core business functions represent the core discipline expertise essential
to execute Company business. Company Functions include:

 Asset Management

 Engineering and Technical Support

 Health, Safety and Environment (HSE)

Issue 02 / Revision 00 Hard copies are not controlled Page 4 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 Engineering and Technical Services

 Operations

 Marketing & Planning

 Human Resources

 Legal Services

 Investor Relations & Communications

 Finance

 Audit & Advisory Services

 Information Technology

 Training

 Supply Chain including Procurement


2.0.4 Demonstrating Assurance of HSE Management Objectives

The Rig Safety Case Parts 2, 3 and 5 present HSE management objectives necessary to
demonstrate assurance that risks in the Rig’s scope of operations are at a level of risk
tolerable to Transocean. These HSE management objectives were taken into
consideration and evaluated during the risk assessments documented in Part 4 of the
Safety Case. By evaluating the HSE management objectives in Part 4, Transocean
either:

 Demonstrates assurance that HSE management objectives are being met, or

 Identifies where arrangements to meet HSE management objectives are ineffective


or not in place, and what measures are necessary to meet all the HSE management
objectives

Transocean HSE management objectives have been organized within the Governing
Principles element structure, so the defined objectives can be applied across the
Company’s core business functions.

Additionally, Part 2 contains HSE management objectives relating to procedural (human


factors) controls and Part 3 contains descriptions of the equipment and systems
(hardware factors) to meet the HSE management objectives.
2.0.5 HSE Management Objectives

HSE management objectives are demonstrated by our commitment to employees,


customers and shareholders by providing direction, resources and support embodied by
our Shared Values, Our Strategic Initiative, our Code of Integrity and our Lifesaving
Rules and Tools.

Issue 02 / Revision 00 Hard copies are not controlled Page 5 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Our Shared Values

Our Shared Values shape our behaviors and form the foundation for building and
maintaining relationships with our employees, stakeholders, suppliers and the
communities we work in. Our Shared Values support a code of ethical business
practices for our employees, which also extend to our customers and suppliers.

Transocean’s Health, Safety and Environment polices support our goal of achieving our
Company’s Strategic Initiative. All of our actions will be guided by our Shared Values:

 Focused: We will consistently exceed the expectations of customers, shareholders


and employees.

 Innovative: We will continuously advance our position as technical leaders, and


relentlessly pursue improvement in all that we do.

 Reliable: We will execute flawlessly by ensuring that our equipment, processes and
systems always perform as and when intended, and that our people are properly
trained and motivated.

 Safe: Above all else, we will protect each other, the environment and our assets.
We will conduct our operations in an incident-free environment, all the time,
everywhere.

 Trusted: We will always act with integrity and professionalism, honor our
commitments, comply with laws and regulations, respect local cultures, and be
fiscally responsible.

Our Strategic Initiatives

Transocean recognize that we are a capital intensive, increasingly commoditized, highly


competitive and cyclical business. Therefore, the leadership team has outlined several
strategic initiatives that will distinguish our organization.

 Align with our Customers

We will actively support our customers in the delivery of their business objectives,
and be recognized as their universal first choice.

 Operate with Distinction

We will be recognized and rewarded by our customers for consistently delivering the
industry’s safest and most efficient offshore well solutions.

 Optimize Performance

We will urgently and continuously optimize our organization to maximize margins


and returns.

 Invest in our Future

We will attract, develop and retain the industry’s best workforce, and we will operate,
maintain, and systematically upgrade and renew the industry’s most efficient fleet of
offshore rigs.

Issue 02 / Revision 00 Hard copies are not controlled Page 6 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Code of Integrity

The Company Code of Integrity describes essential areas of integrity for our business.

Our Code of Integrity is organized into four elements:

 People Integrity

 Financial Integrity

 Transactional Integrity

 Operational Integrity

Our Lifesaving Rules

The Company Lifesaving Rules are the key rules that must be met in order to eliminate
incidents with the highest potential to result in serious or fatal injuries.

Our lifesaving rules have eight elements:

 Guards, Gratings and Handrails

 Working at Heights and Manriding Operations

 Confined Space Entry

 Dropped Object Prevention

 Line of Fire

 Lifting Operations

 Fire Prevention

 Energy Isolations

Our Lifesaving Tools

 Rules of Task Planning - CAKES (Compliance, Authority, Knowledge, Experience


and Skill)

 Risk Assessment

 Barrier Management

 Permit to Work

 Restricted Access

 START Conversations

 Time Out For Safety

Issue 02 / Revision 00 Hard copies are not controlled Page 7 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.1 Policies and Objectives


2.1.1 Policies

Transocean’s senior management have established clear expectations for HSE


Management which is communicated through; a Policy Statement which clearly states
the Company’s expectations and the Company Management System which includes
details of the Company’s health, safety and environmental policies and any local or
regional policies.

The Company’s Health, Safety and Environmental (HSE) Policy Statement represents
the Company’s commitment to provide customers, employees and service partners with
a safe environment to work and values that enable people to achieve the vision to
conduct our operations in an incident free workplace, all the time, everywhere.

To achieve this vision our HSE Policy Statement states:

 Protect our people and the environment where we work

 Take responsibility for our own safety and for those around us

 Monitor and maintain barrier integrity to prevent major accidents

 Comply with our policies and requirements

 Plan all work, identify hazards and manage risk

 Empower our people to stop the job and call a “Time Out for Safety”

 Report and respond to all incidents

 Implement what we learn

The policy statement is prominently displayed at all Company offices and locations and
communicated to all employees, shareholders, suppliers, customers and contractors.
2.1.2 Objectives

As outlined in Part 1.2.3, Our Strategic Initiatives provides us with clear direction. Every
employee is expected to focus on these to ensure goals and objectives are developed
and work is executed in alignment with the Shared Values and Strategic Initiatives.

Goals and objectives are defined at the Global, Global Function, Operation, and Rig
levels. Management Leadership and Commitment, which is one element of our
Governing Principles, is a key factor in setting and achieving annual goals and
objectives.

Strategic planning lays out the “blueprint” by which the Strategic Initiative can be
achieved. The basis of strategic planning is determining the Company’s future position
and deciding what broad business strategies are required to achieve it. Goals and
objectives represented in the Company’s strategic plans define the various pathways for
the Company to attain its Strategic Initiative.

Issue 02 / Revision 00 Hard copies are not controlled Page 8 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

On an annual basis, Executive Management develops and sets global goals and
objectives based on short and long-term strategies designed to achieve our Strategic
Initiatives. Global goals and objectives are approved by the Board of Directors.

Global function goals and objectives are developed to support the global goals and
objectives. Each Global function develops its own goals and objectives to enable it to
contribute to achieving the Global goals and objectives. As such, the Global function
goals and objectives are aligned with the Global goals and objectives. Global function
goals and objectives are approved by the Global function head.

Operation goals and objectives are developed to support the Global function goals and
objectives. Each Operation develops its own goals and objectives to enable it to
contribute to achieving the Global function goals and objectives. As such, the Operation
goals and objectives are aligned with the Global function goals and objectives. In
addition, Operations develop specific goals, as necessary, to meet regional business
conditions. Operation goals and objectives are approved by the Operations Director.

Rigs develop rig specific goals and objectives to support the Operation goals and
objectives. In addition, rigs develop specific goals, as necessary, to meet rig specific
business conditions. Rig goals and objectives are approved by the Rig Manager.

In order to be designed to achieve our Strategic Initiatives, Global, Global function,


Operation and Rig specific goals are required to be specific and measurable so that the
objective can be understood and achieved.

Goals and objectives are periodically reviewed and measured, and where necessary
updated, throughout the year.

2.2 Organization, Responsibilities, and Resources


2.2.1 Organization

The Company’s worldwide operations consist of international and deepwater drilling


services. The Transocean drilling business is divided into Operations (corresponding to
specific countries or areas of operation). Each Operation has a number of operating
rigs.

The Operations Director is responsible for managing the business within his area of
responsibility and reports directly to the Chief Operating Officer.

The Rig Manager is responsible for managing rig business and reports directly to the
Operations Director (or Operations Manager where applicable). Where applicable, the
Operations Manager reports directly to the Operations Director.

Organizational Charts

Organizational charts for Executive Management, Operation and the Rig are included as
Attachments 2-1 a, b and c respectively.

Issue 02 / Revision 00 Hard copies are not controlled Page 9 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Development of a Joint Bridging Document

To ensure all joint aspects of HSE responsibilities are planned, understood and
communicated effectively, an interfacing or bridging document between the Customer
and Transocean will be developed as necessary.

The bridging document is a key document utilised by the Company that defines how
aims and objectives will be met for a specific contract. The plan will describe how the
Company’s management system will be applied and is the primary document used to
record internal and external interface and control arrangements.

The objective of the plan is to convey information to all parties engaged in the execution
of the contract to ensure that the requirements of the contract are met.

The aims of the bridging document are:

 To ensure that all contract activities are planned and controlled effectively and
efficiently to the mutual benefit of the Company and the Customer

 To achieve the highest possible standards in the areas of health, safety and
environmental management

 To ensure that key responsibilities are understood

 To ensure that communication links are understood

Management Reviews

Management at all levels is required to monitor and review performance, including


organizational structure and resource allocation, through participation in various
management review processes such as FOCUS, Management System Audit (MSA),
Self-Verification / Divisional-Verification (SV/DV), Alerts, Bulletins and Advisories,
Scorecards, internal and external inspections, audits and surveys, Customer feedback
and SMART reviews.

Review and change to the Company Management System is formally captured,


reviewed, communicated and executed through the System Management and Review
Team (SMART) process.

SMART provides Global Functions, Operations management, rig management and rig
personnel with a process for:

 Reviewing requests for making changes to the Company Management System and
business processes that originate from installation, Operation or Global Functions.

 Deciding how to implement a change.

 Communicating all changes to Company personnel.

 Commissioning and implementing changes as required.

The SMART process is initiated by a SMART request using the Management System
Feedback Process in the Global Management System (GMS). SMART requests require

Issue 02 / Revision 00 Hard copies are not controlled Page 10 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

an action from the receiving organization. The action may involve review, response
and/or revision to the management system.

2.2.1.1 Document Management

Controls are in place to ensure controlled documents are approved by the appropriate
authority level and that these documents reflect the most current requirements to ensure
accurate information is available. These controls provide a means to maintain Company
documents in a manner that is consistent throughout the Company.

Controlled documents clearly indicate approval authorities, effective dates and issue
and/or revision numbers.

Arrangements, such as Alerts, Bulletins and Advisories, are in place to communicate


revisions to controlled documents.

Access to controlled documents is via the Company intranet through a dedicated


document control system eDocs.

Management of Records

The Company provides a company-wide records management program and policy to


control the Company’s records from creation through processing, maintenance,
protection and final disposal. The program includes records, tapes, photographs,
magnetic media or other material, regardless of physical form or characteristics, made or
received in connection with the transaction of official Company business.

The policy and procedure that governs the records management program is part of the
Quality Management element in the Governing Principles [10]. The purpose of this
policy is to ensure that the Company retains records in a consistent, systematic and
reliable manner so that they can be retrieved promptly when required for legal,
regulatory, or operational reasons.

2.2.1.2 Workforce Participation

Transocean recognizes that the proactive involvement of all personnel in HSE


management activities is essential to develop, implement and maintain effective HSE
programs.

The involvement of personnel in these programs begins with the installation’s HSE
orientation and is continued through training and competency programs such as On the
Job Training (OJT).

All Company personnel at all levels of the organization have the responsibility to comply
with the Company Management System (CMS), foster positive, proactive attitudes and
behavior with regards to HSE management activities. Responsibilities for HSE
management activities are detailed within the job descriptions for each position and in
the Health and Safety Policies and Requirement [2].

Workforce participation in HSE management activities is also demonstrated by


attendance at pre-tour and weekly HSE meetings, HSE Steering Committee meetings
and participation in key processes such as Task Planning and Risk Assessment,

Issue 02 / Revision 00 Hard copies are not controlled Page 11 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

START Conversations, Management of Change (MoC), Time Out For Safety (TOFS)
and FOCUS. Also, the workforce participates in promoting HSE management activities
through the mentoring program and the “buddy system”.

The objective of the Company HSE Steering Committees is to develop and promote
measures to ensure the health and safety of personnel and protection of the environment
through communication and cooperation between all levels of management and the
workforce. The HSE Steering Committee provide a forum by which personnel can be
involved in developing and reviewing HSE performance and revising policies and
procedures, involved in developing and setting health, safety and environmental goals
and objectives that contribute to the development of annual HSE plans, and informed
and knowledgeable of the health, safety and environmental efforts and activities of the
Company.

The Company has a reward and recognition program, with different levels of awards,
which includes rewarding and recognizing demonstrated exceptional performance and
application of the Company’s Shared Values.

The Rig Management and workforce have participated in the development of the Safety
Case. Workforce participation includes; major accident hazard risk assessments (bowtie
analysis), compartment risk assessments, technical information, emergency response
arrangements, proposing and assessing recommendations, implementing agreed
recommendations.

2.2.1.3 Rig Organization

All Transocean personnel have a written Job Description that details their HSE duties,
roles and responsibilities associated with their job. The Rig organization chart is
included as Attachment 2-1c in section 2.7.
2.2.2 Responsibilities

2.2.2.1 Senior Management HSE Responsibility

Senior Management is responsible for the management of Company activities globally


including HSE management responsibilities. The Company has appointed a Senior Vice
President Operations Integrity (OI) and HSE who has overall responsibility for HSE
management activities. The Company HSE function includes Directors and Senior
Managers, at global and operation levels, who are responsible for the different elements
of HSE management, and who have defined roles, responsibility and authority for the
development and implementation of HSE management and regular reporting of HSE
performance.

Safety is a Company Shared Value which prioritizes HSE at the same level of
importance as other business activities. Sufficient resources are provided to meet the
defined HSE management responsibilities.

2.2.2.2 Line Management HSE Responsibility

The Company HSE function includes Managers and Senior Supervisors, at global and
operation levels, who are responsible for the different elements of HSE management,

Issue 02 / Revision 00 Hard copies are not controlled Page 12 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

and who have defined roles, responsibility and authority for the development and
implementation of HSE management and regular reporting of HSE performance.

The positions listed in 2.2.2.3 represent the installation based line management positions
with direct influence on HSE management on the Rig.

2.2.2.3 Individual Responsibility and Authority

The following descriptions are brief introductions to the roles and responsibilities of the
Rig Management and Supervisory team. A complete list of the roles and responsibilities
regarding HSE management are contained within the specific Job Descriptions.

Master / Offshore Installation Manager (OIM)

The Master / OIM’s responsibilities include; exercising authority and discretion to take
whatever action is required for the safety of the crew, installation and protection of the
environment.

In addition, the Master / OIM’s responsibilities include: managing the installation


resources, including the workforce; ensuring that Company policies and procedures are
understood and followed; and that the Customer’s well program is planned and executed
in a safe and efficient manner.

The Master / OIM is responsible for ensuring that all individuals receive an HSE
Orientation. This orientation communicates the individual’s responsibility and authority in
regards to HSE management.

Drilling Superintendent

The Drilling Superintendent’s responsibilities include supervising drilling operations and


associated activities in accordance with Company policies and procedures, and the
Customer’s well program, to ensure drilling operations are performed in a safe and
efficient manner.

Senior Maintenance Supervisor

The Senior Maintenance Supervisor’s responsibilities include supervision and control of


the inspection, maintenance and repair of mechanical, electrical, electronics, subsea and
information technology equipment on the installation, including safety critical systems.

Rig HSE Advisor

The Rig HSE Advisor’s responsibilities include; coaching and mentoring rig-based
personnel in the implementation and understanding of the Company Management
System, in particular HSE activities, acting as a subject matter resource for training
requirements and assisting in the implementation of the rig goals and objectives through
liaison with HSE management.

2.2.2.4 Regulatory Requirements

The Company Management System is aligned with Safety and Environmental


Management Systems (SEMS) requirements.

Issue 02 / Revision 00 Hard copies are not controlled Page 13 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

The Rig has been designed to comply with all applicable Classification Society rules,
Flag State requirements and Coastal State regulations.

To ensure an installation is in compliance with regulatory requirements, the installation is


subject to periodic surveys. Periodic surveys belong to one of the following categories:

 Annual Survey

 Intermediate Survey

 Renewal Survey

 Other Periodic Survey

 SEMS Audits

Refer to the Certificate and Survey Handbook [1] for further detailed information
regarding management of regulatory requirements.
2.2.3 Resources

2.2.3.1 HSE Resources

Adequate resources are available to the organization for HSE management with
knowledgeable and experienced individuals assigned to carry out HSE management
activities.

Management is responsible for final approval of the necessary resources to maintain and
improve the HSE performance throughout Company operations. The Chief Operating
Officer ensures adequate resources are dedicated to effectively supporting line
management. The Senior Vice President, Operations Integrity (OI) and HSE ensures
adequate resources are available to support the Operations Directors on HSE issues
worldwide, while the Operations Directors ensure adequate resources are dedicated to
effectively supporting line management with regard to HSE issues within their area.

2.2.3.2 HSE Committee Representation

The objective of the HSE Steering Committees is to develop and promote measures to
ensure the health and safety of personnel and protection of the environment through
communication and cooperation between all levels of management and the work force.

HSE Steering Committee Meetings are held at the Global, Operation, Installation and
Facility levels.

Global HSE Steering Committee

The Global HSE Steering Committee meets once a year.

Attendees to include:

 Chief Executive Officer

 Minimum of five Officers

 Directors, HSE

Issue 02 / Revision 00 Hard copies are not controlled Page 14 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 A minimum of two offshore personnel

 Other relevant invitees

 A minimum of six committee members must be present for a quorum to exist

Operations HSE Steering Committee

Operations Steering Committee must meet at least once a year.

Attendees include:

 Operations Director

 Operations Manager (as applicable)

 Rig Managers

 HSE Manager

 Other personnel as designated by the Operations Director

 A minimum of 2 offshore personnel

 Other relevant invitees

Installation HSE Steering Committees

Installation HSE Steering Committees meet as required, so that all Company personnel
assigned to the installation have an opportunity, while on board during normal rotation, to
attend one meeting per year.

Attendees include:

 Master / OIM

 Department Heads

 Rig HSE Advisor

 Driller

 Crane Operator or Deck Foreman

 A minimum of two non-supervisory personnel

 Other relevant invitees

 A minimum of one representative from each department on the installation must be


present at the HSE Steering Committee meeting.

Facility HSE Steering Committees

Facility HSE Steering Committees meet as required, at least twice a year.

Attendees include:

Issue 02 / Revision 00 Hard copies are not controlled Page 15 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 Facility Manager/Supervisor

 Fire Wardens

 Department Heads

 Facility personnel as appropriate

 A minimum of two non-supervisory personnel

 Other relevant invitees

Green Team Steering Committees:

Green Team Steering Committees specifically:

 Review minutes and conclusions of prior Green Team Steering Committee


meetings.

 Review Operation’s progress against Global goals, objectives and targets.

 Review Operation’s progress against Operation goals, objectives and targets.

 Review Operation’s environmental performance (including any LOC, Emissions).

 Ensure template for minutes of Green Team Steering Committee reports are posted
on RigCentral (HSE).

Global Green Team Steering Committee

Responsibilities include:

 Coordinating company-wide development and implementation of the Environmental


Management System (EMS).

 Facilitating two-way communication of environmental issues with employees, raise


environmental awareness and share best practices.

 Reviewing and monitoring progress towards achievement of environmental


objectives and targets.

 Ensuring adequate resources are available to manage the implementation and


continual improvement of the EMS.

Operations Green Team Committee

Responsibilities include:

 Coordinating the Operation-wide implementation of the EMS.

 Reviewing and monitoring Operation environmental objectives and targets and the
Operation Environmental Performance Plans to achieve these targets and overall
Company goals.

 Ensuring adequate Operation resources are available to manage the implementation


and continual improvement of the EMS.

Issue 02 / Revision 00 Hard copies are not controlled Page 16 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.2.3.3 Support

Transocean has a support organization that provides adequate resources to meet Senior
Management HSE objectives.

As described in section 2.2.3 above, adequate resources are available to the


organization for HSE management with knowledgeable and experienced individuals
assigned to carry out HSE management activities.

2.2.3.4 Customers

HSE Management Interfaces

As described in section 2.2.1 above, to ensure all joint aspects of HSE responsibilities
are planned, understood and communicated effectively, an interfacing or bridging
document between the Customer and Transocean will be developed as necessary.

It is the responsibility of the Master / OIM to ensure that the identified interfaces are
properly communicated to all personnel on the installation and that the interfaces are
properly monitored.

Effective interfaces with Customers and Sub-Contractors are established and managed
by following the requirements of the Customer and Sub-Contractor Personnel and
Equipment policy in the Health and Safety Policies and Requirement [2]. The purpose of
this policy is to ensure that the HSE interface of all Company operations involving
customers, subcontractor personnel and their equipment are effectively managed to
identify hazards and control risks.

2.2.3.5 Customer’s Third-Parties

Effective interfaces with Customers’ Third-Parties, or sub-contractors, are established


and managed by following the requirements of the Customer and Sub-Contractor
Personnel and Equipment policy described in section 2.2.3.4 Customers.

2.2.3.6 Catering and Accommodation

Suitable arrangements for the health and welfare of all personnel are in place on board
the Rig. Clean and comfortable accommodation and rest facilities are provided, noise
levels and other environmental factors are controlled, appropriate drinking water is
provided and waste is appropriately disposed of.

Accommodation

To ensure accommodation and rest facilities are maintained to an appropriate standard,


and to ensure high standards of hygiene for the storage, handling and preparation of
food and drink, the Company has a Sanitation, Hygiene and Smoking Limitations policy
in the Health and Safety Policies and Requirement [2]. The purpose of this policy is to
ensure that all personnel are adequately protected from the harmful effects of unsuitable
sanitation/hygiene practices and second hand smoke.

Issue 02 / Revision 00 Hard copies are not controlled Page 17 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Drinking Water

To ensure Potable Water is suitable for human consumption, the Company has a
Potable Water policy in the Health and Safety Policies and Requirement [2]. The
purpose of this policy is to ensure that all drinking water is free from bacteria and other
harmful impurities.

Waste

To ensure waste is appropriately disposed of, the Company has a Waste policy in the
Environmental Policies and Requirement [3]. The purpose of this policy is to control the
handling, discharge and disposal of waste in compliance with applicable local and
international legislation.

2.2.3.7 Medical Support

In order to provide suitable medical support arrangements the Company has a Medical
Care and Documentation policy in the Health and Safety Policies and Requirements [2]
and also a Medical Protocols Procedures [7].

The Company has a medical screening program (Medtrack) that ensures that our
overseas and traveling workforce have regular medicals, and that medical information is
available globally 24/7 in a database to assist with any medical issue that may arise.

Transocean has a world-class offshore and topside medical support program with trained
medical professionals stationed on every installation and a network of doctors and
support services available globally. Any medical concerns are communicated to the
Senior Manager, Medical Services.

The clinic on the Rig is staffed by a qualified medical professional, Installation Medical
Person (IMP), who holds current certification which is compliant with company
requirements and is onboard at all times and on call on a 24 hour basis.

Topside Medical Support provides medical advice and direction to all the IMPs, and if
required, escalates to appropriate resources for medical evacuation. The roles and
duties of Topside Medical Support are described in the Medical Protocols Procedures
[7][7].

A valid and updated Medical Emergency Response Plan (MERP) is maintained by


Operations management as described in the Medical Protocols Procedure [7]. This plan
is available to all Company personnel.

The Medical Protocols Procedures [7][7] contains procedures for responding to trauma
and medical incidents to ensure that appropriate medical attention and follow-up is
provided once initial treatment has been provided on board the installation or at a facility.
The Medical Protocols Procedures [7] provides supporting procedures to the Medical
Care and Documentation policy in the Health and Safety Policies and Requirements
[2][2].

2.2.3.8 Selection of Contractors

Issue 02 / Revision 00 Hard copies are not controlled Page 18 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Contractors are selected by following the requirements of the Company’s Global Vendor
Quality Policies and Procedures [8][8], and Global Supply Chain Procedures [9][9] which
are designed to ensures that Contractors meet Company expectations and Shared
Values, including HSE performance and capabilities to manage Contractors HSE
responsibilities.
2.2.4 Competence

2.2.4.1 Selection of Drilling Contractor Personnel

Selection of Internal Personnel

Where appropriate, preference for open vacancies is given to internal candidates. All
offshore employees work towards completing a job specific training matrix for their
current position, and once complete, work towards completing training requirements for
their next position. The employee’s supervisor shall discuss the employee’s readiness for
their next position during the annual appraisal process and an assessment will be made
of when that individual will be ready for promotion. This is captured on the electronic
succession database which is used to identify suitable individuals when a position
becomes available. HR then consults with the rig management to discuss the suitability
of the individual for the promotion. At this time, training records and appraisals are
checked.

There are also several ‘fast-track’ training programs where individuals follow a structured
training program with set criteria to allow them to work towards their next position. They
will graduate from the program when all necessary criteria have been fulfilled. This
involves technical testing and interviews, successful appraisals and full training
compliance.

Positions that have HSE critical activity responsibilities, hazardous responsibilities and
environmental oversight responsibilities are determined based on performance,
competency, professional qualifications, abilities and potential of the individual. Each
policy and procedure document lists responsibilities for each position. Transocean has
established training and competency programs to enable employees to acquire the
necessary knowledge, skill and ability to meet their responsibilities and perform their jobs
safely and effectively.

Selection of External Personnel

If a position cannot be filled internally then it will be passed to the recruitment team to
source a suitably qualified external candidate. Selected applicants who have the correct
background, skills, training and experience will then undergo an HR and technical
interview. The individual must possess the necessary qualifications and training for the
position. All new recruits must attend a Company induction course prior to going
offshore. Copies of all training courses, certificates of competency, necessary licenses
etc. are held on file by the Human Resources department.

2.2.4.2 Selection of Contractor Personnel

Under certain circumstances the Company may need to hire temporary Contractor
personnel from an external provider. The Company will, whenever possible, promote

Issue 02 / Revision 00 Hard copies are not controlled Page 19 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

from within and fill a lower position with Contractor personnel. The Company has an
approved list of selected vendors to hire Contractor personnel, all of which have a list of
job specific certification or licence requirements, where applicable. As part of a robust
acceptance process service providers are checked for quality management accreditation
prior to being accepted onto the Approved Vendors List. This accreditation assures the
Company that the Contractor has a process in place to ensure that their personnel are
suitably trained and competent. The Company also has the right to audit the Contractor
to verify competence of the personnel.

The rig management are sent the CV for anyone proposed to the rig which is reviewed
by the relevant supervisor for suitability prior to acceptance.

2.2.4.3 Competence Assessment and Records

Transocean defines competency as a combination of knowledge, practice, skills, abilities


and behavior that are necessary to perform a task or function instinctively in a work
setting to achieve a defined level of performance.

Managers and supervisors have a responsibility to determine the competency of


individuals performing critical task steps. Critical tasks for operations on the Rig are
identified in the Company Management System and in mandatory and rig specific
procedures in the HSE Toolbox.

The On-The-Job Training (OJT) module system is an integral part of the company
training system. The system is a task based, self-paced, on-the-job training program to
train and measure a participant’s competence that is required in each job category or
function.

The World Wide Training Matrix, which includes courses such as well control and fire
team training, documents course requirements for the different job categories. This
matrix comprises both internal and external training courses.

CAP Programs

Transocean has identified higher risk positions and created specific Competence
Assurance Programs (CAP) to provide more detailed standards for these higher risk
positions. The programs are developed from the OJTs and reflect a robust assessment
process that is conducted onshore and offshore by qualified assessors. Certification and
Individual Development Plans (IDP) are key elements of the program.

A number of Competence Assurance Programs (CAP) are in place to assure that the Rig
personnel are competent to effectively respond to any situation that arises. These
programs are listed below:

 Drillers Competency Assurance Program (D-CAP) for the Rig Drillers.

 DPO Competency Assurance Program (DP-CAP) for the Rig Dynamic Positioning
Operators.

 Subsea Supervisor Competency Assurance Program (S-CAP) for the Rig Subsea
Supervisors.

Issue 02 / Revision 00 Hard copies are not controlled Page 20 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 Crane Operator Competency Assessment (C-CAP) for the Rig Crane Operators.

The Master / OIM is responsible for ensuring the competence of the personnel on the
Rig and that CAP Assessors fully complete their assessment while on board.

Performance Appraisal

The purpose of the Company performance appraisal process is to measure current job
performance and to develop strengths to prepare the employee for future jobs within the
Company. Managers and supervisors appraise their employees utilizing periodic one-
on-one feedback in conjunction with the annual appraisal.

Appraisals enable managers and supervisors to determine how people are performing
against the personal goals and objectives that have been developed.

Critical / Hazardous Activities

The SCA Matrix (Attachment 6-1) details the following:

 All identified HSE critical/hazardous activities

 The individuals who are assigned responsibilities for each HSE critical/hazardous
activity

 The required competence criteria and verification that this competence has been
attained and is current

HSE Trends

The methods Transocean use to evaluate HSE trends identified through incident
analyses or proactive behavior-based observation systems is described in Part 6 of this
Safety Case.

2.2.4.4 Training

The role of training is to enable personnel to develop their knowledge, skills and abilities
to meet their responsibilities and perform their job safely and effectively.

Training is the activity that involves increasing people’s knowledge, allowing them to
practice what they have learned, and through practice, develop skills and abilities to
meet responsibilities. The Worldwide Training Matrix, which specifies the Company
training requirements, is located in the HR section of the Company intranet and includes
HSE critical activity training requirements. All employees are required to complete the
necessary training for their current position within a defined period.

The Company Worldwide Training Matrix is supplemented, as necessary, with any local
or Customer training requirements.

OJT modular training is an integral part of the company training system. OJT is a task
based, self-paced, training program to train and measure competency at each job level.
It consists of computer-based training, practical hands-on and supervisor-led instruction
supported by an extensive library of in-house and out-sourced training materials.

Issue 02 / Revision 00 Hard copies are not controlled Page 21 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Shore-based internal training courses facilitated by Operations personnel or Operations


appointed facilitators. Shore-based external courses are out-sourced to external training
providers and conducted at external facilities.

Training records for all positions on the training matrix are maintained within the
Company’s reporting system Global Management System (GMS). GMS records provide
efficient training administration, statistical analysis and accessibility for employees,
supervisors and management.

2.2.4.5 Induction Program

All new hire personnel receive an onshore safety induction prior to going offshore for the
first time. The safety induction training includes introduction to processes such as Task
Planning and Risk Assessment, START, Time Out for Safety, Permit to Work,
Management of Change and FOCUS. The safety induction also provides an introduction
to the Company Shared Values and Strategic Initiatives.

All Company, customer and subcontractor personnel who work at or visit any Company
Installation, Facility or Office are given an HSE Orientation. The HSE orientation will be
conducted in phases. The phases are as followed:

Phase I - All personnel

All returning crew members to the installation are required to undergo an HSE review
briefing with the Master / OIM, or his designated representative, within 6 hours of arriving
onboard. The briefing includes:

 Be introduced to the Master / OIM

 Be informed of recent installation incidents and HSE performance

 Be informed of current operations and any hazards

 Communicate with the Rig HSE Advisor regarding required training for type of work
to be performed while on board

Phase II - Personnel who have received an Installation HSE Orientation, documented in


GMS, and have previously been on the installation but not in the last 12 months or have
been on a different Company installation within the last 12 months.

 Receive Phase I information

 Receive a Welcome Onboard Card specific to that installation and a review of its
content

 Full HSE Orientation tour

Phase III - Personnel arriving for the first time to a Company installation.

 Receive Phase I and II information

 View Company HSE Orientation DVD

 Be informed of current operations and any hazards associated with them

Issue 02 / Revision 00 Hard copies are not controlled Page 22 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Individuals are introduced to their supervisor and are responsible to familiarize


themselves with their work area, emergency equipment layout and emergency exits.
Key personnel with specific HSE duties, for example, Installation Medical Person,
emergency response teams receive additional specific instructions relating to their
responsibilities.

2.3 Standards and Procedures


2.3.1 Planning and Risk Management

The Company recognizes that proactive planning is fundamental to the achievement of


HSE management objectives and ensures that plans, with the appropriate level of risk
assessment, are developed for all work activities.

To ensure that hazards onboard the Rig are identified and associated risks are
effectively managed, processes are in place to identify and assess hazards and
implement, verify and monitor the required preventative and mitigating barriers/controls.

The Company Management System (CMS) has a number of task planning and risk
management processes such as; Control of Work Planning, Task Planning and Risk
Assessment, Management of Change (MoC), Time out For Safety (TOFS), START
Conversations, Major Accident Hazard Risk Assessment and Compartment Risk
Assessment. By following these processes risk management plans are developed and
implemented and any changes managed.

Before implementing any plan, the associated risks and barriers/controls are effectively
communicated to individuals involved in the plan. Plans are monitored and evaluated by
managers, supervisors and individuals during and after execution.

Control of Work Planning

The purpose of the Company’s Control of Work Planning process is to provide effective
Control of Work by ensuring activities are reviewed, prioritized and planned, adequate
supervision is available; resources are appropriately assigned, relevant personnel are
aware of the work, potential conflicts are managed and appropriate approvals are in
place. Ensuring:

 Work is effectively planned.

 Resources to perform the work are available and appropriately assigned.

 Effective supervision is assigned.

 Work is effectively communicated to all departments and personnel who are or may
be affected.

 There are no conflicts with work to be performed.

 Work to be performed is approved.

 Work is effectively monitored and observations reviewed.

Issue 02 / Revision 00 Hard copies are not controlled Page 23 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

For more information relating to the Control of Work Planning process, refer to the Health
and Safety Policies and Requirements [2][2].

Issue 02 / Revision 00 Hard copies are not controlled Page 24 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Task Planning and Risk Assessment Process

The purpose of the Company’s Task Planning and Risk Assessment Process is to
ensure that it is safe to commence work and that all jobs are planned, hazards are
identified and eliminated where possible, and where hazards cannot be eliminated, the
associated risks are effectively managed and controlled at all times.

For more information relating to the Task Planning and Risk Assessment process, refer
to the Health and Safety Policies and Requirements [2].
2.3.2 Management of Change

Management of Change

The purpose of the HSE Management of Change (MoC) process is to ensure personnel
understand the process to manage change, and to prevent unplanned events. The MoC
procedure consists of the following steps:

 Develop a plan for a task

 Monitor the plan for any changes

 Call a TOFS if required and assess the risk

 Revise the current plan

The MoC policy also includes a process for requesting an exemption.

For more information relating to the MoC process, refer to the Health and Safety Policies
and Requirement [2].

Time Out for Safety (TOFS)

The purpose of the Company’s Time Out for Safety (TOFS) process is to:

 Ensure personnel understand they have the obligation to stop the job when a real or
perceived unsafe condition or unsafe act is observed, without fear of adverse
repercussions. This will allow for a safety conversation to take place and manage
change.

 To have a planned Time Out For Safety during a task.

For more information relating to the TOFS process, refer to the Health and Safety
Policies and Requirement [2].
2.3.3 Emergency Response

Emergency plans and arrangements are in place to provide effective response to all
reasonably foreseeable emergencies including environmental incidents, on the Rig.

Part 5 of this Safety Case documents the emergency plans and arrangements in place
for the Rig.

Issue 02 / Revision 00 Hard copies are not controlled Page 25 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.3.4 Permit to Work System

The Company has a Permit to Work (PTW) system in place for managing higher risk
tasks and activities.
The purpose of the Company’s Permit to Work (PTW) system is to ensure that, prior to
commencing potentially hazardous work; appropriate controls and approvals are in place
and are maintained throughout the activity.

For more information relating to the PTW system, including; PTW training, which tasks
and activities require a PTW and PTW responsibilities, refer to the Health and Safety
Policies and Requirement [2].
2.3.5 Safe Working Practice

The Company has a General Safe Work Practices policy in place to ensure that HSE
management associated with tasks, activities and working areas is effective. The
purpose of this policy is to ensure safe work practices are adopted to prevent injuries or
damage to the environment or property.

For more information relating to the General Safe Work Practices policy, refer to the
Health and Safety Policies and Requirement [2].

The Company has a Dress Requirement and Personal Protective Equipment policy in
place to ensure that HSE management associated with tasks, activities and working
areas is effective. The purpose of this policy is to ensure that all personnel are
adequately protected from environmental elements and relevant workplace hazards.

For more information relating to the Dress Requirement and Personal Protective
Equipment policy, refer to the Health and Safety Policies and Requirement [2].
2.3.6 Environmental Management

The management of environmental aspects and impacts are addressed in the


Company’s Environmental Policies and Requirements [3][3], which is known as the
Environmental Management System (EMS). The EMS policies and requirements
provide the basis for developing practices and procedures for the Rig.
The Company’s EMS is a comprehensive organization of policies, requirements and
documentation and is used by the Company to govern its operations worldwide. The
EMS is used in conjunction with the Health and Safety Policies and Requirements [2] to
form the Health, Safety and Environmental (HSE) Management System.
The purpose of the EMS is to ensure that sound and cost effective environmental
management is always considered before, during and after Company operations.

The elements of the Company’s EMS are:

 HSE Policy Statement

 Objectives and Targets

 Monitoring and Measuring of Environmental Performance

 Implementation of Operational Controls

Issue 02 / Revision 00 Hard copies are not controlled Page 26 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 Management Review

The EMS is a system that incorporates all elements of ISO 14001 and requires that
potential impacts on the environment be identified, controlled, recorded and improved.
The tools in the EMS provide a system and framework that promotes continual
improvement and prevention of pollution.

 Registers of Environmental Legislation and Other Requirements – Identifies


international and local regulations and other requirements applicable to Company
operations

 Environmental Aspects & Impacts Register – Identifies potential environmental


hazards arising from Company operations and documents the associated risks of
these hazards for each Company location

 Operational Control Requirements – Identifies corrective procedures in order to


remove or minimize risk to the environment and prevent pollution

 Measure and Monitor – Identifies areas for improvement within environmental


performance to drive continual improvement

 Environmental Audits – Assesses compliance and performance of the EMS against


the Company objectives and targets

 Environmental Awareness Training – Identifies and develops environmental training


to implement, monitor and improve the EMS

 Improvements and Feedback – Identifies the mechanism for continual improvement


and the process by which recommendations and results from different audits are
incorporated into the EMS.

For more information relating to the Environmental Management System, refer to the
Environmental Policies and Requirements [3][3].

2.3.6.1 Environmental Protection

Regulatory requirements, waste tracking methods, waste minimisation and waste


management plans are addressed in the Company’s Environmental Policies and
Requirements [3][3], which is described in section 2.3.6 above.

For more information relating to the Environmental Management System, refer to the
Environmental Policies and Requirements [3][3].

2.3.6.2 Management of Waste

The Company has a Waste policy in the Environmental Policies and Requirements [3][3].
The purpose of this policy is to control the handling, discharge and disposal of waste in
compliance with applicable local and international legislation.

In this policy, waste segregation, storage, and minimization are described to provide
guidance for the Rig. The Rig Waste Segregation Plan describes the general handling
practices for different kinds of wastes expected to be onboard the Rig.

Issue 02 / Revision 00 Hard copies are not controlled Page 27 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Waste disposal is conducted in adherence to the requirements of the Company’s waste


policy.

For more information relating to the Waste policy, refer to the Environmental Policies and
Requirements [3][3].
2.3.7 Occupational Health

The Company has a number of occupational health policies in the Health and Safety
Policies and Requirements [2] including; Pathogens, Sanitation, Hygiene and Smoking
Limitations, Respiratory Protection, Noise, Potable Water, Asbestos Containing Material,
Manual Handling Operations and Hand Arm Vibration.

A summary of these policies is provided below. For further details of each policy refer to
the Health and Safety Policies and Requirements [2].

Pathogens

The purpose of the Pathogens policy is to control exposure to blood and body fluid
pathogens in the work place.

Sanitation, Hygiene, and Smoking Limitations

The purpose of the Sanitation, Hygiene and Smoking Limitations policy is to ensure that
all personnel are protected from harmful effects of unsuitable sanitation/hygiene
practices and second hand smoke.

Respiratory Protection

The purpose of the Respiratory Protection policy is to protect personnel from the health
hazards associated with airborne contaminants.

Noise

The purpose of the Noise policy is to protect personnel from the health hazards
associated with high noise.

Potable Water

The purpose of the Potable Water policy is to ensure that all water intended for humans
is free from bacteria and other harmful impurities.

Asbestos Containing Material

The purpose of the Asbestos Containing Material (ACM) Policy is to ensure that:

 All installations have been assessed for the presence of ACM

 All installations with asbestos are surveyed and monitored for presence of airborne
asbestos fibers

 Personnel are not exposed to asbestos fibers

Issue 02 / Revision 00 Hard copies are not controlled Page 28 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Manual Handling Operations

The purpose of the Manual Handling Operations policy is to ensure the risks associated
with Manual Handling Operations are assessed and effective controls to prevent
incidents or injuries are implemented.

Hand Arm Vibration (HAV)

The purpose of the Hand Arm Vibration (HAV) Policy is to provide awareness of safe
working practices to personnel who use vibrating tools and minimize the associated
exposure.

Material Safety Data Sheets (MSDS)

A system that ensures up-to-date MSDSs are available for all hazardous materials being
used or stored at the installation or facility are in place and maintained by an installation
or facility designated person. The system is accessible to all personnel onboard the
installation or facility. The Materials Coordinator ensures that an applicable MSDS is
included with all hazardous materials received at the location and that they are
forwarded to the IMP. The Master / OIM designates a person to maintain the
installation’s MSDS files.
2.3.8 HSE Procedures

The arrangements for determining, developing, implementing, monitoring and reviewing


written HSE procedures are detailed in the Company’s Governing Principles [10] and in
the Health and Safety Policies and Requirements [2][2].

Procedures for HSE tasks and activities are determined and developed at the global,
operations and installation levels. Global HSE procedures apply to the entire company,
Operations HSE procedures apply to all installations operating in the particular
Operation. Installation HSE procedures, such as Rig Mandatory Rig Specific Procedures
(MRSPs) and Recommended Practices (RRPs) are specific to the Rig.

HSE procedures are monitored and reviewed as part of the after action review and
SMART processes.
2.3.9 HSE Communication

The Company has an HSE Meeting policy in the Health and Safety Policies and
Requirements [2][2]. The purpose of this policy is to define meetings where:

 Proactive HSE performance can be recognized.

 Personnel can discuss, understand and apply Company HSE processes and
requirements.

 Incidents and HSE information can be reviewed.

Health, Safety and Environmental (HSE) information is communicated to all personnel


onboard the Rig through a number of HSE meetings. These meetings are documented
and attendance sheets signed by all personnel attending. The Master / OIM and Rig
Manager review and sign each meeting report and validate the meeting in GMS. They

Issue 02 / Revision 00 Hard copies are not controlled Page 29 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

both are responsible to ensure appropriate action identified in the meeting is addressed
using the FOCUS process. The documented meeting reports are stored in GMS.

Weekly Departmental HSE Meetings

Rig personnel will attend at least one departmental HSE meeting per week. Topics to be
discussed at this meeting include:

 Primary HSE Meeting Topic.

 Any feedback/outstanding issues from the previous meeting.

 Review of any dropped object incidents on the rig or at the facility since the last
meeting.

