Piper Alpha
- Worst offshore disaster -
- Worst offshore disaster -
Summary data:
Date: July
6, 1988,
Location: North
Sea 110 miles from Aberdeen, Scotland,
What happened: The platform
experienced a series of catastrophic
explosions and fires. It had 226 people on board at the time of the event, 165
of whom perished (in addition, two emergency response personnel died during a
rescue attempt). The platform was totally destroyed.
Causes: Simultaneous
maintenance work on the pump and safety valve resulted in a condensate leak.
What happened?
A
release of light hydrocarbon (condensate; propane, butane, and pentane)
occurred when a pump was restarted after maintenance. Unaware to the personnel
starting the pump, a relief valve in the pump discharge had also been removed
for service and a blank had been loosely installed in its place on the piping
flange. Upon restart of the pump, this flange leaked, producing a flammable
hydrocarbon cloud, which subsequently found an ignition source.
The
Piper Alpha platform was at the hub of a network of platforms interconnected by
oil and gas pipelines. The initial explosion ruptured oil lines on Piper Alpha
and the leaks were fed by the still-pressurized inter-platform pipelines.
Managers on other platforms, aware of a problem on Piper Alpha (but not its
severity), assumed that they would be instructed to shut down their operations,
if needed. However, the explosion had interrupted communications from Piper
Alpha and considerable intervals (from 30 to 60 minutes) passed before these
other platforms were shut in.
A
series of follow-on explosions occurred as the fires on the platform weakened
natural gas riser pipelines on Piper Alpha. The intensity of the fires
prevented rescue efforts, either by helicopter or by ship. At the height of the
event, natural gas was being burned on Piper Alpha at a rate equivalent to the
entire United Kingdom natural gas consumption rate.
Many
of the platform crew retreated to the crew accommodation module, as they had
been trained, to await evacuation. No organized attempt to was made to retreat
from the accommodation module, even though it became increasingly apparent that
the conditions in the module were becoming untenable. 81 personnel died from
smoke inhalation in the crew quarters, awaiting further instructions that never
came. Survivors found ways, on their own initiative, to get to the water (some
jumping to the sea from considerable heights on the platform).
· Two separate work permits had been issued for
the condensate pump, one for the pump repair and one for testing the relief
valve. The relief valve job had not been completed by the end of the shift and,
rather than working overtime to complete it, it was decided to terminate the permit
for that day and continue on the next. The craft supervisor suspended the
permit and returned it to the control room without notifying operations staff
of the job status.
· During shift turnover, the status of the pump
work was addressed, but no mention was made of the relief valve work, and there
was no mention of it in the control room or maintenance logs. Continuing
problems with the adequacy of turnovers and log entries were a problem known to
some (one staff member: “It was a surprise when you found out some things which
were going on.”)
· The work permits for the pump and the relief
valve did not reference each other, and it is likely that the permits had been
filed in separate locations (one on the control room and one in the Safety
Office). When the on-line condensate pump failed later in the shift, creating
an imperative to start the spare to enable continued production, control room
personnel were only aware of the pump repair work permit, and proceeded to have
the pump returned to service.
· The permit to work (PTW) system was often not
implemented according to procedure (“... the procedure was knowingly and
flagrantly disregarded.”). For example, (1) omissions (e.g., signatures and gas
test results) were common, (2) operations representatives often did not inspect
the jobsite before suspending the permit at the end of the shift, or closing
the permit indicating the work had been completed, and (3) craft supervisors
often left permits on the control room desk at the end of a shift, rather than personally
returning them to the responsible operations representative, as required by the
procedure.
· Although the PTW system was monitored by the
lead safety operator, no indications of problems were reported, and management
did not independently review the operation of the system. Based upon an absence
of information to the contrary, management assumed that they “knew that things
were going all right.” It is noted that a senior maintenance technician had
voiced his concerns about the PTW system at a meeting at corporate headquarters
earlier in the year. In addition, the company had entered a guilty plea in a
civil legal proceeding involving a worker fatality caused, in part, by a PTW
system problem; however, no substantive improvements in the PTW system resulted.
· The diesel-powered fire pumps had been placed
in manual control mode due to the presence of divers in the water around the
platform. This practice was more conservative than company policies and a 1983
fire protection audit report had recommended that this practice be discontinued. Placing the pumps in
manual meant that personnel would have had to reach the pumps to start them
after the explosion. However, conditions prevented this and, as a result, the
Piper Alpha deluge system was unavailable.
· Had firewater been available, its efficacy
might have been limited. Distribution piping, including that in the platform
module where the fires were most severe, was badly corroded and pluggage of
sprinkler heads was a known problem dating back to 1984. Various fixes had been
attempted and a project to replace the fire protection piping had been
initiated, but work was lagging behind schedule. Tests in May 1988 revealed
that approximately 50% of the sprinkler heads in the subject module were
plugged.
· To put the previous two observations in
perspective, the structural steel on Piper Alpha had no fireproofing and it was
known (at least to management) that “... structural integrity could be lost
with 10-15 minutes if a fire was fed from a large pressurized hydrocarbon
inventory.”
· The investigation revealed that emergency
response training given to new platform personnel was cursory and not uniformly
provided. Workers were required to be trained if they had not been on Piper
Alpha in the last six months. However, training was often waived even if the
interval was considerably longer, or if the individual reported that he had
previously worked off-shore elsewhere. A number of survivors reported that they
had never been trained on the location of the life rafts or how to launch them.
· Evacuation drills were not conducted weekly
as required (one 6 month period recorded only 13 drills). No full-scale
shutdown drill had been conducted in the three years prior to the explosion.
· Platform managers had not been trained on
their response to such an emergency on another platform (Note: that the various
platforms were owned or operated by different companies.)
· Approximately one year before the explosion,
company management had been cautioned in an engineering report that a large fire
from escaping gas could pose serious concerns with respect to the safe evacuation
of the platform. However management discounted the likelihood of such an event,
citing existing protective systems. In fact, the gas risers upstream of the
emergency isolation valves on Piper Alpha were not protected against fire
exposure and, because of the diameter and length of the inter-platform gas
lines, several days would be required to depressurize the pipelines in the
event of a breach. It was the failure of these lines that destroyed Piper Alpha
and prevented its evacuation.
Aftermath :
Because of damages
costing almost $3.4 billion, the Piper Alpha disaster was the largest man-made disaster at the time and continues to be the worst offshore oil disaster in
terms of life lost and industry impact. Although the Cullen Inquiry found
Occidental guilty of inadequate maintenance and safety procedures, no criminal
charges were brought against the company.
The inquiry
resulted in 106 recommendations for changes to North Sea safety procedures—all
106 were accepted by the industry. And finally, a 3-year investigation into the
safety and integrity of over 100 offshore installations.
Video of the explosion :
http://www.youtube.com/watch?v=mBYdDeVOuQo
National
Geographic Documentary :
http://www.youtube.com/watch?v=7VXHiQ0bViU
