Can A Wartsila Vasa 32 Diesel Really Self-Destruct?

Engineering Marine Engineering
1

One of the suggested ignition sources for the Deepwater Horizon explosion was that the No. 3 engine ingested hydrocarbon gas, went into overspeed, and self-destructed.

The engine was a Wartsila 18V32LN(E) attached to an ABB AMG 0900XU10 generator. Witness accounts and location of damage and injuries are consistent in pointing to an explosion in the vicinity of the No. 3 engine room. Witness accounts are inconsistent in whether power was lost before or after the explosion. There are also witness accounts of lights and computer monitors “popping” before the explosion. Engine room personnel reported consistently that the engines were increasing speed up to the instant of explosion.

The No. 3 engine was protected by three overspeed devices:

A Diesel Engine Speed Measuring System connected to a Simrad Integrated Automated Control System (IACS). If the measured speed is 13% above normal, the IACS cuts both fuel and air supplies.

A Woodward 723 Governor/Actuator that senses engine speed and will move the fuel rack to the zero position and send a shutdown signal to the IACS if speed gets to 15% above normal.

A Mechanical Overspeed Trip Device attached to the camshaft that operates by centrifugal force and which will move the fuel rack to the zero position and send a shutdown signal to the IACS at 18% above normal speed.

The No. 3 engine used engine room air from ventilation inlets, which were 15-20 feet from the source of the escaping hydrocarbon gas. The engine shutdown and ventilation damper closing mechanisms connected to the gas alarms were not set on automatic. The engine air cutoff valves were not connected to gas alarms and were not actuated by the crew.

The assumed composition of the gas was approximately 74% methane, 7% ethane, 5% propane and the rest miscellaneous hydrocarbons.

I have three questions:

  1. The IACS represents a single point of failure for air/gas cutoff. Does anyone out there have any evidence, anecdotal or otherwise, pertaining to the reliability of Simrad IACS units?

  2. The testimony of the engine crew suggests that the engines were controlled through the fuel supply and that air cutoff was a seldom-used feature. Is this conclusion reasonable?

  3. The normal operating speed of the engines was 750 RPM. Would anyone care to speculate on what the destruction RPM of these engines would be, and how rapidly they could reach that speed?

Any and all response will be greatly appreciated.

Cheers,

Earl

2

[QUOTE=Earl Boebert;117884]

I have three questions:

  1. The IACS represents a single point of failure for air/gas cutoff. Does anyone out there have any evidence, anecdotal or otherwise, pertaining to the reliability of Simrad IACS units?

  2. The testimony of the engine crew suggests that the engines were controlled through the fuel supply and that air cutoff was a seldom-used feature. Is this conclusion reasonable?

  3. The normal operating speed of the engines was 750 RPM. Would anyone care to speculate on what the destruction RPM of these engines would be, and how rapidly they could reach that speed?

[/QUOTE]

1.) Given the conditions described, it is probably irrelevant.

2.) Very reasonable.

3.) A diesel will happily run on natural gas and with an abundance of it available along with pilot fuel, it will accelerate rapidly. I have no idea what the terminal speed might be but it is reasonable to postulate that the engine could accelerate to destruction faster than the supply of pilot fuel was depleted by the governor and/or safety system cutting it off.

3

A good mechanical engineer can calculate the forces needed to cause failure of specific parts of the gen set, but you are going to need a lot of data from the engine and gen set makers and a lot of expert witness time to reach a supportable conclusion. Further, what happened first ----- [I]Ignition of the gas cloud or an engine failure that caused ignition of the gas cloud ?[/I]

.

4

[QUOTE=+A465B;117902]A good mechanical engineer can calculate the forces needed to cause failure of specific parts of the gen set, but you are going to need a lot of data from the engine and gen set makers and a lot of expert witness time to reach a supportable conclusion. Further, what happened first ----- [I]Ignition of the gas cloud or an engine failure that caused ignition of the gas cloud ?[/I]

.[/QUOTE]

As far as what happened first, like so much about that casualty the answer is “we’ll never know.” But it is possible to enumerate plausible scenarios. In this case, one would be that the engine ran away at a rate too fast for the the IACS to starve it of air. At some speed the generators were over voltage or frequency sufficient to damage the more fragile gear such as computer monitors. At a higher speed the generator frequency control cut power to the rig. Then the either engine blew up or its overheated exhaust manifold ignited the gas in the engine room.

