Safety Plant: The Piper Alpha Disaster - Essay Example

? The Piper Alpha Disaster BY YOU YOUR SCHOOL INFO HERE HERE Introduction On 6 July, 1988 the North Sea Oil and Gas Platform Piper Alpha experienced a series of catastrophic disasters leading to complete destruction of this vital resource for the industry. A series of failures both technological and human-related contributed to several explosions and fires that took the lives of 167 men. At the time of the platform’s construction, it was owned and maintained by Occidental Petroleum, designed for oil extraction. In the 1980s, the platform received an overhaul to allow for natural gas production, which changed some of the dynamics of its operational and technological systems. Piper Alpha was a fixed platform in the North Sea, consisting of four modules that were segregated by a series of firewalls. Two modules were isolated for gas and oil production, with one module for gas compression and a fourth containing platform wellheads. Later analysis indicated that these firewalls were inefficient for the multiple activities occurring on the platform. The remaining levels of Piper Alpha contained control rooms, helipad operations, and personnel areas (e.g. sleeping quarters and recreational centres). On board were a variety of life rescue boats to facilitate evacuation in the event of emergencies. The events leading to the disaster and occurring during the series of fires were attributed to operational deficiencies, management failures, and process/procedure dysfunction, making this a complex scenario of human and tangible factors. This report highlights the inter-connectivity of these failures as well as discussion of the sweeping safety and procedural changes that occurred in the industry post-disaster. The events leading to Piper Alpha destruction Piper Alpha maintained two different condensate pumps (Pumps A and B). A condensate pump is designed to remove excess condensate (water vapour) to facilitate compression and production functions. On the morning of July 6, routine maintenance was scheduled for Pump A which called for the removal of the pressure safety valve. For reasons unknown, the actual maintenance was delayed and instead of reassembly, Pump A was closed off with a temporary metal flange and scheduled for lock out. As was part of the Piper Alpha operations and safety processes, a work permit was handwritten by the current technician with information that Pump A should not be turned on due to the temporary inability to handle pressure loads. Up until this point, the safety and operational processes were in-line with platform practice and expectations. Six hours later, the written permit indicating that Pump A should, under no circumstances, be turned on was somehow misplaced by the next shift working in the operations control room. Unknown to the technician who wrote the permit, there was a supplementary permit already posted that authorized construction overhaul of Pump A in the control room. No verbal exchanges occurred between the technician in charge of Pump A lockout and the control room operators as another problem was being dealt with on the platform at the time (Caplan 2005). Thus, the permit was left in the control room and the technician returned to the employee housing area. Earlier in the day, Piper Alpha had been experiencing blockage problems caused by hydrate buildup, a form of ice produced when gas and water molecules form solids under certain temperature and pressure conditions (Sheen 1987). This hydrate blockage stopped Pump B and the control room was unable to get the pump back online. The significance of this was that operations of Pump B were inter-connected with every power system on Piper Alpha, therefore there were only a matter of minutes after Pump B ceased production to ensure no power supply disruption. The control room identified an overhaul permit for Pump A, but no indication about the warning of not turning on Pump A since, as previously identified, it had been misplaced. Therefore, the manager of the control room determined that Pump A was an effective contingency plan to ensure that power was not disrupted to the platform. Three minutes after turning on Pump A, the temporary metal flange placed on the pump blew off, thus allowing gas to seep at high pressure into the operating environment. The gas erupted with a high pitched and audible sound, alerting several workers that they were at risk of fire. The workers pulled the gas alarms, but it was too late. The erupting gas found an ignition source and a series of explosions occurred. One worker depressed the control stop button, ceasing all gas and oil compression function, as part of operational procedures. However, the retrofit of the platform had ensured that each module was protected from fire, but could not withstand explosive force. After a secondary explosion occurred in the gas module, the firewalls separating oil from gas production were destroyed and the entire platform was set ablaze. Piper Alpha was, however, equipped with a fire suppression system, a series of pumps that drew significant volumes of seawater upwards to extinguish blazes. However, earlier in the day there had been several divers in the water performing maintenance to the lower portion of Piper Alpha. It was operational procedure to shut down the fire suppression pumps when divers were present as the sucking force of the pumps put divers at risk of being drawn into the fire suppression pipe work. By the time a third explosion had occurred, the entire control room had been destroyed and the fire suppression system rendered useless. It was at this point where all management in charge of evacuation and procedural direction had been killed, thus Piper Alpha had no supervisory