On 6 July 1988, the Piper Alpha offshore platform in the North Sea experienced a series of catastrophic explosions and fires. This disaster is a reminder of what can happen when production and schedule come before safety.
As an indication of the intensity of the fires, at the height of the event natural gas was being burned at a rate equivalent to the entire United Kingdom natural gas consumption rate.
This is considered to be the worst offshore disaster in terms of lives lost. Of the 226 people on board at the time of the event, 165 people perished. Two emergency response personnel from a fast rescue craft also died during a rescue attempt. A large number of the crew congregated in the accommodation module awaiting rescue, but evacuation by safety vessels and helicopters became impossible. A total of 81 bodies were later recovered from this module.
Many bodies were never recovered. Of the 61 men that survived, many experienced significant psychological trauma.
In terms of the impact on the oil and gas industry, this was a pivotal event. The Piper Alpha incident was the catalyst for significant change. Learnings taken from this tragedy created a step-change in health and safety offshore. Many recommendations from the Public Inquiry have been embedded into regulatory frameworks around the world.
The event
The platform was located in the North Sea approximately 175km from Aberdeen, Scotland. It began production in 1976 primarily as an oil platform, but was later converted to add gas production. Piper Alpha gathered gas from two other platforms in the area: Tartan and Claymore. It processed the gas from these facilities together with its own and piped the final products to shore by pipeline.
Two condensate pumps on the lower deck (Pump A and Pump B) were used to re-inject hydrocarbon liquids from the gas/liquid separation process back into the oil export line to shore. One pump was always in service and the other on stand-by. Without these pumps, Piper Alpha and the other two platforms (Tartan and Claymore) would have to shut-down.
On the morning of 6 July 1988, the process connections and electrical motor for Pump A were isolated so that routine maintenance could be carried out on this pump. A pressure relief valve was removed for inspection and blind flanges (round metal plates) were fastened onto the open pipes. This valve was located in the module above and so was out of sight of the pump. This pressure relief valve was due to be reinstalled during the same shift, and so it is likely that the bolts on the blind flanges were only hand-tightened.
At the end of the day shift, the crane was not available to lift the pressure relief valve back into place and so it was not reinstalled. The blind flanges were left in place and the maintenance work on Pump A would continue the next day.
Such maintenance work was recorded and tracked on work permits. When the maintenance supervisor returned the permit for this work back to the control room, where all permits were stored, the process supervisors and operators were in deep conversation, so he left the work permit for this valve on the desk. He wrote “SUSP” on the permit (meaning “SUSPENDED”), but there was no verbal or written hand over. This permit stated that Pump A was not ready for operation and must not be activated.
During the night shift, Pump B stopped suddenly and the crew were unable to restart it. Without this pump, liquid levels were rising rapidly in the process vessels which could result in total shut-down of the platform. A decision was made to start up the standby equipment – Pump A. The night shift crew knew that Pump A had been taken out of service for maintenance earlier the same day. However, they believed that the maintenance work had yet to commence.
They located a work permit for the pump (which had not yet been used), but were not aware of the suspended permit for the pressure relief valve. They reconnected the pump motor and started Pump A without knowing that the pressure relief valve was not connected. Unknown to the crew, a tragedy was now inevitable.
As soon as Pump A was started at 9.55pm, high-pressure gas would have escaped through the blind flanges fitted in the module above the pump. Minutes later, around 10pm, the flammable cloud of gas ignited and the explosion killed or injured the crew in the control room, which was adjacent to the gas compression module. This initial explosion put the main power supplies and the control room out of action. Several pipes ruptured in the explosion and large quantities of oil were burning out of control.
The escalation
Pipes containing gas from the nearby Tartan platform failed at 10.20pm – feeding up to 33 tons of gas per second onto the platform, which ignited immediately. A major gas pipeline that exported gas from Piper Alpha to shore then failed. Debris from this destroyed a fast rescue boat 800m away, killing two rescuers on board. The pipework containing gas from the Claymore platform also failed. The vessel Tharos attempted to fight the fires, but had to withdraw as the heat from the inferno was melting parts of the vessel.
Despite being able to see the Piper Alpha platform on fire, both the Tartan and Claymore platforms continued to pump oil and gas to Piper Alpha. The crew of these platforms did not feel empowered to shut-down production without instruction from shore. And so they continued to fuel the fire on Piper Alpha.
