Cause and event analysis

1. Normal : All training to be done by qualified personnel appointed by the line management New: All personnel who have received training can be used as instructors Non-conformity 5.2.1 October 2002: West Epsilon (WE) starts the assignment on Valhall Flank South (VFS) Natoil is the supplier of SIMOPS cranes to Valhall Flank North (VFN) order of 8 November 2002 August 2002: After start-up on VFS, the employees were given location and crane specific training on the SIMOPS crane by personnel from Natoil Cause and event analysis BP requires Smedvig to install so-called ”dropped object” hatches on the BOP deck After this the training is communicated from person to person Heerema (Tønsberg) was the main contractor for BP. Design and production of hatches and beams was carried out by Bjørge Offshore in Stavanger. The facility was carried out in Rotterdam In the order it is specified that the SIMOPS crane must be identical to the one on VFS. The anti-collision system was an option in the order (spec.6.5) Barrier failure Instructor with inadequate competence (inadequate training programme): Training from person to person is inadequate. Activities Regulations Section 19 relating to competence. The HSE directive 26, section 6.11.4

2. 25 November 2002 the scope was extended to include the anti-collision system for VFN (og VFS) Normal: The FMEA should be a documentation of the effect of failure modes on the operation of the crane including safety system New: The anti-collision system of the crane is not part of the analysis Non-conformity New: FAT didnot comprise checking of the anti-collision system. 5.2.2 Normal : All safety systems must be a part of the FAT programme 5.2.3 The mechanical completion check list made by Natoil 11 April 2003 includes check of mechanical completion for limit switches ”boom up” and ”telescope out”. FAT (Factory Acceptance Test) was carried out 10 April 2003 The anti-collision system was back-ordered for the SIMOPS cranes for VFN and VFS 12 December 2002. Executed as part of crane delivery for VFN FMEA completed 23 January 2003, as built 25 April 2003 Cause and event analysis Barrier failure Deficiencies in FMEA (inadequate safety analysis): Management Regulations Section 13 regarding general requirements to analyses, Activities Regulations Section 43 relating to classification, Machinery Regulations Section 7 ref. attachment 1 Inadequate inspection under FAT (inadequate test programme): FAT lacks a description of the anti-collision system, lack of testing and documentation of the system was not discovered. Activities Regulations Section 14 relating to facility and commissioning, ref. Machinery Regulations Section 7, attachment 1, subsection 4.2.4 inspection before use.

3. Normal: Certificate of application in accordance with AF Section 14 og NORSOK R003N chapter 5.1 New: Maritime (load test) certificate Non-conformity 5.2.4 New: Commissioning does not comprise the anti-collision system Normal: All safety systems must be a part of the test programme 5.2.5 Probably 30 May 2003 The document”Functional Design Specification,Crane” dated25 April 2003 mentions briefly that the anti-collision system has been installed and its mode of operation Allum Marine as issues Certificate of application in May 2003. This was done while the VFN facility was at the building site in Tønsberg Commissioning for the SIMOPS crane to be carried out approx.7 July 2003 Cause and event analysis Certification carried out in accordance with the requirements of the Maritime Directorate’s regulations The document describes the crane ”as built”, and was available on the computer system for personnel on VFN. The certificate does not mention testing of the crane’s safety systems, and no reference has been made to criteria for the scope of the testing – nor acceptance criteria. The certificate does not fulfil the requirements of a Certificate of application Barrier failure Inadequate certification of application and approval of the SIMOPS crane (insufficient preparation for use): The crane does not have a Certificate of application. Instead a load test has been carried out with maritime certification Activities Regulations Section 40 relating to use of work equipment, ref. Regulation relating to use of work equipment section 14, Inspection of work equipment The Activities Regulation Section 44 relating to Maintenance programme subsection f) ref. NORSOK R-003 N subsection 6.1 BP’s Guide for lifting equipment document no 1.70.010 chapter 8.5.3 BP’s HSE directive chapter 26 6.3 Inadequate inspection during commissioning (inadequate procedures relating to change): Missing description of the anti-collision system was not discovered Activities Regulations Section14 relating to completion The Machinery Regulations Section 7, Attachment 1, subsection 4.2.4 Inspection prior to use