leadership while the platform continued to burn. Additionally, the first or second explosion completely knocked out the platform’s electrical systems, thereby cutting all power to vital systems that might have been controlled manually (Hewitt 2008). Because of this, a gas riser was unable to shut fully when the emergency shut-down system had been activated before the control room was destroyed. This only continued to feed the problem by allowing gas from the module to seep upwards to the employee decks. Additionally, Piper Alpha had been fitted with a variety of undersea oil pipelines that were inter-connected with other platforms operating within 18 miles of the platform, the Claymore and the Tartan (Versatel 2007). As neither staff at the Claymore or Tartan had experience or training in handling a disaster of this magnitude, oil continued to flow to the Piper Alpha, feeding the blaze. Figure 1 illustrates the dynamics of the inter-linkages between the three platforms. The length of this pipe network illustrates the volume of oil contained that continued to feed to Piper Alpha, exacerbating the problem. Since there was a considerable distance between the platforms and no communications had been transmitted from Piper Alpha during the events, there was no immediate knowledge that shut-offs at Claymore and Tartan were required. It was not until external warnings came in from rescuer boats and other authorities that such emergency procedures were initiated. At this point, however, Piper Alpha was completely ablaze. Figure 1: The Dynamics of Platform Inter-Linkages Source: http://www.cookeonfire.com/pdfs/Piper%20Alpha%20incomplete.pdf Compounding the problem was the lack of experience in supervision and evacuation procedures with those men who remained after the control room was destroyed. It was standard practice on the platform to promote individuals to higher levels without providing appropriate training required or a different grade of expertise (Patt-Cornell 1990). During the night shift when this occurred, the production team consisted of only five individuals, four of which had recently been promoted into temporary expert positions. When an alarm is signalled, those with proper supervisory training are supposed to check which specific heads were detecting gas leaks with standard oil and gas platform procedures (Patt-Cornell and Bea 1992). There was no evidence in post-disaster inquiries that these procedures were adhered to, likely due to the inexperience of recently promoted technicians and operations specialists. During attempts to evacuate, which were no longer possible by using life boats that were now engulfed in flames, one operations technician attempted to assume a supervisory role. Two colleagues who were not trained for evacuation procedures, Robbie Carroll and Bob Vernon, attempted to traverse the flames to engage manual fire suppression systems, but were both killed as it is standard operating procedure not to return to areas at risk (The Scotsman 2008). There was no means whatsoever of getting messages to other men who were still alive, who had climbed to the helipad region at the top of the platform. Most men had no choice, having no medium for communications or entry to lower decks of the platform, but to jump into the ocean and wait for potential rescue. Some of these heights exceeded 150 feet from the helipad deck. Root causes, prevention and mitigation The Piper Alpha disaster was a triune of dysfunction, consisting of significant non-compliance to safety and operational procedures, failure of management focus, and technical failures that led to complete loss of the platform. First, no significant risk analysis had been conducted during the period where Piper Alpha had been retrofitted for gas production and compression activities. This is a failure in safety adherence and in management/executive focus. In the event of significant installations or retrofits, a systematic case analysis under PSIM should be conducted for current risks and contingency development plans. There is no evidence of the existence of such a safety case analysis prior to the disaster. The safety case and risk analysis should include making safety arrangements, analyzing the pressure load of structural systems and firewalls, along with a series of feedback, audits, and emergency evacuation procedures. A safety case includes many different dimensions, but is ultimately defined as “a comprehensive and structured set of safety documentation which is aimed to ensure that the safety of a specific vessel or equipment can be demonstrated” (Kelly 2003, p.3). Piper Alpha should have had a team of technical and operational experts in the field determine the long-term safety risks to the platform by assessing systems inter-dependencies and their relationship to safety procedures. A case analysis in the event of retrofit or extensive reconstruction should have had experts from Occidental Petroleum and from the current governmental oversight committees involved in the process in order to tangibly demonstrate safety adherence. It had been, even prior to the 1998 disaster, been best practice in the industry to utilise a variety of safety checklists. None of the research evidence on the disaster indicated that such checklists were considered to be reference tools or safety evaluation tools on Piper Alpha. If the technician that had filled out the original hand-written work permit for Pump A had identified his activities on an appropriate checklist, it would have been posted in the control room or near Pump to alert others that certain dimensions of the planned overhaul had been started, but not yet completed. Lack of existence of an appropriate checklist and accountability system is a failure of management