4 ideas
On the night of 6 July 1988, the night shift on Piper Alpha restarted a condensate pump whose pressure safety valve had been removed for maintenance and replaced by a loosely fitted blank flange. Gas escaped and ignited, and the blast breached firewalls that had been designed to resist fire but not explosion. About twenty minutes later a high-pressure gas riser ruptured and engulfed the platform, killing 167 men, including two rescue-boat crew; 61 survived.
Most of the men who died had followed the emergency procedure: they mustered in the accommodation block and waited for a helicopter evacuation that the smoke and flames made impossible, and they died there from smoke inhalation. Most survivors abandoned the plan and jumped into the sea, some from well over 100 feet. When a procedure assumes conditions that no longer exist, obedience becomes the hazard, and survival depends on recognising that the plan has already failed.
The information that pump A's safety valve had been removed was held in a permit-to-work document, but it was not effectively passed to the incoming night shift. When the other pump failed, the night crew restarted pump A without knowing it was unsafe. A safety system that relies on paperwork and verbal handoffs fails at the seams between shifts, where no single person holds the full picture.
The nearby Tartan and Claymore platforms kept pumping oil and gas into the shared pipeline network after Piper was visibly burning. Their managers believed they lacked the authority to halt production without approval from onshore. In a tightly coupled system, a fire is sustained by every node whose people are not empowered to stop, so the decision rights for an emergency shutdown determine how large a disaster becomes.