Piper Alpha Disaster: Safety and Environmental Analysis

The Incident

Piper Alpha was a North Sea oil production platform operated by Occidental Petroleum (Caledonia) Ltd. The platform began oil production in 1976 and was later converted to gas production as the hub of multiple networked rigs. The Piper Alpha platform was operated in multiple shifts by employees who worked the whole platform on a perpetual basis to maintain a continuous supply of oil and gas. The operations of the Piper Alpha platform included receiving oil and gases from nearby platforms and processing them so they could be further refined.

On 6 July 1988, there was a massive leakage of gas condensate on Piper Alpha, which was ignited, causing an explosion and large oil fires. The heat from the fires ruptured the riser of a gas pipeline from another installation. The rupture resulted in further explosions that engulfed the entire Piper Alpha platform. The entire series of events occurred in just 22 minutes, and the devastation caused by the disaster was the worst of its kind at the time of the tragedy. The disaster resulted in 167 deaths, while 62 people were able to survive by jumping from the platform. The financial impacts were ultimately estimated at $3.4 billion, covered through insurance claims. This analysis provides an overview of the conditions that led to the disaster as well as the lessons learned as a result of the investigation into its causes.

The Piper Before the Explosion

The Piper Oilfield lies in the UK continental shelf block, 125 miles northeast of Aberdeen, Scotland. The field is situated on a shelf south of the East Shetland platform, near the eastern end of the Moray Firth Basin. The field was discovered in January 1973 from a seismically mapped structure and confirmed as a major oilfield during that year with five appraisal wells and one exploratory well. A steel platform with 36 well slots and space for two drilling rigs was centrally located over the field in 474 feet of water in June 1975, and was made ready for production drilling by October 10, 1976. The original productive area of the field was 7,350 acres with a maximum oil column of 1,210 feet, containing approximately 1,400 million barrels of stock tank original oil in place (MMBBL STOIIP) (Geological Society, 1991).

Reservoir sandstones are Oxfordian and early Kimmeridgian in age, of marine origin, and unconformably overlie a non-marine Middle Jurassic sedimentary sequence. The gross reservoir thickness averages 250 feet (76 m) in the field area and comprises several individual sandstone bodies 40–70 feet (12–21 m) thick. Within individual sandstone bodies, grain size grades either upward or downward from very fine sandstone or siltstone to coarse-grained sandstone. The sandstones are generally well sorted, highly bioturbated, friable, and possess excellent porosity and permeability. Individual sandstone bodies record local regressions or transgressions. Regressive sands, accreting seaward as foreset beds, were generally thicker than transgressive sands (Williams, Conner, & Peterson, 1975).

A combination of favorable geological and engineering conditions, together with extensive use of seismic data before and during development drilling, resulted in high production rates and the need for only one centrally located platform to maximize recoverable reserves from the Piper Oilfield (Maher, 1981). The Piper Alpha Oil Production Platform was built in the Highlands of Scotland for the Piper Field in the North Sea. It started production in 1978 and became one of the largest producers of oil in the North Sea, before being converted to produce and gather gas as well as oil. In 1988, Piper Alpha endured a gas leak, and the subsequent fire and explosion reduced the platform to a wreck on the bottom of the North Sea (Scott, 2011).

Timeline of Events

A detailed timeline of events that led up to the disaster has been well documented by the Energy Library (The Energy Library, n.d.):

12:00 p.m. Two condensate pumps on the platform, designated A and B, compressed the gas for transport to the coast. On the morning of July 6, Pump A's pressure safety valve (PSV #504) was removed for routine maintenance. The pump's fortnightly overhaul was planned but had not yet started. The now-open condensate pipe was temporarily sealed with a flat metal disc. Because the work could not be completed by 6:00 p.m., the metal disc remained in place. The on-duty engineer filled out a permit stating that Pump A was not ready and must not be switched on under any circumstances.

6:00 p.m. The day shift ends and the night shift begins with 62 men running Piper Alpha. Finding the on-duty supervisor occupied, the departing engineer neglected to inform him of the condition of Pump A. Instead, he placed the permit in the control centre and left. This permit subsequently disappeared and was never found. Coincidentally, another permit had been issued for the general overhaul of Pump A, which had not yet begun.

7:00 p.m. Like many other offshore platforms, Piper Alpha had an automatic firefighting system driven by both diesel and electric pumps (the latter of which were disabled by the initial explosions). The diesel pumps were designed to draw in large amounts of seawater to extinguish fires and were fitted with an automatic control that would activate them in the event of a fire. However, the firefighting system was under manual control on the evening of July 6. Piper Alpha procedures required manual control of the pumps whenever divers were in the water — approximately 12 hours per day during summer — regardless of their location, to prevent divers from being drawn in with the seawater. (Fire pumps on other platforms were switched to manual control only when divers were close to the inlet.)

9:45 p.m. Condensate (LPG) Pump B stops suddenly and cannot be restarted. The entire power supply for the offshore construction work depended on this pump. The duty manager had only a few minutes to restore the pump to operation; otherwise the power supply would fail completely. A search was made through the documentation to determine whether Condensate Pump A could be started.

