Standby Pump Restart Into a Defeated Boundary (Piper Alpha pattern)

A duty/standby pump pair shares a header; the standby is under maintenance with part of its pressure boundary opened (relief valve removed, blind only hand-tight). The duty pump trips and, under pressure to keep the plant running, operators start the "standby" — driving process fluid straight out of the open boundary.

This is the Piper Alpha pattern: the deadliest offshore disaster in history began as a rotating-equipment return-to-service decision made without knowing the machine's true isolation state. Permit discipline is the entire lesson.

1. Standby pump enters maintenance; a PSV is removed and the flange blinded only hand-tight; permit status is not clearly handed over.
2. The duty pump trips; production pressure mounts to restore flow.
3. Operators, unaware the standby is not intact, move to start it.
4. Discharge head is applied to a segment open to atmosphere; inventory releases through the incomplete boundary.
5. Flammable cloud ignites; escalation follows.

Frequency: not quantified in public sources as an event rate. This is a named-incident pattern (Piper Alpha, 1988 ) whose root causes — permit-to-work and isolation-handover failure — remain standard audit findings, but no public dataset counts "standby…

Piper Alpha's first explosion, escalation and platform loss killed 167 people ([The Chemical Engineer](https://www.thechemicalengineer.com/features/piper-alpha-the-disaster-in-detail/), [IChemE…