The Causes and Consequences of the Piper Alpha Disaster - Case Study Example

DRAFT- please review Piper Alpha Disaster 1. Introduction Piper Alpha is an offshore oil platform located at the North Sea. In 1988, a massive explosion occur killing more than a hundred men. The cause of explosion was generally from negligence, faulty procedures, and top management’s obvious disregard on safety. The objective of this paper is to analyse the causes and consequences of the Piper Alpha disaster and discuss lessons learned and implications if such accident happen in Preston. 2. Analysis of the Case Study The destruction of the Piper Alpha offshore oil platform in 1988 by an explosion and the ensuing massive oil and gas fire and the death of 167 men showed that the potential hazards of the offshore industry were larger that had been commonly believed by the public and conceivably by the industry itself (Kletz 2001, p.196). Piper Alpha is located in the North Sea about one hundred eighty kilometres northeast of Aberdeen. The disaster occurred on July 6, 1988 with the explosion of a low-lying cloud of condensate. The explosion caused severe damage that resulted in a large crude oil fire, which made access to lifeboats difficult due to thick smoke. The rapid escalation of the fire was due to the large supply of hydrocarbons from Tartan and Claymore platform. Another explosion occurs twenty minutes later that further intensify the fire. The explosion was due to the rupture of the riser on the gas pipeline from the Tartan platform. Successive ruptures of risers from the other two gas pipelines occur half an hour later intensifying the fire further. The Piper platform along with its equipments and accommodations was destroyed in a matter of hours. At the time of the disaster according Wells (1997, p.221), Piper Alpha was undergoing large-scale maintenance and it had initially agreed to shut the platform down during the maintenance operation. However, the rig executives decided to carry on limited production regardless of maintenance operations in different areas of the platform. The same author explained that one process on Piper Alpha involved eliminating condensate from the gas and pumping it into the main oil lines. The condensate was injected into the oil line by one of two pumps – A and B. On July 4, 1988, it was decided to bring forward the maintenance of pump A by one month because it had been creating some noise. The spares for this job arrived on July 5 and contractors from Score UK Ltd. were asked to perform a recertification on the relief valve of pump A at the same time. Pump A was isolated during the morning of July 6, the relief valve was removed, and the relief line blanked off by a flange. Separate permits-to-work or PTW were issued for each job. The flange should have been made leak-tight with a spanned but at this time, it was left ‘finger-tight’ only. The plan was to refit the relief valve by 18:00. The contractors were aware that the work on pump A would take several days. The relief valve was recertified on July 6 but not restored on the relief line as the crane was unavailable due to an overtime ban, which constrained the crane operators to day shifts only. Under such condition, the contractors should have suspended the PTW for the relief valve. Facts suggest, on the other hand, that the maintenance staff were ignorant that the valve had been refitted and it was improbable that the operations staff signed off the PTW as necessary. After some work on pump A had been completed, the maintenance manager had decided to stop with the planned maintenance but had not yet informed the staff. The operation staffs were aware that pump A was functional. On shift hand over at 18:00, the night shift personnel were told that pump A was operational. However, they were not informed of the work, which had been carried out on the relief valve. The maintenance day shift assumed that work on the relief valve had been completed, even though a site inspection was not carried out as required by standard procedures. At 21:40, pump B tripped and attempts to restart the pump failed. Operation staff decided to reinstate pump A to maintain production. The isolation on pump A was removed and an electrician called in to restore power. The feed valves on pump A were then opened. A low-level gas alarm was recorded at 21:56 and this was followed by a high-level alarm at 22:00. An explosion equivalent to 50kg of condensate occurred. This explosion killed a number of people and destroyed the fire fighting system. A mayday was issued but the ensuing fire rapidly engulfs the control room and severely damages the rig’s communication systems. The adjacent rigs continued to feed gas and oil to Piper Alpha for over an hour. Emergency isolation valves on Piper Alpha failed to close and the fire escalated to a major jet fire. Flame impingement, due to the continuing leakage of gas flows to Piper Alpha from the other rigs, caused the gas risers to fail. This leads to a series of massive explosions that engulfed the platform in smoke and flame and caused structural damage. The emergency power supply also failed. The platform controller tried to enact the practiced emergency plan, which involved mustering in the galley and then evacuation by helicopter. However, the explosion made escape