4. Normal: RFO certification is a confirmation that all systems have been checked and described in the documentation New: It was not recorded that a description of the anti-collision system was missing from the operating manual Non-conformity 5.2.6 WE arrives on VFN approx 4 - 6 August 2003 Take-over from project to operation : RFOC (ready for operation certificate) form was prepared 6 August 2003 Consent to use VFN was given 14 July 2003 Hook up starts approx. 4 august RFOC shall provide an overview of outstanding work on the SIMOPS crane Cause and event analysis No records concerning faults of the anti-collision system in the RFO Documentation of maintenance and operation inclduing the SIMOPS crane must be a part of the take-over documentation The RFOC check list describes: Operational Manual available in Dokumentum, i.e. the operations manual is available in an electronic database Barrier failure Deficiencies when taking over from project to operation, RFOC (inadequate change procedures): Missing documentation for the anti-collision system was not discovered during the take-over from project to operation. Activities Regulations Section 14 relating to installation and commissioning The Machinery Regulations Section 7, Attachment 1, subsection 4.2.4 Inspection prior to use Activities Regulations Section 18 Start-up and operation of facilities

5. New: The SIMOPS crane is operated while a switch is defective New: Certificate/Certificate of application cannot be produced until three weeks after the incident Normal: The lifting equipment must never be operated when parts of the safety system are inoperable Normal : The Certificate of application must be easily accessible on the facility Non-conformity 5.2.8 5.2.7 Natoil was out 14 August 2003. The proximity switch (boom angle limit switch) was damaged during work on the window washer system on the SIMOPS crane BP has now started using the SIMOPS crane on VFN. No Certificate of application exists on the facility BP cannot produce Certificate of application for the SIMOPS crane until 21 April 2004 Cause and event analysis Natoil replaces the proximity switch. Closed 10 September 2003 (The report has been erroneously dated to 9 October.) No documentation of function testing after the repair work During the period 1-10 September 2003, the crane was in daily use, ref. form for daily check of SIMOPS crane on VFN. This in spite of the fact that the switch was inoperable. Barrier failure The SIMOPS crane is operated while the limit switch is defective (non-conformity with procedure): Regulations relating to use of working equipment Section 15 subsection c) working equipment which could involve special danger in use Inadequate testing: This is work on the safety system, and consequently it should be documented Activities Regulations Section 28 relating to Actions during conduct of activities, ref. NORSOK R-003 N subsection 6.1 Activities Regulations Section 83 relating to lifting operations ref. NORSOK R-003 N subsection 5.5.6 Insufficient documentation (document missing): Certificate of application is not available on the facility. BP did not know if a Certification of application existed. Activities Regulations Section 14 relating to facility and commissioning ref. NORSOK R-003 N subsection 5.1.1.2 BP’s Manual for lifting equipment subsection 8.3 relating to files offshore

6. New: Documentation from the crane supplier is not available on the facility Normal: Adequate user documentation must be available in the crane manual Non-conformity 5.2.9 Basic crane operator training. The relevant personnel have completed the basic requirements for operating a 20 tonne hydraulic crane BP has now started to use the SIMOPS crane on VFN. Documentation is missing from the crane manual. Cause and event analysis • Documentation from the crane supplier is not available on the facility, or it is inadequate: • maintenance procedures- description of anti-collision system- operating instructions General crane operator training is required to operate a SIMOPS crane, (Minimum G20) User manual (crane handbook) is insufficient Barrier failure Missing /inadequate documentation for the SIMOPS crane:Documentation for the SIMOPS crane is non-existent or not available to the user. Activities Regulations Section18 relating to start-up and operation of facilities Activities Regulations Section 14 relating to facility and commissioning ref. NORSOK R-003 N subsection 5.1.2.1. (crane handbook must be available) Activities Regulations Section 83 relating to lifting operations NORSOK R-003 N subsection 4.1 f) Lifting equipment manual subsection 8.3 relating to files offshore.

