Vintage: What caused the giant Piper Alpha oil rig explosion?
At 14 000 tons and 2,5 times the height of the Statue of Liberty, the Piper Alpha oil rig was one of the largest in the world. But on 6 July 1988, the entire structure became consumed by a devastating and deadly fire. Late in the evening, a series of explosions ripped through the Piper Alpha platform in the North Sea. Engulfed in fire, over the next few hours most of the oil rig topside modules collapsed into the sea. 167 men died and many more were injured and traumatised. The world’s biggest offshore oil disaster affected 10 percent of UK oil production and led to financial losses of an estimated £2 billion (the equivalent of US$5 billion today).
What went wrong on Piper Alpha? Why did it have such disastrous consequences? And what lessons can still be learned today?
The Piper oil field lies about 120 miles north-east of Aberdeen in Scotland. Discovered in January 1973, it was one of the first deep water reservoirs to be exploited in the northern North Sea. Production of oil started in December 1976, less than four years after discovery, a record that has only rarely been beaten. Oil was exported through a sub-sea line, 128 miles long, to the purpose-built refinery on the island of Flotta in the Orkneys.
Piper Alpha proved spectacularly productive and when the operator, Occidental, sought permission to increase rates, permission was granted on condition that gas should also be exported instead of being flared.
A gas treatment plant was retrofitted and gas export started in December 1978. After removal of water and hydrogen sulphide in molecular sieves, gas was compressed and then cooled by expansion. The heavier fractions of gas condensed as a liquid (essentially propane) and the rest of the gas (mainly methane) continued to export. The condensate was collected in a large vessel connected to two parallel condensate pumps (duty and standby) and injected into the oil for export to Flotta. Note that there were two modes of operation. Phase 1 mode where excess gas was flared and Phase 2 mode where gas was exported. Piper was operating in Phase 2 mode until three days before the disaster, when the molecular sieves were taken out of service for routine maintenance. The gas and condensate treatment facilities were then reconfigured so that Piper could operate in Phase 1 mode. Condensate was still removed from the gas and injected into the oil export line but gas in excess of that required for fuelling the turbo-generators and the gas lift system on Piper was flared.
At about 21h45 on 06 July 1988, condensate pump B tripped. Shortly afterwards, gas alarms activated, the first-stage gas compressors tripped and the flare was observed to be much larger than usual. At about 22h00 an explosion ripped through Piper Alpha.
Witnesses heard a sustained high-pitched screeching noise followed by the flash and whoomph of an explosion.
The men in the control room were knocked off their feet and thrown to floor. Most men were off duty in the accommodation block; they were lifted from chairs or thrown from their beds.
The initial explosion in Module C (gas compressor module) caused a condensate line teeing into the main oil line to rupture in Module B (oil separation module). Witnesses reported a second flash and bang as a huge fireball roared into the night sky.
Twenty minutes later, at about 22h20, a high-pressure gas line connected to the Tartan platform, operated by Texaco, ruptured releasing gas at an initial rate of about three tons per second.
Fifty minutes later, at about 22h50, a Total-operated gas line ruptured, releasing gas flowing though Piper Alpha from the Frigg field via MCP-01 to St Fergus. A fast rescue craft, launched from standby vessel Sandhaven, was destroyed by the explosion, killing two of the three-man crew and the six men they had just rescued from the sea.
Eighty minutes later, at about 23h20, the gas line to Claymore, another platform operated by Occidental, ruptured.
By this time the structure of Piper Alpha was so badly weakened by the intense fires that the topsides started to collapse. The main accommodation module, a four-storey building in which at least 81 men were sheltering, slid into the sea. All those inside died.
By the early morning of 7 July 1988, three-quarters of the original topsides, together with significant sections of the jacket, had been destroyed and lay in a tangled mass on the sea bed 140 metres below.
The fires from the wells and the oil and gas lines (all of which ruptured, one by one) had produced flames with a height of about 200 metres and a peak rate of energy consumption of ~100 gigawatts, three times the rate of UK total energy consumption.
It took over three weeks for the fires to be extinguished. The remains of Piper Alpha were toppled into the sea on 28 March 1989.
Of the 226 people on board that night, only 61 survived. Of the deceased, 109 died from smoke inhalation, 13 by drowning, 11 of injuries including burns. In four cases, the cause of death could not be established, and 30 bodies were never recovered.
Investigation and analysis
One week after the disaster, Lord Cullen was appointed to hold a Public Inquiry into the accident. The Public Inquiry sat for a total of 180 days. Lord Cullen’s report1 was published on 13 November 1990. The inquiry heard evidence from a large number of witnesses, including most of the survivors, and from several experts.
It wasn’t easy to establish the cause of the disaster. Little physical evidence remained and no senior member of Piper Alpha’s management team survived.
Many possible causes were advanced. Few could be conclusively discounted but many were extremely improbable, requiring several successive unlikely events to have occurred, for which there was no evidence at all.
The inquiry concluded that the most likely cause of the first explosion was the release of as little as 30kg of condensate (mainly propane) over thirty seconds though an unsecured blind flange in Module C where a pressure safety relief valve had been removed as part of maintenance on the standby condensate pump.
