Piper Alpha Disaster An Environmental and Safety Management Analysis of the Disaster that Occurred on the Piper Alpha Oil Rig off the Coast of Scotland

Piper Alpha (Seconds from Disaster, 2013)

The Incident

The Piper before the Explosion

Timeline of Events

Piper Alpha Mechanism

Root Causes of the Analysis

Human Factors

Design and Process Factor

Financial Consequences

Permit to Work System

Safety Training

Fire Walls

Temporary Refuge

Evacuation and Escape

The Incident

Piper Alpha was a North Sea oil production platform operated by Occidental Petroleum (Caledonia) Ltd. The platform began the oil production in 1976 and then later converted to gas production as the hub of multiple networked rigs. The piper alpha platform was operated in multiple shifts by the employees who worked the whole platform to continue supply the oil and gas on a perpetual basis. The operations of the Piper Alpha platform included receiving the oil and gases from the other platform nearby and processing these so they could be further refined

On 6 July 1988, there was a massive leakage of gas condensate on Piper Alpha, which was ignited causing an explosion and large oil fires. The heat from the fires ruptured the riser of a gas pipeline from another installation. The rupture resulted in further explosions which engulfed the entire Piper Alpha platform. The entire series of events occurred in just 22 minutes and the devastation caused by the disaster was the worst of its kind at the time of the tragedy. The disaster resulted in 167 deaths while 62 people were able to survive by jumping from the platform. In the end, the financial impacts were estimated at 3.4 billion which were offered through insurance claims. This analysis will provide an overview of the conditions that led to the disaster as well as some of the lessons that were learned as a result of the investigation into causality.

2.0 The Piper before the Explosion

The Piper Oilfield lies in the UK Block, 125 miles northeast of Aberdeen, Scotland. The field is situated on a shelf south of the East Shetland platform, and near the eastern end of the Moray Firth Basin. The field was discovered in January 1973 from a seismicly mapped structure and confirmed as a major oilfield during the year with five appraisal wells and one exploratory well. A steel platform with 36 well slots and space for two drilling rigs was centrally located over the field in 474 ft. Of water in June, 1975, and made ready for production drilling by October 10, 1976. The original productive area of the field was 7350 acres with a maximum oil column of 1210 ft, containing approximately 1400 million barrels of stock tank original oil in place (MMBBL STOIIP) (Geological Society, 1991).

Figure 2 - Piper Oil Field Location (Taylor, N.d.)

Reservoir sandstones are Oxfordian and early Kimmeridgian in age, of marine origin, and unconformably overlie a nonmarine Middle Jurassic sedimentary sequence. The gross-reservoir thickness averages 250 ft (76 m) in the field area and is comprised of several individual sandstone bodies 40-70 ft (12-21 m) thick. Within individual sandstone bodies the grain size grades either upward or downward from very fine sandstone or siltstone to coarse-grained sandstone. The sandstones generally are well sorted, highly bioturbated, friable, and have excellent porosity and permeability. Individual sandstone bodies record local regressions or transgressions. Regressive sands, accreting seaward as foreset beds, were generally thicker than transgressive sands (Williams, et al., 1975).

A combination of favourable geological and engineering conditions together with extensive use of seismic data before and during development drilling has resulted in high production rates and the need for only one centrally located platform to maximize the recoverable reserves from Piper oilfield (Maher, 1981). The Piper Alpha Oil Production Platform was built in the Highlands of Scotland for the Piper Field in the North Sea. It started production in 1978 and became one of the largest producers of oil in the North Sea. Later it was converted to produce and gather gas as well as oil. In 1988, Piper Alpha endured a gas leak with the subsequent fire and explosion reducing her to a wreck, ending up on the bottom of the North Sea (Scott, 2011).

Figure 3 - Piper Alpha Rig (Scott, 2011)

3.0 Timeline of Events

A detailed timeline of events that led up to the disaster has been well-documented by the Energy Library (The Energy Library, N.d.):

12:00 p.m. Two Condensate pumps on the platform, designated A...

