Piper Alpha:
From Disaster
to Change

No other accident in the offshore petroleum industry so far has cost so many human lives as the inferno on Piper Alpha. What went wrong, what were the consequences and why is this disaster still relevant today?

This major accident on the UK continental shelf, when the Piper Alpha facility burnt and exploded, remains one of the worst imaginable scenarios for everyone working in the petroleum industry.

Gas began to leak in the late evening of 6 July 1988 from a condensate pump which had been shut down for maintenance. An operating problem meant that the other pump in the system also had to stop.

A failure of communication meant that the control room operator started up the unit being maintained without realising that the work was unfinished.

The substantial leak of condensate and gas which resulted caught fire and exploded before anyone managed to intervene.

From oil to gas

The Piper Alpha facility was originally designed and constructed for oil production, but was converted after a few years towards producing gas.

This was partly because the share of gas from the field rose as oil output declined, and partly because gas from nearby sources was sent to the platform for processing and transport to land.

But firewalls in Piper Alpha’s process area were dimensioned to protect against an oil fire – not to withstand the pressure from a gas explosion.

The blast on 6 July blew out several panels in a firewall. One of the fragments cut a pipe carrying condensate, and a new fire started.

When the fire broke out, two people donned protective suits and tried to get to the pump room for a manual start-up.

They were never seen again.

Photo: Tony Miller

Photo: Tony Miller

From accident to disaster

“An important reason why this incident developed into such a huge disaster was the safety barriers around nearby fields and facilities producing towards Piper,” explains Torleif Husebø, discipline leader for process integrity at the PSA.

“Isolating energy between the facilities built on each of them controlling its own production. They were self-managed, and there was nothing automatic about shutdowns.”

This meant that halting output from a neighbouring facility which produced to Piper Alpha had to be based on a message from the receiving facility.

“The situation on Piper was so serious and confused that the other installations weren’t notified, and continued to produce towards a platform which then had at least two fires,” says Husebø. “That caused the incident to escalate into a disaster.”

Torleif Husebø, discipline leader for process integrity at the PSA

Torleif Husebø, discipline leader for process integrity at the PSA

Gas was sent via Piper Alpha to the mainland from the Claymore and Tartan fields. Facsimile from the documentary film Fire in the Night (2013).

Gas was sent via Piper Alpha to the mainland from the Claymore and Tartan fields. Facsimile from the documentary film Fire in the Night (2013).

Principles breached

Piper Alpha’s original design took a recognised approach in placing the most safety-critical areas as far as possible from vulnerable zones such as the control room and living quarters.

But that principle was breached when modifying the platform to accept and process gas from Britain’s Claymore and Tartan fields.

Gas compression, for example, was located close to the control room – a move which had consequences for the way the accident developed.

“Piper Alpha shows how terribly wrong things can go if we fail to manage risk and take account of uncertainty,” Husebø emphasises.

Despite the drama on Piper,
the neighbouring Tartan and
Claymore fields continued
to produce and send gas
to the Alpha facility.

Facsimile from Fire in the Night.

Facsimile from Fire in the Night.

Fateful assumptions

“Leaders on the other facilities quickly became aware that something had happened on Piper,” says Husebø. “But they failed to make a balanced assessment of the assumed risks and weren’t sufficiently cautious in their approach.”

Firewater pumps on the facility were normally meant to start automatically when a blaze was detected. But they had recently been placed in manual mode.

This was because divers were working close to the platform, and it was feared they might be at risk from getting too close to the water intake while the pumps were running.

In other words, Husebø says, they put production concerns ahead of safety on the basis of assumptions – that Piper had enough firewater to handle the position and that the position was under control since pressure in their own pipelines stayed stable.

"Mayday, explosion and fire on the Piper plattform.
All personell abandon."

"Bloody hell, it's really on fire, isn't it?"

"The situation is that the platform is completely on fire, from sea level to top. We have in fact pulled back somewhat. The structure is collapsing, and it is total fire."

No communication

Immediately after the explosion, the emergency shutdown (ESD) system on Piper Alpha was activated and the fire should therefore have died out by itself. Instead, the blaze was kept alive and reinforced because Tartan and Claymore continued to produce to it.

Management on these platforms lacked the authority to shut down production without clearance from land. Nor did they have an adequate overview of conditions on Piper.

Piping damage caused by the explosion meant that large quantities of hydrocarbons flowed into the area which was engulfed in flames.