and non-adherence to standard safety and operational practice already established by the NSF. One problem that led to the disaster, also, included significant failures in training and knowledge transfer with existing technical personnel on Piper Alpha. Since it was identified that it was common practice to promote untrained individuals for temporary supervision or expert-required positions illustrated a significant negligence on behalf of the corporation and internal platform supervision. Occidental Petroleum should have established rigorous training packages and programmes to facilitate knowledge transfer and ensured that an evaluation criterion was established so that adequate expertise maintained supervisory and operational support. The complex dimensions that posed significant health and safety risks required that such promotional activities were governed by strict oversight systems. An expert from Occidental should have been expatriated to the platform to provide this training or had technicians temporarily removed from the platform until a variety of certifications had been attained. It seems, though somewhat subjective, that Occidental wanted to avoid the complexities of delivering cross-training that required travel costs (and other costs) by simply promoting to temporary positions when a gap in staffing occurred. If the business and internal supervision had been more aware of the risks of allowing non-certified staff to attain management positions, it is likely this disaster could have been prevented or at least had evacuation coordinated more effectively and in a much more timely manner. Figure 2 illustrates a best practice risk assessment in offshore oil and gas platform activities that should have been utilised to determine safety risks to promoting untrained supervision. Figure 2: Risk Analysis Best Practice Source: Rausand, M. (2005). http://www.ntnu.no/ross/slides/riskanal.pdf As illustrated by Figure 2, risk evaluation identifies the entire risk picture, determining the frequency of potential risk factors along with the consequences of non-adherence to removing risk factors. The model illustrates a cyclical relationship between identification and hazard removal processes, in which all activities are centred around risk estimation and analyses. If the business had utilised this model when assessing management processes and procedures, Occidental Petroleum or internal platform supervision would have identified frequency of risk through inefficient lack of training and been able to identify the potential consequences. As part of this model, such an identification would have created measures to reduce the risks by having newly promoted technicians and operators demonstrate their awareness of various regulations and practices. The company should have modelled this knowledge in a variety of different disaster and standard operations practices to determine the level of understanding each newly promoted manager maintained about important safety systems and procedures. One of the main reasons that the original technician working on Pump A during delayed overhaul of the system was that current control room managers were busy working on multiple platform problems. Of course, in retrospect, this is unacceptable due to the potential consequences of miscommunication in the process of maintenance and system improvement. What was lacking at Piper Alpha was a culture of safety, one where all members maintain recurrent and regular safety focus with a team methodology. A safety culture is developed when sets of norms, technical guidelines, and social practices are adopted by managers and employees in an effort to minimise danger or injury within the organisation. As part of PSIM or the pursuit of establishing a best practice framework, Occidental Petroleum should have built a safety culture from the start of operations in the North Sea. Establishing this culture requires consistent management reiteration of mission and vision, using regular communications and literature distributions about individual contributions to safety. At Piper Alpha, the evidence seems to suggest that there was a considerable lack of understanding about the legitimate risks of health and safety, with most believing that the platform maintained enough redundant systems (both technical and managerial) to prevent such disasters or effectively combat fires and explosions in the event that they were to occur. None of the research indicated any pre-existing focus on having a safety culture which was evident in several interviews conducted with survivors of the disaster and acknowledgements by government statesmen examining the situation. Building a safety culture through training and management interventions would have made it more favourable for the technician who did the initial work on Pump A to intervene and ensure that the problem had been discussed with multiple members of the control room to ensure safety protocol was followed, rather than simply filling out a permit and leaving the control room. One must also be realistic as it pertains to ensuring majority health and safety. It was standard operating procedure to shut off the fire suppression pumps when divers are working in the waters beneath the platform. However, there were over 200 men on the platform that rely on these systems to ensure their longevity and safety. After the first fire and explosion occurred, before the power systems had been destroyed, the control room should have immediately turned on the fire suppression pumps, despite the danger to the two divers. It was recognized, in post analysis, that even when such pumps were on, the recognizable risks to the divers was virtually nil. A more competent control room supervisor should have weighed the