Learning the lessons of deepwater asset integrity

The Piper Alpha accident was a monumental event. It is, perhaps, in terms of impact a top-five engineering disaster on the global scale, considered to be in the same league as Chernobyl, Challenger, Three Mile Island, Flixborough, etc. In terms of cost, it was also very expensive (estimated at more than $3.4 billion). And in many ways it is historically comparable to other

high-impact human events, in that people (certainly in the British Isles and the North Sea community) often remember where they were on the day. In that way, Piper Alpha seems to have uniqueness about it, which may be due to the fact that it was offshore and involved a heavily manned producing platform. With the benefit of hindsight, we can conclude that the disaster was de facto man made, in that the original platform had many major design changes made to convert it into a gathering and distribution hub.

Though not a deliberate act in any way, many human and engineering errors were seen to hideously come into play. Many studies have looked at that aspect, including the Cullen Report which was published in 1990. This was the culmination of a thorough two-year inquiry involving many interviews with survivors, families, and subject-matter experts of the day. The Cullen report has tended to be the mainstay reference source for all new offshore design and operational guidelines the world over. Some regions have used the findings rigorously whereas others have used them less in depth. Overall, the report led to the effective dissolution of the prescriptive regulations sanctioned up to that point, and replaced them with the evolution of the goal-setting integrity regulations in the UK and with derivatives thereof.

On the plus side, the major outcome of the disaster has been far better, safer, and more efficient engineering practices for the oil industry. And this, in turn, has reinforced the need for Inherently Safe Designs and procedures. These have been realized by better, more focused research, better applied knowledge management, and a greater sense of public and industry responsibility by the new generation of engineers and scientists.

Many more offshore, subsea and integrity-related projects and courses have evolved worldwide, largely at contract research or post-graduate level, much to the advantage and betterment of the industry. This has been promulgated by the recognition that the design of the asset – structure, pipeline, and pressure plant – can no longer be based on projected revenues alone. Yes, the ultimate decision maker or breaker can and often is the commercial sensibility, but a greater sense of responsibility to the public, and the environment, has fallen into place. This is largely Regulatory-driven, but one can still discern a good dose of professionalism, merit and worthiness in the arena.

Root causes

Regarding the accident there was, perhaps, no single root cause event that was to blame. Rather, it was a confluence of many critical factors that were almost the “perfect storm.” This is often described as the jigsaw or “Swiss cheese” effect, whereupon critical events occurring at a certain juncture in time; and as a consequence the failure sequence fell into place, with tragic results. In reality, integrity management (IM) is far more complex than basic maintenance (a common misnomer). The parameters affecting IM are non-linear, and have their greatest impact during IM pre-planning, post-planning, action and reaction, etc. They usually involve the alignment of bad sequences, events or circumstances. They are invariably all time-dependent and thus multi-dimensional in nature. This has traditionally made IM a difficult subject to grasp, especially since it transcends both CAPEX and OPEX cost centers.

The Piper Alpha platform was commissioned in 1976, but was modified to act as a major gas processing and gathering station. This meant it was handling large amounts of high-pressure gas, with a dispersed plant layout, making inspection, maintenance and repair difficult. The rapid technology advances of the day, coupled with powerful commercial pressures, clearly had a lot to do with the event. Regarding the best way forward, it is important to identify all integrity-related threats, some of which may be discerned as at a secondary level, albeit with the potential to give similar disastrous results if not taken fully into account. The majority of these are materials performance and corrosion related. The latter is an important point, and necessitates the examination of second tier issues, which usually arise within lower profile design parameters. Examples include pressure (leak) containment, corrosion analysis, erosion, wear and tear, inspection, monitoring, pigging, and maintenance. Thus, it is not hard to see that once the Piper Alpha was converted to its hub status, it became more important to continue producing. As a result, the inspection, maintenance and corrosion control aspects became less important.

After the disaster it became apparent that the Piper suffered serious corrosion problems, particularly regarding the condensate pumping systems, which were in fact later determined to be at the heart of the problem on that fateful day. Essentially, the condensate pumps were under much delayed repair and maintenance schedules. On the fateful day, the work was underway but incomplete. Thus, the supervisor prepared a permit to work (ptw) for the work to be continued by the next shift. The pump was temporarily blanked off, and the paperwork was submitted. Unfortunately, the ptw got mislaid and the next shift erroneously switched on the pump. Since the backup was offline, the blind flange failed and a massive leak of gas under high pressure was released. A detonation was inevitable. When it happened, the fire fighting systems failed, other platforms continued to feed into the hub, and the disaster as we know it unfolded.