by helicopter impossible. Some survivors escaped by jumping into the sea from a height of up to 50 meters. Although the potential for fire had been considered when designing the platform, no consideration had been given to the possibility of explosion. The fire continued for a very long time, long after the oil inventory on the platform would have been consumed. Although the other platforms supplying oil to Piper Alpha knew that there was a serious fire, they continued to pump oil, as they assumed that Piper Alpha would be able to control the fire. All communication equipment on Piper Alpha was damaged in the initial explosion. The emergency diesel fire fighting pumps which was intended for automatic start-up if firewater were needed and the electrically driven pumps did not start thus no cooling was available to the exposed plant. Because of the risk of divers working underwater around the platform being sucked into the pump suction lines, the platform manager had instructed that all pumps were to be switched to manual start whenever a diver was in the water, not just when a diver was near the pump suctions. The weakness of this ruling had been listed in a safety audit report long before but not acted on. As divers were in the water for 12 hours per day in summer that meant that auto start was bypassed for 50% of the time. Because of the use of salt water for fire fighting, the water pipes had corroded and tended to block the spray nozzles. Flushing the pipes had been tried, but this increased corrosion. Larger nozzles had been tried but without success. It had been decided to replace the pipework with corrosion-resistant pipework, and this had been done on one module. However, this was all that had been done in the 4 years since the problem had been identified (Tweeddale 2003, p.412). Why it happened? An inquiry on the incident reveals that it happened because: a. The lead nigh-shift operator would not have tried to start pump A if he had known that maintenance is not yet completed. b. Information regarding the removal and non-replacement of valves has not been communicated during the shift handover. The day maintenance lead hand did not mention this to his night shift opposite number, nor did he record the fact in the maintenance diary or on the A4 pad as the procedures required. c. Pump A was out of service on July 6 and its pressure safety valve had been removed for recertification. There were some 300 pressure safety valves on Piper Alpha and a specialist contractor recertified them every 18 months. The contractor’s offshore supervisor, a valve technician, had only been on the platform since June 27 and had received no specific training in the Permit-to-Work system, though he did tell the platform’s maintenance superintendent on June 28 that he knew how to work the PTW system. d. The Inquiry Report observed that the failure of the PTW system was not an isolated error. The evidence showed that PTW system was being operated in a casual and unsafe manner. It was not being adequately monitored or audited. These were failures for which management were responsible. e. Identified deficiencies of the PTW that were present prior to the incident include the reality that lead production operators do not discuss active or suspended permits at the shift changeover which was required by the company’s procedures. f. Suspended permits were kept in the Safety Office rather than in the Control Room because there was not enough space in the Control Room to display them. g. The training required to make the PTW system work properly was not given, nor was effective monitoring carried out (Reason and Hobbs 2003, p.89). In sum, the accident and the escalation of the disaster happen due to lack of safety culture. If there had been a strong safety culture in Piper Alpha, the managers involved would in all probability have reached different conclusions. 3. Consequences of the Accident Although some men did escaped by jumping from the platform into the sea, many of those off-duty personnel who were sleeping in their accommodation lost their life. One hundred sixty seven workers were killed, the platform destroyed and UK hydrocarbon production temporarily dropped by 11 percent. The majority of the fatalities were cause by smoke inhalation and occurred in the galley or accommodation areas (Well 1997, p.221). The explosion killed at least two people and damaged some of the fire fighting water mains, and the electrical supply systems to parts of the processing section. The gas explosion caused damage to the firewalls around the condensate module and started leaks in the heavy oil module alongside that led to a large oil fire. The oil fire weakened the main gas pipelines, which came up from the seafloor through the centre of the processing module from wells and other platforms. A gas pipeline ruptured. The resulting fireball enveloped the platform thus the continuing fire could not be isolated (Tweeddale 2003, p.412). 