The Worst Offshore Industry Accident
Original Language
Although several other accidents such as Deepwater Horizon (USA), and P-36 (Brazil), no accident of the offshore industry has caused more deaths than Piper Alpha. The disaster was caused by a succession of failures. There was also a poor safety culture, which aggravated the consequences of the accident. But the investigation concluded that the main cause of the high number of fatalities was the failure of the strategies and means of escape and abandonment. All the people who survived, had to disobey the original procedures. The Piper Alpha disaster has become a landmark in the history of offshore safety and many changes have occurred in the projects after the accident.
A study about Piper Alpha accident was presented at the "Seminar of the Biggest Fires in History" in The California State University, San Jose CA - USA. The seminar was coordinated by Professor David Krack and included studies on the major fires of history and is part of the post graduate degree in safety engineering of the Charles W. Davidson College of Engineering, .
Here is a part of this study, which summarizes the Piper Alpha accident in 8 steps and also includes a summary of "lessons learned" from this tragedy:
1
2
The disaster began with a routine maintenance procedure. On the morning of the 6th of July 1988, a certain backup propane condensate pump in the processing area needed to have its pressure safety valve checked. The work could not be completed by 6 pm and the workers asked for, and received permission to leave the rest of the work until the next day.
3
Later in the evening during the next work shift, the primary condensate pump failed. None of those present were aware that a vital part of the machine had been removed and decided to start the backup pump. Gas products escaped from the hole left by the valve.
4
Gas audibly leaked out at high pressure, ignited and exploded, blowing through the firewalls. The fire spread through the damaged firewalls, destroyed some oil lines and soon large quantities of stored oil were burning out of control. The automatic deluge system, which was designed to spray water on such a fire in order to contain it or put it out, was never activated because it had been turned off.
5
6
7
8
This platform, located in the North Sea approximately 110 miles from Aberdeen, Scotland, had 226 people on board at the time of the event, 165 of whom perished (in addition, two emergency response personnel died during a rescue attempt). The platform was totally destroyed.
2
The disaster began with a routine maintenance procedure. On the morning of the 6th of July 1988, a certain backup propane condensate pump in the processing area needed to have its pressure safety valve checked. The work could not be completed by 6 pm and the workers asked for, and received permission to leave the rest of the work until the next day.
3
Later in the evening during the next work shift, the primary condensate pump failed. None of those present were aware that a vital part of the machine had been removed and decided to start the backup pump. Gas products escaped from the hole left by the valve.
4
Gas audibly leaked out at high pressure, ignited and exploded, blowing through the firewalls. The fire spread through the damaged firewalls, destroyed some oil lines and soon large quantities of stored oil were burning out of control. The automatic deluge system, which was designed to spray water on such a fire in order to contain it or put it out, was never activated because it had been turned off.
5
About twenty minutes after the initial explosion, at 10:20 pm, the fire had spread and become hot enough to weaken and then burst the gas risers from the other platforms. These were steel pipes of a diameter from 24 to 36 inches, containing flammable gas products at two thousand pounds per square inch of pressure. When these risers burst, the resulting jet of fuel dramatically increased the size of the fire.
6
The accommodations were not smoke-proofed, and the lack of training that caused people to repeatedly open and shut doors only worsened the problem. Conditions got so bad in the accommodations area that some people realized that the only way to survive would be to escape the station immediately.
7
They, however, found that all routes to lifeboats were blocked by smoke and flames, and in the lack of any other instructions, they made the jump into the sea hoping to be rescued by boat. Sixty-two men were saved in this fashion; most of the other 167 who died suffocated on carbon monoxide and fumes in the accommodations area.
8
The generation and utilities module, which included the fireproofed accommodation block, slipped into the sea. The largest part of the platform followed it. The whole accident took place in 22 minutes.
Lessons Learned
Regulatory Control of Offshore Installations
The accident was instrumental in bringing about the Offshore Installations (Safety Case) Regulations.
A safety case is a written document in which a company must demonstrate that an effective safety management system (SMS) is in place on a particular offshore installation. The implementation of this was handed over to the HSE in 1991.
Adherence to Permit-to-Work System
This was a system of paperwork designed to promote communication between all parties affected by any maintenance procedure done on the platform. The system on Piper Alpha had become too relaxed. Employees relied on too many informal communications and communication between shift changes was lacking. If the system had been implemented properly, the initial gas leak never would have occurred.
Quality of safety management is critical
The Cullen report on Piper Alpha was highly critical of the management system in the company. Managers had minimal qualifications, which led to poor practices and ineffective audits.
Disabling of protective equipment by explosion
The firewalls on Piper Alpha could have stopped the spread of a fire. They were, however, not built to withstand an explosion. The initial blast blew the firewalls down, and the subsequent fire spread unimpeded
Need for safety training
The workers on the platform were not adequately trained in emergency procedures, and management was not trained to make up the gap and provide good leadership during a crisis situation.
Auditing is vital
The Company had regular safety audits of its facilities but they were not performed well. Few, if any, problems were ever brought up, even though there were serious issues with corrosion of deluge system pipes and heads and many other issues. When a major problem was found, it was sometimes just ignored.
Proper isolation of plant for maintenance
The disaster would not have occurred if the pump where work was being done had been positively isolated. Isolation is not achieved by shutting a valve but requires means such as insertion of a slip plate or removal of a pipe section.
Limit inventory on installation and in pipelines
The large inventory of the pipelines connected to the platform fed the fire. Despite technical problems, it should be a design objective to reduce the amount of hydrocarbons.
Emergency Shutdown Valves
Proper location of emergency shutdown valves and backup valves are essential to cutting off fuel supply in case of a fire; above water positioning provides testing accessibility for vigilant maintenance.
Fire and explosion protection
Protection against and mitigation of fire and explosion as well as fire fighting are of particular importance as there is no possibility to rely on outside assistance, such as the fire brigade.
Temporary Safe Refuge (TSR)
TSR on each installation should have a breathable atmosphere through prevention of smoke ingress and provision of fire protection; escape routes and embarkation points should be determined through safety cases. Prevention of smoke ingress into TSR is available through smoke and gas detectors that initiate smoke dampers and prevent circulation of smoke throughout the TSR
Evacuation and Escape
More than one route to helicopters and lifeboats must be present at any given time to ensure evacuation of the platform in a crisis situation. To facilitate escape from a hazardous situation, luminescent strips and heat shielding provide visibility in smoke and protection from flames, respectively. Secondary escapes such as ropes, ladders, and nets are also available as backup for the more sophisticated escape methods
Use of wind tunnel tests and explosion simulations in design
Wind tunnels are useful to assess the effectiveness of the ventilation and the gas detection system. The explosion simulations help investigate the effect of different layouts on explosion overpressures and assess the effectiveness of blast walls.
Memorial to the Disaster Hazlehead Park, Aberdeen, UK
References:
1) Lees’ Loss Prevention in the Process Industries: Hazard Identification, Assessment and Control, ed. Mannan, S., 3rd edition, Elsevier Butterworth-Heinemann, 2005.
2) Learning from accidents, Kletz, T., 3rd edition, Gulf Professional Publishing, 2001.
3) The Public Inquiry into the Piper Alpha Disaster, Cullen, The Honourable Lord, HM Stationery Office, 1990.
4) Building Process Safety Culture, CCPS, New York, NY, 2005
O
sucesso de um empreendimento tecnológico está associado ao respeito aos
fatores humanos, ambientais, econômicos e sociais que estão sob sua
influência. Bons valores estabelecem a boa Cultura de Segurança !
