Piper Alpha: The Permit Cleared the Job, Not the Pump

Chapters

1. 0:00 The form, and the box at the bottom
2. 1:04 The version everyone knows
3. 1:53 Two pumps, one valve each
4. 2:47 Permit 23434
5. 3:58 Three jobs, one phrase
6. 4:51 What the form asks
7. 5:50 Where the paper lived
8. 6:52 The handovers
9. 7:37 The pump that tripped
10. 8:29 A hand-tight flange
11. 9:32 Thirty to eighty kilograms
12. 10:26 The next hour
13. 11:38 The ten months before
14. 12:34 What Cullen changed
15. 13:32 The paper was in a drawer

Transcript

The form, and the box at the bottom 0:00

This is the form. On Piper Alpha, every dangerous job began on one of these, and ended on one. At the bottom there is a box called clearance certification. It is where a job is closed. It says that the work is completed, or suspended. That all men have been withdrawn. That all tools have been removed. And that obstructing objects do not remain. It does not say that the equipment has been left safe. The regulations of the day said that it should. On the sixth of July, 1988, a form like this was signed off at about six in the evening, on the job of taking a safety valve off a pump. The valve was not put back. Less than four hours later, the night shift set out to start that pump. The story is that nobody knew. The public inquiry found something harder to hear. The valve was written down. The paper simply answered a different question.

The version everyone knows 1:04

The version most people know is a night shift that started a pump with no safety valve on it, because somebody forgot. Or was careless. There is truth in that, and the report does not hide it. Handover was poor. The permit rules were broken, again and again, in ways the inquiry lists one by one. But look at the people. The lead operator was described as experienced and conscientious. Lord Cullen wrote that he would not have started that pump if he had known the valve was off. Nor would the maintenance lead hand, who was part of the decision. So the question is not why careful people took a risk. It is why a fact that at least half a dozen people had handled that afternoon was not in the room when it was needed.

Two pumps, one valve each 1:53

Piper Alpha stood a hundred and ten miles north-east of Aberdeen, and it had been producing oil since 1976. Two hundred and twenty-six men were on board that night. In the gas compression module, the heavier part of the gas dropped out as a liquid called condensate. It was pumped back into the oil line to shore. Two pumps did that job, one level down, on the sixty-eight foot deck. One ran, and one stood by. There was no automatic changeover. If the running pump stopped, someone had to walk to the other and start it by hand. Each pump had one pressure safety valve, which opens if the pressure gets too high. It sat one level up, in C Module. Almost every other piece of equipment on the platform had two. These pumps had one.

Permit 23434 2:47

On the morning of the sixth, pump A was taken out of service for maintenance. Its safety valve, number five-oh-four, was due for recertification, like about three hundred others on the platform, on an eighteen month cycle. A contractor's team of two was doing the work, and this was the last valve on their list. By twenty to eight, two of the company's managers had signed the permit. It is number 23434. Under tag number it says PSV 504. Under location, C Module. And under additional precautions, that the open pipework is to be fitted with blind flanges. That afternoon the valve came off, and the open pipe was closed with a blind flange, a flat steel disc bolted over the end. By about six the valve was in the contractor's container, tested and certified, and the crane to lower it back was not available. It would go back in the morning. So the permit was suspended. The contractor's supervisor did it without going down to look at the site. The procedure said that he should.

Three jobs, one phrase 3:58

Meanwhile, the job on pump A was changing. Until about five that afternoon, the plan was a full overhaul, expected to take two weeks. Then a senior maintenance superintendent decided that only the work on the coupling should be done, and had not yet told anyone else. The words did not change. Pump A was still, in the language of the control room, out for maintenance. But that phrase covered three different jobs, and each was isolated a different way. A full overhaul meant spading the pump off. A coupling repair meant electrical isolation, and the pump was not even depressurised. Taking off the safety valve meant locking valves and disconnecting an air line, and no electrical isolation at all. Nothing in the control room showed which of the three was true that night.

What the form asks 4:51

Go back to the form. It has one box for the work, and one for the tag number of the equipment. The unit of the paper is the job. That night the plant did not care about jobs. It cared about one pump, and the pump had two jobs on it, on two permits. The permits did not point at each other. The tenth line of section D asks whether there is any other work which may affect this work. The inquiry found that this line was seldom used. At most it was ticked, with no detail. And the clearance certification records what the work party did. Men out. Tools out. The regulations required a declaration that the equipment had been left in a safe condition. The inquiry found that the form did not contain one. So the paper for the valve could be complete in every line, and say nothing about whether pump A could be run.