 Review of any SNH dropped object incidents within the Company since the last
meeting, including the implementation of any applicable actions.

 Review of any Company or industry DROPS related communications.

 Agreed Customer requirements relating to DROPS.

 An effective Time Out for Safety that took place.

 Any proactive measures that have taken place to protect the environment.

 Progress made toward achieving the installations Safety and Environmental goals.

 Review all Company HSE Alerts, Advisories and Bulletins since previous meeting.

General HSE Meetings

A general HSE meeting is conducted at least once per month on the Rig. General HSE
meetings are used for issues that apply to all personnel, for example:

 HSE performance recognition

 Review of Monthly Incident Rate Chart

 Significant change to normal routines

 Management System Audits, and Verification process status and results

Pre-tour Meetings

Pre-tour meetings are conducted on board the Rig before each normal and short change
shift/tour and before leaving the accommodation/office area. These meetings are part of
the hand-over process to ensure that all personnel starting work are aware of their
responsibilities for the current and planned operations.

Daily Operations Meetings

A daily operations meeting is held on board the Rig, with the Master / OIM and
Department Heads or their Designees. These meetings include:

 A review of each department’s plans for the next 24 hours.

Issue 02 / Revision 00 Hard copies are not controlled Page 30 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 A discussion of simultaneous operations and controls to be implemented.

 An operational look-ahead (5-Day forecast or weekly planner).

HSE Steering Committee Meetings

Installation HSE Steering Committee Meetings are conducted onboard the Rig at specific
times so that each crew has the opportunity to attend a meeting each year.
2.3.10 HSE Advisories, Alerts and Bulletins

HSE Advisories

HSE Advisories are distributed to communicate any changes to the Company


Management System and the responsibilities for following up, responding to, and closing
associated actions.

HSE Alerts

HSE Alerts are distributed to communicate a potentially immediate danger, and the
responsibilities for following up, responding to, and closing associated actions.

HSE Bulletins

HSE Bulletins are distributed to communicate information that may or may not require an
action to be taken.
2.3.11 MODU Security

The Company has a Security and Emergency Management Policy and Requirements
[4][4] which includes the Company’s policies for Security and Emergency Management,
including requirements for an installation specific Emergency Response Plan. The
principal aim of the Company’s Security and Emergency Management is to:

 Protect human life

 Protect the environment

 Protect assets

 Protect Company reputation

 Maintain business continuity

The responsibilities for emergency response on the Rig are documented in an


Emergency Response Plan.

For more information relating to Security and Emergency Management, refer to the
Security and Emergency Management Policy and Requirements [4].
2.3.12 Drilling and Well Control Operations

The Company has a Well Control Handbook [11] which contains the Company’s well
control policies and procedures, including those procedures for detecting a kick and
shutting in the well and partial and complete well abandonment. The purpose of the Well

Issue 02 / Revision 00 Hard copies are not controlled Page 31 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Control Handbook [11] is to ensure that the Company’s well control policies and
procedures are accurately understood and implemented throughout the fleet.

The responsibilities for well control; requirements for well control training and drills; and
well control planning are documented in the Well Control Handbook [11][11] and on the
Worldwide Training Matrix.

Prior to commencing operations the Company and Customer well control requirements
are reviewed by Company and Customer representatives. The Master / OIM reviews the
well control requirements and emergency response procedures with the Customer
representative on the rig to ensure that the Company’s and Customer’s policies are
consistent. They report any differences to the Rig Manager.

The procedures contained in the Well Control Handbook [11] represent the Company’s
standards and must be complied with unless an approved Request for Exemption form is
completed which describes alternative procedures that meet the intent of the Global
policies.
Agreed Customer requirements or local regulations that exceed Company requirements,
must be complied with.
The responsibilities of Company personnel as described in the Well Control Handbook
[11][11] in no way reduce those of the Customer with regards to well control.
For more information relating to well control procedures, refer to the Well Control
Handbook [11].

2.3.12.1 Simultaneous and Combined Operations

2.3.12.1.1 Drilling Contractor – Customer HSE Management Interfaces

To ensure all joint aspects of HSE Management interfaces are planned, understood and
communicated effectively, an interfacing or bridging document between the Customer
and the Company will be developed as necessary.

The bridging document is a key document utilised by the Company that defines how
aims and objectives will be met for a specific contract. The plan will describe how the
Company’s management system will be applied and is the primary document used to
record internal and external interface and control arrangements.

The objective of the plan is to convey information to all parties engaged in the execution
of the contract to ensure that the requirements of the contract are met.

The aims of the bridging document are:

 To ensure that all contract activities are planned and controlled effectively and
efficiently to the mutual benefit of the Company and the Customer

 To achieve the highest possible standards in the areas of health, safety and
environmental management

 To ensure that key responsibilities are understood

 To ensure that communication links are understood

Issue 02 / Revision 00 Hard copies are not controlled Page 32 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.3.12.1.2 Simultaneous Operations Risk Assessments

Any changes to risk profiles caused by simultaneous operations will be identified,


assessed and reduced to a level of risk tolerable to the Company prior to commencing
operations.

Appropriate hazard identification and risk assessments will be conducted prior to


conducting simultaneous operations (SIMOPS) or combined operations (COMOPS) and
all relevant personnel will be informed of the risks and preventive and mitigating
barriers/controls.

SIMOPS or COMOPS risk assessments will be completed during the detailed planning of
activities or operations that are done in conjunction with the customer and other relevant
3rd parties.

A Summary of Operational Boundaries (SOOB) is used to identify possible working


conflicts dealing with SIMOPS or COMOPS. The SOOB defines when limitations or
restrictions in activities must be in force whenever certain dual activities are going on,
such as helicopter operations while using cranes. The SIMOPS or COMOPS process
requires limitations in work whenever the assessed risk from such work activities
increases is determined to increase to a level that is no longer tolerable. Many of these
activities are already defined in the SOOB. For more details, see Part 4 Section 4.6.3 on
SOOB and Part 4, Attachment 4-4.

2.3.12.1.3 Combined Operations Risk Assessments

Any changes to risk profiles caused by combined operations will be identified, assessed
and reduced to a level of risk tolerable to the Company prior to commencing operations.

The hazard identification, assessment, and risk reduction steps for combined operations
are described in section 2.3.12.1.2 Simultaneous Operations Risk Assessments above.
2.3.13 Marine Operations and Site Assessment

The Company has a Marine Compliance Procedures [6] which contains the policies and
procedures for marine operations, including location specific site assessment for jackups
and moored vessels and Well Specific Operating Criteria (WSOC).

The purpose of the Marine Compliance Procedures [6][6] is to define the company’s
marine requirements to promote consistent operations throughout the fleet. These
procedures state how to conduct marine-related operations while utilizing the required
company assets. The contents of this manual include marine operations, marine
engineering, certification of the installation, marine manning, licensing of personnel, and
documentation.

For more information relating to marine compliance policies and procedures, refer to the
Marine Compliance Procedures [6][6].

2.3.13.1 Adverse Weather

The Company has an Adverse / Extreme Impending Weather policy in the Marine
Compliance Procedures [6][6] which includes requirements for forecasting, criteria for

Issue 02 / Revision 00 Hard copies are not controlled Page 33 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

limiting operations and an extreme weather evacuation plan. The purpose of the
Adverse / Extreme Impending Weather policy is to ensure the safety of personnel on
board the installation during tropical cyclones or adverse / extreme impending weather.

For more information relating to the Adverse / Extreme Impending Weather policy, refer
to the Marine Compliance Procedures [6][6].

2.3.13.2 Support Vessels

In order to effectively manage HSE critical/hazardous activities associated with support


vessels, the Company has an Operations with Other Vessels policy in the in the Marine
Compliance Procedures [6][6], which includes procedures for coordinating support
vessels activities. The purpose of this policy is to:

 Establish guidelines for managing vessels operating adjacent to the Installation

 Establish a notification process for vessel entry into the 500-meter safety zone

 Establish appropriate lines of communication between the Installation and other


vessel(s)

 Verify that vessel and Installation critical systems are fully functional

 Verify that environmental conditions are acceptable for the intended operation

For more information relating to the Operations with Other Vessels policy, refer to the
Marine Compliance Procedures [6].
2.3.14 Engineering Management

The Company has a number of functional support groups relating to engineering


Management:

 Engineering Support

 Marine Support

 Upgrade and Repair Projects

 Maintenance and Technical Support

 New Build Projects

HSE management is a key consideration in engineering projects. The requirements of


the Company’s Health and Safety Policies and Requirements [2] [2]apply during all
engineering projects, including hazard identification and assessment requirements,
unless an interfacing or bridging document is in place between the Customer and
Contractor, such as a Shipyard.

To ensure all joint aspects of HSE Management interfaces are planned, understood and
communicated effectively, an interfacing or bridging document between the Contractor
and the Company will be developed as necessary.

The Company has a Shipyard Project HSE Bridging Document. The purpose of this
document is to describe the requirements for all projects to comply with the Health and

Issue 02 / Revision 00 Hard copies are not controlled Page 34 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Safety Policies and Requirement [2], interface points, and includes allocation of
responsibilities and designation of procedures to be utilized on all projects. Specific HSE
procedures shall be developed and maintained at all project worksites as a reference.

This document provides information to the Project Team and third parties on the
management and administration of health, safety and the environment in design,
construction, installation, commissioning and operation.
2.3.15 Lifting Operations and Material Handling

The Company has a Lifting Equipment and Operations policy in the Health and Safety
Policies and Requirements [2][2], which includes requirements for selecting, operating
inspecting, maintaining and color coding lifting equipment, training requirements for
operators and banksmen, signaling and communication requirements, and requirements
for Cranes and Forklifts. The purpose of this policy is to reduce the risk of injury to
personnel and prevent incidents during lifting operations.

For more information relating to the Lifting Equipment and Operations policy, refer to the
Health and Safety Policies and Requirements [2].
2.3.16 Logistics Management

2.3.16.1 Personnel Tracking

The administrative arrangements for maintaining personnel movements and POB data
are maintained on the Company’s Global Management System (GMS).

The Radio Operator coordinates the movement of personnel arriving or departing the
installation.

The movements of personnel to and from the installation by helicopter are tracked by the
use of manifests. The manifests include the number of passengers, names of
passengers, weight of passengers, baggage and cargo and helicopter identification
number.

2.3.16.2 Helicopter Operations

The Company has a Transport of Personnel policy in the Health and Safety Policies and
Requirements [2] which includes Helicopter operations. The purpose of this policy is to
reduce the risk of injury to any personnel and prevent incidents while traveling.

The Helicopter operations section of this policy includes the requirement for a trained
Helicopter Landing Officer (HLO) to to supervise and coordinate all helideck operations.

Requirements for maintaining the Helideck and Helideck equipment are contained in the
Rig Management System (RMS).

Information on the helideck operation arrangements and limits are contained in the
Marine Operations Manual [5].
2.3.17 Hazardous and Radioactive Substances

The Company has a Hazardous Materials policy in the Health and Safety Policies and
Requirements [2][2]. The purpose of this policy is to heighten the awareness of

Issue 02 / Revision 00 Hard copies are not controlled Page 35 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

personnel and reduce exposure to harmful effects associated with hazardous materials.
This policy includes the requirements for:

 Training

 Using Material Safety Data Sheets (MSDS)

 Markings and Storage

 Inventory Control

 Working with Hazardous Materials

 Radioactive Materials and Explosives

 Dangerous Liquids and Gases

 Flammable and Combustible Liquids

 Paint

 Radio Silence

Appropriate PPE is selected based on the requirements for the particular hazardous
material.

For more information relating to the Hazardous Materials policy, refer to the Health and
Safety Policies and Requirements [2][2].
2.3.18 Procurement Management

Procurement and Service Vendors are selected by following the requirements of the
Company’s Vendor Contracting and Contract Management and the Vendor Record and
Vendor Performance Management policies in the Global Supply Chain Procedures [9][9].
The purpose of the Vendor Contracting and Contract Management policy is to protect the
Company’s interests and manage its risk exposure by assuring consistent use of
approved terms and conditions in all procurement transactions. The purpose of the
Vendor Record and Vendor Performance Management policy is to ensure the
Company’s Approved Vendor List (AVL) consists of reputable, ethical and high
performing suppliers that can meet the Company’s needs and provide the best value for
the Company’s capital and operational expenditures.

The Company has a Material/Service Non Conformity Reporting policy in the Global
Vendor Quality Policies and Procedures [8][8]. The purpose of the Material/Service Non
Conformity Reporting policy is to ensure all Material / Service Non-Conformances
(MSNs) are reported and processed appropriately using a consistent process.

For more information relating to the Vendor Contracting and Contract Management and
the Vendor Record and Vendor Performance Management policies, refer to the Global
Supply Chain Procedures [9].

For more information relating to the Material/Service Non Conformity Reporting policy
refer to the Global Vendor Quality Policies and Procedures [8][8].

Issue 02 / Revision 00 Hard copies are not controlled Page 36 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.3.19 Maintenance Management

The Company has Maintenance Policies and Procedures [12] which includes
requirements for Maintenance Strategy, Planning and Scheduling, Execution, Reporting,
Analysis and Improvement. The purpose of the Maintenance Policies and Procedures
[12][12] is to:

 Ensure reliable, safe and environmentally responsible operations

 Establish processes, procedures and maintenance strategies to ensure equipment


and systems comply with global and regulatory authority requirements

 Ensure efficiency of operations by maximizing the equipment uptime within the


performance required by our customers

 Ensure the installation safety systems, critical process integrity and equipment
performance will always fulfil their required purpose

 Provide a methodology for the continuous improvement of the overall maintenance


process

These provide the framework for management and control of maintenance and for
defining key performance indicators (KPIs) by which the effectiveness of the
maintenance program can be measured; thereby providing the basis for continual
improvement.

The Company’s Computerized Maintenance Management System (CMMS) is Rig


Management System (RMS). RMS is the system of record for rig equipment and
maintenance data including critical equipment/systems and management of change
procedures such as Job Deferral.

Arrangements for identifying safety critical systems, and determining their performance
standards, are addressed in Part 6 of this Safety Case.
2.3.20 Contractor Management

Contractor’s HSE performance is managed by following the requirements of the


Company’s Vendor Quality System Audit policy in the Global Vendor Quality Policies and
Procedures [8][8] and the Vendor Record and Vendor Performance Management policy
in the Global Supply Chain Procedures [9].

The purpose of the Vendor Quality System Audit policy is to determine the conformity /
nonconformity to the ISO 9001 Standard for Vendors utilized by the Global Supply Chain
(GSC) and Operations / Rigs to determine the effectiveness of their Quality Management
Systems in meeting specified Company Management System requirements.

The purpose of the Vendor Record and Vendor Performance Management policy is to
ensure the Company’s Approved Vendor List (AVL) consists of reputable, ethical and
high performing suppliers that can meet the Company’s needs and provide the best
value for the Company’s capital and operational expenditures.

For more information relating to the Vendor Record and Vendor Performance
Management policy, refer to the Global Supply Chain Procedures [9][9].

Issue 02 / Revision 00 Hard copies are not controlled Page 37 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

For more information relating to the Vendor Quality System Audit and Vendor QA/QC
Inspector Surveillance policies refer to the Global Vendor Quality Policies and
Procedures [8][8].

2.4 Performance Monitoring


2.4.1 Periodic Monitoring

The Company has arrangements in place for periodically monitoring HSE performance.
The periodic monitoring of HSE performance is performed at all levels of the
organization, i.e. global, operation and rig levels, and is reported to senior management.
Line managers and supervisors monitor HSE performance and compliance with HSE
policies and procedures.

The Company monitors, tracks, and analyzes HSE performance on a continuous basis
through the Task Planning and Risk Assessment process, Start Conversations, and
FOCUS Process in addition to a more rigorous auditing process as required by external
requirements (i.e., regulation, etc.) and by Management System Audit. Reporting is
done within all levels of the organization and is ultimately regionally and globally to the
Senior Vice President, Operations Integrity (OI) and HSE.

Workplace inspections are conducted by following the requirements of processes such


as the START Conversations policy. The purpose of the START Conversations policy is
to ensure we:

 Engage people in observing activities and work areas.

 Identify and correct at-risk behaviors and conditions.

 Identify and reinforce safe behaviors and conditions.

 Require people to have effective conversations about behaviors.

 Track and trend safe and at-risk behaviors and conditions.

 Demonstrate that personnel are committed to achieving and maintaining a safe


working environment.

The Company also conducts a number of auditing processes to periodically monitor HSE
performance such as Self-Verification and Division Verification (SV/DV), Management
System Audit (MSA) and, as applicable, ISM Code and ISPS Code audits. These
auditing processes are contained in the Company’s Audit and Compliance Policies and
Requirements [13].
2.4.2 Incident Reporting and Analysis

The Company has Incident Reporting and Incident Investigation policies in the Health
and Safety Policies and Requirements [2][2]. The purpose of the Incident Reporting
policy is to ensure that when an incident occurs at a Company installation, facility or
office:

 Action is taken to ensure the area is safe and medical attention is provided, if
required.

Issue 02 / Revision 00 Hard copies are not controlled Page 38 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

 The incident is reported internally and externally, as required.

The purpose of the Incident Investigation policy is to ensure a consistent investigation


process is applied to determine the root cause(s) of incidents and to capture lessons
learned.

Incidents such as; non-work related illness, work related illness, near hits, serious near
hits, first aid cases, medical treatment cases, restricted work cases, lost time incidents,
loss of containment and operational integrity events are reported and investigated.

Incident reporting and incident investigation is recorded in the Company’s Global


Management System (GMS).

The Company follows the Kelvin TOP-SET® incident investigation methodology. Each
installation is required to have at least one person on board at all times who has
completed the Kelvin TOP-SET® Senior Investigator training.

Tracking of items arising from investigations is recorded in Incident Investigation and


FOCUS modules in GMS.

For more information relating to the Incident Reporting and Incident Investigation policies
refer to the Health and Safety Policies and Requirements [2][2].
2.4.3 Behavior-Based Observation Systems

START Conversations

The Company has a START Conversations policy in the Health and Safety Policies and
Requirements [2][2]. START is a behavioral based safety program in which people hold
safety conversations in the workplace. START focuses on the elimination of at risk
behaviors from the workplace by observations and conversations. All personnel are
trained in START Conversations.

The purpose of the START Conversations policy is to ensure personnel:

 Engage in observing activities and work areas.

 Identify and correct at-risk behaviors and conditions.

 Identify and reinforce safe behaviors and conditions.

 Require people to have effective conversations about behaviors.

 Track and trend safe and at-risk behaviors and conditions.

 Demonstrate that personnel are committed to achieving and maintaining a safe


working environment.

For more information relating to the START Conversations policy refer to the Health and
Safety Policies and Requirements [2][2].

Issue 02 / Revision 00 Hard copies are not controlled Page 39 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.4.4 Environmental Monitoring and Measurement

The Company has an Environmental Policies and Requirements [3][3] which contains
Emissions and Energy Conservation, Discharges and Loss of Containment policies for
monitoring and measuring discharges and emissions.

The purpose of the Emissions and Energy Conservation policy is to reduce emissions
and conserve energy. The Emissions and Energy Conservation policy includes the
requirements for monitoring and measuring emissions.

The purpose of the Discharges policy is to comply with environmental regulations. The
Discharges policy includes the requirements for monitoring and measuring discharges.

The purpose of the Loss of Containment policy is to ensure that when a LOC incident
occurs:

 The incident is reported as required

 The incident is investigated as required to prevent re-occurrence

For more information relating to the Emissions and Energy Conservation, Discharges
and Loss of Containment policies refer to the Environmental Policies and Requirements
[3][3].
2.4.5 Audit and Audit Compliance

The Company has an Audit and Compliance Policies and Requirements [13][13] which
includes Management System Audit (MSA), Self-Verification and Division Verification
(SV/DV), ISM Code and Requirements and ISPS Code and Requirements policies.

The purpose of the MSA policy is to define the requirements for verifying compliance
with, and measuring the effectiveness of, the Company Management System (CMS).
MSA Audits are conducted by trained Auditors who have been selected based on their
knowledge, skills and experience.

The purpose of the SV/DV policy is is to verify effective implementation and


understanding of, and compliance with, the CMS on Company installations.

The purpose of the ISM Code and Requirements policy is to ensure that all personnel
with responsibilities related to compliance with the ISM Code (reference ISM Code and
Guidelines 2010) are aware of and meet the ISM Code requirements.

The purpose of the ISPS Code and Requirements policy is to ensure that all personnel
with responsibilities related to compliance with the International Ship and Port Facility
Code (reference ISPS Code and Guidelines, 2003) are aware of and meet the ISPS
requirements.

Tracking of items arising from audits is recorded in the SV/DV and FOCUS modules in
GMS.

For more information relating to the Management System Audit (MSA), Self-Verification
and Division Verification (SV/DV), ISM Code and Requirements and ISPS Code and

Issue 02 / Revision 00 Hard copies are not controlled Page 40 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Requirements policies, including scheduling of audits, refer to the Audit and Compliance
Policies and Requirements [13].
2.4.6 Verification of HSE Critical Activities / Tasks and Equipment / Systems

The Company has an Audit and Compliance Policies and Requirements [13][13] which
includes a Self-Verification and Division Verification (SV/DV) policy.

The purpose of the SV/DV policy is to verify effective implementation and understanding
of, and compliance with, the Company Management System (CMS) on Company
installations.

This is achieved by evaluating and verifying personnel’s knowledge and understanding


of, and compliance with, the CMS, including HSE critical activities/tasks and
equipment/systems, by asking open-ended questions derived from policies and
procedures within the CMS. Verification questions are released on a periodic schedule
in GMS.

The SV/DV process has three parts:

 Self-Verification - Selected verification questions are distributed to the Master / OIM,


who then allocates the questions to selected supervisors (or to himself) to form the
basis of a discussion with appropriate crew members. Based on the responses, the
Master / OIM can determine the degree of knowledge and understanding of, and
whether there is compliance with, the CMS.

 Division-Verification - On completion of the Self Verification (SV), the same


verification questions and the results are provided to the Rig Manager. The Rig
Manager confirms the accuracy of the results by asking the same questions while on
board the Rig.

 Review of responses by onshore subject matter specialists

For more information relating to Self-Verification and Division-Verification (SV/DV) policy


refer to the Audit and Compliance Policies and Requirements [13].

Refer to Part 4 - Risk Management for details of HSE critical activities/tasks and
equipment/systems.
2.4.7 Certification

The Company has a Certificate and Survey Handbook [1] which contains the
requirements for maintaining the Rig’s Classification Society, Flag State, and Coastal
State certification.

Copies of the Rig’s Classification Society, Flag State, and Coastal State certification are
held on board the Rig.

For more details on the requirements for maintaining Classification Society, Flag State,
and Coastal State certification refer to the Certificate and Survey Handbook [1].

Issue 02 / Revision 00 Hard copies are not controlled Page 41 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

2.5 Management Review and Improvement


2.5.1 Review

Senior management periodically reviews the effectiveness of HSE management


arrangements. These review processes include:

 Review of HSE leading and lagging indicators

 Review of Management System Audit results

 Review of Scorecards

 Review of Performance Management through the Company’s business intelligence


process (Compass)

 Operations Business Reviews

 HSE Steering Committee Meetings

 Review of Service Quality Appraisals (SQAs)

 Review of Classification Society, Flag State, and Coastal State certification

 Review of performance appraisals

 Review of external audits

The reporting of the review findings and incorporation into the objectives is conducted
through the SMART Process.

System Management and Review Team (SMART Process)

Change to the Company Management System (CMS) is formally captured, reviewed,


communicated and executed through the System Management and Review Team
(SMART) process.

The SMART process enables people at different levels in the Company, including senior
management, to propose and implement change to the CMS.

2.6 References
[1] Certificate and Survey Handbook, Document No: HQS-OPS-HB-03

[2] Health and Safety Policies and Requirements, Document No: HQS-HSE-PP-01

[3] Environmental Policies and Requirements, Document No: HQS-HSE-PP-02

[4] Security and Emergency Management Policies and Requirements, Document No:
HQS-HSE-PP-03

[5] Petrobras 10000 Marine Operations Manual

[6] Marine Compliance Procedures, Document No: HQS-OPS-PR-06

[7] Medical Protocols Procedures, Document No. HQS-HSE-PR-02

Issue 02 / Revision 00 Hard copies are not controlled Page 42 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

[8] Global Vendor Quality Policies and Procedures, Document No. HQS-GVQ-PP-01

[9] Global Supply Chain Procedures, Document No. HQS-OPS-PR-02

[10] Governing Principles, Document No. HQS-CMS-GOV

[11] Well Control Handbook, Document No. HQS-OPS-HB-01

[12] Maintenance Policies and Procedures, Document No. HQS-AMM-PP-01

[13] Audit and Compliance Policies and Procedures, Document No. HQS-CMS-PP-01

2.7 Attachments
 Attachment 2-1 Organizational Charts

- Attachment 2-1a Executive Organizational Chart


- Attachment 2-1b Rig Operations Organizational Chart
- Attachment 2-1c Petrobras 10000 Organizational Chart

 Attachment 2-2 Safety Case Review Processes


- Attachment 2-2a New Safety Case Review Process
- Attachment 2-2b Safety Case 5 Yearly Review Process
- Attachment 2-2c Safety Case Material Change Review Process
- Attachment 2-2d Safety Case Regulatory or Policy Change Review Process
- Attachment 2-2e Location Change Safety Case Review Process

 Attachment 2-3 Company Management System Structure

Issue 02 / Revision 00 Hard copies are not controlled Page 43 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-1a Executive Organizational Chart

President
CEO

Executive Vice President Vice President Executive Vice President Senior Vice President
COO Audit & Advisory Services CAO and CIO Marketing

Senior Vice President


Operations Integrity, HSE & Executive Vice President Senior Vice President
Technical Services & CFO & General Counsel

Senior Vice President Chief Compliance Officer


Tax

Senior Vice President


Supply Chain and
Controller

Vice President
Corporate Finance and
Treasurer

Vice President
Investor Relations

Issue 02 / Revision 00 Hard copies are not controlled Page 44 of 52


Rev Date: December 13, 2016December Petrobras 10000 Safety Case
12, 2016
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-1b Rig Operations Organizational Chart

Executive Vice President


& COO

Senior VP Operations
Integrity, HSE and
Below is replicated for each Rig Operation – Technical Services
AM1, AM2, AM3, NWE, ANG, ARM, ASA

Director, Operations
Operations Director Integrity and HSE
Support

Senior Manager
Rig Manager Technical Manager Marine Manager
HSE

Assistant Rig
HSE Advisors
Manager

Note: This is a representation of the organization. Specific arrangements may changes as rigs enter or leave a Rig
Operation.

Issue 02 / Revision 00 Hard copies are not controlled Page 45 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-1c Petrobras 10000 Organizational Chart

Rig Manager

Assistant Rig
Manager

Master / Offshore Installation


Manager

Snr. Maintenance
Drilling Superintendent Chief Mate
Supervisor

Electronic 1st Assistant Mechanical


Electrical Supervisor Snr. Subsea Engineer Snr. Toolpusher Snr. DPO Deckpusher Bosun
Supervisor Engineer Supervisor

2nd Assistant
Chief ET Chief Electrician Chief Mechanic Subsea Engineer Toolpusher DPO Crane Operator Able Bodied Seaman
Engineer

Assistant Crane
ET Electrician Oiler / Motorman Mechanic Driller Roustabout
Operator

Welder Assistant Driller


Senior Materials
Rig HSE Advisor
Coordinator

Derrickman Pumphand Floorhand


Materials
RSTT
Coordinator

Nurse

Radio Operator

Issue 02 / Revision 00 Hard copies are not controlled Page 46 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-2a New Safety Case Process

New Transocean Safety Case (IADC 3.6) Process


Areas: AM1, AM2, AM3, ANG, ARM, ASA

Co-ordinate
Contact Arrange any
completion of Parts Soft copy
Operations required rig studies
Rig Manager
3 and 5 publication into Submit to Rig
and gap analysis Share-Point
Integrity
Arrange for PO to
Focal Point be raised for Risk
Management Review and approve
Consultant Safety Case
Discuss
Participate and
requirements for Arrange MAHRA
support MAHRA
Risk Management Work Shop
Workshop
Consultant
Operations Integrity

Advise Rig Manager Review and accept


on any rig studies or Safety Case
gap analysis
Focal Point

Provide Safety Case


Templates

Complete Parts Compile and QA


1, 2, 4, 5 and 6 Safety Case
Risk Management

Provide Input to
Facilitate MAHRA
Consultant

Part 4
Workshop

Conduct
Compartment Risk
Assessment

Participate in Participate in
Participate in
Compartment Risk development of
Rig Supervisors

MAHRA Workshop:
Assessment Parts 3 and 5

Disciplines:
OIM, Drilling,
Marine,
Technical,
Safety

Issue 02 / Revision 00 Hard copies are not controlled Page 47 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-2b Safety Case 5 Yearly Review Process

Transocean Safety Case (IADC 3.6) 5 Yearly Review Process


Areas: AM1, AM2, AM3, ANG, ARM, ASA

Arrange for PO to Co-ordinate the


Contact Operations Soft copy
be raised for Risk update of
publication into Submit to Rig

Rig Manager
Integrity Focal Management Parts 3 and 5
Share-Point
Point Consultant

Review and approve


Safety Case

Discuss
Participate and
requirements for Arrange MAHRA
support MAHRA
Risk Management Work Shop
Workshop
Operations Integrity

Consultant Review and accept


Provide Safety Case Safety Case
Focal Point

Templates

Review Parts Compile and QA


1, 2, 4, 5 and 6 and Reviewed Safety
update as required Case

Provide Input to
Facilitate MAHRA
Risk Management

Part 4
Workshop
Consultant

Conduct
Compartment Risk
Assessment

Participate in Participate in
Participate in
Compartment Risk update of
Rig Supervisors

MAHRA Workshop:
Assessment Parts 3 and 5

Disciplines:
OIM, Drilling,
Marine,
Technical,
Safety

Issue 02 / Revision 00 Hard copies are not controlled Page 48 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-2c Safety Case Material Change Review Process

Transocean Safety Case (IADC 3.6) Material Change Review Process


Material Change definition – Something which affects the basis on which the Safety Case was accepted

Areas: AM1, AM2, AM3, ANG, ARM, ASA


Rig Manager

Co-ordinate the Review and


No Arrange for PO to be update of applicable Soft and hard copy
Approve Material
raised for Parts publication and Submit to Rig
Change
Consultant(s) and drawings distribution

Contact Operations
Integrity Focal Follow RMR/REA
Process as
Point
(Shipyard only)

applicable
Discuss if the Scope
Manager

of Work meets the Will Update applicable


Project

Discuss Review MAHRA(s)


requirement of a Consultant(s) be Parts as required
Yes requirements for applicable to
Material change and required for this
Consultant(s) Material Change
if there is any affect change?
on the Safety Case
Operations Integrity

Review Project
Definition Sheet /
Focal Point

Work Breakdown
Review, QA and
Sheet
accept all revised
Safety Case
Parts
End, no need to change Affects Major
No Yes
Safety Case Hazard Barriers?
Consultant(s)

Facilitate the
process as per
Review MAHRAs as requirement
required discussed with Rig
Manager / Project
Manager

Participate in
Participate in review
update of Parts as
Rig Supervisors

of MAHRA(s)
required

Disciplines:
OIM, Drilling,
Marine,
Technical,
Safety
Transocean

Participate in review
SMEs

of MAHRA(s) as
requested

Issue 02 / Revision 00 Hard copies are not controlled Page 49 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-2d Safety Case Regulatory or Policy Change Review Process

Transocean Safety Case (IADC 3.6) Regulatory or Policy Change Review Process (IADC 3.6)
Regulatory or Policy Change definition – A change which has an affect on the Safety Case

Areas: AM1, AM2, AM3, ANG, ARM, ASA

Review and
Arrange for PO to Soft and hard copy
Approve updated
Rig Manager

be raised for publication and


Safety Case Parts
No Consultant(s) distribution

Submit to Rig
Co-ordinate the
Will update of applicable
Discuss
Consultant(s) be Parts
Yes requirements for
required for this and drawings
Detail extent of Consultant(s) Review, QA and
change?
Operations Integrity

Regulation or Affects Safety policy change and accept all updated


Yes Safety Case
Policy Change Case? affect on the Safety
Focal Point

Case Parts

No

End, no need to change


Safety Case
Consultant(s)

Facilitate the process


as per requirement
discussed with Rig
Manager and
Operations Integrity
Focal Point

Participate in
update of Parts as
Rig Supervisors

required

Disciplines:
OIM,
Drilling,
Marine,
Technical,
Safety

Issue 02 / Revision 00 Hard copies are not controlled Page 50 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-2e Location Change Safety Case Review Process

Location Change Review Process – Transocean Safety Case (IADC 3.6) Review Process
Areas: AM1, AM2, AM3, ANG, ARM, ASA
Rig Manager
Contact Review Safety Case
and update Parts 2, Review and approve Soft and hard copy
Operations 4 and 5 with Rig/ updated Safety Case publication and Submit to Rig
Integrity Focal Area Specific distribution
Point information
Also Follow
Is there a Shipyard
‘Material Change
Period between Yes
Safety Case Review
location change?
Operations Integrity Focal

Process’ flowchart
No
Is the location Review Safety Case Compile and QA
change to a and update Parts 2, updated Parts 2, 4
Regulated Area? No
4 and 5 and 5
Point

Yes

Go to applicable
‘Location Change Safety
Case Review’ flowchart

Issue 02 / Revision 00 Hard copies are not controlled Page 51 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 2: HSE Management System

Attachment 2-3 Company Management System Structure

Issue 02 / Revision 00 Hard copies are not controlled Page 52 of 52


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

CONTENTS

3 Rig Description and Supporting Information ........................................................................ 2


3.0 Introduction.................................................................................................................. 2
3.1 General Information ..................................................................................................... 2
3.1.1 MODU Details .......................................................................................................... 2
3.1.2 Certification, Classification and Registration ............................................................ 3
3.1.3 MODU Layout .......................................................................................................... 3
3.1.4 Modifications and Upgrades .................................................................................... 5
3.1.5 Selection of HSE Critical Equipment and Systems................................................... 5
3.2 Primary Structure......................................................................................................... 9
3.2.1 Operating Limits / Design Criteria ............................................................................ 9
3.2.2 Structural Integrity.................................................................................................. 11
3.2.3 Marine Integrity – Floating Units (Semi-Submersibles and Drillships) .................... 13
3.3 Drilling, Completion and Well Control ........................................................................ 21
3.3.1 Hoisting and Tubular Handling ............................................................................... 21
3.3.2 Mud and Cement System ...................................................................................... 26
3.3.3 Blow Out Preventer (BOP) System ........................................................................ 31
3.3.4 Subsea Completion Tree and Handling Systems ................................................... 35
3.4 Plant and Utilities ....................................................................................................... 35
3.4.1 Power Generation and Distribution ........................................................................ 35
3.4.2 Fuel / Lube Oil System........................................................................................... 39
3.4.3 MODU Air System ................................................................................................. 41
3.4.4 Heating Ventilation and Air Conditioning (HVAC) Systems .................................... 41
3.4.5 Drain, Effluent and Waste Systems........................................................................ 45
3.4.6 Communications .................................................................................................... 46
3.4.7 Emergency Lighting ............................................................................................... 48
3.4.8 Helideck Facilities .................................................................................................. 48
3.4.9 Lifting Equipment and Material Handling ................................................................ 50
3.4.10 Storing and Handling of Explosives / Flammable and other Hazardous
Substances ....................................................................................................................... 52
3.5 Fire and Explosion Protection .................................................................................... 54
3.5.1 Hazardous Area Classifications ............................................................................. 54
3.5.2 Fire & Gas Detection Systems ............................................................................... 55
3.5.3 Emergency Shut Down Systems ............................................................................ 57
3.5.4 Active Fire Protection ............................................................................................. 58
3.5.5 Passive Fire Protection .......................................................................................... 63
3.5.6 Temporary Refuge (TR) ......................................................................................... 64
3.6 Evacuation and Escape Systems............................................................................... 65
3.7 Accommodation ......................................................................................................... 67
3.8 Well Testing ............................................................................................................... 70
3.9 Diving Support ........................................................................................................... 70
3.10 Other Third Party Equipment ..................................................................................... 70
3.11 References ................................................................................................................ 71
3.12 Attachments .............................................................................................................. 71

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

3 RIG DESCRIPTION AND SUPPORTING INFORMATION

3.0 Introduction
Part 3 of the Petrobras 10000 (herein called the Rig) Safety Case describes the layout,
equipment, and control systems of the Rig, in particular those systems that are safety
critical.

To provide assurance that Transocean (the Company) is managing HSE risks effectively,
Safety Case Part 2 – HSE Management System, Part 3 – Rig Description and
Supporting Information (this part), Part 5 – Emergency Response, and Part 6 –
Performance Monitoring are all applied in conjunction with the structured risk
management process described in Part 4 – Risk Management.
Figure 3-1 Interrelationship of Safety Case Parts

3.1 General Information


3.1.1 MODU Details

he Rig was designed and built by Samsung Heavy Industries, as a Mobile Offshore
Drilling Unit (MODU), or more specifically, as an IMO DP Class 3, Dynamically
Positioned Drillship, for exploration and drilling activities worldwide.

The Rig can drill to 37,500 ft. and can operate in water depths of 10,000 ft. The Rig is
constructed with a double hull.

The maximum POB (Personnel on Board) is 200.

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

All of the following information is captured in the rig-specific Descrição da Unidade


Maritima (DUM), which is a separate document from this Safety Case. For a more
detailed description of the Rig, refer to the DUM.
3.1.2 Certification, Classification and Registration

The Rig, including its hull, equipment and machinery, was constructed under the survey
of American Bureau of Shipping (ABS), and is distinguished in the register by the
symbols of:

ABS, +A1, +Drilling Unit, (E), +AMS, +ACCU, +DPS-3, SH-DLA,

The Rig is registered in the Republic of the Marshall Islands as a MODU. Compliance
with the International Safety Management (ISM) Code and the International Ship and
Port Facility Security (ISPS) Code is applicable to the Rig.

There are no deviations from design specification and/or formal exemptions given from
the relevant flag state authority. There are not any operational limitations imposed.
3.1.3 MODU Layout

Main Dimensions and Parameters

Primary dimensions and parameters of the Rig are shown in Table 3-1.

Table 3-1 Primary Dimensions

Parameter Dimension

Length Overall 227.8 m

Length Between Perpendiculars 2,109.4 m

Breadth (moulded) 42 m

Depth (moulded) 19 m

Scantling Draft (moulded) 13 m

Operating Draft (moulded) 12 m

Transit Draft (moulded) 8.5 m

Displacement (Operating Draft) 96,000 mt

Lightweight 35,101 mt

Storage Capacities

The storage capacities of the Rig main tanks are presented in Table 3-2.

Issue 02 / Revision 00 Hard copies are not controlled Page 3 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Table 3-2 Liquid and Bulk Tank Capacities

Material Capacity
3
Fuel (diesel) oil 6,650 m
3
Drill water 2,850 m
3
Potable water 1,060 m
3
Base oil 500 m
3
Brine 500 m
3
Liquid mud 1,000 m
3
Bulk cement 450 m
3
Bulk barite 340 m
3
Bulk bentonite 110 m

The Rig is designed with one continuous upper and forecastle deck.

Accommodation for up to 200 persons, and which includes the Navigation Bridge is
located forward. The Accommodation is fully air-conditioned and comprises: cabins,
Galley, Mess Room, recreation rooms, Hospital and treatment rooms, coffee shop, gym,
offices, conference rooms, etc.

The engine rooms / power plant are located aft. The Rig has six main generators
located in two main engine rooms; three engines to each compartment.

A Moon Pool (approximately 25.6 meters by 12.5 meters) is located amidships in order
to facilitate drilling operations. The drilling equipment is located within modules located 4
meters above the Main Deck.

Drill pipe, collars and casing is stored horizontally on the Pipe Deck located forward of
the Drill Floor. Alternatively, pipe, collars and casing may be stored vertically on the Drill
Floor within the Derrick.

When the Blow Out Preventer (BOP) is not deployed it is stored in the BOP set back
area, adjacent to the Moon Pool port aft side. Marine riser is stored horizontally on the
Riser Deck, aft of the Drill Floor. There is capacity to store a wellhead / Christmas tree
at the Christmas Tree storage area, forward of the Moon Pool.

The helideck is located above and forward of the Accommodation.

A total of eight lifeboats are provided on the Rig: two each on the port and starboard
sides forward; and two each on the port and starboard sides aft. The lifeboats are davit
launched and can hold up 53 persons each. In addition the Rig is equipped with 16
liferafts – each with a 25 person capacity.

Issue 02 / Revision 00 Hard copies are not controlled Page 4 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

3.1.4 Modifications and Upgrades

All modifications and repairs are subject to the same Regulatory requirements specified
for initial construction. Certifying authority approvals / Inspections may be required prior
to modifications or repairs.
3.1.5 Selection of HSE Critical Equipment and Systems

Transocean’s approach to the identification of the Safety Critical Systems (SCS) is


aligned with the asset integrity and operational risk management philosophies of the
International Association of Drilling Contractors (IADC) and other organizations such as
the International Association of Oil and Gas Producers (OGP). This approach
recognizes that safety critical can be applied at different levels of equipment hierarchy.
For example:

 A single component may be critical to the proper functioning and performance of a


piece of equipment (e.g. the ram seals on a BOP ram preventer); or

 A piece of equipment may be critical to the proper functioning and performance of a


larger piece of equipment (e.g. a ram preventer within a BOP stack); or

 A larger piece of equipment may be critical to the proper functioning and


performance of a larger system (e.g. a BOP stack within the BOP System).

The last example recognizes that rig systems, such as the BOP System, incorporate
redundancy / contingency e.g. multiple ram preventers.

All three approaches are managed within Transocean. However, with respect to the
management of major hazards the final example is applied.

Transocean defines a Safety Critical System as: A system which could cause or
contribute substantially to a Major Accident in the event of failure; or a system whose
purpose is to prevent release of a Major Hazard or mitigate a Major Accident.

Key to this is the inclusion of the term ‘Major Accident’. As per Transocean’s definition
this refers to an incident which can cause multiple (5 or more) serious injuries or
fatalities, major damage to the rig or environment, or loss of the rig. Therefore, pieces of
equipment that are safety critical with respect to personal / occupational safety (e.g. a
safety harness or man-riding winch) are not considered as Safety Critical Systems. In
addition, equipment that, albeit important, but does not directly meet the requirements of
the above definition is not considered.

Table 3-3 identifies Safety Critical Systems as applicable to the different rig types
operated by Transocean.

