The Piper Alpha disaster

Overview

On July 6, 1988, the Piper Alpha oil platform experienced a series of catastrophic explosions and fires. This platform, located in the North Sea approximately 177 kilometers from Aberdeen, Scotland, had 226 people on board at the time of the event, 165 of whom were killed. In addition, two emergency response personnel died during a rescue attempt. The platform was totally destroyed and led to damages of around 3.4 billion USD.

A release of light hydrocarbon occurred when a pump was restarted after maintenance. Though the personnel starting the pump did not know this, a relief valve in the pump discharge had also been removed for service and a blankA blank or blind flange is a solid metal flange that is installed to block off a section of pipe or an unused nozzle on a vessel.

had been loosely installed in its place on the piping flange (which was not readily visible from the pump vicinity). Upon restart of the pump, this flange leaked, producing a flammable hydrocarbon cloud, which subsequently encountered an ignition source. The initial explosion led to an escalating series of crude oil fires (an illustration of what is called the “domino effect”), fuelled by continuing production from adjacent oil platforms.The Piper Alpha platform was at the center of a network of platforms interconnected by oil and gas pipelines. The initial explosion caused oil pipelines on the Piper Alpha platform to rupture, leaking additional oil which fed the fire. The pipelines were fed by oil from other platforms, whose managers assumed that they would be told to shut down their operations if necessary (they were aware of the event on Piper Alpha, but did not know how serious it was). However, the accident had interrupted communications with other oil platforms, and it took a long time for the “please stop” message to arrive.

The intensity of the subsequent fires prevented rescue efforts, either by helicopter or by ship. At the height of the event, natural gas was being burned on Piper Alpha at a rate equivalent to the natural gas consumption rate of the entire United Kingdom.

It took over three weeks for the fires on the remains of the rig to be put out by a company specialized in controlling runaway oil wells.

Contributing factors

The accident was caused by an “accumulation of errors and questionable decisions” [Paté-Cornell 1993]. Lord Cullen, who led the government inquiry into the accident, stated that the underlying cause of the various direct causes of the accident was poor safety management. This included:

• Poor management of work permitsA work permit or permit-to-work system is an organizational mechanism that requires anyone undertaking a specific planned work procedure to obtain prior explicit (and generally written) approval. It applies to front-line work such as maintainance operations. The work permit specifies the work to be undertaken, the people involved, the specific risks and associated safety precautions associated with the task. Typically, special permissions will be required for tasks exposed to specific hazards such as generating a flame, entering an enclosed space, opening equipment that contains potentially toxic product, and tasks exposed to electric hazards. When emitting permits, tasks are checked to make sure that nearby operations do not generate a “co-activity” hazard.
  
  and lockout/tagout procedures in maintenance operations. The shift workers who had restarted the pump had checked maintenance records to determine whether there was ongoing maintenance on that pump. They had found a global permit concerning an ongoing overhaul involving that pump, but did not find another permit concerning the routine maintenance that day that had led to the removal of a relief valve and replacement by a blank, because that permit had been placed in a box near the pump, rather than in the control room. This is because the permit-to-work system was location-based rather than centralized, and because work teams didn’t have a rigorous information transfer system when changing shifts.This inadequacy in information transfer occurred despite a fatality on the platform the previous year which was partly due to this inadequate transmission of safety-relevant information between shift workers.
  
  

• Inadequate management review of the permit-to-work system, despite a previous fatal accident attributed to its poor operation and despite serious concerns raised by a senior maintenance technician at a meeting at corporate headquarters earlier in the year.

• Poor management of the tradeoffs between production and safety. The Piper Alpha platform was a staging point for pipelines arriving from two other nearby drilling platforms before moving through a pipeline to land. Because of the significant cost of shutting down these pipelines, managers on the other platforms hesitated to shut down their operations until they had definite information of the severity of the event on Piper Alpha, which took a long time to arrive. This additional incoming oil and gas made the fire on Piper Alpha much more severe than it would otherwise have been.

• Design inadequacies: lack of redundancies and of appropriate “decoupling” of the safety systems. The control room of the platform, which should have been where evacuation activities were coordinated, was evacuated very quickly after the start of the fire, because it was not properly protected from production areas. Although it was separated from production areas and protected by firewalls in the original design of the platform, later modifications had weakened this original protection by installing production equipment (gas compression units) near to the control room. Furthermore, the firewalls had been designed for the original purpose of the platform, oil extraction, and had not been reinforced when the platform started to also extract and process gas; the firewalls failed to resist the force of the gas explosions.

  A number of technical improvements became mandatory after the Piper Alpha accident, such as the fire protection of risers (pipes connecting oil platforms to underwater pipelines), better emergency isolation of the risers, improvements to subsea isolation valves and obligations to include automatic shut-down valves.

• An ineffective fire protection system: diesel generatorsThe Piper Alpha platform was equipped with both electric and diesel seawater pumps to power its automatic firefighting system. However, the automatic pumps had been set to a manual mode of operation because some divers were present in the water earlier in the day (reducing risk of sucking them into the pumps), so the firefighting system did not work as intended (pumps had to be activated locally, and dense fire and smoke prevented anyone from getting close to them despite valliant efforts). An audit earlier had recommended that this practice of disabling the firefighting system while diving operations were underway (a practice only implemented on the Piper Alpha platform) be stopped.
  
  set to manual mode due to diving operations, corroded firewater piping (which was progressively being replaced at the time of the accident).

• Absence of fireproofing on structural elements of the platform. This led to the eventual structural failure of the platform as the metal was weakened by impinging flames.