Where the paper lived 5:50

Now follow the paper. Active permits were kept in the control room, filed by the location of the equipment. The pump was on the sixty-eight foot level. Its valve was one level up, in C Module. The inquiry says it plainly: work on associated equipment on different levels would not be filed together. Suspended permits were not kept in the control room at all. They went to the safety office, apparently because there was not enough room to display them. And there they were filed by trade. Not by location, and not by equipment. That made it difficult, in the inquiry's words, for any supervisor to check readily which equipment was isolated for maintenance. In February 1988, someone counted. A hundred and twenty-four permits were outstanding, some suspended for months. The safety staff agreed the number should come down. No procedure was put in place to do it.

The handovers 6:52

At a quarter past five the lead operators handed over in the control room, for twenty minutes or so, working from notes on a pad. Nobody reviewed the active permits, or the suspended ones. That was not part of it. There was no written procedure for handover at all. What was passed on was left to the person passing it. At half past five the maintenance lead hands did the same, from a diary and a second pad. The valve was in neither. Some time after six, in the recreation room, the contractor's supervisor happened to meet the day-shift lead hand, and told him the valve was still off. By then the handover was over, and the night shift was on duty.

The pump that tripped 7:37

At about a quarter to ten that night, the running pump, pump B, tripped. Nothing switched over. Someone had to go and start pump A by hand. And there was reason to hurry. Without the condensate pumps the gas plant would in time stop, then the generators that ran on its gas, and the platform faced a total loss of power. The lead operator went down to pump B, and could not restart it. He came back to the control room for the permit on pump A. It carried two red tags, the electrical isolation of the pump. He wanted them signed off, so that the pump could be electrically reinstated. The maintenance lead hand came down and signed them too. Neither of them mentioned the valve. The inquiry concluded that neither of them knew.

A hand-tight flange 8:29

What happened next, nobody saw. Most of the equipment was never recovered, and the men at pump A did not survive. So Lord Cullen reasoned it out, and said so. On a balance of probabilities. The likeliest sequence: condensate was let into pump A. With no relief valve, the only thing between the pump and the module was the blind flange. Tests showed that a flange that was only hand-tight could pass the flow that was needed. A hole equivalent to about eight millimetres, open for about half a minute. The report gives a reason why a competent fitter might have left it that way. That afternoon, pump A was still expected to be down for two weeks. A hand-tight cover would keep dirt out of the pipe, and nobody expected the pipe to be under pressure. It is a possibility, not a finding, and the report says so. But the plan changed at five. The flange was never told.

Thirty to eighty kilograms 9:32

In the last few minutes, gas alarms began to sound in C Module, and two compressors tripped. At about ten o'clock, the cloud found something to ignite it. It was smaller than you would think. The inquiry put the fuel in the flammable part of the cloud at thirty to eighty kilograms. The wall between C Module and B Module was a fire wall. The report puts the pressure that breaks it at about a tenth of a bar, a pound and a half per square inch. The wall came apart, and its pieces broke a four-inch pipe in B Module. Crude oil poured into a fire. The explosion had also wrecked the control room and the main power. The diesel fire pumps were on manual, as they were on every night that divers were in the water. Even undamaged, someone would have had to walk to them and start them.

The next hour 10:26

At twenty past ten, the fire reached the riser from Tartan. A riser is the pipe that brings a pipeline up from the seabed. This one was eighteen inches across, with a wall one inch thick, painted and not fireproofed, and it ran just under the sixty-eight foot deck, where the oil fire had spread. The fire heated it until it failed. Behind it was a pipeline full of gas, and the gas came out through the break. The inquiry judged that fireproofing could have delayed that rupture by one to three hours. At about ten-fifty, the riser on the line to the Frigg field failed. At about twenty past eleven, the one from Claymore. Of the two hundred and twenty-six men on board, sixty-one survived. A hundred and sixty-five died, and two more, crew of a rescue boat. It was the highest death toll in the history of offshore operations. Of the bodies recovered, most died from smoke. The platform's system for control in an emergency had been almost entirely knocked out by the first explosion, and no one led the men gathered in the accommodation out.

The ten months before 11:38

None of this was new to the platform. On the seventh of September, 1987, ten months earlier, a rigger was killed in A Module, on a job that had grown beyond its permit. The company pleaded guilty, and the charge included inadequate communication of information from the day shift to the night shift. Witnesses told the inquiry that after the death, and after the plea, nothing changed in handover practice. An experienced maintenance lead hand had told a company seminar in early 1988 that communication of information was totally inadequate. By the sixth of July nothing had come of it. The permit for the valve still said: operator to isolate as required. Government inspectors had visited that June and found none of this. The inquiry called the inspections superficial to the point of being of little use as a test of safety on the platform.

