PIPER ALPHA

Equipment Design Failure

Event Sequence

The diesel and electric saltwater pumps were switched from automatic to manual control as it was found they may prove hazardous if they were activated whilst platform divers were in the water. These pumps fed the platforms on-board fire-fighting system from the ocean

System parts

System life cycle

People

Workplaces

Nightshift staff were unable to restart the primary condensate pump after it tripped out. The spare condensate pump was re-commissioned to restart operations when it was under maintenance

Spare condensate pump/valves were removed for a large overhaul and was additional work to what was initially scheduled for maintenance

Piper Alpha Platform

Staff

Diesel Module

Additional Accommodation West

Quarters West

Deck Support Frame

Condensate Pump A

Condensate Pump B

A Module (Wellheads)

B Module (Oil Separation)

C Module (Gas Compression)

D Module (Electrical & Facilities)

Helideck

SPEE Module

Sub Module D

Pods Module

Storage Module

Mud Module

Drilling Rig

SW Flare Boom

SE Flare Boom

Pipeline terminations

Pig Traps

Cranes

East

West

Control Room

Construction

De-commissioning

Maintenance

Commissioning

Operation

Concept Detailed Design

Servicing

Drilling line maintenance

Wire rope maintenance

Mud circulating system

Generator, electrical systems and electric motors

Engines

Rig floor

Rotary

Inspections

Adjustments & amendements

Catheads

Tongs

Wire rope

Drawworks

Air hoists

Hoses

Hose connections

Pop-off values

Shale shakers

Belts

Guards

Mud pumps

Replacement parts

Derrick equipment maintenance

Travelling block

Swivel packing replacement

Crown block

Swivel

Platform removal

Explosive and mechanical techniques sever jacket below seafloor

Ultimate placement of material in landfill or limited recycling

Break-up of large pieces of metal and concrete to demolish installations

Impact on fishes and invertebrates beneath platform

Seafloor returned to its unobstructed pre-lease condition

Conversion of decommissioned gas and oil platforms can be turned into particular reefs. In the Gulf of Mexico, as much as 11% of platforms have been converted into reef (Bull & Love 2019)

Testing

Platform installation

Hell deck

Top deck

Quarters

Power generation

Drilling rig

Crane

Flare boom

Production equipment

Management

Organisational factors

Job design

Information transfer

Team factors

Individual factors

Workplace factors

Equipment design

Work environment

Piper Alpha was an oil platform located approximately 120 miles north-east of Aberdeen, Scotland in the North Sea. The platform later added gas and condensate production. A series of explosions broke out before the platform was engulfed in fire killing 167 people on the 6-7 July 1988

Due to work policies, the contractors working on the large overhaul paused the job at 6pm to complete the next morning which made the pump maintenance incomplete

Due to workload, the contractors were unable to speak to the operations manager directly to explain the work was incomplete and the permit-to-work system (on additional works) so they left it on the manger's desk

Operations manager was unaware that the contractors did additional works on the spare pumps/valves that was not completed

Condensate began to leak at the point where relief valve had been removed from maintenance works

Gas alarms in the control room started to sound to warn leaking gas in low lying areas that indicated propane

Leaking condensate ignited causing an explosion in the gas compression module. Various firewalls and communication equipment was destroyed

Communication equipment was destroyed in explosion

A gas pipe carrying compressed gas from the other two platforms burst causing explosion and gas fire

Oil fire was ignited causing toxic black smoke

The pipeline that connects Piper Alpha and the claymore platform bursts

Module (D), including the fireproofed accommodation block, slips into the sea

Handover of information was inadequate between shifts, crew and disciplines

No communication between the contractors and management to discuss the unfinished work & removal of the spare condensate pump/valves

Organisational Systems/Management and Regulations

Operational conversion (oil to gas)

Extensive modifications required due to afterthought to introduce export of gas

The new facility was located right beside accommodation modules, radio room, under the electrical power and beside the control room which caused a disastrous situation

Operational Routine

To activate the fire-fighting system, the pumps had to be started locally

Organisational Safety Procedures

When the fire broke out, the pumps had to be started locally to activate the fire-fighting

The suspended work permits were not displayed in the control room but in the safety office

Permits in the safety office were filed by trade and not by location

The gas and condensate operational elements were not included in the design plans therefore it could only manage the safety of the gas production

The permit to work system relied heavily on informal communication

While bespoke communications can have some benefits, minimum standards were not set or met.

