The Piper Alpha Oil Platform Catastrophe

Before the Fire

The Piper Alpha Oil Platform

After the Fire

www.safetycouncil.org.nz

The Piper Alpha Oil Platform Catastrophe

THE PIPER ALPHA OIL PLATFORM CATASTROPHE

The Piper Alpha Oil Platform catastrophe occurred in the North Sea, UK in July 1988
The Piper Alpha oil platform was an impressive sight. It stood one hundred feet above some
of the fiercest waters in the North Sea. Lights sprinkled around the huge accommodation
block designed to hold over two hundred men, gantries held aloft a burning torch, a proud
symbol of the thousands of tonnes of black gold it was pumping back to shore.
Occidental Petroleum was getting its money's worth; around 3 m a day, to be precise.
At its peak Piper Alpha accounted for 10% of the UK's North Sea oil production.
But in just a few hours, this marvel of engineering was reduced to a blackened, smoking,
stump. Most of the rig melted and fell away into the sea. Of the 225 men on board 167 died.
The catastrophe in July 1988 shocked the oil industry into realising that the dangers on a rig
like Piper Alpha were worse than they have possibly imagined. As Lord Cullen's public
enquiry rumbled on it also became clear that it was not an 'accident'.
They held the Occidental management directly responsible for a series of preventable
failings and errors.
Bad communication and organisation
Bad communication and organisation of the paperwork allowed a pump to be turned on while
it was in the process of being fixed. The subsequent gas explosion was, experts say,
survivable for most of the men, apart from the one or two who were probably killed instantly.
But there were no blast walls around this area, just fire-walls, and so an oil fire quickly took
hold. Two other rigs feeding into the same oil export line did not shut down until one hour
after the initial mayday, which meant oil from the other rigs, flowed back towards Piper and
fuelled the fire. The fire escalated out of control.
Gas pipelines ended in the area where the oil fire had started. They were eventually
ruptured in the heat and the explosion engulfed the rig in thousands of tonnes of burning gas.
Occidental had known about this danger; it was highlighted 12 months earlier in a report.
But no changes had been made and no protection was given to these vulnerable areas
which were a result of the rig having been converted to pump gas as well as oil.
The dozens of men trapped in the accommodation block knew that most of the rig was in
flames and thick black smoke seemed to be everywhere. Many must have hoped and
prayed that a helicopter would be able to land, but from the first explosion this was
impossible. The routes to the lifeboats were blocked, and they faced this situation helpless.
There was no message over the public address system telling them what to do.
The rig was falling to pieces in front of their eyes.
Most stayed where they were until smoke and gas fumed overcame them. The survivors
jumped 100 feet into the sea, contrary to the minimal training they had been given.
Lord Cullen's report concluded that Occidental had "adopted a superficial attitude" to safety.
Dr Tony Barrell, an expert on off-shore safety, says "There is an awful sameness about
these incidents. They are nearly always characterised by lack of forethought and lack of
analysis, and nearly always the problem comes to down to poor management."

Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz

Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 2 of 11

The Piper Alpha Oil Platform Catastrophe

Background and Events of the Disaster: Technical Viewpoint

Piper Alpha was an oil platform in the North Sea that caught fire and burned down on July 6,
1988. It was the worst ever offshore petroleum accident, during which 167 people died and a
billion dollar platform was almost totally destroyed.
The platform consisted of a drilling derrick at one end, a processing/refinery area in the
centre, and living accommodations for its crew on the far end. Since Piper Alpha was close
to shore than some other platforms in the area, it had two gas risers (large pipes) from those
platforms leading into the processing area. It processed the gas from the risers plus the oil
products it drilled itself and then piped the final products to shore.
The disaster began with a routine maintenance procedure. A certain backup propane
condensate pump in the processing area needed to have its pressure safety valve checked
every 18 months, and the time had come. The valve was removed, leaving a hole in the
pump where it had been.
Because the workers could not get all the equipment they needed by 6:00 PM, they asked for
and received permission to leave the rest of the work until the next day.
Later in the evening during the next work shift, a little before 10:00 PM, the primary
condensate pump failed. The people in the control room, who were in charge of operating
the platform, decided to start the backup pump, not knowing that it was under maintenance.
Gas products escaped from the hole left by the valve with such force that workers described
it as being like the scream of a banshee. At about 10:00, it ignited and exploded.
Force of the explosion
The force of the explosion blew down the firewall separating different parts of the processing
facility, and soon large quantities of stored oil were burning out of control. The automatic
deluge system, (which was designed to spray water on such a fire in order to contain it or put
it out), was never activated because it had been turned off.
About twenty minutes after the initial explosion, at 10:20, the fire had spread and become hot
enough to weaken and then burst the gas risers from the other platforms. These were steel
pipes of a diameter from twenty-four to thirty-six inches, containing flammable gas products
at two thousand pounds per square inch of pressure.
When these risers burst, the resulting jet of fuel dramatically increased the size of the fire
from a bill
owi
ngf
i
r
ebal
l
t
oat
ower
i
ngi
nf
er
no.Att
hef
i
r
e
speak,t
hef
l
amesr
eachedt
hr
ee
hundred to four hundred feet in the air and could be felt from over a mile away and seen from
eighty-five.
The crew began to congregate in the living accommodations area, the part of the platform
that was the farthest from the blaze and seemed the least dangerous, awaiting helicopters to
take them to safety. Unfortunately, the accommodations were not smoke-proofed, and the
lack of training that caused people to repeatedly open and shut doors only worsened the
problem.
Conditions got so bad in the accommodations area that some people realized that the only
way to survive would be to escape the station immediately. They found that all routes to
lifeboats were blocked by smoke and flames, and in the lack of any other instructions, they
made the jump into the sea hoping to be rescued by boat.
Sixty-two men were saved in this fashion; most of the other 167 who died suffocated on
carbon monoxide and fumes in the accommodations area.
Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz
Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 3 of 11