“With loss of command and control, and loss of electrical power, the system was technically decapitated”
Pate-Cornell, 1993, p.222
Design issues meant that when the fire-water pumps were on manual mode, they had to be started locally – but access routes to the pumps were not protected from fire. Electrical cables were routed through the most vulnerable areas of the platform without adequate redundancy. Early in the event, electrical power was lost – this impacted on control systems, communications, lighting etc. The location of the control room adjacent to the production modules meant that a fire or explosion in these modules had a high probability of destroying the control room. Key personnel were killed immediately in the first explosion.
Emergency response and evacuation
Around 10.04pm, workers evacuated the control room – leaving the platform with no means to manage the escalating disaster.
The fire-water system, which pumped seawater into a deluge designed to control such fires had been isolated previously. This was in order to protect divers, who were carrying out inspections near to the intake for the fire-fighting seawater pumps. Therefore, the automatic fire-water system was out of service and the fires spread. When in manual mode, as they were on the night of 6 July, it was necessary for someone to operate a switch adjacent to each pump. Several unsuccessful attempts were made to reach the water pump machinery.
Even if the firewater system had been operational, many of the deluge nozzles (sprinklers) were blocked and so it is likely that much of the deluge system on the platform would not have discharged water. The problem of scale blocking the deluge heads had been identified by Occidental three years earlier, when tests showed that 40-50% of nozzles were found to be blocked.
No evacuation orders were given. There were no platform-wide emergency communications.
The Piper Alpha crew began to congregate in the living accommodation area, furthest from the fire and waited for instructions that never came. There was no systematic attempt to lead the crew to escape from the accommodation. It is certain that leaving the accommodation and attempting to abandon the platform would have saved lives.
The intense fire and smoke prevented helicopters from landing on the platform – and prevented rescue boats from getting close. The crew were on their own, with no ability to fight the fires. Soon after the initial explosion, virtually every emergency system on the installation had been rendered ineffective. The Inquiry concluded that emergency response was “crippled from the start”.
The accommodation module where crew were waiting for rescue was not smoke-proof. Most of the 165 crew who died were overcome by carbon monoxide and smoke in the accommodation area. Some men left the accommodation area hoping to reach a liferaft, but all routes were blocked by fire and smoke. At 11.20pm the melting crew quarters slid into the sea. Within three hours, most of the platform had burned down to sea level.
“To remain in the accommodation meant certain death”.
The public inquiry into the Piper Alpha disaster, Volume one, p.2
The only escape was to climb down the platform to sea level, or jump from the various levels. In total, 61 men survived by jumping into the sea, some from a height of 53 metres (174ft), and were rescued by boat.
The Public Inquiry
On 13 July 1988, Lord William Cullen was appointed to hold a public inquiry to establish the circumstances of the accident and its causes. This was completed in October 1990, and was published as two volumes in November 1990 (PDFs below).
Regarding the removal of the pressure relief valve, the Inquiry stated:
“The lack of awareness of the removal of the valve resulted from failures in communication of information at shift handover earlier in the evening and failure in the operation of the permit to work system in connection with the work which had entailed its removal”
The public inquiry into the Piper Alpha disaster, Volume one, p.1
Lord Cullen made 106 recommendations, all of which were accepted by the UK industry.
A key recommendation: the introduction of safety regulations requiring the operator of every fixed and mobile installation operating in UK waters to submit to the HSE, for their acceptance, a safety case. The safety case must give full details of the arrangements for managing health and safety and controlling major accident hazards on the installation. It must demonstrate for example, the operator has safety management systems in place, has identified risks and reduced them to as low as reasonably practicable, has introduced management controls, provided a temporary safe refuge on the installation and has made provisions for safe evacuation and rescue.
The responsibility for safety in the North Sea was transferred from the UK’s Department of Energy to the Health and Safety Executive (HSE). This change was mainly based on a conflict of interest – the Department of Energy had responsibility for both production and safety.
Although the Cullen Inquiry found Occidental guilty of inadequate maintenance and safety procedures, no criminal charges were brought against the company.