Training

If a newcomer had worked offshore before, then training was brief to the point of non-existent

Training

Incoming crews were supposed to be given safety induction training by the safety department

Safety culture

The safety induction was too simplistic. Staff were handed booklet and told to read it, much of the information was out of date or inapplicable to Piper Alpha

Organisational systems

Shift changeovers

At shift changeover lead production operators would not review or discuss suspended permits

Operators were busy with their own handovers at the shift change on the day

The explosions caused a loss of command, control and electrical power among the platform, leaving the system essentially decapitated

Financial pressures

Rigs were all interconnected and not individual

Contract rigger killed in an accident a few years prior

Prior warnings regarding issues with the organisations low quality safety management systems long before the accident

Safety culture complacency and everything is fine attitude

Personal safety over process safety eg. fire water pumps on manual start to protect divers

Managers on board the platform had minimal training
which resulted in poor practices and ineffective audits

Policies and procedures

Impairment of performance and inability to complete maintenance before shift changeover could be attributed to tiredness from long shifts

Emergency response procedures

Management viewed safety training as “cursory” and did not train new workers in emergency responses. Witnesses reported that some workers were not shown where the lifeboats were on the platform

Emergency procedures that existed, did not account for any catastrophic events, such as the one that destroyed the platform

Due to display of non-critical alarm sounds and signals coming from the detector module rack, the gas alarms sounding in the control room were not acknowledged by the operator as associated with gas hazard alarms

The platform was never upgraded to be equipped with emergency response mechanisms for gas situations; therefore the firewalls were never upgraded to withstand gas-related fires and explosions of that nature

Communications between the platforms were lost when the first explosions occurred. This delayed shut-down on the other platforms, particularly on Claymore and Tartan.

Equipment was challenging to control during the emergency as there was a lack of redundancy controls

The primary emergency evaluation method was via helicopters and boats and no other transportation method was included.

Supervisors/Management

Management of Piper Alpha viewed emergency training as 'cursory' and did not account for catastrophic events including the one that destroyed the platform

Teams on other platforms surrounding Piper Alpha continued to pump oil to it even though it was visibly on fire

Safety advisor signed off Permit to Work without inspecting the job site where routine maintenance was being conducted

There was no mention of the works being conducted on the Condensate Pump A in the maintenance logs

Inadequacies in the layout of the platform as there was only one access route to the lifeboats and this was obstructed with thick black smoke from the explosions

Attitudes

Work ethic among the platform had disintegrated; with workers only working to complete tasks before changeovers

Long shifts for the workers on the platform could have attributed to poor performance when undertaking maintenance activities

Control room operators did not believe they had the authority to cease productions and stop pumping oil

Macleod et al. (2018) states that when people are encouraged to think that safety can be ensured by roles that are enforced by inspectors, they become complacent and it is impossible to cover eventualities in a set of general rules

Highlighted inadequacies of both the permit to work and the shift handover procedures however nothing was changed

Main evacuation was via helicopter (helideck as it was believed to be the last place to be damaged if an accident occurred). Within the first minute of the explosion, the helideck was covered in black smoke

Roles and responsbilities

Management were reluctant to shut down the operations onboard

Superintendent in the control room did not believe he had the authority to stop the exportation processes from the platform

Management in the surrounding platforms did not believe they had authority to stop the constant supply from their platforms

Discrepancies between what the safety department intended to convey, and what they actually conveyed

Lack of adherence to the standard operating procedures associated with the PTW system

Procedure required maintenance and operations to meet, inspect the work site and sign off permits together however did not occur on the day of the accident

Some staff didn't know the location of the lifeboats

Some staff did not know the location of the lifeboats therefore it hindered their escape when the explosions began

Operators kept a log but often failed to record maintenance activities

Shift handover was a busy time

Procedure if management were busy was for maintenance to sign off the work permit and leave it in the control room or safety office

Contractors & maintenance personnel

Workers/Operators

No one received accurate training as they did not challenge management's viewers that emergency training was cursory

The previous shift supervisors failed to communicate to the supervisor on the consecutive shift that there was ongoing maintenance being conducted on Condensate Pump A

Due to a number of other non-critical alarms constantly sounding, the operators ignored the gas alarms that were sounding in the control room

The assessment of risk was focused on turning off the pumps to protect divers from being sucked into pipes instead of prioritising the 226 men unprotected from fire

Oil continued to be produced and exported into the line to for approximately an hour after the first explosion

Operators were busy with their own handovers at the shift change on the day

Superintendent in the control room did not believe he had the authority to stop the exportation processes from the platform

The control room operators did not believe they had the authority to cease productions and stop pumping oil to Piper Alpha due to a lack of command among platforms

The deluge nozzles were often blocked with scale and the fire-water pipework was undergoing phased replacement

The platform was underperforming operationally after an inspection was conducted on the safety equipment

The oil from Claymore and Titan took the easier reverse route to Piper Alpha because the emergency shutdown valve on the Piper Alpha oil export line failed to close tightly

Retrofitting was in several phases - separation of condensate and then production of export-quality gas

Retrofitting causes non-ideal design solutions to make it work

The location of the control room next to the oil and gas production modules had a high probability of destroying the control room and created high failure dependencies if any fires and blasts occurred

Safety design rested (fire) was not revisited effectively when the platform was modified to treat gas with additional risk of explosion.

