The Heimdal Incident
Failure to carry out a proper investigation of any incident, especially a serious incident, is a barrier to the learning from the incident. When reading some investigation reports and presentations, it is not surprising that learning from incidentsis a still a challenge.
When you carry out investigations, do you really get to the bottom of what happened, how it happened, and why it happened?
This is the second extraordinary Reflektion that Reflekt has produced since we started with our Reflektions in October 2017. We hope that an extraordinary Reflektion will get extraordinary attention and that the points we are trying to make will make you think and act differently.
Always Safe
Always Safe https://alwayssafe.no/en/ is a collaboration by Equinor, AkerBP, Vår Energi and ConocoPhillips. The purpose of the initiative is:
to strengthen the industry’s safety culture and work together towards zero major accidents, and avoid injuries and undesirable incidents in our daily work.
On the website there are HSSE Learning Packages that can be used for team exercises for resolving safety issues and contributing to the continuous improvement that the Petroleum Safety Authority (PSA) expects of the industry. The intention of the web site is good and some of the material presented is very useful. Some of the examples used are not anonymised and one of these is an incident that occurred on the Heimdal platform in Norway on 28th November 2019. The incident resulted in the serious injury of two people and could have resulted in fatalities.
The operator Equinor has made a presentation of the incident and the findings from the investigation and posted it on the Always Safe website.
https://alwayssafe.no/en/incidents/work-accident-at-heimdal-november-2019/
While Reflekt supports the efforts Equinor have made to share the experience and give others a chance to learn, we believe the investigation, as presented, is inadequate and fails to identify some important points that could contribute to prevention of such incidents in the future. Reflekt hopes that this criticism will be regarded as constructive and lead to a dialog on the depth and quality of investigations, the application of investigation methods and how to realise the learning potential from incidents.
This incident was covered by a Reflektion week 24/2021 where we highlighted the value of experience in working safely. Now that more details of the investigation are available on the ‘Always Safe’ website then we can go into the incident in more detail. We believe that people always try to do their best and work safely. We focus on trying to understand why people believed what they were doing was safe rather than identifying what the people did not do and what went wrong.
Petroleum Safety Authority (PSA) has also investigated the incident and the report is available on the PSA website.
The incident
The details of the incident are described in this screen shot from the presentation on Always Safe, see figure 1.
A key factor in the incident was that the injured persons, ‘automatician 02’ and ‘mechanic apprentice’, were relatively inexperienced. The injured persons did not sign the work permit. Another important point is that one of the injured persons was supporting the gas cylinder while it was being pressured.
Figure 1 – Incident overview from Equinor presentation
The gas booster pump, shown in figure 2, had a faulty pressure gauge and the fault had been reported. The pump also had a maintenance/calibration date that had been exceeded by 2 months. The pump was temporary equipment without an identification tag ID and hence not covered by the formal maintenance system. There was no person/position that owned the pump and set requirements for its operation and maintenance. These points are covered in the presentation.
Figure 2 – The gas booster pump used
The gas cylinder contained nitrogen that is used to discharge CO2 for fire suppression in gas turbine enclosures. The filling of the gas cylinders was a routine operation and required the cylinder to be removed from the cabinet. The platform nitrogen system operates at 130 barg and the normal operating pressure of the gas cylinder was 200 barg. The design pressure of the gas cylinder was 348 barg. The gas booster pump used was a positive displacement pump that uses instrument air to drive a piston that increases the pressure. The discharge pressure is determined by the inlet nitrogen pressure and the instrument air pressure. With the operating parameters from the Heimdal instrument air and nitrogen systems, the pump had the potential to deliver 700 barg. There was no external or internal pressure relief device. As mentioned earlier the pressure gauge was faulty and was reading 70 barg when the gauge was inspected after the incident. The people involved in the incident stated the pressure gauge did not measure greater than 150 barg during the task.
The people involved in the incident pressured up the gas cylinder until it failed catastrophically and debris from the cylinder struck two people. A rapid response and life saving first aid saved the lives of the injured people. The damaged cylinder is shown in figure 3.
Figure 3 – The gas cylinder that failed
The investigation team compiled a bow tie diagram to give an overview of the barriers that failed and the recommendation actions. This is shown in figure 4. More details on the specific failures are available by following the presentation on the Always Safe website.
Figure 4 – Bow tie developed for Heimdal near fatality
Incident Investigation Findings
The recommended actions from the incident are described in a power point presentation that can be downloaded from the Always Safe website.
Learning 1
The intention of the action to remove the need for the gas booster pump is in line with the inherent safety principle of ‘remove’ the hazard. The action is however specific to the use of the gas booster pump and to activities using this type of pump. There could have been a general point related to planning of activities and pre-job risk assessments on removing any potential hazard or potentially dangerous equipment. A general point of not using a pressure higher than what is necessary may also lead to consideration of planning for any operation for pressuring systems and equipment.
