The Piper Alpha disaster — Risk Engineering (2024)

Overview

On July 6, 1988, the Piper Alpha oil platform experienced a series ofcatastrophic explosions and fires. This platform, located in the NorthSea approximately 177 kilometers from Aberdeen, Scotland, had 226 peopleon board at the time of the event, 165 of whom were killed. In addition,two emergency response personnel died during a rescue attempt. Theplatform was totally destroyed and led to damages of around 3.4 billionUSD.

A release of light hydrocarbon occurred when a pump was restartedafter maintenance. Though the personnel starting the pump did not knowthis, a relief valve in the pump discharge had also been removed forservice and a blankA blank or blind flange is a solid metal flange that isinstalled to block off a section of pipe or an unused nozzle on avessel. had been loosely installed in its place on the pipingflange (which was not readily visible from the pump vicinity). Uponrestart of the pump, this flange leaked, producing a flammablehydrocarbon cloud, which subsequently encountered an ignition source.The initial explosion led to an escalating series of crude oil fires (anillustration of what is called the “domino effect”), fuelled bycontinuing production from adjacent oil platforms.The Piper Alpha platform was at the center of a networkof platforms interconnected by oil and gas pipelines. The initialexplosion caused oil pipelines on the Piper Alpha platform to rupture,leaking additional oil which fed the fire. The pipelines were fed by oilfrom other platforms, whose managers assumed that they would be told toshut down their operations if necessary (they were aware of the event onPiper Alpha, but did not know how serious it was). However, the accidenthad interrupted communications with other oil platforms, and it took along time for the “please stop” message to arrive. The intensity of the subsequent fires prevented rescueefforts, either by helicopter or by ship. At the height of the event,natural gas was being burned on Piper Alpha at a rate equivalent to thenatural gas consumption rate of the entire United Kingdom.

It took over three weeks for the fires on the remains of the rig tobe put out by a company specialized in controlling runaway oilwells.

Contributing factors

The accident was caused by an “accumulation of errors andquestionable decisions” [Paté-Cornell 1993]. Lord Cullen, who ledthe government inquiry into the accident, stated that the underlyingcause of the various direct causes of the accident was poor safetymanagement. This included:

• Poor management of work permitsA work permit or permit-to-worksystem is an organizational mechanism that requires anyone undertaking aspecific planned work procedure to obtain prior explicit (and generallywritten) approval. It applies to front-line work such as maintainanceoperations. The work permit specifies the work to be undertaken, thepeople involved, the specific risks and associated safety precautionsassociated with the task. Typically, special permissions will berequired for tasks exposed to specific hazards such as generating aflame, entering an enclosed space, opening equipment that containspotentially toxic product, and tasks exposed to electric hazards. Whenemitting permits, tasks are checked to make sure that nearby operationsdo not generate a “co-activity” hazard. and lockout/tagout procedures inmaintenance operations. The shift workers who had restarted the pump hadchecked maintenance records to determine whether there was ongoingmaintenance on that pump. They had found a global permit concerning anongoing overhaul involving that pump, but did not find another permitconcerning the routine maintenance that day that had led to the removalof a relief valve and replacement by a blank, because that permit hadbeen placed in a box near the pump, rather than in the control room.This is because the permit-to-work system was location-based rather thancentralized, and because work teams didn’t have a rigorous informationtransfer system when changing shifts.This inadequacy in information transfer occurreddespite a fatality on the platform the previous year which was partlydue to this inadequate transmission of safety-relevant informationbetween shift workers.

• Inadequate management review of the permit-to-work system,despite a previous fatal accident attributed to its poor operation anddespite serious concerns raised by a senior maintenance technician at ameeting at corporate headquarters earlier in the year.

• Poor management of the tradeoffs between production and safety.The Piper Alpha platform was a staging point for pipelines arriving fromtwo other nearby drilling platforms before moving through a pipeline toland. Because of the significant cost of shutting down these pipelines,managers on the other platforms hesitated to shut down their operationsuntil they had definite information of the severity of the event onPiper Alpha, which took a long time to arrive. This additional incomingoil and gas made the fire on Piper Alpha much more severe than it wouldotherwise have been.

