Professionalism/Piper Alpha Oil Rig Disaster

On July 6, 1988, in the Piper Oilfield, North Sea, the world's deadliest offshore oil industry disaster took place. At about 10 pm, a simple miscommunication and safety lapse involving one of the platform's two condensate pumps caused a chain reaction, culminating in a chain reaction of explosions that completely destroyed the entire Piper Alpha oil rig. 226 men were on the platform at the time of the disaster, and only 61 crewman survived. 165 crewmen were lost, as well as 2 rescue personnel, leading to a total of 167 fatalities. 30 bodies were never recovered.

Background

There were unaddressed issues prior to the day of the disaster that are considered key components of the disaster, mainly consisting of design and safety oversights years in advance.

Construction

In 1972, a joint venture of 4 companies, including Texaco, began searching for oil and gas under the North Sea. The Piper Field was discovered in January 1973 by Occidental, located approximately 120 miles northeast of Aberdeen, Scotland. The Piper Alpha Oil Rig was constructed in two sections by McDermott Engineering of Ardersier and UIE of Cherbourg in 1975 and began production in 1976.

The platform was modular in design, consisting of 4 main operating areas. Module A contained the oil wells and pumps, Module B contained the separation equipment to separate the crude oil and gas, Module C contained the gas compression equipment, and Module D contained the personnel area, including the control room, alarm systems, fire suppression equipment, accommodation block, and helideck. Module C utilized two condensate pump systems, A and B, with only one needed for operation.

Piper Alpha pumped its processed oil (and later gas) from the oil field to Flotta Terminal, located on the Orkney Islands, through a 30-inch diameter undersea pipeline.

A key factor in designing the platform was that dangerous operations which could lead to fire or explosion were located separate from the personnel area. This design philosophy was abandoned when gas processing was added to the platform.

Addition of Gas Processing

To comply with UK gas conservation requirements, Piper Alpha was modified in 1978 to process and export the natural gas that accompanied the oil streams. This compromised the previous design philosophy of separating the dangerous operations from the personnel areas, as a gas compression module was added to the platform right next to the control room. The platform also served as a hub, connecting the gas lines of neighboring platforms. The gas retrofit did not include updated safeguards specific to gas production: blast proof walls were not installed around the gas compression module. In the late 1980's, the gas compression module was undergoing replacement; rather than stop operation as originally planned, production was continued.

Tartan, Claymore, and MCP-01 platforms

The Tartan and Claymore platforms were installed after Piper Alpha's completion. These two platforms also produced oil and gas. They sent their produced oil through the same Flotta Terminal pipeline as Piper Alpha, while all gas produced was transferred between platforms through separate pipelines.

Piper Alpha processed its own gas, but also connected Tartan's and Claymore's gas lines to the MCP-01 compression platform for processing. This collection of large gas lines on Piper Alpha was central to the platform's destruction. Occidental commissioned a report in 1986 on the risks of these gas lines; the report stated that:

These pipelines… would take hours to depressurize because of their capacity. This could result in a high pressure gas fire… that would be virtually impossible to fight.

Event Timeline

While the event timeline has been argued due to limited survivors, the generally accepted timeline is as follows:

12 noon - 6:00 PM: The safety valve on condensate pump A is removed for routine maintenance. The maintenance is not completed before the shift change at 6 pm, so the safety valve is simply replaced with a hand tightened temporary blind flange. A permit to work on the safety valve is filed and left at the pump, stating that Pump A is not ready for operation. A 2-week long overhaul had been planned for Pump A, but it had not been started. The supervisor is not directly informed of the temporary flange replacement.

9:45 PM: Condensate pump B fails due to a hydrate buildup. The gas from the condensate pumps powered the rig. A loss of gas flow meant a loss of power, and a costly shutdown. The crew begins searching for the permit for pump A, but is only able to find the permit for the overhaul, as the safety valve permit is stored separately with the valve itself. The blind flange is located behind other equipment, making a visual check of the pump difficult.

9:55 PM: Pump A is started on the lead Engineer's authority, as the crew is unaware of the blind flange replacement. The engineer found the permit to work for unstarted routine maintenance in pump A, and assumed it was operational. Gas immediately begins leaking from the site of the removed safety valve, causing an explosion before the crew can react. The firewalls around the gas compression module collapse, damaging the control and radio rooms. The fire spreading through the firewalls ignite a small condensate pipe ruptured by the initial explosion. Tartan and Claymore receive no orders and believe they have no authority to stop pumping oil to Piper Alpha.

10:04 PM: The platform workers evacuate the control room. An oil fire breaks out on the rig. Emergency production shutdown is activated, but back-pressure from the connected Tartan and Claymore platforms supplies more oil to the fire. The firefighting system, set to manual activation and located in the control room, is inaccessible. This firefighting system was always set to manual when divers were in the water, an unnecessary step taken, as the water intake was only a threat to divers when they were in close range. The crew has no way to fight the fire or manage the disaster, and receives no evacuation orders. The crew gathers in the accommodation deck and awaits instructions.

10:20 PM: The gas pipeline connecting Tartan to Piper Alpha bursts from the heat of the oil fire, leaking up to 33 tons of gas per second and causing an explosion and high-pressure gas fire. Claymore refuses to shut down without authorization from Occidental headquarters. Smoke fills the living quarters.

10:30 PM: The purpose-built safety vessel Tharos attempts to assist Piper Alpha. Its water cannons flooded, requiring 10 minutes to restart, and even when they are operational they are too powerful to use near crew members. Its extendable gangway had extended to only a third of the distance to Piper Alpha in 20 minutes. Helicopter rescue is impossible due to wind, smoke, and flames. At this point rig personnel begin jumping from the 175 foot platform, directly disobeying emergency procedure.