Another scenario that has been put forth is that when the No. 3 engine was fed by an uncontrolled fuel source it took all load, causing the No. 6 engine to trip off to prevent reverse power. The power management system would then try to restart another of the six engines to maintain station keeping power (this was a DP rig), and the start sequence ignited the gas.

Cheers,

Earl

5

[QUOTE=Earl Boebert;117884][
[/FONT]

  1. The IACS represents a single point of failure for air/gas cutoff. Does anyone out there have any evidence, anecdotal or otherwise, pertaining to the reliability of Simrad IACS units?

  2. The testimony of the engine crew suggests that the engines were controlled through the fuel supply and that air cutoff was a seldom-used feature. Is this conclusion reasonable?

  3. The normal operating speed of the engines was 750 RPM. Would anyone care to speculate on what the destruction RPM of these engines would be, and how rapidly they could reach that speed?

Any and all response will be greatly appreciated.

Cheers,

Earl[/QUOTE]

I am not familiar with the Simrad system that was onboard. If the air supply cut off did not function properly, then you basically have a running engine engulfed in a cloud of natural gas. You can secure all the diesel to the engine and with the natural gas in the air this becomes a uncontrolled fuel supply. Most any engine given this condition will continue to increase RPM until either the fuel source is secured or it self destructs.

An air supply cut off is probably the least common method of shutting down a diesel engine of any size. It would not surprise me at all, if it was not being tested properly, if at all. Then when it did get tested did anyone actually check to see if the flap actually cut off the air supply, or did the fuel supply cutoff actually stop the engine during normal over speed testing.

I can not even begin to guess what the self destruct speed of this Wartsilla would be. However with the gas cloud in the air, I would say it would continue to speed up very rapidly.

If generator #3 was continuing to gain RPM, there should have been an over voltage trip which should have tripped the generator off line at some point. however that still would not have shut the engine down, thus it was continuing to gain RPM from the gas cloud. This might be when the blackout occurred. I can agree that if #3 was taking off that #6 should have tripped on reverse power. This might have also put an overload condition on #3 now being the only generator online. The power management system should have tried to start another generator at this time, and put it online. However if the blackout occurred before the backup generator come online, then basically nothing should have happened. Most power management system will not close a generator from a dark ship, someone usually has to manually put the first generator online then power management will take over. Most work that way but not all. If there was generator’s tripping off line under load, I would say there is a good chance a spark could have come from one of the loaded generators, they were no doubt engulfed in gas as well.

Without knowing exactly what happened and in what order it will all be wild ass guess’s

6

[QUOTE=ChiefRob;117932]I am not familiar with the Simrad system that was onboard. If the air supply cut off did not function properly, then you basically have a running engine engulfed in a cloud of natural gas. You can secure all the diesel to the engine and with the natural gas in the air this becomes a uncontrolled fuel supply. Most any engine given this condition will continue to increase RPM until either the fuel source is secured or it self destructs.

An air supply cut off is probably the least common method of shutting down a diesel engine of any size. It would not surprise me at all, if it was not being tested properly, if at all. Then when it did get tested did anyone actually check to see if the flap actually cut off the air supply, or did the fuel supply cutoff actually stop the engine during normal over speed testing.

I can not even begin to guess what the self destruct speed of this Wartsilla would be. However with the gas cloud in the air, I would say it would continue to speed up very rapidly.

If generator #3 was continuing to gain RPM, there should have been an over voltage trip which should have tripped the generator off line at some point. however that still would not have shut the engine down, thus it was continuing to gain RPM from the gas cloud. This might be when the blackout occurred. I can agree that if #3 was taking off that #6 should have tripped on reverse power. This might have also put an overload condition on #3 now being the only generator online. The power management system should have tried to start another generator at this time, and put it online. However if the blackout occurred before the backup generator come online, then basically nothing should have happened. Most power management system will not close a generator from a dark ship, someone usually has to manually put the first generator online then power management will take over. Most work that way but not all. If there was generator’s tripping off line under load, I would say there is a good chance a spark could have come from one of the loaded generators, they were no doubt engulfed in gas as well.