7. The training was given in August 2002 before the anti-collision system had been ordered and installed on the SIMOPS cranes at VFS. New: Location-specific training has not been provided for the SIMOPS crane with the equipment on VFN Normal: Competence requirements include basic training and location-specific training for the crane to be operated Non-conformity New: BP has not verified the location and crane-specific expertise Normal: BP checks and ensures that training is in accordance with requirements 5.2.10 5.2.11 Crane- and location-specific training. The crane training from VFS was carried on to VFN by having a crane operator who had already been ”cleared” act as an instructor for the new crane operator. Cause and event analysis Through the supervisor the field manager is responsible for implementing training on the SIMOPS crane, ref. HSE directive 26 Demands will be made on safeguarding competence. This entails making demands on, verifying and maintaining this competence through exercise, drills, training and education Personnel on VFN and WE have no knowledge of the anti-collision system and its operation Barrier failure Crane- and location-specific skills were inadequate (insufficient competence) Crane operators do not have knowledge of the anti-collision system. Activities Regulations Section 19 relating to competence, ref. NORSOK R-003 N subsection 4.5.1 relating to training of operators. Activities Regulations Section 40 relating to use of work equipment, ref. Regulations relating to use of work equipment, Section 10 relating to training, drills and instruction of employees. Inadequate inspection of requirements for crane- and location-specific training (insufficient QA programme): BP has not verified the training. No training has been carried out on the anti-collision systems, as the training material does not contain any description of it. Activities Regulations Section 19 relating to competence, ref NORSOK R-003 N subsection 4.5.1 relating to training of operators.

8. 19 February 2004 Natoil cannot complete the repair of the limit switch for boom angle and hook up, owing to lack of parts New: No handling of non-conformity Normal: Handling of non-conformity in BP Non-conformity 5.2.13 New: Planned work on safety system defined as ”non-critical” Normal: Work on safety system is evaluated with high criticality 5.2.12 Approx. 17-19 February 2004 Natoil repairs wire on limit switch for telescope out At the turn of the year 2003/2004, a defect in the limit switch for telescope out was discovered Subsequent facility of anti-collision system on VFS 25 October 2003 Cause and event analysis Natoil also establishes a defect in the limit switch for boom angle and hook up 4 January 2004 Work order (KAO-032703) for wire for limit switch on telescope is broken ”replace wire and limit switch if necessary” BP stopped operation of the crane owing to lack of parts 19 February 2004. Natoil reports that there is no documentation for electricity and hydraulics for the SIMOPS crane Natoil is requisitioned to repair the defect Barrier failure Inadequate handling of non-conformities (insufficient QA programme) Management Regulations Section 20 relating to handling of non-conformities Inadequate risk assessment during the planning of work on safety systems. (The potential risk is not understood):The work is defined as non-critical. Activities Regulations Section 43 relating to classification and 45 relating to planning and priorities.

9. Normal: Work on safety equipment must be carried out or checked by competent personnel New: No inspection by competent personnel (expert activity) Non-conformities 5.2.14 21 February 2004. A work order is established in Work Mate for repair of the anti-collision system 24 February 2004 Parts for the two other limit switches arrive at VFN/BP Cause and event analysis Work order for replacement of boom angle limit switch XS440 (KAO-033708): ”Defective boom angle limit switch replaced. The function is tested after facility and connection” Work order for replacement of upper hook limit switch (KAO-033706): ”Limit switch is defective/broken. The function is tested after facility and connection.” Barrier failure Inadequate planning of work on safety system (insufficient planning): Work on safety systems is planned with personnel without the necessary expertise and without the necessary drawings. No planned verification by expert body. Activities Regulations Section 44 relating to maintenance programme subsection f) ref. NORSOK R-003 N subsection. 6. Inspection, examination and testing subsection 6.1 Activities Regulations Section 43 relating to classification and 45, planning and prioritisation, Activities Regulations Section 40 relating to work equipment, ref. regulation relating to use of work equipment Section 14 inspection of work equipment.