safety of a staff of over 200 with the safety of maintenance divers and implemented the fire suppression system manually. It is likely that the problem could have been much better contained by using practical judgment about emergency procedures. It was widely understood in post-evaluation of the event that the current control room supervisor on duty at the time performed incompetent evaluations of the situation that could have prevented the disaster (Cullen 1990). Offered Lord Cullen, head of the department now known as the Health and Safety Executive, “No amount of detailed regulations for safety improvements could make up for deficiencies in the way that safety is managed by operators” (Cullen 1990, p.52). The on-duty control room supervisor should have been trained with how to make rash judgments related to balancing individual safety with majority volume safety and instantly threw the fire suppression switch prior to knock-out of the power system and ultimate destruction of the control room that occurred on the third explosion. Individuals who are assigned to safeguard the lives of the masses require such training which entails assessment of psychological capability to make difficult decisions with rapid and logical judgment. Thus, it should be said that Occidental Petroleum was significantly negligent in providing vital training to supervision for ethical emergency scenarios which is another mitigating factor for the Piper Alpha disaster. Lord Cullen further labelled Occidental Petroleum as “a corporate disease of sloppiness” (Cullen 1990, p.61). Measures and controls established in the industry post-disaster After the Piper Alpha disaster, a variety of sweeping changes occurred in the industry and internationally for safety improvement, the development of new regulatory committees and legislation, and a set of objectives by which oil and gas companies were expected to adhere (best practices). Firstly, the responsibility of legislative and compliance-based responsibilities were handed over from the Department of Energy to the Health and Safety Executive which took on much broader control over the gas and oil production industry. The regulatory focus of the Department of Energy was widely criticised for its inability to promote better safety practices on offshore platforms during the time period with suggestions that having the Department of Energy monitor and regulate all safety and production activities as a conflict of interest. The Health and Safety Executive maintained a much better track record at aggressive compliance measures and evaluations, thus establishing its oil and gas industry compliance division. This assisted in localising the safety interests of UK employees working with international businesses. New methods of assessing hydrocarbon inventories was also established by the HSE, with a focus on infrastructure development and transfer of materials in the North Sea and other offshore regions. Having a singular regulating body for these processes allowed for examination of contemporary evacuation and emergency procedures, explosion and fire protections, establishment of emergency procedures for inter-connected oil pipelines, and the creation of a standby vessel system for faster emergency and evacuation responses (HSE 2008). The government also intervened to force companies operating under its regulatory jurisdiction to perform regular drills in evacuation and emergency procedures to prevent another such disaster from occurring again (HSE 2008). The industry also recognised that the problem with misplaced written work permits was a significant safety risk for the industry and was a widespread problem on other offshore platforms. This led to the development of integrated, electronic permit-to-work systems that began incorporation on oil and gas platforms in the early 1990s. The Health and Safety Executive conducted a survey which returned results that nearly one-third of all accidents that occurred in this industry were a problem with maintenance systems and processes (ASAP 2009). Electronic solutions in the permit process served to maintain an accessible database for various work systems when supplemented with handwritten permits or appropriate checklists. If Piper Alpha had maintained electronic databases, it is likely that Pump A would not have been turned on as a contingency for the failure of Pump B due to hydrate blockage. Much of this was due to Lord Cullen of the HSE and his publicised inquiry into the disaster that occurred from 1989 to 1991. Improvements proposed for industry-wide compliance regarding permit-to-work systems were ensured for all businesses operating offshore platforms (Oil & Gas UK 2008). Operational improvements to platforms were also proposed and developed after Piper Alpha, including contingency infrastructure changes that prevent smoke hazards, making improvements to evacuation systems, and undersea emergency bulkheads or isolation systems to ensure adequate stoppage of inter-linked pipeline systems during emergency scenarios (Oil & Gas UK 2008). Nearly one billion pounds was invested in the 1990s, just by the UK government and not including structural capital investments by platform operators, into improving the health and safety conditions and strategies of platforms in this industry (Oil & Gas UK 2008). Many businesses in the oil and gas industry also established safety culture literature and training which represented an organisation-wide effort to change attitudes of operators, managers and specialised technician support on oil and gas platforms. Many businesses developed safety management change champions that followed these training processes and knowledge transfers throughout the entire project life cycle to ensure that such cultures were