PIPER ALPHA OIL PLATFORM DISASTER

WHAT HAPPENED?

WHY IT HAPPENED

EVENT SEQUENCE

NATURE OF SYSTEM AND SYSTEM PARTS

DESIGN FAILURES

PEOPLE, WORKPLACES AND MANAGEMENT

TERTIARY INITIATING EVENTS

SECONDARY INITIATING EVENTS

PRIMARY INITIATING EVENTS

Redundant condensate pump A shut down for maintenance. Pipes were removed and replaced with loose fitting blind flanges, with no pressure release valve.

Condensate pump B failed

Shift supervisor had two work permits to complete maintenance work but workers did not complete maintenance work before end of shift.

shift supervisor gave unfinished work permits to contractor, who did not read them, but instead, signed off on them.

Night shift crew commenced with no indication that pump A was shut down for maintenance.

Since pump B had failed, night shift workers decided to fire up pump A.

Condensate gas vapors began steadily leaking out of blind flange

Gas alarms sounded in control room but were ignored by operator, which resulted in the gas finding an ignition source, creating a large explosion which caused a continual release of gas and oil.

Second major explosion from the gas leak that caused the propagation of fire to the first fire wall (Module B)

The gas explosion broke through the fire wall and raged on a constant supply of gas and crude oil

Fire spread from it source and found a large supply of fuel drums beyond the third firewall (Module C)

A third violent explosion resulted

automatic fire fighting system was switched off when divers were working around platform

Communications between platforms were destroyed so other platforms continued supplying Piper Alpha with oil.

Intense heat from explosions cause the steel structures of the platform to melt, leading to the collapse of the Piper Alpha platform

PIPER ALPHA PLATFORM

INTERCONNECTED PLATFORMS

STAFF

WORKERS

divers

maintenance crew

operating staff

ROSTERS

day shifts

night shifts

shift supervisor

control room operator

contractor

Tartan platform

Claymore platform

MCP-01 gas processing platform

Oil platform design failure

Human error

SYSTEM LIFECYCLE

MAINTENANCE

COMMISSIONING

DECOMMISSIONING

CONSTRUCTION

workers

consideration of number of wells to be drilled

recovery techniques for extraction

materials

cost to build platform

separation systems for gas and fluids

treatment systems for preservation of environment

period of production increase

plateau (stabilization phase)

period of injection (such as water, gas or other chemicals to maintain satisfactory production levels)

production decline due to near-depletion of source

depletion of resources

PIPER ALPHA platform destroyed in disaster

dismantling of facility

workers

skills required

time allowed for completion

parts needed / parts to repair

permits to work

FUNCTION

system lifecylce

people

systems usability

interfaces

design of controls

feedback systems

ease of access

Baxter (2016) looks at the premise of learning from failures in design of socio-technical systems, by emphasizing the belief that the socio-technical process should take into account the human-machine relationship factors that influence the usage and functionality of computer-based systems.

IFP School (2015) discusses the life cycle of an oil/gas production platform, highlighting the factors which determine the length in which a hydrocarbon field can remain in operation.

manufacturing

PEOPLE

WORKPLACES

MANAGEMENT

Information transfer

communication

handovers

instructions

Job design

Organisation systems

Management and leadership

Procedures

Polices

Organisations of work

surrounding platforms experienced breakdown in chain of communication

lack of command among platforms

despite seeing the platform on fire, surrounding platforms continued to pump oil to Piper alpha, due to a perceived lack of authority

'permit to work' system not sufficiently implemented or followed,

job sites not inspected before closing or suspending work permits

supervisors neglected workplace policy and left permits on desk in control room instead of delivering it in person to brief management on status of job

worker training was often waived

emergency procedures never accounted for disastrous event that destroyed the platform

emergency training viewed as 'cursory'

no emergency drills practiced regularly

workers who survived disaster claimed they were never trained on location or deployment procedures for life boats

no full-scale shut down of platform procedure practiced

no problems or issues on the platform were reported

management on the platform did not independently review an operations in the 'permit to work' system

lack of information lead to management running on assumptions that there were no problems

management had never been trained on emergency procedures for an event as large as the one that destroyed the platform

rosters

workload

task design

job requirement

supervision

work crew scheduled to conduct routine maintenance on condensate pump A before change of shift

rotating rosters, with changeover at 6pm

regulatory maintenance on pump A

removal and testing of safety valve on condensate pump A. Replaced with loosely installed blind flange not visible to workers. Maintenance not completed before shift turnover.