10. The switches are replaced without access to electric or hydraulic drawings Instrument 27/02/04: ”Have replaced 90-xs-128057 with new limit switch. Test OK, NN” 26 February 2004: ”Have replaced the entire limit switch. Test OK, NN” Normal: Drawings available for work to be done New: Drawings missing New: Work on safety system without inspection by expert Non-conformities Normal: Work on safety system to be checked by expert 5.2.15 5.2.16 27 February 2004 Automation expert from Valhall (SWAT) replaces ”boom angle” limit switch on SIMOPS crane VFN 26 February 2004 Automation expert connected to Valhall (SWAT) replaces ”hook up” limit switch on SIMOPS crane VFN Cause and event analysis According to interviews the switches are installed in the same way as the ones removed - the automation expert makes a sketch before replacing them On request the automation expert feels competent to replace the switches The automation expert has no experience with work on cranes Work on safety systems was carried out by personnel without the necessary skills(insufficient competence): Activities Regulations Section 19 Competence Activities Regulations Section 40 relating to Use of work equipment ,ref. regulation relating to use of work equipment, Section 9 Information to employees, 10 Training, drill and instructions to employees and 14 inspection of work equipment BP’s manual for lifting equipment Section 9.5 (i.e. requirements related to use of competent controller) Barrier failure Work on safety systems with the necessary technical Documentation (Documentation missing): Activities Regulations Section 28 relating to Action during conduct of activities. The Machinery regulations, attachment 1 subsection 1.7.4 og subsection 4.4.2. Activities Regulations Section 40 relating to Use of work equipment, ref. regulation relating to use of work equipment Section 9, Information to employees

11. During the period August 2003 - 2 April 2004 several other repairs have been carried out on the SIMOPS crane New: The fact that the crane’s safety system was inoperable was not known Normal: Status of the crane’s safety system must be known Non-conformities 5.1.1 After the repair the limit switch for the ”boom angle” was installed with incorrect polarity. It is not known whether it was installed incorrectly prior to the repair Cause and event analysis 30 December 2003: Loose cable tray at the top of boom Faulty facility means that the limit switch is disconnected 20 February 2004: Motor for window cleaner inoperable The SIMOPS crane does not have a functioning anti-collision system 19 February 2004: Repair of loop on hook block??. (carried out by Natoil) Barrier failure Certain parts of the crane’s safety system do not function. Status unknown (insufficient preparation before use): Lifting appliances must never be operated if the safety systems or parts of the safety systems are out of order. Activities Regulations Section 24 relating to safety systems Activities Regulations Section 83 relating to lifting operation, ref. NORSOK R-003 N subsection 5.5.6 relating to safe use of lifting equipment

12. The crane operators on VFN have no access to the maintenance system (Workmate ) 1 April 2004 The whole work team involved in the incident came onboard the same evening and start their watch at 23:00. Only the flank foreman on VFN has access to the maintenance system New: The crane operator has limited knowledge of the crane’s condition/ status of corrective maintenance Non-conformities Normal: The crane operator is familiar with the crane’s condition before use 5.2.17 Schlumberger is on downtime owing to equipment fault Cause and event analysis Approx. 01:15 Overall supervisor Schlumberger has been on duty for 16 hours and cannot assist in the work relating to troubleshooting on this equipment Repairs are not recorded in the maintenance system, only in the daily inspection form for the crane There were, e.g. multiple faults in the window shield wipers/washers during the period Nov/Dec 2003 og March 2004. Barrier failure Lacking/insufficient access to the maintenance system (insufficient work preparation/basis for work). The crane operator on the SIMOPS crane does not have access to the maintenance system. Activities Regulations Section 23, Use of facilities (relating to status of maintenance) Activities Regulations Section 14 , Installation and commissioning, Ref. NORSOK R-003 N subsection 5.1.2.1 (requirements regarding available documentation) Activities Regulations Section 83, Lifting operations, ref. NORSOK R-003 N subsection 4.5.2.1 follow-up of maintenance. Activities Regulations Section 24, Safety systems. BP’s HSE directive 26, chapter 6.3.