Issue 02 / Revision 00 Hard copies are not controlled Page 5 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Table 3-3 Safety Critical Systems by Rig Type

Safety Critical System Jackups Conventionally Dynamically Petrobras


Moored Semi- Positioned (DP) 10000
submersible rigs

Systems which may cause or prevent major accidents

Ballast System   

Mooring System    

Low Pressure (LP) Mud    


System

High Pressure (HP) Mud    


System

Cement Unit    

Ex Equipment    

Rig Structure    

Watertight Doors,    
Hatches and Valves

Weathertight Doors and    


Hatches

Towing System    

Mud Processing Area    


Ventilation

BOP Stack    

Marine Riser System   

Choke and Kill System    

Diverter System    

Mud / Gas Separator    


System

Drilling Instrumentation    
System

Navigation and    
Obstruction Systems

Weather Station    

Deck Crane Safety    


Systems

Jacking Systems 

Preload Systems 

Issue 02 / Revision 00 Hard copies are not controlled Page 6 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Safety Critical System Jackups Conventionally Dynamically Petrobras


Moored Semi- Positioned (DP) 10000
submersible rigs

Dynamic Positioning 

System

Power Management  
System

Thruster Propulsion  
System

Systems Which May Detect Major Accidents:

Fire Detection System    

HC Gas Detection    
System

H2S (Toxic) Gas    


Detection System

Flood Detection System    

Bracing Leak Detection   (as applicable)

Systems Which Mitigate or Control Major Accidents:

Fire Main System    

Helideck Firefighting    
System

Drill Floor Deluge    


System

Accommodation   
Sprinkler System

Fixed Fire Extinguishing    


Systems

Portable Fire Fighting    


Appliances

Fireman’s Equipment    

Fire Boundaries    

Bilge System    

Emergency    
Communication Systems

Public Address Alarm    


System

Drill Floor Hoisting Safety    

Issue 02 / Revision 00 Hard copies are not controlled Page 7 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Safety Critical System Jackups Conventionally Dynamically Petrobras


Moored Semi- Positioned (DP) 10000
submersible rigs
Systems

Motion Compensator   
System

TR Escape Routes    

Temporary Refuge    

Emergency Shutdown    
System (ESD)

Remotely Operated Fuel    


Oil Tank Shut Off Valves

Machinery Spaces    
Ventilation System
Shutdowns

Emergency Mooring  (as applicable) 


Release System

Emergency Generator    

Escape, Evacuation and Rescue Systems:

Helicopter Deck    

Lifeboat System    

Liferaft System    

Escape Ladder to the    


Sea

Immersion Suits    

Marine Lifejackets    

Escape Packs    

ERRV Standby Vessel   

Third Party (Temporary) Systems (as applicable):

Towing Vessel   

Well Test Package    

Mud Logging System    

Third Party H2S Safety    


Systems

Coiled Tubing System    

Wireline System    

Issue 02 / Revision 00 Hard copies are not controlled Page 8 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Safety Critical System Jackups Conventionally Dynamically Petrobras


Moored Semi- Positioned (DP) 10000
submersible rigs

Transocean Interface   
with Customers ESD
System

Diving System    

Safety Critical Systems are managed by following the requirements of the Maintenance
Policies and Procedures and the planned maintenance schedule described within the
Rig Management System (RMS).

3.2 Primary Structure


3.2.1 Operating Limits / Design Criteria

The following national regulations and International Codes and Standards were used to
assess the design and construction of the MODU. Rules, guidance and regulations are
applied if current or have been applied if revoked:

 International Convention of the Safety of Life at Sea (SOLAS), 1974 with Protocol of
1978 and the amendments up to 2003

 International Convention on Load Lines, 1966 with the Protocol of 1988

 International Convention for the Prevention of Pollution from Ships (MARPOL), 1973
(Annexes I, IV, V and VI (Regulation 12, 13, 14 and 16)) with Protocol of 1978 and
the amendments up to 2003 (except Regulation 25 and the requirements of raking
damage in Regulation 13F)

 International Convention for Preventing Collisions at Sea, 1972 including


amendments of 1981, 1987, 1989 and 1993

 International Telecommunications Union (ITU) Radio Regulations, 1982

 International Convention of Tonnage Measurements of Ships, 1969

 Suez Canal Navigation Regulations and Tonnage Measurements of Ships

 International Electro-Technical Commission (IEC) Publication 92 for electrical


installation on ships

 AC-Metal enclosed switchgear and control gear for rated voltage above 1 kV up to
including 72.5 kV – IEC 298

 Electromagnetic compatibility of electrical and electronic installation on ships – IEC


533

 U.S. Coast Guard’s regulations for Foreign Flag Vessels operating in Navigable
Waters of the United States (except Alaskan waters, without Certificate nor
inspection)

Issue 02 / Revision 00 Hard copies are not controlled Page 9 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

- CFR title 33 – Part 155: Oil Pollution Prevention Regulations of Vessels


- CFR title 33 – Part 156: Oil and Hazardous Material Transfer Operations
- USCG NVIC 3 – 88 for foreign flag MODU’s (Option C)
- CFR title 33 – Part 164: Navigation Safety Regulation

 International Labour Conference concerning Crew Accommodation on board Ship


Convention No. 92 and 133 (except swimming pool)

 OPA-90 regarding double hull requirement

 IMO Resolution A.468 (XII) “Code on Noise Levels on board Ships” 1981

 IMO MSC/Circ.645 Guidelines for Vessel with Dynamic Positioning System,


Consequence Class 3

 IMO MSC.Circ.474 Guidelines for Bow and Stern Loading and Unloading
Arrangements in Oil Tankers (as applicable within scope of the Specification)

 IMO MODU Code 1989, and amendments up to 2001

 American Petroleum Institute (API) as applicable

 Sulfide stress cracking resistant material for oil field equipment for Topside facilities
(NACE Standard MR-01-75)

 ISO 6954-1984E “Guideline for the Measurement, Reporting and Evaluation of


Vibration with regard to habitability on Passenger and Merchant Ship”

 International Ship and Port Facility Security Code

 UK Civil Aviation Publication CAP437 Offshore Helicopter Landing Area – A


Guidance

 UK HSE Requirements in association with UK “Offshore Installations (Safety Case)


Regulation 1992” (SCR) – SI No. 2885

Environmental limiting factors for the Rig include wind speed, air and sea temperatures,
water depth, and maximum wave height and period. The maximum allowable water
depth during drilling operations is 10,000 ft.

The structure design parameters and operational criteria are provided in Table 3-4 and
Table 3-5, respectively.
Table 3-4 Structure Design Parameters

Parameter Transit Survival


Condition Condition

Significant Wave Height, Hs (m) 14.4 14.4

Wave Period, Tp (S) 17.0 17.0

Wind Speed (Knots) 100 100

Issue 02 / Revision 00 Hard copies are not controlled Page 10 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Table 3-5 Operational Criteria

Type of Operation Max. Accepted Motions Portion of


Time (%)
Pitch / Roll (deg.) Heave (m)
(double amplitude) (double amplitude)

Significant Maximum Significant Maximum

Running riser / BOP 3.2 6.0 1.6 3.0 14

BOP handling 3.2 6.0 1.1 2.0 5

Drilling / well testing 6.5 12.0 3.4 6.4 25

Tripping / Running 6.5 12.0 3.4 6.4 30

Running casings 3.2 6.0 1.6 3.0 10

Electric logging - - 3.4 6.4 10

Fishing 6.5 12.0 1.3 2.4 5

Disconnect riser 6.5 12.0 4.4 9.0 1

Wind

The Rig is designed with adequate intact stability for wind speeds to 70 knots for normal
operating / transit conditions and 100 knots for severe storm conditions.

The structural design wind speed is 100 knots ten minute sustained.

The wind speed for station keeping is applied as 50 knots.

Wave

The significant wave height for station keeping capability is applied as 5.8 m.

Current

The current speed for station keeping capability is applied as 1.16 knots.
3.2.2 Structural Integrity

Rig Structure

The purpose, or performance objective, of the Rig Structure is to withstand the maximum
operational and environmental loadings imposed upon it in the transit and semi-
submerged conditions.

There are a number of functional requirements which the Rig Structure must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Rig Structure Performance Standard [1].

Issue 02 / Revision 00 Hard copies are not controlled Page 11 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Every rig is subject to corrosion, fatigue, damage from large equipment, extreme storms,
and contact with other vessels. To ensure the safety and structural integrity of the Rig,
various structural analyses were conducted and monitoring systems implemented.

Inspections, tests and trials of the vessel’s integrity, which includes its materials for the
hull, machinery, equipment, and outfits, was carried out at the shipyard throughout the
construction of the Rig in order to comply with the requirements of the applicable rules
and regulations.

Primary Dimensions and Parameters

Primary dimensions of the rig are shown in Table 3-1.

Fatigue Life

A fatigue analysis and structural integrity study was conducted for the Rig.

The fatigue analysis was conducted in accordance with the ABS Class Rules to
determine the fatigue life of the rig as 25 years.

Corrosion Monitoring and Protection

An automatically controlled Impressed Current Cathodic Protection (ICCP) system, with


remote monitoring system is provided for protection of the hull lying below the waterline.
The Cathodic Protection System is in accordance with DNV Standard RPB401.

Sacrificial aluminum anodes are provided in sea-chests. The vessel is outfitted with an
external ICCP (impressed current Cathodic Protection System), internal and external
passive anodes and forward and aft Marine Growth Protection Systems (MGPS).

Appropriate procedures are in place for the materials, color, surface preparation,
application, inspection, and repair of protective coatings. All tanks, pipelines, valves, and
other surfaces also follow a specific Transocean painting system scheme.

Flood Detection System

The purpose, or performance objective, of the Flood Detection System is to detect liquid
in enclosed, normally dry, compartments which may be vulnerable to flooding.

There are a number of functional requirements which the Flood Detection System must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Flood Detection System Performance Standard [1].

Bilge alarms are used to provide leak indication. Bilge wells throughout the Rig have
high level alarms that are indicated in the Bridge and Engine Control Room.

Leak detection is provided locally and by the Integrated Automation System (IAS).

Inspections/ surveys are performed in accordance with Flag State and Classification
Society requirements.

Issue 02 / Revision 00 Hard copies are not controlled Page 12 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Inspection and Non-destructive Testing

Inspections and non-destructive testing (NDT) is carried out in accordance with the ABS
class and Marshall Island flag requirements.
3.2.3 Marine Integrity – Floating Units (Semi-Submersibles and Drillships)

3.3.1.1 Stability (Semi-Submersibles and Drillships)

Intact and Damaged Stability Characteristics

The Stability Control personnel onboard the Rig are fully familiar with the on line stability
program. The loading program addresses all aspects of vessel loading and is the
primary tool for assessment of both impact and damage stability. As a backup to the on
line stability program, the Petrobras 10000 Marine Operation Manual contains methods
of hand calculating the Rig’s loading and stability properties using a format similar to that
of the Loading Program.

The Installation is equipped with a Load Distribution Control Program “SHIPLOAD”, with
functionality related to equilibrium, longitudinal strength, and stability calculations.

The program has Transocean approval and is not augmented by a third-party, such as a
Classification Society, approval.

The vessel’s loading for a given operating mode must be checked to ensure that the
vertical center of gravity (KG or VCG), corrected for free surfaces, is always less than the
maximum allowable KG and that the hull longitudinal bending moments and shear
stresses are less than the allowable shear forces and bending moments. Such stability
and longitudinal strength calculation evaluations are performed on a daily basis,
especially prior to making any significant change to variable loads or commencing
ballasting or de-ballasting operations. These check that an adequate measure of
stability and longitudinal strength exists before, during and after changes in loading,
drafts, etc.

The free surface effect of the hull and liquid mud tanks can cause an appreciable
increase in the apparent VCG; therefore, it may be necessary to investigate several
schemes of ballasting. As a guide, the most favorable ballasting is achieved by keeping
the number of slack tanks to a minimum. This involves the use of the maximum number
of either completely empty tanks or pressed-up full tanks. The vertical location of the
ballast tank fluid surfaces also exerts an influence: if the filling level of ballast tanks is
above the double bottom, up to ten tanks can be slack with little effect; if the filling level
is below the double bottom, no more than four tanks should be slack at any one time.

Whenever the vessel is prepared for a change of mode in operation requiring a


significant alteration of draft or for severe storm conditions, all hatches, doors, scuttles,
ventilators and other Weathertight and Watertight openings are closed except for those
in actual use.

A field move is defined as a move of relatively short duration, such that favorable
weather can be accurately predicted for its duration. Field moves do not require all of
the preparations of those for a major voyage. If during the move, the roll and pitch
motions of the Installation are deemed excessive, or heavy impacting of seas occur, the

Issue 02 / Revision 00 Hard copies are not controlled Page 13 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Installation’s course may be altered, or speed reduced, to reduce and minimize these
motions.

A major voyage may be defined as a long duration ocean voyage, from one general area
of operations to another. It may also be defined as a long field move of such duration
(which is dependent on the particular area of operations), that it is not practical to project
favorable weather conditions for the duration of the voyage. For such major voyages,
special preparations should include:

 lowering and securing the derrick’s traveling equipment, to prevent damage from
dynamic loads, caused by increased motion of the Installation in a seaway

 securing all deck and below stores

 lashing down equipment, tubulars, etc., to prevent shifting of weights

 closing all Watertight and Weathertight openings

 carefully determining the Installation’s stability for departure and arrival conditions.

Inclining Test and Deadweight Survey


An inclining experiment was carried out on 2 June 2009, while the Rig lay anchored
outside the construction shipyard, Samsung Heavy Industries in South Korea.

Table 3-6 Lightship Values

As-inclined Current Values


Lightship Weight (mt) 35,100.0 35,287.4
VCG (m), from BL +ve upwards 20.8 20.845
LCG (m), from AP, +ve forward 112.663 112.824
TCG (m), from CL, +ve Starboard + 0.297 +0.308

Note: VCG is above the hull molded baseline (BL); LCG is forward from the aft
perpendicular (AP) at frame 0; and TCG is port from the drillship centerline (CL).

The Rig’s Lightship weight includes the following additional items:

 Cement Unit

 Drilling equipment, tensioners, cranes – rigged and ready for service

 Forklift

 Mud Dryer Unit in Moon Pool and through to Mud System

The Rig’s Lightship weight does not include the following;

 Anchors

 BOP stack and Lower Marine Riser Package (LMRP)

 Diving unit and equipment

Issue 02 / Revision 00 Hard copies are not controlled Page 14 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Drill line (spare on reel)

 Flare or burner booms

 Garbage compacters

 Loading station hoses

 Mooring system wire rope

 Mud Lab

 Mud Logging Unit

 ROV equipment

 Well logging unit and equipment

 Well test unit and equipment

The Rig maintains accurate lightship alteration logs. These records are an essential part
of the deadweight survey, and are used along with the deadweight survey to
demonstrate efficient weight control measures.

3.3.1.2 Watertight Doors

The purpose, or performance objective, of the Watertight Doors, Hatches and Valves is
to maintain the watertight integrity of the compartment.

There are a number of functional requirements which the Watertight Doors, Hatches and
Valves must meet in order to fulfil this purpose. These functional requirements are
documented fully in the Watertight Doors, Hatches and Valves Performance Standard
[1].

Details of all watertight compartments and the necessary means of closure can be
located on the Rig’s General Arrangement and Freeboard plans.

When the Rig is preparing for a change in mode of operation, requiring a significant
alteration of draft, or, for a severe storm, all watertight enclosures should be closed.

3.3.1.3 Weathertight Doors

The purpose, or performance objective, of the Weathertight Doors and Hatches is to


maintain the weathertight integrity of the compartment.

There are a number of functional requirements which the Weathertight Doors and
Hatches must meet in order to fulfil this purpose. These functional requirements are
documented fully in the Weathertight Doors and Hatches Performance Standard [1].

Details of all weathertight compartments and the necessary means of closure can be
located on the Rig’s General Arrangement and Freeboard plans.

When the Rig is preparing for a change in mode of operation, requiring a significant
alteration of draft, or, for a severe storm, all weathertight enclosures should be closed.

Issue 02 / Revision 00 Hard copies are not controlled Page 15 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

3.3.1.4 Ballast and Bilge Systems (Semi-submersibles and Drillships)

Ballast System

The purpose, or performance objective, of the Ballast System is to provide a means of


continuously monitoring the draft, trim and heel of the rig and making necessary
adjustments, as required, through all operating conditions.

There are a number of functional requirements which the Ballast System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Ballast System Performance Standard [1].

The Rig is fitted with a segregated water ballast system, which handles only clean sea
water, under normal operations.

There are two ballast systems fitted on board:

 Main Water Ballast System

 Aft Water Ballast System

Both systems have their own pumps and cannot be cross-connected to the other system.

In normal operation, the Main Water Ballast System will be used for ballast transfers in
the vessel, with the After Water Ballast System being used to trim the vessel by the
stern.

Drawing – “Piping Diagram of Hull Part” – MB 601.10. – refers.

The main water ballast system comprises eleven water ballast tanks and ten hold ballast
tanks located forward of the Ballast Pump Room.

The vessel is provided with two ballast pumps delivering 2,500 m3/hr.: one ballast pump
delivering 750 m3/hr. and a ballast eductor delivering 500 m3/hr.

All ballast pumps are located in the Ballast Pump Room, and are electrically driven by
motors located in the Engine Room. Pumps and motors are connected by drive shafts,
which pass through deck stuffing boxes, with gas-tight packing glands.

All hydraulically operated valves in the system are controlled through the IAS and
displayed on the IAS Operator Station.

Each Ballast tank is fitted with High Level Indication Alarms and remote sounding
systems.

Sea suction chest valves are operated manually.

In an emergency situation, the cargo pumps can be connected to the ballast system, by
connecting a spool piece to valve BA574F, for sea suction and emergency de-ballasting.

The Aft Water Ballast System includes, two separate sub-systems, with Port Engine
Room ballast, bilge and general service pump used for the port system and the
Starboard Engine Room ballast, bilge and general service pump used for the starboard
system.

Issue 02 / Revision 00 Hard copies are not controlled Page 16 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The Aft Water Ballast System comprises two tanks (No. 6 WBT, P and S) having a total
capacity of approximately 3,444 m3.

Ballast water is transferred by the use of the Port and Starboard Engine Room ballast,
bilge, and general service pumps, each having a capacity of 500 m3/hr. Both pumps can
be started and stopped from the IAS screen, manually, when the pump is switched to
remote operation.

In the event of a failure, ballast valves fail in the default “closed” position.

Bilge System

The purpose, or performance objective, of the Bilge System is to provide a means of


pumping water out of any compartment which may be susceptible to flooding.

There are a number of functional requirements which the Bilge System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Bilge System Performance Standard [1].

The vessel is constructed with separate machinery spaces, forward and aft. The forward
section consists of three separate Thruster Rooms and the forward Auxiliary Machinery
Room. The aft section comprises the Port and Starboard Main Engine Rooms, and the
aft Thruster Rooms.

The bilge systems comprise the various compartments:

 Pump Room

 HPR Compartments (port and starboard)

 Dry Bulk Tank Room

 Agitator Room

 Bosun’s Store

 Cofferdams

Drawing – “Piping Diagram in Engine Room” – MB 601.25 (1 to 6) – refers.

The following pumps can take suction from the bilge main:

 Engine Room Bilge Pump (5 m3/hr. at 3 bar) – Port Engine Room

 Engine Room / Ballast / Bilge / General Service Pump (500 / 240 m3/hr.) in each
Engine Room

Under normal operations, bilge material is pumped into the bilge holding tank, through
the Engine Room bilge pump in the Port Engine Room. Thereafter the bilge material is
processed via an Oily Water Separator (5 m3/hr.), with clean water (less than 15 ppm oil)
discharge overboard via an “oil in water” monitor unit.

Recovered oil from the oily water separator is discharged to sludge tanks, which are
located in the Engine Rooms.

Issue 02 / Revision 00 Hard copies are not controlled Page 17 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The system is controlled from the IAS, by using remotely operated suction valves, and
the Engine Room bilge pump.

3.3.1.5 Mooring and Station Keeping (Semi-Submersibles and Drillships)

Mooring System

The purpose, or performance objective, of the Mooring System is to provide a means of


maintaining rig position, or to maneuver the rig.

There are a number of functional requirements which the Mooring System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Mooring System Performance Standard [1].

The windlasses and winches installed on the Rig are manufactured by Rolls-Royce.
They are of the high-pressure hydraulic type.

A conventional anchor windlass is located on the Forecastle and four mooring winches
are located:

 Starboard forward

 Port – forward of amidships

 Starboard – aft of amidships

 Port aft

Individual winches are powered by two-speed hydraulic motors, supplied with high
pressure fluid from either of two hydraulic pumping stations.

The vessel is equipped with a Tanktech Co., emergency towing system also.

The vessel’s anchoring system is not intended for drilling service station-keeping; only
for traditional anchoring service when the vessel is lying in a road, harbor, or other
shallow water location. Standard marine practice for deploying and retrieving anchors is
employed.

When estimating the required scope of anchor chain to deploy, for a given situation, note
that the vessel’s thrusters add significantly to the moulded draft. Care must be taken
when deploying and retrieving the anchors, so that the anchor chains do not foul either of
the three forward hull-mounted thrusters.

Supply boat mooring stations, consisting of floating fenders and mooring lines, are
arranged at varying locations on the parallel midship section – port and starboard. Boats
will normally be secured to the vessel side-by-side, at the supply boat mooring stations.
The starboard side, being the “downwind” side, with exhaust ducts, etc. arranged toward
it, is favored for supply boat mooring. Permission must be received from the DP system
controllers 1) prior to mooring a supply boat to the installation, 2) prior to unmooring a
supply boat from the installation, and 3) prior to commencing maneuvering for tandem
off-loading operations.

Issue 02 / Revision 00 Hard copies are not controlled Page 18 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Dynamic Positioning System

The purpose, or performance objective, of the Dynamic Positioning (DP) System is to


maintain station while operating.

There are a number of functional requirements which the Dynamic Positioning System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Dynamic Positioning System Performance Standard [1].

The DP system has been designed to maintain the vessel’s position for a specified set of
environmental conditions in various modes of operation, as defined:

 Normal drilling – the vessel can conduct all normal drilling operations

 Stand-by – all drilling operations are suspended with the vessel at drilling draft and
the riser still connected. The drill string will either be pulled, or hung-off

 Severe storm – the riser is disconnected and either pulled, or hung-off

The DP system control is managed by the Kongsberg Maritime Dynamic Positioning


System sub-unit of the installation’s Kongsberg Maritime Integrated Automation System
(IAS). The core of this system is a Kongsberg Maritime triple-redundant DP-32 dynamic
positioning system. Sensors feeding into the DP system consist of:

 Triple Redundant Controller Unit

 Three Operator Stations

 One K-Pos DP-32 Dual –OS and a DPC-3

 One K-Pos DP-12 Single DP-OS and a DPC-1

 Three sets of sensors – Wind, Gyros and Motion Reference Units (MRUs)

 Two sets of HiPAP systems

 Four sets of DGPS systems including differential correction signals

 One cJoy system

Environmental Meteorological Performance (EMP) System

The EMP system interfaces directly with the vessel’s DP system for monitoring the wind
speed, current, waves and the vessels motion reference sensors for heave, roll and pitch
and mean draft.

The EMP system covers the following:

 Monitoring

 Report generation

 Data logging

The EMP system design is based on the requirements of the relevant Class, US, and UK
authorities.

Issue 02 / Revision 00 Hard copies are not controlled Page 19 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

DP Classification

The Rig has DP Classification DPS-3. This classification identifies that in addition to the
vessel meeting the design requirements for equipment redundancy, the loss of any one
compartment due to fire or flood will also not affect the vessels station keeping ability.

3.3.1.6 Propulsion Systems (Semi-Submersibles and Drillships)

The purpose, or performance objective, of the Thruster-Propulsion System is to maintain


station while operating.

There are a number of functional requirements which the Thruster-Propulsion System


must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Thruster-Propulsion System Performance Standard [1].

The Rig’s thrusters are arranged in two groups: three thrusters forward and three
thrusters aft.

Each thruster has a rated power of 6,035 hp, from a variable speed, vertically mounted
electric motor and is driven by an AC drive motor. The thrusters are fitted with four
bladed, fixed pitch propellers, 3.8 m in diameter.

The thruster motors are of a standard marine type, squirrel cage motor, manufactured by
ABB, and are mounted vertically above the thruster module. Cooling for the motors is
taken from the local fresh water cooling system.

Control of the thrusters is either remotely, from the Bridge, via the DP System, or locally,
from the Azimuth Thruster Room.

The propulsion system may be operated from the Bridge console in the following modes:

 local Aquapilot control

 slave control

 autopilot control

 non-follow-up control

Propulsion control is also available from the DP control station in the automatic, manual
and DP transit modes.

Emergency steering is available from thruster No. 3 and 5.

The main components of the thruster / propulsion system are:

 Aquapilot Control System – UUC 455

 Raytheon STD 22 Gyro Compass

 C. Plath Navisatx MK1 Gyro Compass

 Kongsberg Maritime SVC, Vessel Control System

Issue 02 / Revision 00 Hard copies are not controlled Page 20 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

3.3.1.7 Towing or Transit (Semi-Submersibles and Drillships)

The Rig is a self-propelled DP MODU, and as such, does not require towing, unless
under abnormal or emergency situations.

Emergency Towing System

The purpose, or performance objective, of the Towing System is to provide the means of
attaching a towing line to the rig.

There are a number of functional requirements which the Towing System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Towing System Performance Standard [1].

Emergency towing equipment and arrangements are detailed in the Petrobras 10000
Marine Operations Manual [2].

The Rig is fitted with a KETA-40A emergency towing system for the aft deck and a
KETA-45F / TANKTECH Co. emergency towing system and KETSP-40A, emergency
towing system, with escorting pull-back system, forward.

3.3 Drilling, Completion and Well Control


The drilling, completion and well control consists of various systems onboard the Rig that
may facilitate drilling activities in a safe and efficient way. Typical components of the
system include:

 Hoisting and Tubular Handling

 Mud and Cement System (primary well control)

 Blow Out Preventer (BOP) System (secondary well control)

 Subsea Completion Tree and Handling Systems


3.3.1 Hoisting and Tubular Handling

The hoisting system is used to lift drill tubulars such as piping and casing in and out of
the hole. The main components of the hoisting system typically include:

 Derrick and Substructure

 Derrick Hoisting System:

- Crown Block
- Traveling Block
- Drill Line
- Deadline Anchor

 Drawworks

The tubular handling system comprises of handling and rotating systems used to rotate
the drill string, and other systems that assist with the drilling operations, including:

Issue 02 / Revision 00 Hard copies are not controlled Page 21 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Tubulars

 Rotating System:
- Top Drive
- Rotary Table

 Tubular Handling System

 Drilling Control and Monitoring

Derrick and Substructure

The Derrick is a bolted Dual Dynamic Bottle Neck type (DDBN), hot dip galvanized
construction, consisting of “H” beam sections.

The Derrick is equipped to serve two Well Centers – Main and Auxiliary.

The Derrick is capable of withstanding forces (as per API Spec RP4E and 4F) with a
maximum static and dynamic hook load of 907 mt (2,000,000 lb.) and 440 mt (972,000
lb.), at the Main and Auxiliary well centers, respectively.

The Derrick measures 18.3 m by 24.4 m. The distance between well centers is 12.2 m.

Table 3.7 shows the effective force on the hook. The actual load capability is reduced
due to dynamics.
Table 3.7 Derrick Hook Load Capabilities

Well Centre Operation Condition Survival Condition

Max Static and Max Max Static and Max


Dynamic Hook Compensated Dynamic Hook Compensated
Load Hook Load Load Hook Load

Main 907 mt 454 mt 50 mt 0 mt

Auxiliary 440 mt 400 mt 50 mt 0 mt

The free internal lifting height in the Derrick is 61 m.

The Derrick has two vertical sides approximately 40 m above the Drill Floor, and then
tapers in to the Crown beams that support the Crown Mounted Compensator.

The Derrick supports / comprises:

 Crown blocks – Main / Auxiliary Well Center

 Crown Mounted Compensator

 Guide rails – Main / Auxiliary Well Center

 Adjustable / fixed finger board

 Belly board

Issue 02 / Revision 00 Hard copies are not controlled Page 22 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Casing stabbing basket – Main / Auxiliary Well Center

 Manual racking / finger board winch

 Dual HydraRacker System

 Travelling block – Main / Auxiliary Well Center

 Top Drive including Retractable Dolly – Main / Auxiliary Well Center

 Elevated back-up Tong

Hoisting Equipment

There are two Crown Blocks one for Main and one for Auxiliary Well Centers. Both are
manufactured and supplied by NOV. The Crown Blocks comprise six 72 inch diameter
sheaves, grooved for 2 inch lines. The rated capacity is 907 mt.

An NOV Crown Mounted Compensator is installed at the top of the Derrick. It comprises
a pair of vertically mounted hydraulic cylinders which convert hook load into hydraulic
pressure. The piston rods of the cylinders are attached directly to the Crown Block.

The compensator is fitted with four guide sheaves on pivoted arms. Hydraulic fluid is
used on the cylinder side of the system, so that the Crown Block can be locked in any
position.

There are two Hydralift Travelling Blocks, each rated at 907 mt. These have seven
sheaves, with 72 inch diameter sheaves, grooved for 2 inch lines. Each block weights
12,000 kg.

Derrick Hoisting Safety System

The purpose, or performance objective, of the Derrick Hoisting Safety System is to


prevent dropped objects.

There are a number of functional requirements which the Drill Floor Derrick Hoisting
Safety System must meet in order to fulfil this purpose. These functional requirements
are documented fully in the Drill Floor Derrick Hoisting Safety System Performance
Standard [1].

The crown block safety device is integrated into the drilling control software.

The primary means of drawworks braking is regenerative power. The system also uses
dual disk caliper brakes as a parking and emergency stopping brake.

The Drill Floor Hoisting System is designed to DNV-OS-E101 standards which includes
provisions for preventing the traveling block from running into the crown block during
operations. DNV-OS-E101 also requires the drilling console to sound an alarm if
abnormal conditions are detected on the braking system.

The drilling control system includes three UPS systems, each of which come with 30
minutes of battery backup time for its operational load.

Issue 02 / Revision 00 Hard copies are not controlled Page 23 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Drawworks

The SSGD Drawworks, manufactured by NOV, comprises the following:

 Drawworks Mechanical Parts with AC motors, disc brakes, and emergency lowering
system

 Cooling blowers for Drawworks motors

 Drawworks Control System

 Interface to Operator Stations and other PLCs

 The Drawworks is operated from the Driller’s Cabin.

The Drawworks power is provided by five Baylor 628-TUT electric motors, each having a
continuous output of 1,150 hp.

Rotating System

The Rig is fitted with two NOV, HPS 1000 2E-AC-KT Top Drives – one each for the Main
and Auxiliary Well Centers. The drives have a rated capacity of 907 mt. Output power is
two times 1,150 hp and the maximum continuous torque is 78,450 ft. lbs. Maximum
rotary speed is 280 rpm.

The NOV, twin motor, type 4PVII, Top Drive System maintains rotation and circulation.

The Rotary Table (Main and Auxiliary) installed on the Rig is an NOV RST-1/2 2G, which
can be used with a Top Drive with double functionality in the tools. The Top Drive is used
for drilling, while the RST is used for slowly positioning the bit, in any desired direction,
for directional drilling.

The rotary table is hydraulically operated / driven by three bull / pinion motors.

The maximum static load rating is 910 mt.

Maximum back-up torque applied to the locks is 163,200 Nm

Maximum generated torque is 61,000 Nm

Maximum continuous speed is 5 rpm.

The system comprises:

 Hydraulic Motors

 Dynamic Slip Ring

 Flushing Kit

 Hydraulic Interlock

 Shim and Fixation Block

 Operator Control Box

Issue 02 / Revision 00 Hard copies are not controlled Page 24 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Tubular Handling System

The Iron Roughnecks (Main and Auxiliary) fitted on the Rig are NOV HydraTong MPT
which is used for making up and breaking out drill pipe and collars, ranging from 3-½
inch to 9-¾ inch diameter, and casing up to 25 inch diameter.

The HydraTong MPT system consists of a travelling elevation frame (TE-1190) on to


which the TF-975 Tool Frame (3 ½ inch to 9 ¾ inch) is hung.

The HydraTong is remotely operated from inside the Driller’s Control Room. The
HydraTong is equipped with a pulse encoder, for locating the well center, and the system
can be operated in semi-automatic, manual and emergency mode.

The maximum make-up torque is 103,259 ft. lbs., and the break-out torque is 147,512 ft.
lbs.

Drilling Instrumentation System

Drilling control and monitoring is achieved through the Drilling Instrumentation System.
The purpose, or performance objective, of the Drilling Instrumentation System is to
monitor well conditions.

There are a number of functional requirements which the Drilling Instrumentation System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Drilling Instrumentation System Performance Standard [1].

All mud and drilling instrumentation is monitored and controlled through the Smart
Drilling Instrumentation (SDI) System. The SDI is capable of monitoring and controlling
a variety of functions, such as measurement while drilling (MWD), mud treatment, well
logging, kick monitoring, mud tank volume management, and several other drilling
controls. The SDI allows for customizable alarms, trending, and report generation.

The following information is displayed in the SDI:

 Bit depth, total depth, hook load, and block movement

 Rate of Penetration (ROP) and top drive speed

 Selectable numeric values

 Mud pumps including speed and stroke count

 Mud system including flow in, mud return charge, and mud pump information

 Well control including mud return flow and active gain loss

 Additional selectable values

 Drilling and tripping data including:


- ROP
- Well depth
- Stand counter

Issue 02 / Revision 00 Hard copies are not controlled Page 25 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

- Mud pit volumes


- Trip tank volume
- Circulation rate and pressure

 Tool and equipment status

 Bar graphs including:

- Hook load
- WOB
- Top drive torque
- Standpipe pressure
3.3.2 Mud and Cement System

The mud system is the primary means of well control during drilling operations. It is a
circulating system that transports a mud mixture (drilling fluid) from the wellbore, to a
treatment system on the Rig, and back down the drill stem. The main functions of the
mud system are to transport cuttings to the surface, support the walls of the wellbore,
prevent kicks and blowouts, and reveal information regarding the presence of oil and gas
in the geologic formation. The mud system is divided into three subsystems:

 Low Pressure (LP) Mud System

 High Pressure (HP) Mud System

 The Bulk System

Low Pressure (LP) Mud System

The purpose, or performance objective, of the Low Pressure (LP) Mud System is to
supply mud to the High Pressure Mud System, or to the Cement Unit, in a well control
situation.

There are a number of functional requirements which the LP Mud System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Low Pressure Mud System Performance Standard [1].

Drilling mud is used to provide sufficient hydrostatic head pressure to prevent the ingress
of formation fluids into the well bore, making the LP Mud System an important
component for primary well control. The LP Mud System consists of active and reserve
mud tanks, settling tanks, pill and slug tanks, trip tanks, a stripping tank, a chemical
mixing tank, shale shakers, desilters, vacuum degassers, agitators, centrifuges, mud
hoppers, and a gumbo box. A mud / gas separator (poor boy) is part of the system also.

The LP mud system is fed by the diverter, which is seated on the marine riser flex joint.
The LP mud system indirectly receives mud from the high pressure (HP) mud pumps as
well as the choke and kill manifold through the marine riser.

Issue 02 / Revision 00 Hard copies are not controlled Page 26 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

A total of 12 active tanks (pits) with a net capacity of 880 m 3 are used to hold drilling fluid
that is treated and circulated into the wellbore during drilling operations. Four reserve
tanks with a net capacity of 239 m3 each are used to hold drilling fluid that is stored and
not actively treated.

There are two slug tanks with a net capacity of 20 m3 each. The slug tanks are small
separate tanks which hold a small amount of mud that is denser than the mud found in
the drill string, which is used for special purposes.

The Mud Treatment System comprises of six Brandt VSM 300 Shale Shakers, with a
maximum capacity of 60 m3/hr.

The following items are the main equipment used in this system:

 Diverter

 Choke and Kill Manifold

 Mud Gas Separator – operating volume 63.57 cu. ft., pressure 0 – 10 bar

 Choke Glycol Injection Unit

 Trip Tanks

 Gumbo Separator Box

 Flow divider

 Cutter Conveyor – 16 inch diameter screw type

 Cutting Chute and Dryer

 Desander

 Brandt DG-10 (341 m3/hr.) Degasser

 Burgess Magna-Vac 1500 (227 m3/hr.) Degasser

 Three centrifugal mud treatment pumps (341 m3/hr. each)

 Centrifuge

 Two Progressive Cavity Mono Feed Pumps.

Drill cuttings are carried from the Diverter Housing, with the mud, along the mud return
flowline. The mud and cuttings enter the Shale Shaker Room where they travel through
the two Derrick Primers. These are mesh conveyor belts which separate the larger
cuttings from the mud. The mud which has passed through the primers enters the Shale
Shaker Header Box and over finer mesh screens. The screened mud flows to the mud
return flowline and to the Pit Room.

The cuttings from the primers and shakers enter an auger system which carries the
cuttings to a cleaning unit. This removes the mud adhering to the cuttings, which are
then deposited down an overboard ramp chute. The mud collected from the cleaning
unit is routed to the Pit Room.

Issue 02 / Revision 00 Hard copies are not controlled Page 27 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

High Pressure (HP) Mud System

The purpose, or performance objective, of the High Pressure (HP) Mud System is to
supply and distribute mud to the well, via the Choke and Kill System, in a well control
situation.

There are a number of functional requirements which the (HP) Mud System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
High Pressure Mud System Performance Standard [1].

The high pressure (HP) mud system is primarily comprised of various pumps,
interconnected pipes, valves, mud pump manifolds, a standpipe manifold, and hoses.
The HP mud system receives mud from the active mud tanks and pumps it to a mud
manifold, where it delivers high pressure mud to the mud hoses via a standpipe manifold
and also to the marine riser. The system has a working pressure of 7,500 psi.

There are four NOV 14-P-220, 7,500 psi, triplex, high pressure, reciprocating Mud
Pumps, each having a capacity of 979 gpm. Pump speed (90% of max) is 105 rpm.

The pumps are driven by Baylor, CM628TUT motors with a continuous power rating, per
motor, of 1,350 hp at 920 rpm.

Each Mud Pump has an auxiliary Mud Charge Pump, Mission Magnum Supreme 2500,
100 hp, 1,200 rpm with 14 inch impellor.

The HP mud system also includes mud pump manifolds and a mud standpipe manifold.

Bulk System

The Bulk System is for handling (receiving, storage and transfer (using compressed air))
of chemical powder in the form of barite and bentonite, which are used in the preparation
of drilling mud and also powdered cement used for the preparation of cement mixtures.

The system comprises:

 Loading stations

 Bulk loading hoses

 Rock catchers

 Sampling units

 Bulk storage tanks

 Cement day tanks

 Surge tanks

 Cyclone and dust collectors

All tanks operate at a pressure of 5 bar.

The tanks have the following capacities:

Issue 02 / Revision 00 Hard copies are not controlled Page 28 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Surge tanks – one each: 6 m3 per silo


 Barite
 Bentonite
 Cement
Storage tanks 115 m3 per silo
 Two each barite
 One Baracarb
 One bentonite
 Four cement
Cement day tank – two 40 m3 per silo
Dust collector 2.5 m3
 One barite
 One bentonite
 Two cement
The bulk powders are received in bulk from supply boats and moved around the vessel
by low pressure, high volume air. The system is supplied by the service air system
utilizing pressure reducing stations.

Choke & Kill System

The purpose, or performance objective, of the Choke & Kill System is to control the flow
of wellbore fluids from the well through the Choke Line, and to supply fluids into the
wellbore through the Kill Line in a well control situation.

There are a number of functional requirements which the Choke & Kill System must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Choke & Kill System Performance Standard [1].

The choke and kill manifold, which is designed up to a working pressure of 15,000 psi
receives wellbore fluids from the choke line, and mud from the standpipe manifold, and
cement from the cement unit. It in turn sends fluids to the kill line, poor boy, and
monitoring tank, or alternatively, to either of the overboard lines on the port or starboard
sides.

Adjustable chokes are operated manually and power chokes are operated remotely
through the hydraulic power unit (HPU). The power chokes are controlled from the
remote control panel found in the Driller’s Cabin.

The choke and kill manifold consists of the following equipment:

 2 off Masterflo P25E-15K Manual Adjustable Chokes

 2 off Masterflo P25 Controlled Chokes

 NOV Remote Control Panel – located in Driller’s Control Room

 Glycol Injection

Issue 02 / Revision 00 Hard copies are not controlled Page 29 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Stripping Tank

 Buffer Chamber

Mud Gas Separator

The purpose, or performance objective, of the Mud Gas Separator System is to separate
gas from the drilling mud as it is returned from the well bore in a well control event, and
then to vent the gas a safe distance from the Drill Floor.

There are a number of functional requirements which the Mud Gas Separator System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Mud Gas Separator System Performance Standard [1].

There are three centrifugal type, mud treatment pumps. Each pump has a capacity of
340 m3/hr. These pumps take suction from the mud treatment tanks and deliver mud to
the desander, desilter, mud / gas separator; and mud re-circulation to mud treatment
tanks and to the mud return line from the diverter.

Cement Unit

The purpose, or performance objective, of the Cement Unit is to pump Mud to the well,
via the Choke and Kill System, in a well control situation.

The Cement Unit is used operationally to mix and pump a slurry of cement and additives
into the wellbore to create a solid barrier between permeable formations and the
wellbore. This can and does include cementing casing strings in place, or creating solid
cement plugs in the wellbore. The cement unit can also be utilized to perform downhole
and surface pressure testing, pumping various fluids into the wellbore at varying rates
and pressure, and assisting in well control pumping situations as needed.

There are a number of functional requirements which the Cement Unit must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Cement Unit Performance Standard [1].

The Cement Room contains a Schlumberger CPS-665 Offshore Pumping Skid Unit,
complete with accessories.

Two Caterpillar 3412, Turbocharged Diesel Engines, rated at 860 bhp at 2,100 rpm
power the Gardner Denver GD1250, Triplex Pumps.

The Cement Unit comprises:

 Mark III Slurry Chief Cement Mixer

 Non-radioactive Densitometer

 Advanced Cement Control System

 Stainless Steel Displacement Tanks

 Split Skid with Bulkhead

 Hushed Power Engine Compartment

Issue 02 / Revision 00 Hard copies are not controlled Page 30 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 LAS Metering Rack

 CUS 122 Surge Tank- Offshore

The Cement Unit is designed, tested and certificated (ABS - CDS) for Zone 2 operation.

The system includes a Schlumberger CBS-955 Twin 50 bbl. Batch Mixer, which is a
hydraulic power pack, driven by a Deutz BF6M1015C diesel engine rated at 365 hp, EPA
Tier 2, and Euro Stage II rating. The Unit mixes and recirculates cement slurry for the
pumping unit.

Two centrifugal pumps, transfer fluids from remote sources and recirculates cement
slurry back to the tanks, mixing jet and discharge fluids to the pumping unit.

Two high-capacity jets intercept the newly wetted slurry, with recirculated fluid from the
mixing tank, mixing the old with the new. The mixing tank slurry density is measured in
the recirculation flow loop.

The energy of the resultant slurry, exiting the axial flow mixer, is dissipated by a specially
designed diffuser plate, located just below the tank fluid level.

The slurry is further mixed by two high powered agitators.

The surge tank has a standard volume of 70 ft3, and ensures a steady flow of dry cement
from the bulk silos to the mixing equipment.
3.3.3 Blow Out Preventer (BOP) System

In the event that the mud system becomes inadequate for well control, formation fluids
will enter the well bore and cause a kick. During a kick or other emergency situation,
secondary well control is achieved by means of the blowout preventer (BOP) system.

The BOP system is one of the most critical systems used during drilling and well control.

BOP Stack

The purpose, or performance objective, of the BOP Stack is to provide secondary well
control.

There are a number of functional requirements which the BOP Stack must meet in order
to fulfil this purpose. These functional requirements are documented fully in the BOP
Stack Performance Standard [1].