4. Lessons Learned One of the very important lessons from the Piper Alpha disaster is the fact that latent conditions can exist at any level of the system and beyond it. For instance, one of the latent conditions that contributed greatly to the loss of life was the enormous pressure from top management to maintain production despite the maintenance works. This is the reason why “local managers were reluctant to shut down nearby platforms, which kept pumping and so feed the fire” (Doyle 2003, p.178). Another essential condition was that the platform had been modified to pump gas, and to cut down cost, inadequate blast walls had been fitted. This in turn allowed the fire to engulf the workers accommodation where the men had been instructed to go to await rescue. Consequently, those who comply with the instructions all died and only those who have the courage to jump 175 feet into the sea survived. None of these latent conditions would have led to disaster had there not been sloppy safety procedures surrounding the maintenance operations that led to the initial explosion (Doyle 2003, p.179). Some of the lessons that may be learned from this disaster are the following: a. The importance of the availability of firewater to cool the facilities and prevent escalation. b. Another is the mistake of putting the central control room, radio room, and accommodation near the gas compression area. In addition, the location of the accommodation on top of the installation that caused smoke accumulation inside the quarters. If the accommodation had been on a low level, it would have been avoided filling up with smoke so fats, and would have provided better access possibilities to the lifeboat stations, at least in the initial stages of the accident. c. Another lessons learned from operation is the consequence of putting fire water pumps on manual start when it should on automatic standby for as long a time as possible. d. Another is the hope that many offshore employees still have, that emergency evacuation is sensible by means of helicopters, is a significant problem. If we ignore the effect of smoke from the accident, and suppose that helicopters could still land after the first gas riser rupture, and then by the time the accommodation module collapsed into the sea, there could still have been perhaps 90-100 people waiting for a helicopter seat. This is even more serious when it is realised that the helicopter would only have needed to ferry people to the mobile emergency unit just a couple of hundred metres away (Vinnem 2007, p.93). e. The PTW or the Permit-to-Work system on board was apparently failing severely and in fact, the operator’s HES or Health Environment and Safety management system received severe criticisms. 5. Assessment of the Implications if such accident happen to Preston “Accidents by definition are untoward events” (Jasanoff 1994, p.3). They occur without warning and by unpredictable pathways. Technological accidents such as the Piper Alpha disaster, the collapse of a bridge, the busting of a dam, the escape of deadly radiation, and so on, strike us as particularly frightening because they represent a sudden breakdown in a smoothly functioning, inanimate world, which seemed beforehand to stand apart from human agency and the possibility of human error. Disaster can happen anywhere even in Preston because these technological disasters often reveal an entirely different picture in which not only things but also people and institutions played an essential and destructive role. Although the accident involves oil platform far away in the North Sea, occurrence of a disaster with such magnitude can happen elsewhere. Preston, an industrialised city with a population larger than the number platform workers may suffer bigger losses in terms of life, property, and economy. The accident may not occur in an oil platform but fire knows no boundaries. At Preston, where modern technologies are also present, explosion and subsequent fire may occur in an office building, a hotel, a restaurant, a home. Human error started the Piper Alpha disaster and human error can happen anywhere in Preston. This is because “human error can occur in the design, operation, management, and maintenance of the complex systems characteristics of modern life” (Senders and Neville 2001, p.1) thus, Preston is no exemption. There is nothing new about tragic accidents caused by human error. For instance, the Tenerife runway collision in 1977, the Bhopal methyl isocynate tragedy in 1984, the Challenger and Chernobyl disasters in 1986, the capsize of the Herald of Free Enterprise, the King’s Cross tube station fire in 1987. The nature and the scale of certain potentially hazardous technologies mean that human errors can have adverse effects almost anywhere. 6. Bibliography Doyle Christine E. 2003. Work and Organizational Psychology: An Introduction with Attitude. Psychology Press, UK Jasanoff Sheila. 1994. Learning from Disaster: Risk Management After Bhopal. University of Pennsylvania Press, US Kletz Trevor A. 2001. Learning from Accidents. Gulf Professional Publishing, UK Reason J. T. and Hobbs Alan. 2003. Managing Maintenance Error: A Practical Guide. Ashgate Publishing, Ltd., UK Senders John W. and Neville Moray. 1991. Human Error: Cause, Prediction, and Reduction. Lawrence Erlbaum Associates, US Tweeddale Mark. 2003. Managing Risk and Reliability of Process Plants. Gulf Professional Publishing, US Vinnem Jan Erik. 2007. Offshore Risk Assessment: Principles, Modelling and Applications of QRA Studies. Springer, Netherlands Wells G. L. 1997. Major hazards and their management. Institution of Chemical Engineers (IChemE), UK Read More