PIPER ALPHA OIL PLATFORM DISASTER
WHAT HAPPENED?
WHY IT HAPPENED
EVENT SEQUENCE
NATURE OF SYSTEM AND SYSTEM PARTS
DESIGN FAILURES
PEOPLE, WORKPLACES AND MANAGEMENT
TERTIARY INITIATING EVENTS
SECONDARY INITIATING EVENTS
PRIMARY INITIATING EVENTS
Redundant condensate pump A shut down for maintenance. Pipes were removed and replaced with loose fitting blind flanges, with no pressure release valve.
Condensate pump B failed
Shift supervisor had two work permits to complete maintenance work but workers did not complete maintenance work before end of shift.
shift supervisor gave unfinished work permits to contractor, who did not read them, but instead, signed off on them.
Night shift crew commenced with no indication that pump A was shut down for maintenance.
Since pump B had failed, night shift workers decided to fire up pump A.
Condensate gas vapors began steadily leaking out of blind flange
Gas alarms sounded in control room but were ignored by operator, which resulted in the gas finding an ignition source, creating a large explosion which caused a continual release of gas and oil.
Second major explosion from the gas leak that caused the propagation of fire to the first fire wall (Module B)
The gas explosion broke through the fire wall and raged on a constant supply of gas and crude oil
Fire spread from it source and found a large supply of fuel drums beyond the third firewall (Module C)
A third violent explosion resulted
automatic fire fighting system was switched off when divers were working around platform
Communications between platforms were destroyed so other platforms continued supplying Piper Alpha with oil.
Intense heat from explosions cause the steel structures of the platform to melt, leading to the collapse of the Piper Alpha platform
PIPER ALPHA PLATFORM
INTERCONNECTED PLATFORMS
STAFF
WORKERS
divers
maintenance crew
operating staff
ROSTERS
day shifts
night shifts
shift supervisor
control room operator
contractor
Tartan platform
Claymore platform
MCP-01 gas processing platform
Oil platform design failure
Human error
SYSTEM LIFECYCLE
MAINTENANCE
COMMISSIONING
DECOMMISSIONING
CONSTRUCTION
workers
consideration of number of wells to be drilled
recovery techniques for extraction
materials
cost to build platform
separation systems for gas and fluids
treatment systems for preservation of environment
period of production increase
plateau (stabilization phase)
period of injection (such as water, gas or other chemicals to maintain satisfactory production levels)
production decline due to near-depletion of source
depletion of resources
PIPER ALPHA platform destroyed in disaster
dismantling of facility
workers
skills required
time allowed for completion
parts needed / parts to repair
permits to work
FUNCTION
system lifecylce
people
systems usability
interfaces
design of controls
feedback systems
ease of access
Baxter (2016) looks at the premise of learning from failures in design of socio-technical systems, by emphasizing the belief that the socio-technical process should take into account the human-machine relationship factors that influence the usage and functionality of computer-based systems.
IFP School (2015) discusses the life cycle of an oil/gas production platform, highlighting the factors which determine the length in which a hydrocarbon field can remain in operation.
manufacturing
PEOPLE
WORKPLACES
MANAGEMENT
Information transfer
communication
handovers
instructions
Job design
Organisation systems
Management and leadership
Procedures
Polices
Organisations of work
surrounding platforms experienced breakdown in chain of communication
lack of command among platforms
despite seeing the platform on fire, surrounding platforms continued to pump oil to Piper alpha, due to a perceived lack of authority
'permit to work' system not sufficiently implemented or followed,
job sites not inspected before closing or suspending work permits
supervisors neglected workplace policy and left permits on desk in control room instead of delivering it in person to brief management on status of job
worker training was often waived
emergency procedures never accounted for disastrous event that destroyed the platform
emergency training viewed as 'cursory'
no emergency drills practiced regularly
workers who survived disaster claimed they were never trained on location or deployment procedures for life boats
no full-scale shut down of platform procedure practiced
no problems or issues on the platform were reported
management on the platform did not independently review an operations in the 'permit to work' system
lack of information lead to management running on assumptions that there were no problems
management had never been trained on emergency procedures for an event as large as the one that destroyed the platform
rosters
workload
task design
job requirement
supervision
work crew scheduled to conduct routine maintenance on condensate pump A before change of shift
rotating rosters, with changeover at 6pm
regulatory maintenance on pump A
removal and testing of safety valve on condensate pump A. Replaced with loosely installed blind flange not visible to workers. Maintenance not completed before shift turnover.