Without knowing exactly what happened and in what order it will all be wild ass guess’s[/QUOTE]

Lot of things going on here. If he generator was in parallel operation with another unit it would not be able to increase speed unless it was able to maintain a power level high enough to take the load of the entire plant and then continue to increase power above that at which point all units would begin to increase speed as well or trip out on reverse power.

Light hydrocarbon gasses do not compression ignite in diesel engines. There are a new generation of dual fuel engines that use a pilot injection of fuel oil to initiate the burn of the remaining charge of natural gas just like a spark plug in a gasoline engine. If the fuel supply is removed by the overspeed trip mechanisms the engine may not continue to run even though it is ingesting natural gas.

But, that being said, an engine ingesting natural gas and still injecting fuel will increase its power output. Maybe as the engine’s power output increased and it started taking load from the other units it went into an overload condition? A lot of engines this size have a cylinder relief valve. I do not believe I have ever seen any type of flame arrestor on a cylinder relief valve (like you would see on a crankcase explosion door). Maybe a cylinder relief valve operated and provided the spark to ignite the atmosphere?

7

[QUOTE=87cr250r;117935]Lot of things going on here. If he generator was in parallel operation with another unit it would not be able to increase speed unless it was able to maintain a power level high enough to take the load of the entire plant and then continue to increase power above that at which point all units would begin to increase speed as well or trip out on reverse power.?[/QUOTE]

This is a DP2 class rig the generators were running on a split bus, not in parallel. After thinking about it for a few minutes #6 should not have tripped on reverse power, just because of being on split bus. Something else had to cause #6 to trip off line.

I know I had to change out a 8V71 Detroit that run away on gas, even with the blower flap tripped and the fuel secured at the tank. That one run until it slung the rods out the side, and it did not take it long. Less than 30 seconds for sure it went boom.

8

Where was the switchgear located? A generator tripping off a bus at full load makes quite the arc in the breaker.

Another thing to consider would be the auto-ignition temperature of the natural gas. It’s quite high, though at around 1100-1200 F. I know turbo inlet exhaust temps on modern high speed 4-stroke engines can easily exceed 1100 degrees at full power (I’ve seen 1250+ on our Cat 3500 engines). So even though the exhaust stream is at 1100+ it’s unlikely the surface temp of the pipe would be over 1000 F. But an engine ingesting natural gas could experience significant afterburning while still running normally which could send the exhaust temps high enough that the surface temp of the exhaust piping could exceed the auto-ignition point of natural gas.

9

[QUOTE=87cr250r;117939]Where was the switchgear located? A generator tripping off a bus at full load makes quite the arc in the breaker.

Another thing to consider would be the auto-ignition temperature of the natural gas. It’s quite high, though at around 1100-1200 F. I know turbo inlet exhaust temps on modern high speed 4-stroke engines can easily exceed 1100 degrees at full power (I’ve seen 1250+ on our Cat 3500 engines). So even though the exhaust stream is at 1100+ it’s unlikely the surface temp of the pipe would be over 1000 F. But an engine ingesting natural gas could experience significant afterburning while still running normally which could send the exhaust temps high enough that the surface temp of the exhaust piping could exceed the auto-ignition point of natural gas.[/QUOTE]

The switch gear and all the breakers were in the engine control room which is isolated from the engine room. This rig should have had 2 engine rooms which are isolated from each other as well. More than likely engine’s #1, 2, and 3 were in one engine room, and engine’s #4, 5 and 6 were in a separate engine room. The control room is usually in between them and on deck above, most of the time.

After sleeping on it last night I have to shoot some hole’s even in my first post. This was a DP 2 class rig, running on a split bus. There fore one generator tripping off line should never create a total blackout condition. Loosing one generator will only cause a power loss on that bus. So if they had a complete blackout, they would have had to loose both generator #3 and #6 almost at the same time. Something that is not supposed to happen.

Also after reading back through the accident a little they were sitting on DP in very clam conditions. Hardly no wind and no current, because the rig sat on location for 2 and a half days after the accident with no propulsion to hold it in position. They were not doing much with the derrek. They were not pulling riser or tripping pipe. So they should have actually been using very minimum power. So I really don’t think there was any where close to an overload condition, So the exhaust temps should not have been that hot.

