Work a Investigation Project Piper Alpha Disaster Content

Piper Alpha Disaster

An Environmental and Safety Management Analysis of the Disaster that Occurred on the Piper Alpha Oil Rig off the Coast of Scotland

Piper Alpha (Seconds from Disaster, 2013)

The Incident

The Piper before the Explosion

Timeline of Events

Piper Alpha Mechanism

Root Causes of the Analysis

Human Factors

Design and Process Factor

Financial Consequences

Permit to Work System

Safety Training

Fire Walls

Temporary Refuge

Evacuation and Escape

The Incident

Piper Alpha was a North Sea oil production platform operated by Occidental Petroleum (Caledonia) Ltd. The platform began the oil production in 1976 and then later converted to gas production as the hub of multiple networked rigs. The piper alpha platform was operated in multiple shifts by the employees who worked the whole platform to continue supply the oil and gas on a perpetual basis. The operations of the Piper Alpha platform included receiving the oil and gases from the other platform nearby and processing these so they could be further refined

On 6 July 1988, there was a massive leakage of gas condensate on Piper Alpha, which was ignited causing an explosion and large oil fires. The heat from the fires ruptured the riser of a gas pipeline from another installation. The rupture resulted in further explosions which engulfed the entire Piper Alpha platform. The entire series of events occurred in just 22 minutes and the devastation caused by the disaster was the worst of its kind at the time of the tragedy. The disaster resulted in 167 deaths while 62 people were able to survive by jumping from the platform. In the end, the financial impacts were estimated at 3.4 billion which were offered through insurance claims. This analysis will provide an overview of the conditions that led to the disaster as well as some of the lessons that were learned as a result of the investigation into causality.

2.0 The Piper before the Explosion

The Piper Oilfield lies in the UK Block, 125 miles northeast of Aberdeen, Scotland. The field is situated on a shelf south of the East Shetland platform, and near the eastern end of the Moray Firth Basin. The field was discovered in January 1973 from a seismicly mapped structure and confirmed as a major oilfield during the year with five appraisal wells and one exploratory well. A steel platform with 36 well slots and space for two drilling rigs was centrally located over the field in 474 ft. Of water in June, 1975, and made ready for production drilling by October 10, 1976. The original productive area of the field was 7350 acres with a maximum oil column of 1210 ft, containing approximately 1400 million barrels of stock tank original oil in place (MMBBL STOIIP) (Geological Society, 1991).

Figure 2 - Piper Oil Field Location (Taylor, N.d.)

Reservoir sandstones are Oxfordian and early Kimmeridgian in age, of marine origin, and unconformably overlie a nonmarine Middle Jurassic sedimentary sequence. The gross-reservoir thickness averages 250 ft (76 m) in the field area and is comprised of several individual sandstone bodies 40-70 ft (12-21 m) thick. Within individual sandstone bodies the grain size grades either upward or downward from very fine sandstone or siltstone to coarse-grained sandstone. The sandstones generally are well sorted, highly bioturbated, friable, and have excellent porosity and permeability. Individual sandstone bodies record local regressions or transgressions. Regressive sands, accreting seaward as foreset beds, were generally thicker than transgressive sands (Williams, et al., 1975).

A combination of favourable geological and engineering conditions together with extensive use of seismic data before and during development drilling has resulted in high production rates and the need for only one centrally located platform to maximize the recoverable reserves from Piper oilfield (Maher, 1981). The Piper Alpha Oil Production Platform was built in the Highlands of Scotland for the Piper Field in the North Sea. It started production in 1978 and became one of the largest producers of oil in the North Sea. Later it was converted to produce and gather gas as well as oil. In 1988, Piper Alpha endured a gas leak with the subsequent fire and explosion reducing her to a wreck, ending up on the bottom of the North Sea (Scott, 2011).

Figure 3 - Piper Alpha Rig (Scott, 2011)

3.0 Timeline of Events

A detailed timeline of events that led up to the disaster has been well-documented by the Energy Library (The Energy Library, N.d.):

12:00 p.m. Two Condensate pumps on the platform, designated A and B, compressed the gas for transport to the coast. On the morning of July 6, Pump A's pressure safety valve (PSV #504) was removed for routine maintenance. The pump's fortnightly overhaul was planned but had not started. The now open Condensate pipe was temporarily sealed with a flat metal disc. Because the work could not be completed by 6:00 P.M., the metal disc remained in place. The on-duty engineer filled out a permit which stated that Pump A was not ready and must not be switched on under any circumstances.

