Incidents: Piper Alpha

Piper Alpha was a hub or collection platform - not only did it receive oil and gas from its own risers, two other platforms - Claymore and Tartan 'A' - fed gas to it. Piper Alpha then exported the combined gas streams to MCP-01. (It also used some of the gas for its own generators and as lift gas.) Its oil was pumped to the Flotta Terminal.

The Event

The sequence of events leading up to the explosion and fire is complex; it is described in detail in Appendix 19 of Lees' Loss Prevention in the Process Industries. An overview of the event is provided below. The platform had two hydrocarbon condensate pumps: 'A' and 'B'. The 'A' pump was down in order that three maintenance tasks could be carried out on it. One of these tasks was to test and calibrate the pump's relief valve. This meant that the relief valve had been removed and two blind flanges put on the pump casing. The flanges were not bolted down tightly. The pump's gas operated suction and discharge block valves had been closed, but the pump was not blinded off. During the course of the day the maintenance activities were changed, and one of the jobs was closed out. At shift change information as to the status of the open work orders was not communicated properly.

At 9:50 p.m. the 'B' pump tripped out and could not be restarted. If neither of the two condensate pumps could be started within 30 minutes then the platform would have to be shut down - an expensive decision, so the decision was made to de-isolate pump 'A' and to bring it into service. However, the maintenance work on it had not been completed, nor had the permits to work been properly closed out. In particular, the relief valve blind flanges had not been tightened up.

Shortly after the 'A' pump was started condensate leaked from the loose flanges and an explosion occurred. It caused extensive damage and was followed by an oil pool fire and a blowdown of gas inventories to flare. The oil fire created a massive smoke plume that made the escape routes from the living quarters (where most of the personnel were located) impassable.

About twenty minutes after the initial explosion the Tartan gas riser failed and a second massive explosion occurred, followed by an escalation of the fire. Fifty minutes later the riser from MCP-01 also failed, resulting in a third explosion. A continued series of explosions and fires led to the destruction of the platform.

The inventory of oil and gas such as Piper Alpha is quite low. Therefore, even though the initial explosion and fire were large they should not have resulted in the total loss of the platform. There are two important reasons for the severe escalation of the event.

First, the Tartan and Claymore platforms continued to feed oil and gas to Piper, in spite of the fact that they could see that Piper was on fire. They did not stop the oil and gas flow because the communications systems had been destroyed in the explosion and “no one told them to stop”. They lacked the initiative to take unilateral action. Had they done so, it is virtually certain that this section of this book would need to have been written.

The second reason for the severe escalation of the event was that the condensate pumps were not protected by a blast wall. Piper had originally been built in 1976 as an oil platform. It was later converted to handle gas also. The original structure had only fire walls. With the addition of gas and condensate systems these should have been replaced with blast walls, but they were not. Hence the initial explosion was not contained. Moreover, since the mangers on the platform were killed in the initial blast there was never an effective emergency evacuation of those still on board.

Escape options were severely restricted. The helideck was unusable, and many of the escape routes to the lifeboats could not be used.

Long-term Consequences

Just as the Santa Barbara blowout led to profound changes in environmental regulations in the United States, so Piper Alpha provided the impetus for many structural changes in the way in which safety was managed offshore.

The circumstances and causes of the disaster were examined in great detail by an inquiry led by Lord Cullen, a Scottish High Court judge. The report, The Public Inquiry into the Piper Alpha Disaster (Cullen 1990), which was highly critical of many of the design and operating practices that were in use at that time. The report led to a much stronger emphasis on the use of safety cases in the U.K. sector of the North Sea. Indeed, although safety cases had been prepared for North Sea offshore facilities prior to the Piper Alpha event, it is reasonable to state that it was the Cullen report that jump started the use of safety cases in offshore waters. More broadly, the Cullen Report became a major contributor to the development of process safety management systems - both onshore and offshore.

Risk Management Lessons

Conversion of the Platform

The platform had originally been designed to handle primarily gas, and was later converted to handle oil and gas.

Decision to Stop Work

Lockout / Tagout System

Workers probably relied too much on informal communications at critical times, such as shift turnover.

Adherence to Permit-to-Work System

Evacuation and Escape