Sunday, December 29, 2013

Chain of Events, Chain of Supply and Quality of Decisions in disasters- The case of Piper Alpha

Sometimes looking again at past events provides a new perspective that may not have been as apparent. The Piper Alpha offshore drilling platform incident in 1988 may be one of those unfortunate events that provides insight, for supply chain disruptions and for better decision making during response and recovery.

I had the chance to watch the presentation by Brian Appleton, the Technical Assessor to the Cullen Inquiry into the event. You can see it here by clicking on the picture, and I highly recommend it (note: it's a little long).Nat Geo does a great job with the details: LINK to MOVIE

 Appleton Video of Piper Incident

Below are a couple of slides on what the lessons learned are already. They are from a presentation by David Reynolds of Clyde and Co, during a 2013 conference by Lloyds (link). Of the 226 crewmembers, 167 were killed, 30 of whose bodies were never recovered. Only 59 men survived and most of these were scarred for life, not only from horrific burns, but from the memory of the explosion and fire on the Piper Alpha on 6th July 1988 and the loss of lifelong friends and workmates.


But there are three areas that may be worth looking at again, these have to do with the effects of the supply chain (in this case multiple platforms),  and decision quality of those in charge:

1) The effect of "chaining supplies": 
First, is in terms of communication across separate entities in a "chain". What caused the real damage at Piper, and made the situation astronomically worse was that the supply from the other two platforms (which were being routed to Piper to consolidate and send to shore) were never stopped! The continuous supply fed the fire, which weakened the gas lines, which caused the major gas line. Report of the disaster note:

"The Tartan (11 miles away) and Claymore (21 miles away) platforms continued to supply oil and gas, despite the flames from Piper being visible to them. If they had shut down the supplies to Piper, the fire and subsequent explosions would have been much less severe and may have been have been limited to the Gas Module. Although the explosion and fire caused by the escape of gas from the PSV blinds was the initial cause of the disaster, the failure and rupture of the gas risers were responsible for Piper's destruction and preventing the crewmembers evacuation. (Source).

Here's what is written about the accident: " Despite the fire on Piper being visible from both these platforms" but gas was still being supplied from Claymore and Tartan, and would continue for some time". With the gas supply from Tartan "there was no way of going back" as increased fire and explosions make more of the pipe of supply to fail and add fuel to the fire...the result is explosion after explosion.....

What does this mean in supply chain language: Well, to start this is the equivalent of a supplier providing parts that are causing downtime downstream for the manufacturer. But the manufacturer doesn't know the cause. Since the manufacturer is unable to communicate, and the supplier doesn't know (and doesn't realize the ramifications of his action), the problem escalates. Supplier keeps sending parts that cause more damage to the manufacturer. How Claymore and Tartan reacted is essentially the same, they never thought about their fresh fuel adding to the inferno. 

In a supply chain context, this is the equivalent of an oblivious supplier providing parts, even if the manufacturer can not use them. Except in this case the extra supply extended the problems being faced by the manufacturer. One way to look at it is below: 



2) The Butterfly effect: The massive inquiries on this disaster by the British authorities highlight the primary cause of failure as paper work. Quite sombering is their findings: Two work permits one on a pump and the other on its safety valve were the cause, simply because they were not kept together. The pump was back online, but without a safety valve and those who need to know did not know. The operators used it. This caused the first explosion, which then caused a loose fitting metal disk to cause a second explosion. The second explosion caused the firewalls to break up and shatter into piping. One of the piping was carrying condensate, which caused a larger explosion, which caused fuel leaks on to rubber matting that divers left on the rig. This provided a long lasting fire which caused high pressure pipes providing fuel from Titan to burst....from there, other pipes blew up one after another in a sequence as the rig became hotter and hotter. 

We could tell the cause of this regrettable story this way:

Faulty paperwork 
Caused the pump without the safety-valve to 
Cause an explosion to 
Cause the loose fitting metal disk to 
Caused a larger explosion to 
Cause the firewalls to burst, and fly around like bullets to 
Cause rupture to an oil pipe that dripped onto the improperly placed diving rubber mats to 
Cause a pool of crude oil, to 
Cause a hot enough fire to 
Cause a high pressure gas line to burst to 
Cause hotter and more ongoing fire to 
Cause other pipes carrying fuel from other platforms to 
Cause Piper Alpha and 176 of its crew to fall to the bottom of the ocean.

In short, it was a tightly linked chain of events in a complex system that caused the failure in Piper Alpha. 
A break anywhere in the chain could have made the damage much less. 

3) Decision quality, preparedness of decision makers: 
Many of those killed  died from asphyxiation in the accommodation because they decided to stay in the accommodation section of the platform. Most of those who took the risk of jumping off of the platform actually survived. Those who stayed apparently were never told that they ha better odds if they left the quarters. Of course, no safety manual would suggest for a worker to jump off the equivalent of 11 stories into a thick black smoked sea. However, if those in charge were able to read the situation better, perhaps they would have told others to follow those who jumped of which 59 survived. 