What Cullen changed 12:34

Lord Cullen made a hundred and six recommendations. Several of them read as an answer to one question: what is the unit of the paper? Every permit system must include physical locking off and tagging of isolation valves. He wrote that had such a system been in use on Piper, it would have stopped the operating staff from opening the valves that let condensate into pump A. Where several jobs share one isolation, the locks are per permit, and de-isolation cannot happen until every permit's lock is gone. A permit and its isolations stay in force until the equipment is returned to operation. And copies of all issued permits must be displayed in a systematic arrangement, so that operating staff can readily see which equipment is under maintenance and not available. The test is no longer whether the job was closed. It is whether an operator can see, from one place, that the pump is not available.

The paper was in a drawer 13:32

Four cases ago, a label decided what would be looked at. Here the paper existed. It was signed by two managers, and correct in every line. It answered a question about a job, and the night needed an answer about a pump. A form can only ask what its designers thought to ask. This one asked whether the men had left, and whether the tools were gone. On the sixth of July both were true. The valve was on paper. The paper was in a drawer. And the drawer was organised for something else. Next case is the same night, twelve miles away. On the Tartan platform, the pressure chart for the gas line to Piper went flat at twenty-five past ten. Nobody on Tartan knew that the sensor which drew it sat upstream of a valve. It was showing a false picture. When they opened that valve at twenty past eleven, there was almost no pressure left to measure.

Description and sources

On the evening of July 6th, 1988, the Piper Alpha platform, 110 miles north-east of Aberdeen, was destroyed by fire after an explosion at about 22:00. Of the 226 men on board, 61 survived; 165 died, and two more crew of a rescue boat, the highest death toll in the history of offshore operations.

The explosion began with a leak of condensate at condensate injection pump A, which had been taken out of service that day. Its only pressure safety valve, PSV 504, had been removed for recertification and the open pipe closed with a blind flange. The permit that recorded this, number 23434, had been signed by two managers at 07:40 and was suspended at about six, when no crane was available to put the valve back. The night shift, after pump B tripped at about 21:45, set out to start pump A. Lord Cullen concluded, on a balance of probabilities, that the leak came from a blind flange that was not leak-tight, and that neither the lead operator nor the maintenance lead hand knew the valve was off.

This episode is about the paper. The clearance certification on Occidental's permit form declares that work is completed or suspended, that all men have been withdrawn, that all tools have been removed and that obstructing objects do not remain. It does not declare that the equipment was left in a safe condition, which Regulation 3(4) required. The unit of the paper was the job; the unit of the plant was the pump, and the pump had two jobs on it. Active permits were filed by location, suspended ones in the Safety Office by trade; 124 permits were outstanding in February 1988. The plan for pump A had changed at about 17:00, from a two-week overhaul to work on the coupling, and no handover covered it.

The inquiry made 106 recommendations. Three of them answer the paper's mistake directly: lock and tag isolation valves, keep a permit's isolations in force until the equipment is returned to operation, and display permits so operators can see what equipment is under maintenance.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

• The Public Inquiry into the Piper Alpha Disaster (Lord Cullen), Cm 1310, HMSO, 1990, two volumes. Read in full: https://www.hse.gov.uk/offshore/piper-alpha-disaster-public-inquiry.htm
• Figs. 3.1, 3.2, 3.5 and 3.9 are reproduced from that report (Crown copyright, Open Government Licence v3.0). Fig. 3.9 is Occidental's own permit-to-work form, shown as a document under criticism.

ARCHIVE FIGURES — drawings and documents from the official report, with title, author, archive and licence. Crown copyright, used under the Open Government Licence v3.0 (contains public sector information), reframed for the screen.

• Fig. 3.9 — Occidental (via Cullen Inquiry) | Piper Alpha Public Inquiry report, HMSO Cm 1310, 1990 | OGL v3.0
• Fig. 3.1 — Cullen Inquiry | Piper Alpha Public Inquiry report, HMSO Cm 1310, 1990 | OGL v3.0
• Fig. 3.2 — Cullen Inquiry | Piper Alpha Public Inquiry report, HMSO Cm 1310, 1990 | OGL v3.0
• Fig. 3.5 — Cullen Inquiry | Piper Alpha Public Inquiry report, HMSO Cm 1310, 1990 | OGL v3.0

The 20 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system — the figures above are from the official report, the drawings are ours, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using official investigation reports and primary technical literature. Sources for this episode are linked above.

Charts and timelines are drawn from the sources listed above; the figures of the Piper Alpha platform and its permit form are reproduced from the Cullen report, credited on screen and above. Contains public sector information licensed under the Open Government Licence v3.0.

#engineering #processsafety #rootcause