Piper Alpha

The Vessel

Piper Alpha was a fixed-platform oil production installation in the North Sea, located in the Piper oilfield some 190 kilometres northeast of Aberdeen, Scotland. She was constructed at McDermott Engineering's Ardersier yard and installed at the Piper field in 1976 as the principal gathering and processing platform for the field, which had been discovered by Occidental Petroleum in 1973 and brought into production at the end of 1976.

She was a four-leg jacket platform rising some 144 metres from the seabed to her helideck, with a main processing deck 23 metres above the water. Her mass at the time of the disaster was approximately 34,000 tonnes. She processed approximately 300,000 barrels of crude oil per day, approximately 10 per cent of total UK North Sea production at the time, and she gathered and processed natural gas from the associated Claymore and Tartan platforms via subsea gas lines.

Her design, built for oil production in 1976, had been progressively adapted through the 1970s and 1980s for increased gas processing. Modules originally built for crude oil handling had been converted to gas-compression service; gas-condensate modules had been installed between production modules that had not originally been designed to share bulkheads with gas-pressurized equipment; and the centralised emergency shutdown system had been progressively downgraded as Occidental's operational culture accepted routine overrides of emergency procedures for operational throughput. By 1988 she was a platform operating on a substantially different process specification than the one for which her structural design had been approved.

The Voyage

On 6 July 1988 the day-shift maintenance team on Condensate Pump A (CPA) had partially disassembled the pump's pressure safety valve (PSV) for overhaul. The PSV was to be reinstalled by the night shift. At 18:00, shift change, the day-shift maintenance permit was handed in at the control room by a supervisor who believed the PSV would be reinstalled before the pump was returned to service. The permit was filed under "not for immediate action" rather than under "hold until work completed"; this administrative distinction was a function of the Piper Alpha's permit-to-work system, which did not provide an unambiguous hold procedure for partially-completed work.

At 21:45, the night-shift operator of Condensate Pump B (CPB), the redundant pump, found that his pump had shut down on its own (an automatic "trip"). Under operational pressure to maintain the platform's condensate output, he consulted the permit-to-work system, did not find a permit in the active-hold tray for CPA, and concluded that CPA was therefore available for service. He ordered CPA restarted. The pump pressurised. The partially reassembled PSV, with a blind flange loosely installed in place of the safety valve, began leaking liquid gas condensate almost immediately.

The condensate formed a vapour cloud in the vicinity of CPA. At 21:58 the cloud found an ignition source, probably a hot pipe or an electrical spark, and ignited. The first explosion of 6 July 1988 occurred at 21:58.

The Disaster

The first explosion was contained within the oil-processing module. It breached the firewall between the processing module and the adjacent utilities module but did not reach the adjacent gas-compression module or the accommodation block. The platform's automatic firewater deluge system, which should have activated immediately, failed to do so: the deluge pumps had been placed on manual control during an unrelated maintenance activity earlier in the day and had not been returned to automatic. The manual restart was attempted but took time.

Twenty-two minutes into the fire, at 22:20, the main gas riser from the Tartan platform ruptured. The Tartan riser carried gas at 120 bar pressure; when it breached, approximately 15 tonnes of gas released in three seconds and ignited in a fireball that rose 100 metres above the platform, twice the platform's own height. The Tartan rupture destroyed the control room, the communications centre, and the main emergency control station. Every subsequent response from the platform had to be improvised by individual crew members without central direction.

At 22:33 the main gas riser from the Claymore platform ruptured in a second, much larger fireball. The Claymore rupture destroyed the main structural joint between the production module and the accommodation module. From 22:33 onward the accommodation block was on fire, and crew members inside had no escape route to the sea except by a 50-metre descent down the exterior of a burning platform or by jumping from the helideck.

The platform manager Colin Seaton assembled the available personnel in the accommodation block and, in accordance with written Occidental protocol, instructed them to wait for rescue helicopters which could not land. Most of the men who followed this instruction died when the accommodation block collapsed at approximately 23:50. Men who disobeyed the protocol and jumped, or who climbed down through the fire to the sea, had a significantly higher survival rate. 167 of 229 aboard died; 62 survived. The fire burned for three weeks before all the platform's contained and flow-fed hydrocarbons were exhausted.

The Legacy

The Cullen Inquiry, chaired by Lord Cullen between November 1988 and June 1990, produced the most influential single industrial safety report in offshore history. The Cullen Report of November 1990, issued in two volumes and 485 pages, identified 106 specific recommendations for the North Sea offshore industry. The recommendations included the transfer of safety regulation from the Department of Energy to the Health and Safety Executive (implemented 1991), the introduction of the "safety case" regime under the Offshore Installations (Safety Case) Regulations 1992, and the mandatory provision of temporary safe refuge on all offshore platforms.

The Cullen safety case regime required every operator of an offshore platform in UK waters to produce, and submit to the HSE for approval, a formal document demonstrating that major accident hazards had been identified and that the operator's systems for managing those hazards were adequate. The safety case had to be reviewed and updated every five years. The safety-case regime was subsequently adopted internationally, with parallel regimes introduced in Norway (the Petroleum Safety Authority), Australia (NOPSEMA), and, after the Deepwater Horizon disaster, in the United States. Piper Alpha is, directly, the reason for the modern offshore safety case framework.

The 167 dead included 134 Occidental and contractor employees, 30 sub-contractor personnel, and 3 crew members of the rescue vessel Sandhaven who died attempting to recover survivors from the water. Their names are listed on the Piper Alpha Memorial in the Rose Garden at Hazlehead Park, Aberdeen, unveiled on 6 July 1991. The memorial consists of three bronze statues of oilmen on a granite plinth with the names of the dead inscribed on bronze plaques around the perimeter; it is the principal focus of the annual memorial service held on 6 July.

Occidental Petroleum sold its remaining UK North Sea assets in 1991 and left the British oil industry. The Piper field itself was redeveloped by Elf Petroleum (subsequently Total) on the Piper B platform, installed in 1992, which continued production until 2022. The Piper Alpha platform itself lies as a removed wreck on the seabed 190 kilometres northeast of Aberdeen, cleared from the seabed under the decommissioning programme of the 1990s; the Piper Alpha foundations, below the seabed, remain. She is the worst offshore oil disaster in history, and the direct source of the safety regime under which every North Sea platform has operated since 1992.