When the fire and black smoke broke out, no workers could get to the helipad

No way of contacting the surrounding platforms to cease their supplies to the platform

The lack of communication system redundancies when these were destroyed during initial explosions

Main escape route for emergencies not sufficient

Not accurately updated to suit new operational requirements eg. gas

The pressure relief valves for the condensate injection pumps were located one floor above the pumps

In order to reinstate condensate injection pump A, two separate actions would have been required: reinstate electrical power and open the gas-operated suction and discharge valves

Valve should be placed as close to condensate unit as possible however it was placed 8 metres above and 15 metres away from the pump

No locking of isolation valves, spading or double-block-and-bleed were used to prevent re-pressurisation of a system isolated for maintenance

Some parts used to refurbish for installation at another location

Onboard facilities

Function

Can be 200 people working and living on a rig at one time

Onboard wifi

Accommodation quarters

Television

Small movie theatres, pool tables, air hockey, video game consoles on some rigs

Operator skills & requirements

Complete sea survival training

Medical examinations

Helipad

Used to fly in hundreds of workers constantly via helicopters

Oil rig operational 24 hours a day

Approx. 90 min turnaround on flight

Music rooms

Laundry

Kitchen

Sometimes fire rooms/own fire fighting crew

Poorly ventilated modules where equipment was located

Most workers were sleeping in the accommodation quarters where the explosion occurred due to fire which was located close to the explosion

Controls

Automated drilling system

Integrated drilling controls system

Equipment integration

Drilling control rooms

Data Mate System (DMS)

Management were reluctant to shut down operations onboard after the first explosion

No identification of the risks associated with loosely fitting the blind flange

Did not inform management of unfinished works or additional maintenance work was undergone

Maintenance log not filled in

No out of order signs/tag out on pump undergoing maintenance

Management would assume that if no issues were reported by crew then they did not independently review operations or the Permit to Work system

Not trained in emergency evacuation procedures

Left works for the following day instead of delegating the task

Fire-fighting systems were not activated when fires began as it was turned to manual control

Emergency and safety procedures not practiced on the platform

Workers were constantly exposing themselves to fatal levels of smoke as they constantly opened and closed the door to the crew quarters

The Piper Alpha platform did not have an adequate refuge area and refuge system

Due to a lack of emergency training, the workers seeking refuge in the crew quarters were constantly opening and closing the doors; exposing themselves to fatal levels of the smoke from the explosions.

The workers onboard the platform at the time of the emergency began to seek shelter in the crew quarters. Due to a lack of emergency training, the workers seeking refuge in the crew quarters were constantly opening and closing the doors; exposing themselves to fatal levels of the smoke from the explosions

Processing equipment and utilities tested onshore and pre-commissioned where possible

Hydrotesting of pressurised gas tests and pipework (1% helium and nitrogen for trace for detection)

Onshore hydrotesting of the topside performed with potable water

Vessels fire fighting systems

Analysis required

Fatigue analysis

In-place analysis

Earthquake analysis

Installation analysis

Transportation analysis

Upending analysis

Appurtenances analysis

Loadout analysis

Impact analysis

Stability analysis

Pile and conductor pipe drivability analysis

Environmental perimeters

Helicopter landing pads/decks must conform to legislation

Wave height analysis

Water depth

Wind velocities

Tide analysis

Minimum air gaps between decks

Load weight of onboard equipment

Geotechnical perimeters

Seabed soil mixture eg. sand, clay, silt

Load bearing of tension and compression

Sheer resistances

Load-deflection characteristics

Various

Accommodation allocation

Transportation

On board a vessel

Built in fabrication yards

Stresses checked

Seafastening analysis is performed

Platform parts (decks, jackets, appurtenances fastened to barge

Motions of heave, pitch, roll and yaw is considered

Seastate analysis compare with worst of the year

Installation

Structural sections must be able to withstand upending, uprighting and lifting/launching and other stresses

Jackets are self supporting during pile drive and installation

Safety features and emergency provisions eg. lifeboats

Materials used

Layout of rig

Design Failure

Active Failure - Information Transfer

Precursor - Failure to investigate - Management/Systems

Design Flaw – Precondtion

Change Management Procedures – Latent Failure

Management/Organisational Failure

Active Failure - Management/Organisational

Management Policies/Procedures – Precursor

Active failure to ensure procedure was followed – information transfer

Management/Organisational – Latent Failure

Inadequate management policy/procedure – Latent failure

Management/Organisational – Latent Failure

Active failure –Management/information transfer

Management/Organisational – Latent Failure

Active failure to ensure procedure was followed – information transfer