craft supervisor's decision to suspend permit. It was returned to control room, but the supervisor failed to notify management on job status
two separate work permits issued for maintenance on condensate pump A, neither of which were mentioned in maintenance logs
communication between Piper Alpha platform and surrounding platforms was crucial in emergencies, however, explosions disrupted communication and oil was still being pumped to Piper Alpha
no briefing between shift supervisors on the maintenance work conducted on pump A
new shift supervisor of 6pm crew gave the order to start up condensate pump A after pump B failed
workplace factors
equipment design
work environment
fixed plant design
access
site design
geotech design
capacity to accommodate 200 people and featured a helideck
4 main operating areas separated by firewalls. Despite being converted from a oil processing platform to a gas an oil processing platform, firewalls were not upgraded to provide defense against gas explosions
helicopters and boats were main modes of transport, however, thick smoke from explosions prevented those on board from reaching the life boats as there was only one access route to them
fixed platform in an interconnected hub of platforms
displays
feedback
commands
warning systems
ease of use
inadequacies in platform design, meaning the one route to the lifeboats was inundated with smoke, preventing access
gas alarms sounded when initial gas leak occurred, but the location was not displayed for the control room operator
automatic firefighting system designed to activate when smoke is detected, however it was shut off when divers were working near it. it was switched to manual operation, meaning it did not activate when smoke was detected
control system in operating room poorly designed, meaning the control room operator could not see where gas leak originated from
gas alarms sounded, however, were ignored as there were a number of non-critical alarms sounding as well, so operator ignored them.
temperature
noise
visibility
chemical exposure
poor visibility after explosions due to thick smoke
explosions caused excessive heat on the platform
standard non-critical alarms, but no excessive noise
those on board the platform were exposed to fatal levels of carbon monoxide and other gases are pipelines ruptured
knowledge
competency
goals
work ethic had degraded, with workers only working to complete tasks before shift changeover
all people on board lacked knowledge and training on emergency procedures
workers continually opened and closed doors in accommodation rooms, continually exposing themselves to dangerous levels of smoke and gases
many died from smoke inhalation
no workers were given adequate or regular training
Piper Alpha platform
surrounding platforms
condensate pumps
firewalls
systems of work
no adequate warning systems
gas alarms did not raise concerns
control room did not display where gas leak originated from
loosely installed flange in replacement of safety valve was not visible to workers
only one route to life boats
platforms could still pump oil to Piper Alpha even though it was visibly on fire. No emergency shut off that prevented this
weren't upgraded during oil and gas conversion, meaning firewalls were destroyed in gas explosions
permit to work system insufficient
control room operator
safety adviser and craft supervisor
workers
management
did not train workers on emergency procedures and didn't have knowledge on procedures themselves
systems of work
disregarded likelihood of catastrophic event
did not seek information or review operations on the platform
ran on assumptions that there were no issues
did not abide by policy of how 'permit to work' systems were supposed to be implemented
terminated permit to work with the idea of continuing it the next day
safety adviser did not read over permit to see that the job was incomplete but signed off on it anyway
permits were not written in maintenance logs for management to see
permits were left on control room desk instead of being handed to management in person
ignored gas leak alarms due to complacency from usual non-critical alarms sounding constantly
work ethic disintergrated
did not want to work overtime
installed a blind flange loosely, in an area that was no visible to the workers on the next shift
firewalls weren't upgraded to accommodate for potential gas explosion after platform was converted to duel gas and oil processing plant
limited modes of transport (boats and helicopters) with limited access routs
control room displays did not identify gas leak origin
constant non-critical alarms allowed critical gas alarms to be ignored
automatic firefighting system switched to manual and did not engage when explosions began
no back-up communication systems between Piper Alpha and interconnected platforms as the explosions disrupted communications but surrounding platforms continued to supply Piper Alpha with oil, fueling the blaze
no air-lock systems to prevent smoke inhalation and inhalation of toxic carbon monoxide
location of control room next to production pumps left control room susceptible to being destroyed in fire and explosions
lack of redundancies in commands made it difficult to manually control equipment
location of control room next to condensate pumps
room susceptible to being destroyed by explosions and fire
Loss of command, control and electrical power from control room left the system evidently decapitated
(Pate-Cornell 1993) analyses the failure path of an incident using a risk analysis model structure that ably assists in identifying root causes of systems failures, such as in management decisions, human errors and system component failures.
Johnson (1998) discusses the importance of understanding the relationship between organizational failures and human error, by directing focus to the idea that the failures of an organisation are what initiate the necessary preconditions for human error, and are what exacerbates the consequences of human error.
Andras (2016) discusses the role of structures within an organisation and how communication systems influence faults, errors and failures within that organisation.
Blah (2014) emphasises the importance in having staff trained on emergency procedures of a workplace and how all staff should be knowledgeable on the evacuation routes, which can be aided with signage at regular intervals in the workplace.