6:00 p.m. The day shift ends and the night shift starts with 62 men running Piper Alpha. As he found the on-duty custodian busy, the engineer neglects to inform him of the condition of Pump A. Instead he places the permit in the control centre and leaves. This permit disappeared and was not found. Coincidentally there was another permit issued for the general overhaul of Pump A that had not yet begun.

7:00 p.m. Like many other offshore platforms, Piper Alpha had an automatic fire-fighting system, driven by both diesel and electric pumps (the latter of which were disabled by the initial explosions). The diesel pumps were designed to suck in large amounts of sea water in order to extinguish any fires. These pumps had an automatic control which would start them in case of fire. However, the fire-fighting system was under manual control on the evening of July 6. Piper Alpha procedures required manual control of the pumps whenever divers were in the water (as they were approximately 12 hours per day during summer) regardless of their location, to prevent divers from being sucked in with the sea water. (Fire pumps on other platforms were switched to manual control only if the divers were close to the inlet.)

9:45 p.m. Condensate (LPG) Pump B. stops suddenly and cannot be restarted.

The entire power supply of the offshore construction work depended on this pump. The manager had only a few minutes to bring the pump back online, otherwise the power supply would fail completely. A search was made through the documents to determine whether Condensate (LPG) Pump A could be started.

9:52 p.m. The permit for the overhaul is found, but not the other permit stating that the pump must not be started under any circumstances due to the missing safety valve. The valve was in a different location from the pump and therefore the permits were stored in different boxes, as they were sorted by location. None of those present was aware that a vital part of the machine had been removed. The manager assumed from the existing documents that it would be safe to start compressor A. The missing valve was not noticed by anyone, particularly since the metal disc replacing the safety valve was located several metres above ground level and obscured by machinery.

9:55 p.m. Condensate (LPG) Pump A is switched on. Gas flowed into the pump, and due to the missing safety valve produced an overpressure which the loosely fitted metal disc did not withstand.

Gas audibly leaks out at high pressure, drawing the attention of several men and triggering 6 gas alarms including the high level gas alarm, but before anyone can act, the gas ignites and explodes, blowing through the firewall made up of 2.5 x 1.5 metre panels bolted together, which were not designed to withstand explosions. The custodian presses the emergency stop button; closing huge valves in the sea lines and ceasing all oil and gas production.

Theoretically, the platform would now have been isolated from the flow of oil and gas and the fire relatively contained. However, because the platform was originally built for oil, the firewalls were designed to resist fire rather than withstand explosions. The first explosion breaks up the firewall and dislodges panels around Module (B). One of the flying panels ruptures a small Condensate pipe, creating another fire.

10:04 p.m. The control room is abandoned. Piper Alpha's design made no allowances for the destruction of the control room and the platform's organisation disintegrates. No attempt was made to use loudspeakers or to order an evacuation.

Emergency procedures instructed personnel to make their way to lifeboat stations, but the fire prevented them from doing so. Instead the men moved to the fireproofed accommodation block beneath the helicopter deck to await further instructions. Wind, fire and smoke prevented helicopter landings and no further instructions were given with smoke beginning to penetrate the personnel block.

As the crisis mounted, two men donned protective gear in an attempt to reach the diesel pumping machinery below decks and activate the firefighting system. They are never seen again.

The fire would have burnt out were it not being fed new oil from both Tartan and the Claymore platforms, the resulting backpressure forcing fresh fuel out of ruptured pipework on Piper, directly into the heart of the fire. The Claymore continued pumping until the second explosion, because the manager had no permission from the Occidental control centre to shut down. Also the connecting pipeline to Tartan continued to pump, as its manager had received this directive from his superior. The reason for this procedure was the exorbitant cost of such a shut down. It takes several days to restart production after a stop, with substantial financial consequences.

Gas lines of 140 to 146 cm in diameter ran close to Piper Alpha. Two years earlier Occidental management ordered a study, which warned of the dangers of these gas lines. Due to their length and diameter it would take several hours to reduce their pressure, so that it would not be possible to fight a fire fueled by them. Although the management admitted how devastating a gas explosion would be, Claymore and Tartan were not switched off with the first emergency call.