Learning 2
Actions such as correcting known faults, that describe what people are supposed to do anyway are not helpful. Of course, faults should be corrected. Since the investigation did not seem find out why the faults were not corrected then appropriate actions are difficult to assign.
Learning 3
Actions to improve quality, that describe a general good intention are both difficult to implement and to assess their affect. The investigation did not describe in detail the problems with the work permit that was used so specific actions are difficult to assign.
Learning 4
The actions are related to the use of gas booster pumps.
The investigation does not describe why these systems were not in place before the incident so appropriate actions on any type of equipment are not assigned. Where possible investigations should identify general actions and learning points that could be applied to any system.
Learning 5
The learning point is related to the filing of gas cylinders. The action requires that overpressure protection should be used when the source pressure can exceed the working pressure of the gas cylinder. This is basic good practice and should be understood by all persons working on a facility.
The investigation did not describe why the people involved did not use an overpressure protection system so there are no specific actions, for example on training and competence with working with pressurized systems.
This learning point should have been related to a general point on working with systems under pressure and when equipment and systems are being pressured up. There is no description of what processes and procedures were actually in place and the quality of these.
Learning 6
Learning that states an intention of ‘increasing safety’ are unlikely to lead to any improvements without the investigation finding out why the points that are noted were not already in place before the incident.
Learning 7
Increasing safety in the industry is a noble aim and the sharing of this incident will contribute to increasing safety in the use of gas booster pumps and possibly for activities that are working with pressure. The learning potential of this incident could have been enhanced significantly if the investigation had been carried out differently and more thoroughly. The more we can learn from this type of incident the better.
Learning 8
Rapid notification when demand for medical attention is a noble aim. The question arises whether the notification was not rapid and therefore the action is to do something different, or whether the notification was rapid and there is an opportunity to learn from success. Learning from success is an important learning factor and good responses or actions from the reaction to an incident are also worthy of thorough investigation.
Learning 9
Good and effective first aid is important, and it is understood that the actions by the nurse and the first aid teams saved one or even both injured persons. There is no description of what went well and how others could learn from the incident. Learning from success is arguably easier than learning from failure. Success may be so simple as to repeat what went well. Any alternative to failure may not succeed. The action to assess experience is vague. Experience with what? Training and exercises or handling incidents?
Learning 10
The quality of an action is related to two main points. How clear the action is and hence the reliability of implementation, and whether the action actually leads to the desired improvement. This second point is not always noted in action follow up, and actions are often closed out when they are considered implemented and not when an assessment is made as to whether they have achieved the intended objective.
Reflektions
The danger of pressure, working with pressure and any activities that require pressuring up systems and equipment is not adequately highlighted in the bow tie is. This is particularly important when using gas as the pressuring medium. The investigation points out that the energy stored in the cylinder when it exploded was equivalent to 300 grams of TNT. When pressuring any system, a pre-job meeting including a risk assessment, should be carried out and the following question should be asked, ‘Can the pressure exceed the design pressure of this system?’. This is particularly important with positive displacement pumps and compressors. Other essential factors in working with pressure are how the pressure is being measured and whether there is an automatic restriction on the pressure or a pressure relief device.
Was there a pre-job safety meeting? Were the dangers of pressure discussed? Were all the participants aware of what they were doing? Did they consciously decide that this activity could be carried out safely, or did they just get on with the job? Did they believe what they were doing was OK?
The investigation team identified that the people involved in the task were not familiar with the gas booster pump or its operation. Why were they then given the task if they were not competent to do the task? Why was there not someone that was familiar with the pump involved in the operation or to give guidance before the work started? Why did the supervisor and/or the permit authority not verify that the people had the required competence and experience? How is competence assured in other activities carried out on Heimdal, in Equinor?
Why were there people located just beside a gas cylinder that was being pressure up? Did the people involved consider the basic principle of separating the hazard from the people? Was this hazard identified by the relevant supervisor and the area authority, and were the team given guidance on the hazards and the appropriate precautions, for example on the permit to work.
The investigation team found that the pressure required in the gas cylinder was only 130 barg hence the cylinder could have been pressurised safely directly from the platforms own nitrogen system. It is assumed that this system has pressure control and overpressure protection and can therefore not exceed a pressure of around 130 barg. There was therefore no need to use the gas booster pump. Removal of the need for the pump is good inherent safety, however it begs the question, ‘Why was the pump used? Did the people involved not understand this or were they not informed? Who was responsible for the maintenance routine, was the pressure requirement understood, and why was this information not transferred?
The investigation team highlighted that the two injured people had not signed the permit to work and could then not be considered part of the team. The injured people were part of the team irrespective of whether they signed the permit to work. Why did they not sign the permit to work? Since they did not sign the permit were they not aware of the precautions described in the permit? Did the permit describe precautions for pressuring up the gas cylinders? Did the area authority confirm that the people carrying out the work understood the potential consequences of the activity?