10:50 PM: The gas line from MCP-01 burst, driving the Tharos away from the platform due to the extreme heat. Tartan and Claymore stop production. The heat is so extreme that the rig and even portions of the Tharos begin melting.

11:20 PM: The final gas pipeline burst, and the fireproof accommodation block to which most of the crew had retreated falls into the sea. The rest of the platform continued falling apart until about 12:45 am on July 7. The only remaining module at that time is the oil wells module.

Key Failures

The severity of the Piper Alpha disaster could have been limited if certain key failures had been avoided. These failures can be categorized into three areasː design, management, and procedure.

Design Failures

1. Firewalls between modules not upgraded to blast proof tilesː When Piper Alpha was converted from an oil producing rig to an oil, natural gas, and liquid propane gas (LPG), the fire barriers between modules were not upgraded. The installed tiles were suitable for a crude oil fire, but were not intended to withstand gas explosions. When the initial explosion occurred in module C, the tiles acted as shrapnel and caused damage to modules B and D.
2. Control room adjacent to gas compression moduleː The placement of the control room adjacent to module C without proper shielding meant that a failure in module C could cause damage to the control room. This is exactly what happened, and left the control room inoperable.
3. Primary supply lines from other oil rigs permitted backflowː When the main supply lines on Piper Alpha failed, they leaked large amounts of crude oil and LPG into the fire. Piper Alpha could not stop the flow itself, and the entire volume of the supply lines from the Tartan and Claymore platforms fed Piper Alpha's fire.
4. Tharos rescue vessel design flawsː
   • Evacuation gangwayː The evacuation gangway intended to extend to the Piper Alpha platform to allow personnel to escape did not function as intended. This resulted in a delay of almost an hour.
   • Fire pump issuesː When personnel on Tharos initially attempted to start the fire fighting system, the pumps became flooded. Ten minutes passed before the pumps restarted and were able to fight the fire.
   • Fire pumps too powerful for personnelː The fire fighting pumps on Tharos were too powerful to use while personnel were present on Piper Alpha. If the pumps were used, the fire may have been better controlled, but personnel might have been injured.

Management Failures

1. Normal operation during major construction, maintenance, and upgradesː The Piper Alpha was undergoing multiple improvement and maintenance projects, as well as upgrades. As previously mentioned, the original plan was to shut down production, but the rig continued operation. This led to the confusion where multiple maintenance projects were occurring simultaneously, and the blind flange plate was left unnoticed.
2. Oil feeds from Tartan and Claymore weren’t shut off until too lateː Oil production on nearby platforms Tartan and Claymore continued producing oil and gas even after seeing fire on the Piper Alpha platform. Supervisors on the platforms could not determine the extent of damage on Piper Alpha, and did not believe they had authority to shut down production on their platforms (stopping production is extremely expensive).
3. Despite safety report regarding gas lines, they were never reinforced or protectedː Many 16 and 18 inch pipelines were connected to Piper Alpha, but the length and diameter of these pipelines were determined to be subject to too much pressure, requiring several hours to de-pressurize in case of an emergency. These pressure issues would make it impossible to fight a fire while fuel was pumped through them.
4. Lax safety when converting rig from oil to gas - see design failuresː The firewalls were not upgraded to blast walls, and the gas compression module was located directly next to the control room.

Procedural Failures

1. Engineer neglected to inform on-duty custodian of Pump A’s conditionː The head engineer did not inform the custodian that the safety valve had been removed from Pump A. If the custodian was aware of pump A's condition, he would have known that the system was in an unusable state and would not have tried to start the system without fixing it.
2. Flat metal disk not properly tightened, allowing LPG to leak and igniteː The metal flange meant to seal the system while the safety valve was removed was tightened by hand. A later investigation showed that had it been tightened properly using tools it would not have leaked the propane that caused the initial explosion.
3. Permit to Work system was largely a formality - no lock out tag outː The primary method of ensuring safety was a system of paper permits. Permits were organized by location, which made it hard to determine whether all parts of the system were operable. Had the system been prevented from starting physically or through software, pump A could not have been started preventing the initial gas leak.
4. Firefighting system was set to manualː The automated fire fighting system on Piper Alpha was normally set to manual whenever divers were present to prevent them from being sucked into the intake if the system was activated. On other platforms, fire fighting equipment was set to manual only when divers were very close to the intakes. Because it was set to manual during when the fire occurred, and the override was in the damaged control room, it was not useful during the disaster.
5. Evacuation protocols broke downː The radio and control room were not functional and/or inaccessible during the disaster. Alarms did not sound to alert platform personnel, and evacuation could not be coordinated with surrounding vessels.

Discussion

The Cullen Report was a public inquiry into the Piper Alpha Disaster which resulted in 106 recommendations for policy changes in the UK oil and gas industry. The recommendations covered the regulatory system, prevention and mitigation measures, and evacuation, escape, and rescue. All 106 recommendations were adopted by the industry and the government, including the Formal Safety Assessment system which covered the full lifecycle of an offshore platform and placed more responsibility for safety on the company operating the platform.

Although the disaster and the Cullen report had wide-reaching impact on the industry, disasters such as Deepwater Horizon show that lessons remain to be learned in offshore operations safety. Like Piper Alpha, a combination of management decisions, procedures, and design issues led to an explosion. Although the loss of life was smaller, the resulting oil spill was an additional disaster.

Additional research could seek to understand just how impactful this disaster was on the oil industry, looking at policy changes and later disasters that were avoided due to lessons learned from this disaster.