What do we learn? As systems become more complex, the probability of small events causing larger ones becomes more real. This is already known. A rogue trader can bring down a banking empire (Nick Leeson and Barings Bank). A faulty supplier using bad paint can cause major damage to a major toy manufacturer (Mattel) . A momentary lapse by a train operator kills people and shuts down New York rail system for an entire day (see a post below) and issues with batteries used for backup and start can down an entire fleet of airplanes (Boeing) for months. So, it should not be surprising to see small matters cause major issues. Of course, if we could predict these small issues, we would not have to deal with the aftermaths like these. So, it may be best to raise vigilance and ability to respond, or the cliche word: Resilience. Resilience at the individual level, and the work group level, at the organizational level and at the supply chain level can help - not just to avoid mishaps, but to be better prepared to deal with the aftermath. 

Brian Appleton's report and presentation on Piper Alpha purposefully mention how "The details of an industrial accident don't repeat themselves". Indeed it is these details that will be difficult to try and predict and control to the full extent. Rather, a bit of situational awareness from the part of the suppliers and managers may have helped limit the damage here. 









7 comments:

  1. Eric Staffin (FBCI, CISSP)December 30, 2013 at 7:14 AM

    Tragic for sure .. now separating this incident into its clinical parts, we can also clearly see that there was a breakdown in business continuity management (BCM) relative to the planning, testing, and crisis management aspects of the incident. A deeper understanding of the importance that BCM plays is paramount, and is recognized and practiced by many of the world's leading companies. In order to promote a more advanced perspective on disruption management, it is crucial for all enterprises (public and private) to regularly validate requirements and capabilities, perform needed corrective actions based on findings, scenario testing, and program/product/process maintenance, continue to optimize overall solution design – relative to stakeholder requirements (embracing cost and risk as gating requirements), and architect resilient solutions as products, processes, and systems are being developed. BCM and Crisis Management are the price to "play" (table stakes) when failure results in loss of life, employee/community safety, and shareholder value.

    ReplyDelete
  2. You can see how the topic has moved away from what Brian Appleton focused on to what we tend to focus on. The issue then was safety. The issue now is ensuring that things continue operating. BCM is essentially that - to make sure an explosion in one area does not cause the rest of the operation to fail. Backups and flexible systems are one way to do so. Scenario testing and "what if" questions are indeed a key aspect of the job of OIMs these days according to the literature. Today we wonder why no-one in the industry saw the ramifications of having the paperwork for the safety valve and the pump not to be together! Business Continuity is not only the assurance that the paperwork stays together, but that if it does separate, it does not lead to larger and larger crises.

    ReplyDelete
  3. Thanks for sharing information.The issue now is ensuring that things continue operating. BCM is essentially that - to make sure an explosion in one area does not cause the rest of the operation to fail. the planning, testing, and crisis management aspects of the incident. to regularly validate requirements and capabilities, perform needed corrective actions based on findings, scenario testing, and program/product/process maintenance, continue to optimize overall solution design – relative to stakeholder requirements(embracing cost and risk as gating requirements), and architect resilient solutions as products, processes, and systems are being developed.

    Regards
    Iosh training in chennai
    safety training in Chennai
    Iosh ms course training in chennai

    ReplyDelete
  4. Thanks for sharing information.The issue now is ensuring that things continue operating. BCM is essentially that - to make sure an explosion in one area does not cause the rest of the operation to fail. the planning, testing, and crisis management aspects of the incident. to regularly validate requirements and capabilities, perform needed corrective actions based on findings, scenario testing, and program/product/process maintenance, continue to optimize overall solution design – relative to stakeholder requirements(embracing cost and risk as gating requirements), and architect resilient solutions as products, processes, and systems are being developed.

    Regards
    Iosh training in chennai
    safety training in Chennai
    Iosh ms course training in chennai

    ReplyDelete
  5. Thank you for another great article. Where else could anyone get that kind of information in such a perfect way of presentation.

    # Writer @ online cheap essay writing service

    ReplyDelete
  6. You could access all techniques by finishing a basic payment for the initiatives we have actually placed in to produce these practical options to obtain Free Xbox Live Gold for you! A number of functions of the Xbox One only deal with an Xbox Live Gold membership, such as the capability to tape on your own, calling by means of Skype as well as OneGuide", which is a method to enjoy TELEVISION. Some video games or console packages might consist of a pre-paid code for an Xbox Live gratuit Gold test membership. Yes Two Days may not suffice however obtaining it completely free is definitely a great catch. We have actually assisted countless players obtain the much required xbox live subscription codes.

    ReplyDelete