Piper Alpha
- Worst offshore disaster -

Summary data:

Date: July 6, 1988,

Location: North Sea 110 miles from Aberdeen, Scotland,

What happened: The platform experienced a series of catastrophic explosions and fires. It had 226 people on board at the time of the event, 165 of whom perished (in addition, two emergency response personnel died during a rescue attempt). The platform was totally destroyed.

Causes: Simultaneous maintenance work on the pump and safety valve resulted in a condensate leak.

What happened?

A release of light hydrocarbon (condensate; propane, butane, and pentane) occurred when a pump was restarted after maintenance. Unaware to the personnel starting the pump, a relief valve in the pump discharge had also been removed for service and a blank had been loosely installed in its place on the piping flange. Upon restart of the pump, this flange leaked, producing a flammable hydrocarbon cloud, which subsequently found an ignition source.

The Piper Alpha platform was at the hub of a network of platforms interconnected by oil and gas pipelines. The initial explosion ruptured oil lines on Piper Alpha and the leaks were fed by the still-pressurized inter-platform pipelines. Managers on other platforms, aware of a problem on Piper Alpha (but not its severity), assumed that they would be instructed to shut down their operations, if needed. However, the explosion had interrupted communications from Piper Alpha and considerable intervals (from 30 to 60 minutes) passed before these other platforms were shut in.

A series of follow-on explosions occurred as the fires on the platform weakened natural gas riser pipelines on Piper Alpha. The intensity of the fires prevented rescue efforts, either by helicopter or by ship. At the height of the event, natural gas was being burned on Piper Alpha at a rate equivalent to the entire United Kingdom natural gas consumption rate.

Many of the platform crew retreated to the crew accommodation module, as they had been trained, to await evacuation. No organized attempt to was made to retreat from the accommodation module, even though it became increasingly apparent that the conditions in the module were becoming untenable. 81 personnel died from smoke inhalation in the crew quarters, awaiting further instructions that never came. Survivors found ways, on their own initiative, to get to the water (some jumping to the sea from considerable heights on the platform).

The subsequent investigation revealed the following :

· Two separate work permits had been issued for the condensate pump, one for the pump repair and one for testing the relief valve. The relief valve job had not been completed by the end of the shift and, rather than working overtime to complete it, it was decided to terminate the permit for that day and continue on the next. The craft supervisor suspended the permit and returned it to the control room without notifying operations staff of the job status.

· During shift turnover, the status of the pump work was addressed, but no mention was made of the relief valve work, and there was no mention of it in the control room or maintenance logs. Continuing problems with the adequacy of turnovers and log entries were a problem known to some (one staff member: “It was a surprise when you found out some things which were going on.”)

· The work permits for the pump and the relief valve did not reference each other, and it is likely that the permits had been filed in separate locations (one on the control room and one in the Safety Office). When the on-line condensate pump failed later in the shift, creating an imperative to start the spare to enable continued production, control room personnel were only aware of the pump repair work permit, and proceeded to have the pump returned to service.

· The permit to work (PTW) system was often not implemented according to procedure (“... the procedure was knowingly and flagrantly disregarded.”). For example, (1) omissions (e.g., signatures and gas test results) were common, (2) operations representatives often did not inspect the jobsite before suspending the permit at the end of the shift, or closing the permit indicating the work had been completed, and (3) craft supervisors often left permits on the control room desk at the end of a shift, rather than personally returning them to the responsible operations representative, as required by the procedure.

· Although the PTW system was monitored by the lead safety operator, no indications of problems were reported, and management did not independently review the operation of the system. Based upon an absence of information to the contrary, management assumed that they “knew that things were going all right.” It is noted that a senior maintenance technician had voiced his concerns about the PTW system at a meeting at corporate headquarters earlier in the year. In addition, the company had entered a guilty plea in a civil legal proceeding involving a worker fatality caused, in part, by a PTW system problem; however, no substantive improvements in the PTW system resulted.

· The diesel-powered fire pumps had been placed in manual control mode due to the presence of divers in the water around the platform. This practice was more conservative than company policies and a 1983 fire protection audit report had recommended that this practice be discontinued. Placing the pumps in manual meant that personnel would have had to reach the pumps to start them after the explosion. However, conditions prevented this and, as a result, the Piper Alpha deluge system was unavailable.

· Had firewater been available, its efficacy might have been limited. Distribution piping, including that in the platform module where the fires were most severe, was badly corroded and pluggage of sprinkler heads was a known problem dating back to 1984. Various fixes had been attempted and a project to replace the fire protection piping had been initiated, but work was lagging behind schedule. Tests in May 1988 revealed that approximately 50% of the sprinkler heads in the subject module were plugged.

· To put the previous two observations in perspective, the structural steel on Piper Alpha had no fireproofing and it was known (at least to management) that “... structural integrity could be lost with 10-15 minutes if a fire was fed from a large pressurized hydrocarbon inventory.”

· The investigation revealed that emergency response training given to new platform personnel was cursory and not uniformly provided. Workers were required to be trained if they had not been on Piper Alpha in the last six months. However, training was often waived even if the interval was considerably longer, or if the individual reported that he had previously worked off-shore elsewhere. A number of survivors reported that they had never been trained on the location of the life rafts or how to launch them.

· Evacuation drills were not conducted weekly as required (one 6 month period recorded only 13 drills). No full-scale shutdown drill had been conducted in the three years prior to the explosion.

· Platform managers had not been trained on their response to such an emergency on another platform (Note: that the various platforms were owned or operated by different companies.)

· Approximately one year before the explosion, company management had been cautioned in an engineering report that a large fire from escaping gas could pose serious concerns with respect to the safe evacuation of the platform. However management discounted the likelihood of such an event, citing existing protective systems. In fact, the gas risers upstream of the emergency isolation valves on Piper Alpha were not protected against fire exposure and, because of the diameter and length of the inter-platform gas lines, several days would be required to depressurize the pipelines in the event of a breach. It was the failure of these lines that destroyed Piper Alpha and prevented its evacuation.

Aftermath :

Because of damages costing almost $3.4 billion, the Piper Alpha disaster was the largest man-made disaster at the time and continues to be the worst offshore oil disaster in terms of life lost and industry impact. Although the Cullen Inquiry found Occidental guilty of inadequate maintenance and safety procedures, no criminal charges were brought against the company.

The inquiry resulted in 106 recommendations for changes to North Sea safety procedures—all 106 were accepted by the industry. And finally, a 3-year investigation into the safety and integrity of over 100 offshore installations.