Since it was DP2 and running on spit bus there is no way for one single generator to take the entire load of the plant by itself, unless some one closed the bus tie. So the load that was on #3 and #6 should have pretty much stayed the same even if the other generator did trip off line, since they were only using minimum power. I don’t think the exhaust should have been hot enough to ignite the gas, there was just not enough load on the system.

Since they were running on a split bus one generator tripping off line will never cause one on the opposite bus to go into reverse power. Only if you have 2 generators running in parallel would one trip on reverse power, something else that is never supposed to happen on DP 2 class vessels

10

Hello – I have also had a similar discussion on this topic with other engineers. I was on the Deepwater Horizon for her final commissioning phases in Korea and spent two years there before leaving in 2002. There are so many variables and out of respect for the 11 men lost and those who survived this event I am not going to armchair quarterback a bunch of ideas.

My only real question of the accounts are the lights blowing out and computers frying. If the engines ran away the over voltage and over frequency protection devices for the generator’s breaker would have tripped. If I recall they had Woodward 723 Digital controls and an ABB Synpol D. I don’t recall if the Synpol was configured to trip the breaker or another protection device was used.

To Chief Rob – Horizon was DP3 with 6 separate engine rooms and 8 HV bus sections. Unless they changed things, the bus sections would have been closed in a ring as the SIMRAD power management system had provision to split bus sections in the event of imbalance, HV faults etc.

One more thought, the gas coming from the drill floor was obviously expanding at an incredibly high rate. So the gas would need to pass across the riser deck, into the air intake, through the short duct, into the engine space, through the turbo and then cause the engine to run away. Keep in mind the engine spaces are not rated Class 1 Div 1 so virtually anything in that engine room could have been an ignition source for the gas before it got a chance to be ingested.

  1. The IACS represents a single point of failure for air/gas cutoff. Does anyone out there have any evidence, anecdotal or otherwise, pertaining to the reliability of Simrad IACS units?

The VASA 32’s air cut off devices were mounted on the turbos compressor outlet; work fairly well. You have to keep in mind if the gas did in fact make it into the air box and increase RPM, shutting off the air & fuel on over speed will not immediately stop the engines as it has the gas in the air box to digest.

  1. The testimony of the engine crew suggests that the engines were controlled through the fuel supply and that air cutoff was a seldom-used feature. Is this conclusion reasonable?

Yes, the air cut off are not used on any plant that I am aware of for normal shutdowns. These are for emergency shutdowns like an overspeed.

  1. The normal operating speed of the engines was 750 RPM. Would anyone care to speculate on what the destruction RPM of these engines would be, and how rapidly they could reach that speed?

I’m 99% sure the operating speed of those engines was 720rpm. I worked for Ulstein Bergan and saw a similar size engine run to 1700-1800 briefly. The attached generator sprayed it’s windings throughout the engine room however the engine survived. There were numerous bent valves, broken valve springs and the majority of the connection rod big ends were oval; however the crankshaft journals were fine and deflection was perfect. Lots of variable but I’d say they would go at least 1500 and stay glued together.

THarvey

11

Here’s a drawing of the engine room locations. And thanks to all for the help.

Cheers,

Earl

12

Thanks to all. I can’t get attachments to work, but for those interested a drawing of the engine room layout is here:

The crew members who were in the ECR reported that the damage to walls and doors definitely indicated that the explosion came from the direction of the No. 3 engine room.

Cheers,

Earl

13

Earl try and post some links to the DWH hearings where the engineers and ET testified. We can give it a read thru and a think. I read some of it at the time, but came to no particular conclusion abt the exact source of ignition. Probably i’m just slow. I doubt there was enough time for a manifold to overheat. Make a timeline from the testimony to check if you are headed that way.

Also try Drillers Club forums with your enquiries. Some rig engineers there but mainly drilling side. They pretty much guessed the incident’s root cause very quickly, as in months before the formal inquest.