The control room had to be abandoned less than 10 minutes after the first explosion. Messages could no longer be given over the public address system, and organisation of further work became very difficult.

“Nor had personnel on Piper Alpha trained on emergency response with the other facilities – they’d undoubtedly failed to envisage this type of major accident,” says Husebø.

“Such a far-reaching incident was more or less inconceivable. When you haven’t trained, it’s difficult to be sufficiently well prepared to handle an actual event.”

Sought refuge

Emergency procedures specified that personnel should muster to the lifeboats, but the fire prevented that. People therefore sought refuge in the living quarters, with its protective firewalls.

The fire and smoke, combined with the wind direction, rendered helicopter evacuation impossible. Smoke and combustion gases eventually began to enter the living quarters.

Many of those on board chose to jump into the sea, and most of the survivors were picked up by ships which were in the area or arrived from elsewhere.

After the fire had been under way for 25 minutes, the riser from Tartan fractured because of the heat. A huge ball of fire then enveloped the whole platform. Fames rose more than 100 metres into the air.

Two hours after the first explosion, Piper Alpha disintegrated. The bulk of the facility, including the living quarters, sank beneath the waves.

One hundred and sixty-five of the 226 people on board when the accident happened died. Another two people were also killed on a support vessel which took part in the rescue operation.

Of the 61 survivors, many suffered major burns.

Thirty of the dead were never found.

Lord Cullen and
the new regime

The official commission of inquiry into the Piper Alpha disaster was headed by senior Scottish judge Lord Cullen. Its 1990 report led to fundamental changes for Britain’s oil industry.

This document levelled scathing criticism not only at platform operator Occidental but also at the energy department and the UK’s system for offshore safety regulation.

Lessons learnt
Lord Cullen was the keynote speaker at the major Safety30 conference in Aberdeen, staged in June 2018 to mark the 30th anniversary of the disaster.

The 82-year-old has seldom spoken about the inquiry and its conclusions, but reflected in an interview with the PSA on his experiences in the wake of Piper Alpha.

Risk management
Lord Cullen believes that the most important lesson learnt from the disaster deals with risk management.

“Here we had a situation where a platform was set up to deal with oil, but had introduced into it the transmission of gas coming from other installations.

“That created a danger, where there was a question of whether the gas risers might be affected by something happening on the oil side, as in fact happened, or whether they would themselves create a danger for control of the platform and for accommodation.

“Huge risk factors were involved in this, and management did not really face up to the need to take a systematic and radical look at what it was embarking on.

“So when the accident happened in July 1988, it was a realisation of those inherent risk factors which hadn’t been adequately appreciated.”

Lasting change
The Safety30 conference was staged by the International Regulators’ Forum and Oil & Gas UK. Among other issues, its seminars addressed the effect of the disaster on safety work down to the present day and how the lessons learnt can help to reduce petroleum-industry risk now.

Lord Cullen emphasises that Piper Alpha led to fundamental changes in Britain’s oil industry.

“[This] had a huge effect on the industry itself. It went through an enormous realisation of the enormity of what had happened. Things were never the same.”

Norwegian perspective

During its work, the Cullen commission showed great interest in the structure of Norway’s offshore safety regulations and the regulatory regime on the Norwegian continental shelf (NCS).

A number of the proposals made were also inspired by the Norwegian regime, including the allocation of responsibility, the supervisory system and legal provisions.

“The Norwegian model was certainly one to look at, because you had had to deal with your own disaster only a few years before,“ Lord Cullen recalls. “We took it into account, without following it exactly.”

From disaster to learning

Now retired, Lord Cullen has devoted much of his life to drawing lessons from major accidents and disasters.

In addition to Piper Alpha, he also led the official inquiries into Scotland’s Dunblane school shooting in 1996 and the Ladbrooke Grove train crash in London during 1999.

“If you examine a major accident, you need to get down to the basement to find out all the underlying factors,” he observes. “And those factors in themselves are very important because they can happen again.

“But they can be prevented from becoming a major accident. So each major accident has got a lot to tell us, and Piper Alpha is a very good example of that.“

He emphasises the importance of not jumping to immediate conclusions when working with safety.

“Say an employee overfills a particular vessel, so there’s a hydrocarbon escape. What do you do? Do you target the employee, and sack or retrain him, or do you look a bit more deeply?

“Is supervision what it should be, for example? Are the practices and procedures proper and up-to-date, or do they need to be changed? Is a warning system needed to demonstrate that the level has been exceeded?