There are two Shaffer NXT, 18-¾ inch, 1,500 psi, Triple, BOP stack assemblies,
consisting of a Lower Marine Riser Package (LMRP) and a Lower Blowout Preventer
(BOP) Stack, installed on the Rig. The BOP Stack functions are used: to control
wellhead pressure while drilling; to shut-in the well; to strip out drill pipe; and to seal the
wellbore pressure; and, in emergencies, to shear the drill string.

The BOPs each come with a Shaffer 18-¾ inch 10K Annular and Vetco DWHD H4 18-¾
inch, Wellhead Connector.

The BOP equipment is capable of controlling wellhead pressures to 1,034 bar.

Issue 02 / Revision 00 Hard copies are not controlled Page 31 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The LMRP houses two independent subsea control pods (MUX Units) which contain all
of the primary system controls, for the lower stack and LMRP functions. The LMRP is
independently retrievable from the lower BOP stack.

The lower BOP stack houses two ram-type blowout preventers (six cavities in total) used
to close the well, either with drill pipe in the hole or on open bore. The BOP can be left
on the wellhead during bad weather conditions, while the LMRP is recovered to the
surface.

The BOP Stack comprises:

 Pipe Shear / Blind Ram PosLock Operator

 Casing Shear Ram with PosLock Operator

 Pipe Shear Blind Ram with Booster Operator

 Pipe Ram with UltraLock IIB, ILF Operator

 Multi-pipe Ram

The BOP stack also houses accumulator bottle racks for the control system. The subsea
accumulator bottles within this control system are nitrogen gas, pre-charged to high
pressure. They are not protected by an over-pressure relieving device.

Mounted on the LMRP and lower BOP stack are 15 gallon, separator (bladder) type,
accumulator bottles, used to store the hydraulic operating fluid for the functions of the
LMRP and BOP stack.

Two 15 gallon accumulator surge bottles, act as surge dampeners.

There are a total of 125 accumulator bottles on the BOP stack: 16 on the LMRP and 109
on the lower BOP stack.

On the LMRP one accumulator bottle is used as a surge dampener for the upper
annular. The remaining 15 are used to open and close the upper and lower annular,
rams, and the Choke and Kill valves.

BOP Control System

The Rig is fitted with a Hydraulic Power Pack as the primary source of hydraulic fluid
pressure for the Multiplex (MUX) Control System and can be located in a Zone 2
Hazardous Area.

The HPU consists of the following skid-mounted components:

 Fluid Reservoir for Mixed Fluid, Glycol, and Soluble Oil

 Oil and Glycol Filter Assembly

 Proportional Mixing System

 Circulation System

 Two Triplex Pumps

Issue 02 / Revision 00 Hard copies are not controlled Page 32 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Control Panel

 Mixer Control Box

 Air Receiver System

 Hydraulic Return System

The Rig is fitted with a Shaffer Multiplex, Electro-Hydraulic System, which is a


microprocessor based, software driven, electro-hydraulic control, and data acquisitioning
system.

The system provides subsea control and monitoring of the Blowout Preventer (BOP) and
associated valves that control well pressure during drilling operations.

Normal operation is controlled from a panel located in the Driller’s Cabin with a back-up
in the Toolpusher’s office. An electro-hydraulic back-up system provides emergency
operation of critical well control, or stack disconnect functions, if the primary system fails.

The BOP control system complies with API Specification 16D “Specification for Control
Systems for Drilling Well Control Equipment”.

Diverter System

The purpose, or performance objective, of the Diverter System is to divert the contents of
the wellbore away from the rig in a well control event.

There are a number of functional requirements which the Diverter System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Diverter System Performance Standard [1].

The Shaffer 21-¼ inch, 500 psi, Diverter comprises of an internal diverter assembly, and
diverter housing.

During emergency operations the Diverter can be used to control low pressure kicks, or
divert dangerous gasses away from the Rig, through the overboard valves and piping
attached to the Diverter housing.

Hydraulic supply pressure for the Diverter is supplied from the BOP Control System
hydraulic power unit, connected to a separate Diverter Control Panel.

Specifications of the Diverter System are:

 Bore 21-¼ inch

 Working Pressure 500 psi

 Hydraulic Pressure 1,500 psi

 Hang-off Capacity 1.134 million kg

The system comprises:

 Running Test Tool

Issue 02 / Revision 00 Hard copies are not controlled Page 33 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Diverter Housing

 Diverter Spool

 Diverter CSO Packer

 Flowline Seals

 Flexible Joint – which allows a deviation of up to 15 degrees from vertical in any


direction.

Marine Riser System

The purpose, or performance objective, of the Marine Riser System is to provide a heave
compensated, flexible means of maintaining a column of drilling fluid, and to provide a
means of supporting the Choke and Kill Lines.

There are a number of functional requirements which the Marine Riser System must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Marine Riser System Performance Standard [1].

The Marine Riser System comprises the following:

 Dual Wireline Tensioners – total of 16 tensioners. Each single tensioner includes a


vertical tension cylinder, wire sheaves and HP air / oil accumulator

 16 support wires

 Dual idler sheaves for wire routing

 Air valve control skid

 12 working APVs

 Stand-by APVs

 Stand-by Air Compressors

 Cyberbase Controls

 “Local” Operating Panel

 PLC Control Cabinet

The Rig is equipped with:

 78 joints of Shaffer Marine Riser in 90-foot lengths

 Shaffer Pup Joints in 10 foot lengths

 One Shaffer Telescopic Joint – 65 foot stroke

Issue 02 / Revision 00 Hard copies are not controlled Page 34 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Riser Tensioner System

The Rig is fitted with a Dual Wireline Tensioning System, which keeps a positive and
constant tension on the Marine Drilling Riser. Also, it includes compensation for relative
vertical movement (heave), between the vessel and the riser.

The system controls the tension of the riser by means of eight Dual Wireline Tensioners
(a total of 16 tensioners).

The riser is suspended in a support wire from each tensioner via the tension / support
ring.

The overall system includes an air valve, control skid, working APVs, and controls.

The Tensioner System can be operated from any one of the Cyberbase operator
stations, located in the Main Driller’s Cabin.
3.3.4 Subsea Completion Tree and Handling Systems

A subsea completion tree handling area is located to the forward side of the Moon Pool
and Derrick structure. The subsea tree can landed onto a 136 mt (150 short ton) rated
skid cart which is mounted to an elevated guide rail system. Two 136 mt (150 short ton)
skid carts are provided. Commissioning and surface testing of the subsea tree can be
performed from the landing area. A Cargotec HIAB service crane rated to 2,300 kg
(7,000 lbs.) SWL is positioned overhead the subsea tree handling area to assist in
maintenance and testing of the subsea trees. From the landing area the 136 mt (150
short ton) cart can be skid to a 318 mt (350 short ton) trolley cart. The trolley cart can be
controlled either remotely or locally from the Moon Pool area. The trolley cart drag
chains and hydraulic motors have the ability to move the subsea tree to either the
Auxiliary or Main well centers where the tree can be connected and deployed via drill
pipe. A subsea completion tree skidding system with two carts is installed with a skid rail
extended from the port side to the starboard storage area. The skidding cart is able to
be locked on the completion tree trolley prior to movement to the well center. A wooden
guide wall, 75 mm oak, is installed where the completion trees are lowered down with the
main crane from the Pipe Deck level and down to the cart on the port side of the Main
Deck.

3.4 Plant and Utilities


3.4.1 Power Generation and Distribution

The six main generator engines are powered by Wartsilla 16V32, turbo-charged, diesel
engines, each developing 7,290 kW at 720 rpm.

Main power is generated initially at 11 kVA, and supplied to the Port and Starboard HV
Switchboards. Each Switchboard is supplied by three generators, and there is provision
to cross-connect the HV Switchboards

All of the main engines are air start and are fresh water / saltwater cooled.

11 kV is distributed in the following manner:

 Port HV Switchboard (11 kV) feeds:

Issue 02 / Revision 00 Hard copies are not controlled Page 35 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

- Forward Drilling Distribution Transformer (2,700 kV)


- Port Drilling Drive Transformer (7,200 kV)
- Forward Low Voltage (440 V AC) Switchboard via Transformer
- Port Stern Thruster Drive via Transformer
- Cargo Oil Pump No. 1
- Port Engine Room Fire Pump
- Centre Stern Thruster Bus-tie Panel
- Centre Bow Thruster Panel

 Starboard HV Switchboard (11 kV) feeds:


- Center Bow Thruster Panel
- Centre Stern Thruster Bus-tie Panel
- Starboard Engine Room Fire Pump
- Cargo Oil Pump
- Port Bow Thruster Panel
- Aft Starboard Low Voltage (440 V AC) Switchboard
- Starboard Stern Thruster Drive via Transformer
- Forward Low Voltage (440 V AC) Switchboard via Transformer
- Starboard Drilling Drive Transformer (7,200 kV)
- Aft Drilling Distribution Transformer (2,700 kV)

Low voltage Switchboards are 440 / 220 V AC, and are connected with Bus-tie Breakers.

220 V AC is used for lighting, domestic purposes and also as a feed to the UPS systems.

An Emergency Generator is located on the Upper Deck – port forward.

Power Management System

The purpose, or performance objective, of the Power Management System is to maintain


station while operating and to ensure that power is available and distributed correctly.

There are a number of functional requirements which the Power Management System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Power Management System Performance Standard [1].

The electric power plant consists of six main diesel generators, 11 kVA. The rated
power of each main diesel generator is 7 MW.

The main generators and the 11 kV switchboards are located in the aft Engine Rooms,
port and starboard. The 11 kV plant is divided into two bus sections. These are
normally operated in a split bus bar configuration. Each bus section (port, and

Issue 02 / Revision 00 Hard copies are not controlled Page 36 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

starboard) switchboards are fed from three generators. All consumers are supplied from
these bus bars.

The Port 11 kV Switchboard feeds the starboard bow thruster and the port stern thruster.
The Starboard 11 kV Switchboard feeds the port bow thruster, and the starboard stern
thruster. The center stern thruster (Thruster No. 6) is fed from a bus-tie panel that has
the possibility of being connected to either port or starboard 11 kV board by closing the
correct bus-tie breaker.

Also, it is possible to connect both Switchboards (port and starboard), through the center
stern thruster’s bus tie panel when the vessel is not in DP-3 mode. The center bow
thruster (Thruster No. 1) is fed from the 11 kV panel that has the possibility of being
connected to either port or starboard 11 kV board by closing the correct incoming
breaker. A Switchboard interlock prevents the closure of both port and starboard
incomers.

Normally the center thrusters will be connected to different sides (one to port and
another to starboard) of the Switchboards.

Failure of one 11 kV Switchboard will result in the failure of two thrusters: one stern and
one bow – a diagonal pair; and one center thruster, that is connected to the failed
Switchboard.

The center thruster will be automatically reconnected to the healthy Switchboard to keep
four thrusters running.

To prevent system blackouts, the generator protection system, hardwired protection, in


the HV Switchboard, will, in the event of detection of a short-circuit, open the tie
breakers, and if the short-circuit is still present, open the generator breakers.

Directional over current relays in bus tiebreakers, in both Switchboards, recognizes the
fault, together with all generator relays connected. This bus tiebreaker relay will trip the
bus tie connected to the faulty switchboard within 800 milliseconds; isolating the faulty
Switchboard. The generator relays, connected to the faulty bus, will also give trip signal
to the two bus ties at the same time. The generator connected to the isolated faulty part
will trip in 1 second.

IAS System Description

The fully integrated Kongsberg vessel management system enables full control and
monitoring of the Power Generation equipment and propulsion system, and is integrated
with the dynamic positioning control system.

All operator stations, and field stations, are self-contained units, and are independent of
the other units. That is, a failure in one station will not cause any other station to break
down.

All process logic, including equipment safety and control functions, is contained in the
respective field station controller.

Each operator station contains a hard disc, with all system configuration, and acts as
back-up for each other, during system start-up.

Issue 02 / Revision 00 Hard copies are not controlled Page 37 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The main tasks of the vessel management system are as follows:

 Thruster control and Monitoring

 Engine room alarm and monitoring

 Navigation system alarm and monitoring

 Alarm / event recording

 Alarm extension

 Power management control and monitoring

 Auxiliary diesel engine control and monitoring

 Ballast control and monitoring

 Fuel Oil control and monitoring

 Trend function and history functions

 Drilling control system monitoring

Emergency Generator

The purpose, or performance objective, of the Emergency Generator is to provide


emergency power to Safety Critical Systems.

There are a number of functional requirements which the Emergency Generator must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Emergency Generator Performance Standard [1].

The Emergency Generator comprises a Lindenberg-Anlagen, MTU, 12 V 4000P 81,


turbo-charged diesel engine producing 1,600 kW at 1,800 rpm, driving a Leroy Somer,
LSAM 51.2 S55 Generator with a maximum output of 1,350 kW, 480 V AC.

The Emergency switchboard (440 V AC) is fed from the following sources:

 Emergency Generator

 Port Bow Thruster Auxiliary Panel

 Starboard Bow Thruster Auxiliary Panel

 Shore Power Connection Box

 From forward Low Voltage Switchboard

440 V AC is distributed directly to 440 V AC consumers, and is also fed via step-down
transformer to the Emergency 220 V AC feeder panel.

The engine has three means of starting:

 Main – batteries - automatic

 Manual – hydraulic

Issue 02 / Revision 00 Hard copies are not controlled Page 38 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Air/ hydraulic

Uninterrupted Powered Supplies (UPS)

The Rig is equipped with UPS protection for each of the following critical systems:

BOP

There are two UPS units located in the CCC (Central Control Center), one for the Yellow
Pod, and one for the Blue Pod. However, both UPSs can supply either pod. The UPSs
will provide a minimum of 2 hours back-up power to the pods, should all power be lost.
One UPS is powered from the 440 V AC Drilling bus “A”, and the other is fed from 440 V
AC Drilling bus “B”. Should either of the power supplies be lost, a supply from the
Emergency Generator will take over. This transfer is bumpless.

Kongsberg VMS

The Kongsberg VMS has a total of nine UPSs which via distribution boards supply power
to all field stations, operator stations, DP sensors, and the Fire and Gas Detection
systems. Each of the UPSs has three redundant supplies: one from the Emergency
Switchboard; one from the Port Switchboard; and one from the Starboard Switchboard.
Should any of the power supplies be lost, there will be a bumpless transfer of power.
Each UPS will provide power for a minimum of 1 hour should all power be lost.

Drilling UPS

The Drilling equipment PLCs, and critical control systems, are powered via a 440 V AC
UPS located in the Drilling Switchgear Room. The UPS has three supplies: one from the
440 V AC Drilling bus “A”; one from 440 VAC Drilling bus “B”; and the other from the
Emergency Switchboard. Should any of the power supplies be lost, there will be a
bumpless transfer of power. Power is distributed via a UPS Distribution board. The UPS
shall provide power for a minimum of 1 hour should all power be lost.
3.4.2 Fuel / Lube Oil System

Fuel / Lube Oil Storage Tanks and Transfer Arrangements

Each engine room is fitted with two fuel oil supply pumps with a capacity of 23.7 m 3/hr.

Apart from the main engines, fuel is also supplied to the Emergency Generator, Auxiliary
Boilers, Inert Gas Generator and Incinerator.

Fuel Tank Capacities are as follows:

 Fuel Tanks – No. 1 and 2 – 3,004.8 m3 each

 Settling Tank – Port and Starboard – 119.9 m3 each

 Daily Service Tanks – Port and Starboard – 103.3 m3 each

 Emergency Generator Fuel Tank – 9.0 m3

 Drain Tank – 0.5 m3

 Diesel Oil Storage Tank - Forward – 328.1 m3

Issue 02 / Revision 00 Hard copies are not controlled Page 39 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Drawing Ref. “Piping Diagram in Engine Room”- MB 101.20 (3/6)

There is a dedicated Lube Oil storage tank on the Rig, with a capacity of 44.5 m3. The
tank is fitted with remote and local level indication, and high level alarms.

A separate “Daily” tank (0.2 m3) is used to supply small quantities of Lube Oil to several
miscellaneous systems.

Each main engine room is provided with a stand-alone Lube Oil purifier. Sludge from
cleaning cycles of the purifiers is deposited in the Sludge Tank (2 m 3). This tank is fitted
with remote temperature and level indication.

Fuel Sampling and Retention

Each fuel delivery is accompanied by a “bunker delivery note“. This note includes a
declaration signed and certified by the fuel oil supplier’s representative that the supplied
fuel oil is in conformance with MARPOL regulations. The bunker delivery note is stored
for three years after fuel delivery.

Remotely Operated Fuel Oil Tank Shut Off Valves

The purpose, or performance objective, of the Remotely Operated Fuel Oil Tank Shut Off
Valves is to isolate the flow from all Fuel Oil Service and Storage Tanks.

There are a number of functional requirements which the Remotely Operated Fuel Oil
Tank Shut Off Valves must meet in order to fulfil this purpose. These functional
requirements are documented fully in the Remotely Operated Fuel Oil Tank Shut Off
Valves Performance Standard [1].

The Fuel Oil System is capable of remotely starting and shutting off the fuel oil transfer
pumps. The IAS system is also capable of remotely shutting down the transfer pumps if
level indicators report high liquid level.

Components Preventing Loss of Containment/Spillage

During normal operations, the following spill prevention devices are utilized:

 All fuel vents have fixed spill containment

 Bunker stations have fixed spill containment

 All oil storage facilities have fixed spill containment

 During fuel / oil transfers all associated overboard scuppers are closed

 Spills that occur onboard will be cleaned up using spill kits located in various areas
around the Installation. Additionally, oil spills will be removed to drums or a slack
EWT tank (if well fluids are spilled) using portable reciprocating pumps located in the
spill locker in the Moon Pool area. Mud spills on deck are vacuumed off the deck via
connections located on the port-side and Moon Pool areas of the mud module and
discharge into the mud module / Drill Floor vacuum recovery system.

Spill prevention operations for the Well Test Area will be as follows:

Issue 02 / Revision 00 Hard copies are not controlled Page 40 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 All Well Test Deck drains are piped to a safe area coalescing tank. When well test
operations are being conducted, the well test drains will be isolated from the safe
area hull tank and diverted to a portable drain holding tank located on the main deck

 Forward Riser Deck and Center Containment area scuppers drain to directly
overboard and to the hazardous area coalescing tank

When EWT fluids are being transferred both sets of scuppers will be closed with
expandable plugs. In the event of a spill, a portable pneumatic pump and spill kit will be
used first. In the case of large spills that could overwhelm the portable pump’s capacity,
the scupper plugs to the hazardous are coalescing tank will be removed allowing the spill
to drain into the tank.

All other areas drain to the safe area coalescing tank. All other main deck areas also
have scuppers that discharge overboard. All overboard scuppers will normally remain
closed, using expandable plugs. These will be opened only in the case of wash down or
major rain events.
3.4.3 MODU Air System

The Rig is fitted with three Hamworthy 4SW80 Mk III, 3,625 psi, high pressure,
electrically driven air compressors. Each compressor unit is fitted with two Hamworthy
Desiccant Twin Tower Air Dryers with a rated capacity of 4,502 ft3/ hr.

Low Pressure (Rig Air) is provided by four Tamrotor Marine Compressors, Model M 150-
10 EWNA, with a rated capacity of 43,861 ft3/hr. and a working pressure of 125 psi.

There are four Johnghap Pneutec CMH-114A Start Air Compressors with a rated
capacity of 60 m3/hr. and a working pressure of 29 bar. These are located in the Main
Engine Rooms.
3.4.4 Heating Ventilation and Air Conditioning (HVAC) Systems

The Rig’s heating, ventilation, and cooling systems are designed to ensure that all inside
safe areas (access corridors, stairways, airlocks, muster areas and escape routes) are
over pressurized while all inside hazardous areas are under pressurized. Fire dampers
are situated at strategic places in the Accommodation ductwork to allow effective
isolation in the event of fires, gas release, etc.

In the event of gas detection in the main air intake, the HVAC control panel will
disconnect, and all fire dampers, associated with the respective compartments will be
closed by the Fire and Gas Detection System. The non-related HVAC units will continue
to function.

HVAC Design Basis

The HVAC systems in all areas of the Rig are designed in accordance with the following
functional requirements:

 Sufficient ventilation, heating and cooling capacity in all weather conditions;

 Acceptable air quality in all weather conditions;

Issue 02 / Revision 00 Hard copies are not controlled Page 41 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Reliable performance through concept selection, the design having the following
features in decreasing order of importance:
- Simplicity, with a preference for passive systems,
- Inherent robustness by providing design margins for systems and equipment,
- Fault/status indication and self-diagnostics,
- Sparing of systems and equipment,
- Maintainability through ease of access for tests and inspections.

The following additional requirements apply to specific areas on the rig to:

 Prevent the accumulation of potentially hazardous concentrations of flammable


gaseous mixtures in hazardous areas by the provision of sufficient ventilation and air
distribution for the dilution, dispersion and removal of such mixtures, and contain
such mixtures, once formed, through maintaining relative pressures, avoiding cross-
contamination and providing dedicated systems for hazardous areas.

 Prevent, through pressurization, the ingress of potentially flammable gas-air mixtures


into all designated non-hazardous areas;

 Maintain ventilation to all equipment and areas/rooms that are required to be


operational during an emergency when the main source of power is unavailable;

 Provide a humidity and temperature controlled environment in which personnel, plant


and systems can operate effectively, free from odors, dust and contaminants,
including smoke control

The HVAC system is interfaced with the Fire and Gas Detection System for ESD.
Further detail on the Fire and Gas Detection System is provided under heading 3.5.2.
The HVAC system is designed for normal and emergency operations.

Accommodation Ventilation System

The Rig is equipped with a centralized air conditioning system, to serve as ventilation,
heating and cooling for cabins, public spaces and the Hospital.

The air conditioning system is a high pressure, single duct, re-heating system, with
central heating and cooling unit.

The system consists of air handling units and refrigerating plant with distribution ducts.

Two Hi Air Korea HIP – 3WGE, package type unit coolers (R-404A – direct expansion
system, plenum chamber type, fresh water cooling), one Hi Air Korea HIP-8WGE, ten
Finetec Century MP-G10 HF 3, and three Finetec Century MP-G5HF3, air conditioning
units and air handling systems, which supplies the following compartments:

 Two Engine Control Rooms

 Wheelhouse

 Helicopter Reception Room

Issue 02 / Revision 00 Hard copies are not controlled Page 42 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Switchboard Rooms

 Thruster Rooms

 Electrical Store

 Engineer’s Store.

The Galley has its’ own dedicated air conditioning unit.

Air is drawn into the system, on a basis of 47% fresh air and 53% recycled air.

The refrigeration plants are two condensing units, each having 100% cooling capacity.
Each unit comprises a screw type compressor, condenser, gas dryer and associated
equipment.

H2S (Hydrogen sulfide) Detectors are located at the Accommodation block entrances at
all levels.

The Installation is also fitted with a dedicated Drilling HVAC system, located at “B” deck
level, amidships, and supplies the Drilling Switchboard Room, and Electrical / ET,
workshops, offices and stores.

Mud Processing Area Ventilation System

The purpose, or performance objective, of the Mud Processing Area Ventilation System
is to dilute and remove flammable or toxic gas, and to maintain a pressure differential
between the hazardous area and adjacent non-hazardous areas.

There are a number of functional requirements which the Mud Processing Area
Ventilation System must meet in order to fulfil this purpose. These functional
requirements are documented fully in the Mud Processing Area Ventilation System
Performance Standard [1].

The HVAC system for the cabin consists of two systems: one fan skid mounted outside
and one AC unit inside the Driller Cabin. The fan skid is supplies the Driller Cabin, Local
Instrument Room (LIR) and the Total Drilling Control Room (TDCR) with fresh air and
maintaining mandatory over pressure in both rooms. The AC units is placed inside the
Driller Cabin, LIR and TDCR to control the inside temperature. The temperature
adjustment is controlled from the integrated control panel on the AC-units.

The HVAC systems for DC, LIR and TDCR consist of the following:

 Dual purge fans, located in safe area. (min. 3 meter away from Ex-zone)

 Pre-heater for heating fresh air

 AC-unit mounted inside the Driller Cabin with heater and cooler included

 AC-unit mounted inside the LIR with heater and cooler included

 AC-unit mounted inside the TDCR with heater and cooler included

 Water-cooled condenser to cool the AC units

Issue 02 / Revision 00 Hard copies are not controlled Page 43 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 All required dampers

Pressure differential transmitter and flow transmitter is provided inside the cabin, LIR and
TDCR to detect low pressure; this will give the vessel system an alarm signal, a light will
be lit and a buzzer will give an audible alarm. The low pressure alarm is suppressed for
30 seconds this to avoid an alarm every time the door is opened. The cooling loop is
started and stopped by a pressure activated valve, allowing water to flow or not in the
loop.

Machinery Space Ventilation System

The purpose, or performance objective, of the Machinery Spaces Ventilation System


Shutdowns is to prevent the ingress of flammable gas, deprive a fire of oxygen, and to
ensure the effective operation of installed fire extinguishing systems.

There are a number of functional requirements which the Machinery Spaces Ventilation
System Shutdowns System must meet in order to fulfil this purpose. These functional
requirements are documented fully in the Machinery Spaces Ventilation System
Shutdowns System Performance Standard [1].

Machinery spaces are air conditioned or ventilated by air conditioning units and
ventilation fans. The air conditioning systems are linked to the IAS which is capable of
sending a signal to shut the dampers and ventilation fans in the HVAC system.

Machinery spaces are located in the hull of the Rig. All machinery spaces / areas are
zoned as safe areas, and pressure is maintained at atmospheric conditions with no
control of relative humidity. Exceptions are the Paint Locker, which is Zone 1 and kept at
-50 Pa, and the drain tank room, which is Zone 2 and kept at -50 Pa. The spaces in the
hull are continuously maintained at the conditions specified.

Automatic and Manual Shutdown Arrangements

Operational functions of the HVAC System can be performed in two operating modes:

 Manual (Advisory Mode)

 Automatic Mode

By means of a dedicated switch, the operator may select between these two operating
modes:

Manual (Advisory Mode)

In this mode the operator is advised by the system of the actions to be taken in case of a
specific event (Fire or Gas detection). Depending on the operating conditions, the
operator will take the appropriate actions.

Automatic Mode

In this mode all the functions are to be initiated automatically by the system as reflected
in the Fire and Gas Detection System “Cause and Effect” diagram.

Issue 02 / Revision 00 Hard copies are not controlled Page 44 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

3.4.5 Drain, Effluent and Waste Systems

There are three types of waste that require disposal from the Rig, in respect to the
requirements outlined in the MARPOL schedule. These include:

 Waste oil and oily water

 Sewage (black or grey water)

 Solid waste

The disposal of these wastes is in accordance with MARPOL 73/78.

The essential features of the Rig with regard to environmental management are the:

 Drain system

 Oily water separator

 Sewage treatment unit

Drain System

Drains are provided on the Installation in all spaces where water or oil can accumulate.
The drains are divided into two categories: clean and contaminated. Each of these is
divided into hazardous and non-hazardous systems. The hazardous and non-hazardous
drains are piped separately.

A separate drain system is provided for mud handling areas. Water based mud is routed
overboard and oil based mud is routed to collection drums.

Oily water is routed to separator tanks where the oil is manually drained and transferred
to oil collection tanks. The residual water is routed to the Oily Water Separator where oil
is separated and routed to the collection tanks. The water is tested for oil content prior to
being discharged overboard.

Sewage Treatment System

Grey water, which originates from showers, basins, the galley and the laundry, is
discharged overboard. Black water, water from urinals and hospital grey water is routed
to a sewage treatment plant where it is treated. The sewage is managed by a sewage
treatment plant, sewage holding tank and pipeline for the discharge to a reception
facility. The sewage treatment plant is certified to meet the effluent standards as provide
for in Resolution MEPC.2 (VI).

The sewage system is located forward below Main Deck level

Handling and Discharging of Cuttings

The Rig is fitted with two Brandt HS3400 centrifuges, with 45 hp Power Pack and Control
System.

The centrifuge separates the oil from the mud, and the cuttings are sent to a dryer

Issue 02 / Revision 00 Hard copies are not controlled Page 45 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Mesh conveyor belts separate the larger cuttings from the mud. The mud which has
passed through the Primers then enters the Shale Shaker Header Box. The mud has is
cleaned of cuttings and returns to the mud return flowline and back to the Pit Room.

The cuttings from the Shakers enter an auger system which carries the cuttings to a
Brandt cleaning unit. The Brandt Unit removes all the mud adhering to the cuttings,
which are then deposited down an overboard ramp chute.

The mud collected from the Brandt Unit re-enters the flowline and returns to the Pit
Room

Segregation and Storage of Other Waste

Waste storage areas are segregated and hazardous waste will be clearly segregated
from the non-hazardous waste.
3.4.6 Communications

Public Address and General Alarm

The purpose, or performance objective, of the Public Address and General Alarm
(PA/GA) System is to transmit audio and visual information during an emergency
situation.

There are a number of functional requirements which the Public Address and General
Alarm System must meet in order to fulfil this purpose. These functional requirements
are documented fully in the Public Address and General Alarm System Performance
Standard [1].

The Rig’s PA and GA System includes the facility to broadcast routine and emergency
messages and alarm signals to all areas of the Rig.

The Rig is protected by the following alarm and detection systems.

General Alarm – three General Alarm actuation stations are located on the Rig, one in
the Control Room, one in the Radio Room and one on the Drill Floor. The General
Alarm bells are used to notify personnel to report to their lifeboat stations, prior to
abandoning the Rig, for man overboard alert, and to signal other emergencies.

Abandon Ship Signal – continuous sounding of the General Alarm bells.

Man Overboard Signal – a series of three long soundings of the General Alarm bells.

Fire Alarm – the Rig’s fire alarm system is actuated by three methods: manual
pushbuttons; thermal detectors; and smoke detectors. The actuators are distributed
throughout the Rig as are the alarm bells that are activated by them. The fire alarm panel
is in the Control Room. A repeater panel is located in the Radio Room.

Fire or Emergency Instruction Signal – intermittent sounding of the General Alarm bells.

Gas / H2S Alarm – a gas alarm panel and alarm bell are located in the Control Room and
the Driller’s Cabin. The alarm is activated by gas and H2S monitors located: on and
under the Drill Floor; the rotary box; Cellar Deck; Pipe Racks; Mud Pit Room; flowline at

Issue 02 / Revision 00 Hard copies are not controlled Page 46 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

the shale shaker; Mud Process Area; and Accommodation ventilation inlets. Four
portable gas detectors are also carried on the Rig.

Gas Emergency Signal – series of one long and one short sounding of the general alarm
bell.

Smoke / Heat Detection – a smoke and heat detection system is installed, monitoring all
Accommodation and machinery spaces, with an alarm panel in the Control Room and an
operator control station in the Wheelhouse.

The detection and alarm systems are backed-up by UPS and battery power in the event
of a single / multiple point failure

Emergency Communications System

The purpose, or performance objective, of the Emergency Communications System is to


provide internal and external communications during an emergency situation.

There are a number of functional requirements which the Emergency Communications


System must meet in order to fulfil this purpose. These functional requirements are
documented fully in the Emergency Communications System Performance Standard [1].

Principal equipment includes one Global Marine Distress And Safety System (GMDSS)
station, with two operator stations located in the Bridge and Radio Room outfitted for A3
Sea Areas operations. Features include:

 redundant MF/HF SSB duplex radios with telex over radio capability (Radio Room
only)

 Marine VHF radios

 one Inmarsat C telex station (Bridge only)

 one Inmarsat B system (complete with telephone, telefax, telex and data capability)

A secondary GMDSS radio station is located in the Engine Control Room (ECR),
consisting of two Marine VHF and one MF/HF SSB units.

Other communications equipment available include: portable UHF and VHF intrinsically
safe radios; a UHF repeater/pager system; a VHF Airband radio (for helicopter
communications); a non-directional beacon (for helicopter operations); and cellular
telephone capability.

Operation of the communication system is verified and documented by annual testing


and maintenance of communication equipment to ensure proper performance.

The following equipment is fitted:

 Sailor CU5100 MF/HF Radios

 Sailor RT 5022 VHF

 Sailor – 3000 E InMarsat C

 InMarsat F , Fleet 77

Issue 02 / Revision 00 Hard copies are not controlled Page 47 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Navtex JMC NT- 2000 Receiver

 GM 338 VHF Radio


3.4.7 Emergency Lighting

General Emergency Lighting System

General emergency lighting is used to illuminate areas for personnel onboard and is
powered by the emergency switchboard through each lighting distribution panel. Circuit
connection to the emergency switchboard for lighting fixtures ensures power in an
emergency situation. Additionally, battery back-up is provided on light fixtures essential
to escape and evacuation to provide lighting in the event of emergency power failure.

Navigation and Obstruction Systems

The purpose, or performance objective, of the Navigation and Obstruction Systems is to


provide visual and audible warnings of the rig as an obstruction or danger to the safe
navigation of other shipping, when the rig is on location or under tow.

There are a number of functional requirements which the Navigation and Obstructions
Systems must meet in order to fulfil this purpose. These functional requirements are
documented fully in the Navigation and Obstructions Systems Performance Standard [1].

The vessel is constructed as a ABS +A1(E) Self Propelled Mobile Offshore Drilling Unit
and is equipped with the following:

 Navigational lights, obstruction lights, fog horns, and ships whistles


- Navigational and obstruction lighting is controlled manually from the Wheel
House lighting panel.
- A pneumatic ships whistle is located forward and aft. It can be operated manually
or automatically from the bridge control console.
- Fog signals are controlled from the bridge (Fog Signal Control Panel). They are
capable of manual and automatic operation
3.4.8 Helideck Facilities

The purpose, or performance objective, of the Helicopter Deck (helideck) is to provide a


suitable landing area for evacuation by helicopter.

There are a number of functional requirements which the Helicopter Deck must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Helicopter Deck Performance Standard [1].

The Rig is equipped with a self-contained helideck, located at about 4,230 mm above the
Helicopter Reception Deck level, at the fore end of the Rig, above the Wheelhouse.
Access to the Helideck is via stairways on port and starboard sides of the helicopter
reception deck. The Helideck is octagonal in shape, with dimensions approximately 27.3
m by 27.3 m.

The helideck is rated for a Sikorsky S-61 N helicopter or equivalent, with a maximum
rotor diameter of 18.9 m (62.0 ft.). The gross load limit is 9,297 kg (20,500 lb.).

Issue 02 / Revision 00 Hard copies are not controlled Page 48 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The helideck measures 83 feet by 83 feet, and is certified to CAP 437 (NORMAN-27)
Standards, for a single main rotor Helicopter.

The construction is aluminum, with mild steel supports, of pancake type construction.

The deck is designed to drain to the edges with appropriate guttering and drainage.

The deck is surrounded by a 1.5 meter safety net framework that protrudes outward at
deck level for most of the perimeter of the deck. Barrier railings, consisting of metallic
tubing frames, border passenger walkways, and ensure passenger safety for
embarkation and disembarkation from the helideck.

Emergency equipment associated with the helideck is:

 Two wheeled Dry Powder (Class D) fire extinguisher

 One wheeled CO2 (carbon dioxide) fire extinguishers

 One Fire Locker

 Three fireman’s outfit

 Breathing apparatus

 Lifeline

 Safety lamp

 Axe

 Non-conductive boots

 Gloves, rigid helmet, protective clothing

 Helicopter Emergency Crash Locker

 Three foam monitors with dedicated piping to foam tanks located under the
Helicopter Reception Room.

 Three Escape Routes – down to Main Deck

 Three Foam Tanks

 Four water fire main hose boxes and hydrants

 Three Foam Hose Stations

Environmental guidelines for helicopter landings are as follows:

 Proceed with caution

- Winds 15-26 m/sec (30-50 knots)

 Proceed only at the discretion of the Master / OIM and HLO

- Winds 26-31 m/sec (50-60 knots)

Issue 02 / Revision 00 Hard copies are not controlled Page 49 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 No landings permitted

- Winds over 31 m/sec (60 knots)

In situations exceeding these limits, helicopters should not be allowed to land except in
extreme emergencies, and only then if they are within the helideck’s weight limit
3.4.9 Lifting Equipment and Material Handling

The lifting equipment and material handling systems on the Rig perform routine lifting
activities and include equipment such as:

 Tubular handling equipment (see subsection 3.3.1 Hoisting and Tubular Handling)

 Cranes

 Winches

 Other material handling equipment

Lifting procedures, safety and ergonomic equipment, as well as inspection, testing, and
maintenance requirements are established for all lifting equipment by the Transocean
Lifting Operations Handbook HQS-HSE-HB-01.

Cranes

The purpose, or performance objective, of the Deck Crane Safety Systems (i.e. the Safe
Load Indication System, the Boom and Hoist Limit System and the Emergency Stop) is
to prevent damage to the rig, or subsea assets, from dropped loads.

There are a number of functional requirements which the Deck Crane Safety System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Deck Crane Safety System Performance Standard [1].

The Rig is fitted with four NOV Knuckle Boom Main Cranes, located:

 Port Forward

 Port Aft

 Starboard Forward

 Starboard Aft

The crane specification is as follows:

 Type NOV 3932

 ABS / FEM Rules and Regulations

 Drive Motor

 Each crane fitted with two ABB-M2 CA315 LC 4/V3, 485 kW electric motors

 Main Boom 90.5 ft.

Issue 02 / Revision 00 Hard copies are not controlled Page 50 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Knuckle 6.3 ft.

Each crane is equipped with a weight and radius indicator and is also provided with
legible information noting the maximum rated loads at the maximum radii for the various
boom lengths, extensions and counterweight configurations.

Generally, crane operations are not be undertaken when wind speeds exceed 26 m/sec
(50 knots) or during extremes of roll and/or pitch.

Each crane is equipped with a weight and radius indicator and is also provided with
legible information noting the maximum rated loads at the maximum radii for the various
boom lengths, extensions and counterweight configurations.

Generally, crane operations are not be undertaken when wind speeds exceed 26 m/sec
(50 knots) or during extremes of roll and/or pitch.

The main power supply to the crane is two-times 3 x 440 V, 60 Hz for the two motors
plus auxiliary equipment 3 x 440 V, 60 Hz. The feeding cables from the vessel are
connected to the slip ring in the crane pedestal via a connection box. The motor starter
for each main motor is located inside the pedestal. The start method is soft. The start /
stop and emergency stop switches for the motors are located inside the operator cabin.
The main motors are equipped with anti-condensation heating elements, which
automatically switch on when the motors are not in service. The main motors are
provided with thermistor protection.

If a defined overload occurs, the crane control system takes appropriate action relevant
to the hydraulic AOPS control valve and instrument panel. The mechanical brake will be
released and the winch maintains a retaining force not less than the corresponding SWL.
An activated system overruns the lower hook stop. A continuously illuminated red lamp
“AOPS” visually indicates the activated system, together with an external acoustic signal
that will sound as long as AOPS is activated.

The cranes lifting capacity depending on working radius, working height, selection of
falls, will be shown on the load indicator in the operator display. The load is continuously
measured and shown on the operator display.

Pipe and Riser Handling Systems

The purpose of the HydraRacker is the building and transportation of vertical stands of
drill pipe, collars, casing, and Bottom Hole Assemblies, between the Finger Board, and
the Catwalk.

The Main and Auxiliary systems are identical.

The main HydraRacker is normally operated from the Assistant Driller’s Cyberbase
operator station in the Main Driller’s Cabin. The remote operation of the finger board is
from the same station.

Refer to NOV Doc. Nos. T8815-Z-SA-001, T8816-Z-SA-001, T8815-Z-DS-001, T8816-Z-


DS-001

In addition, the Rig is equipped with the following:

Issue 02 / Revision 00 Hard copies are not controlled Page 51 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 BOP Gantry Crane (NOV, Type T8866) which is capable of lifting the entire BOP.
The crane can be operated remotely from the Main Deck.

 Bridge Crane Auxiliary Hoists – two at 35 mt, SWL each.

 BOP Transporter (NOV) – 420 mt.

 BOP Bulkhead Gripper – capable of restraining BOP stack, equal to BOP


Transporter maximum rating. NOV BOP, Type BH-400/ F, 420 mt.

 Guidebase Transporter – NOV 420 mt, hydraulically operated and with a Zone 2
operating entitlement.

Winches and Other Material Handling Equipment

The following winches are present onboard:

NOV Manrider Winch (type HL-MR-150-110M) is designed for safe and reliable
personnel handling operations on fixed or floating drilling platforms/vessels in a heavy
duty and critical offshore working environment. The winch is designed to meet the latest
NPD and EU rules for machine directive requirements for such equipment and it is type
approved by DNV/ABS.

There are three manrider winches installed on Drill Floor and three manrider winches
installed in the Moon Pool area. These are high level specification 5 ton winches (NOV
WINCH-5T-150M, rated to 5,000 kg, 160 meters of wire).

All of the winches come with the following standard safety features: automatic spooling
device, drum guards, pressure rollers, counterweights, grooved drum, remote and local
controls, emergency stop (remotely and locally), emergency lowering system, hook
stops, and return to neutral type controls.

The primary braking system on the all of the above mentioned utility winches is a
hydraulically operated failsafe brake that is automatically applied when the operating
lever or controls are returned to neutral or there loss of hydraulic power.
3.4.10 Storing and Handling of Explosives / Flammable and other Hazardous
Substances

The following hazardous materials are provided with dedicated storage areas, are
segregated and have appropriate degrees of protection against fire or other hazards.

 Radioactive Materials

 Explosives

 Helicopter Fuel

 Compressed Gases

 Paint and Thinners

 Toxic Chemicals

Issue 02 / Revision 00 Hard copies are not controlled Page 52 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The Master / OIM is tasked with ensuring that the stowage and handling of dangerous
and radioactive material is in accordance with all applicable international codes, rules
and regulations. All dangerous materials are clearly identified and marked as to the
nature of the hazard they represent.

Personnel handling dangerous material must wear appropriate protective clothing and/or
devices to ensure their safety at all times.

Radioactive Material

Radioactive materials are stowed in spaces designated for that purpose and in no other
areas. Radioactive materials are kept well away from the Accommodation and normally
manned spaces. The designated space for storing radioactive materials is on the aft,
port side of the pipe deck and is posted with warning signs.

The use of radioactive sources is strictly controlled under the permit to work system, with
only designated responsible personnel being allowed to handle the sources. These
personnel wear exposure monitoring devices at all times when sources are in use.

Explosives

Explosives are stowed in spaces designated only for that purpose and entrances to
these spaces are kept locked at all times. Designated storage for explosives is on the
aft, starboard side of the production riser deck and is posted with warning signs.

Helicopter Fuel

The helicopter fuel system is decommissioned and not operational.

Compressed Gases

Oxygen and acetylene bottles are caged and have dedicated but separate storage areas
on the port aft Main Deck.

The use and storage of gas bottles is strictly controlled. Only trained personnel may use
oxygen and acetylene equipment. All hoses and equipment are maintained in good
condition and every effort is made to minimize damage during use. A daily inventory of
full and empty bottles is kept.

Paint and Thinners

Paint and highly flammable substances are stored in CO2 protected Paint Lockers
located on the aft area of the Main Deck. Painting materials and inventories are
controlled. This space is kept clean and tidy at all times in order to prevent any
accumulation of combustible materials.

