On July 6 1988 there was a gas escape in the pumping system of the North Sea platform Piper Alpha which subsequently ignited. The platform was a collecting point for gas from the Tartan and Claymore fields and their failure to react to the accident and shut down their systems resulted in the Piper A being demolished after a number devastating explosions. 167 of the 228 personnel who had been on board at the time died. The survivors were those who had jumped into the sea. The subsequent public enquiry, chaired by Lord Cullen, reported in November 1990, and extended to two volumes containing 106 recommendations.
THE UNITS INVOLVED.
The Piper Alpha platform was what was then the conventional design, with a steel jacket piled into the seabed in 474 feet (144 metres) of water, topped with the process and accommodation modules. It had been constructed in the early 1970s and had commenced production in 1976. Initially it had been used to process hydrocarbons from its own 24 wells, in its heyday about 300,000 barrels a day, and deliver the result by pipeline to the Flotta oil terminal in Orkney. Later it had been converted to facilitate gas production and was a collecting station for the hydrocarbons produced by the Tartan and Claymore. It was provided with an export line to Total’s MCP-01 gas compression platform. It was 120 miles northeast of Aberdeen and was operated by Occidental.
The Tharos was an Earl and Wright Sedco 700 design built as what would today be known as a “life of field” support vessel. It was 91 metres (300 feet) long and 76 metres (249 feet) wide, and like all the Sedco 700s it was based on two pontoons on which were mounted eight columns, four on each side, which in turn supported the upper deck. It was not a drilling rig, and so was not provided with a derrick. It could carry out diving and other support operations and was equipped with an eight point mooring system, and was capable of being dynamically positioned. It had a large Clyde crane and an extendable gangway which could be connected to the platforms it supported. It was operated by a consortium which consisted of Occidental and BP.
The Iolair, another life of field support vessel.
The Silver Pit, was the standby vessel assigned to the platform. Like most of the standby vessels out there in the UK sector of the North Sea, required subsequent to the Sea Gem disaster back in 1969, it was a former deep sea trawler, known in the business as a “side dragger” It was a vessel of 340 gross tons and had been built in Canada in 1947. It had a single engine driving a conventional screw, rod and chain steering and no form of autopilot, requiring the watchkeeper to either be steering the course, or else for the ship to be drifting downwind, known as laying and dodging. It had a small FRC which could be deployed to pick people out of the sea.
The Lowland Cavalier was a diving ship 80 metres (262 feet) long constructed in 1975 by Martin Jansen and originally named Seaway Falcon. It was powered by six diesel engines which output to two controllable pitch propellers and four tunnel thruster. It had been purchased by Low Line is 1987.
The Sandhaven was a former supply vessel 52 metres (170 feet) long, which had been built by Richards of Lowestoft in 1981. It had migrated to the standby fleet principally because the industry did not like the propulsion system which consisted of a large azimuthing thruster aft, powered by a single Yanmar engine developing 1400 bhp, and a single azimuthing thruster forward. Despite the industry’s reluctance to accept this design, it and its sister ships were said to be excellent at dealing with the strong currents prevalent in the southern North Sea. It was actually assigned to a Santa Fe MODU 4.5 miles away. It was provided with a couple of FRCs one of which it launched to recover personnel from the sea.
The Tharos was provided with its own anchor-handler the Maersk Cutter and it and a number of other vessel responded in a short time to the emergency, including two platform ships the Loch Carron and the Loch Shuna, and two further Maersk anchor-handlers the Maersk Leader and the Maersk Logger.
PREAMBLE.
Because of the changing legislation on the UKCS the oilfield operators were required to export the separated gas to the shore instead of flaring it off, and to allow this to be done the Piper Alpha had been upgraded to include a Gas Compression Module. This was installed close to the Control Room, and the barriers between the different spaces had not been upgraded to deal with gas ignition rather than oil fires.
During 1988 a variety of major maintenance and upgrade activities were being undertaken on the platform, and at the time of the accident the diving ship Lowland Cavalier was carrying out trenching activities about 25 metres from the platform. Since there would be divers in the water the safety procedures for the platform required that the fire pumps were deselected from automatic operation, and hence required to be manually started, one assumes from the Control Room.