The Piper Alpha Oil Platform Catastrophe

The gas risers that were fuelling the fire were finally shut off about an hour after they had
burst, but the fire continued as the oil on the platform and the gas that was already in the
pipes burned. Three hours later the majority of the platform, including the accommodations,
had melted off and sunk below the water. The ships in the area continued picking up
survivors until morning, but the platform and most of its crew had been destroyed.
Events: Human Viewpoint
For a worker on the Piper Alpha platform the night of July 6, 1988, the events that occurred
would have been absolutely terrifying and would have required great personal strength and
courage to survive.
The panic and confusion that occurred were amplified by the facts that many of the workers
at any given time were contracted for and were therefore new to the platform and that a full
evacuation drill had not been carried out in over three years,
In fact, safety training was deficient all around. Workers in the control room were alerted by a
series of blaring gas alarms, and the rest first either heard the explosion or saw smoke.
People began to run through the station in confusion, which turned to panic as the fire and
explosions spread.
There were no clear orders announced over the speaker system at any point.
When they realized that there was a real danger on the station, some workers tried to reach
the lifeboats, but by that time all paths to them had been cut off. Likewise, a group tried to
reach the controls that would allow them to manually start the fire suppression system,
whose automatic start feature had been disabled, but they failed and none of them were ever
seen again.
Very soon, most people began heading to the accommodation area. There they were mostly
protected from the heat and flame for a while, but not the choking smoke. Men began to lie
on the ground with wet rags over their mouths and faces. Some of them realized that they
might die.
At one point, an important manager got on a table and began to speak, but no one could
hear or paid him any attention. It was too late for direction then.
Some people realized that the only way to safety was to jump into the sea. Men ran to the
railing, only to see a daunting drop of over a hundred and fifty feet to the surface of the
water, lit by the patches of flaming oil floating around the platform. Those who jumped had to
alternate between staying underwater and freezing in the frigid North Sea and keeping their
heads in the air to cook. Those who stayed behind died of carbon monoxide poisoning.
Stories from survivors illustrate how horrible the situation was. One man had just come to
the platform that day and had no idea where he was or how to get around. All he could see
was that he was on a walkway high up in a cloud of smoke. He made the decision that it
would be better to die from jumping and hitting the deck than from burning alive. He jumped,
fell into the ocean, and was rescued.
Another man was heard to call out a repeated request for anyone who worked for the same
company he did. When asked why he would do such a thing in such a situation, he replied,
"
Idi
dn
twantt
odi
eal
one.
"
In the end, 62 men were picked up from the water, many with severe burns and injuries.
167 more died and those who lived will have to do so with their memories of fear and loss for
the rest of their lives.
Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz
Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 4 of 11

The Piper Alpha Oil Platform Catastrophe

Causes and Shortcomings

There were several safety shortcomings that allowed the disaster to occur, each one of
which let the losses increase more than needed and caused safety regulations to change
dramatically on their examination in the following years.
They were:
Permit-to-Work System
Firewalls
Deluge System
Safety Training
Auditing
Risk Assessment