9:52 p.m. The permit for the overhaul of Pump A is found, but not the separate permit stating that the pump must not be started under any circumstances due to the missing safety valve. The valve was located in a different part of the platform from the pump, so the permits were stored in different boxes, sorted by location. None of those present was aware that a vital component of the pump had been removed. The duty manager, relying on the available documents, assumed it would be safe to start Pump A. The missing valve went unnoticed, partly because the metal disc replacing the safety valve was located several metres above ground level and obscured by machinery.

9:55 p.m. Condensate Pump A is switched on. Gas flowed into the pump and, due to the missing safety valve, produced an overpressure that the loosely fitted metal disc could not withstand. Gas audibly leaked out at high pressure, attracting the attention of several workers and triggering six gas alarms, including the high-level gas alarm. Before anyone could act, the gas ignited and exploded, blowing through the firewall — composed of 2.5 × 1.5 metre panels bolted together — which had not been designed to withstand explosive forces. The duty manager pressed the emergency stop button, closing large valves in the sea lines and halting all oil and gas production.

Theoretically, the platform would at this point have been isolated from the flow of oil and gas, and the fire relatively contained. However, because the platform had originally been built for oil production, the firewalls were designed to resist fire rather than withstand explosions. The first explosion broke up the firewall and dislodged panels around Module B. One of the flying panels ruptured a small condensate pipe, creating a second fire.

10:04 p.m. The control room is abandoned. Piper Alpha's design made no provision for the loss of the control room, and the platform's command structure collapsed. No attempt was made to use the public address system or to order an evacuation. Emergency procedures directed personnel to make their way to lifeboat stations, but the fire prevented them from doing so. Instead, the men moved to the fireproofed accommodation block beneath the helicopter deck to await further instructions. Wind, fire, and smoke prevented helicopter landings, and no further instructions were issued as smoke began to penetrate the accommodation block.

As the crisis escalated, two men donned protective gear in an attempt to reach the diesel pumping machinery below decks and activate the firefighting system. They were never seen again.

The fire would have burned itself out were it not being fed by fresh oil flowing from both the Tartan and Claymore platforms. The resulting back-pressure forced additional fuel out of ruptured pipework on Piper Alpha, directly into the heart of the fire. The Claymore continued pumping until the second explosion because its manager had no authorization from Occidental's control centre to shut down. Similarly, the connecting pipeline to Tartan continued to supply fuel, as its manager had received instructions from his superior to continue operations. The reason for this procedure was the prohibitive cost of a shutdown — it takes several days to restart production after a stop, with substantial financial consequences.

Gas lines of 140 to 146 centimetres in diameter ran in close proximity to Piper Alpha. Two years earlier, Occidental management had commissioned a study that warned of the dangers posed by these gas lines. Due to their length and diameter, it would take several hours to reduce their pressure — too long to fight a fire fuelled by them. Although management acknowledged how devastating a gas explosion would be, neither Claymore nor Tartan was shut down following the first emergency call.

10:20 p.m. Tartan's gas line, pressurized to 120 atmospheres, melts and bursts. From this moment, the platform's destruction is assured. Between 15 and 30 tonnes of gas are released instantaneously and immediately ignite. A massive fireball approximately 150 metres in diameter engulfs Piper Alpha.

10:30 p.m. The Tharos, a large firefighting and rescue platform, draws alongside Piper Alpha. Attempts are made to extend its rescue walkway the 30 metres needed to reach the deck. A critical design flaw in the Tharos becomes apparent as the walkway extends too slowly to bridge the gap before 10:50 p.m.

10:50 p.m. The second gas line ruptures, releasing millions of litres of gas into the conflagration. Huge flames shoot more than 300 feet into the air. The Tharos is driven back by the intense heat, which begins to melt surrounding machinery and steelwork. It was after this second explosion that the Claymore finally stopped pumping oil. Personnel still alive are either sheltering desperately in the scorched, smoke-filled accommodation block or leaping from the deck — some 200 feet (61 m) — into the cold, rough North Sea.

11:20 p.m. The pipeline connecting Piper Alpha to the Claymore platform bursts, claiming the disaster's final victims.

11:50 p.m. The generation and utilities Module D, which includes the fireproofed accommodation block, slips into the sea. The largest part of the platform follows.

12:45 a.m., July 7. The entire platform has been destroyed. Module A is all that remains of Piper Alpha.

Root Causes of the Disaster

In November 1988, the UK Department of Energy — which was responsible for the operation and safety of offshore oil and gas installations — appointed Lord Cullen, an experienced Scottish jurist, to conduct a Public Inquiry into the cause of the Piper Alpha disaster. Beginning in January 1989, the inquiry lasted 13 months and heard evidence from more than 150 witnesses. By the time his report was published in 1990, it was widely acknowledged that the Cullen Inquiry would signal a fundamental change in offshore safety (Allen, 2008). Two main categories of factors are attributed to the Piper Alpha disaster: Human Factors and Design and Process Factors.