Human and organisational factors
The Piper Alpha incident – and the disastrous consequences – was a result of poor decisions. Some of these were made many years previously in the design and modification of the platform; and some were made during the incident itself. Design decisions set the crew up to fail should a serious event occur on Piper Alpha. Critical systems, together with emergency response and evacuation systems were designed such that they would be unavailable when they were needed the most. And as the platform was modified over time, these systems became even more unsuitable.
Work As Imagined versus Work As Done
It’s common at the moment to hear terms such as these in the safety arena, proclaiming a “new” view of safety. Over thirty years ago this issue was being discussed by this Inquiry. In the case of Piper Alpha, Lord Cullen remarked that “The safety policies and procedures were in place: the practice was different” (Volume 1, page 3). By this, he was referring to the fact that emergency training was not being provided as intended; procedures were not being followed; that management were too easily satisfied that the permit to work system was being operated correctly; that preparations for emergencies were not what they should have been, and so on.
Communications
The oncoming shift did not find all of the documents relating to the various maintenance activities. A decentralised system inhibited the sharing of safety critical information. Clearly, Pump A would not have been started if the crew knew that the pressure relief valve was not in place.
The Permit to Work (PTW) system was a formal written means of planning and approaching dangerous jobs in a safe manner, including communicating key aspects to those involved or impacted by the work. However, this procedure was often knowingly disregarded.
The Inquiry made several comments on the communication of information during handovers between shifts. Any deficiencies with the system may be due to the fact that there was no written procedure for handovers. On the night of 6 July, the handover did not discuss the fact that a pressure relief valve had been removed and not yet replaced. Handovers did not discuss active or suspended permits.
All of the procedures relating to interactions between the three platforms assumed that communications between the platforms would remain in place.
Training and competence
Personnel who had key roles in the Permit to Work system had not received appropriate training in the system. Training in the system was largely by watching others, i.e. learning on the job, and as such had little structure or rigour.
The Offshore Installation Managers (OIMs) of each of the three installations (Piper, Claymore and Tartan) were confronted with a situation for which they were unprepared. They had not previously considered a scenario where one of the platforms was disabled; nor had they received training in joint exercises involving multiple platforms. The Inquiry stated that had such joint training been conducted, then much of the misunderstanding, delay and indecision on Claymore and Tartan would have been avoided.
The Offshore Installation Manager onboard Piper Alpha appeared to be in a state of shock, and did not assume control of the response or evacuation. Knowledge that the escape routes to the life rafts were blocked may have contributed to his inability to provide leadership.
“The technical decapitation of the system was compounded by an organisational decapitation as no one took charge except the personalities that emerged as leaders”
Pate-Cornell, 1993, p.223
There were failures in the system of inductions for newcomers to the platform. The system for deciding who should receive an induction was cursory; the lack of consistent content and the uncertainty as to who should receive refresher training are examples of this. A number of survivors of the disaster reported that their safety induction was minimal or non-existent. Several of the crew had not been shown the location of the life rafts or how to launch and inflate them.
Emergency drills and exercises were not carried out with the frequency required by Occidental, and the Inquiry considered that, along with the induction training, this contributed to the platform crew being unprepared for a disaster.
Safety culture and leadership
The platform relied on individual safety practices, rather than a strong safety culture. The culture did not discourage shortcuts. Known procedures were routinely not followed. It was common practice for operations staff not to visit the worksite before suspending a permit at the end of a shift. Craft supervisors (such as maintenance) often left permits on the control room desk at the end of a shift instead of handing them to an operations representative.
Deficiencies in the Permit to Work system were identified in a worker fatality on Piper Alpha in 1987, (and the company entered a guilty plea), but no substantial improvements were made to the system.
The platform management did not ensure that inductions were thorough, and did not ensure that muster drills and emergency training were performed as planned. The Inquiry considers this a lack of leadership, which was then combined with a failure of onshore staff to effectively monitor the adequacy of emergency training.
A key contributor to the disaster was the night-shift recommissioning Pump A whilst its pressure relief valve was missing. The Inquiry concluded that this failure was symptomatic of the many informal and unsafe practices identified.
The company was aware from previous studies that “structural integrity could be lost with 10-15 minutes if a fire was fed from a large pressurized hydrocarbon inventory”. It appears that warning was not taken seriously, in part due to wrong assumptions of the independence of failure events.