• Inadequate emergency response and evacuation training (the death toll among those in the accommodation section of the rig, which ended up collapsing into the sea, might have been significantly reduced if they had instructions to escape from the accommodation by whatever means possible).The personnel who followed emergency instructions to remain within the accommodation area, which in principle was protected against fire hazards, were in fact killed when the structure finally failed and the accommodation area fell into the ocean.
  
  Life rafts on the platform did not inflate, lifeboats could not be launched, helicopters could not be used to evacuate personnel due to the amount of smoke and flames, a firefighting support vessel could not operate at full capacity because its water jets had the power to kill individuals exposed to them, and an emergency evacuation drill had not been undertaken.

Lord Cullen stated in his report into the accident [Cullen 1990]:

Management shortcomings emerged in a variety of forms. For example there was no clear procedure for shift handover. The permit to work system was inadequate. But so far as it went, it had been habitually departed from. Training, monitoring and auditing had been poor, the lessons from a previous relevant accident had not been followed through. Evacuation procedures had not been practised adequately.

and also

There had not been an adequate assessment of the major hazards and methods for controlling them.

However, the operating company Occidental Petroleum (an american company which was one of the largest firms operating in the North Sea at the time) was not exposed to any civil or criminal penalties following the accident.

Location

The platform was located above the Piper oilfield in the North Sea, around 200 km northeast of Aberdeen.

Lessons learned

The report of the public inquiry into the Piper Alpha accident, headed by Lord Cullen, made more than 100 recommendations to improve the safety of offshore oil and gas extraction, covering issues such as corporate safety culture, regulatory oversight, emergency procedures and facility design. It is widely recognized as a landmark analysis of how safety should be managed by companies running high-hazard facilities and how they should be regulated and inspected by the competent authorities.

The report states that

It is essential to create a corporate atmosphere or culture in which safety is understood to be and accepted as, the number one priority.

Indeed, the company that operated the Piper Alpha platform, Occidental Petroleum, had significantly reduced spending on maintenance on their facilities, following the decrease in profitability of their operations (the oil price had fallen to 8 USD per barrel in the 1980s after much higher levels of almost 40 USD per barrel in the aftermath of the 1979 oil crisis). 10 years before the accident, the Piper Alpha platform was the most productive platform in the world, producing more than 5M USD worth of crude oil per day.

Recommendations in the Cullen report led to the introduction of the safety case regime in the North Sea, which in effect transferred responsibility for identification of major accident risks from the legislator and safety inspectorate to the operating company. In this new approach to safety oversight, the operating company is also assumed to be responsible for ensuring that provisions in the safety management system and the safety case are respected in practice, in particular by implementing regular audits (in the past, there could have been a tendency for operating companies to assume that “inspectors are responsible for telling us if anything is insufficiently safe”). The regulator is then responsible for ensuring that the company audits are well carried out, and for undertaking any further inspections that it deems necessary.

Furthermore, the Cullen report suggested that

Many regulations are unduly restrictive in that they are of the type which impose “solutions” rather than “objectives” and are out-of-date in relation to technological advances. […] There is a danger that compliance takes precedence over wider safety considerations; and that sound innovations are discouraged. The principal regulations should take the form of requiring stated objectives to be met.

The principles of the regulatory approach were later extended to Seveso facilities onshore.

A specialist Offshore Safety Division was set up within HSE, the UK regulator, to provide specialist support to the oil and gas industry.Prior to the accident, safety of offshore oil and gas extraction facilities was overseen in the UK by the Department of Energy. This means the same organization had responsibility for developing the industry (and taxing production) and safety oversight, which constituted a conflict of interest. The Cullen inquiry found that though the Piper Alpha platform had been inspected the year of the accident, with inspections focused on the area of work permits and information transfer between shifts (because this issue had been implicated in an earlier fatal accident), the inspections were “superficial to the point of being little use as a test of safety on the platform”.

Furthermore, a specialist offshore health and safety division was created within the Crown Office and Procurator Fiscal’s Service, the body responsible for prosecuting offences in Scotland. The aim of the specialist unit was to ensure consistency in the way complex health and safety prosecutions are handled, to secure greater expertise in the prosecution of such cases which would lead to a quicker resolution of cases.

Lack of external learning. It is worth reflecting on the fact that eight years before the Piper Alpha disaster, a similar catastrophe had occurred on an offshore oil platform in the Norwegian area of the North Sea, the Alexander Kielland, where 123 workers were killed. The investigation into that accident had made recommendations similar to those in the Cullen report, and in fact 105 of the 106 safety recommendations included in the Cullen report had already been implemented in Norwegian operations at the time of the Piper Alpha disaster [Reid 2020]. This illustrates the difficulty that organizations have in learning from accidents that happen “elsewhere”.

Conclusion

Whilst the excellent recommendations in the Cullen report did lead to significant improvements in the safety of offshore oil and gas extraction activities, this industrial sector remains one of the most risky still in operation today, with large numbers of workers killed each year worldwideFor instance, the US Bureau of Labor Statistics recorded a rate of 16 deaths per 100 000 workers in 2014, almost 5 times the general average.

and enormous (and in certain geographical areas, unrecorded) environmental damage from leaks. The spectacular Macondo (Deepwater Horizon) accident in the Gulf of Mexico in 2010 is present in people’s minds, but there are many other deadly accidents each year that barely make the news.

More information

• A NASA Safety Message on the Piper Alpha accident

• UK HSE research report OTH 543 on Human and organisational factors in offshore safety, published 1997, presents results from research on the human and organizational factors of activity on offshore oil and gas facilities in the UK.