13. Non-conformities New: Only objects falling from the top deck to the Xmas tree deck were evaluated in SAS Normal: Falling objects from WE should have been a part of the risk assessment 5.2.18 BP Well intervention supervisor (WIS) night shift, decides to use Sclumberger personnel to assist ABB in the work on well N14. Safe work review (SAG) is initiated by Sclumberger’s personnel and implemented by the involved. Work permit prepared and approved Cause and event analysis The personnel have experience from WP and Maersk Guardian, where they also ”bumped into" the hatches on the deck of MG above Schlumberger personnel usually operate the SIMOPS crane, ref contract with BP subsection 5.8.1 Since the crane operator is unfamiliar with the anti-collision system, he should initiate measures to prevent collision with WE BP has not identified risk in the operation of the crane when the anti-collision system is out of order Barrier failure The danger of the crane touching the hatches on the BOP deck was not assessed in SAG (insufficient experience transfer / risk was not assessed): Despite previous experience, collision with WE is not considered a risk. Compensatory action is not implemented Management Regulations Section 22, Improvement (Experience transfer) Activities Regulations, Section 83, Lifting operations, ref. NORSOK R-003 N subsection 4.1Activities Regulations, Section28, Actions during conduct of activities (planning of work) Activities Regulations, Section40, Use of work equipment, ref. regulation relating to use of all types of work equipment and Section 7 relating to the employer’s general obligations and Section 43 regarding use of all types of working equipment

14. The window cleaning system was out of order The window cleaner on the roof window is out of order Normal : Check list for safety systems New: The check list is insufficient New: Lifting operation carried out without the necessary visibility Normal: Good visibility to the work area for the crane 5.2.19 Non-conformities Normal : Operator/user of the lifting appliance has an independent responsibility to ensure that the lifting appliance is in proper condition New: inspection prior to use is limited to inspection of the oil level and visual inspection 5.2.20 5.1.2 There is no inspection of the crane before use (inspection prior to use). The crane operator initiates cleaning of window in the operator’s cab owing to poor visibility. The skylight is not cleaned. Form prepared by BP for daily checks does not describe inspection of safety systems Cause and event analysis The crane operator does not have access to the maintenance system, and consequently not status for the SIMOPS crane Flagman fetches a high-pressure washer and washes the side windows of the operator’s cab. No inspection of the anti-collision system. The crane operator is unfamiliar with the operation of the system (not referred to in the crane manual), and has not had training in the system No cleaning because this would require work permit for working at heights. No check of the safety system. No check of status for maintenance. No function testing. 5.2.19: Inadequate procedure for daily check of the SIMOPS crane (insufficient procedure): Activities Regulations Section 22, Procedures. BP’s HSE directive 26 subsection 6.1.5 Activities Regulations Section 40, Use of work equipment, ref. regulation relating to use of work equipment, Section 14 relating to inspection of work equipment. 5.1.2: Inadequate inspection prior to use of the lifting appliance (insufficient preparation): Activities Regulations Section 83, Lifting operations ref. NORSOK R-003 N subsection 5.5 .6 relating to safe use of lifting appliances Activities Regulations Section 19, Competence, ref. NORSOK R-003 N subsection 4.5.2.1 Barrier failure Poor visibility through the roof window (emphasis on time not safety):Cleaning is omitted because it would require work permit for working at heights. Therefore, a choice was made to work with poor visibility through the roof window. Activities Regulations Section 31, Arrangement of work, Section 32, Ergonomic aspects and the Facilities Regulations Section 19 relating to ergonomic design Activities Regulations Section 28, Actions during conduct of activities and 29, Monitoring and control

15. Work on Xmas tree carried out together with ABB (pulling of plug BPV( back pressure valve)) Crane chaser goes down to the Xmas tree deck and manages the lifting of the plug from well N14 via radio. New: Flagman carries out the work of the crane chaser directing the load not following the movements of the crane. Normal: Flagman directs safe movement of crane and hook load Non-conformities 5.2.21 On the top deck work starts on re-installing the well hatch. Operation on well N14 starts. Well hatch is lifted off and put on N2 The roles of crane chaser and flagman mixed during the lift. Cause and event analysis Flagman holds the guide rope fixed to the well hatch As per agreement in SAG meeting, a crane chaser, flagman and crane operator are directly involved in the lifting operation. Flagman does not pay attention to the boom top Flagman and crane chaser put on vests Flagman shoves the well hatch to position it over the hole. Flagman uses lifeline Barrier failure Manning level during operation is not according to procedure (non-conformity with procedure): The jobs of the crane chaser and the flagman are mixed Activities Regulations Section 83, Lifting operations, NORSOK R-003 N subsection 4.5.2.2 BP’s HSE directive no. 26 chapter 6.1.6-7 clearly states the responsibilities and obligations of crane chaser and flagman