“That’s why deeper thinking is very important. You can’t just go for the superficial approach.”

Assessing incidents which have not happened is impossible, Lord Cullen points out. He hopes that the benefits gained from learning lessons and continuous improvement after major accidents will be retained.

“Unfortunately, it’s a fact of life that substantial change does not come about easily. It tends to rely on major events, even though they are dreadful.

“The Piper Alpha disaster and all the changes which followed on that were very substantial. People are still living under those changes.“

The Legacy of
Piper Alpha

British improvement efforts following the disaster took Norway as a model which could be emulated.

“The Piper Alpha investigation also became in many respects an indirect test of our own safety regime,” says Torleif Husebø.

After the Alexander L Kielland flotel turned over in 1980 with the loss of 123 lives, this regime was revised and a new division of regulatory responsibility adopted for operations on the NCS.

The consent system was introduced in 1985, when the principle of internal control in enterprises also emerged.

Although regarded as uncontroversial today, the latter initially encountered fierce opposition from several quarters. These critical voices were muted by Piper Alpha.

Clearer structure

The disaster led to big changes in Britain’s offshore safety regime, including the transfer of regulatory responsibility from the Department of Energy to the Health and Safety Executive (HSE).

“This was intended to establish a clear distinction between resource management and safety supervision by the state,” Husebø notes.

A requirement to produce a safety case for various UKCS activities was also introduced as a result of the inquiry commission’s recommendations, he adds.

“Key elements here are that the operator must provide a detailed overview of the risk picture on a facility, and that adequate measures and barriers are put in place to handle relevant scenarios.

“The safety case solution has many features in common with Norway’s system of consents for conducting activities on the NCS.”

Still relevant

“It’s important that we’re constantly conscious of what happened with Piper Alpha and other major accidents which have hit the petroleum sector,” observes Husebø.

They show how terribly wrong things can go without expertise to manage risk and take account of uncertainty, he says. Piper Alpha is still relevant to current safety discussions.

“In this case, the other platforms saw the fire but continued to produce because they thought the position was under control and failed to appreciate that they had a clear mandate to shut down.”

“This challenge of ensuring balance between safe operation and creating financial value remains relevant in the petroleum sector,” Husebø says.

“It’s also a core element in risk management. Positive safety measures will usually have a positive effect on value creation. But safety-related measures usually also have a cost.”

He points out that traditional economic methods are inadequate tools for analysing complex correlations involving great uncertainty – as when dealing with major accident risk.

“Financial cost/benefit assessments are important in a decision process, but it’s also important to be aware of the limitations of such analyses.

“It’s not the case that all safety measure must be adopted, but we in the PSA see many circumstances where such action is initially argued away because the short-term costs are excessive.

“That occurs especially when seeking to reduce the risk of incidents with a low probability, big consequences and great uncertainty – in other words, the elements of a major accident.”

No guarantees

Much has happened since 1988 in terms of risk understanding, regulations, technology and operational conditions. But it is impossible to guarantee that an incident like Piper Alpha could not happen again.

“As long as you pursue petroleum operations, unforeseen circumstances can arise,” emphasises Husebø. “Accidents like Alexander L Kielland, Piper Alpha and Deepwater Horizon in 2010 show the big risk potential inherent in this industry.”

On the other hand, the probability of an incident like the UK disaster of three decades ago is undoubtedly much lower than it was then – even if it is clearly greater than zero.

“We know that the level of safety on the NCS is high, and that progress has been made over time,” Husebø says. “But history has limited value when it comes to predicting the future.

“We must remain conscious of the uncertainty and deal with it in an acceptable manner, so that the probability of such incidents is minimised.”

The Alexander L. Kielland accident in 1980 led to wide-reaching changes to the security regime on the Norwegian continental shelf. Photo: Erik Thorberg / NTB Scanpix

The Alexander L. Kielland accident in 1980 led to wide-reaching changes to the security regime on the Norwegian continental shelf. Photo: Erik Thorberg / NTB Scanpix

11 people died in the Deepwater Horizon accident, which also caused considerable environmental damage. The accident was a powerful reminder of the potential risk in the petroleum industry. Photo: US Coast Guard

11 people died in the Deepwater Horizon accident, which also caused considerable environmental damage. The accident was a powerful reminder of the potential risk in the petroleum industry. Photo: US Coast Guard

Written by Øyvind Midttun & Stian Danielsen.
Video by Morten Gjerstad.
Translated by Rolf E. Gooderham.