On the evening of 6 July 1988, condensate pump A was isolated for maintenance on its motor drive coupling. Pump A pressure relief valve had also been removed for maintenance under a separate permit and a blind flange almost certainly fitted in its place. The flange was not, however, leak-tested or pressure-tested. When pump B tripped at about 21h45, the operators tried unsuccessfully to restart it.
The operators would have been aware that pump A was out of commission for maintenance but as maintenance had not yet started and the problem with pump A was not especially serious, it would not have been unreasonable to consider restarting it.
Because of the way in which work permits were organised on Piper Alpha, the operators would not have known that the pressure relief valve for pump A was missing.
It is believed that the operators took steps to reinstate pump A and condensate leaked from the blind flange which had been installed in place of the pressure relief valve, but not fully tightened up.
The escaping condensate ignited. The first explosion was quickly followed by an oil pipe rupture and fire. The sequential failure of the gas lines then caused a rapid escalation of the disaster.
Emergency response and evacuation
One of the most shocking aspects of the Piper Alpha tragedy was the inability to evacuate the personnel on board. It was assumed that, whatever happened, evacuation would be (at least substantially) by helicopter. This assumption, so easy to criticise with hindsight, was based on several premises, the most important being that no event on Piper Alpha would render the helideck inoperative almost immediately and that sufficient helicopters would be available to evacuate everyone on board.
However, within about a minute of the first explosion, the helideck became enveloped in black smoke (presumably from oil fires) and helicopters could not land on it.
The multi-function support vessel Tharos was close to Piper Alpha throughout the disaster. Although not intended primarily as a fire fighting vessel, Tharos had significant fire fighting capabilities. The lack of communication from Piper Alpha led to a delay in deployment, then the demand for electrical power was so great that Tharos suffered an almost complete power failure, from which it took several minutes to recover. There was a subsequent delay, because so many monitors were opened that the water pressure fell to a level below that at which the discharge valve on the fire pump could be opened. The safety systems on Tharos, good as they were, had never been tested in such extreme conditions before. When it came to it, the systems failed that test.
No lifeboats or inflatable life rafts were launched successfully from Piper Alpha. All those who survived did so by making their way to the sea by whatever means they could. This included climbing down knotted ropes and jumping, from as high as the helideck, over 50 metres above sea level.
Many lessons can be drawn from the tragic events on Piper Alpha; this paper focusses on seven key areas.
1. Management of change (design issues);
2. Personal safety over process safety (fire water pumps on manual start to protect divers);
3. Permit to work and isolation for maintenance (pump re-started before maintenance complete);
4. Handover (inadequate transfer of information between crews, shifts and disciplines);
5. Interconnection (no rig is an island…);
6. Emergency response – evacuation;
7. Safety culture (complacency — everything’s fine).
Despite the extensive fixed fire protection system on Piper Alpha, not a single drop of water was applied from Piper Alpha itself to any of the fires. Water alone would not have put the oil fires out (and with gas fires one should not even attempt to do so) but it might have cooled the structure and pipelines and have prevented, or at least significantly delayed, the gas line rupture which was the major escalating factor in the Piper Alpha disaster. After the rupture of the first gas line, Piper Alpha was doomed.
So why didn’t the fire protection system activate as intended?
For many years, the practice on Piper Alpha was to switch the fire pumps from automatic to manual when divers were in the sea. As diving was such a regular part of normal operation, in practice the pumps remained on manual most of the time.
It is much easier to imagine the horror of a close colleague being sucked into a pipe (as had happened a few years earlier although the diver survived) and prioritise it over the danger of leaving 226 men unprotected in the highly unlikely event of fire.
The assessment of risk was skewed. The suction pipes under Piper Alpha were protected with grilles to prevent divers from being sucked in, although anyone within five metres of the inlet could be drawn towards them when the fire pumps started with the risk of serious injuries. On other rigs this was managed by close communication with divers and a temporary override used only when the divers were working within a short distance of the inlets, a relatively rare occurrence.
When fire broke out on Piper Alpha, the only way to activate the fire fighting system was to start the pumps locally. Despite valiant attempts, dense smoke and fire prevented anyone from reaching them.
It is not known whether the initial explosion on Piper ruptured the fire water ring main or damaged the control system for the fire pumps. It is likely that electrical power was knocked out, but there was a diesel back-up. It is not known how effective the deluge would have been had it deployed as the nozzles often blocked with scale and the fire-water pipework on Piper Alpha was undergoing phased replacement.
After any accident, there is a very human need to find out exactly what went wrong, to attribute clear causes for any accident, to implement specific recommendations to fix them and move on. It could be argued it was a good thing that the Cullen Inquiry left open the exact cause of the disaster. Those with excellent permit to work systems might have felt complacent and failed to learn the many other lessons that Cullen gives in his truly outstanding report.
The subset of lessons described here illustrate the widespread system failures that led to the Piper Alpha tragedy. It is clear that there were serious design flaws, but even perfectly engineered ‘hardware’ can always be operated incorrectly. While technical measures are essential for safety, they are in no sense sufficient. Safety also requires an appropriate management structure and that structure must be maintained throughout the whole life of a project from design, through change to decommissioning.
Source: The Chemical Engineer