16. 5.1.3 Schlumberger has received assurances from Smedvig that the hatches cannot fall down Normal: The crane must not be driven into obstructions (obstacles) New: The crane operator has no inspection with the position of the boom Non-conformities New: ”Dropped object” hatches were not fastened according to procedure Normal: Procedure for fastening is followed 5.1.4 The crane operator extends the telescope to reach N14 with the well hatch. The boom is run into the deck of WE The boom lifts the ”dropped object” hatch on WE from its fastening 2 April 2004 approx. at 06:15 the ”dropped object” hatch from WE falls 14.9 m straight towards VFN Cause and event analysis The crane operator has to lean forward during the lift to get a better view Hatches are not fastened according to procedures Could have lowered the boom (two operations). Chose to extend the telescope (one operation) Smedvig’s procedure states requirements for work with this hatch. The procedure describes how it is to be fastened with chains and shackles to beams Barrier failure Smedvig had not made sure the ”dropped object” hatches were fastened according to procedures (non-conformity from procedure): Activities Regulations Section 22, Procedures Procedure WE-02-06-05,14 incl. facility and maintenance instruction. PBO-8250081-P-04 Inadequate inspection of the position of the boom (insufficient self-monitoring to avoid errors): Compensatory actions to maintain inspection with the boom top were not initiated Activities Regulations Section 19, Competence, ref. NORSOK R-003 N subsection 4.5.2.1 and 4.1.h) BP’s HSE directive 26, subsection 6.7

17. New: Crane operation leaves the crane with load hanging from the hook. Non-conformity Normal : Crane operator must not leave the crane with load hanging from the hook. 5.2.22 The flagman is hit and injured in his right foot and face/jaw The crane operator, work supervisor from Schlumberger and BP’s WIS rush up to help the injured flagman The well hatch starts to swing approx. 1.5 m above the deck Notification of SAR and emergency preparedness on WE works Cause and event analysis Nurse and OIM on WE are notified The ”dropped object”hatch hits both the flagman and the well hatch when falling The crane chaser comes running up from the Xmas tree deck SAR from Ekofisk field centre is requisitioned The well hatch is considered a hazard, and is set down by crane chaser when he arrives The injured is transported onshore after receiving first aid treatment The remaining hatches on WE are secured Barrier failure Inadequate securing of load (non-conformity from procedure): Activities Regulations Section 83, Lifting operations, ref. NORSOK R-003 N subsection 5.5.13. BP’s HSE directive 26 chapter 6.5.1.

18. Non-conformity 2 April 2004. Approx. at 17:00 Investigation group from the PSA/Police and BP arrive on VFN Natoil is requisitioned to go to VFN to assess the SIMOPS crane, and to find out if there is an electronic log in the crane. Arrival 4 April 2004 2 April 2004 The authorities are notified. The PSA is notified at 07:18 The accident area is secured Cause and event analysis There is no electronic log in this type of crane In the notification the ”dropped object” hatch which fell down was reported to weigh 100 kgs, but it turned out to be 357 kgs. Barrier failure

19. Non-conformities Faults are established in the facility of limit switch for boom up. Limit switch is damaged It is established that the limit switch for hook up is broken off. 21 April 2004 PSA’s investigation group receives Maritime loading certificate for the SIMOPS crane on VFN from BP The PSA gives direct order prior to departure 5 April 2004 Cause and event analysis This could have happened when the hatch fell down The order entails temporary termination of work with similar cranes Natoil does not have parts to repair the two limit switches Barrier failure