These two factors contributed to the mass loss of life on board the Piper Alpha platform.
human supervisory control
automated / manual system
Pannone (2010) discusses the design human machine interface (HMI), in terms of important safety considerations needed to make the HMI work effectively. This includes reducing the likelihood of human error, as it is a large contributing factor to most workplace accidents, by providing a clear presentation of alarms as well a system which has the ability to report errors.
However, the HMI design on the Piper Alpha platform was not effective in providing easily visible alarms, contributing to the destruction of the platform.
Health and Safety Executive (2016) looks at the design considerations of a control room and the materials needed to build it in order for it to withstand preconceived threats and hazards so to remain fully operational. Involves consideration of threat or hazard, such as fire or explosion, and the likelihood of such an event, emphasizing the importance of protecting the occupant of the control room to allow them to maintain control of the workplace.
Health and Safety Executive (2016) deliberates that adequate access should be provided to machinery requiring maintenance so to eliminate the possibility of inadvertent operation of equipment while this is happening.
Stanislav (2015) discusses the methods of decommissioning an oil platform that have beneficial outcomes. Platforms can be deconstruction and transported back to land piece by piece and sold as scrap metal, or some platforms can be left in the ocean, as artificial reefs or fish homes.
Dearden (2010) focuses on understanding the relationship between an operator and a system, as well as the potential hazards associated with the system. The author also explores the conceptual impact of human error, making it essential to consider human error in the design process.
Cacciabue (2004) discusses the importance of understanding the complexity of a human machine relationship by deconstructing the human machine system in order to discover where errors can arise so to prevent a breakdown in the system.
REFERENCES
Allen, B 2011, Accident reduction, emergency planning, viewed 07 September 2016, http://www.healthandsafetyatwork.com/piper-alpha-lessons
Andras, P 2016, Faults, errors and failures in communications: a systems theory perspective on organisational structure, viewed 21 September 2016, https://www.staff.ncl.ac.uk/peter.andras/PABCstructorg.pdf
Baxter, G 2016, Learning lessons from the failures of socio-technical systems design, viewed 21 September 2016, http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.156.6476&rep=rep1&type=pdf
Blah, G 2014, Why implementing an evacuation plan is important, viewed 22 September 2016, http://www.conceptsafety.com.au/why-implementing-an-evacuation-plan-is-important/
Cacciabue, P. C 2004, Guide to applying human factors method, e-book, Springer-Verlag, London, available at file:///C:/Users/user%201/Downloads/9781852337056-c1%20(1).pdf
Center for Chemical Process Safety of the American Institute of Chemical Engineers 2005, BUILDING PROCESS SAFETY CULTURE: Tools to Enhance Process Safety Performance, Centre for chemical process safety, viewed 07 September 2016, http://www.aiche.org/sites/default/files/docs/embedded-pdf/Piper_Alpha-case-history.pdf
Centre of Risk 2016, Piper Alpha accident, viewed 07 September 2016, http://www.smd.qmul.ac.uk/risk/yearone/casestudies/piper-alpha.html
Dearden, A M 2010, Impact and the Design of the Human-Machine Interface, viewed 24 July 2016, http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.49.9846&rep=rep1&type=pdf
Health and Safety Executive 2016, Control room design, viewed 22 September 2016, http://www.hse.gov.uk/comah/sragtech/techmeascontrol.htm
IFP School 2015, What are the main steps of an oil or gas field development project?, viewed 21 September 2016, http://www.ifp-school.com/upload/docs/application/pdf/2015-02/3_main_steps_oil_gas_field_development.pdf
Johnson, C 1998, Visualizing the relationship between human error and organizational failure, viewed 20 September 2016, http://www.dcs.gla.ac.uk/~johnson/papers/fault_trees/organisational_error.html
Kable 2016, Piper Alpha Platform, North Sea, United Kingdom, viewed 07 September 2016, http://www.offshore-technology.com/projects/piper-alpha-platform-north-sea/
LinkedIn Corporation 2016, Piper alpha disaster, viewed 20 September 2016, http://www.slideshare.net/joeh2012/assignment-piper-alpha
Pannone, J 2010, Design considerations for effective human machine interface systems, viewed 20 September 2016, https://www.pddnet.com/article/2010/09/design-considerations-effective-human-machine-interface-systems
Pate-Cornell, E 1993, ‘Learning from the Piper Alpha accident: A postmortem analysis of technical and organizational factors’ Journal of Risk Analysis, vol. 13, no. 2, pp. 1-18
Stanislav, P 2015, Decommissioning, abandonment and removal off obsolete offshore installations, viewed 23 September 2016, http://www.offshore-environment.com/abandonment.html
The Guardian 2013, Piper Alpha disaster: how 167 oil rig workers died, viewed 20 September 2016, https://www.theguardian.com/business/2013/jul/04/piper-alpha-disaster-167-oil-rig