During the day of July 6th 1988 one of the two condensate pumps was put offline so that a safety valve could be repaired, and the missing valve was replaced with a blind flange, which had not been properly tightened up. There had been no intention to start the pump, and there had apparently been permits issued for the overhaul of the safety valve. Because the permit system required the actual permits to be located in the space where the activity was to take place, and the pump and the safety valve were in different compartments, although the permit for the pump was found, no-one found the permit for the safety valve. Hence it was assumed that it would be possible to start this pump, when the other one of the two had stopped and could not be restarted.
At the time the Tharos was on the location with its mooring system deployed, but was some distance away from the platform with its gangway housed.
THE SEQUENCE OF EVENTS
July 6 1988.
2154. The condensate pump A is switched on, and immediately gas is released from the loosely attached blank flange, and an explosion occurs displacing some of the boundary material of the module, some of it into the Control Room.
A distress message is immediately broadcast from the Radio Room of the Piper Alpha.
2202. Lowland Cavalier broadcasts a Mayday which is picked up by Wick Radio, and the shore station alerts the Search and Rescue services. The Lowland Cavalier launches its workboat and the Silver Pit launches its FRC.
2204. The Control Room is abandoned. No instructions to evacuate the unit have been issued, and personnel migrate towards the accommodation muster areas.
2208. A third Mayday is broadcast from the Piper Alpha Radio Room, requesting assistance and saying that the Radio Room is to be abandoned.
2219. An RAF Nimrod is scrambled from RAF Kinloss to coordinate rescue operations.
2220. The Tartan gas riser bursts with immediate ignition of the gas released on the platform.
2222. A Sea King helicopter lifts off from RAF Lossiemouth.
2228. A second Sea King lifts off from RAF Boulmer
2230. The Tharos closes up with the platform but is unable to deploy its gangway due to smoke and flame at the gangway receiving point. It is able to use its fire monitors to reduce the effect of heat on the small craft carrying out rescue operations. It is probable that around this time the Sandhaven arrives at the location and launches its FRC.
2245. A third Sea King lifts off from Shetland.
2250. The MCP-01 gas line ruptures, causing an explosion. The FRC from the Sandhaven has just rescued a number of people who had shinned down ropes on the southwest corner of the platform. The explosion destroys the FRC and kills all its occupants except for one. The Tharos is partially engulfed and is forced to move away from the platform.
2251. A fourth Sea King lifts off from Lossiemouth.
2318. The first helicopters arrive on the scene.
2320. The Claymore gas pipeline bursts.
2350. Much of the topsides of the platform falls from the jacket into the sea.
July 7 1988.
0018. The first helicopters leave the scene bound for Aberdeen with survivors on board.
0045. A medical team from Aberdeen Royal Infirmary arrives on the Tharos by helicopter.
0218. The first survivors arrive at ARI.
0400. There are 45 vessels at the location, all fire-fighting has ceased and the activity is now one of search and rescue.
0815. 63 people have been rescued, and mostly transferred to the Tharos.
2245. The search for survivors is terminated.
THE INVESTIGATION.
The public enquiry report runs to two volumes, the first containing the process of the investigation, which was difficult considering the fact that the platform had been completely destroyed, and the second mainly containing the details of the failings in the operation and construction of the unit, and what had gone wrong after the explosion, and thereafter the 106 recommendations. The event is included here because of the changes to the safety regime in the UKCS, and in other parts of the world, but it would be unproductive to go into too much detail.
The failure of the Tartan and Claymore platforms to register the scale of the emergency, and therefore to stop pumping, resulted in the ignition of further gas inventories, and the only people to escape from the platform were those who jumped into the sea, some from the helideck.
The Piper Alpha was sited close to the shipping route between the Shetland Basin and the northeast coast of Scotland and within an area of continuing offshore exploration and development. As a result a number of other vessels were to be involved in the rescue operations.
Within a few minutes of the initial explosion, the FRC from the Silver Pit and the workboat from the Lowland Cavalier had been launched, and were picking up survivors who had found their way to the lowest points on the platform. The Tharos fire-fighting monitors, where, to some extent, protecting the crews of the FRCs working in extreme heat close to the burning structure.