“[Occidental management] adopted a superficial attitude to the assessment of the risk of major hazard”
The public inquiry into the Piper Alpha disaster, Volume one, p.2
Auditing and inspection
The Piper Alpha platform had been inspected by the Department of Energy on several occasions. The Public Inquiry found that the findings of these official inspections were in striking contrast to what was revealed by the Inquiry. The Inquiry reported that these inspections were “superficial to the point of being little use as a test of safety on the platform” (Volume 1, p.3). The Inquiry concluded that these inspections didn’t reveal a number of obvious deficiencies.
Management of change
Piper Alpha commenced production in 1976. It was originally designed to process and export oil from the Piper Oilfield to the Flotta Terminal on the Orkney Isles. The four main operating areas of the platform were separated by firewalls designed to withstand oil fires. These four “modules” were arranged so that hazardous operating areas were located far from personnel and control areas.
In 1978, the platform was modified to process gas and sent this to the MCP-01 gas compression platform. In addition, Piper Alpha served as a hub, connecting the gas lines from two other platforms in the Piper oilfield (Claymore and Tartan) to the MCP-01. As part of these modifications to Piper Alpha, a Gas Compression Module (GCM) was installed next to the platform control room. These modifications did not follow the principles of safe design.
When the initial gas exploded, the firewalls that were designed to withstand burning oil failed under the overpressure.
As there was no design for blast resistance, all critical systems suffered considerable direct damage or were rendered inoperable due to loss of power.
Procedures
Several issues were found with the written Permit to Work system, including the absence of a need to cross-reference permits where one piece of work may impact others. The written procedure may have been too complex for those that needed to use it.
There were no backup procedures to outline the actions to take in the event of a loss of the platform control room.
“The OIMs (Offshore Installation Managers) on Claymore and Tartan were ill-prepared for an emergency on another platform with which their own platform was connected”.
The public inquiry into the Piper Alpha disaster, Volume one, p.2
Lessons for other industries
Although this incident (and its escalation) had several technical causes that are specific to the oil and gas industry; there are wider lessons for all industries. For example:
- an organisational denial of risk
- insufficient redundancies in safety systems
- a culture that put production before safety
- inadequate coordination between linked organisations
- failure to manage the impact of modifications
- rapid and/or temporary promotion of staff
- a failure of safety critical communications
- a failure of leadership in an emergency.
Pause for thought / reflection
Any major disaster such as this provides an opportunity to consider our own organisations. Here’s a few questions to help you reflect on how the lessons from Piper Alpha relate to you:
- What are people rewarded or incentivised for? What could be the unintended effects of this?
- How do you balance the management of production versus safety?
- Where does the Safety function sit in your organisation – and what are the pros and cons of this structure?
- What time horizon do you encourage people to have? Is their focus on the short-term?
- What attention is given to severe and rare events, compared to low consequence-high-frequency events?
- Do you push your organisation and assets to the limit? How do you know when you are about to cross the line into an unforgiving danger zone?
- Is sustained high production or throughput a source of pride, or is it seen as a warning that the envelope is being pushed too far?
- How are warnings or negative feedback received by leadership? Are such warnings welcomed, or are the messengers seen as problematic and difficult?
- How do you really know that safety systems are working in practice?
- How can you be sure that safety systems (communications, fire-fighting, electrical power, incident leadership etc.) will function in severe emergencies?
Final thought
Brian Appleton, a Technical Assessor who contributed to the Public Inquiry, stated that:
“Safety is not an intellectual exercise designed to keep us in work. It is a matter of life or death. It is the sum of our contributions to safety management that determines whether the people we work with live or die”.
Learn more
“Remembering Piper: The night that changed our world“. A short film produced for Step Change in Safety. This moving film was released on the 25th anniversary of the disaster. Whilst recognising that organisational issues played a key role in the disaster, this film focusses on everyone playing their part.
The Public Inquiry into the Piper Alpha Disaster – Volume 1. HMSO, London, November 1990. This volume covers the first three sections: the Introduction, the Disaster and the Background to the disaster.
The Public Inquiry into the Piper Alpha Disaster – Volume 2. HMSO, London, November 1990. This volume contains section 4: the Future.
Pate-Cornell, M.E. (1993) Learning from the Piper Alpha accident: A postmortem analysis of technical and organisational factors, Risk Analysis, Vol. 13, No. 2, 1993
You must be logged in to post a comment.