Piper Alpha Accident,

A Summary of the IChemE’s Perspective

Background:
The Piper oil field lies about 120 miles north-east of Aberdeen in Scotland. Discovered in January 1973, it
was one of the first deep water reservoirs to be exploited in the northern North Sea. Production of oil
started in December 1976, less than four years after discovery, a record that has only rarely been beaten.
Oil was exported through a sub-sea line, 128 miles long, to the purpose-built refinery on the island of
Flotta in the Orkneys.

Piper Alpha proved spectacularly productive and when the operator, Occidental, sought permission to
increase rates, permission was granted on condition that gas should also be exported instead of being
flared.

A gas treatment plant was retrofitted and gas export started in December 1978. After removal of water
and hydrogen sulphide in molecular sieves, gas was compressed and then cooled by expansion. The
heavier fractions of gas condensed as a liquid (essentially propane) and the rest of the gas (mainly
methane) continued to export. The condensate was collected in a large vessel connected to two parallel
condensate pumps (duty and standby) and injected into the oil for export to Flotta. Note that there were
two modes of operation:
 Phase 1 mode where excess gas was flared and
 Phase 2 mode where gas was exported.

Piper was operating in Phase 2 mode until three days before the disaster, when the molecular sieves
were taken out of service for routine maintenance. The gas and condensate treatment facilities were then
reconfigured so that Piper could operate in Phase 1 mode. Condensate was still removed from the gas
and injected into the oil export line but gas in excess of that required for fuelling the turbo-generators and
the gas lift system on Piper was flared.

The Accident:

1. At about 21.45 on 06 July 1988, condensate pump B tripped. Shortly afterwards, gas alarms
activated, the first-stage gas compressors tripped and the flare was observed to be much larger
than usual.

2. At about 22.00 an explosion ripped through Piper Alpha. Witnesses heard a sustained high-
pitched screeching noise followed by the flash and whoomph of an explosion.

3. The initial explosion in Module C (gas compressor module) caused a condensate line teeing into
the main oil line to rupture in Module B (oil separation module). Witnesses reported a second
flash and bang as a huge fireball roared into the night sky.
Piper Alpha Accident,
A Summary of the IChemE’s Perspective
4. Twenty minutes later, at about 22.20, a high-pressure gas line connected to the Tartan platform,
operated by Texaco, ruptured releasing gas at an initial rate of about 3 tonnes per second.

5. Fifty minutes later, at about 22.50, a Total-operated gas line ruptured, releasing gas flowing
though Piper Alpha from the Frigg field via MCP-01 to St Fergus. A fast rescue craft, launched
from standby vessel Sandhaven, was destroyed by the explosion, killing two of the three-man
crew and the six men they had just rescued from the sea.

6. Eighty minutes later, at about 23.20, the gas line to Claymore, another platform operated by
Occidental, ruptured.

7. By this time the structure of Piper Alpha was so badly weakened by the intense fires that the
topsides started to collapse. The main accommodation module, a four-storey building in which at
least 81 men were sheltering, slid into the sea. All those inside died.

8. By the early morning of 07 July 1988, three-quarters of the original topsides, together with
significant sections of the jacket, had been destroyed and lay in a tangled mass on the sea bed
140 metres below.

9. The fires from the wells and the oil and gas lines (all of which ruptured, one by one) had produced
flames with a height of about 200 metres and a peak rate of energy consumption of ~100
gigawatts, three times the rate of UK total energy consumption. It took over three weeks for the
fires to be extinguished. The remains of Piper Alpha were toppled into the sea on 28 March 1989.

10. Of the 226 people on board that night, only 61 survived. Of the deceased, 109 died from smoke
inhalation, 13 by drowning, 11 of injuries including burns. In 4 cases, the cause of death could not
be established, and 30 bodies were never recovered.
 Top / Horizontal view
Piper Alpha Accident,
A Summary of the IChemE’s Perspective

Findings:
 On the evening of 06 July 1988, condensate pump A was isolated for maintenance on its motor
drive coupling. Pump A pressure relief valve had also been removed for maintenance under a
separate permit and a blind flange almost certainly fitted in its place. The flange was not,
however, leak-tested or pressure-tested. When pump B tripped at about 21.45, the operators tried
unsuccessfully to restart it.