The Maersk Cutter also took up the role of fire-fighting vessel and within 10 minutes was using its fire monitors to attempt to control the blaze at Drill Floor level. With three of its four monitors operating the estimated rate of discharge was 7500 tonnes per hour.
A later explosion damaged the FRC from the Silver Pit, and the occupants were rescued by the Maersk Cutter after it had ceased fire-fighting.
A little after 2300 two further Maersk vessels, the Maersk Leader and the Maersk Logger, were on location and were also rescuing survivors from the sea with their FRCs and now transferring them to the Tharos. The Tharos was able to recover personnel from the support vessels with its crane and was the recipient of medical teams, who had arrived by helicopter.
Of the 61 survivors of the Piper Alpha, 29 had been picked up by the FRC from the Silver Pit and 8 by the vessel itself. Nine who had been picked up by various FRCs were taken directly to the Tharos and seven to other vessels, particularly the Maersk Logger. Inevitably the investigation into the disaster found failings in the manner in which the rescue efforts were carried out citing, in particular, the chaotic communications, the tendency for FRCs to break down and the manoeuvring difficulties suffered by the Silver Pit. The loss of the Sea Gem in 1969 had triggered the requirement for a standby vessel, but witnesses to Lord Cullen’s enquiry reflected an industry view that the craft were nothing more than “a necessary evil” and “a token gesture”. The Silver Pit was provided with a temperamental bow-thruster, which failed after five minutes in operation. Lord Cullen said “I am entirely satisfied that in the above respects (manoeuvring capability) the Silver Pit was essentially unsuitable for the purpose of effecting the rescue of survivors”. The Silver Pit was found deficient in many other respects, some due to poor maintenance and some due to the inadequacy of the regulations under which standby vessels in general were operated and equipped.
The Tharos also came in for criticism in during the enquiry. Its operators, Occidental, had claimed that it would effectively deal with many emergencies including fires, but in the event it had been late to get alongside the platform due to the length of time it had taken to heave in its anchor cables, and it had been slow to operate its fire monitors. Some survivors suggested that if it had operated properly it would have been able to extend its gangway under protection of its fire monitors and would have therefore been able to rescue people directly from the platform. The vessel was referred to by some as “the most expensive white elephant in the North Sea”. The report stated specifically that there could be no criticism levelled at the master of the Tharos for his decisions and for the exercise of his responsibility, but it remains difficult to say whether the lack of effectiveness of its hardware has had a long-term effect on such vessels. The Tharos and Shell’s equivalent vessel the Stadive are now both drilling rigs, and the Iolair, the BP emergency and diving semi-submersible, is now an accommodation unit in the Gulf of Mexico.
By the end of the enquiry converted trawlers in general, rather than the Silver Pit in particular, were becoming the recipients of fairly extensive criticism. At that time 162 of the possible 187 standby vessels were former fishing vessels, and even though the enquiry itself had only considered the Silver Pit, Lord Cullen recommended extensive changes to the standby vessel code, which effectively made most fishing vessels unsuitable for further service. The industry itself, prior to the results of the public enquiry, developed what became known as “The Green Code”, with which all standby vessels were gradually altered to conform, or else paid off to be replaced by old supply vessels which were nearing the end of their useful life in their primary role.
The 106 recommendations in the report covered the following topics:
· Legislation and the HSE
· Safety Committees and Safety Representatives
· Permit to Work
· Reporting of Incidents
· Hydrocarbon Inventories
· The TR, evacuation and escape.
· Helicopters
· Standby vessels
· Command, drills and training.
Most of the recommendations were directed at changing the manner in which safety was dealt with offshore. Lord Cullen had borrowed the concept of the Safety Case – making the case for safety – from the nuclear industry. There it had been deemed essential that all risks should be identified and means found to reduce them to a level considered to be as low as reasonably practicable. It was necessary in the nuclear industry since an accident could result in fall-out over a large area, with consequent deaths in the community. Subsequent to the Flixborough chemical accident in 1974 safety cases were also introduced for chemical plants.
