July 6, 1988: The Piper Alpha Disaster
Piper Alpha was an oil production platform in the North Sea operated by Occidental Petroleum (Caledonia) Limited. It began production in 1976, but on July 6, 1988 it was the site of the world's most lethal offshore disaster.
An explosion and resulting oil and gas fires destroyed the platform, killing 167 people, including two crewmen of a rescue vessel. Only 61 workers escaped. 30 bodies were never recovered.
The total insured loss was about $3.4 billion, and at the time of the disaster, the platform accounted for approximately ten percent of North Sea oil and gas production.
A large fixed platform, Piper Alpha was situated on the Piper oilfield, approximately 120 miles (193 kilometers) northeast of Aberdeen in 474 feet (144 meters) of water. It was made up of four modules separated by firewalls, and for safety reasons, the modules were organized so that the most dangerous operations were distant from the personnel areas. A later conversion from oil to gas processing broke this safety concept, with the result that sensitive areas were brought together; for example, gas compression occurred next to the control room - this played a role in the accident.
In the late 1980s, major upgrade works had been planned by Occidental and by July 1988, the rig was already well into major work activities. Despite a complex and demanding work schedule, Occidental made the decision to continue operating the platform rather than shut it down temporarily.
Although the Cullen Inquiry found Occidental guilty of inadequate maintenance and safety procedures, no criminal charges were brought against the company.
The inquiry resulted in 106 recommendations for changes to North Sea safety procedures - all 106 were accepted by the industry. The most significant recommendation was for the Health and Safety Executive (the U.K.’s body responsible for encouragement, regulation, and enforcement of workplace health, safety and welfare, and occupational safety research) to bear responsibility for North Sea safety, replacing the U.K.’s Department of Energy’s obligation. The reasoning for this was based on a potential conflict of interest when one organization oversees both production and safety.
Timeline of Events
12:00 noon: Two condensate pumps, designated A and B, displaced the platform's condensate for transport to the coast. On the morning of July 6, Pump A's pressure safety valve was removed for routine maintenance. The pump's two-yearly overhaul was planned but had not started. The open condensate pipe was temporarily sealed with a disk cover (flat metal disc also called a blind flange or blank flange). Because the work could not be completed by 6:00 pm, the disc cover remained in place. It was hand-tightened only. The on-duty engineer filled in a permit which stated that Pump A was not ready and must not be switched on under any circumstances.
6:00 pm: The day shift ended, and the night shift started. As he found the on-duty custodian busy, the engineer neglected to inform him of the condition of Pump A. Instead he placed the permit in the control center and left. This permit disappeared and was not found. Coincidentally there was another permit issued for the general overhaul of Pump A that had not yet begun.
7:00 pm: Like many other offshore platforms, Piper Alpha had an automatic fire-fighting system, driven by both diesel and electric pumps (the latter were disabled by the initial explosions). The diesel pumps were designed to suck in large amounts of sea water for fire fighting; the pumps had an automatic control to start them in case of fire (although they could not be remotely started from the control room in an emergency). However, the fire-fighting system was under manual control on the evening of July 6: the Piper Alpha procedure adopted by the Offshore Installation Manager (OIM) required manual control of the pumps whenever divers were in the water (as they were for approximately 12 hours a day during summer) although in reality, the risk was not seen as significant for divers unless a diver was closer than 10–15 feet (3–5 meters) from any of the four 120 feet (40 meter) level caged intakes.
9:45 pm: Because of problems with the methanol system earlier in the day, methane clathrate (a flammable ice) had started to accumulate in the gas compression system pipework, causing a blockage. Due to this blockage, condensate Pump B stopped and could not be restarted. As the entire power supply of the offshore construction work depended on this pump, the manager had only a few minutes to bring the pump back online, otherwise the power supply would fail completely. A search was made through the documents to determine whether Condensate Pump A could be started.
9:52 pm: The permit for the overhaul was found, but not the other permit stating that the pump must not be started under any circumstances due to the missing safety valve. The valve was in a different location from the pump, and therefore the permits were stored in different boxes, as they were sorted by location. None of those present were aware that a vital part of the machine had been removed. The manager assumed from the existing documents that it would be safe to start Pump A. The missing valve was not noticed by anyone, particularly as the metal disc replacing the safety valve was several meters above ground level and obscured by machinery.