 The operators would have been aware that pump A was out of commission for maintenance – but
as maintenance had not yet started and the problem with pump A was not especially serious, it
would not have been unreasonable to consider restarting it.

 Because of the way in which work permits were organised on Piper Alpha, the operators would
not have known that the pressure relief valve for pump A was missing.

 The escaping condensate ignited. The first explosion was quickly followed by an oil pipe rupture
and fire. The sequential failure of the gas lines then caused a rapid escalation of the disaster.

Lessons Learned:
 Management of change (design issues);
Piper Alpha was designed to produce and export oil. The requirement to export gas — with the
associated separation of condensate — was an afterthought and involved extensive modification.
The retrofitting went on in several phases, starting with separation of condensate and ending with
production of export-quality gas.

The new facilities were located beside the control room, under the electrical power, radio room
and accommodation modules, so that when disaster struck, it did so with disastrous effect on the
rest of Piper Alpha. The control room was badly damaged in the first explosions (the control room
operator survived and gave valuable evidence to the Public Inquiry on the sequence of alarms
preceding those first explosions). The radio room was rendered useless; communications were
lost almost at once.

In many retrofitting projects, non-ideal design solutions are required. However, in the case of
Piper Alpha, the worst-case scenario on which the process safety design rested (fire) was not
revisited effectively when the platform was modified to treat gas with additional risk of explosion.

 Personal safety over process safety (fire water pumps on manual start to protect divers);
Despite the extensive fixed fire protection system on Piper Alpha, not a single drop of water was
applied from Piper Alpha itself to any of the fires. Water alone would not have put the oil fires out
(and with gas fires one should not even attempt to do so) but it might have cooled the structure
and pipelines and have prevented — or at least significantly delayed — the gas line rupture which
was the major escalating factor in the Piper Alpha disaster. After the rupture of the first gas line,
Piper Alpha was doomed.

So why didn’t the fire protection system activate as intended?

For many years, the practice on Piper Alpha was to switch the fire pumps from automatic to
manual when divers were in the sea. As diving was such a regular part of normal operation, in
practice the pumps remained on manual most of the time.

It is much easier to imagine the horror of a close colleague being sucked into a pipe (as had
happened a few years earlier although the diver survived) and prioritise it over the danger of
leaving 226 men unprotected in the highly unlikely event of fire.

The assessment of risk was skewed. The suction pipes under Piper Alpha were protected with
grilles to prevent divers from being sucked in, although anyone within 5 metres of the inlet could
Piper Alpha Accident,
A Summary of the IChemE’s Perspective
be drawn towards them when the fire pumps started with the risk of serious injuries. On other rigs
this was managed by close communication with divers and a temporary override used only when
the divers were working within a short distance of the inlets, a relatively rare occurrence.

When fire broke out on Piper Alpha, the only way to activate the fire-fighting system was to start
the pumps locally. Despite valiant attempts, dense smoke and fire prevented anyone from
reaching them.

 Permit to work and isolation for maintenance (pump re-started before maintenance complete);
The night shift operators were aware that condensate injection pump A was out of commission for
maintenance and also that maintenance had not yet started: the maintenance and associated
work permits had been suspended overnight.

The suspended work permits were not displayed in the control room but in the safety office. It
appears that the operators were not aware of another suspended permit. The pressure relief
valve for pump A had also been removed. Even if operators had gone to the safety office to
check, permits in the safety office were filed by trade and not by location.

The pressure relief valves for the condensate injection pumps were located one floor above the
pumps. Although it is almost always best practice for a pressure relief valve to be sited as close
as possible to the unit that it is protecting, condensate on the downstream side had to be able to
drain to an appropriate vessel, so the valve was placed about 8 metres above (and 15 metres
away from) the pump.

In order to reinstate condensate injection pump A, two separate actions would have been
required: reinstate electrical power and open the gas-operated suction and discharge valves. By
reconnecting the air supplies to the valves, they could then be opened using toggle buttons on a
local control panel by pump A. There was no locking of isolation valves, spading or double-block-
and-bleed in order to prevent re-pressurisation of a system isolated for maintenance.