Toxic Chemicals

Toxic chemicals used as additives when mixing drilling mud are transported to the vessel
by supply boats in containers in accordance with relevant regulatory requirements.
Furthermore, each individual package is marked with the appropriate warning sign. Data
sheets for each chemical are provided by the supplier and kept on file in the shore-based

Issue 02 / Revision 00 Hard copies are not controlled Page 53 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

warehouse and on board the vessel. All chemical substances which, when mixed, may
produce a chemical reaction are kept separated.

Containers with acid contents are only opened in well-ventilated spaces, with a suitable
and safe means of extracting acid from the container available. All chemical containers
are kept sealed when not in use.

Mud chemicals are stored in the Sack Room and an inventory of sack chemicals is
maintained.

3.5 Fire and Explosion Protection


3.5.1 Hazardous Area Classifications

Areas with potentially explosive atmospheres are zoned in accordance with IEC 60079 -
Explosive Atmospheres, Part 10-1: Classification of Areas, with zones specified as
follows:

 Zone 1 – An area in which an explosive gas is likely to occur in normal operation


occasionally

 Zone 2 – An area in which an explosive gas atmosphere is not likely to occur in


normal operation but, if it does occur, will persist for a short period only

The Rig has Zone 1 and Zone 2 hazardous areas in various locations of the rig.

Hazardous area arrangements have been approved by the Classification Society.

Ex Equipment

The purpose, or performance objective, of Ex Equipment is to operate in an explosive


atmosphere without acting as a source of ignition.

There are a number of functional requirements which Ex Equipment must meet in order
to fulfil this purpose. These functional requirements are documented fully in the Ex
Equipment Performance Standard [1].

Ex Equipment is equipment designed for service in designated hazardous areas, and is


the only equipment permitted in those areas. A list of all Ex Equipment can be found in
the Rig’s Hazardous Areas Equipment Register (HAER). This register can be found in
RMS and the applicable equipment is labeled “HAER”. Maintenance on Ex Equipment is
conducted in accordance with its rating.

Ex Equipment has different inspection and maintenance requirements, depending on


which of the following protection classifications it has:

 D: Flameproof

 E: Increased safety

 I: Intrinsically safe

 N: Non-sparking

Issue 02 / Revision 00 Hard copies are not controlled Page 54 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 O: Immersed in oil

 P: Pressurized

 Q: Powder filled

 S: Special protection

As an example, EEX’i’ equipment is intrinsically safe equipment that must be configured


in such a way as to prevent sparks or hot surfaces from igniting an explosive
atmosphere. This equipment must be securely earthed where required and regularly
inspected for compliance.

As another example, EEX’p’ equipment has a pressurized, or purged, enclosure and is


designed so that an explosive atmosphere cannot reach a potential ignition source inside
the enclosure. Purge and purge time indicators must be in good operation, must induce
an alarm, and must automatically shut off the equipment, in a Zone 1 area, whenever
there is a fault.
3.5.2 Fire & Gas Detection Systems

Fire and gas (F&G) detection systems provide notice to facility personnel that a fire or
gas event exists onboard the Rig. The following F&G detectors are fitted throughout the
Rig:

 Fire
- Flame detectors;
- Multi-sensor detectors (smoke and heat);
- Heat detector;
- Smoke detector; and
- Manual call points.

 Hydrocarbon (HC) gas

 Hydrogen sulfide (H2S) gas

The F&G system onboard the Rig is interfaced with other systems and can be controlled
and monitored via operator stations. .

Fire Detection System

The purpose, or performance objective, of the Fire Detection System is to detect the
presence of heat, smoke or flame in designated areas, and to provide immediate
indication of the location of the fire detected.

There are a number of functional requirements which the Fire Detection System must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Fire Detection System Performance Standard [1].

The Fire (and Gas) Detection System fitted on the Rig is a Minerva Marine system.

Issue 02 / Revision 00 Hard copies are not controlled Page 55 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Detection thresholds for fires are on a voting system when heat is detected.

When no voting is provided or in case of manual call point activation, the operator at the
Bridge determines the actual status, based on information from personnel or other inputs
from the area, and takes the appropriate actions.

The following types of detectors are provided to address various potential flammable
scenarios:

 Flame detectors

 Multi-sensor detectors (smoke and heat)

 Heat detectors

 Smoke detectors

 Manual call points

The fire (and gas) alarm control panels are located in the Engine Control Room, with an
operator control station in the Wheelhouse.

Hydrocarbon (HC) Gas Detection System

The purpose, or performance objective, of the HC Gas Detection System is to detect the
presence of hydrocarbon gas, and provide immediate indication of the location and
concentration of the gas detected.

There are a number of functional requirements which the HC Gas Detection System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the HC Gas Detection System Performance Standard [1].

The (Fire and) Gas Detection System fitted on the Rig is a Minerva Marine system.

A confirmed explosive gas atmosphere is indicated by the following:

 Voting (2ooN): one detector at 60% LEL (Lower Explosive Limit) and any other
(within the same space) at 25% LEL; and

 No voting: 60% LEL from one detector.

All gas detectors alarm at 25% LEL and 60% LEL independently of the above voting.

The (fire and) gas alarm control panels are located in the Engine Control Room, with an
operator control station in the Wheelhouse.

Hydrogen Sulfide (H2S) Gas Detection System

The purpose, or performance objective, of the H2S Gas Detection System is to detect the
presence of H2S gas and provide immediate indication of the location and concentration
of the gas detected.

There are a number of functional requirements which the H2S Gas Detection System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the H2S Gas Detection System Performance Standard [1].

Issue 02 / Revision 00 Hard copies are not controlled Page 56 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The (Fire and) Gas Detection System fitted on the Rig is a Minerva Marine system.

H2S gas detectors alarm at 10 ppm concentration in hazardous areas.

H2S gas detection will follow these principles:

 Gas detected 5 ppm: the system closes the associated fire dampers and stops the
ventilation. An alarm (visual only) is sounded. The PA system is automatically
activated. The Accommodation air intake dampers close immediately.

 Gas detected 10 ppm: the actions are the same as above and an alarm (visual and
audible) is sounded. The PA is automatically activated.

The (fire and) gas alarm control panels are located in the Engine Control Room, with an
operator control station in the Wheelhouse.
3.5.3 Emergency Shut Down Systems

The purpose, or performance objective, of the Emergency Shutdown System is to enable


the controlled shutdown of specified equipment and ventilation Systems in an emergency
situation.

There are a number of functional requirements which the Emergency Shutdown System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Emergency Shutdown System Performance Standard [1].

The ESD System has been designed with 6 main ESD levels, specified as:

 ESD Level 0: Catastrophic shutdown

 ESD Level 1: Emergency power shutdown

 ESD Level 2: Main power shutdown (for starboard, center, and port regions)

 ESD Level 3: Mud module shutdown

 ESD Level 4: Drilling shutdown

 Local ESD: Local emergency stop shutdown

ESD Level 0 isolates all batteries. After initiation, the only remaining equipment
operating is the emergency escape lighting, obstruction lights, and GMDSS radio
equipment. Lower levels of shutdown will be activated as well.

ESD Level 1 shuts down the emergency power generation and distribution facilities.
After initiation, the UPS and batteries remain operational to provide energy for the
essential communication systems necessary for safe evacuation of the unit. Lower
levels of shutdown will be activated as well.

ESD Level 2 shuts down generators where confirmed gas has been detected and
electrically isolates the main power distribution. After initiation, the ESD system will
communicate with the F&G system to control the ventilation of the associated room.
Quick closing valves in the fuel system are also closed.

Issue 02 / Revision 00 Hard copies are not controlled Page 57 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

ESD Level 3 and 4 electrically isolates the HV/LV drilling switchboards, the welding
sockets, non-essential telecoms equipment, non-ex equipment in the DCR, and normal
lighting.

Two UPS systems are provided for both the Fire and Gas Detection System and ESD
System. The UPS and battery is provided with 60 minutes battery back-up time for its
operational load.
3.5.4 Active Fire Protection

Active fire protection is installed to suppress fires throughout the Rig. The active fire
protection devices installed onboard consist of:

 Fire main system (including firewater pumps, fire ring, and isolation valves)

 Fire hydrants and hoses

 Deluge systems

 Helideck foam system

 Other firefighting systems:

- CO2 system

- Water mist system

- Portable firefighting appliances

Fire Main System

The purpose, or performance objective, of the Fire Main System is to supply water to
extinguish a fire.

There are a number of functional requirements which the Fire Main System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Fire Main System Performance Standard [1].

The fire ring main is divided into the forward and aft sections of the vessel.

The following pumps are permanently connected to the fire ring main:

Forward

 Forward Fire Pump – capacity 750 m3/hr. by 130 m head, located in the forward
Auxiliary Machinery Room. The pump is fitted with a remote / manual start, and local
pressure gauge.

 Two Fire Jockey Pumps – each having a capacity of 50 m3/r hr. by 90 m head.
These are fitted with remote and auto start / stop facilities and local pressure gauges.
The lead pump discharges to a hydrophore tank, and is arranged to start at 8.5
kg/cm2 tank pressure, and stop at 9 kg/cm2 tank pressure. The lag pump starts at 8.0
kg/cm2 tank pressure, and stops at 9 kg/cm2. The tank is fitted with local level and
pressure gauges.

Issue 02 / Revision 00 Hard copies are not controlled Page 58 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Aft

 Port Engine Room Fire Pump – capacity 750 m3/hr. by 130 m head – located in the
Port Engine Room

 Starboard Engine Room Fire Pump – capacity 750 m3/hr. by 130 m head – located in
the Starboard Engine Room

The pumps are fitted with remote / local, start / stop switches, and local pressure
gauges.

The pumps discharge into a 300 mm diameter pipe, which is connected to the fire ring
main, located on the upper deck. Branch lines, 65 mm diameter, distribute water to main
Engine Room consumers, and forward Auxiliary Machinery Room consumers

Fire Hydrants and Hoses

The Main Engine Room fire pumps discharge water, via a 65 mm branch pipe to
hydrants in the Engine Room.

Each hydrant is provided with steel hose reels, which house ND 60 fire hoses, 15 m in
length. The fire hoses are fitted with adjustable nozzles, giving jet, and fog spray type
facilities from a 19 mm diameter orifice.

Reference to Drawing “Piping Diagram of Hull Part” – MB 601.50 (1/ 2, 2/ 2), for the
description of the Weather Deck Fire Hydrants.

The Weather Deck fire hydrants are located on the foam (fire) main systems, which
consists of a 300 mm diameter pipe, located at port and starboard sides of the
Installation. Port and starboard sides can be cross-connected by valves located either in
the aft foam room or the forward Emergency Headquarter Compartment.

Each fire hydrant is connected to the ring main by a 50 mm diameter branch pipe, and is
fitted with a fire hose box, fabricated from GRP (Glass Reinforced Plastic). There are 50
fire hose boxes onboard, with fire hoses having a length of 15 m, and an adjustable hose
nozzle.

Fire hydrants and hose boxes are arranged every 30 m on the Upper Deck, port and
starboard. Additionally, fire hydrants with hose boxes are provided on the after deck port
and starboard, outside the Muster Area, Forecastle Deck, Bosun’s Store, and several
equipment compartments.

The Accommodation is also fitted with fire hydrants and fire hose boxes. Three hydrants
are installed on each deck level in the Accommodation: two hydrants on the weather side
of the bulkhead, and one 25 mm hydrant inside, as required.

Each hydrant fitted in the weather area is fitted with a Fiber Reinforced Plastic hose box
which contains a 50 mm fire hose, 20 m long, fitted with an adjustable nozzle.

The fire ring main in the Accommodation area, also feeds the Helideck Firefighting
system, via a 150 mm diameter feed line. Additionally, two International Shore
Connections are located adjacent to the Accommodation.

Issue 02 / Revision 00 Hard copies are not controlled Page 59 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Deluge Systems

The purpose, or performance objective, of the Drill Floor Deluge System is to provide a
means of reducing the likelihood of ignition of escaping hydrocarbons, or to assist with
the cooling, controlling or extinguishing of a fire.

There are a number of functional requirements which the Drill Floor Deluge System must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Drill Floor Deluge System Performance Standard [1].

The sea water deluge system is provided to protect the spaces as follows:

 Aft deck – stern area

 Port and Starboard Lifeboat Stations

 Radar Scanner on aft Starboard Deck

 Engine Room casing Bulkheads

The sea water for the deluge system is supplied from the Port and Starboard Ballast /
Bilge and General Service Pumps located in the engine room, each has a capacity of
500 / 240 m3/hr.

Helideck Firefighting System

The purpose, or performance objective, of the Helideck Firefighting System is to prevent


or suppress a Helicopter fire by delivering sufficient quantities of foam, and to rescue
personnel from the Helicopter.

There are a number of functional requirements which the Helideck Firefighting System
must meet in order to fulfil this purpose. These functional requirements are documented
fully in the Helideck Firefighting System Performance Standard [1].

A foam firefighting system with a capacity of 2,500 l/min and operating pressure 130 –
185 psi is provided on the helideck. In addition, four 12 kg dry powder extinguishers,
three 5 kg CO2 extinguishers, two 9 kg CO2 extinguishers, and two portable foam
applicators are available.

A helicopter rescue tool box is located on the top deck in the vicinity of the helideck
access. The rescue box includes the following items:

 One adjustable wrench

 One large aircraft type fire axe

 One bolt cutters with arm length of 24 inches or more

 One large crowbar

 One grab or salving hook

 One heavy duty hacksaw with six spare blades

 One fire resistant blanket

Issue 02 / Revision 00 Hard copies are not controlled Page 60 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 One lightweight ladder approximately 3 m in height

 One life line (5 cm circumference x 30 m in length) and rescue harness

 One stainless steel knife for cutting seat belts

 One side cutting pliers

 One set of assorted screwdrivers

 Two harness knives and sheaths

 Two pairs of fire resistant gloves

 One power cutting tool

 Two portable safety lamps (explosion proof)

 Two sets of SCBA

Foam System

The Rig is provided with two independent foam systems, situated in the Aft Foam Room,
and the forward Emergency Headquarters. Each system comprises: a steel foam tank,
with GRP coating internally; two foam liquid pumps; two foam proportioners; and the
individual supply lines to the protected area.

Foam tanks each have a capacity of 3.0 m3, and are capable of supplying foam to the
largest protected area for a period of 20 minutes.

3% AFFF foam is provided to the foam system and is of the type, Fluoro Synthetic
Aqueous Film Forming Foam (AFFF).

Fixed foam Fire Extinguishing System for:

 Stern Starboard Cargo Manifold

 Burner Boom Foam Deluge Nozzle

 Port and Starboard Cargo Tank Decks

 Stern Upper Deck

 Topsides

Seawater pressure on the foam system is maintained by the action of the jockey pumps,
and the hydrophore tank connected to the Fire Ring Main.

The above refers to the aft Foam Station, however the secondary / forward foam station
is identical with the exception that it also supplies foam to the Accommodation.

Also, the Rig is fitted with a foam deluge system, which is provided to protect slop and
cargo tank deck areas. The foam deluge system consists of a number of fixed nozzles,
located on a 65 mm diameter branch line, and two foam supply valves: one hydraulically
operated remote valve; and one manual isolating valve.

Issue 02 / Revision 00 Hard copies are not controlled Page 61 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

A total of 105 nozzles are provided to protect an area of 1612 m 2. The nozzle capacity is
38 liters/min. at 8 bar.

Foam at Monitors

After starting the foam pumps, the foam will be available at the foam monitors by
opening the isolating valve for the monitors.

Each self-oscillating Firewater Foam Monitor is provided with a 4 inch electrically


operated butterfly valve, 2.5 inch inductor, foam tank (500 liters), and local push button.

The monitor has the design flow rate of 1,500 liters/ minute, at 7 bar.

Foam at Helideck

The Helideck is fitted with an independent, low expansion foam firefighting system, and
the water for the system is supplied from the Fire Ring Main.

The system comprises:

 Three self-oscillating Firewater Foam Monitors

 Three foam / water Hydrant Cabinets

 Remote Operations Panel

 Spray Nozzles

 Foam Tanks – (capacity – 20 liters, each)

Spray nozzles are arranged on the Heli-fuel tank unit, and the system is controlled
manually, via an isolation valve. The water for the spray nozzles is supplied through the
Fire Main.

Fire Extinguisher Systems – Carbon dioxide (CO2) / Water Mist

The Rig is fitted with a fixed CO2 smothering system supplied from 45 kg CO2 cylinders
located in the CO2 Room on the aft Upper Deck.

Twenty separate compartments are protected, by this central flooding system, and each
compartment is covered by a designated number of cylinders.

Compartments covered:

 Engine Room – port and starboard

 Purifier Rooms – port and starboard

 Switchgear Rooms – port and starboard

 Boiler and Incinerator Rooms – port and starboard

 Engine Control Room

 Stern, Centre and Bow Thruster Rooms – forward and aft

Issue 02 / Revision 00 Hard copies are not controlled Page 62 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Cargo Pump Room

 Forward Auxiliary Machinery Room

 Switchgear Room – Topside

 Cement Room

The Emergency Generator Room is fitted with an independent CO2 system, which
utilizes six cylinders. The release control mechanism and CO2 Room are adjacent to this
compartment.

The Paint Store has its own dedicated CO2 smothering system comprising one CO2
cylinder. The system is built-in to the Compartment Bulkhead and is not exposed to the
elements.

In addition, the Rig is fitted with a X-MIST water mist firefighting system. The system
comprises an electrically driven, vertical, centrifugal, multi-stage, inline KSB MOVITECH
VF-18-6 pump, with a capacity of 22m3/hr. by 95 m. by 11 kW. The pump draws water
from No. 2 Distilled Water Tank.

The system can be operated in either Automatic or Manual mode.

The system covers the following Compartments:

 Port and Starboard Main Engines

 Auxiliary Boilers and Incinerators

Portable Firefighting Appliances

The purpose, or performance objective, of the Portable Fire Fighting Appliances is to


extinguish a minor fire.

There are a number of functional requirements which the Portable Fire Fighting
Appliances must meet in order to fulfil this purpose. These functional requirements are
documented fully in the Portable Fire Fighting Appliances Performance Standard [1].

There are portable and semi-portable fire extinguishers placed throughout the Rig. The
type (dry powder, foam, and carbon dioxide), and capacity, of each extinguisher depends
on the nature of fire that would reasonably be expected to occur, in that area, or space.
3.5.5 Passive Fire Protection

Fire Boundaries

The purpose, or performance objective, of the Fire Boundaries is to prevent a fire from
spreading from one area to another.

There are a number of functional requirements which the Fire Boundaries must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Fire Boundaries Performance Standard [1].

Designated fire protection specifications are divided into class divisions. A-Class and B-
Class are the most commonly used guidance for structural integrity. A time interval is

Issue 02 / Revision 00 Hard copies are not controlled Page 63 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

included with the fire rating to specify the length in which the structural integrity is
maintained.

Structural fire protection is provided in the following locations:

A60 Compartments:

 Aft External Bulkheads – Accommodation

 Battery Locker

 Boiler Room Bulkheads

 CO2 Room

 DP back-up Room

 Emergency Generator Room

 Engine Control Bulkheads

 Engine Room Bulkheads

 Engine Room Emergency Exits’ Bulkheads

 Foam Room

 Helicopter Reception Room

 Navigation Instrument Room

 Safety Equipment Room

 Emergency Headquarters Room (partly)

All other compartments and fire boundaries are rated as A Class Fire Retarding
Bulkheads / Decks / Deckheads at all levels.

Internal Accommodation bulkheads are B Class Fire Retarding.

Reference is made to Drawing No. PBS-A005-01 Rev 2-04 Jan 2012, showing location
and rating of fire resistant bulkheads, decks and deckheads.
3.5.6 Temporary Refuge (TR)

The purpose, or performance objective, of the Temporary Refuge is to provide protection


for; sufficient time to muster, for the emergency to be assessed, and for decisions to be
taken and implemented.

There are a number of functional requirements which the Temporary Refuge must meet
in order to fulfil this purpose. These functional requirements are documented fully in the
Temporary Refuge Performance Standard [1].

A minimum survival time of 30 minutes has been assessed for the Temporary Refuge,
and is based on the Escape, Evacuation and Rescue Assessment (EERA).

Issue 02 / Revision 00 Hard copies are not controlled Page 64 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The Accommodation serves as a Temporary Refuge and provides sufficient protection to


enable personnel to muster safely, assess the context of the emergency, and allow
decisions to be taken on the appropriate emergency action.

Internal Bulkheads, fire boundaries, stairways and alleyways, leading to the muster area,
the Lifeboat Stations and the Helideck, are protected by structural fire protection,
ventilation dampers’ shut-offs, both manual and automatic, and fire doors to prevent the
egress of smoke and fire, spreading through the Installation’s Accommodation.

Muster Areas

The Rig’s Station Bill [3] identifies Muster Areas: located at the forward and aft areas of
the vessel – both port and starboard.

3.6 Evacuation and Escape Systems


Evacuation and Escape Systems refer to the method used by personnel to leave the Rig
in an emergency situation.

 Evacuation is where, during an incident, personnel can make their way to their
muster station and then evacuate under the guidance of the Person in Charge (PIC).

 Escape is where (for the personnel in question) personnel are unable to reach their
muster stations, and subsequently abandon the Rig under their own initiative (e.g. by
escape ladder or directly entering the sea)

Evacuation Systems

The Rig has the following means of evacuation, listed in preferred order:

 Moving the Rig off location – If at all possible, the Rig will make a controlled move off
the drilling location with personnel onboard using its propulsion system. This may
negate a requirement to take further action to evacuate personnel.

 Helicopter – The primary means of evacuation in the event that evacuation is


necessary and it is possible to get onshore support. Helicopter evacuation may take
time depending on the distance to shore. The Rig helideck must be operational at
the time of evacuation. In the event of a major fire or explosion, loss of stability, or
other rapidly progressing event, helicopter evacuation would be unlikely. See section
3.4.8 Helideck Facilities for further details.

 Lifeboats – The secondary means of evacuation in the event that helicopter


evacuation is not possible.

Escape Systems

 Liferafts – Liferafts are the primary means of escape.

 Secondary Escape – Secondary escape (abandonment) facilities are provided in


case both primary and secondary means of evacuation and the primary means of
escape are not available. These facilities include any infrastructure and equipment in
place for making a controlled descent into the sea (e.g. escape ladders and
lifejackets).

Issue 02 / Revision 00 Hard copies are not controlled Page 65 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

All evacuation and escape equipment is posted in the Rig’s Fire Control and Safety Plan
[4].

Escape Routes

The escape routes were designed in compliance with relevant regulations such as the
International Maritime Organization (IMO) MODU Code, SOLAS, and the Class rule.

Escape routes have been determined for all normally manned spaces and are indicated
on the Rig’s Lifesaving Plan. All main equipment spaces are provided with at least two
means of escape, both leading to the external main escape routes, and are clearly
defined by photo-luminescent signs and arrows indicating the direction to the lifeboat
stations and muster areas. Provisions have been made on major escape routes for
carrying stretchers and firefighting equipment.

For escape/evacuation drawings, reference is made to Drawing No. PBS-A0006-01-Rev


1, 09 June 2011.

Lifeboat System

The purpose, or performance objective, of the Lifeboat System is to provide a means of


evacuation.

There are a number of functional requirements which the Lifeboat System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Lifeboat System Performance Standard [1].

The lifeboats are Totally Enclosed Motor Propelled Survival Craft (TEMPSC) of
reinforced fiber glass construction. Each lifeboat is fitted with a spraying system for
protection against fire and an internal compressed air system for protection against
smoke ingress.

Eight davit-launched lifeboats are installed: two each on the port and starboard sides
forward; and two each on the port and starboard sides aft. They are 53-man capacity,
Schat / Harding, KISS 800, fully enclosed, motor lifeboats, fitted with a spraying system
and internal systems for firefighting and smoke protection. Provisions and lifesaving
equipment are stored inside the lifeboats in accordance with regulatory body
requirements.

Other equipment fitted in the Lifeboats is in accordance with the provisions of SOLAS
1974(and 1992 amendments), Certifying and other Authorities regulations.

The system will remain operational up to a list of 15 degrees to port or starboard, or a


Trim of 15 degrees by the head or stern.

Liferaft System

The purpose, or performance objective, of the Liferaft System is to provide a means of


escape from the rig, in the event that evacuation is not possible.

There are a number of functional requirements which the Liferaft System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Liferaft System Performance Standard [1].

Issue 02 / Revision 00 Hard copies are not controlled Page 66 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The rig is equipped with 16 Viking 25-man liferafts.

Escape Ladders

The purpose, or performance objective, of the Escape Ladders to Sea is to provide


personnel with a means of controlled descent to the sea in the event that evacuation is
not possible.

There are a number of functional requirements which the Escape Ladders to Sea must
meet in order to fulfil this purpose. These functional requirements are documented fully
in the Escape Ladders to Sea Performance Standard [1].

When escape via TEMPSC or helicopter is unavailable, the next means of evacuation is
by launching of the liferafts and exiting via escape ladders. There are two escape
ladders located at the port and starboard forward lifeboat muster station on B Deck.

Standby Vessel

The purpose, or performance objective, of the Standby Vessel is to recover or rescue


personnel from the sea, and to monitor shipping for potential collisions.

There are a number of functional requirements which the Standby Vessel must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Standby Vessel Performance Standard [1].

The Standby Vessel is provided by the Operator / Customer.

Rescue

Rescue is the external assistance provided to personnel that allows them to reach a
place of safety in an emergency. A place of safety will be an onshore or safe offshore
location, e.g. another rig or installation, where medical treatment and other facilities are
available.

Rescue from the Rig is covered in relevant site-specific bridging documentation prior to
the commencement of any drilling campaign. The Rig is provided with the following
equipment which is supplied for the purpose of rescuing personnel who may accidentally
enter the water:

 Lifebuoys with self-illuminating lights located at strategic points around the decks

 Escape ladders at strategic points around the Rig

 Lifeboats used for rescue, if required

 Standby vessel

Designated persons are trained to operate the rescue boat such that there will always be
a full rescue crew available on shift.

3.7 Accommodation
The maximum Personnel on Board (POB), is 200.

Issue 02 / Revision 00 Hard copies are not controlled Page 67 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The Accommodation is located at the forward end of the Installation and comprises nine
levels from Upper (Main) Deck to the Wheelhouse Deck.

At the Upper Deck level the Accommodation comprises:

 Two man Cabins

 Chillers, freezers, Dry Stores, Garbage Store

“A” Deck:

 Recreation Room – No Smoking

 Recreation Room – fitted as “Cardio Fitness Suite”

 Galley and Mess Room

 Laundry

 Gym

 Sauna

“B” Deck:

 Two and four man Cabins

 Changing Room – male

 Coffee Shop

 Changing Room – female

“C” Deck:

 Two and four man Cabins

 Library

“D” Deck:

 Two and four man Cabins

“E” Deck:

 Two man Cabins

 Conference Room

“F” Deck:

 Offices

 Company Man Cabin

 DP Back-up

 Navigation Instruments

Issue 02 / Revision 00 Hard copies are not controlled Page 68 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Hospital

 Conference Room

Navigation / Wheelhouse Deck:

 Wheelhouse

The present configuration gives provision for four, two and single berth cabins.

A fully equipped Hospital is located on “F” Deck. The Hospital is outfitted as per the
Transocean Medical Protocol, and complies with International Regulations for Medical
Facilities for MODUs.

There is also a fully qualified Medic on board, and who is “on-call” on a full time basis

Safety Equipment in Accommodation

370 lifejackets are located in storage boxes inside the Accommodation and at the Muster
Stations.

Fireman’s outfits and portable fire extinguishers (foam, dry powder and water) are
stowed in the Accommodation in compliance with the Rules and Regulations.

Potable Water for Accommodation

The details of the freshwater storage tanks are as shown in Table 3.8.
Table 3.8 Potable Water Storage

Compartment Capacity Location


3
No.1 FW Tank – Potable – Port 514.5 m FR 122-133

No.1 FW Tank – Potable – 3


546.3 m FR 122-133
Starboard

No. 2 FW tank – Distilled - 3


359.2 m FR 2-13
Starboard

Freshwater is generated on board the Installation by two Exhaust Heat Generators, one
located in each Engine Room with a capacity 65 ton/day). In addition, freshwater may
be loaded from Supply Vessels, or when secured alongside in port.

Freshwater generated by the Freshwater Generators, is fed to No. 2 Freshwater Tank in


the Starboard Engine Room. It is then transferred to the forward Freshwater Tanks, in
the forward Auxiliary Machinery Room, by the port and starboard freshwater transfer
pumps. Each has a capacity of 10 m3/hr.

The Freshwater Hydrophore, located in the Starboard Engine Room, draws freshwater
from the common suction header that runs across the Engine Room. The Hydrophore
Unit consists of a pressurized Freshwater Hydrophore tank (capacity 0.5 m3), and two
freshwater pumps each having a capacity of 2 m3/hr.

Issue 02 / Revision 00 Hard copies are not controlled Page 69 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

The system generates an alarm and opens a product dump valve in case of high salinity,
and levels and alarms are integrated with the IAS.

The potable water system is dived into two systems, forward and aft, with the capability
to transfer water through a de-hardener unit.

The aft system is fed from the Fresh Water Generators and has its own tank with a
single hydrophore arrangement.

The forward system is fed from aft, and has two tanks that supply a single hydrophore
arrangement

Potable water is filtered and UV sterilized, before being considered fit for consumption.

There is a 65 m3/day waste heat evaporator in each Engine Room that receives heat
from the Main Engines’ high temperature system. Under normal operational scenarios
the system is heated by steam.

The on board Medic monitors and tests water quality on a daily basis.

3.8 Well Testing


The purpose, or performance objective, of the Well Test System is to maintain well
integrity during well testing.

There are a number of functional requirements which the Well Test System must meet in
order to fulfil this purpose. These functional requirements are documented fully in the
Well Test System Performance Standard [1].

The Rig has specific areas allocated on board to enable Well Testing Operations to be
undertaken. These are located on the aft end of the Drill Floor.

A flare boom is fitted on the port quarter of the vessel.

The Rig has a dedicated burner boom cooling system.

3.9 Diving Support


Diving support, if required, is provided by a third party contractor and will be utilized if
diving is needed.

3.10 Other Third Party Equipment


The Master / OIM or designee is required to approve the placement, installation and
operation of any third party equipment. Transocean personnel must inspect the
equipment and complete the “Approval to Install and Operate Customer and
Subcontractor Equipment” form, prior to installation. Any unsatisfactory items are
reported to the Master / OIM and to the third party representative.

The third party (subcontractor) maintains its equipment while it is onboard the installation
and monthly verifications are performed. Equipment installed for extended periods is
required to obtain a Transocean “Approval to Install and Operate Customer and

Issue 02 / Revision 00 Hard copies are not controlled Page 70 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

Subcontractor Equipment" that is renewed annually. Transocean management (shore-


based) must be informed of unsatisfactory third party equipment.

Third Party Equipment is inspected and documented within the Rig Management System
(RMS) to ensure compliance in all categories for code, safety and performance. Third
Party Equipment is also included in the RMS to verify that maintenance procedures are
carried out by the relevant owners.

3.11 References
[1] Transocean Performance Standards

[2] Petrobras 10000 Marine Operation Manual

[3] Petrobras 10000 Station Bill

[4] Petrobras 10000 Fire Control and Safety Plan

3.12 Attachments
Copies of drawings and schematics, as per IADC Guidance, are available onboard
and/or upon request.

General Arrangements

 Outboard Profile

 Main Deck Plan View

 General Arrangement Tween Deck Spaces

 General Arrangement of Accommodation

Stability

 Allowable VCG curves

Ballast & Bilge Arrangements

 Ballast Piping Schematic

 Bilge System

Drilling & Well Control

 Mud Process Schematic

 Choke and Kill Isometric

 Design Basis of the Relief System

 Description of the well control systems

Power Generation & Distribution

 Main Power Single Line Diagram with Switchboard layout

Issue 02 / Revision 00 Hard copies are not controlled Page 71 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 3: Rig Description and Supporting Information

 Emergency Power Single Line

 Description of alarm, shutdown and interlock systems

Fire & Explosion

 Electrical Area (Hazardous Area) Classifications

 Design basis for active and passive fire and explosion protective arrangements

 Bulkhead Classification

 Temporary Refuge

 Fire Control Plan

 Fire Main Schematic

Evacuation & Escape

 Design basis for emergency evacuation procedures

 Emergency Plan (Station Bill / Muster List)

 Escape Routes

 Lifesaving Equipment Plan

Issue 02 / Revision 00 Hard copies are not controlled Page 72 of 72


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

CONTENTS

4 Risk Management ............................................................................................................... 2


4.0 Introduction.................................................................................................................. 2
4.0.1 Integrating HSE Management into Operations ......................................................... 4
4.0.2 Inter-relation of Hazards and Operations ................................................................. 4
4.1 Risk Management Process Overview .......................................................................... 5
4.1.1 Relationships of Risk Management Terms – ISO ..................................................... 5
4.1.2 Risk Management Process – ISO 17776 ................................................................. 5
4.1.3 Structured Hazard Identification and Control (SHIDAC) Process ............................. 6
4.2 Structured Hazard Identification and Control (SHIDAC) Process ................................. 7
4.2.1 SHIDAC Step 1 – Identify Hazards .......................................................................... 7
4.2.2 SHIDAC Step 2 – Evaluate Risk ............................................................................ 10
4.2.3 SHIDAC Step 3 – Identify Risk Reduction Measures and Set Functional /
Performance Requirements ............................................................................................... 12
4.3 Identification of Hazards and Risk Sources ................................................................ 13
4.3.1 Acute and Chronic Hazards ................................................................................... 17
4.3.2 Environmental Aspects and Occupational Health Hazards .................................... 17
4.3.3 Hazard and Source Identification Techniques ........................................................ 20
4.4 Risk Estimation .......................................................................................................... 20
4.4.1 Risk Assessment Matrix (RAM) ............................................................................. 20
4.4.2 Screening Criteria .................................................................................................. 22
4.5 Risk Evaluation .......................................................................................................... 43
4.5.1 Tolerability of Risk ................................................................................................. 43
4.5.2 Screening Criteria and Significance ....................................................................... 45
4.5.3 Inter-relation of Major Hazards and Events (e.g. Domino principle)........................ 46
4.6 Risk Treatment .......................................................................................................... 49
4.6.1 Risk Hierarchy ....................................................................................................... 54
4.6.2 Risk Optimization Strategies .................................................................................. 55
4.6.3 Summary of Operation Boundaries (SOOB) – Combined Operations .................... 55
4.7 Risk Acceptance ........................................................................................................ 56
4.8 Risk Communication .................................................................................................. 56
4.8.1 Transocean Scope of Operations .......................................................................... 56
4.8.2 Workforce Communication to Drilling Contractor Senior Management ................... 57
4.8.3 Monitoring and Verification .................................................................................... 57
4.8.4 Feedback to the Drilling Contractor Management System ..................................... 57
4.9 References ................................................................................................................ 57
4.10 Attachments .............................................................................................................. 58

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

4 RISK MANAGEMENT

4.0 Introduction
This Section describes the major hazard identification, screening and validation process
used within Transocean. In addition, this Section provides a comprehensive list of the
major hazards with the potential to affect Transocean’s operations. The major hazards
that have been identified for the Petrobras 10000 (herein called ‘the Rig’) are described
in this Section.

To provide assurance that Transocean is managing HSE risks effectively, Safety Case
Part 2 – HSE Management System, Part 3 – Rig Description and Supporting Information,
Part 5 – Emergency Response, and Part 6 – Performance Monitoring are all applied in
conjunction with the structured risk management process described in this part of the
Safety Case.
Figure 4-1 Interrelationship of Safety Case Parts

Transocean addresses the identification of both major and other workplace hazards
through a variety of tools and procedures, for example: Hazard Identification (HAZID);
Hazard Analysis and Operability (HAZOP) studies; Major Accident Hazard Risk
Assessment (MAHRA); Control of Work Planning; and the application of risk assessment
related processes such as; Task Planning and Risk Assessment, START Conversations,
Management of Change (MoC) and Time out for Safety (TOFS). Although the focus of
the Safety Case is the management of major hazards, other workplace hazards,
including occupational / personal safety, are considered in this Section.

The hazard identification process followed by Transocean is aligned with the steps
outlined in ISO 17776:2000 (Petroleum and natural gas industries – Offshore production
installations – Guidelines on tools and techniques for hazard identification and risk
assessment). An overview of the hazard identification process in relation to the
Transocean risk management process is shown in Figure 4-2.

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Figure 4-2 Transocean Risk Management Process

The Safety Case is a rig specific document which documents:

 the major hazards which affect operations on the Rig;

 how these major hazards have been assessed;

 the major hazard barriers which are in place on the rig;

 who is responsible for operating and/or maintaining these barriers; and

 any recommendations to improve how these barriers are managed

Definitions

Throughout the Safety Case the following terms and definitions apply:

 Safety Critical – Something which could cause or contribute substantially to a Major


Accident in the event of failure; or a system whose purpose is to prevent release of a
Major Hazard or mitigate a Major Accident

 Major Accident – an event which can cause multiple (5 or more) serious injuries or
fatalities, major damage to the rig or environment, or loss of the rig

 Hazard – something with the potential to cause harm

 Major Hazard – a hazard with the potential to cause a major accident when released

 Major Accident Hazard Risk Assessment – a qualitative process of assessing the


probability of a major hazard being released and causing a major accident

 Major Hazard Barrier - a physical, procedural or human barrier which is intended to


prevent the release of a Major Hazard or mitigate a Major Accident
- People Barrier – People who effectively perform Safety and Environmentally
Critical Activities and/or take Safety Critical Actions

Issue 02 / Revision 00 Hard copies are not controlled Page 3 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

- Plant Barrier – A physical barrier which blocks or controls a Major Hazard. (e.g.
Safety Critical Systems or Environmentally Critical Systems
- Process Barrier – Execution of effective procedures, standards and requirements

 Intact Barrier – a barrier which performs as designed or as intended

 Defense in Depth – Having multiple independent, tested, assured and verified


barriers/controls in place and intact.

 Performance Standard – A description of the purpose and functional requirements of


a Safety Critical System, including necessary checks, measurements and assurance
activities to confirm that it satisfies those functional requirements.
4.0.1 Integrating HSE Management into Operations

Within Transocean, Operational Integrity is defined as:

“The management of major hazards whereby consistent operational discipline and asset
integrity is assured, verified and continually improved.”

The Safety Case demonstrates how we maintain Operational Integrity on Transocean


rigs by describing:

 how the major hazards which affect operations on the Rig are managed

 the procedures for maintaining consistent operational discipline, and for assuring and
verifying barrier integrity
4.0.2 Inter-relation of Hazards and Operations

Transocean addresses the identification, assessment and management of major hazards


through a variety of tools and procedures, including:

 Hazard Identification (HAZID) / Hazard Register

 Major Accident Hazard Risk Assessment (MAHRA) and ALARP assessment (As Low
As Reasonably Practicable)

 Compartment Risk Assessments

 Control of Work Planning, and the application of risk assessment related processes,
such as; assurance activities, Task Planning and Risk Assessment, START
Conversations, Management of Change (MoC) and Time out for Safety (TOFS)

Identifying and documenting the relationship between operations and their associated
hazards provides the basis for the evaluation and management of risks. Several
mechanisms are used to relate operations to their associated hazards and risks.

The Hazard Register provides an overview of all hazards and operations, along with the
key barriers/controls to manage them. The Hazard Register is developed from various
workplace and formal safety assessment hazard and risk analyses, and industry
guidance. HSE Management System arrangements on board the Rig ensure that
hazards and risks associated with operations, tasks and activities are assessed

Issue 02 / Revision 00 Hard copies are not controlled Page 4 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

continually. Where new hazards and risks or changes to existing barriers/controls are
identified, the Hazard Register is updated to reflect these changes.

Major Accident Hazards (MAH) are analysed through the Major Accident Hazard Risk
Assessment (MAHRA) (bow-tie analysis) process. Bow-ties show the relationship
between the causes and consequences of major accident events, and the specific
barriers/controls in place to manage associated risk.

Bow-tie analysis forms the basis for the listing of safety critical systems, procedures and
activities/operations.

For each HSE critical equipment, procedures and activities, parties are assigned with
associated responsibilities collated for each rig position.

4.1 Risk Management Process Overview


4.1.1 Relationships of Risk Management Terms – ISO

The relationship of key risk management terms adapted from the ISO / IEC Guide 73
Risk Management – Vocabulary is shown in figure 4-3 below.
Figure 4-3 Relationship of Risk Management Terms in ISO / IEC Guide 73

Risk Management
1. Risk Assessment
a. Risk Analysis
Source (Hazard) Identification
Risk Estimation
b. Risk Evaluation
2. Risk Treatment
a. Risk Avoidance
b. Risk Optimization
c. Risk Transfer
d. Risk Retention
3. Risk Acceptance
4. Risk Communication

The Transocean risk management process incorporates the elements defined in Figure
4-2 and Figure 4-3 as part of its structured hazard identification and control process.
4.1.2 Risk Management Process – ISO 17776

The Company considers internal and external business aspects when applying a risk
management process. These specific business aspects take into account differences in
geographical location, the suitability of the rig for the operating environment, the
Customer’s third parties, the regulatory environment and the available supplier or sub-
contractor onshore/offshore support infrastructure.

Effective application of a risk management process requires sound judgments and


appropriate decisions to be made, such as: identifying appropriate screening criteria;
defining effective and achievable risk management barriers/controls; and determining

Issue 02 / Revision 00 Hard copies are not controlled Page 5 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

when risk levels are tolerable. The ISO 17776 based Risk Management Process utilized
by Transocean is presented in Figure 4-4.
4.1.3 Structured Hazard Identification and Control (SHIDAC) Process

The Structured Hazard Identification and Control (SHIDAC) process is based on the ISO
17776 Risk Management Process (Figure 4-4) with additional sub-steps included to
provide a more appropriate description of the practical requirements for each of the three
key risk management steps:

1. Identify hazards

2. Evaluate risk

3. Identify risk reduction measures (preventative and mitigating) and set functional
(performance) requirements
The SHIDAC process is an iterative process, potentially requiring multiple passes of
each step to effectively complete the risk management process related to specific
hazards.
Transocean uses a range of hazard identification and assessment processes to identify
hazards. These processes are tailored to the two main groups of hazards: major
accident hazards (MAHs) and workplace/occupational hazards.

Workplace/occupational hazards are managed by a number of processes and


procedures described within the Company’s Health and Safety Policies and
Requirements [5]. The processes and tools used by Transocean with respect to major
accident hazards are described as follows:

A Hazard Identification Study (HAZID) is a structured and systematic process to


identify and document hazards associated with an operation or facility in order to identify
potential hazards to people, asset and / or the environment. HAZIDs are performed by
breaking down an operation or facility into activities or areas and systematically
reviewing each to identify hazards and associated accident events. A HAZID is a
qualitative technique carried out by a multi-disciplinary team during a set of meetings.

Major Accident Hazard Risk Assessment (MAHRA) (Bow-tie Analysis) is a


structured method to assess risk where a quantitative approach may not be possible or
desirable. The success of the resulting bowtie diagram is that it is simple and easy for
the non-specialist to understand. The Bow-tie combines threats and consequences.
Threats are illustrated on the left hand side and consequences are illustrated on the right
hand side with the hazard and associated accident events illustrated in the middle.
Preventative and mitigating barriers/controls are defined for specific threats and
consequences. The Bow-tie methodology is an effective way of demonstrating that risks
are reduced to a level which is As Low As Reasonably Practicable (ALARP) without the
over reliance on quantitative risk assessments. Bow-tie analysis is a qualitative
technique carried out by a multi-disciplinary team during a set of meetings.