Permit-to-Work System:
This was a system of paperwork designed to promote communication between all parties
affected by any maintenance procedure done on the platform. Workers had to fill out a form,
which would then be submitted to a manager who would approve, cross reference, and track
it until the work was completed.
The system on Piper Alpha had become too relaxed. Employees relied on too many informal
communi
cat
i
ons
,suc
hasmer
el
yl
eav
i
ngt
hef
or
m onamanger

sdes
ki
nst
eadofper
sonal
l
y
giving to him, and communication between shift changes was lacking.
If the system had been implemented properly, the initial gas leak never would have occurred.
Firewalls
The firewalls on Piper could have stopped the spread of a mere fire. They were not built to
withstand explosion. The initial blast blew these down, and the subsequent fire spread
unimpeded, when it might have been contained has the firewalls withstood explosion also.
Newer stations have blast walls that would prevent a repeat of the initial phases of the Piper
disaster.
Deluge System
This was a system designed to automatically activate in case of a fire and spray water on it
to suppress it. Unfortunately, the platform manager had ordered that the automatic start
feature be turned off. Since there was no control for just that purpose, it was probably done
at the circuit breaker. The reason for his decision was to protect divers in the water near the
intake for the system.
Since divers were in the water up to half the time during the summer months, this meant that
the automatic deluge was off for half the time also, including when the disaster happened.
Disabling the system was a fairly common practice among similarly designed platforms, but
they had better luck than Piper did.

Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz

Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 5 of 11

The Piper Alpha Oil Platform Catastrophe

Safety Training
This was an extremely major problem. The workers on the platform were not adequately
trained in emergency procedures, and management was not trained to make up the gap and
provide good leadership during a crisis situation. Evacuation drills were not done nearly as
frequently as the official schedule of once a week, and a full drill had not happened in over
three years. Also, there was inadequate training in inter-platform communication.
When the other platforms realized that there was a problem on Piper, they simply assumed
that Piper would take care of it. They did not shut off the flow of gas that they were pumping
onto it for over an hour, effectively tripling or more the available fuel supply.
The problems with safety training were not a lack of decent training guidelines; the existing
guidelines were just ignored.
Auditing
Occidental Petroleum had regular safety audits of its facilities. These audits were performed,
but they were not performed well. Few if any problems were ever turned up, even though
there were serious issues with corrosion of deluge system pipes and heads and many other
issues. When a major problem was found, it was sometimes just ignored.
For example, about a year before the gas risers burst and burned the station down, an
independent audit whose purpose was to identify major fire risks correctly identified the
hazard and stated that if they every burst, nothing could save the station.
He recommended installing specific safety systems just to protect them.
In the board meeting that reviewed his report, the gas risers were never mentioned.
Risk Assessment
Those risers were clearly the primary risk on the platform, but nothing was done to protect
them. It was recommended that a specific deluge system be installed just for them, along
with an automatic valve that would seal them off at sea level in the event of an alarming
pressure loss, etc., but none of these measures was implemented.
Most modern platforms do have such features where they are appropriate.
Outcomes
Overall, 167 people died. A billion dollar platform was lost, along with up to ten percent of
Br
i
t
ai
n
soi
lpr
oduct
i
oncapabi
l
i
t
y
.
Thei
nsur
ancepaymentf
r
om Ll
oyd
sofLondon,whi
chcover
ed:
the value of the platform,
lost production, and
the 700 thousand dollars paid to every victim, among other things,

totalled a record 2.8 billion dollars, almost twice the second highest payment for a single
event besides a natural disaster such as a strong hurricane.
The oil industry was badly shaken, and a public inquiry was launched that recommended
many new safety procedure.
Government agencies were created to implement these changes in Great Britain.

Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz

Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 6 of 11

The Piper Alpha Oil Platform Catastrophe

Immediate Action on Offshore Safety

On the night of July 6, 1988, the Piper Alpha oil platform disaster took 167 lives which could
have been saved. Better safety procedures and training were desperately needed to
maintain the integrity of the British offshore oil industry.
The devastating effects of the Piper Alpha disaster warranted dramatic reforms that would
sweep the British offshore oil industry and revolutionize British offshore oil platform safety.
The central positive effects of the Piper Alpha incident were:
The Public Inquiry
As a consequence of the catastrophic events that occurred on the night of July 6th aboard
the Piper Alpha platform, the British government assigned Hon. Lord William Douglas Cullen,
a renowned Scottish judge, to oversee a public inquiry investigating the disaster and to write
a report addressing his findings.
Q: What is a public inquiry?
A: A public inquiry is an open government investigation that allows public observation and
includes expert testimonies and published conclusions.
Q: What were the objectives of the Piper Alpha public inquiry?
A: The Piper Alpha public inquiry had to answer two main questions:
Part 1 - What were the causes and circumstances of the disaster on the Piper Alpha platform
on July 6, 1988?
Part 2 - What should be recommended with a view to the preservation of life and the
avoidance of similar accidents in the future?
Q: How long did the Piper Alpha public inquiry last?
A: The process spanned about 13 months. Part 1 took 10 months; part 2 took 3 months.
Q: When was the public inquiry published?
A: Lord Cullen published the Piper Alpha report in November of 1990.
Lord Cullen's Recommendations
Lord Cullen executed his responsibilities to the British government by summoning 63 expert
witnesses to lend their knowledge of offshore platform design, management, and safety to
the Piper Alpha report.
The witnesses represented the United Kingdom Offshore Operators Association Limited
(UKOOA), the Health and Safety Executive (HSE), the Department of Energy (DEn), the
trades unions, the Department of Transport, and the Norwegian Petroleum Directorate.
Their testimonies provided the necessary expertise and evidence to formulate a formal set of
recommendations for the improvement of offshore safety.

Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz

Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 7 of 11

The Piper Alpha Oil Platform Catastrophe

The three core changes that Lord Cullen proposed to revolutionize offshore safety:
Formation of the Health and Safety Executive
Conversion to Goal-setting Regulations
Implementation of the Safety Case
Other important recommendations included a spectrum of Subjects

Health and Safety Executive

Because of constant confusion among platform operators in getting regulations approved by
authorities, the HSE was created and mandated to take over offshore responsibilities
previously carried out by the DEn, which did not have sufficient expertise to organize
effective safety methods for offshore oil platforms.
Q: What does the Health and Safety Executive do?
A: As the operating branch of the Health and Safety Commission, the Health and Safety
Ex
ecut
i
v
e(
HSE)ensur
est
hatr
i
skst
opeopl
e
sheal
t
hands
af
et
yf
r
om wor
kact
i
v
i
t
i
esar
e
properly controlled.
Q: How is the Health and Safety Executive organized?
A: The Health and Safety Executive consists of 16 divisions:
1.

Chemical Hazardous Installations Division

2.

Directorate of Science and Technology

3.

Electrical Equipment Certification Service

4.

Field Operations Directorate

5.

Health and Safety Laboratory

6.

Health Directorate

7.

HSE Information Services

8.

HSE Language Services

9.

Local Authority Unit and HELA

10.

Mines Inspectorate

11.

Nuclear Safety Directorate

12.

Offshore Safety Division

13.

Operations Unit

14.

Policy Unit

15.

HM Railway Inspectorate

16.

Safety Policy Directorate

Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz

Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 8 of 11

The Piper Alpha Oil Platform Catastrophe

Q: What special measures did the HSE take to ensure improvement in offshore safety?
A: In addition to its already extensive system of 15 specialized divisions, the HSE created a
new Offshore Safety Division (OSD) in April of 1991.
Q: What does the Offshore Safety Division do?
A: This division of the HSE ensures that risks to workers in the petroleum and diving
industries are minimal. Oil platforms are frequently inspected, operations are carefully
audited, and accidents and worker complaints are investigated to meet this objective.
Goal-setting Regulations
Lord Cullen specified that goal-setting regulations, which require certain objectives to be met
using appropriate methods, be implemented on offshore oil platforms to replace former
regulations, which imposed detailed measures that had to be taken invariably.
Non-mandatory guidance notes would accompany goal-setting regulations to facilitate
meeting goals effectively. Goal-setting regulations, though they may seem like a subtle
change in procedure, actually alter safety methods considerably. They allow more flexible,
platform-customized procedures to be used as opposed to the cut-and-dried, tedious
procedures mandated by former regulations.
Lord Cullen saw immediate need for conversion to goal-setting regulations in the following
areas:
Construction structure and layout of the installation and its accommodation
Plant and equipment plant and equipment of installation, especially those dealing with
hydrocarbons
Fire and explosion protection active and passive fire and explosion protection
Evacuation, escape, and rescue emergency procedures, life-saving appliances,
evacuation, escape, and rescue
The Safety Case
Q: What is a safety case?
A: A safety case is a written document in which a company must demonstrate that an
effective safety management system (SMS) is in place on a particular offshore installation.
Q: What is a Safety Management System (SMS)?
A: An integral part of the safety case, the SMS is a group of platform personnel that sets
safety objectives, a system to achieve those objectives, performance standards to be met,
and a system by which those standards should be enforced.
Q: Who proposed the safety case?
A: The UKOOA proposed the safety case as an offshore version of the onshore formal
safety assessment, or Regulation 7 of the Control of Industrial Major Accident Hazards
Regulations.
Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz
Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 9 of 11

The Piper Alpha Oil Platform Catastrophe

Q: What criteria must a safety case meet?