established. Much more emphasis on management intervention and support has led to significant decreases in safety and emergency situations in the industry since Piper Alpha. Figure 3 illustrates the steady improvements occurring in the oil and gas industry since the HSE investments and best practice improvements introduced into the industry. Figure 3: Statistics on Safety Performance in the Industry Source: Oil & Gas UK (2008). http://www.oilandgasuk.co.uk/downloadabledocs/237/Jessica%20Presentation.pdf As illustrated by the chart, there have been dramatic improvements in the volume of injuries caused by unsafe practices in the industry since dramatic safety improvements were introduced after 1989. By 2007, such frequency of injuries had been reduced by approximately 100 percent. It is clear that the investments by corporations in the oil and gas industry, along with aggressive compliance measured supplied by the Health and Safety Executive, contributed to a much safer industry in an effort to prevent another such occurrence as Piper Alpha. Comparison to Other Disasters Piper Alpha, in relation to management and systems communications failures, can be compared to the capsizing of the Herald to Free Enterprise, a car ferry that sunk in 1987, killing 193 people including passengers and crew members (nearly 80 percent of its total complement). This ferry maintained eight different decks, two of which (E and G decks) were for vehicle transfers and storage during the trip. In an unfamiliar port, the Herald to Free Enterprise had a large passenger complement and thus had to utilise E and G deck to meet loading demands. The ramp used for loading was not large enough to reach E deck (the higher deck) and the captain determined that filling the boat’s ballast tanks would provide adequate reach, thus submerging the boat lower in the water than is normally conducted. Upon successful loading, the assistant boatswain was assigned to shut the bow doors before pulling out of port. The assistant, however, had left the docking area for a break and had fallen asleep, thus missing the alarm that the moorings were being pulled. The first officer, as part of the contingency plan, was to remain on deck to ensure adequate operations before exiting port. The captain, assuming all activities were being performed with adequate back-up support to procedure, left the dock. Within 90 seconds, the volume of water entering G and H deck (the deck maintaining all power and engine systems) caused the boat to list 30 degrees and ultimately capsize. This situation, though not involving explosions and fires, is comparable to Piper Alpha as it relates to creating a culture of safety. Post-analysis of the capsizing disaster had the head boatswain stating that he did not close the doors because it was the duty of the assistant boatswain. Thus, it indicated that the main boatswain actually saw the doors were opened, assuming that the assistant would perform their duties appropriately and according to procedure before leaving the dock. In this case, there were a great deal of assumptions by multiple crew members with no formal acknowledgement or communications system in place to ensure that all areas had been covered and checked off before indicating to the captain that it was safe to leave. If the Herald of Free Enterprise had built a culture of safety, another staff member would have stepped in and performed the duties of a crew member lax in their responsibilities, thus saving 193 people from certain death. Much like the technician at Piper Alpha who assumed his permit-to-work would be seen by the control room, this was a comparable failure in relation to management and organisational culture. Another incident comparable to Piper Alpha is the Bhopal Gas Tragedy of 1984, a gas leak event in India that killed over 3,700 people. This situation is comparable due to similar maintenance problems in the process that were in-line with Piper Alpha. Union Carbide had several of its safety systems undergoing maintenance routines where vent gas scrubbers and the steam boiler in the plant were out of service. At the same time, a major storage tank containing non-compliant storage volumes of methyl isocyanate experienced water leakages that seeped into the storage tank. When methyl isocyanate, water and rust blended, it created a chemical reaction that increased the tank’s maximum pressure, allowing 30 metric tonnes of toxic gas to be released. The storage tank had a refrigeration system designed to prevent this from occurring, however it had been switched off during the accident. Later analysis of the event indicated that the company had inexperienced labour operating this machinery and performing maintenance, lack of compliance to safety standards, and no sufficient catastrophe management process or system in place. Though the dynamics of the Bhopal disaster differ from Piper Alpha, it illustrates how accidents happen as a result of improper maintenance processes and communications systems. Several safety systems and units involved in the process of securing the integrity of methyl isocyanate were disabled. Also as in the Piper Alpha case, labourers were being utilised that did not maintain the appropriate training and knowledge about operations in a facility with this many potential health hazards and risks. Furthermore, many of the liabilities involved in this case were direct corporate failures on behalf of Union Carbide, similar to the negligence of Occidental Petroleum and Piper Alpha. The Union Carbide plant had not established adequate control and preventative systems or operational standards on what should be done in the event of a disaster of this magnitude. Occidental Petroleum had not established contingency evacuation