Issue 02 / Revision 00 Hard copies are not controlled Page 6 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Figure 4-4 ISO 17776 Risk Management Process

4.2 Structured Hazard Identification and Control (SHIDAC)


Process
4.2.1 SHIDAC Step 1 – Identify Hazards

The Company hazard identification (HAZID) process involved an assessment of the list
of hazards and effects presented in ISO 17776 to determine the major hazards that have
the potential to affect Transocean’s global operations.

The identification process was based on Transocean’s experience of operating a diverse


group of drilling rigs (including jackups, conventionally moored semi-submersibles and
dynamically positioned (DP) semi-submersibles and drill ships), globally, over an

Issue 02 / Revision 00 Hard copies are not controlled Page 7 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

extensive period of time. In addition, standard industry practice for offshore drilling and
production installations was applied in terms of identifying, risk assessing, and screening
hazards.

The output from this process (refer to Attachment 4-1 Hazard Register and the Global
HAZID Report [6]) is a globally applicable set of major hazards that affect Transocean
operations. Such an approach provides for a common and consistent means of
managing the identified hazards and for preventing or mitigating the associated risks.

The HAZID process followed the steps outlined below.

Initial Hazard Screening

Appendix D of ISO 17776:2000 [1] was reviewed to identify and provide an initial
screening of the hazards that are applicable, and have the potential, to affect
Transocean operations.

Determination of Credible Major Accident Scenarios

With reference to the hazards identified in the initial hazard screening a review of
Appendix C Table C.2 from ISO 17776:2000 [1] was conducted. The output was the
determination of credible major accident scenarios (i.e. operations, activities, or
situations) where control of the hazard could be lost.

Major Hazard Screening

Transocean’s HAZID Risk Matrix (Figure 4-5) was used to identify the major hazards that
affect Transocean operations and to screen out other (non-major) workplace hazards.
Screening was based on the initial risk with no preventative or mitigating barriers in
place.
Figure 4-5 HAZID Risk Matrix

Likelihood
A B C D E
Negligible Improbable Remote Possible Probable

0 No Effect

1 Minor
Consequence

2 Significant

3 Serious

4 Major

5 Catastrophic

Other Hazard Major Hazard

In order to evaluate whether a hazard is a major hazard, the following criteria was
applied to determine the likelihood and potential consequence of an event occurring.

Issue 02 / Revision 00 Hard copies are not controlled Page 8 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Likelihood

A Negligible Not credible, e.g. never heard of incident occurring in industry.

B Improbable Conceivable, but would require multiple failures of systems and controls.

Less than average, easy to imagine a scenario for incident but considered
C Remote
unlikely.

D Possible More than average, represents a credible scenario.

E Probable Likely to occur.

Consequence

People Asset Environment

0 No Effect No harm to personnel No damage to the rig Contained on board

Does not affect the


Less than 10 barrels (2
1 Minor Injuries unlikely integrity of any part of
tonnes) to sea
the rig

May affect safety critical


Some minor injuries 10-50 barrels (2–10
2 Significant systems, limited
possible tonnes) to sea
structural damage

May affect several


safety critical systems
Some major injuries 50-100 barrels (10-20
3 Serious with extensive but non-
possible tonnes) to sea
critical structural
damage

Only a few safety critical


systems survive,
extensive structural 100-1000 barrels (20-
4 Major Single fatality
damage places the 200 tonnes) to sea
integrity of the rig in
serious doubt

Possibly no safety
critical systems remain,
Greater than 1000
Multiple fatalities structural damage such
5 Catastrophic barrels (200 tonnes) to
(5 or more) that integrity of rig lost,
sea
with potential for
immediate collapse

Hazard Register

Various working sessions were held to develop a Hazard Register. A workshop took
place on April 25, 2016 via telepresence between Transocean Operations and HSE
personnel in Houston, Macaé and Rio de Janeiro to review the Register and to validate

Issue 02 / Revision 00 Hard copies are not controlled Page 9 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

its applicability to the Rig. All occupational health, safety and environmental risks
identified via various means are included in the Hazard Register, which was screened to
highlight the major accident hazards. The Hazard Register is included as Attachment 4-
1.

Major Hazard Validation

A peer review of the output from the Major Hazard Screening was conducted to validate
the identified major hazards against the knowledge and experience of personnel and
verification with historical incident data. The validation was recorded in the Global
HAZID Report [6] which summarizes the major accident hazards with the potential to
affect Transocean’s operations.
4.2.2 SHIDAC Step 2 – Evaluate Risk

Major Accident Hazard Risk Assessment

A Major Accident Hazard Risk Assessment (MAHRA) is undertaken in order to validate


the identified major hazards and to complete an assessment of the associated risks.
Transocean’s chosen method of MAHRA is Bowtie Barrier Analysis which is a widely
used qualitative risk assessment technique.

The aim of the MAHRA is to:

 Ensure the Major Hazards, Threats, Consequences and (Major Hazard) Barriers
identified in the Bowtie(s) are appropriate.

 Review the preventative and mitigating barriers in order to validate effectiveness and
responsibilities.

 Identify any gaps that may be present i.e. missing Threats or Barriers.

 Risk assess each Major Hazard utilizing the Transocean MAHRA Risk Matrix.

 Conduct an ALARP assessment.

The MAHRA is carried out by a multi-disciplinary team familiar with the design, operation
and structure of the rig. It is led by an experienced facilitator who is familiar with the
MAHRA process and the Transocean MAHRA Bowties.

Decisions reached during the MAHRA are based on team consensus and therefore
represent the collective knowledge, experience and judgment of the team.

A full set of rig-specific Bowtie diagrams for the Rig is provided in Attachment 4-2.

Figure 4-6 illustrates the different components of a Bowtie diagram.

Issue 02 / Revision 00 Hard copies are not controlled Page 10 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Figure 4-6 Components of a Bowtie Diagram

The following terms apply:

 Major Hazard: a hazard with the potential to cause a major accident if released.

 Top Event: the initial consequence that occurs immediately after the major hazard is
released (i.e. control of the hazard is lost).

 Threat: the cause of the Top Event i.e. the means by which the major hazard could
be released.

 Consequence: the potential ultimate consequence resulting from the release of the
major hazard.

 Barrier: there are two types of barriers that are identified in the Bowtie diagram, i.e.
preventative and mitigating. The preventative barriers are designed to prevent a
Threat from becoming a Top Event. The mitigating barriers are designed to stop the
escalation of the Top Event.

 Barrier Escalation Factor: these are certain conditions which could cause a barrier to
fail i.e. a condition that leads to increased risk by defeating or reducing the
effectiveness of a barrier. An example of an escalation factor is a fire detection
system failing to alarm.

 Barriers to the left of the Top Event represent the preventive controls which are
designed to stop the Threats (blue boxes) from becoming a Top Event. When in
place and intact these preventative barriers reduce the likelihood of a Top Event
occurring.

Issue 02 / Revision 00 Hard copies are not controlled Page 11 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

 Barriers shown to the right of the Top Event are designed to detect, control or
mitigate the loss of control. These mitigating barriers are designed to prevent the
Top Event from escalating into the ultimate consequence (red boxes). When in place
and intact these mitigating barriers reduce the severity of losing control of a major
hazard.

 Both preventive and mitigating barriers can have escalation factors, which are threats
that can erode or defeat a barrier. These barrier escalation factors are illustrated
with yellow boxes. Some controls act as barriers against these escalation factors
and are placed between the barrier escalation factor and the barrier it can defeat.

 Transocean categorizes the preventative and mitigating barriers into three types:

 People Barriers – i.e. people who effectively perform safety critical activities and/or
take safety critical actions

 Plant Barriers – i.e. physical barriers which block or controls a Major Hazard s

 Process Barriers – i.e. execution of effective procedures, standards and


requirements

However, it is recognized that each barrier typically includes a mix of People, Plant and
Process elements which are interdependent. The selected combination of these ensures
that the barrier is suitable, sufficient and available to deliver its expected risk reduction
measures.

The output from the MAHRA is a report which includes a set of Bowties which have been
verified as applicable to a specific rig and which include a rig-specific risk assessment of
the major (accident) hazards. The Rig MAHRA Report [2] is summarized in section 4.4.2
Screening Criteria for the Rig.
4.2.3 SHIDAC Step 3 – Identify Risk Reduction Measures and Set Functional /
Performance Requirements

Following from identification of hazards and evaluation of risks, preventative and


mitigating barriers/controls are identified along with key functional requirements.
Functional requirements are driven by:

 Legislation and regulations

 Industry accepted codes and standards

 Company policy and practice

 Hazard and risk assessment

Part 2 - HSE Management System and Part 3 – Rig Description and Supporting
Information provide general details relating to industry accepted codes and standards,
and company policy and practices that form the basis for the risk management
arrangements (equipment, procedures and associated activities) including functional
requirements.

Issue 02 / Revision 00 Hard copies are not controlled Page 12 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

For major hazards, section 4.6 Risk Treatment, section 4.7 Risk Acceptance, and section
4.8 Risk Communication provide specific details on risk management.

4.3 Identification of Hazards and Risk Sources


The following Major Hazards with the potential to affect Transocean operations were
identified:

1. Reservoir Hydrocarbons

a. Shallow gas

b. Hydrocarbons in formation during well operations

c. Hydrocarbons in formation during coil tubing or wireline operations

d. Hydrocarbons in subsea assets and pipelines

e. Hydrocarbons during well testing

f. Gas cut mud

2. Flammable / combustible materials

3. Explosives

4. Suspended loads

5. Station-keeping (DP and Semi only)

6. Helicopter

7. Hydrogen sulfide (H2S)

8. Vessel stability (DP and Semi only)

9. Watertight integrity

10. Rig moving

11. Attended Platform / Fire/explosion on platform (Jack-up only)

12. Structural integrity / Structural failure (Jack-up only)

Table 4-1 lists the Major Hazards and also documents the initial consequence of losing
control and the scenarios (i.e. operations, activities, or situations) where control could be
lost i.e. the threats which could lead to a loss of control.

Issue 02 / Revision 00 Hard copies are not controlled Page 13 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Table 4-1 Overview of Major Hazards

Major Hazard / Sub Initial Consequence of 1


Ref. Scenarios
Category Losing Control

1 Reservoir Hydrocarbons

1a. Shallow gas Shallow gas release Failure to identify and


communicate the presence
of shallow gas

Rig positioned incorrectly

1b. Hydrocarbons in Uncontrolled release of Influx of reservoir fluids


formation during well hydrocarbons without riser / Blowout
operations Preventer in place

Influx of reservoir fluids with


conductor / Blowout
Preventer in place

1c. Hydrocarbons in Uncontrolled release of Influx of reservoir fluids


formation during coil hydrocarbons
Failure of Coiled Tubing
tubing or wireline
System
operations

Failure of Wireline System

1d. Hydrocarbons in subsea Uncontrolled release of Dropped loads


assets and pipelines hydrocarbons
Anchor impact on subsea
asset / pipeline (Jackup
only)

Spud can contact with


subsea asset / pipeline
(Jackup only)

Loads dropped through the


Moon Pool (Semi- and DP)

Physical impact on subsea


asset / pipeline (Semi- and
DP)

1e. Hydrocarbons during well Uncontrolled release of Well Test System failure
testing hydrocarbons
Flare extinguishes

1f. Gas cut mud Ignited explosive High gas levels


atmosphere
Ignition sources

2 Flammable / combustible Fire Engine fuel leaks

Issue 02 / Revision 00 Hard copies are not controlled Page 14 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Major Hazard / Sub Initial Consequence of 1


Ref. Scenarios
Category Losing Control
materials Improper storage of
flammable / combustible
materials

Galley

Laundry

Electrical equipment

Hot Work

3 Explosives Unplanned detonation Mishandling, incorrect


storage or use
2
4 Suspended loads Dropped load Heavy loads

Derrick hoisting
3
5 Station-keeping (DP and Loss of position Extreme weather conditions
Semi only)

Drive off (DP only)

Drift off (DP only)

6 Helicopter Helicopter crash Debris on heli-deck

Obstructions around
helideck and approach

Pilot error

Helicopter equipment failure

Extreme weather conditions

Bird strike

7 Hydrogen sulfide (H2S) Toxic atmosphere Presence of H2S during well


operations

Presence of H2S during well


testing

8 Vessel stability (DP and Loss of stability Unplanned weight changes


6
Semi only) / distribution / compartment
flooding

Vessel impact

Extreme weather conditions


4
9 Watertight integrity Loss of watertight integrity Deck loading (while afloat)
(Jackup only)

Issue 02 / Revision 00 Hard copies are not controlled Page 15 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Major Hazard / Sub Initial Consequence of 1


Ref. Scenarios
Category Losing Control

Deck and bulk loading


(Semi- and DP only)

Extreme weather conditions

Vessel impact

Corrosion
5&6
10 Rig moving Loss of control during rig Loss of power of towing
moving vessel (Jackup and Semi-
only)

Loss of tow (wire or


equipment failure) (Jackup
and Semi- only)

Mismanagement of tow
(Jackup and Semi- only)

Loss of propulsion (DP only)

Vessel impact (DP only)

Extreme weather conditions

11 Attended Platform (Jack- Fire / explosion on platform Failure of systems or


6
up only) procedures on platform

Rig / towing vessel makes


contact with platform during
close maneuvers

Damage to platform from


dropped objects

12 Structural integrity (Jack- Structural failure Overloading of deck


6
up only)
Leg system failure

Punch through / foundation


failure

Vessel impact

Extreme weather conditions


1
Human Error is an applicable scenario for all Major Hazards.
2
This major hazard is actually gravity. However, in order to best communicate this major hazard the
familiar term 'Suspended Loads' is used
3
This major hazard is actually weather conditions and sea state. However, in order to best communicate
the major hazard the familiar term 'Station Keeping' is used
4
This major hazard is actually the sea and internal sea water systems. However, in order to best
communicate the major hazard the familiar term 'Watertight Integrity' is used

Issue 02 / Revision 00 Hard copies are not controlled Page 16 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

5
This major hazard is actually weather conditions and sea state. However, in order to best communicate
the major hazard the familiar term 'Rig Moving' is used
6
The familiar term ‘marine operations’ is used to collectively describe vessel stability, rig moving,
attended platform and structural integrity

4.3.1 Acute and Chronic Hazards

Personnel working onboard the Rig are exposed to two distinct types of hazards defined
by their exposure/consequence:

 Acute hazards - Those with the potential to cause impairment or fatalities as a result
of more or less instantaneous events or incidents. MAHs are acute hazards. Other
workplace hazards can also be acute hazards.

 Chronic hazards - Those with the potential to cause harm arising from non-
instantaneous exposures such as repeated emissions or discharges, continuous
emissions or discharges and occupational exposures. Other workplace hazards are
chronic hazards.

Non-major acute and chronic hazards are managed through implementation of effective
occupational health and safety management system arrangements, as described in Part
2 of the Safety Case. Both acute and chronic hazards are identified in the Hazard
Register (See Attachment 4-1).
4.3.2 Environmental Aspects and Occupational Health Hazards

Other Workplace Hazards include all hazards not classified as MAHs, such as
occupational hazards. Environmental hazards were assessed from both the major
hazards analyzed in the MAHRA and other workplace hazards analyzed separately. The
events related to other workplace hazards are not included in the MAHRA but are
instead risk ranked and added to the Hazard Register (See Attachment 4-1).

Workplace Hazards

Management of workplace and occupational hazards is done through several tools and
procedures used for safety in the workplace, detailed in the Company’s Health and
Safety Policies and Requirements [5]. Examples of safety tools and procedures used
include:

 Control of Work Planning

 Task Planning and Risk Assessment

 START Conversations

 Management of Change (MOC)

 Time out for Safety (TOFS)

 FOCUS

 Permit to Work (PTW)

 General Safe Work Practices

Issue 02 / Revision 00 Hard copies are not controlled Page 17 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

 Personal Protective Equipment (PPE)

 Energy Isolation

 Confined Space Entry

 Hot Work

 Lifting Equipment and Operations

 Restricted Access Areas

 Work Platforms Electrical Safety

 DROPS

 Fall Protection

 HSE orientation, information, meetings, and recognition

Several of these tools and procedures are described in more detail in Part 2 of this
Safety Case.

Periodic HSE audits are scheduled for all onshore and offshore facilities. Team member
composition, duration and other details are included in Part 6 – Performance Monitoring.

Environmental Hazards

Procedures and activities to manage environmental hazards and risks are detailed in the
Company’s Health and Safety Policies and Requirements [5][5] (Safety Management
System) and Environmental Policies and Requirements [4] (Environmental Management
System (EMS)) and the Shipboard Oil Pollution Emergency Plan (SOPEP) described in
Part 2 of the Safety Case.

Collectively the Companies HSE Management System documents the management


system in place to ensure that the company operates without accidents, damages, or
loss related to the environment. It also reflects the importance of local sensitivities,
regulations and client requirements.

The purpose of the SOPEP is to provide guidance to the Master / OIM and other
personnel onboard the rig with respect to the steps to be taken when a pollution incident
has occurred or is likely to occur.

The Company’s EMS is a documented, comprehensive set of policies and requirements


used to identify, control, record, and improve any potential impacts to the environment.
The EMS includes:

 HSE policy statement

 Objectives and targets

 Monitoring and measuring of environmental performance

 Implementation of operational controls

Issue 02 / Revision 00 Hard copies are not controlled Page 18 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

 Management review

The Transocean EMS follows the ISO 14001 framework and uses a cycle of continual
improvement to control and prevent environmental hazards and reduce the risk of
impacting the environment. As a starting basis, a register of environmental legislation
and other requirements is established. This first register is used to identify and build a
second register of environmental aspects and impacts. The identified environmental
aspects and impacts are continually updated from the EMS cycle, as shown in Figure 4-
7.

The management of environmental hazards is further described in Part 2 section 2.3.6 of


this Safety Case.
Figure 4-7 Transocean Environmental Management System Cycle

Issue 02 / Revision 00 Hard copies are not controlled Page 19 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Health Hazards

The management of occupational health hazards and risks is detailed in the Health and
Safety Policies and Requirements [5]. Examples of procedures related to occupational
health include:

 Medical Care And Documentation

 Pathogens

 Sanitation, Hygiene, And Smoking Limitations

 Respiratory Protection

 Noise

 Potable Water

 Asbestos Containing Material

 Manual Handling Operations

 Hand Arm Vibration

Further details on these policies and procedures are provided in Part 2 section 2.3.7
Occupational Health in this Safety Case.
4.3.3 Hazard and Source Identification Techniques

Various hazard and source identification techniques as detailed in section 4.3 are used
by the Rig and in support of this Safety Case.

All hazards identified are documented in the Hazard Register described in section 4.2.2
and included in Attachment 4-1 of this part of the Safety Case.

4.4 Risk Estimation


4.4.1 Risk Assessment Matrix (RAM)

A Risk Assessment Matrix is used to qualitatively assess the associated risk of each
hazard. A residual risk assessment is conducted assuming that the identified
preventative and mitigating barriers are in place and intact.

Using the Risk Assessment Matrix (Figure 4-8), potential consequences that could cause
harm to People, Environment and Assets are assessed. For each potential
consequence there is a determination of the likelihood of occurrence and the ultimate
consequence of an occurrence.

The Risk Assessment Matrix and the MAHRA Risk Matrix use the same definitions of
Likelihood and Consequence as the HAZID Matrix.

Issue 02 / Revision 00 Hard copies are not controlled Page 20 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Figure 4-8 MAHRA Risk Matrix

Likelihood
A B C D E
Negligible Improbable Remote Possible Probable
0 No Effect

1 Minor
Consequence

2 Significant

3 Serious

4 Major

5 Catastrophic

1
Broadly Acceptable Tolerable if ALARP Intolerable

1
As Low As Reasonably Practicable (ALARP) means that measures have been or will be taken to control
risk to a level whereby the resources (e.g. costs, effort or time) associated with further measures would
be considered grossly disproportionate to the risk reduction achieved.

Likelihood

A Negligible Not credible, e.g. the team has never heard of incident occurring in industry.

B Improbable Conceivable, but would require multiple failures of systems and controls.

Less than average, easy to imagine a scenario for incident but considered
C Remote
unlikely.

D Possible More than average, represents a credible scenario.

E Probable Likely to occur.

Consequence

People Asset Environment

0 No Effect No harm to personnel No damage to the rig Contained on board

Does not affect the


Less than 10 barrels (2
1 Minor Injuries unlikely integrity of any part of
tonnes) to sea
the rig

May affect safety critical


Some minor injuries 10-50 barrels (2–10
2 Significant systems, limited
possible tonnes) to sea
structural damage

Issue 02 / Revision 00 Hard copies are not controlled Page 21 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

People Asset Environment

May affect several


safety critical systems
Some major injuries 50-100 barrels (10-20
3 Serious with extensive but non-
possible tonnes) to sea
critical structural
damage

Only a few safety critical


systems survive,
extensive structural 100-1000 barrels (20-
4 Major Single fatality
damage places the 200 tonnes) to sea
integrity of the rig in
serious doubt

Possibly no safety
critical systems remain,
Greater than 1000
Multiple fatalities structural damage such
5 Catastrophic barrels (200 tonnes) to
(5 or more) that integrity of rig lost,
sea
with potential for
immediate collapse

The MAHRA Risk Matrix allow for three possible results:

 Broadly Acceptable – managed for continual improvement.

 Tolerable if ALARP – a level of risk which requires further review to determine if the
risk is ALARP. If the risk is not considered ALARP a recommendation is required
e.g. further preventative or mitigating barrier(s).

 Intolerable – requires a recommendation to address the risk further. The


recommendation may be for further investigation for which the workshop attendees
may not have had the time, resources, expertise etc.
4.4.2 Screening Criteria

Screening Criteria are defined as values, targets or performance standards used to


evaluate or compare the significance of an identified hazard, event or associated risk to
determine the tolerability. They may be defined either in quantitative or qualitative terms.

Qualitative Screening

For qualitative screening, the primary tool used is the Risk Assessment Matrix (RAM)
described in section 4.4.1 Risk Assessment Matrix (RAM). The two primary studies used
for qualitative screening are the Hazard Register and the MAHRA. Following these
studies, further qualitative screening was done in the ALARP workshop, detailed in
section 4.5.2 Screening Criteria and Significance.

Hazard Register

The following methodology was used to identify the major hazards that have the potential
to affect Transocean operations.

Issue 02 / Revision 00 Hard copies are not controlled Page 22 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

 Hazard Identification and Review – A review of Appendix D of ISO 17776:2000 [1][1]


– Hazards Checklist (and complementary information) to identify hazards that could
potentially affect Transocean operations. Transocean Hazard Categories are
included in Table 4-2.

 Initial Hazard Screening – Appendix D of ISO 17776:2000 [1][1] was reviewed to


identify and provide an initial screening of the hazards that are applicable, and have
the potential, to affect Transocean operations.

 Determination of Credible Major Accident Scenarios - With reference to the hazards


identified in the initial hazard screening a review of Appendix C Table C.2 from ISO
17776:2000 [1] was conducted. The output was the determination of credible major
accident scenarios (i.e. operations, activities, or situations) where control of the
hazard could be lost.
Table 4-2 Transocean Hazard Categories

Hazard # Hazard Description

01 Hydrocarbons

01.01 Oil under pressure

01.02 Hydrocarbons in formation

01.03 LPGs (e.g. Propane)

01.04 LNGs

01.05 Condensate, NGL

01.06 Hydrocarbon gas

01.07 Oil at low pressures

01.08 Wax

01.09 Coal

02 Refined hydrocarbons

02.01 Lube and seal oil

02.02 Hydraulic oil

02.03 Diesel fuel

02.04 Petroleum spirit/gasoline

03 Other flammable materials

03.01 Cellulosic materials

03.02 Pyrophoric materials

03.03 Electric Materials

04 Explosives

04.01 Detonators

Issue 02 / Revision 00 Hard copies are not controlled Page 23 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

04.02 Conventional explosive material

04.03 Perforating gun charges

04.04 Firearms and weapons

05 Pressure hazards

05.01 Bottled gases under pressure

05.02 Fluids under pressure in pipe works

05.03 Non-hydrocarbon gas under pressure in pipe works

05.04 Air under pressure

05.05 Hyperbaric operations (diving)

05.06 Decompression (diving)

05.07 Oil and hydrocarbon gas under pressure

06 Hazards associated with differences in height

06.01 Personnel at height >2 m

06.02 Personnel at height <2 m

06.03 Overhead equipment

06.04 Personnel under water

07 Objects under induced stress

07.01 Objects under tension

07.02 Objects under compression

08 Dynamic situation hazards

08.01 On-water transport (boating)

08.02 In-air transport (flying)

08.03 Boat collision hazard to other vessels and offshore structures

08.04 Equipment with moving or rotating parts

08.05 Use of hazardous hand tools

08.06 Use of knives, machetes and other sharp objects

08.07 Transfer from boat to offshore platform

09 Environmental hazards

09.01 Weather

09.02 Sea state

09.03 Tectonic

Issue 02 / Revision 00 Hard copies are not controlled Page 24 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

10 Hot surfaces

10.01 Process piping and equipment between 60 °C and 150 °C

10.02 Process piping and equipment over 150 °C

10.03 Engine and turbine exhaust systems

10.04 Steam piping

11 Hot liquid

11.01 Temperatures between 100 °C and 150 °C

11.02 Temperatures greater than 150 °C

12 Cold surfaces

12.01 Process piping between – 25 °C and – 80 °C

12.02 Process piping less than – 80 °C

13 Cold fluids

13.01 Oceans, seas and lakes less than 10 °C

13.02 Liquid Nitrogen

14 Open flame

14.01 Heaters with fire tube

14.02 Direct-fired furnaces

14.03 Flares

15 Electricity

15.01 Voltage > 50 V to 440 V in cables

15.02 Voltage > 50 V to 440 V in equipment

15.03 Voltage > 440 V

15.04 Lightning discharge

15.05 Electrostatic energy

16 Electromagnetic radiation

16.01 Ultraviolet radiation

16.02 Infrared radiation

16.03 Microwaves

16.04 Lasers

16.05 E/M radiation: high voltage AC cables

17 Ionizing radiation — Open source

Issue 02 / Revision 00 Hard copies are not controlled Page 25 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

17.01 Alpha, beta — Open source

17.02 Gamma rays — Open source

17.03 Neutron — Open source

17.04 Naturally occurring ionizing radiation

18 Ionizing radiation — Closed source

18.01 Alpha, beta — Closed source

18.02 Gamma rays — Closed source

18.03 Neutron — Closed source

19 Asphyxiates

19.01 Insufficient oxygen atmospheres

19.02 Excessive CO2

19.03 Drowning

19.04 Excessive N2

19.05 Halon

19.06 Smoke

20 Toxic gas

20.01 H2S (hydrogen sulfide, sour gas)

20.02 Exhaust fumes

20.03 SO2

20.04 Benzene

20.05 Chlorine

20.06 Welding fumes

20.07 Tobacco smoke

20.08 CFCs

21 Toxic fluid

21.01 Mercury

21.02 PCBs

21.03 Biocide (glutaraldehyde)

21.04 Methanol

21.05 Brines

21.06 Glycols

Issue 02 / Revision 00 Hard copies are not controlled Page 26 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

21.07 Degreasers (terpenes)

21.08 Isocyanates

21.09 Sulfonyl

21.10 Amines

21.11 Corrosion inhibitors

21.12 Scale inhibitors

21.13 Liquid mud additives

21.14 Odorant additives (mercaptans)

21.15 Alcohol-containing beverages

21.16 Non-prescribed drugs

21.17 Used engine oils

21.18 Carbon tetrachloride

21.19 Grey and/or black water

22 Toxic solid

22.01 Asbestos

22.02 Man-made mineral fiber

22.03 Cement dust

22.04 Sodium hypochlorite (Bleach)

22.05 Powdered mud additives

22.06 Sulfur dust

22.07 Pig trash

22.08 Oil-based muds

22.09 Pseudo-oil-based muds

22.10 Water-based muds

22.11 Cement slurries

22.12 Dusts

22.13 Cadmium compounds and other heavy metals

22.14 Oil-based sludge’s

23 Corrosive substances

23.01 Hydrofluoric acid

23.02 Hydrochloric acid

Issue 02 / Revision 00 Hard copies are not controlled Page 27 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

23.03 Sulfuric acid

23.04 Caustic soda (sodium hydroxide)

24 Biological hazards

24.01 Food-borne bacteria (e.g. E. coli)

24.02 Water-borne bacteria (e.g. Legionella)

24.03 Parasitic insects (pin worms, bed bugs, lice, fleas)

24.04 Cold and flu virus

24.05 Human Immune deficiency Virus (HIV)

24.06 Other communicable diseases

Disease transmitting insects (mosquitoes-malaria and yellow fever, ticks-lime


24.07
disease, fleas-plague)

25 Ergonomic hazards

25.01 Manual materials handling

25.02 Damaging noise > LC, peak of 140 dB(C)

25.03 Loud steady noise > LAeq,8h of 85 dB(A)

25.04 Heat stress (high ambient temperatures)

25.05 Cold stress (low ambient temperatures)

25.06 High humidity

25.07 Vibration

25.08 Workstations

25.09 Lighting

25.10 Incompatible controls

25.11 Awkward location of workplaces and machinery

25.12 Mismatch of work to physical abilities

25.13 Mismatch of work to cognitive abilities

25.14 Long and irregular working hours/shifts

25.15 Poor organization and job design

25.16 Work planning issues

25.17 Indoor climate (too hot/ cold/ dry/ humid, draughty)

26 Psychological hazards

26.01 Living on the job/away from family

26.02 Working and living on a live plant

Issue 02 / Revision 00 Hard copies are not controlled Page 28 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

26.03 Post-traumatic stress

26.04 Fatigue

26.05 Shift work

26.06 Peer pressure

27 Security-related hazards

27.01 Piracy

27.02 Assault

27.03 Sabotage

27.04 Crisis (military action, civil disturbances, terrorism)

27.05 Theft, pilferage

28 Use of natural resources

28.01 Water

28.02 Air

29 Medical

29.01 Medical unfitness

29.02 Motion sickness

30 Noise

30.01 High level noise

30.02 Intrusive noise

31 Entrapment

31.01 Fire / Explosion

31.02 Mechanical damage

31.03 Diving

Major Hazard Screening – Transocean’s HAZID Risk Matrix (Figure 4-5) was used to
identify the major hazards that affect Transocean operations and to screen out other
(non-major) workplace hazards. Screening is based on the initial risk with no
preventative or mitigating barriers in place.

Major Hazard Validation – A peer review of the output from the Major Hazard
Screening was conducted on April 25, 2016 via telepresence between Transocean
Operations and HSE personnel in Houston, Macaé and Rio de Janeiro to validate the
identified major hazards and risk ranking against the knowledge and experience of
personnel and verification with historical incident data. The HAZID Risk Matrix (Figure 4-

Issue 02 / Revision 00 Hard copies are not controlled Page 29 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

5) as described in section 4.2.2 above. The list of attendees to the Hazard Register
Verification workshop is presented Table 4-3.
Table 4-3 Hazard Register Verification Workshop Attendees

Name Position

Paul Johnson Operations Director - Americas


Bruno Manfredini Operations Manager - Brazil

Marcio Martins HSE Senior Supervisor - Brazil

Carolina Bartoli HSE Advisor - Brazil

Diogo Cardoso Rig Manager - Petrobras 10000

Ray Worth Rig Manager - 706

Diego Reixach Assistant Rig Manager - 706


Lucas Leal Assistant Rig Manager - PBS
Gabriel Gaertner Assistant Rig Manager - DRL
Sidarta Mocelin Operations Engineer - Brazil
Jason Wilson OI Manager - Americas
John Lewter OI Advisor - Americas

Hazard Register Results Summary

Table 4-4 includes the Hazard Categories identified with Major Hazards for various
scenarios with consequences to People, Assets and/or Environment. The entire Hazard
Register is included as Attachment 4-1 to this Part.

Table 4-4 Categories identified with Major Hazards

Hazard # Hazard Description

01 Hydrocarbons

01.01 Oil under pressure

01.02 Hydrocarbons in formation

01.06 Hydrocarbon gas

02 Refined hydrocarbons

02.01 Lube and seal oil

02.03 Diesel fuel

02.04 Petroleum spirit/gasoline

03 Other flammable materials

03.03 Electric Materials

Issue 02 / Revision 00 Hard copies are not controlled Page 30 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Hazard # Hazard Description

04 Explosives

04.02 Conventional explosive material

04.03 Perforating gun charges

06 Hazards associated with differences in height

06.03 Overhead equipment

08 Dynamic situation hazards

08.01 On-water transport (boating)

08.02 In-air transport (flying)

20 Toxic gas

20.01 H2S (hydrogen sulfide, sour gas)

22 Toxic solid

22.08 Oil-based muds

22.09 Pseudo-oil-based muds

22.10 Water-based muds

Major Accident Hazard Risk Assessment (MAHRA)

A MAHRA workshop was completed for the Rig in the Transocean Macaé offices on
October 13-14, 2016. The MAHRA was facilitated by an independent experienced risk
management consultancy, ERM. The MAHRA followed the methodology described in
4.2.2 SHIDAC Step 2 – Evaluate Risk of the Safety Case. The Rig MAHRA Report [2]
provides a comprehensive description of the scope, workshop methodology and results.
A summary of the findings is presented below.

The MAHRA attendees are shown in Table 4-5:


Table 4-5 MAHRA Attendees

Name Position Company


Sidarta Mocelin Maintenance Supervisor – Brazil Transocean
Kevin Harrison Toolpusher – Sedco 706 Transocean
Richard Edwards Maintenance Supervisor – Transocean
Sedco 706
Mardonildo Filho Rig Manager – Petrobras 10000 Transocean
Bruno Manfredini Operations Manager – Brazil Transocean
Antonio Lameira Technical Manager – Brazil Transocean
Carolina Bartoli HSE Advisor – Brazil Transocean

Issue 02 / Revision 00 Hard copies are not controlled Page 31 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Name Position Company


Ray Worth Rig Manager – Sedco 706 Transocean
Joe Robinson Sr. Toolpusher – Petrobras Transocean
10000
Terryl Munsamy Sr. Maintenance Supervisor – Transocean
Petrobras 10000
Marcio Martins Sr. HSE Supervisor – Brazil Transocean
Bruno Maurano Marine Licensing – Brazil Transocean
Anderson Santos Rig Manager – Petrobras 10000 Transocean
Ricky Walley Drilling Superintendent – Transocean
Petrobras 10000
Ervin Luksic Master / OIM – Petrobras 10000 Transocean
Stephen Shaw Risk Consultant / Facilitator ERM
Suresh Yelisetty Risk Consultant / Scribe ERM

MAHRA Results Summary

A summary of the MAHRA results is provided in Table 4-6 below. Error! Reference
ource not found.Figure 4-8 includes the Transocean Risk Matrix where these
categories were derived.
Table 4-6 Summary of MAHRA Results

Major Hazard Potential Consequence People Asset Environ.


1a. Shallow gas Ignited release – multiple
fatalities / loss of rig / B2 B2 C4
environmental damage
1b. Hydrocarbons in Explosion or fire – multiple
formation during fatalities / loss of rig / B5 B5 B5
wells operations environmental damage
1c. Hydrocarbons in Explosion or fire – multiple
formation during fatalities / loss of rig /
B5 B5 B5
coiled tubing and environmental damage
wireline operations
1d. Hydrocarbons in Ignition of hydrocarbon gases –
subsea assets and multiple fatalities / loss of rig / B1 B4 B5
pipelines environmental damage
1e. Hydrocarbons in Explosion or fire – multiple
well testing fatalities / loss of rig / B5 B4 B5
environmental damage
1f. Gas cut mud Ignited release – multiple
B5 B4 B2
fatalities / loss of rig

Issue 02 / Revision 00 Hard copies are not controlled Page 32 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Major Hazard Potential Consequence People Asset Environ.


2. Flammable and Fire – multiple fatalities / loss of
combustible rig / environmental damage B5 B4 B2
materials
3. Explosives Explosion – multiple fatalities /
B4 B3 B3
loss of rig
4. Suspended loads Large energy impacts on
critical areas – multiple C4 C3 C0
fatalities
Large energy impacts on the
C4 C4 C1
Drill Floor – multiple fatalities
5. Station-keeping Contact with subsea or surface
assets – damage to rig / B4 B5 B5
environmental damage
Loss of well control –
B4 B3 B5
environmental damage
6. Helicopter Helicopter impacts helideck –
B5 B3 B3
multiple fatalities
Helicopter impacts on some
other area of the rig – multiple B5 B4 B3
fatalities
Helicopter ditching into sea –
C5 C1 C1
multiple fatalities
7. Hydrogen sulfide Exposure to H2S gas – multiple
B5 B3 B1
fatalities
8. Vessel stability Vessel capsize / sinking –
multiple fatalities / loss of rig / B5 B5 B5
environmental damage
9. Watertight integrity Vessel capsize / sinking –
B5 B5 B5
multiple fatalities / loss of rig
10. Rig moving Collision / grounding / sinking –
B5 B5 B5
multiple fatalities / loss of rig

MAHRA Details

Further details of the MAHRA follow for each of the major hazards with the potential to
affect the operation of the Rig. Where required, other qualitative or quantitative risk
analysis data is presented to support the overall risk assessment. A separate ALARP
assessment is conducted for all Major Accident Hazards (MAHs) risk ranked medium or
above. More details can be found in section 4.5.2 of this Safety Case.

Issue 02 / Revision 00 Hard copies are not controlled Page 33 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

1a: Reservoir Hydrocarbons: Shallow Gas

Shallow gas events are the result of penetration into a shallow gas pocket close to the
seabed (typically to 3,300 ft. / 1,000 m below the seabed). Penetration of the gas pocket
may result in an uncontrolled release of hydrocarbon gas through the well bore, into the
water column and to the surface of the sea. The gas volumes released are typically high
and typically occur over a short duration.

The threats are the failure to identify the presence of shallow gas prior to commencing
operations or the potential for the rig to be positioned incorrectly.

The possible consequence of the event and the associated levels of risk were identified
as follows.
Table 4-7 Reservoir Hydrocarbons in Shallow Gas MAH Consequences

Consequence People Asset Environment


Ignited release – multiple fatalities /
B2 B2 C4
loss of rig / environmental damage

Risk to people and the asset was determined as to be broadly acceptable and risk to the
environment was found to be tolerable if ALARP. It was determined that potential
harmful impact to personnel or assets was improbable, mainly due to the fact that a gas
release would most likely originate from the sea floor and have to ignite after passing
through hundreds to thousands of feet of water. If such an event were to occur, the team
determined that a major environmental damage was remotely possible and that
significant injuries to personnel or damage to the drill string were improbable.

1b: Reservoir Hydrocarbons: Hydrocarbons in Formation during Well Operations

This sub-category relates to the potential for an uncontrolled release of formation


hydrocarbons as a result of a loss of well control during well operations.

The identified threats relate to an unplanned and uncontrolled influx of reservoir fluids
into the well with or without the conductor / marine riser and BOP being installed and in
use.

The possible consequence of the event and the associated levels of risk were identified
as follows.
Table 4-8 Reservoir Hydrocarbons in Formation during Well Operations MAH
Consequences

Consequence People Asset Environment


Explosion or fire – multiple fatalities /
B5 B5 B5
loss of rig / environmental damage

Risk to people, asset, and the environment was determined as to be tolerable if ALARP.
The most significant accident leading to an explosion or fire was considered to be a well
formation blowout event. Although such an event was determined to be improbable due

Issue 02 / Revision 00 Hard copies are not controlled Page 34 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

to the effectiveness of barriers / controls in place, the team agreed that if such an event
were to occur, it could be catastrophic in its impact to personnel and the environment
and could extensively damage the asset.

1c: Reservoir Hydrocarbons: Hydrocarbons in formation during coiled tubing and


wireline operations

This sub-category relates to the potential for an uncontrolled release of formation


hydrocarbons as a result of a loss of well control during coiled tubing or wireline
operations.

The issues related to this major hazard are comparable and similar to those described in
Sub-category 1b. i.e. a loss of well control during well operations. However, a separate
risk assessment has been conducted as it is recognized that there are different threats
and barriers during coiled tubing and wireline operations. That is, the temporary
installation and use of third party equipment being operated and maintained by third
party personnel.

The possible consequence of the event and the associated levels of risk were identified
as follows.
Table 4-9 Reservoir Hydrocarbons in Formation during Coiled Tubing and Wireline
Operations MAH Consequences

Consequence People Asset Environment


Explosion or fire – multiple fatalities /
B5 B5 B5
loss of rig / environmental damage

Risk to people, asset, and the environment was determined as to be tolerable if ALARP.
The most significant accident leading to the explosion or fire was considered to be a well
formation blowout event similar to the major hazard of hydrocarbons in formation during
well operations discussed in Sub-category 1b. Such an event was likewise determined
to be improbable due to the effectiveness of barriers / controls in place. The team
agreed that if such an event were to occur, it could be catastrophic in its impact to
personnel and the environment and could extensively damage the drillship.

1d: Reservoir Hydrocarbons: Hydrocarbons in subsea assets and pipelines

This sub-category concerns the potential for damage to occur from the rig or its
operations on subsea assets or pipelines which results in an uncontrolled release of
hydrocarbons.

Damage to subsea assets and pipelines can occur during anchor handling or rig move
operations (e.g. spud cans, mooring lines, etc.) operations. In addition, there is a threat
of dropped objects from the rig (e.g. from heavy lifts such as BOPs, riser, wellheads,
etc.) either from crane or moon pool lifting operations.

The possible consequence of the event and the associated levels of risk were identified
as follows.

Issue 02 / Revision 00 Hard copies are not controlled Page 35 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Table 4-10 Reservoir Hydrocarbons in Subsea Assets and Pipelines MAH


Consequences

Consequence People Asset Environment


Ignition of hydrocarbon gases –
multiple fatalities / loss of rig / B1 B4 B5
environmental damage

Risk to the asset and the environment was determined as to be broadly acceptable.
Risk to the environment was considered as tolerable if ALARP. Impact to subsea assets
was determined to be improbable. Since people and the asset itself are separated from
hydrocarbon gases by a significant water depth, injuries were considered to be unlikely.
However, extensive structural damage could impact the integrity of the rig and the
environment could be catastrophically impacted due to a continuous release of
hydrocarbons from a subsea impact.

1e: Reservoir Hydrocarbons: Hydrocarbons during Well Testing

During well testing, reservoir fluids (including hydrocarbons) are brought on board the rig
under pressure and tested to evaluate reservoir conditions and ascertain the exact
nature of the hydrocarbon deposits. Failure of the well test system or the flare (used to
burn and dispose of reservoir gases) can result in an uncontrolled release of
hydrocarbons on the rig.

Well testing systems are typically provided, operated and maintained by third party
companies.