After the accident, due to the media frenzy of the day, the causes were variously reported over the first year as: metal fatigue, poor maintenance, inadequate operating procedures, bad work practices, human error, etc. The full report is a public document, and much educational material, videos/DVDs etc. are readily available for the interested reader. The Cullen report and other studies have highlighted many reasons for the disaster, the most damning of which were:

• Poor plant design (including rapid modifications and changes)
• Breakdown of the permit to work system (probably not fully tested under all scenarios)
• Bad maintenance management
• Inadequate safety auditing, and training procedures
• Poor communications (all levels)
• Poor emergency management (including with regard to action of surrounding platforms).

The Cullen report made over 106 recommendations, which included in summary:

• The transfer of government responsibility for offshore health and safety to the Health and Safety Executive (HSE) was generally well received.
• The establishment of a Safety Case regime (entailing independent verification).
• Overall review of legislation, definition of best practices, and better use of loss prevention studies.
• Better work force involvement (crucial but sensitive).
• Verification and intervention when necessary.
• Permit-to-work systems (ideally fail safe and tamper proof).
• Systematic approach to safety, responsibility of everyone (senior management and down the line).
• Emergency response and incident reporting (effectively by training and changes in attitude and culture).

It has to be said that most of the activities listed above still fall in the grey area of judgment, and in that case best practices must therefore be interpreted and applied through the identification of safety critical systems and components, proactive risk analysis, risk reduction, and therefore risk management. There are many other important derivations from the Cullen report, but without unnecessarily going outside the scope of this article, it is quite clear that management of change (MOC) is and will continue to be the best tool available in the ever-improving area of knowledge management.

Industry changes

The many ensuing industry changes identified since the disaster have, in fact, taken many years to come to fruition. Overall, most offshore regions – in particular the North Sea, GoM, and Australia – have embraced the new culture of safety. To be sure, there is sometimes a dangerous disconnect between theory and the actual practice of implementation. The rest of the world

has responded in a slower manner, but with positive results, especially the SE Asia regions and offshore India.

The very heartening implementation of best practices (by choice, not necessarily regulation) has given greater confidence for the new, challenging deepwater explorations and subsea tie backs in the GoM and the new frontier Arctic regions. The most notable changes are interpreted as follows:

• Changes to offshore asset design, requirements for design review, more latitude for concept creativity, better rationale for engineering conservatism and pragmatic safety.
• New goal-setting legislation; i.e. the Safety Case, and better use of subject matter experts (SMEs).
• The goal setting idea replaces the prescriptive method. This has proved to be a step change in offshore safety and engineering performance.

For the GoM, it has been stated that the regulations conferred by the governing (now former) MMS are “fit for purpose.” This suggests the designs are suitable at construction, but the gradual drift of this meaning has evolved to “life-cycle fitness for purpose” and this appears to be adopted and embraced by the more recent generation of engineers (typically 5-10 years

experience) as they enter the fray. The subtle debate now ongoing is at the material selection stage. There are two schools of thought, namely the distinction being made of whether to select carbon steel and then carefully manage the operational corrosion; or to select the corrosion resistant alloy option with minimal corrosion management. The contrary arguments are usually cost-center based, with strong opinions tested for CAPEX and OPEX scenarios. In other words, do we pick materials for immediate fitness for service at fabrication (“just build it”) or fitness for materials life cycle performance? The answer is now emerging as a requirement for both, and to that effect the materials engineering specialist is having an ever-more assertive role to play within the large multidiscipline teams usually engaged on high capital projects.

Implementation

The implementation of the Cullen report recommendations has, it is believed, shown through various studies that reportable incidents that impact safety issues in the UK sector have been significantly reduced by some 75% – a major achievement. This clearly means the industry is on the right track, but there are still problems and issues. It is argued that more attention should and must be made to the secondary tier items such as root cause corrosion mechanisms, advanced

monitoring and inspection techniques, etc. This aspect is best illustrated by an adaption of the “Swiss cheese” effect. It is to this effect that this article is targeted, with the intent that by paying more focused attention to these parameters and findings, the integrity management discipline will be more substantively improved.

