Editing Piper Alpha (section)

=== Preliminary events ===
At 07:45, 6 July 1988, the [[permit-to-work]] forms for the day shift were issued and signed.<ref name=":17">{{Cite journal |last=Reid |first=Marc |date=2020 |title=The Piper Alpha Disaster: A Personal Perspective with Transferrable Lessons on the Long-Term Moral Impact of Safety Failures |journal=[[ACS Chemical Health & Safety]] |volume=27 |issue=2 |pages=88–95 |doi=10.1021/acs.chas.9b00022 |eissn=1878-0504 |doi-access=free}}</ref> Of the two condensate pumps, both located in module C, pump B was operating to displace the platform's condensate for transport to the coast, while pump&nbsp;A was due for maintenance. Two permits were issued to that effect, one for a pump overhaul and another for the removal of the pump's [[Safety valve|pressure safety valve]] (PSV #504), which was due for recertification. During the day, pump A was electrically and mechanically isolated, but containment was not broken. The PSV, instead, was removed. The open condensate pipe upstream of the PSV was temporarily sealed with a disk cover (a flat metal disc also called a blind [[flange]] or blank flange). It was hand-tightened only. Because the work could not be completed by 18:00, the blind flange remained in place. The on-duty engineer filled in information on the PSV removal permit to the effect that pump&nbsp;A was not ready and must not be switched on under any circumstances. However, this information was not provided in the pump overhaul permit.<ref name="pate">{{cite journal |last1=Paté-Cornell |first1=M. Elisabeth |date=April 1993 |title=Learning from the Piper Alpha Accident: A Postmortem Analysis of Technical and Organizational Factors |journal=[[Risk Analysis (journal)|Risk Analysis]] |volume=13 |issue=2 |pages=215–232 |bibcode=1993RiskA..13..215P |doi=10.1111/j.1539-6924.1993.tb01071.x |issn=0272-4332 |eissn=1539-6924}}</ref>

The night shift started at 18:00 with 62 men running Piper Alpha. As the on-duty custodian was busy, the engineer neglected to inform him of the condition of pump&nbsp;A. Instead, he placed the PSV permit in the [[Control room|control centre]] and left. This permit disappeared and was not found.<ref name=":28" />

At 19:00 the diesel-driven [[fire pump]]s were put under manual control. Like many other offshore platforms, Piper Alpha had an automatic fire-fighting system, driven by both diesel and electric fire pumps. The pumps were designed to suck in large amounts of sea water for firefighting and had automatic controls to start them in case of fire. However, the Piper Alpha procedure adopted by the [[offshore installation manager]] (OIM) required manual control of the diesel pumps whenever divers were in the water (as they were for about 12&nbsp;hours a day during summer) although in reality, the risk was not seen as significant, unless a diver was closer than {{convert|10–15|ft|m|0}} from any of the four {{convert|120|ft|m|-1}} level caged intakes. A recommendation from an earlier audit had suggested that a procedure be developed to keep the pumps in automatic mode if divers were not working in the vicinity of the intakes, as was the practice on the Claymore platform, but this was never implemented.<ref name=":18">{{cite journal |last1=Drysdale |first1=D.D. |author-link=Dougal Drysdale |last2=Sylvester-Evans |first2=R. |date=15 December 1998 |title=The Explosion and Fire on the Piper Alpha Platform, 6 July 1988. A Case Study |journal=[[Philosophical Transactions of the Royal Society A|Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences]] |volume=356 |issue=1748 |pages=2929–2951 |bibcode=1998RSPTA.356.2929D |doi=10.1098/rsta.1998.0304 |issn=1364-503X |eissn=1471-2962 |s2cid=83615637 |doi-access=free}}</ref><ref name=":28" /><ref name=":35">{{Cite video |title=Learning from Accidents: The Piper Alpha Oil Platform Disaster – Messages for Managing Safety |date=April 1991 |last=Johnson |first=Chris |type=Videotape |others=Presented by Brian Appleton ([[Imperial Chemical Industries|ICI]] Group Safety) for the International Management of Safety course |oclc=752255236}}</ref>{{sfnp|Bollands|2018|p=57}}

At 21:45, condensate pump B stopped and could not be restarted. This was likely due to the formation of [[Clathrate hydrate|hydrates]] and the consequent blockage of gas compression pipework, following problems with the [[methanol]] system.{{sfnp|Spouge|1999|loc=appendix III, p. 6}} The operators were anxious to reinstate condensate pumping capacity. Failure to do so would have meant needing to stop the [[compressor|gas compressors]] and venting to the flare all the gas that could not be processed.{{sfnp|Bollands|2018| pp=137–138}}{{Efn|At least two documentaries<ref name=":28" /><ref name="NatGeo" /> state that the operators were under pressure to have one of the condensate pumps running because failing to do so would have caused a total power and production shutdown. This has been put in question because generators could also be run on [[diesel fuel]], of which there were 160 tonnes on board.<ref name="Crawleynotes">{{Cite book |last=Crawley |first=F.K. |title=Safety and Loss Prevention/Safety Engineering: Notes Prepared by Eur Ing F K Crawley, for Use in UK University Courses Based on Notes Produced for the University of Strathclyde |publisher=[[University of Strathclyde]] |year=2014 |location=Glasgow, Scotland |pages=374}}</ref> It is possible that operators were concerned that the automatic switch of the [[John Brown & Company|John Brown]] turbine generators from gas to diesel might not be successful and therefore a [[black start]] might be required, an event that could result in the drill becoming stuck at depth.{{sfnp|McGinty|2009|p=74}} In any case, control room operator Geoff Bollands wrote of the ''Seconds from Disaster'' documentary: "The film states that 'The condensate pumps had tripped and production crew were all feeling the pressure as the whole production facilities would soon shut down'. I was contradicting this statement as it wasn't true, the worst that would have had to happen is that we would have to stop making condensate, i.e. flare the gas."{{sfnp|Bollands|2018| pp=137–138}}}}

Around 21:52 a search was made through the documents to determine whether condensate pump&nbsp;A could be started. The permit for pump&nbsp;A overhaul was found but that for its PSV removal was not. The valve was at a distance from the pump, so the permits were stored in different boxes, as they were sorted by location. Because the overhaul had just started on the day, with no equipment removed or containment broken, the operators were under the impression that the pump could be put back in operation quickly and safely. None of those present were aware that a vital part of the machine had been removed. The missing valve was not noticed by anyone, particularly as the blind flange replacing the safety valve was several metres above ground level and obstructed from view.<ref name=":28" />