The possible consequence of the event and the associated levels of risk were identified
as follows.
Table 4-11 Reservoir Hydrocarbons during Well Testing MAH Consequences

Consequence People Asset Environment


Explosion or fire – multiple fatalities /
B5 B4 B5
loss of rig / environmental damage

Risk to people, asset, and the environment was determined as to be tolerable if ALARP.
The most significant accident leading to an explosion or fire was considered to be a
catastrophic failure of well testing equipment or a flare extinguishing, leading to a very
large release that could ignite. Such an event was determined to be improbable due to
the effectiveness of the barriers / controls in place, such as: a subsea safety valve;
subsea BOP; and other barriers. The team agreed that if such an event were to occur, it
could be catastrophic in its impact to personnel and the environment and could
extensively damage the drillship.

1f: Reservoir Hydrocarbons: Gas cut mud

This sub-category relates to the potential for an explosion to occur on the rig as a result
of high concentrations of gas being brought to the rig within the mud / drilling fluid. Gas

Issue 02 / Revision 00 Hard copies are not controlled Page 36 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

concentrations typically increase closer to reservoir formations but also occur in smaller
pockets where hydrocarbon gas migration has occurred.

The threats are related to high gas levels being encountered in closed spaces on the rig
that may form an explosive atmosphere close to ignition sources.

The possible consequence of the event and the associated levels of risk were identified
as follows.
Table 4-12 Reservoir Hydrocarbons in Gas Cut Mud MAH Consequences

Consequence People Asset Environment


Ignited release – multiple fatalities /
B5 B4 B2
loss of rig

Risk to people and the asset was determined as tolerable if ALARP and broadly
acceptable for the environment. The ignition of gas cut mud was considered to be an
improbable event; however, if it were to occur, it could result in multiple fatalities to
personnel with extensive structural damage to the rig. Since, by definition, the release is
caused by an ignition or high gas levels, minimal liquid hydrocarbon was anticipated to
affect the environment.

2: Flammable / combustible materials

This major hazard concerns the presence of flammable or combustible materials on the
rig and the potential for their ignition and a subsequent fire.

The risk assessment considered a range of different areas (e.g. Galley and Laundry) or
scenarios (engine fuel leaks, Hot Work, etc.) where the potential for a fire exists.

The possible consequence of the event and the associated levels of risk were identified
as follows.
Table 4-13 Flammable and Combustible Materials MAH Consequences

Consequence People Asset Environment


Fire – multiple fatalities / loss of rig /
B5 B4 B2
environmental damage

Risk to people and asset was found to be tolerable if ALARP and risk to the environment
was determined as broadly acceptable. The likelihood for ignition or combustion of
materials on the rig was determined to be remote. Prior experience has demonstrated
that the preventative and mitigating barriers / controls in place are highly effective.
However, an unmitigated scenario could result in multiple fatalities or extensive structural
damage.

3: Explosives

The major hazard Explosives concerns the potential for an unplanned detonation of
explosives on the rig resulting in multiple fatalities and/or loss of the rig. Explosive

Issue 02 / Revision 00 Hard copies are not controlled Page 37 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

charges are not normally present on the rig. They are used in specialized well
operations such as perforating completions and well suspension / abandonment.
Explosives are handled by third party companies.

The possible consequence of the event and the associated levels of risk were identified
as follows:
Table 4-14 Explosives MAH Consequences

Consequence People Asset Environment


Explosion – multiple fatalities / loss
B4 B3 B3
of rig

Risk to people was determined as tolerable if ALARP and risk to asset and the
environment was found to be broadly acceptable. An explosion event was considered to
be improbable. Impact to personnel was determined to potentially result in a single
fatality / significant injury, but to be limited in terms of impact to the asset or the
environment.

4: Suspended Loads

This major hazard is concerned with suspended loads and the potential for them to be
dropped from height over people and/or the rigs structure and equipment.

The threats are related to heavy loads dropped from the rigs cranes or during derrick
hoisting operations.

The possible consequences of a dropped load event and the associated levels of risk
were identified as follows:
Table 4-15 Suspended Loads MAH Consequences

Consequence People Asset Environment


Large energy impacts on critical
C4 C3 C0
areas – multiple fatalities
Large energy impacts on the Drill
C4 C4 C1
Floor – multiple fatalities

In both scenarios risk to people and the asset was determined as tolerable if ALARP and
risk to the environment was found to be broadly acceptable. The likelihood of dropped
loads was determined to be remote for impacts to critical areas of the rig and also the
Drill Floor. While this type of event has occurred, mitigating barriers / controls were
determined to be effective in reducing the impact to personnel and the asset. The
potential to impact the environment was considered as negligible or minor.

5: Station-keeping

This major hazard relates to the station-keeping of the rig and therefore its ability to
maintain position on location.

Issue 02 / Revision 00 Hard copies are not controlled Page 38 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

The key threats to station-keeping are extreme weather and environmental conditions.
On dynamically positioned (DP) rigs failure of the DP or Propulsion Systems is
considered also.

The possible consequences of a loss of station-keeping event and the associated levels
of risk were identified as follows:
Table 4-16 Station-keeping MAH Consequences

Consequence People Asset Environment


Contact with subsea or surface
assets – damage to rig / B4 B5 B5
environmental damage
Loss of well control –environmental
B4 B3 B5
damage

In scenarios with the potential to contact subsea or surface assets the risk to people,
asset and the environment was determined as tolerable if ALARP.

In scenarios with the potential for a loss of well control the risk to people and the
environment was determined as tolerable if ALARP, whereas the risk to the asset was
determined as broadly acceptable.

Loss of position and subsequent contact with subsea or surface assets or loss of well
control was determined to be improbable. Due to effective mitigating barriers / controls,
impact to personnel was considered as a single fatality or significant injury. In a collision
scenario damage to the asset could be extensive but less so in a well control scenario as
the drill ship would move off well center. In both scenarios environmental damage was
deemed as potentially catastrophic as the result of an uncontrolled release of liquid
hydrocarbons to the sea.

6: Helicopter

The major hazard Helicopter relates to the potential for a helicopter to crash while
transporting personnel to and from the rig and/or while servicing the rig i.e. for supplies.

A range of potential threats were identified related to the operation of the helicopter. It is
recognized that Transocean does not normally contract helicopters. Therefore many of
the identified barriers are controlled by third party companies and out with the direct
control of rig personnel.

The possible consequences of a loss of positon event and the associated levels of risk
were identified as follows:

Issue 02 / Revision 00 Hard copies are not controlled Page 39 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Table 4-17 Helicopter MAH Consequences

Consequence People Asset Environment


Helicopter impacts helideck –
B5 B3 B3
multiple fatalities
Helicopter impacts on some other
B5 B4 B3
area of the rig – multiple fatalities
Helicopter ditching into sea –
C5 C1 C1
multiple fatalities

Risk to people was determined as tolerable if ALARP for helicopter impact scenarios and
intolerable for a scenario where the helicopter ditched in the sea. In all other case the
risk to asset and the environment was considered as broadly acceptable except for a
helicopter impact on some other part of the rig. This was determined as tolerable if
ALARP in terms of risk to the asset.

It was acknowledged that incidents involving helicopters do occur. However, the team
determined that the likelihood was either improbable or remote depending on the specific
scenario being considered. This assessment was due to: advances in aviation and the
ability to turn the rig and provide the safest orientation for helicopter landing. If a
helicopter were to crash, multiple fatalities could occur, as well as extensive structural
damage to the rig if a critical part is impacted. The worst case environmental impact was
found to only consist of the helicopter releasing fuel into the environment.

Further, it was recognized that helicopter transport is a crucial element of transferring


personnel offshore which has to be considered against the risks of alternate means of
transfer e.g. personnel transfer baskets via a crane.

7: Hydrogen Sulfide (H2S)

Hydrogen sulfide (H2S), a toxic gas, may occur naturally in hydrocarbon reservoirs.
Significant quantities of toxic gas can therefore be released on to the rig in the mud
returns or as a result of leaks during well testing activities.

This major hazard is concerned with the presence of H2S at a concentration that could
form a toxic atmosphere and therefore be hazardous to health.

The possible consequence of the event and the associated levels of risk were identified
as follows:
Table 4-18 H2S MAH Consequences

Consequence People Asset Environment


Exposure to H2S gas – multiple
B5 B3 B1
fatalities

Risk to people was determined as tolerable if ALARP and risk to asset and the
environment was determined as broadly acceptable. The workshop team concluded that

Issue 02 / Revision 00 Hard copies are not controlled Page 40 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

the probability of finding a well with high levels of H2S was well known and understood.
As such, additional barriers / controls are implemented and there were determined as
effective. The team considered the possibility of a significant H2S release to be
improbable. However, if a release were to occur the impact could result in multiple
fatalities or significant injuries. A release of H2S was determined to not affect the
integrity of the rig, and to only have a minor consequence to the environment.

8: Vessel Stability

The major hazard Vessel Stability is concerned with the loss of stability of the rig.

The threats identified relate to unplanned weight changes onboard the rig and/or
compartment flooding due to sea water ingress. In addition, external threats are
associated with impact on the rig from errant vessels or extreme weather / sea
conditions.

The possible consequence of the event and the associated levels of risk were identified
as follows:
Table 4-19 Vessel Stability MAH Consequences

Consequence People Asset Environment


Vessel capsize / sinking – multiple
fatalities / loss of rig / environmental B5 B5 B5
damage

Risk to people, asset and the environment was determined as tolerable if ALARP. The
team determined that the likelihood of having a loss of stability event was improbable.
The impact to personnel, the asset and the environment was determined as catastrophic
in a scenario where the integrity of the drill ship was severely compromised.

9: Watertight Integrity

The major hazard Watertight Integrity is closely related to that of Vessel Stability – and
the former is considered a potential threat to the latter. The threats are also common;
however, a separate risk assessment has been conducted as the barriers are different.

The possible consequence of the event and the associated levels of risk were identified
as follows:
Table 4-20 Watertight Integrity MAH Consequences

Consequence People Asset Environment


Vessel capsize / sinking – multiple
B5 B5 B5
fatalities / loss of rig

Risk to people, asset and the environment was determined as tolerable if ALARP. The
team determined that the likelihood of a significant watertight integrity event was
improbable. Although the impact to personnel, the asset and the environment was

Issue 02 / Revision 00 Hard copies are not controlled Page 41 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

determined as catastrophic in a scenario where the integrity of the drill ship was severely
compromised.

10: Rig Moving

Rig moving concerns the potential for control to be lost during planned rig moves.

DP vessels are normally self-propelled and do not rely on external support to be able to
move from one location to another. Therefore, the key threats are loss of the Propulsion
System onboard or external threats such as extreme weather.

The possible consequence of the event and the associated levels of risk were identified
as follows:
Table 4-21 Rig Moving MAH Consequences

Consequence People Asset Environment


Collision / grounding / sinking –
B5 B5 B5
multiple fatalities / loss of rig

Risk to people, asset and the environment was determined as tolerable if ALARP. The
team determined that the likelihood of a loss of control during a rig move was
improbable. Although the impact to personnel, the asset and the environment was
determined as catastrophic in a scenario where the integrity of the drill ship was severely
compromised

Compartment Risk Assessment

The purpose of the Compartment Risk Assessment is to assess the risk of fire, explosion
or flooding events occurring in separate compartments of a rig, and to determine if these
events could initiate, or substantially contribute to, a major accident.

Compartment Risk Assessments are performed on board the rig by a small team of rig
personnel comprising Drilling, Marine, Maintenance and HSE expertise. Where
applicable, an experienced risk management service provider may provide support.

The compartment risk assessment procedure involves:

 identifying the hazards in each compartment

 determining that sufficient control measures are in place to prevent or mitigate a fire,
explosion and/or flooding event

 assessing the effectiveness of these control measures by determining the likelihood


and consequence of a fire, explosion and/or flooding event occurring

 ensuring that the risk of fire, explosion or flooding is both tolerable and As Low As
Reasonable Practicable (ALARP)

 identifying any recommendations which may further reduce the risk of fire, explosion
and/or flooding in the compartment

Issue 02 / Revision 00 Hard copies are not controlled Page 42 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Each assessment is recorded on a Compartment Risk Assessment Form.

The results of Compartment Risk Assessments are intended to be utilized as a source of


information in the development of rig specific procedures and risk assessments.

A Compartment Risk Assessment for the Rig was undertaken by a broad representation
of the rig crew. A summary of the Compartment Risk Assessment results is provided at
Attachment 4-3.

4.5 Risk Evaluation


4.5.1 Tolerability of Risk

A key principle of risk-based hazard management is that while risk cannot always be
completely eliminated, it should be possible to reduce risk to a level that is As Low As
Reasonably Practicable (ALARP). That is, where the risk is tolerable because all
reasonably practicable risk reduction measures have been implemented.

As described above the MAHRA allow for three possible results:

 Broadly Acceptable

 Tolerable if ALARP

 Intolerable

During the ALARP assessment the risks determined as ‘Tolerable if ALARP’ are
reviewed further to determine if the risk is ALARP. Meaning that measures have been or
will be taken to control risk to a level whereby the costs and/or resources associated with
further measures would be considered grossly disproportionate to the risk reduction
achieved. If the risk is not considered ALARP a recommendation is made for further risk
reduction e.g. further preventative or mitigating barrier(s).

Transocean has identified a level of acceptable risk to act as benchmarks against which
performance can be measured (refer to Figure 4-11).

Issue 02 / Revision 00 Hard copies are not controlled Page 43 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Figure 4-11 Risk Acceptability

The Company has determined


that levels of risk greater than
1 x 10-3, expressed as
individual fatality per year are
unacceptable.

Levels of risk which are equal


to or less than 1 x 10-6
expressed as individual fatality
per year are considered to be
broadly acceptable.

Levels of risk which are


determined as being between
these two figures will be
tolerable when reduced in
accordance with the ALARP
principle.

Any hazard’s associated risk assessment will be deemed appropriate in terms of


complexity and rigor by consideration of the depth and level of assessment, from
qualitative at the broadly acceptable range, through to a full quantified risk assessment
at the intolerable range.

The Company has defined the levels of risk which it considers to be “tolerable” and those
which it considers to be broadly acceptable.

Between the tolerable and broadly acceptable levels lies the “tolerable-if-ALARP” region.
Thus, even after an assessment that the risk is tolerable, there remains the onus on
Transocean to seek further reduction of risk, taking into account the resources required
for any measures taken. The aim is to reduce risks as much as possible, but once an
assessment of acceptability has been achieved, it would be considered unreasonable to
require expensive further improvements to standards. Thus, risks should be tolerable,
and cost-benefit considerations apply to risks that lie in the tolerable-if-ALARP region. In
addition, the effort put into reducing risk within the ALARP region should be proportional
to the level of risk.

Risks should be ALARP for all rigs but it is reasonable to expect that for a newer rig the
principle of gross disproportion may apply further down the ALARP region compared with
an older rig. This approach takes into account the details of the rig whenever a QRA is
performed, including the age and future lifetime of the rig. For example, it distinguishes
between a new rig that is regarded as “state of the art” in terms of safety technology and
safety management, and which has many years of future operation and an old rig which
has older technology and systems and which has a comparatively short remaining life. It
may mean that stricter operating procedures may have to be used on older rigs to
achieve risk reduction with the tolerable-if-ALARP area.

Issue 02 / Revision 00 Hard copies are not controlled Page 44 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

4.5.2 Screening Criteria and Significance

Screening criteria are defined as values and targets used to evaluate or compare the
significance of an identified hazard, event or associated risk to determine the tolerability.
They may be defined either in quantitative or qualitative terms.

ALARP Assessment

An ALARP (As Low as Reasonably Practicable) assessment was conducted for the Rig
in the Transocean Macaé offices on October 13-14, 2016 as part of the MAHRA
workshop. A comprehensive description of the scope, methodology and assessment
outcomes are provided in the Rig ALARP Assessment [3].

The ALARP attendees are shown in the table below. The workshop was facilitated by an
experienced third party consultant, ERM:
Table 4-29 ALARP Attendees

Name Position

Paul Johnson Operations Director - Americas


Bruno Manfredini Operations Manager - Brazil

Marcio Martins HSE Senior Supervisor - Brazil

Carolina Bartoli HSE Advisor - Brazil


Diogo Cardoso Rig Manager - Petrobras 10000

Ray Worth Rig Manager - 706


Diego Reixach Assistant Rig Manager - 706
Lucas Leal Assistant Rig Manager - PBS

Gabriel Gaertner Assistant Rig Manager - DRL


Sidarta Mocelin Operations Engineer - Brazil
Jason Wilson OI Manager - Americas
John Lewter OI Advisor - Americas

As described in 4.2.2 SHIDAC Step 2 – Evaluate Risk of the Safety Case the MAHRA
allows for three results:

 Broadly Acceptable

 Tolerable if ALARP

 Intolerable

During the ALARP assessment the results of the MAHRA are reviewed to confirm
whether the risk has been assessed as ALARP. If necessary, additional information or
data may be reviewed to support the ALARP decision.

Issue 02 / Revision 00 Hard copies are not controlled Page 45 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

ALARP demonstration is achieved through a structured process, whereby a hierarchy of


measures is used as the framework in which the potential for further risk reduction
options are considered. Where no further practicable risk options can be identified
based upon engineering judgment, lessons learned and industry practice, the risk can be
deemed to have been reduced to ALARP.

Inputs from the MAHRA bowties developed for the Rig were used to brainstorm any
further risk reduction options.

ALARP worksheets were populated during the MAHRA for each major accident hazard
(MAH). These worksheets were subsequently used as a prompt during the ALARP
assessment / workshop. Key control measures were categorized in accordance with the
following risk reduction options:

 Elimination (or substitution)

 Separation

 Prevention of potential event (loss of control)

 Prevention of ignition

 Control of the magnitude of consequences

 Detection

 Mitigation of the impact

 Recovery (emergency response and contingency planning)

For each MAH, the risk scenario was populated based on the bow-tie diagrams
developed as part of the Rig MAHRA and were discussed during the ALARP
assessment / workshop. The workshop team then considered any other potential risk
options.

The Rig was constructed to appropriate codes and standards. The utilization of good
practice, the application of the principles of safety in design and implementation of the
actions/recommendations resulting from the expansive formal safety studies undertaken,
has resulted in a design in which all the identified threats are well prevented and
mitigated.

An ALARP workshop team reviewed the MAH risk controls associated with operations of
the Rig and found them to be adequate. Further risk reduction measures were
suggested and assessed for practicability using the hierarchy of control as a framework.
With the added recommendations, the workshop concluded that the MAH residual risks
associated with the Rig have been reduced to ALARP. More details can be found in the
Rig ALARP Assessment [3].
4.5.3 Inter-relation of Major Hazards and Events (e.g. Domino principle)

HSE risk ranking for all hazards was done in the Hazard Register workshop. Risk
ranking of each consequence related to MAHs was done in the MAHRA. These studies
are described in further detail in section 4.4.2 Screening Criteria.

Issue 02 / Revision 00 Hard copies are not controlled Page 46 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Screening of each of the major accidents is done through a risk evaluation process
within the ALARP assessment. The criteria used are described in further detail in
section 4.5.2 Screening Criteria and Significance.

A MAH rarely results in a single isolated event. Incidents generally consist of a chain of
inter-related events (e.g., a load dropped from a crane ruptures fuel tanks that in turn
catch fire, etc.). The purpose of the MAH analyses involves identifying how hazards may
develop and escalate to the surrounding systems.

Understanding this inter-relation of MAH and associated escalating events is necessary


to ensure accurate evaluation of potential consequences and risk. This inter-relationship
is shown in on the following page in Figure 4-14.

Issue 02 / Revision 00 Hard copies are not controlled Page 47 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Case
Part 4: Risk Management

Figure 4-14 Inter-relationship of MAH

1d: Gas release Ignited release


1a:
Hydrocarbons in
Hydrocarbons in
subsea assets 1f: Hydrocarbons
shallow gas Uncontrolled release
and pipelines in gas cut mud
of hydrocarbons
Fire

1b: Ignition
Hydrocarbons in
formation during Explosion
well operations
1c: Hydrocarbons in Unplanned
formation during 1e: detonation
2: Flammable /
coiled tubing or Hydrocarbons
combustible
during well Large energy
wireline operations materials
testing impacts
Dropped load

3: Explosives
Contact with subsea
Loss of position
or surface assets

4: Suspended Legend
loads Loss of control of
helicopter
Loss of well control
5: Station
6: Helicopter
keeping
Toxic atmosphere Major Hazard

7: H2S Helicopter impact

Loss of stability

Top Event
Exposure to H2S gas
Loss of watertight
integrity
9: Watertight
8: Stability 10: Rig moving Accident/
integrity
Loss of control while Vessel capsize / Consequence
rig is moving sinking

Issue 02 / Revision 00 Hard copies are not controlled Page 48 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

4.6 Risk Treatment


As the process of selecting and implementing measures to modify risk is done, actions
for risk treatment include the following:
1. Risk Avoidance: The action of withdrawing or not becoming involved in a risky
situation
2. Risk Optimization: The process of minimizing the negative and maximizing the
positive consequences and/ or respective frequencies
3. Risk Transfer: Sharing with another party the burden of loss or the benefit of gain
from risk and the measures to reduce the risk
4. Risk Retention: The acceptance of the burden of loss, or the benefit of gain from risk
since risk may rarely be reduced to zero

The risk treatment process should be hierarchical in application, meaning that priority
should be given to risk avoidance.

In addition, this section describes the Major Hazard Barriers which were finalized during
the Major Accident Hazard Risk Assessment (MAHRA).

An overview of Major Hazard Barriers in relation to the Transocean risk management


process is shown in Figure 4-15.
Figure 4-15 Transocean Risk Management Process

A Major Hazard Barrier is a physical, procedural or human barrier which is intended to


prevent the release of a major hazard or mitigate a major accident.

Major Hazard Barriers were evaluated or more were added during the MAHRA by
examining their role in preventing major accidents. An overview of the MAHRA process
is described in section 4.2.2 SHIDAC Step 2 – Evaluate Risk. The rig-specific MAHRA is
summarized in section 4.4.2 Screening Criteria.

There are three types of major hazard barriers:

Issue 02 / Revision 00 Hard copies are not controlled Page 49 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

 People Barriers – i.e. people who effectively perform safety critical activities and/or
take safety critical actions

 Plant Barriers – i.e. a physical barrier which blocks or controls a Major Hazard

 Process Barriers – i.e. Execution of effective procedures, standards and


requirements

People Barrier

A People Barrier is someone who effectively performs Safety Critical Activities and/or
takes Safety Critical Actions. These barriers are often also termed Human Barriers.

The People Barriers used during the MAHRA are primarily related to job positions that
have been determined as critical elsewhere in the Company Management System and/or
activities (such as fire-fighting) that require specific training and experience.

Each person in one of these job positions (and personnel in a development role towards
these positions e.g. Assistant Driller) are trained and assessed on a regular basis as part
of the Company’s Competency Assurance Management System (CAMS), including On
the Job Training (OJT) Modules and Marine Licensing requirements. Assessment
occurs on and offshore and includes a theoretical and practical demonstration of
competency verses a defined set of performance criteria.

In addition, there are a number of People Barriers related to training, drills and
experience. Compliance with internal requirements, such as the World-wide Training
Matrix and the requirements for emergency drills, etc. is recorded, tracked and monitored
within the Global Management System (GMS).

Plant Barrier

A Plant Barrier is a physical barrier which blocks or controls a Major Hazard e.g. a Safety
Critical System.

Transocean’s approach to the identification of Safety Critical Systems (SCS) is aligned


with the asset integrity and operational risk management philosophies of the
International Association of Drilling Contractors (IADC) and other organizations such as
the International Association of Oil and Gas Producers (OGP). This approach
recognizes that safety critical can be applied at different levels of equipment hierarchy.
For example:

 A single component may be critical to the proper functioning and performance of a


piece of equipment (e.g. the ram seals on a BOP ram preventer); or

 A piece of equipment may be critical to the proper functioning and performance of a


larger piece of equipment (e.g. a ram preventer within a BOP stack); or

 A larger piece of equipment may be critical to the proper functioning and


performance of a larger system (e.g. a BOP stack within the entire BOP System).

The last example recognizes that rig systems, such as the BOP System, incorporate
redundancy / contingency e.g. multiple ram preventers.

Issue 02 / Revision 00 Hard copies are not controlled Page 50 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

All three approaches are managed within Transocean. However, with respect to the
management of major hazards the final example is applied.

Transocean defines a Safety Critical System as: something which could cause or
contribute substantially to a Major Accident in the event of failure; or a system whose
purpose is to prevent release of a Major Hazard or mitigate a Major Accident.

Key to this is the inclusion of the term ‘Major Accident’. As per Transocean’s definition
this refers to an event which can cause multiple (5 or more) serious injuries or fatalities,
major damage to the rig or environment, or loss of the rig. Therefore, items of equipment
that are safety critical with respect to personal / occupational safety (e.g. a safety
harness or man-riding winch) are not considered as Safety Critical Systems in this
context. As such, equipment that, albeit important and with rigorous management
processes, but does not directly meet the requirements of the above definition is not
considered.

Using the above definition and rule set the Plant Barriers used during the MAHRA are
considered as Safety Critical Systems. Where there are additional pieces of equipment
which are not part of a Safety Critical System, but are considered to provide a supporting
role these have been identified as Process Barriers.

Listing of Safety Critical Systems

Table 4-29 lists the identified Safety Critical Systems (SCS) as applicable to the Rig.
Safety Critical Systems are managed by following the requirements of the Maintenance
Policies and Procedures [8] relating to these barriers in Rig Management System (RMS).
These requirements are summarized in the respective Performance Standards listed in
Table 4-30.
Table 4-30 Safety Critical Systems Present on the Rig

Safety Critical System Transocean


Performance
Standard Ref.

Systems which may cause or prevent major accidents:

Ballast System 10101

Mooring System (Semi Sub) 10201

Low Pressure (LP) Mud System 10302

High Pressure (HP) Mud System 10303

Cement Unit 10304

Ex Equipment 10401

Rig Structure 10502

Watertight Doors, Hatches and Valves 10507

Weathertight Doors and Hatches 10509

Towing System 10601

Issue 02 / Revision 00 Hard copies are not controlled Page 51 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Safety Critical System Transocean


Performance
Standard Ref.

Mud Processing Area Ventilation 10701

BOP Stack (Subsea) 10802

Marine Riser System 10808

Choke and Kill System 10809

Diverter System 10811

Mud / Gas Separator System 10813

Drilling Instrumentation System 10901

Navigation and Obstruction Systems 11001

Weather Station 11101

Deck Crane Safety Systems 11401

Dynamic Positioning System (DP) 11701

Power Management System (DP) 11702

Thruster Propulsion System (DP) 11703

Systems Which May Detect Major Accidents:

Fire Detection System 20101

HC Gas Detection System 20200

H2S (Toxic) Gas Detection System 20300

Flood Detection System 20400

Fire Main System 30101

Helideck Firefighting System 30103

Drill Floor Deluge System 30104

Fixed Fire Extinguishing Systems 30107

Portable Fire Fighting Appliances 30108

Fireman’s Equipment 30110

Fire Boundaries 30201

Bilge System 30301

Emergency Communication Systems 30401

Public Address Alarm System 30404

Drill Floor Hoisting Safety Systems 30501

Motion Compensator System (by CMC) 30502

Issue 02 / Revision 00 Hard copies are not controlled Page 52 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Safety Critical System Transocean


Performance
Standard Ref.

TR Escape Routes 30601

Temporary Refuge (TR) 30603

Emergency Shutdown System (ESD) 30700

Remotely Operated Fuel Oil Tank Shut Off Valves 30701

Machinery Spaces Ventilation System Shutdowns 30704

Emergency Mooring Release System 30801

Emergency Generator 31001

Escape, Evacuation and Rescue Systems:

Helicopter Deck 30802

Lifeboat System 30803

Liferaft System 30901

Escape Ladder to the Sea 30902

Immersion Suits 30903

Marine Lifejackets 30904

Escape Packs 30905

Third Party (Temporary) Systems (as applicable):

Well Test Package 40300

Mud Logging System 40402

Third Party H2S Safety Systems 40501

Coiled Tubing System 40600

Wireline System 40700

Diving System 40900

Process Barriers

The Process Barriers used during the MAHRA relate to the execution of effective
procedures, standards and requirements that are deemed safety critical. These barriers
are often also termed Procedural Barriers. All of the Process Barriers are mapped to a
policy or requirement of the Company Management System contained within the
following:

 Asset Management Handbook

 Certificate and Survey Handbook

Issue 02 / Revision 00 Hard copies are not controlled Page 53 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

 Operations Policies and Procedures

 Well Control Handbook

 Marine Compliance Procedures

 HR Policy and Procedures

 Health and Safety Policies and Requirements

 Audit and Compliance Policies and Requirements

 Field Operations Procedures

 (Rig type specific) Field Operations

 Environmental Policies and Requirements

 Security and Emergency Response

 Competence Assurance Management System

 Rig-specific Security and Emergency Response Plan

 Rig-specific Marine Operations Manual

 Rig-specific Shipboard Oil Pollution Emergency Plan


4.6.1 Risk Hierarchy

The ALARP demonstration is achieved through a structured process, whereby a


hierarchy of measures is used as the framework in which the potential for further risk
reduction options are considered. The framework used is:

 Determining whether the task needs to be performed at that time

 Elimination of risk by removing the hazard at the worksite

 Separation of personnel from exposure to the hazard at the worksite

 Prevention of potential loss of containment of the hazard

 Prevention of ignition

 Improve detection of the event

 Control of the magnitude of consequences

 Mitigation of the impact/consequence of an event on people, the environment, or


assets

 Improve recovery from the impact

Engineering controls (hardware/plant) are generally preferred over procedural controls


(process) and administrative controls (supervision and general requirements).

Issue 02 / Revision 00 Hard copies are not controlled Page 54 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

4.6.2 Risk Optimization Strategies

Risk optimization refers to finding a balance between negative risk and the benefits of
the operation or activity; and between risk reduction and effort applied. Transocean
applies a range of HSE and Risk Management practices globally throughout the
company so that it can optimize risk to achieve levels of residual risk that are tolerable.

Risk is first screened through the Hazard Register and the MAHRA. Risk is then
evaluated through the ALARP assessment, and then finally risk is optimized to provide
sufficient protection to people, the environment, and assets.

What is ultimately used to effectively manage risks and prevent major accidents from
occurring is a series of people barriers, plant barriers, and process barriers described at
the start of section 4.6. The people barriers are managed through adequate training of
personnel, and by constantly improving training programs and worker competency.
Plant barriers are managed through the various performance standards and inspection,
maintenance and testing activities scheduled and recorded in Rig Management System
(RMS). Process barriers are maintained by periodically reviewing and reinforcing the
various handbooks, manuals, and procedures documented in the Transocean Company
Management System.

The HSE Management System is described in Part 2 of this Safety Case, and
Performance Monitoring is described in Part 6 of this Safety Case. The systems and
procedures described in these parts of the Safety Case are some of the means used to
manage the various people, plant, and process barriers that are in place. By managing
these barriers, the frequency of incidents is kept at a minimum level that is considered to
be ALARP.

Transocean seeks to constantly maintain barriers/controls to a high level of


effectiveness. During the MAHRA, barrier effectiveness was defined as either unknown,
good, or very good. In general, barriers with unknown effectiveness are managed by
third parties. Barriers managed by Transocean are kept to at least a good level of
effectiveness. Good barriers are in place and being used >75% of the time, while very
good barriers are in place and being used >95% of the time. Both good and very good
barriers were determined to be at least 95% effective.
4.6.3 Summary of Operation Boundaries (SOOB) – Combined Operations

A Summary of Operation Boundaries for simultaneous and combined operations is


included as Attachment 4-4. The SOOB defines limitations on activities during periods
when a critical safety system (especially protective or detection equipment) is
unavailable due to failure or maintenance. Due to the capabilities of the Rig, typical
“dual-activities” are included in the SOOB. The examples included are representative of
the types of dual activities of which the Rig is capable and are not all inclusive. The
identified restrictions placed on operations are regarded as a minimum and additional
restrictions may be required during the course of the drilling program.

In addition to the SOOB, certain concurrent operations have limitations or restrictions


due to increased risk for continuation of both simultaneously. Restrictions on concurrent
or simultaneous operations are addressed at daily operations meetings and considered
on a case-by-case basis in task planning (Task Planning and Risk Assessment process).

Issue 02 / Revision 00 Hard copies are not controlled Page 55 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

Helicopter operations and use of radios/communication equipment are required to be


suspended while explosive charges are being used during well logging and testing
operations. Additional restrictions may also be placed on the operation of other
equipment if required. The exact requirements are situation specific and are required to
be addressed by the responsible engineer prior to the arming of explosives. Hot work
requires a permit to work at all times. The granting of this permit to work will consider
the possible effects of the hot work on other operations. Hot work is restricted when
drilling through a potential shallow gas zone and during well testing. Drilling and well
services may require suspension during periods of extreme weather. Similarly, boat
loading/offloading operations may require suspension. The exact requirements are
situation specific and will require to be assessed by the Master / OIM based on weather
forecasts. Crane operations are required to be restricted or suspended on the approach
landing and take-off of helicopters.

4.7 Risk Acceptance


Through compilation of various files and documentation of the processes, Transocean
has demonstrated the following:

 All reasonable measures have been taken, or are in the process of being taken, to
ensure that the HSE risks have been reduced to a tolerable level on the Rig through
the use of the Hazard Register, MAHRA and the ALARP assessment;

 Rigorous processes such as Task Planning and Risk Assessment and START will be
applied to identify potential hazards;

 Risks associated with these hazards (both major and workplace hazards) have been
and will continue to be identified, assessed and managed to a tolerable level.

4.8 Risk Communication


Risk communication is “the exchange or sharing of information about risk between the
decision-maker and other stakeholders.” This information relates to the existence,
nature, form, probability, severity, acceptability, and treatment of risk. HSE information is
made available and appropriately communicated to all personnel onboard the Rig
including 3rd party contractors, Customers, Customer’s subcontractors to ensure that
they are adequately informed of HSE issues, in order to improve awareness and HSE
Performance. Key aspects of risk communication are discussed in the following
sections.
4.8.1 Transocean Scope of Operations

Transocean’s scope of operations comprises documentation to help communicate


hazards, hazard scenarios, consequences, potential causes, preventative and mitigating
barriers, risk rankings and hazard categories to the workforce. For the Rig, this
information is included in the Hazard Register (refer to Attachment 4-1), Major Accident
Hazard Bowtie diagrams (refer to Attachment 4-2), Compartment Risk Assessment
(Attachment 4-3), training materials and a number of detailed hazard identification and
assessment reports. More details are included in section 6.4 and Part 6, Attachment 6-1
– SCA Matrix and SCA Sheets.

Issue 02 / Revision 00 Hard copies are not controlled Page 56 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

In addition, there are location specific aspects that need to be addressed as part of the
Customer’s bridging documentation, as they cannot be fully covered by Transocean’s
scope of operation.
4.8.2 Workforce Communication to Drilling Contractor Senior Management

Transocean actively promotes an environment to ensure that the whole workforce is


formally involved in promoting HSE Management through a number of meetings and
mechanisms. These mechanisms have been implemented to ensure that all safety
concerns are raised, recorded, and closed out appropriately. One of these mechanisms
is START Conversations. All personnel must take part in START conversations.

HSE Steering Committee Meetings are held at Global, Operation, Installation and Facility
levels. In order to ensure regular and ongoing feedback is obtained regarding responses
to risk, HSE meetings are conducted onboard the Rig in a manner that provides an
opportunity for crews to discuss, understand/apply processes/procedures for conducting
tasks and identifying hazards and associated risks, all in an effort to increase awareness
by reviewing and learning from incidents and reviewing HSE information. In addition,
during the weekly department meetings, department heads onboard the Rig are
responsible to ensure that all personnel within their respective departments attend at
least one departmental HSE meeting per week. Crew supervisors are responsible to
ensure that meetings are conducted effectively.
4.8.3 Monitoring and Verification

The Safety Case is a living document and presents an overview of the technical,
operational, and organizational arrangements present on the Rig. This allows the Safety
Case to present valuable guidance for the personnel offshore in the daily operations in
terms of providing important information about risk management including maintenance
of barriers/controls and operational boundaries.
4.8.4 Feedback to the Drilling Contractor Management System

For each Customer, a bridging document is required, as applicable, that addresses


campaign specific risks and associated management requirements. All permit-to work
(PTW) differences are identified and addressed in the HSE bridging document. In
addition, as part of the Transocean Health and Safety Policies and Requirements [5], all
company personnel are required to actively support and practice the Company Task
Planning and Risk Assessment, START Conversations and FOCUS processes in order
to effectively plan, monitor and improve the HSE aspects of the operation. Audits,
inspections and incident investigations are conducted and documented as required by
the Company’s Health and Safety Policies and Requirements [5] and Audit and
Compliance Policies and Requirements [7].

4.9 References
[1] ISO 17776:2000, Petroleum and natural gas industries – Offshore production
installations – Guidelines on tools and techniques for hazard identification and risk
assessment

[2] Petrobras 10000 MAHRA Report

Issue 02 / Revision 00 Hard copies are not controlled Page 57 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 4: Risk Management

[3] Petrobras 10000 ALARP Assessment

[4] Environmental Policies and Requirements, Document No: HQS-HSE-PP-02

[5] Health and Safety Policies and Requirements, Document No: HQS-HSE-PP-01

[6] Transocean Global HAZID Report (Final)

[7] Audit and Compliance Policies and Procedures, Document No. HQS-CMS-PP-01

[8] Maintenance Policies and Procedures, Document No. HQS-AMM-PP-01

4.10 Attachments
Attachment 4-1: Petrobras 10000 Hazard Register

Attachment 4-2: Petrobras 10000 Bowtie Diagrams

Attachment 4-3: Petrobras 10000 Compartment Risk Assessment

Attachment 4-4: Petrobras 10000 Summary of Operational Boundaries

Issue 02 / Revision 00 Hard copies are not controlled Page 58 of 58


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

CONTENTS

5 Emergency Response ......................................................................................................... 2


5.0 Introduction.................................................................................................................. 2
5.1 Emergency Response Management ............................................................................ 3
5.1.1 Emergency Response Philosophy ........................................................................... 3
5.1.2 Emergency Response Analysis ............................................................................... 4
5.1.3 Emergency Response Plans .................................................................................... 5
5.2 Command and Communication ................................................................................... 9
5.2.1 Command During Emergencies ............................................................................... 9
5.2.2 External Emergency Response Support ................................................................ 11
5.2.3 Communications .................................................................................................... 14
5.3 Training for Emergencies ........................................................................................... 14
5.3.1 Emergency Response Training .............................................................................. 14
5.3.2 Drills and Exercises ............................................................................................... 14
5.3.3 HSE Inductions ...................................................................................................... 15
5.4 Temporary Refuge Assessment ................................................................................ 17
5.4.1 Temporary Refuge (TR) Concept and Description ................................................. 17
5.5 Details of Evacuation and Escape Equipment ........................................................... 18
5.5.1 Evacuation and Escape Systems ........................................................................... 18
5.5.2 Means of Recovery to a Place of Safety ................................................................ 19
5.6 Establishing and Approving Location Specific Emergency Response Arrangements
with Customer ....................................................................................................................... 19
5.7 References ................................................................................................................ 20

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

5 EMERGENCY RESPONSE

5.0 Introduction
Emergency response refers to the Company’s approach for managing various potential
emergency situations onboard the Petrobras 10000 (herein called ‘the Rig’). It is an
essential part of the overall process of risk management as documented within this
Safety Case. Whilst every effort is made to prevent the release of a major hazard, any
such event has the potential to occur, and if so, must be managed accordingly.

It is recognized that a number of the identified mitigating People, Plant and Process
barriers are primarily related to emergency response. This Part of the Safety Case
provides an overview of the global emergency response philosophy and arrangements
as per the Company’s Governing Principles [10] and the Company’s Security and
Emergency Management Polices and Requirements [1] and how these arrangements
are applied to the Rig.

To assure that Transocean (the Company) is managing HSE risks effectively, Safety
Case Part 2 – HSE Management System, Part 3 – Rig Description and Supporting
Information, Part 6 – Performance Monitoring, and this part (Part 5 – Emergency
Response) are all applied in conjunction with the structured risk management process
described in Part 4 – Risk Management.
Figure 5-1 Interrelationship of Safety Case Parts

The Emergency Response Part of the Safety Case (this Part) demonstrates that
emergency response arrangements on the Rig have been systematically assessed and
that suitable arrangements are in place to respond to all credible emergency situations.
These objectives are organized by the following elements:

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

 Emergency Response Management

 Command and Communication

 Training for Emergencies

 Temporary Refuge (TR) Assessment

 Details of Evacuation and Escape Equipment

5.1 Emergency Response Management


5.1.1 Emergency Response Philosophy

The Company’s Governing Principles [10] has an Emergency Management and


Business Continuity Element which includes Emergency Planning, Preparedness and
Response requirements to ensure effective response and recovery, and that situations
with the potential to result in emergencies are identified, and Emergency Response
Plans are developed and ready for immediate implementation.

In order to ensure effective response and recovery the Emergency Management and
Business Continuity Element includes requirements that:

 Processes and procedures are in place for the development and implementation of
Emergency Response Plans.

 Roles, responsibilities and authorities are defined for emergency management.

 Situations with the potential to result in an emergency are identified for all locations
based upon risk assessment.

 Emergency Response Plans are developed, documented, reviewed at specified


intervals and revised as appropriate utilizing risk assessments, lessons learned from
drills, exercises and incidents, and include estimated timeframes for mobilizing
resources and conducting response and recovery activities.

 Designated Emergency Control Centers are established on each rig in accordance


with established criteria and with access to relevant Emergency Response Plans.

 Designated Emergency Response Centers are established onshore to support


Company rigs in accordance with established criteria.

 Communication systems are in place to facilitate:


- Timely and continual communication between the scene of the emergency and
the Emergency Response Centers
- Appropriate methods of communication among other stakeholders

 Internal and external support resources are available to plan and implement safe and
effective emergency response.

Issue 02 / Revision 00 Hard copies are not controlled Page 3 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

 Training, drills and exercises based on realistic scenarios are planned and executed
at defined intervals, are site-specific and include all personnel.

 Emergency response activities are evaluated against established criteria.

 All personnel, including relevant external parties, are trained in their roles for
emergency response.

 Results of drills and exercises are documented and analyzed to identify opportunities
for improvement and to incorporate lessons learned.

 Emergency systems and equipment are inspected, tested and maintained or


replaced to meet established criteria.

 Emergency Response Plans are assessed for interfaces with Business Continuity
Plans and evaluated for effectiveness.

Security and Emergency Polices and Requirements

The Company’s Security and Emergency Policies and Requirements [1] contains policies
and procedures to ensure that a secure workplace is maintained for all personnel and
complies with relevant international and local regulatory requirements.

The principal aim of the Security and Emergency Management Policies and
Requirements [1] is to:

 Protect human life

 Protect the environment

 Protect assets

 Protect Company reputation

 Maintain business continuity

The Security and Emergency Management Policies and Requirements [1] include the
requirements for rig-specific security and emergency response documentation. As an
International Ship and Port Facility Security (ISPS) Code certified vessel the Rig
requires:

 Ship Security Assessment

 Ship Security Plan

 Emergency Response Plan


5.1.2 Emergency Response Analysis

The Company has employed a systematic risk management process for the identification
of hazards, risks and emergency response requirements. These were identified and
analyzed during the Hazard Register [2] development, and the Major Accident Hazard

Issue 02 / Revision 00 Hard copies are not controlled Page 4 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Risk Assessment (MAHRA) Report [3]. The Hazard Register [2] includes a list of all
hazards present on the Rig.