After the investigation was completed, it was established that the pump had been incorrectly switched on as a result of a failure in the Permit to Work (PTW) system, which did not ensure proper communication between shifts — a critical factor in the disaster (Centre of Risk, n.d.). A Permit to Work is a document that records the identity and location of the component on which work is to be carried out. On any offshore platform installation, a PTW must be raised before any work can commence. On the morning of July 6, a backup propane condensate pump in the processing area needed its pressure safety valve inspected. The work could not be completed by 18:00, so the workers requested and received permission to defer the remainder of the work until the following day; the open pipe was sealed with a plate. Later that evening, during the next work shift, the primary condensate pump failed. None of those present was aware that a vital component had been removed from the backup pump, and the decision was made to start it. Gas escaped from the aperture left by the valve, leaked at high pressure, ignited, and exploded, blowing through the firewalls (Centre of Risk, n.d.).

McDermott Engineering at Ardersier and UIE at Cherbourg had originally constructed the Piper Alpha platform with safety in mind, organizing modules so that the most dangerous operations were kept distant from other platforms. However, after the platform was converted from pure oil production to oil and gas production, these safety design principles were disregarded. Using Piper Alpha as a processing hub, following its conversion, violated the safety concept that had been embedded in its original design and construction.

When the explosion occurred, both the Tartan and Claymore platforms continued to supply Piper Alpha with oil and gas — even though the fire on Piper Alpha was clearly visible from those platforms. Although the explosion was initially triggered by the escape of gas from the PSV on Piper Alpha, the major failure and rupture of the gas risers were ultimately responsible for the platform's destruction and for trapping workers inside.

Although Piper Alpha did have a series of firewalls, these had not been upgraded to blast walls when that technology became available. Consequently, the existing firewalls disintegrated immediately during the gas explosion, allowing the fire to spread to oil and gas pipelines and machinery, fuelling the conflagration further. The workers' accommodation was also not smoke-proofed, and employees repeatedly opening and closing the doors contributed to the rapid spread of toxic fumes.

The rapid spread of fire across the platform left many workers with no option but to jump into the sea. Yet many did not get the opportunity to escape, as routes to the lifeboats were blocked by flames and smoke. Sixty-one men survived by jumping from the platform, but 167 men perished — their deaths caused primarily by carbon monoxide poisoning in the accommodation area, though many also died from direct exposure to fire or from the force of the explosions.

The Cullen Inquiry concluded that the initial condensate leak resulted from maintenance work being carried out simultaneously on a pump and its related safety valve. The inquiry was critical of Piper Alpha's operator, Occidental, which was found to have had inadequate maintenance and safety procedures. However, no criminal charges were ever brought against the company (Centre of Risk, n.d.). The financial costs of the disaster were enormous; at the time it was the largest man-made industrial disaster of its kind, with insurance claims exceeding £1.4 billion.

Conclusion

Piper Alpha was a North Sea oil production platform operated by Occidental Petroleum (Caledonia) Ltd. The platform began oil production in 1976 and was later converted to gas production as the hub of multiple networked rigs. On 6 July 1988, a massive leakage of gas condensate on Piper Alpha was ignited, causing an explosion and devastating oil fires. The disaster resulted in 167 deaths, while 62 people survived by jumping from the platform. The financial impacts were ultimately estimated at $3.4 billion, covered through insurance claims.

In November 1988, the UK Department of Energy appointed Lord Cullen to conduct a Public Inquiry into the cause of the disaster. Beginning in January 1989, the inquiry lasted 13 months and heard evidence from more than 150 witnesses. By the time his report was published in 1990, it was clear that the Cullen Inquiry would bring about a fundamental transformation in offshore safety regulation. The two principal categories of causation identified were Human Factors and Design and Process Factors. As a result of the lessons learned from the disaster, numerous safety improvements and regulatory reforms have been implemented to improve the operations of modern offshore rigs and prevent a recurrence of such a tragedy.

Allen, B. (2008). Lest we forget: Piper Alpha. Retrieved April 19, 2013.

Centre of Risk. (n.d.). Piper Alpha accident. Retrieved April 19, 2013.

Geological Society. (1991). The Piper Field. Geological Society of London Memoirs, 14(1), 361–368.

Maher, C. (1981). Development geology of the Piper Oilfield. Ocean Management, 7(1–4), 133–165.

Parthenon Consultancy Ltd. (n.d.). The Piper Alpha explosion & fire. Retrieved April 18, 2013.

Pate-Cornell, E. (1993). Learning from the Piper Alpha accident: A postmortem analysis of technical and organizational factors. Risk Analysis, 13(2), 215–232.

Scott, W. (2011). Piper Alpha oil rig disaster. Retrieved April 18, 2013.

Seconds from Disaster. (2013). S01E10: Explosion in the North Sea — Piper Alpha disaster. Retrieved April 18, 2013.

Taylor, S. (n.d.). Oil work. Retrieved April 18, 2013.

Williams, J., Conner, D., & Peterson, K. (1975). Piper Oil Field, North Sea: Fault-block structure with Upper Jurassic beach/bar reservoir sands. AAPG Bulletin, 59(9), 1585–1601.