Lord Cullen felt that the current prescriptive legislation, embodied by then in what was known as “Fourth Edition Guidance” should be replaced by a system in which the operators of the offshore installations, which included mobile units, should identify the risks to their managed objects and then provide the means of reducing them. Hence the industry was to deal with a new process – that of risk assessment. The recommendations contain the following statements, which are particularly pertinent to the manner in which the processes were to be carried out:
· That the potential major hazards of the installation and the risks to personnel thereon have been identified and appropriate controls provided.
· A demonstration that so far as is reasonably practicable the exposure of personnel on the platform to accidental events and their consequences has been minimised.
The words “so far as is reasonably practicable” are derived from the ALARP principle which states that risks must be “as low as is reasonably practicable.”
The report typically targets SI611 (Statutory Instrument 611), which dealt with fire and explosion risk and mitigation, for revision under goal setting legislation as follows:
50. The regulations and related guidance notes should promote an approach to fire and explosion protection:-
ii. in which the need for, and the location and resistance of, fire and blast walls is determined by safety assessment rather than by regulations.
iii. in which the function, configuration, capacity, availability and protection of the fire water deluge system is determined by safety assessment rather than by regulations.
iv. which facilitates the use of scenario based design method for fire protection as an alternative to the reference area method.
v. which provides to a high degree the ability of the fire water deluge system, including the fire pump system, to survive severe accident conditions.
These examples also illustrate the manner in which the recommendations, and subsequently the legislation, concentrates on accidents to fixed platforms. This bias has required considerable interpretation of the legislation on the part of the operators of mobile units and also considerable interpretation by the HSE assessors of the mobile unit safety cases.
The wreck of Piper Alpha
COMMENT.
Of all the accidents which have occurred offshore since the 1950s, the Piper Alpha disaster is probably the one which has had the greatest influence on the manner in which offshore safety is approached all over the world. For the installations operating within the UK sector came the requirement for the “Safety Case”, an approach which is gradually beginning to migrate to the whole of the offshore environment worldwide. It seems to the author that many of the recommendations from the US Coast Guard report into the Deepwater Horizon disaster would have been satisfied by some form of safety case regime, and here one is not saying that the one initiated in the UK is the best. It has worked relatively well, but after the revision and reissue of the regulations in 2005, followed by the disbanding the HSE Offshore Safety Division, some consider that the regulations no longer have the teeth that they once had.
It is also a curious fact that mobile units were struggling in the early 1990s with the latest edition of the “Guidance on Design, Construction and Certification of Offshore Installations (Fourth Edition) 1990”, which was requiring more onerous standards than were in place in the various iterations of the MODU Code. And when the Safety Case Regulations were published in 1992, with the provisor that all installations had to have a safety case in place by 1995, after a certain amount of posturing, they realised that they might be onto a good thing and set to, to conform with the new regulations. The one thing they never quite got to grips with was the requirement for “suitable and sufficient QRA”, that is Quantitative Risk Assessment, which for those who are not familiar, is the use of statistics to determine the level of risk from various accidents, and then to prove that the level of risk is acceptable. The techniques used are mathematical and presented in terms of fractions. Typically the IRPA – Individual Risk Per Annum – for an offshore worker should be such that he or she could go out there for 1000 years without risk of being accidentally killed. Actually the numbers can easily be manipulated to achieve whatever result is required, but it is an expensive process, and in the end is almost impossible for the ordinary man on the rig to understand.
The safety case is used in the UK Sector of the North Sea, and also in Canada where the document is part of the operator’s safety submission, and in Australia, Ireland and the Falkland Islands. Some operators also require the units they hire to be provided with one, no matter what part of the world they are working in.
Subsequent to the publication of the Safety Case Regulations the HSE followed up with some secondary legislation the “Prevention of Fire and Explosion and Emergency Response” regulations (PFEER) which attempted to fill in any gaps which might have been left by the Safety Case Regs – typically QRA could have identified the fact that having lifeboats was more risky than not having them, and so PFEER ensured that they would be there. And there is more, but maybe it should be the subject of another article.