craft supervisor's decision to suspend permit. It was returned to control room, but the supervisor failed to notify management on job status

two separate work permits issued for maintenance on condensate pump A, neither of which were mentioned in maintenance logs

communication between Piper Alpha platform and surrounding platforms was crucial in emergencies, however, explosions disrupted communication and oil was still being pumped to Piper Alpha

no briefing between shift supervisors on the maintenance work conducted on pump A

new shift supervisor of 6pm crew gave the order to start up condensate pump A after pump B failed

workplace factors

equipment design

work environment

fixed plant design

access

site design

geotech design

capacity to accommodate 200 people and featured a helideck

4 main operating areas separated by firewalls. Despite being converted from a oil processing platform to a gas an oil processing platform, firewalls were not upgraded to provide defense against gas explosions

helicopters and boats were main modes of transport, however, thick smoke from explosions prevented those on board from reaching the life boats as there was only one access route to them

fixed platform in an interconnected hub of platforms

displays

feedback

commands

warning systems

ease of use

inadequacies in platform design, meaning the one route to the lifeboats was inundated with smoke, preventing access

gas alarms sounded when initial gas leak occurred, but the location was not displayed for the control room operator

automatic firefighting system designed to activate when smoke is detected, however it was shut off when divers were working near it. it was switched to manual operation, meaning it did not activate when smoke was detected

control system in operating room poorly designed, meaning the control room operator could not see where gas leak originated from

gas alarms sounded, however, were ignored as there were a number of non-critical alarms sounding as well, so operator ignored them.

temperature

noise

visibility

chemical exposure

poor visibility after explosions due to thick smoke

explosions caused excessive heat on the platform

standard non-critical alarms, but no excessive noise

those on board the platform were exposed to fatal levels of carbon monoxide and other gases are pipelines ruptured

knowledge

competency

goals

work ethic had degraded, with workers only working to complete tasks before shift changeover

all people on board lacked knowledge and training on emergency procedures

workers continually opened and closed doors in accommodation rooms, continually exposing themselves to dangerous levels of smoke and gases

many died from smoke inhalation

no workers were given adequate or regular training

Piper Alpha platform

surrounding platforms

condensate pumps

firewalls

systems of work

no adequate warning systems

gas alarms did not raise concerns

control room did not display where gas leak originated from

loosely installed flange in replacement of safety valve was not visible to workers

only one route to life boats

platforms could still pump oil to Piper Alpha even though it was visibly on fire. No emergency shut off that prevented this

weren't upgraded during oil and gas conversion, meaning firewalls were destroyed in gas explosions

permit to work system insufficient

control room operator

safety adviser and craft supervisor

workers

management

did not train workers on emergency procedures and didn't have knowledge on procedures themselves

systems of work

disregarded likelihood of catastrophic event

did not seek information or review operations on the platform

ran on assumptions that there were no issues

did not abide by policy of how 'permit to work' systems were supposed to be implemented

terminated permit to work with the idea of continuing it the next day

safety adviser did not read over permit to see that the job was incomplete but signed off on it anyway

permits were not written in maintenance logs for management to see

permits were left on control room desk instead of being handed to management in person

ignored gas leak alarms due to complacency from usual non-critical alarms sounding constantly

work ethic disintergrated

did not want to work overtime

installed a blind flange loosely, in an area that was no visible to the workers on the next shift

firewalls weren't upgraded to accommodate for potential gas explosion after platform was converted to duel gas and oil processing plant

limited modes of transport (boats and helicopters) with limited access routs

control room displays did not identify gas leak origin

constant non-critical alarms allowed critical gas alarms to be ignored

automatic firefighting system switched to manual and did not engage when explosions began

no back-up communication systems between Piper Alpha and interconnected platforms as the explosions disrupted communications but surrounding platforms continued to supply Piper Alpha with oil, fueling the blaze

no air-lock systems to prevent smoke inhalation and inhalation of toxic carbon monoxide

location of control room next to production pumps left control room susceptible to being destroyed in fire and explosions

lack of redundancies in commands made it difficult to manually control equipment

location of control room next to condensate pumps

room susceptible to being destroyed by explosions and fire

Loss of command, control and electrical power from control room left the system evidently decapitated

(Pate-Cornell 1993) analyses the failure path of an incident using a risk analysis model structure that ably assists in identifying root causes of systems failures, such as in management decisions, human errors and system component failures.

Johnson (1998) discusses the importance of understanding the relationship between organizational failures and human error, by directing focus to the idea that the failures of an organisation are what initiate the necessary preconditions for human error, and are what exacerbates the consequences of human error.

Andras (2016) discusses the role of structures within an organisation and how communication systems influence faults, errors and failures within that organisation.