A: Safety cases must show that the SMS of the offshore installation is competent to ensure
that the design and operation of the installation are safe, that possibly major risks to workers
have been minimized, and that both a Temporary Safe Refuge (TSR) and a full evacuation,
escape, and rescue plan are in place in case of an emergency.
Q: What quantitative information supplements safety cases?
A: Quantitative risk assessment (QRA) allows structured, objective, numerical data to be
applied to the measurement of risk in order to make clear comparisons between the
effectiveness of safety methods. QRA focuses on demonstrating how probable a harmful
event is and how severe a particular consequence would be as a result of using a certain
safety measure.
Data provided by QRA must be applied with caution because they only serve to supplement
safety case, which is, in essence, a qualitative evaluation.
Q: What are the advantages of the safety case?
A: The safety case contributes to safety in the offshore oil industry largely because it takes
into account various types of offshore installations and tailors safety measures to their
different designs and modes of operation. Fixed and floating, shallow-water and deep-water,
gas-producing, oil-producing, gas- and oil-producing, unmanned, small-staffed, and largestaffed platforms all require very different regulations to be optimally safe, and the safety
case encourages the innovation and invention necessary to the development of new and
improved safety techniques that satisfy optimum safety requirements.
By focusing on the platform oper
at
or

sr
esponsi
bi
l
i
t
yt
omanageas
af
ewor
kpl
ace,t
hesaf
et
y
case enables major hazards to be identified and minimized early. The operator is so familiar
with his/her platform that he/she can pinpoint areas that need modification and activate these
modifications before the safety case is completed.
Other Recommendations
Subj
ect
sofLor
dCul
l
en
sOt
herRecommendat
i
ons
The other main areas that Lord Cullen specified changes for include the following:
Safety Committees and Safety Representatives
Each platform elects representatives who are trained to raise safety issues to the safety
committee or to management.
Emergency Shutdown Valves
Proper location of emergency shutdown valves and backup valves are essential to cutting off
fuel supply in case of a fire; above water positioning provides testing accessibility for vigilant
maintenance.
Sub-sea Isolation Systems
Sub-sea isolation systems, while difficult to maintain, provide protection against failure of
above-water emergency shutdown valves.
Fire and Explosion
Active and passive methods of fire explosion protection have been integrated into offshore
safety regimes.
Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz
Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 10 of 11

The Piper Alpha Oil Platform Catastrophe

Accommodations, TSR, Escape Routes, Embarkation Points

The TSR on each installation should normally be the accommodations module and should
have a breathable atmosphere through prevention of smoke ingress and provision of fire
protection; escape routes and embarkation points should be determined through safety
cases.
Smoke Hazard
Prevention of smoke ingress into TSR is available through smoke and gas detectors that
initiate smoke dampers and prevent circulation of smoke throughout the TSR.
Emergency Systems
Status lights and alarm systems have been standardized to increase awareness of disasters
in progress.
Evacuation and Escape
More than one route to helicopters and lifeboats must be present at any given time to ensure
evacuation of the platform in a crisis situation. To facilitate escape from a hazardous
situation, luminescent strips and heat shielding provide visibility in smoke and protection from
flames, respectively. Secondary escapes such as ropes, ladders, and nets are also available
as backup for the more sophisticated escape methods.
Helicopters
A very high frequency voice system now ensures that helicopters can be in constant touch
with air traffic controllers throughout the North Sea.
Totally Enclosed Motor-propelled Survival Craft
Each installation must have lifeboat capacity to accommodate 150% of people on installation
at any given time. Accessibility from the TSR to lifeboats has been improved, and free falling
lifeboats have been developed to more quickly and safely evacuate platform personnel.
Standby Vessels
At least one standby vessel within 5 miles of each installation must be available at any given
time to accommodate all platform personnel.
Command in Emergencies
Offshore installation managers must have met competency criteria and completed training to
take control in crises.
Drills and Exercises
Lifeboat stations, fire-fighting, breathing apparatus, and first aid are among training exercises
that must be completed by platform workers.
Training
In order to be permitted to work offshore, personnel must complete a basic emergency
survival course.

Issued by the New Zealand Safety Council ~ January 2006 www.safetycouncil.org.nz

Sour
ce:Cal
ami
t
ySof
t
war
ef
r
om
GoSaf
et
yPubl
i
shi
ngNSW

Page 11 of 11