Risk assessments involving the analysis of emergency response scenarios were


undertaken with the Rig crew, other Company personnel. The output from this process
was used to ensure that the emergency response arrangements for the Rig are relevant
to the range of credible major (and other) hazard scenarios.

The hierarchy of emergency response is illustrated in Figure 5-2.


5.1.3 Emergency Response Plans

Emergency Response Plans exist at various levels within the Company to provide rigor,
consistency and structure in the response to differing levels of incident. At the highest
level this includes Crisis Management and Business Continuity. The emergency
response arrangements within Transocean are summarized in Figure 5-2.
Figure 5-2 Emergency Response Organization

Brazil Rig Cell Onshore Emergency Response Plan

The objective of the Emergency Response Plan for the Brazil Rig Cell [4] is to provide
procedures for the planning and activation of the Brazil Rig Cell Emergency Response
Team (ERT), including interface arrangements with Corporate ERT and other company
response teams should it be required.

Issue 02 / Revision 00 Hard copies are not controlled Page 5 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

In the event of an emergency on an installation, the strategies presented in the Brazil Rig
Cell Onshore Emergency Response Plan [4] are intended to be used in conjunction with
the Petrobras 10000 Emergency Response Plan [5].

Petrobras 10000 Emergency Response Plan

The Rig has an Emergency Response Plan (ERP) [5] and Emergency Response Teams
(ERTs) in order to ensure an effective response to manage emergencies.

When developing an ERP the following is considered, where applicable:

 Relationships with host nation security and international agencies, for example,
Embassy and Consulate Local Emergency Services

 In-country emergency response resources

 A joint assessment with the customer to determine whether or not additional controls
are required:
- During critical well operations
- During rig moves
- When the rig is to be physically connected to an offshore platform or facility

The Rig Emergency Response Plan [5] includes a range of Control and Mitigation Plan
aligned with the major hazard scenarios identified as relevant to the Rig. This
relationship is summarized in Table 5-1.
Table 5-1 Relationship between Major Hazards and Emergency Response Plans
1
Major Hazard Emergency Response Plan

1a Shallow gas Shallow Gas Blowout

1b Hydrocarbons in formation during Reservoir Blowout at the Drill Floor


well operations Fire / Explosion on Drill Floor / Moon Pool

1c Hydrocarbons in formation during Reservoir Blowout at the Drill Floor


coil tubing or wireline operations Fire / Explosion on Drill Floor / Moon Pool

1d Hydrocarbons in subsea assets Shallow Gas Blowout


and pipelines

1e Hydrocarbons during well testing Fire / Explosion in Well Test Area

1f Gas cut mud Fire / Explosion in Mud Processing Areas


Explosive Atmosphere in a Confined Space

Issue 02 / Revision 00 Hard copies are not controlled Page 6 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

1
Major Hazard Emergency Response Plan

2 Flammable / combustible Fire / Explosion on Drill Floor / Moon Pool


materials Fire / Explosion in Mud Processing Areas
Fire / Explosion in Well Test Area
Fire / Explosion in Confined Area
Fire in Workshops / Warehouse
Derrick Fire (Service Loop) Drill Pipe in Hole
Fire / Explosion in the Machinery Spaces
Fire in Open Deck Areas
Fire in Paint Locker
Fire in Thruster Room
Fire in Accommodation

3 Explosives Explosives Bunker Fire / Surface Detonation


Emergency

4 Suspended loads N/A – the response will be appropriate to the


circumstances of the event (e.g. personal injury, asset
damage, etc.)

5 Station-keeping Power Failure


Collision with Another Vessel (Drilling Mode on
Location)
Drift Off Loss of Position
Drive Off Loss of Position

6 Helicopter Helicopter Crash on the Installation


Helicopter Crash into the Sea Close to the Installation

7 Hydrogen sulfide (H2S) Hydrogen Sulfide (H2S) / Toxic Gas Release

8 Vessel stability Loss of Stability (from Internal Reasons)


Structural Failure
Collision with Another Vessel (Drilling Mode on
Location)

9 Watertight Integrity Loss of Watertight Integrity


Collision with Another Vessel (Drilling Mode on
Location)

10 Rig Moving Loss of Control in Transit (Self Propelled)


Loss of Control in Transit (Under Tow)
Emergency Towing Procedures
1
Note: Response ‘Evacuation and Abandonment of the Installation’ applies to multiple Major
Hazard scenarios.

Issue 02 / Revision 00 Hard copies are not controlled Page 7 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Evacuation Planning

The Rig Emergency Response Plan [5] includes an Evacuation Plan which includes:

 Roles and responsibilities of Emergency Response Team members

 Method and means of communication

 Locations of primary and alternative muster and Temporary Refuge areas

 Method and routes for evacuation (primary and secondary)

When developing an Evacuation Plan, other factors which are considered include:

 Mitigation measures to sustain safe and secure operations

 Risks associated with moving personnel

 Asset protection

Stages of Evacuation

There are four stages of evacuation:

 Warning

- There is potential for normal operating conditions to deteriorate.


- At this time Installation management review the Evacuation Plan and be prepared
to implement it at short notice.

 Stand By
- An evacuation may be required imminently and arrangements for evacuation
begin. This includes where applicable minimized local movement.

 Evacuation of Non-Essential Personnel


- Operations Management determines non-essential personnel be evacuated.

 Evacuation of All Personnel


- Operations Management determines all personnel are evacuated and Installation
secured.

Emergency Control Center (ECC)

The Rig has a designated Emergency Control Center (ECC) equipped with a Major
Emergency Management Board, relevant Operating Manuals, internal and external
contact information, and communications equipment. The Major Emergency
Management Board captures the following information:

 Personnel On Board (POB) count and muster status

 Missing Person and casualty detail

Issue 02 / Revision 00 Hard copies are not controlled Page 8 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

 Present weather conditions

 Teams and their location involved in control of the emergency and those teams or
personnel on standby

 Key events time log

 Vessels and aircraft involved or nearby that can assist in control of the incident

 Specific emergency control actions that must be performed

 Status of required emergency equipment, for example, fixed firefighting equipment,


lifeboats and equipment or system shutdowns

 Relevant external contact information

Compartment Risk Assessment Sheets

Compartment Risk Assessment sheets are available in the ECC and for the On Scene
Man in Charge (OSMIC).

Emergency Response Teams

The Rig has personnel assigned to Emergency Response Teams (ERTs) who have the
required training, knowledge and experience to fulfil their roles.

ERTs have identified alternates for each role.

The roles and responsibilities of each team and team member are clearly defined in the
Emergency Response Plan [5].
Emergency Response Plan Review

Emergency Response Plans are reviewed:

 At least once annually

 On change of location

 When the MAHRA or Safety Case is revised

 Following Lessons Learned from an emergency response incident

5.2 Command and Communication


5.2.1 Command During Emergencies

Command during emergencies is coordinated between the Rig Command Team and the
onshore Incident Management Team (IMT). The command and control hierarchy in an
emergency situation is detailed on the Rig Station Bill [6].

Issue 02 / Revision 00 Hard copies are not controlled Page 9 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Onshore Command Team

An onshore based Operation Incident Management Team (refer to section 5.2.2) is in


place in order to respond to, and support, emergencies arising offshore.

The mission of the team is to provide managerial and technical support to an installation
Command Team and any facility or branch specific emergencies as needed. Support
may come in the form of operational and/or technical advice to the installation, facility, or
office as shore side logistical support and notification.

Petrobras 10000 Command Team

The Rig Command Team is composed of the Person in Charge (PIC), Master / OIM,
Customer Representative, and others positions as required.
The function of the Rig Command Team is to:
 Deploy emergency teams as necessary

 Coordinate emergency response effort

 Initiate activation of, and liaise with, the shore based Incident Management Team

 Liaise with Emergency Services and Support as required

The Master / OIM is the Person in Charge (PIC) in all emergency situations.

PICs are trained and assessed in the management of major emergencies.


The Rig Emergency Control Center (ECC) is located on the Bridge.

The Rig Station Bill [6] includes the following information:

 Details of alarm signals

 Escape routes

 Primary and secondary muster points for all personnel including visitors

 Initial responsibilities and actions to be performed by all personnel in an emergency


situation

 The Chain of Command, Person in Charge (PIC), and at least one Alternate

 The On Scene Man in Charge (OSMIC) and one Alternate

 Personnel or Team responsible for activating Emergency Shut Down (ESD) functions
including closing of watertight doors, fire doors, valves, vent inlets and outlets,
scuppers, skylights, portholes, ventilation dampers and other similar openings

 Personnel by position and/or Team responsible for operating of the survival craft and
other life-saving appliances

 Use of EPIRB and radio communication equipment

Issue 02 / Revision 00 Hard copies are not controlled Page 10 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

 Composition, roles and responsibilities of Emergency Teams

The following teams and their roles and responsibilities are detailed in the Rig Station Bill
[6]:

 Command Team

 On Scene Man in Charge (OSMIC)

 Initial Response Team (IRT)

 Emergency Response Teams (ERT)

 Lifeboat Crews

 Rescue Boat Team

 Maintenance Teams

 Medical Response Team

For further details, refer to the Security and Emergency Management Policies and
Requirements [1].
5.2.2 External Emergency Response Support

The Command Team is the central organisation that exercises control during any
emergency. They are also responsible for the external communication to Shore Based
Management, customers and Coast State Emergency Services (e.g. National
Coastguards, local (municipal) and regional authorities).

The arrangements for external emergency response communication and support are
detailed in the Security and Emergency Response Communication Plans Policy held
within the Security and Emergency Management Policies and Requirements [1].

Emergency Response Center (ERC)

The Company has an onshore Emergency Response Center (ERC) in Macaé which is
equipped to respond to, and support, emergencies arising offshore and locally.

The Emergency Response Center includes:

 Separate telephone lines for each member of the Incident Management Team

 A dedicated computer with both intranet and internet access

 Ready access to a printer

 Event boards for record keeping

 Wireless intranet and internet connectivity

 Television with direct reception to local media stations

Issue 02 / Revision 00 Hard copies are not controlled Page 11 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

 Multimedia projector and display screen

 Fax machine

Operation Incident Management Team (IMT)

The Operation Incident Management Team provides support as necessary to the Rig
Command Team from the Emergency Response Centre (ERC) in the event of an
emergency.

The IMT has a Team Leader, an Alternate Team Leader, and an appropriate number of
team members to take action in an emergency. The roles and responsibilities of each
team and team member are defined in the onshore Emergency Response Plan [4].

All personnel assigned roles and responsibilities for responding to, and managing,
emergencies participate in drills and exercises simulating the duties they would be
required to conduct in such emergencies.

In the event of an emergency the Team Leader or Alternate will initiate the activation of
the appropriate shore based Incident Management Team.

When notified of an emergency, the IMT Leader will determine the support required,
muster members of the IMT and activate additional Emergency Response Centres as
necessary. The IMT Leader may call in additional expertise, internal or external, as
required.

Incident Command is transferred from the Rig ECC:

 On the instruction of the Rig PIC

 If communication between the Rig and IMT is lost

Corporate Incident Management Team

The Company has a Corporate Operational Support Plan [7] which includes the
requirements for a Corporate Incident Management Team. This team provides support
to Operation Incident Management Teams during emergencies, as required.

The Corporate Operational Support Team may be activated partially or fully when critical
or catastrophic emergencies affect the Company, including:

 Major loss of life

 Major emergency with potential to effect safety or security of company personnel or


assets

 Major environmental damage

 Loss or potential loss of an installation or facility

Emergency Response

The response to an emergency situation is shown in Figure 5-3.

Issue 02 / Revision 00 Hard copies are not controlled Page 12 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Figure 5-3 Emergency Response Flow Diagram

EMERGENCY EMERGENCY
ASSESSMENT RESPONSE

Installation
Installation // Facility
Facility
OIM
OIM // PIC
PIC

Is activation of the Activate


Activate full
full response
response from
from
Yes
Emergency Response Center Emergency
Emergency Response
Response Team
Team
necessary?

Installation
Installation // Facility
Facility
Rig
Rig Manager
Manager If the vessel in need of
assistance is part of the
Master Limited Partnership
No (MPL), the appropriate
personnel must be informed
as defined in Section 6,
Hub Paragraph 6
Hub
Operations
Operations Manager
Manager

Select
Select members
members ofof Emergency
Emergency
Is it necessary to notify
Yes Response
Response Team
Team to
to perform
perform limited
limited
members of the Emergency
response
response
Response Tem?
Hub
Hub
Operations
Operations Director
Director

No

Emergency
Emergency Coordinator
Coordinator Emergency
Emergency Response
Response Team
Team
Reports
Reports information
information to
to
Does emergency require No appropriate
appropriate internal
internal Functions
Functions for
for Team
Team Leader
Leader
corporate notification or proper
proper follow-up
follow-up Emergency
Emergency Coordinator
Coordinator
assistance? Primary
Primary Contact
Contact
Logistics
Logistics Coordinator
Coordinator
Medical
Medical Services
Services Coordinator
Coordinator
Customer
Customer Contact
Contact
Personnel
Personnel Coordinator
Coordinator
Yes Marine
Marine Coordinator
Coordinator
Security
Security Focal
Focal Point
Point
V.P.
V.P. Operations
Operations Log
Log Keeper
Keeper
Corporate
Corporate ERT
ERT
Corp.
Corp. Communications
Communications Director
Director

Oil Spill Response Plan

The Rig has a Shipboard Oil Pollution Emergency Plan (SOPEP) [11]. The purpose of
the SOPEP [11] is to provide guidance to the Master / OIM, and others on board the Rig,
with respect to the steps to be taken when a pollution incident has occurred or is likely to
occur. The SOPEP [11] contains requirements for responding to controlling, and
reporting an oil spill.

For full details refer to the Rig SOPEP [11].

Issue 02 / Revision 00 Hard copies are not controlled Page 13 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

5.2.3 Communications

Communications for an emergency situation onboard the Rig are initiated by the Master /
OIM and coordinated from the Rig Emergency Command Centre (ECC).

A number of internal and external communication equipment and systems such as,
Global Maritime Distress and Safety System (GMDSS), Emergency Position Indicating
Radio Beacon (EPIRB), Inmarsat, Very High Frequency (VHF) Radios, Non Directional
Beacon (NDB), Search and Rescue Transponders (SART), Public Address/General
Alarm (PA/GA), Navigation and Obstruction Systems and Telephones are available
onboard the Rig. These equipment and systems are described in more detail in Part 3
Section 3.4.6 of this Safety Case.

Communication is coordinated between the Rig and the onshore Operation Incident
Management Team (IMT) and initiated by the Rig or Alternate.

For further details relating to communications refer to heading 5.2.2 – External


Emergency Response Support and the Corporate Operational Support Plan [7].

5.3 Training for Emergencies


5.3.1 Emergency Response Training

The Master / OIM and Drilling Superintendent are required to complete the Company’s
Major Emergency Management (MEM) training. In addition, the Person in Charge (PIC)
is required to satisfactorily complete the Company’s assessment of PICs training.

The Company has a World Wide Training Matrix defining the required training, and
training refresher, requirements for individual positions on the rig, which includes
emergency response related training.

The Rig Emergency Response Team comprises personnel who have completed training
and are certificated for their emergency role, e.g. emergency team leaders, fire-fighting
team members, lifeboat coxswains and first aiders all complete specific training for their
role.

The Rig clinic is staffed by a qualified medical professional (paramedic, RN or MD)


holding valid credentials.

The ability of personnel to fulfill their assigned emergency roles are assessed as part of
the Competence Assessment process as described in Part 2 of this Safety Case,
including during drills and exercises which are described in heading 5.3.2 below.
5.3.2 Drills and Exercises

The Company has procedures in place to ensure personnel are prepared to respond to
emergencies through scheduled drills and exercises. Offshore personnel are required to
participate in regular emergency drills and exercises.

The following emergency response drills are conducted at the specified intervals:

Issue 02 / Revision 00 Hard copies are not controlled Page 14 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

 At least weekly
- Fire drill
- Abandon ship drill

 At least every 60 days

- Confined Space Rescue Drill

 At least every 90 days

- Man overboard
- Environmental spill
- Medical Emergency response
- Search, rescue and mock injury drill
- Helicopter emergency drill
- H2S drill (if H2S is not anticipated)

Other drills, such as well control, damage / flooding control, black out recovery, etc. are
also conducted at regular intervals.

Members of the Corporate Operational Support Team and Operation Incident


Management Team participate in emergency response exercises.

For further information refer to the Security and Emergency Policies and Requirements
[1] and the Corporate Operational Support Plan [7].
5.3.3 HSE Inductions

All Company, customer and subcontractor personnel who work at or visit any Company
Installation, Facility or Office are given an HSE Orientation. The HSE orientation will be
conducted in phases. The phases are as followed:

Phase I - All personnel

All returning crew members to the installation are required to undergo an HSE review
briefing with the Master / OIM, or his designated representative, within 6 hours of arriving
onboard. The briefing includes:

 Be introduced to the Master / OIM

 Be informed of recent installation incidents and HSE performance

 Be informed of current operations and any hazards

 Communicate with Rig HSE Advisor regarding required training for type of work to be
performed while on board

Issue 02 / Revision 00 Hard copies are not controlled Page 15 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Phase II - Personnel who have received an Installation HSE Orientation, documented in


GMS, and have previously been on the installation but not in the last 12 months or have
been on a different Company installation within the last 12 months.

 Receive Phase I information

 Receive a Welcome Onboard Card specific to that installation and a review of its
content

 Full HSE Orientation tour

Phase III - Personnel arriving for the first time to a Company installation.

 Receive Phase I and II information

 View Company HSE Orientation DVD

 Be informed of current operations and any hazards associated with them

Individuals are introduced to their supervisor and are responsible to familiarize


themselves with their work area, emergency equipment layout and emergency exits.
Key personnel with specific HSE duties, for example, Installation Medical Person,
emergency response teams receive additional specific instructions relating to their
responsibilities.

Installation Welcome Onboard Card

The Welcome Onboard Card must be issued to all Phase III personnel.

The Installation Welcome Onboard Card includes minimum required information. Any
additions to the Installation Welcome Onboard Card must be approved by the Rig
Operations HSE Manager.

The following information must be made installation specific:

 Emergency signals

 Emergency telephone number

 Important telephone numbers

 Emergency escape route drawings

Personnel must acknowledge receipt of the card by signing the declaration form.

HSE Orientation Tour

Personnel conducting HSE Orientations must ensure all items below are physically
shown to all phase II and III personnel (excluding accompanied day visitors).

Minimum requirements for HSE Orientation Tour:

Issue 02 / Revision 00 Hard copies are not controlled Page 16 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Accommodation

 Muster point

 Offices (Master / OIM, Rig HSE Advisor, and others as necessary)

 Location of meetings

 Waste facilities

 Cabin layout

 Recreational areas (including smoking facilities)

 Galley

 Laundry

 Emergency routes

 Hospital

Outside

 Lifeboats / muster points

 Drain plugs (one example)

 Escape to sea facilities

 Manual alarm call points and emergency shut off buttons (one example)

 Emergency routes and walkways

 Spill kit location information

 Waste facilities

 Drill floor access walkways (restricted access)

 Designated Smoking area (if applicable)

The HSE Orientation is a tool to inform, not train, personnel. Training is the responsibility
of the supervisor and this will be given as required.

For further information refer to the HSE Orientation policy in the Health and Safety
Policies and Requirements [8].

5.4 Temporary Refuge Assessment


5.4.1 Temporary Refuge (TR) Concept and Description

A Temporary Refuge (TR) is intended to provide a safe location to assess and monitor
an emergency, and to make command decisions regarding emergency response and/or

Issue 02 / Revision 00 Hard copies are not controlled Page 17 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

evacuation. The Accommodation is the designated TR. The Bridge is designated as the
Emergency Control Center (ECC).

The TR has been designed, constructed and equipped to act as a command center and
refuge during emergencies.

Internal Bulkheads, fire boundaries, stairways and alleyways, leading to the muster area,
the Lifeboat Stations and the Helideck, are protected by structural fire protection,
ventilation dampers’ shut-offs, both manual and automatic, and fire doors to prevent the
egress of smoke and fire, spreading through the Installation’s Accommodation.

The Accommodation is maintained over-pressurized to prevent the ingress of potentially


flammable gas/air mixture, toxic gas and smoke. Smoke detectors have been installed
in all areas within the quarters.

There are smoke detectors, heat detectors, flame detectors and gas sensors located
throughout the ship. The Fire and Gas (F&G) Detection System provides the means for
detecting the presence and accumulation of combustible or toxic gases and/or an
outbreak of fire. Visual and audible indication of a detection incident will be transmitted
to the fire and gas alarm station on the Bridge for manual or automatic execution of
control actions and the initiation of alarms.

Several low level HVAC shutdowns are configured to take place automatically upon
detection of certain hazardous conditions. Automatic shutdown of HVAC will be initiated
by shutting down all the ventilation fans and accommodation dampers

Muster Areas

The muster areas are located at the forward and aft areas of the vessel – both port and
starboard.

The Rig Emergency Response Plan [5] and Station Bill [6] include locations of the
muster areas and alternative muster areas for all personnel and response teams and
assignments for lifeboats.

A current POB list is maintained, which is readily available at all appropriate muster
locations. A copy of the current POB for the rig is transmitted at least daily to the shore
base office.

5.5 Details of Evacuation and Escape Equipment


5.5.1 Evacuation and Escape Systems

The arrangements and details of the Rig escape, evacuation and lifesaving equipment
and systems are described in Part 3 heading 3.6 Evacuation and Escape Systems.
Additionally, arrangements for drills on the Rig, including mustering and evacuation
exercises, are described in Part 5 heading 5.3.2 Drills and Exercises. Requirements to
ensure personnel are familiarized with the Rig, including evacuation routes, safe areas,
and emergency response equipment, are described in Part 5 heading 5.3.3 HSE
Inductions.

Issue 02 / Revision 00 Hard copies are not controlled Page 18 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

Escape Routes

Escape routes have been determined for all normally manned spaces and are indicated
on the Firefighting and Live Saving Plan [9].

All main equipment spaces are provided with at least two means of escape, both leading
to the external main escape routes, and are clearly defined by photo-luminescent signs
and arrows indicating the direction to the lifeboat stations and muster areas. Provisions
have been made on major escape routes for carrying stretchers and firefighting
equipment.

Muster areas have been provided fore and aft on the vessel both interior and exterior.
Station Bills posted throughout the installation illustrate the muster area locations. In the
event of an emergency, PA announcement will be broadcast advising personnel of the
muster area to use.

Internal bulkheads, fire boundaries and passageways leading to the muster areas, to the
lifeboat stations and to the helideck are all protected by structural fire protection,
ventilation dampers, and fire doors to prevent the spread of smoke and fire.
5.5.2 Means of Recovery to a Place of Safety

During an emergency, the first measure undertaken is an emergency disconnection


sequence (EDS) followed by a move-off location. If this is unsuccessful, the preferred
means of evacuation is by helicopter. Evacuation of the Rig follows the means
described in the Evacuation Systems subsection in section 5.5.1 Evacuation and Escape
Systems.

Location specific rescue arrangements and support, and the estimated survival times for
personnel in the sea, vary with rig operating location. More information is provided in
heading 0 below.

5.6 Establishing and Approving Location Specific Emergency


Response Arrangements with Customer
The following means of evacuation and escape are available on the Rig, in the preferred
order listed below:

 Helicopter – Is the primary and preferred means of evacuation in the event that
evacuation is necessary and it is possible to get onshore support. Helicopter
evacuation may take time depending on the distance to shore. The Rig helideck
would require to be operational at the time of evacuation. In the event of a major fire
or explosion, loss of stability, or other rapidly progressing event, helicopter
evacuation would be unlikely.

 Lifeboats – Are the secondary means of evacuation in the event that helicopter
evacuation is not possible. The Rig is equipped with eight 53-man davit-launched
lifeboats:
- two lifeboats on the port and starboard sides forward

Issue 02 / Revision 00 Hard copies are not controlled Page 19 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

- two lifeboats on the port and starboard sides aft.

All lifeboats have been designed as per SOLAS to be self-righting and outfitted with
safety equipment (e.g. external water spray system, smoke ingress protection,
emergency rations, portable GMDSS handheld radios, and radar transponders) in
accordance with SOLAS Regulations.

 Liferafts – Are the primary means of escape in the event that lifeboat evacuation is
not possible. The Rig is equipped with 16, 25-person self-inflating life-rafts.

 Secondary Escape – Secondary escape (abandonment) arrangements are in place


in the event that both primary and secondary means of evacuation and primary
means of escape are not possible. There are two escape ladders located at the port
and starboard forward lifeboat muster station on B Deck.

Lifeboats and evacuating personnel from the facility and liferafts with people escaping
will collect together once in the water. If a Standby Vessel (SBV) is on station, each
lifeboat will attempt to transfer survivors to the SBV, as weather and safety conditions
permit. If applicable, the SBV may use an onboard fast rescue craft or may rescue
survivors directly onto the vessel. The success of this operation depends on the
prevailing weather condition. The Rig also has its own fast rescue craft. In situations
where a significant number of the people end up in the water, helicopter assistance will
reduce the rescue time.

The bridging document provides the location specific details for rescue arrangements
and may include estimated survival times in the sea and estimated recovery times from
the sea for each reasonably foreseeable event likely to lead to the need for recovery or
rescue.

5.7 References
[1] Security and Emergency Management Policies and Requirements, Manual No: HQS-
HSE-PP-03

[2] Petrobras 10000 Hazard Register

[3] Petrobras 10000 MAHRA Report

[4] Brazil Rig Cell Onshore Emergency Response Plan – BZL-HSE-PR-01

[5] Petrobras 10000 Emergency Response Plan

[6] Petrobras 10000 Station Bill

[7] Corporate Operational Support Plan, Document No: HOU-HSE-PR-01

[8] Health and Safety Policies and Requirements, Document No: HQS-HSE-PP-01

[9] Petrobras 10000 Firefighting and Live Saving Plan

[10] Governing Principles, Document No. HQS-CMS-GOV

Issue 02 / Revision 00 Hard copies are not controlled Page 20 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 5: Emergency Response

[11] Petrobras 10000 Shipboard Oil Pollution Emergency Plan (SOPEP)

Issue 02 / Revision 00 Hard copies are not controlled Page 21 of 21


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

CONTENTS

6 Performance Monitoring ...................................................................................................... 2


6.0 Introduction.................................................................................................................. 2
6.1 Performance Monitoring .............................................................................................. 2
6.2 Monitoring.................................................................................................................... 3
6.2.1 Incident Reporting and Analysis ............................................................................... 4
6.2.2 Behavior-Based Observation Systems..................................................................... 5
6.2.3 Occupational Health / Environmental Monitoring and Measurement ........................ 6
6.3 Audit and Audit Compliance......................................................................................... 7
6.4 Verification of HSE Critical Activities / Tasks and Equipment / System ........................ 8
6.5 Certification ............................................................................................................... 10
6.6 References ................................................................................................................ 10
6.7 Attachments .............................................................................................................. 10

Issue 02 / Revision 00 Hard copies are not controlled Page 1 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

6 PERFORMANCE MONITORING

6.0 Introduction
Part 6 of the Pretobras 10000 (herein called ‘the Rig’) Safety Case describes the
arrangements for the periodic monitoring of key risk management control measures to
ensure they are implemented, maintained, and remain effective. Periodic monitoring
activities include monitoring, audits, verification, and classification activities.

To provide assurance that Transocean (the Company) is managing HSE risks effectively,
Safety Case Part 2 – HSE Management System, Part 3 – Rig Description and
Supporting Information, Part 5 – Emergency Response, and Part 6 – Performance
Monitoring (this part) are all applied in conjunction with the structured risk management
process described in Part 4 – Risk Management.
Figure 6-1 Interrelationship of Safety Case Parts

6.1 Performance Monitoring


Performance monitoring is a critical part of the Company’s HSE Management System
described in Part 2 of this Safety Case in section 2.4 Performance Monitoring and
section 2.5 Management Review and Improvement. Performance monitoring is used to
determine how effectively policies, plans and procedures are being implemented, and to
identify opportunities for improvement.

Performance monitoring may be active, i.e. setting expectations and measuring against
them, or reactive, i.e. measuring incidents, including near hits, after they have occurred
in order to learn and improve.

Performance monitoring can be considered to have three major aspects:

 Periodic Monitoring – Supervisors and line management perform periodic


performance monitoring as part of their day-to-day activities to ensure that plans and

Issue 02 / Revision 00 Hard copies are not controlled Page 2 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

operations are implemented and maintained to manage all identified HSE hazards
and risks. Periodic monitoring is described further in section 6.2.

 Audit and Audit Compliance – Audit and audit compliance is an assessment of the
overall effectiveness of the HSE Management System and is generally performed by
personnel not directly responsible for the unit/operation. Audit and audit compliance
is described further in section 6.3.

 Verification of HSE Critical Activities/Tasks and Equipment/Systems – Verification of


HSE critical activities/tasks and equipment/systems includes confirmation that HSE
critical activities/tasks are understood and that the HSE critical equipment/systems
are working effectively. The verification (assurance) may be performed by Company
personnel not directly responsible for the Rig’s operations or by an external party
(e.g., regulator, customer or other third party). Verification (assurance) of HSE
critical activities/tasks and equipment/systems is described further in section 6.4.

6.2 Monitoring
Daily Monitoring and Inspections

Line managers and supervisors monitor HSE performance on a daily basis by following
processes such as the START Conversations process and by direct supervision and
participation in work activities. Daily monitoring of HSE performance onboard the Rig is
achieved in a variety of ways including:

 Control of Work Planning Meeting – The daily Control of Work Planning Meeting
provides effective Control of Work by ensuring activities are reviewed, prioritized and
planned, adequate supervision is available, resources are appropriately assigned,
relevant personnel are aware of the work, potential conflicts are managed and
appropriate approvals are in place.

 Daily Operation Meeting – The Daily Operation Meeting, which is held with the
Master / OIM and Department Heads, or their designees, includes a discussion of
any HSE concerns or trends that have been reported in the preceding 24 hours.

 START Conversations – The START Conversations process is a behavioral based


process to observe workplace practices and workplace conditions in order to
maintain and improve safe behaviour.

 Task Planning and Risk Assessment process – The Task Planning and Risk
Assessment process is the Company’s process for planning and risk assessing all
tasks.

 Pre-Tour Meetings – Pre-Tour meetings are conducted for all personnel before each
normal and short change shift/tour and before leaving the accommodation/office
area. These meetings are part of the hand-over process to ensure that personnel
starting work are aware of responsibilities for the current and planned operations.

Issue 02 / Revision 00 Hard copies are not controlled Page 3 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

 Permit to Work – The Permit to Work process is for ensuring that, prior to
commencing potentially hazardous work; appropriate controls and approvals are in
place and are maintained throughout the activity.

Proactive Performance Measures

The Company has an Incident Reporting policy in the Health and Safety Policies and
Requirements [1] which includes the reporting of a number of indicators which are
periodically monitored and evaluated to ensure HSE performance objectives are being
met. These measures provide an indication of current performance and act as an
indicator of future HSE performance, and include:

 Reporting and reviewing Near Hits (NHs) and Serious Near Hits (SNHs) – Diligent
reporting of NHs and SNHs is a key component of the Company’s reporting
procedure.

 Reporting and reviewing Potential Severity of Incidents – Potential severity is


calculated by considering the potential outcome of an Incident with a slight, and
realistic, change in circumstances.

The Company has a START Conversations policy in the Health and Safety Policies and
Requirements [1]. START Conversations are used proactively, including during START
Tours, to identify and correct at-risk/unsafe practices or conditions before an incident
occurs.

Proactive performance measures are periodically discussed and reviewed at all levels in
the Company, and are recorded in the Company’s Global Management System (GMS).

Reactive Performance Measures

The Company has Incident Reporting and Incident Investigation policies in the Health
and Safety Policies and Requirements [1], which include the reporting and investigation
of a number of reactive performance measures to monitor and provide an indication of
current HSE performance trends.

Reactive performance measures are periodically discussed and reviewed at all levels in
the Company, and are recorded in the Company’s Global Management System (GMS).
6.2.1 Incident Reporting and Analysis

The Company has Incident Reporting and Incident Investigation policies in the Health
and Safety Policies and Requirements [1], which includes requirements that all incidents
are reported and investigated.

The purpose of the Incident Reporting policy is to ensure that when an incident occurs at
a Company installation, facility or office:

 Action is taken to ensure the area is safe and appropriate response initiated

 The incident is reported internally and externally, as required

Issue 02 / Revision 00 Hard copies are not controlled Page 4 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

The purpose of the Incident Investigation policy is to ensure that a consistent


investigation process is applied to determine the root cause(s) of incidents and to
capture lessons learned.

Incidents are periodically analyzed and reviewed at all levels in the Company, and are
recorded in the Company’s Global Management System (GMS). These Incidents
include both non-work related injuries and illnesses and work related incidents.

Incident Investigation

The Company’s approved incident investigation methodology is Kelvin TOP-SET®. The


Company’s Incident Investigation policy includes a requirement that the Rig must have at
least one person onboard at all times that has completed the TOP-SET® Senior
Investigator training.

The required terms of reference for incident investigation include identifying any failed
barriers and any system level weaknesses.

Incident investigations are documented in GMS. Any corrective actions or improvement


opportunities identified during investigations are defined, implemented, and tracked in
the FOCUS module of GMS.
6.2.2 Behavior-Based Observation Systems

The Company’s behavior-based observation process is the START Conversations


process which is used to observe workplace practices and workplace conditions in order
to maintain and improve safe behaviour.

The purpose of the START Conversations process is to ensure that we:

 Engage people in observing activities and work areas.

 Identify and correct at-risk behaviors and conditions.

 Identify and reinforce safe behaviors and conditions.

 Require people to have effective conversations about behaviors.

 Track and trend safe and at risk behaviors and conditions.

 Demonstrate that personnel are committed to achieving and maintaining a safe


working environment.

All personnel working on or visiting the Rig are trained in the START Conversations
process and are required to participate in START Conversations. Supervisors are
responsible for ensuring that personnel receive the training necessary to effectively
participate in the START Conversations process.

For mentoring, coaching and verifying effectiveness of START, all supervisors are
encouraged to take the lead on a START Tour at least once per day. They must be
accompanied by one other person, from any department; that person can be a
supervisor, non-supervisor, Transocean, customer or subcontractor.

Issue 02 / Revision 00 Hard copies are not controlled Page 5 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

The Master / OIM ensures that an effective system is in place for tracking, reviewing and
trending START Conversation Tracking Cards.

The Rig Manager reviews observation trends, ensures that appropriate proactive
measures are implemented and that the necessary resources are provided.
6.2.3 Occupational Health / Environmental Monitoring and Measurement

Occupational Health
The Company has a number of Occupational Health policies in the Health and Safety
Policies and Requirements [1], including policies for Hazardous Materials, Pathogens,
Respiratory Protection, Noise, and Hand Arm Vibration.
These policies include requirements for monitoring occupational health exposures at the
worksite and in the living quarters.

The purpose of the Hazardous Materials policy is to heighten the awareness of


personnel and reduce exposure to harmful effects associated with hazardous materials.
The purpose of the Pathogens policy is to control exposure to blood and body fluid
pathogens in the work place.
The purpose of the Respiratory Protection policy is to protect personnel from the health
hazards associated with airborne contaminants.
The purpose of the Noise policy is to protect personnel from the health hazards
associated with high noise.
The purpose of the Hand Arm Vibration policy is to to provide awareness of safe working
practices to personnel who use vibrating tools and minimize the associated exposure.
For further details of these policies refer to the Health and Safety Policies and
Requirements [1].
Environmental Monitoring and Measurement

The Company has a Monitoring and Measuring policy in the Environmental Policies and
Requirements [2], which includes requirements for monitoring and measuring discharges
and emissions.
The purpose of the Monitoring and Measuring policy is to ensure compliance of
Company requirements and environmental legislation.
The following information is recorded on board the Rig in the Global Management
System (GMS):
 Loss of containment
 Waste produced
 Emissions
 Discharges
Progress against objectives and targets is monitored on board the Rig.

Issue 02 / Revision 00 Hard copies are not controlled Page 6 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

For further details of the Monitoring and Measuring policy refer to the Environmental
Policies and Requirements [2].

6.3 Audit and Audit Compliance


The Company has an Audit and Compliance Policies and Requirements [3] which
includes Management System Audit (MSA), Self-Verification and Division Verification
(SV/DV), ISM Code and Requirements and ISPS Code and Requirements policies.
The purpose of the MSA policy is to define the requirements for verifying compliance
with, and measuring the effectiveness of, the Company Management System (CMS) in
order to:
 Provide a service that ensures Company location personnel are assessed for
understanding and implementation of, and compliance with, Company Requirements
by personnel independent of the location
 Provide constructive feedback to installations
 Identify improvement opportunities for the Company
MSAs are conducted by trained Auditors who have been selected based on their
knowledge, skills and experience.
The MSA process includes referring to the Rig’s Major Accident Hazard Risk
Assessments (MAHRAS) [Part 4, Attachments 4.1-4.4] in order to assess compliance
with the CMS.
The purpose of the SV/DV policy is to verify effective implementation and understanding
of, and compliance with, the CMS on Company installations.
The purpose of the ISM Code and Requirements policy is to ensure that all personnel
with responsibilities related to compliance with the ISM Code (reference ISM Code and
Guidelines 2010) are aware of and meet the ISM Code requirements.
The purpose of the ISPS Code and Requirements policy is to ensure that all personnel
with responsibilities related to compliance with the International Ship and Port Facility
Code (reference ISPS Code and Guidelines, 2003) are aware of and meet the ISPS
requirements.
Tracking of items arising from audits is recorded in the SV/DV and FOCUS modules in
GMS. MSA Lead Auditors initiate FOCUS items based on any corrective actions or
improvement opportunities identified during the audit.
The MSA evaluates aspects of internal and external audits, inspections, reports and
surveys including regulatory, class society, flag state and customer audits, inspections,
reports and surveys.
The MSA audit report is distributed and reviewed at all levels of the Company including
by the President and Chief Executive Officer.
The SV/DV process has three parts:

 Self-Verification - Selected verification questions are distributed to the Rig’s Master /


OIM, who then allocates the questions to selected supervisors (or to himself) to form

Issue 02 / Revision 00 Hard copies are not controlled Page 7 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

the basis of a discussion with appropriate crew members. Based on the responses,
the Master / OIM can determine the degree of knowledge and understanding of, and
whether there is compliance with, the CMS

 Division-Verification - On completion of the Self Verification (SV), the same


verification questions and the results are provided to the Rig Manager. The Rig
Manager confirms the accuracy of the results by asking the same questions while on
board the Rig

 Review of responses by onshore subject matter specialists

For more information relating to the Management System Audit (MSA), Self-Verification
and Division Verification (SV/DV), ISM Code and Requirements and ISPS Code and
Requirements policies, including audit scope, audit criteria, scheduling of audits, audit
team composition, management of audit findings and audit report distribution refer to the
Audit and Compliance Policies and Requirements [3].
Types of Audit and Assessment
The types of audits and assessments conducted on board the Rig include:
 Internal
- Self-Verification
- Division Verification
- Marine Integrity Reviews
- Rig Condition Assessments
- Management System Audit
- ISM
- ISPS
 External
- Regulatory inspections and audits
- Class Society surveys and inspections
- Flag State surveys and inspections
- Customer audits and inspections

6.4 Verification of HSE Critical Activities / Tasks and Equipment


/ System
As described in 6.3 above, the Company has an Audit and Compliance Policies and
Requirements [3] which includes a Self-Verification and Division Verification (SV/DV)
policy.

The purpose of the SV/DV policy is to verify effective implementation and understanding
of, and compliance with, the Company Management System (CMS) on Company
installations.

Issue 02 / Revision 00 Hard copies are not controlled Page 8 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

This is achieved by evaluating and verifying personnel’s knowledge and understanding


of, and compliance with, the CMS, including HSE critical activities/tasks and
equipment/systems, by asking open-ended questions derived from policies and
procedures within the CMS. Verification questions are released on a periodic schedule
in GMS.

As described in 6.3 above, the SV/DV process has three parts:

 Self-Verification,

 Division-Verification, and

 Onshore review of responses

Safety Critical Systems (SCSs)

A number of Safety Critical Systems (SCS), which are designed to prevent or mitigate a
major accident, were determined during the Rig Major Accident Hazard Risk Assessment
(MAHRA) process, which is described in Part 4 of this Safety Case.

Performance Standards [4] have been developed for these Safety Critical Systems
including Performance Standards for 3rd Party (temporary) Safety Critical Systems.

The Performance Standards [4] include ‘Assurance Activities’ which are test and
examination tasks to determine the continue suitability of the SCS, i.e. that the SCS is
meeting its Performance Standard. These Assurance Activities are scheduled and
recorded in the Company’s Rig Management System (RMS).

Inspection and Maintenance of SCS Components

Inspection and maintenance tasks for ensuring that the components of Safety Critical
Systems are in the required condition are also scheduled and recorded in the Company’s
Rig Management System (RMS).

Safety Critical Activities

A Safety Critical Activity is an activity which ensures that major hazard barriers are
implemented, monitored, tested or verified.

These SCAs correspond to the responsible persons for operating and/or maintaining a
major hazard barrier determined during the Rig Major Accident Hazard Risk
Assessments (MAHRAs) [Part 4, Attachments 4.1-4.4] and those who are delegated by a
responsible job position to carry out these activities.

A Rig Safety Critical Activity (SCA) Matrix has been developed to identify the SCAs each
job position is required to undertake. The matrix divides the SCAs by Major Accident
Hazard Risk Assessment. The SCA Matrix and SCA Data Sheets are included as
Attachment 6.1.

Issue 02 / Revision 00 Hard copies are not controlled Page 9 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case
Petrobras 10000 Safety Case
Part 6: Performance Monitoring

6.5 Certification
The Company maintains the Rig in compliance with the applicable Flag State,
Classification Society and Coastal State requirements.

The Rig is registered in the Marshall Islands and is classified by ABS.

The Company has a Certificate and Survey Handbook [5] which includes the
requirements for maintaining compliance with Flag State, Classification Society and
Coastal State requirements. The purpose of the Certificate and Survey Handbook [5] is
to guide the persons responsible for regulatory compliance.

The Company’s Rig Management System (RMS) has a Marine Certificates and Surveys
module which includes a reporting function for the status of certificates and surveys.

Current regulatory certificates, such as the Certification of Classification, Certificate of


Registry and the IMO MODU Code Safety Certificate, are held on board the Rig. A full
listing of applicable certificates is maintained in the Certificate and Survey Handbook [5]
and on board the Rig.

For further details refer to the Certificate and Survey Handbook [5].

6.6 References
[1] Health and Safety Policies and Requirements, Document No: HQS-HSE-PP-01

[2] Environmental Policies and Requirements, Document No: HQS-HSE-PP-02

[3] Audit & Compliance Policies and Requirements, Document No: HQS-CMS-PP-01

[4] Performance Standards DP

[5] Certificate and Survey Handbook, Document No: HQS-OPS-HB-03

6.7 Attachments
Attachment 6.1 – SCA Matrix and SCA Sheets

Issue 02 / Revision 00 Hard copies are not controlled Page 10 of 10


Rev Date: December 13, 2016 Petrobras 10000 Safety Case

Vous aimerez peut-être aussi