10:20 p.m. Tartan's gas line (pressured to 120 Atmospheres) melts and bursts. From this moment on, the platform's destruction is assured. 15-30 tonnes of gas are released instantaneously and immediately ignite. A massive fireball of 150 metres in diameter engulfs Piper Alpha.

10:30 p.m. The Tharos, a large fire fighting and rescue platform, draws alongside Piper Alpha. Attempts are made to extend its rescue walkway the 30 metres to the deck. A woeful design flaw in Tharos becomes apparent as the walkway extends too slowly to be able to reach the platform before 22:50.

10:50 p.m. The second gas line ruptures, spilling millions of litres of gas into the conflagration. Huge flames shoot over three hundred feet in the air. The Tharos is driven off due to the fearsome heat, which begins to melt the surrounding machinery and steelwork. It was after this second explosion that the Claymore stopped pumping oil. Personnel still left alive are either desperately sheltering in the scorched, smoke-filled accommodation block or leaping from the deck some 200 ft (61 m) into the cold, rough North Sea.

11:20 p.m. The pipeline connecting Piper Alpha to the Claymore Platform bursts and the disaster claims its final victims.

11:50 p.m. The generation and utilities Module (D), which includes the fireproofed accommodation block, slips into the sea. The largest part of the platform follows it.

12:45 a.m., July 7 The entire platform has gone. Module (A) is all that remains of Piper Alpha.

4.0 Piper Alpha Mechanism

Piper Alpha started its operation as a pure oil production platform in the North Sea approximately 170 miles northeast of Aberdeen, Scotland and comprised four modules separated by firewalls. McDermott Engineering at Ardersier and UIE at Cherbourg constructed the Piper Alpha platform in different sections and the two parts were amalgamated at Ardersier before the platform was towed to its location in 474 feet of water in 1975 (Parthenon Consultancy LTD, N.d.).

Figure 4 - Simplified Layout (Pate-Cornell, 1993)

Figure 5 - East View (Pate-Cornell, 1993)

For safety reasons, the engineers had designed the Piper Alpha modules so that they were organized in way that kept the most dangerous operations distant from nearby platform. However, a few years later, when the platform being converted from pure oil production to oil and gas production, it had to alter this design. The Tartan and Claymore platforms were installed in the Piper Field nearby to the Piper Alpha platform. These two newly installed platforms also producing crude oil and gas and their export oil lines joining Piper Alpha's oil export line to the Flotta terminal. Piper Alpha then became a hub, processing its own gas, collecting gas from the Tartan, and pumping this gas onto the MCP-01 Platform. A gas pipeline was also installed linking Piper with Claymore, receiving and supplying gas to Claymore as required for gas-lift purposes (Scott, 2011). At the time of the disaster Piper Alpha was one of the heaviest platforms operating in the North Sea.

Figure 6 - Piper Processing Network (Scott, 2011)

5.0 Root Causes of the Analysis

In November, later in the same year, the Department of Energy from the United Kingdom, who was responsible for the operation and safety of offshore oil and gas installation, appointed Lord Cullen, a very experienced Scottish Jurist, to conduct a Public Inquiry in to the cause of the Piper Alpha disaster. Beginning in January 1989, the inquiry -- chaired by Lord Cullen -- lasted 13 months and heard evidence from more than 150 witnesses; by the time his report was published in 1990, nobody was in any doubt that Piper Alpha and Cullen's inquiry would signal a sea change in safety offshore (Allen, 2008). There are two main factors that are attributed to the Piper Alpha disaster were Human Factors and Design and Process Factors. The causes of the Piper Alpha disaster based on the Lord Cullen Inquiry are as follows

5.1 Human Factors

After the investigation was completed it was discovered that the pump had been turned off and was a failure of 'permit-to-work' system that did not ensure proper communication which was a critical factors that lead to the disaster (Centre of Risk, N.d.). Permit to Work (PTW) is a document that notes the identity and location of the component that the work is to be carried out. In any offshore platform installations the PTW must be raised before any work can be carried out. On the morning of the 6th of July, a backup propane condensate pump in the processing area needed to have its pressure safety valve checked. The work could not be completed by 18.00 and the workers asked for and received permission to leave the rest of the work until the next day and then the tube was sealed with a plate. Later in the evening during the next work shift, the primary condensate pump failed. None of those present were aware that a vital part of the machine had been removed and decided to start the backup pump. Gas products escaped from the hole left by the valve and then gas audibly leaked out at high pressure, ignited and exploded, blowing through the firewalls (Centre of Risk, N.d.).