On the morning of July 6, Pump A's pressure safety valve (PSV #504) was removed for routine maintenance. The pump's fortnightly overhaul was planned but had not started. The now open Condensate pipe was temporarily sealed with a flat metal disc. Because the work could not be completed by 6:00 P.M., the metal disc remained in place. The on-duty engineer filled out a permit which stated that Pump A was not ready and must not be switched on under any circumstances.
6:00 p.m. The day shift ends and the night shift starts with 62 men running Piper Alpha. As he found the on-duty custodian busy, the engineer neglects to inform him of the condition of Pump A. Instead he places the permit in the control centre and leaves. This permit disappeared and was not found. Coincidentally there was another permit issued for the general overhaul of Pump A that had not yet begun.

7:00 p.m. Like many other offshore platforms, Piper Alpha had an automatic fire-fighting system, driven by both diesel and electric pumps (the latter of which were disabled by the initial explosions). The diesel pumps were designed to suck in large amounts of sea water in order to extinguish any fires. These pumps had an automatic control which would start them in case of fire. However, the fire-fighting system was under manual control on the evening of July 6. Piper Alpha procedures required manual control of the pumps whenever divers were in the water (as they were approximately 12 hours per day during summer) regardless of their location, to prevent divers from being sucked in with the sea water. (Fire pumps on other platforms were switched to manual control only if the divers were close to the inlet.)

9:45 p.m. Condensate (LPG) Pump B. stops suddenly and cannot be restarted.

The entire power supply of the offshore construction work depended on this pump. The manager had only a few minutes to bring the pump back online, otherwise the power supply would fail completely. A search was made through the documents to determine whether Condensate (LPG) Pump A could be started.

9:52 p.m. The permit for the overhaul is found, but not the other permit stating that the pump must not be started under any circumstances due to the missing safety valve. The valve was in a different location from the pump and therefore the permits were stored in different boxes, as they were sorted by location. None of those present was aware that a vital part of the machine had been removed. The manager assumed from the existing documents that it would be safe to start compressor A. The missing valve was not noticed by anyone, particularly since the metal disc replacing the safety valve was located several metres above ground level and obscured by machinery.

9:55 p.m. Condensate (LPG) Pump A is switched on. Gas flowed into the pump, and due to the missing safety valve produced an overpressure which the loosely fitted metal disc did not withstand.

Gas audibly leaks out at high pressure, drawing the attention of several men and triggering 6 gas alarms including the high level gas alarm, but before anyone can act, the gas ignites and explodes, blowing through the firewall made up of 2.5 x 1.5 metre panels bolted together, which were not designed to withstand explosions. The custodian presses the emergency stop button; closing huge valves in the sea lines and ceasing all oil and gas production.

Theoretically, the platform would now have been isolated from the flow of oil and gas and the fire relatively contained. However, because the platform was originally built for oil, the firewalls were designed to resist fire rather than withstand explosions. The first explosion breaks up the firewall and dislodges panels around Module (B). One of the flying panels ruptures a small Condensate pipe, creating another fire.

10:04 p.m. The control room is abandoned. Piper Alpha's design made no allowances for the destruction of the control room and the platform's organisation disintegrates. No attempt was made to use loudspeakers or to order an evacuation.

Emergency procedures instructed personnel to make their way to lifeboat stations, but the fire prevented them from doing so. Instead the men moved to the fireproofed accommodation block beneath the helicopter deck to await further instructions. Wind, fire and smoke prevented helicopter landings and no further instructions were given with smoke beginning to penetrate the personnel block.

As the crisis mounted, two men donned protective gear in an attempt to reach the diesel pumping machinery below decks and activate the firefighting system. They are never seen again.

The fire would have burnt out were it not being fed new oil from both Tartan and the…