Blah (2014) emphasises the importance in having staff trained on emergency procedures of a workplace and how all staff should be knowledgeable on the evacuation routes, which can be aided with signage at regular intervals in the workplace.
These two factors contributed to the mass loss of life on board the Piper Alpha platform.

human supervisory control

automated / manual system

Pannone (2010) discusses the design human machine interface (HMI), in terms of important safety considerations needed to make the HMI work effectively. This includes reducing the likelihood of human error, as it is a large contributing factor to most workplace accidents, by providing a clear presentation of alarms as well a system which has the ability to report errors.
However, the HMI design on the Piper Alpha platform was not effective in providing easily visible alarms, contributing to the destruction of the platform.

Health and Safety Executive (2016) looks at the design considerations of a control room and the materials needed to build it in order for it to withstand preconceived threats and hazards so to remain fully operational. Involves consideration of threat or hazard, such as fire or explosion, and the likelihood of such an event, emphasizing the importance of protecting the occupant of the control room to allow them to maintain control of the workplace.

Health and Safety Executive (2016) deliberates that adequate access should be provided to machinery requiring maintenance so to eliminate the possibility of inadvertent operation of equipment while this is happening.

Stanislav (2015) discusses the methods of decommissioning an oil platform that have beneficial outcomes. Platforms can be deconstruction and transported back to land piece by piece and sold as scrap metal, or some platforms can be left in the ocean, as artificial reefs or fish homes.

Dearden (2010) focuses on understanding the relationship between an operator and a system, as well as the potential hazards associated with the system. The author also explores the conceptual impact of human error, making it essential to consider human error in the design process.

Cacciabue (2004) discusses the importance of understanding the complexity of a human machine relationship by deconstructing the human machine system in order to discover where errors can arise so to prevent a breakdown in the system.

REFERENCES
Allen, B 2011, Accident reduction, emergency planning, viewed 07 September 2016, http://www.healthandsafetyatwork.com/piper-alpha-lessons


Andras, P 2016, Faults, errors and failures in communications: a systems theory perspective on organisational structure, viewed 21 September 2016, https://www.staff.ncl.ac.uk/peter.andras/PABCstructorg.pdf


Baxter, G 2016, Learning lessons from the failures of socio-technical systems design, viewed 21 September 2016, http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.156.6476&rep=rep1&type=pdf


Blah, G 2014, Why implementing an evacuation plan is important, viewed 22 September 2016, http://www.conceptsafety.com.au/why-implementing-an-evacuation-plan-is-important/


Cacciabue, P. C 2004, Guide to applying human factors method, e-book, Springer-Verlag, London, available at file:///C:/Users/user%201/Downloads/9781852337056-c1%20(1).pdf


Center for Chemical Process Safety of the American Institute of Chemical Engineers 2005, BUILDING PROCESS SAFETY CULTURE: Tools to Enhance Process Safety Performance, Centre for chemical process safety, viewed 07 September 2016, http://www.aiche.org/sites/default/files/docs/embedded-pdf/Piper_Alpha-case-history.pdf


Centre of Risk 2016, Piper Alpha accident, viewed 07 September 2016, http://www.smd.qmul.ac.uk/risk/yearone/casestudies/piper-alpha.html


Dearden, A M 2010, Impact and the Design of the Human-Machine Interface, viewed 24 July 2016, http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.49.9846&rep=rep1&type=pdf


Health and Safety Executive 2016, Control room design, viewed 22 September 2016, http://www.hse.gov.uk/comah/sragtech/techmeascontrol.htm


IFP School 2015, What are the main steps of an oil or gas field development project?, viewed 21 September 2016, http://www.ifp-school.com/upload/docs/application/pdf/2015-02/3_main_steps_oil_gas_field_development.pdf


Johnson, C 1998, Visualizing the relationship between human error and organizational failure, viewed 20 September 2016, http://www.dcs.gla.ac.uk/~johnson/papers/fault_trees/organisational_error.html


Kable 2016, Piper Alpha Platform, North Sea, United Kingdom, viewed 07 September 2016, http://www.offshore-technology.com/projects/piper-alpha-platform-north-sea/


LinkedIn Corporation 2016, Piper alpha disaster, viewed 20 September 2016, http://www.slideshare.net/joeh2012/assignment-piper-alpha


Pannone, J 2010, Design considerations for effective human machine interface systems, viewed 20 September 2016, https://www.pddnet.com/article/2010/09/design-considerations-effective-human-machine-interface-systems


Pate-Cornell, E 1993, ‘Learning from the Piper Alpha accident: A postmortem analysis of technical and organizational factors’ Journal of Risk Analysis, vol. 13, no. 2, pp. 1-18


Stanislav, P 2015, Decommissioning, abandonment and removal off obsolete offshore installations, viewed 23 September 2016, http://www.offshore-environment.com/abandonment.html


The Guardian 2013, Piper Alpha disaster: how 167 oil rig workers died, viewed 20 September 2016, https://www.theguardian.com/business/2013/jul/04/piper-alpha-disaster-167-oil-rig