The gas booster pump was due for certification on 1st October 2019, two months before the incident. Why did the people involved use the pump when it had exceeded its certification date? Did they check the certification and decide to use anyway? Did they not check the certification and if not, why not?
The pressure gauge on the gas booster pump was reported as being faulty. This gauge was the only way to measure and monitor the pressure during pressuring. Why did the people involved use the gas booster pump with a faulty pressure gauge? Did they know the pressure gauge was faulty? Did they check that the pressure gauge was working? Did they check the pressure gauge responded as expected as the pressure increased? What were their expectations to the pressure response when the activity started? Did the people have any such expectations?
The investigation team identified that there was no way to regulate the discharge pressure from the gas booster pump. Why not? Was this as the pump was designed or was the regulation inoperative? Again, with no way to regulate the pressure why was this type of pump used? Did the people carrying out the task understand the limitations in the pump operation?
The gas booster pump did not have an overpressure device to prevent exceeding the design pressure of the equipment being pressured. Why was there no overpressure device? Was there a procedure/guideline/practice in place for pressuring equipment that included precautions for overpressure protection? If there was such a document, why was it not followed? Were the people aware of this document?
With regards the gas booster pump the question arises, ‘Why did the people involved believe the gas booster pump was working satisfactorily?’ Did they make a conscious decision,or did they just get on with the job?
When the task was ongoing did the people involved registersignals that there were problems? The pressure gauge that stuck and didn’t increase even though the pressurisation was still ongoing? The gas cylinder would have heated up as the pressure inside increased. Did the person holding the cylinder notice this and consider the consequences? Did the gas booster pump vibrate or make a different noise as the pressure increased? Did anyone react to this? Did the people involved discuss potential signals that may indicate a hazardous situation?
The investigation team pointed out that the gas booster pump was a temporary equipment, and no one was responsible for setting requirements for its operation. Why not? Was there not a system for ensuring temporary equipment is maintained, inspected, and can be operated safely? If there is a system, why was it not followed in this case?
The gas cylinder was installed in a cabinet and there were two pressure gauges that monitored the pressure. To pressure the cylinder the cylinder had to be removed from the cabinet. Why was it necessary to remove the cylinder for pressuring? This is also part of the inherent safety approach to any task.
The investigation concluded there was no defined owner of the equipment, no-one to set requirements for operation, and expectations to maintenance and inspection. Although an annual inspection was actually called for. Why was there no one nominated as responsible for the safe operation of the equipment? Is there other equipment on any of Equinorsinstallations that could be in a similar state? This is not noted in the presentation and not in any recommendation.
Two of the main points from the investigation on the recommend actions for broken barriers were:• Known faults must be corrected• Increase safety when using gas booster pumps
These points fall into the categories of:
‘Remember to do the things you are supposed to do’ and ‘Be careful, when you are doing anything’.
It seems obvious that people should not use equipment that is faulty, not certified and not maintained in accordance with the company’s maintenance system. Why then do people use such equipment, is it for example, convenience, time pressures, knowledge and understanding? Without the deeper enquiry into why and relevant measures to help people carry out their work, then it is likely that people will continue to use faulty equipment.
The investigation team was of the view that the people were unnecessarily exposed to a hazard. This is certainly true however is of limited value for learning as it does not explain why the people were exposed to the hazard of high pressure. Similar to the team investigating a falling object incident that concludes that one of the causes of the incident was gravity. Yes, its true, but of little value for learning related to prevention of falling objects.
The incident highlights some of the challenges in working safely in the petroleum industry. The incident investigation highlights why the industry fails to learn from such incidents. The investigation as presented did not get to the bottom of thisincident and did not adequately identify the causes. It was several ‘whys’ away from a proper understanding of what happened, and the recommended actions in consequence are not as good as they should have been.
We realise that it is easy to stand on the side lines and criticize. We are also aware that the sharing of the presentation by Equinor is a genuine effort to share experience and learn. But if it is worth the investment of developing a website to promote learning then it is worth the effort to make sure the examples used are good ones.
We have focussed on asking the right questions to have any chance of getting the right answers and we would like to quote Rudyard Kipling, from the story “Elephant’s Child” in “Just So Stories”.
I keep six honest serving-men (They taught me all I knew); Their names are What and Why and When AndHow and Where and Who. I send them over land and sea, I send them east and west; But after they have worked for me, I give them all a rest.
In the Petroleum Industry we cannot afford to give our questions a rest. When an incident and an investigation is initiated, we need to keep on asking questions until we get the answers we need. We need to understand the what, the how and the why of any incident. We need to understand what actions were taken and why the people involved believed that these actions would lead to a safe execution of the activity. We need to understand the conditions that were present and how these affected the chain of events and the outcome. If we fail to carry out a thorough and effective investigation, then we fall at the first hurdle in the race to learn.
Asking questions and ensuring the right answers is a cultural characteristic. What sort of culture do you have in your organisation?