14

[QUOTE=+A465B;118021]Earl try and post some links to the DWH hearings where the engineers and ET testified. We can give it a read thru and a think. I read some of it at the time, but came to no particular conclusion abt the exact source of ignition. Probably i’m just slow. I doubt there was enough time for a manifold to overheat. Make a timeline from the testimony to check if you are headed that way.

Also try Drillers Club forums with your enquiries. Some rig engineers there but mainly drilling side. They pretty much guessed the incident’s root cause very quickly, as in months before the formal inquest.[/QUOTE]

Thanks. I’ve put the Chief Mechanic’s testimony together her here:

http://bit.ly/16dLtA6

I’m active on Driller’s Club, may give this question a try there.

Also, thanks to tomasharvey, you’re right, normal RPM was 720.

This is for a book I have been working on for the past 2 1/2 years. My intent is to give as accurate a presentation of the evidence as possible, without judgment or speculation. I intend to have the work peer reviewed before publication (I am a veteran of 10 National Academy of Sciences studies, and appreciate the value of this step); the solicitation for peer reviews is here:

Reviewers would remain anonymous unless they choose otherwise.

Cheers,

Earl

15

DP3 vessel with closed bus…not very common, I’ll bet that took some testing to prove to class its safe?

16

Earl,

How about some links to the ET and other engineers testimony? I do not recall if the chief mechanic was in the engine room / MCR at the time. The ones closest to the situation, and multiple testimonies will help understand the timeline. A thought…

17

[QUOTE=powerabout;118040]DP3 vessel with closed bus…not very common, I’ll bet that took some testing to prove to class its safe?[/QUOTE]

Actually it’s very common to have a Class cert to run a DP3 vessel in closed bus. The DP3 vessel that performed the Macondo top kill and recovered the Horizon’s BOP did so in closed bus…I know this because I’m the C/E of that vessel.

18

[QUOTE=+A465B;118097]Earl,

How about some links to the ET and other engineers testimony? I do not recall if the chief mechanic was in the engine room / MCR at the time. The ones closest to the situation, and multiple testimonies will help understand the timeline. A thought…[/QUOTE]

The Chief Mechanic testified he was in the ECR.

The Chief Electronics Technician’s deposition and exhibits are here:

http://www.mdl2179trialdocs.com/releases/release201303141200012/Williams_Michael-Depo_Bundle.zip

The Chief Engineer refused to testify or be deposed. The only evidence we have from him of note is an earlier email where he pleaded for help and said that the maintenance crews were overwhelmed. A scathing evaluation of the state of the rig can be found here:

http://www.mdl2179trialdocs.com/releases/release201303131200011/TREX-22700.pdf

This, naturally was rebutted by an expert witness for Transocean who said everything was just fine.

Cheers,

Earl

19

[QUOTE=Earl Boebert;118125]The Chief Mechanic testified he was in the ECR.

The Chief Electronics Technician’s deposition and exhibits are here:

http://www.mdl2179trialdocs.com/releases/release201303141200012/Williams_Michael-Depo_Bundle.zip

The Chief Engineer refused to testify or be deposed. The only evidence we have from him of note is an earlier email where he pleaded for help and said that the maintenance crews were overwhelmed. A scathing evaluation of the state of the rig can be found here:

http://www.mdl2179trialdocs.com/releases/release201303131200011/TREX-22700.pdf

This, naturally was rebutted by an expert witness for Transocean who said everything was just fine.

Cheers,

Earl[/QUOTE]

I liked the part in the testimony where the mechanic had explained that he had been knocked off his feet and fell into a hole the explosion had opened up. He later ended up in the hospital with a fractured leg and the lawyers were asking him if he had been provided with proper PPE including a hard hat, gloves, and safety glasses. Leave it to the morons, I mean lawyers, to make the decisions that drive the rest of our lives.

20
  1. Can’t answer with any authority
  2. Yes. Very reasonable. Standard practice, with air shutdown being used only for systems checks and emergencies.
  3. Difficult to answer and would involve a lot of speculation absent a detailed engineering analysis. It’s my thought that in an extreme hydrocarbon rich environment the engine could very conceivably accellerate so rapidly, even under considerable load, that even the air trip would be insufficient to cause tripping fast enough to prevent destructive overspeed. Pure speculation on my part but seems reasonable to me.