• Design inadequacies: lack of redundancies and ofappropriate “decoupling” of the safety systems. The control room of theplatform, which should have been where evacuation activities werecoordinated, was evacuated very quickly after the start of the fire,because it was not properly protected from production areas. Although itwas separated from production areas and protected by firewalls in theoriginal design of the platform, later modifications had weakened thisoriginal protection by installing production equipment (gas compressionunits) near to the control room. Furthermore, the firewalls had beendesigned for the original purpose of the platform, oil extraction, andhad not been reinforced when the platform started to also extract andprocess gas; the firewalls failed to resist the force of the gasexplosions.

  A number of technical improvements became mandatory after the PiperAlpha accident, such as the fire protection of risers (pipes connectingoil platforms to underwater pipelines), better emergency isolation ofthe risers, improvements to subsea isolation valves and obligations toinclude automatic shut-down valves.

  See Also

  Piper Alpha: The Disaster in DetailMenselijke fouten veroorzaken inferno op NoordzeePiper Alpha: How we survived North Sea disasterJuly 6, 1988: The Piper Alpha Disaster

• An ineffective fire protection system: dieselgeneratorsThe Piper Alpha platform was equipped with bothelectric and diesel seawater pumps to power its automatic firefightingsystem. However, the automatic pumps had been set to a manual mode ofoperation because some divers were present in the water earlier in theday (reducing risk of sucking them into the pumps), so the firefightingsystem did not work as intended (pumps had to be activated locally, anddense fire and smoke prevented anyone from getting close to them despitevalliant efforts). An audit earlier had recommended that this practiceof disabling the firefighting system while diving operations wereunderway (a practice only implemented on the Piper Alpha platform) bestopped. set to manual mode due to diving operations, corrodedfirewater piping (which was progressively being replaced at the time ofthe accident).

• Absence of fireproofing on structural elementsof the platform. This led to the eventual structural failure of theplatform as the metal was weakened by impinging flames.

• Inadequate emergency response and evacuationtraining (the death toll among those in the accommodation section of therig, which ended up collapsing into the sea, might have beensignificantly reduced if they had instructions to escape from theaccommodation by whatever means possible).The personnel who followed emergency instructions toremain within the accommodation area, which in principle was protectedagainst fire hazards, were in fact killed when the structure finallyfailed and the accommodation area fell into the ocean. Life rafts on the platform did not inflate, lifeboatscould not be launched, helicopters could not be used to evacuatepersonnel due to the amount of smoke and flames, a firefighting supportvessel could not operate at full capacity because its water jets had thepower to kill individuals exposed to them, and an emergency evacuationdrill had not been undertaken.

Lord Cullen stated in his report into the accident [Cullen 1990]:

Management shortcomings emerged in a variety of forms. For examplethere was no clear procedure for shift handover. The permit to worksystem was inadequate. But so far as it went, it had been habituallydeparted from. Training, monitoring and auditing had been poor, thelessons from a previous relevant accident had not been followed through.Evacuation procedures had not been practised adequately.

and also

There had not been an adequate assessment of the major hazards andmethods for controlling them.

However, the operating company Occidental Petroleum (an americancompany which was one of the largest firms operating in the North Sea atthe time) was not exposed to any civil or criminal penalties followingthe accident.

Location

The platform was located above the Piper oilfield in the North Sea,around 200 km northeast of Aberdeen.

Lessons learned

The report of the public inquiry into the Piper Alpha accident,headed by Lord Cullen, made more than 100 recommendations to improve thesafety of offshore oil and gas extraction, covering issues such ascorporate safety culture,regulatory oversight, emergency procedures and facility design. It iswidely recognized as a landmark analysis of how safety should be managedby companies running high-hazard facilities and how they should beregulated and inspected by the competent authorities.

The report states that

It is essential to create a corporate atmosphere or culture in whichsafety is understood to be and accepted as, the number one priority.