9:55 pm: Condensate Pump A was switched on. Gas flowed into the pump, and because of the missing safety valve, produced an overpressure which the loosely fitted metal disc did not withstand. Gas audibly leaked out at high pressure, drawing the attention of several men and triggering six gas alarms including the high level gas alarm. Before anyone could act, the gas ignited and exploded, blowing through the firewall. The custodian pressed the emergency stop button, closing huge valves in the sea lines and ceasing all oil and gas extraction.
Theoretically, the platform would then have been isolated from the flow of oil and gas and the fire contained. However, because the platform was originally built for oil, the firewalls were designed to resist fire rather than withstand explosions. The first explosion broke the firewall and dislodged panels, one of which ruptured a small condensate pipe, creating another fire.
10:04 pm: The control room of Piper Alpha was abandoned. "Mayday" was signaled via radio by radio operator David Kinrade. Piper Alpha's design made no allowances for the destruction of the control room, and the platform's organization disintegrated. No attempt was made to use loudspeakers or to order an evacuation.
Emergency procedures instructed personnel to make their way to lifeboat stations, but the fire prevented them from doing so. Instead many of the men moved to the fireproofed accommodation block beneath the helicopter deck to await further instructions. Wind, fire and smoke prevented helicopter landings and no further instructions were given, with smoke beginning to seep into the personnel block. As the crisis mounted, two men donned protective gear and attempted to reach the diesel pumping machinery below decks and activate the firefighting system. They were never seen again.
The fire would have burnt out were it not being fed with oil from the Tartan and Claymore platforms, the resulting back pressure forcing fresh fuel out of ruptured pipework on Piper, directly into the heart of the fire. The Claymore platform continued pumping oil until the second explosion because the manager had no permission from the Occidental control center to shut down. Also, the connecting gas pipeline to Tartan continued to pump, as its manager had been directed by his superior. The reason for this procedure was the huge cost of such a shut down. It would have taken several days to restart production after a stop, with substantial financial consequences.
Gas pipelines of both 16 and 18 inch diameter ran to Piper Alpha. Two years earlier Occidental management ordered a study, the results of which warned of the dangers of these gas lines. Because of their length and diameter, it would have taken several hours to reduce their pressure, which meant fighting a fire fueled by them would have been all but impossible. Although the management admitted how devastating a gas explosion would be, Claymore and Tartan were not switched off with the first emergency call.
10:05 pm: The Search and Rescue station at RAF Lossiemouth received the first call notifying them of the possibility of an emergency, and a Sea King helicopter took off at the request of the Coastguard station at Aberdeen. The station at RAF Boulmer was also notified, and a Hawker Siddeley Nimrod from RAF Kinloss were sent to the area to act as "On-Scene Commander" and "Rescue Zero-One".
10:20 pm: Tartan's gas line (pressurized to 120 Atmospheres) melted and ruptured, releasing 15-30 tons of high pressure gas every second, which immediately ignited. From that moment on, the platform's destruction was assured.
10:30 pm: The Tharos, a large semi-submersible fire fighting, rescue and accommodation vessel, drew alongside Piper Alpha. The Tharos used its water cannon where it could, but it was restricted, because the cannon was so powerful it would injure or kill anyone hit by the water.
10:50 pm: The second gas line ruptured (the riser for the MCP-01 platform), ejecting millions of cubic feet of gas. Huge flames shot over 300 feet (90 meters) in the air. The Tharos was driven off by the heat, which began to melt the surrounding machinery and steelwork. It was only after this explosion that the Claymore platform stopped pumping oil. Personnel still left alive were either desperately sheltering in the scorched, smoke-filled accommodation block or leaping from the various deck levels, including the helideck, 175 feet (50 meters) into the North Sea. The explosion also killed two crewmen on a fast rescue boat launched from the standby vessel Sandhaven and the six Piper Alpha crewmen they had rescued from the water.
11:18 pm: The gas pipeline connecting Piper Alpha to the Claymore Platform ruptured, adding even more fuel to the already massive firestorm that engulfed Piper Alpha.
11:50 pm: With critical support structures burned away, and with nothing to support the heavier structures on top, the platform began to collapse. One of the cranes collapsed, followed by the drilling derrick. The generation and utilities Module, which included the fireproofed accommodation block, slipped into the sea, taking the crewmen huddled inside with it. The largest part of the platform followed it.
00:45 am: The entire platform had gone.