The Cullen report also identified two areas of under-emphasis that may be appropriately reasoned, firstly the industry tendency to avoid the acceptance of external consultants’ advice if the recommendations are not supported by more experienced personnel, often even if the consultation seems logical and safety sensible. The case of the central riser argument for the Piper Alpha is cited; here evidently the dangerous proximity of the risers to the control and radio room areas was, in fact, identified, but no action taken (design change, relocation, blast walling, etc). Nowadays, virtually all new designs insist on the risers being as far away as possible from the accommodations.

The “Swiss cheese” analogy as applied to materials engineering.

The second point of observation is the concept of addressing root cause effects. The Piper Alpha condensate pump problems that initiated the whole tragic sequence of events were plagued with corrosion problems, the attendance to which was seemingly consistently delayed as lower priority. Apparently some platform corrosion issues were left for over four years. If corrosion management as a recognized discipline had been in place, rather than an ad hoc to-do item, then again (with the benefit of hindsight), the tragedy could have been avoided. That, unfortunately, is how the learning and knowledge management process works. And it has to be said that companies today often have very valuable lessons-learned meetings after major projects are concluded. There is a strong case, and new initiatives, underway for such formal lesson learning on an ongoing basis.

The use of modern-day corrosion risk assessment techniques are under development and application. It is hoped that ultimately these will be implemented by the weight of motivation, though in reality some degree of mandatory regulation may be ultimately required. In almost all major comparable disaster cases, the commonality has been the confluence of many variables coming into a tragic alignment, sometimes referred as the jigsaw or “Swiss cheese” effect. The authors of this article contend that in almost all cases, the loss of materials performance as stimulated by corrosion is the root cause effect. A close examination of the modes of failure reveals the uncanny role of corrosion dissolution at either the macro or micro level (whether it be by alloy, embrittlement, crevice corrosion, mixed metal galvanic, etc) the outcome is the same: severe loss of material properties and/or load carrying capabilities.

The resolution of the corrosion aspect will, therefore, in virtually all cases eliminate the closure of the jigsaw effect, thereby preventing the failure. On a positive note, the concepts of knowledge management, advanced inspection techniques, implementation of MOC, and the more newly defined roles and responsibilities for pertinent decision makers, etc., have all been very instrumental in making this industry safer and better equipped to tackle the challenges faced ahead. It is strongly argued that one new recommendation that would be instrumental in helping improve this aspect an order of magnitude would be the “mandatory” requirement for each asset to submit a clear annual corrosion integrity statement on the facility, and pertinent (safety critical parts) thereof. The burden for doing this is not high, but the results would be extremely positive.

Conclusion

The Piper Alpha review has been a work in progress, with many derived findings, conclusions and specifically KPI-based recommendations, most of which are capable of being tailored to new and existing projects. The most valuable observation is the need for continued life cycle vigilance, most likely through diligent but limited regulatory control, since the North Sea experience has shown that “over regulation” can impose major financial burdens often to the detriment of the project, and sometimes to the creativity of solutions.

It is important for the future deepwater offshore community to look more closely at new designs and new solutions from both a materials fabrication and the materials performance basis, especially for safety critical elements such as SCRs, and pressure containment plant, and potential leak sources at interfaces. Companies must continually re-educate staff so that lessons learned (and near misses) are not forgotten, and be prepared to look at alternative approaches to design/operational issues even if they emanate from unconventional sources.

Better cooperation between the CAPEX and OPEX cost centers is vital if full advantage of lessons learned from Piper Alpha and other disasters are to be realized. In reality, this may take the form of an extended CAPEX commitment. History has shown that major step change progress is usually made after major disasters and often through non-conventional means. The new solution sets, and developments vis-a- vis inherently safer designs will come from a closer liaison between industry and academia, as exemplified by the JIPs already in place. The powerful role of academia – whether through JIPs or self driven changes in university curricula – will be instrumental in the paradigm shift required and perhaps expected.

Acknowledgment

Based on a paper presented at the Deep Offshore Technology International Conference, held at the George R. Brown Convention Center in Houston, Texas, February 2-4, 2010; and on a paper presented at the Offshore Technology Conference, “Offshore Integrity Management 20 years on—Overview of Lessons Learnt Post Piper Alpha (Paper # OTC-20051-PP).