Indeed, the company that operated the Piper Alpha platform,Occidental Petroleum, had significantly reduced spending on maintenanceon their facilities, following the decrease in profitability of theiroperations (the oil price had fallen to 8 USD per barrel in the 1980safter much higher levels of almost 40 USD per barrel in the aftermath ofthe 1979 oilcrisis). 10 years before the accident, the Piper Alpha platform wasthe most productive platform in the world, producing more than 5M USDworth of crude oil per day.

Recommendations in the Cullen report led to the introduction of thesafety case regime in the North Sea, which in effecttransferred responsibility for identification of major accident risksfrom the legislator and safety inspectorate to the operating company. Inthis new approach to safety oversight, the operating company is alsoassumed to be responsible for ensuring that provisions in the safetymanagement system and the safety case are respected in practice, inparticular by implementing regular audits (in the past, there could havebeen a tendency for operating companies to assume that “inspectors areresponsible for telling us if anything is insufficiently safe”). Theregulator is then responsible for ensuring that the company audits arewell carried out, and for undertaking any further inspections that itdeems necessary.

Furthermore, the Cullen report suggested that

Many regulations are unduly restrictive in that they are of the typewhich impose “solutions” rather than “objectives” and are out-of-date inrelation to technological advances. […] There is a danger thatcompliance takes precedence over wider safety considerations; and thatsound innovations are discouraged. The principal regulations should takethe form of requiring stated objectives to be met.

The principles of the regulatory approach were later extended toSeveso facilities onshore.

A specialist Offshore Safety Division was set up within HSE, the UKregulator, to provide specialist support to the oil and gasindustry.Prior to the accident, safety of offshore oil and gasextraction facilities was overseen in the UK by the Department ofEnergy. This means the same organization had responsibility fordeveloping the industry (and taxing production) and safety oversight,which constituted a conflict of interest. The Cullen inquiry found thatthough the Piper Alpha platform had been inspected the year of theaccident, with inspections focused on the area of work permits andinformation transfer between shifts (because this issue had beenimplicated in an earlier fatal accident), the inspections were“superficial to the point of being little use as a test of safety on theplatform”. Furthermore, a specialist offshore health and safetydivision was created within the Crown Office and Procurator Fiscal’sService, the body responsible for prosecuting offences in Scotland. Theaim of the specialist unit was to ensure consistency in the way complexhealth and safety prosecutions are handled, to secure greater expertisein the prosecution of such cases which would lead to a quickerresolution of cases.

Lack of external learning. It is worth reflecting onthe fact that eight years before the Piper Alpha disaster, a similarcatastrophe had occurred on an offshore oil platform in the Norwegianarea of the North Sea, the Alexander Kielland, where 123 workers werekilled. The investigation into that accident had made recommendationssimilar to those in the Cullen report, and in fact 105 of the 106 safetyrecommendations included in the Cullen report had already beenimplemented in Norwegian operations at the time of the Piper Alphadisaster [Reid 2020]. Thisillustrates the difficulty thatorganizations have in learning from accidents that happen“elsewhere”.

Conclusion

Whilst the excellent recommendations in the Cullen report did lead tosignificant improvements in the safety of offshore oil and gasextraction activities, this industrial sector remains one of the mostrisky still in operation today, with large numbers of workers killedeach year worldwideFor instance, the US Bureau of Labor Statisticsrecorded a rate of 16 deaths per 100 000 workers in 2014, almost 5 timesthe general average. and enormous (and in certain geographical areas,unrecorded) environmental damage from leaks. The spectacular Macondo(Deepwater Horizon) accident in the Gulf of Mexico in 2010 is present inpeople’s minds, but there are many other deadly accidents each year thatbarely make the news.

More information

• A NASASafety Message on the Piper Alpha accident

• UK HSE research report OTH 543 on Humanand organisational factors in offshore safety, published 1997,presents results from research on the human and organizational factorsof activity on offshore oil and gas facilities in the UK.