procedures or properly trained supervisors on making quick decision-making in an emergency scenario. Maintenance processes and negligent managerial activities by Union Carbide makes this disaster very comparable to Piper Alpha as many of both disaster factors could have been prevented with a more interactive corporate governance system. Conclusion Piper Alpha is an example of a disaster that could have been prevented in several different ways if there had been more managerial focus, the development of an entire, holistic culture of safety, and better operational procedures pertaining to maintenance activities. Piper Alpha illustrates the imperatives of performing routine risk assessments and audits of infrastructure and procedures to ensure that compliance is being achieved and knowledge transfer occurs successfully. Lord Cullen of the Health and Safety Executive was one of the most instrumental figures in creating widespread changes to the oil and gas industries through his strong chastisements of irresponsible corporate behaviour that was highly publicised internationally. By giving these incidents much more public attention, it illustrated the depths of the problems with health and safety for offshore platform operations that led to a much more compliant and safety-conscious industry. If there had been more effective communications systems on Piper Alpha, the operators both managerial and technical would have conducted more thorough investigations into the status of Pump A without making assumptions that all systems were operating properly. In reflection, it would seem that despite the many different failings occurring on the platform, the largest lesson learned is that such disasters can be prevented most effectively by changing attitudes that jump to rapid conclusions (assumptions) rather than checking all facts before making decisions that have significant safety consequences. It is clear that more efficient training, maintenance processes, and communications systems need to be developed regularly. However, cultural changes so that individuals operating in high risk environments have a safety orientation and safety dynamic would be a best practice method for ensuring less safety incidents occurring in multiple industries. Piper Alpha was a significantly destructive disaster that had a multi-factor dynamic leading to the loss of the platform and many different human lives. However, it would seem that with preliminary and ongoing risk assessments and brainstorming of best practice concepts, the oil and gas offshore platform industry would be a safer place to work. Best practice should include appropriate training, psychological evaluation of control room management and supervision, and regular infrastructure and process auditing to improve health and safety performance. By focusing on PSIM and development of more contingencies related to safety, incidents like Piper Alpha will never burden this industry again. As illustrated by the Bhopal disaster, Piper Alpha, and the Herald of Free Enterprise disaster, far too many incidents are occurring in multiple industries that should serve as a foundational benchmark for safety and quality improvements internationally. Neither companies nor the general public, much less the hazardous environment worker, can afford for further negligence in these industries necessary to sustain modern lifestyle. References ASAP. (2009), Electronic permit to work, Advanced Safety Applications and Procedures [online] Available at: http://www.safetyapplication.com/tcetodayarticle.pdf (accessed 12 September 2012). Caplan, P.I. (2005). Appendix to Opinions Chapter 5 Causation 1-Volume 2. [online] Available at: http://www.scotcourts.gov.uk/opinions/Pipervol2.html (accessed 12 September 2012). Cullen, Hon. Lord. (1990), The Public Inquiry into the Piper Alpha Disaster, London: HMSO. Global Spec (2008). Risk presentation and risk acceptance criteria [online] Available at: http://www.globalspec.com/reference/72246/203279/chapter-3-risk-presentation-and-risk-acceptance-criteria (accessed 13 September 2012). Hewitt, T. (2008), Who is to blame? Allocating liability in upstream project contracts, p.187. [online] Available at: http://www.herbertsmith.com/NR/rdonlyres/D6CE5DE0-9E90-492D-A84F-F1A57F5BC2C5/7775/hewitt_article.pdf (accessed 11 September 2012). HSE. (2008), Lest we forget: Piper Alpha, Health and Safety Bulletin [online] Available at: http://osha.europa.eu/en/campaigns/hw2010/maintenance/accidents/5-piper.pdf (accessed 11 September 2012). Kelly, T. (2003), A systematic approach to safety case management 04AE-149, SAE International. Rausand, M. (2005). Risk Analysis – An Introduction, Norwegian University of Science and Technology [online] Available at: http://www.ntnu.no/ross/slides/riskanal.pdf (accessed 13 September 2012). Oil & Gas UK. (2008), Piper Alpha: Lessons Learnt [online] Available at: http://www.oilandgasuk.co.uk/cmsfiles/modules/publications/pdfs/HS048.pdf (accessed 13 September 2012). Patt-Cornell, M.E. (1990), Organisational aspects of engineering system reliability: The case of the offshore platforms, Science, pp.1210-1217. Patt-Cornell, M.E. and Bea, R.G. (1992), Management errors and system reliability: A probabilistic approach and application to offshore platforms, Risk Analysis 12(1), pp.1-18. Sheen, J. (1987), Herald of Free Enterprise, Report of Court 8074, London: Department of Transport. The Scotsman. (2008), The night the sea caught fire: Remembering Piper Alpha [online] Available at: http://www.scotsman.com/news/the-night-the-sea-caught-fire-remembering-piper-alpha-1-1433754 (accessed 12 September 2012). Versatel. (2007), Piper Alpha [online] Available at: http://home.versatel.nl/the_sims/rig/pipera.htm (accessed 12 September 2012). Read More