The permit to work system on Piper Alpha relied heavily on informal communication. The
following questioned were asked during the investigation:
- Was the procedure adequate?
- Was the procedure complied with?
- Was there adequate training?
- Was the procedure monitored?
The answer to all four questions was no.

 Handover (inadequate transfer of information between crews, shifts and disciplines);

Incoming crews were supposed to be given safety induction training by the safety department.
There was a huge gap between what the safety department intended to convey, and what they
actually conveyed. Communication is a two-way thing. According to witnesses, if the newcomer
had worked offshore before, then training was brief to the point of non-existent. The safety
induction consisted of a being handed a booklet and told to read it.

Operators kept a log but often failed to record maintenance activities. Shift handover was a busy
time. The company procedure required maintenance and operations to meet, inspect the work
site and sign off permits together. However, the operators were busy with their own handovers at
the same time, and the practice developed where maintenance would sign off the permit and
leave it in the control room or safety office. At shift changeover lead production operators would
not review or discuss suspended permits.

 Interconnection
Communications between Piper Alpha, Claymore, Tartan and MCP-01 were lost from the first
explosions. This delayed shut-down on the other platforms, particularly on Claymore and Tartan.

The oil from Tartan to Claymore joined oil from Piper Alpha at a Y junction before flowing
onwards to Flotta. Oil continued to be produced and exported into the line to Flotta for about an
Piper Alpha Accident,
A Summary of the IChemE’s Perspective
hour after the first explosion on Piper Alpha. The emergency shutdown valve on the Piper Alpha
oil export line appears to have failed to close tightly, allowing the oil from Tartan and Claymore to
take the easier reverse route onto Piper Alpha. Shutdown of oil production only started on Tartan
at about 22.40 and on Claymore at about 23.00.

Oil exported from Tartan and Claymore flowed out of the ruptured oil line on Piper Alpha, flooded
the floor and overflowed to the floor beneath, starting a large pool fire which impinged directly on
the gas import and export lines, leading to their rupture – and hence to the inevitable escalation of
events on Piper Alpha.

 Emergency response – evacuation;

One of the most shocking aspects of the Piper Alpha tragedy was the inability to evacuate the
personnel on board. It was assumed that, whatever happened, evacuation would be (at least
substantially) by helicopter. This assumption, so easy to criticise with hindsight, was based on
several premises, the most important being that no event on Piper Alpha would render the
helideck inoperative almost immediately and that sufficient helicopters would be available to
evacuate everyone on board.

However, within about a minute of the first explosion, the helideck became enveloped in black
smoke (presumably from oil fires) and helicopters could not land on it.

The multi-function support vessel Tharos was close to Piper Alpha throughout the disaster.
Although not intended primarily as a fire-fighting vessel, Tharos had significant fire-fighting
capabilities. The lack of communication from Piper Alpha led to a delay in deployment, then the
demand for electrical power was so great that Tharos suffered an almost complete power failure,
from which it took several minutes to recover. There was a subsequent delay, because so many
monitors were opened that the water pressure fell to a level below that at which the discharge
valve on the fire pump could be opened. The safety systems on Tharos, good as they were, had
never been tested in such extreme conditions before. When it came to it, the systems failed that
test.

No lifeboats or inflatable life rafts were launched successfully from Piper Alpha. All those who
survived did so by making their way to the sea by whatever means they could. This included
climbing down knotted ropes and jumping, from as high as the helideck, over 50 metres above
sea level.

 Safety culture (complacency — everything’s fine).

Less than a year earlier, on 07 September 1987, a contract rigger was killed in an accident on
Piper Alpha. The accident highlighted the inadequacies of both the permit to work and the shift
handover procedures. A golden opportunity to put these right was missed.

- The primary responsibility for safety lies with those who create the risks and those who
work with them, in other words with the management and operators of an installation;
- Safety management systems should be developed by the management and operators of
the installation themselves, in order that they identify with the system and make it work;
- Critical safety procedures must be checked to see how they work in practice: auditing
must include what is actually done and not just what is meant to be done or said to be
done.