5.2 Design and Process Factor

McDermott Engineering at Ardersier and UIE at Cherbourg had originally constructed the Piper Alpha platform. When these companies designed the rig they had made sure the Piper Alpha modules were organized so that the most dangerous operations were distant from nearby platforms. This provided a level of safety by separating the most dangerous operations. However, after the Piper Alpha platform being converted from pure oil production to oil and gas production, these safety design features were disregarded. Using the Piper Alpha as a hub by converting its features violated the safety concept that had been introduced in the initial design and the construction of Piper Alpha.

When the explosion occurred, the Tartan platform and Claymore platforms continued to supply the Piper Alpha platform with oil and gas. Furthermore, the supply continued despite the fact that the fire from the Piper Alpha platform was visible from the Tartan and Claymore platforms. Although the explosion was caused by the escape of gas from the PSV of Piper Alpha platform, the major failure and rupture of the gas risers were responsible for Piper Alpha's destruction which also prevented the Piper Alpha workers from evacuating.

Although the Piper Alpha platform did have a series of fire walls, the fire walls were upgraded to blast walls when this technology became available. Therefore, the fire walls in the platform that were present were immediately disintegrated during the gas explosion. This allowed the fire to spread to the oil and gas pipe lines and machinery which consequently added to the fire. Furthermore the Piper Alpha worker accommodations were not smoke-proofed and the employees repeatedly opened and closed the doors which also facilitated the spread of the fire.

The rapid spread of the fire on the platform made many workers realize that the only way to survive the situation was to escape from the Piper Alpha platform by jumping. Yet many of the workers did not get the opportunity to escape from the platform since the routes to life boats were blocked by the flames and smoke. Sixty-one men survived by jumping from the platform yet the other 167 men died because they could not escape. Their deaths were primarily caused from suffocation of the carbon monoxide fumes in the accommodations area on the Piper Alpha platform but many died from direct exposure to the fire or from explosions as well.

5.3 Financial Consequences

The Cullen enquiry concluded that the initial condensate leak was the result of maintenance work being carried out simultaneously on a pump and related Safety valve. The enquiry was critical of Piper Alpha's operator, Occidental, which was found guilty of having inadequate maintenance and safety procedures. But no criminal charges were ever brought against it (Centre of Risk, N.d.). The costs of the damage were exorbitant. At the time it was the largest man-made disaster that ever occurred with insurance claims exceeding 1.4 billion.

Figure 7 - Financial Impacts of the Disaster

6.0 Recommendations

Based on the Lord Cullen inquiry on the Piper Alpha disaster, there were many realizations that were made for the improvement of future operations. Lord Cullen made many recommendations on improvements in his report in order to prevent future disasters on any future offshore installations. The second phase of the enquiry made 106 recommendations for changes to North Sea safety procedures, all of which were accepted by industry. Most significant of these recommendations was that the responsibility for enforcing safety in the North Sea should be moved from the Department of Energy to the Health and Safety Executive as having both production and safety overseen by the same agency was a conflict of interest (Centre of Risk, N.d.). Some of the improvements and prevention strategies that emerged as a result of studying the disaster will be outlined in the following sections.

6.1 Permit to Work System

The Permit to Work System was a system of documents that had been designed to provide effective and efficient communications between the staff on the Piper Alpha. This system allowed the workers on the platform to coordinate any maintenance work or repairs that were to be performed on the platform. However, based on the information that was provided in the Lord Cullen Inquiry, the permit to work system on the Piper Alpha platform became relaxed and many employees did not check the logs regularly. There were also no formal communication procedures that resulted in the confirmation of information that was provided when the workers shifts changed. It is reasonable to speculate that if the Permit to Work system had been used properly then the initial gas leak that created the chain reaction would never have occurred. Offshore rigs are now mandated to follow a formal permit to work system that ensures proper communications are maintained between crews.