INDUSTRIAL ACCIDENTS

LANDMARK INCIDENT

FABIG classifies Piper Alpha as a landmark incident. It was the world’s worst offshore oil industry disaster. The loss of life was staggering; 165 men (out of 226) on board the platform and two men on board a rescue vessel died, and dozens were badly injured.

The Cullen Inquiry into the incident, published in 1990, made 106 recommendations. Two of the most significant outcomes were the transfer of health and safety responsibilities for offshore installations from the UK Department of Energy to the UK Health and Safety Executive in 1991, and the development of Offshore Installation Safety Cases. Under the Offshore Installations (Safety Case) Regulations 1992, operators became required to submit a statement demonstrating that their management systems cater for all potential major accident hazards, and that the residual risks are (or will be) as low as is reasonably practical. Regulations changed from being prescriptive to goal setting, whereby flexibility of approach and innovative solutions at the corporate level are provided for. The recommendations also had a direct international impact, leading other countries (e.g. Australia, the Netherlands) to adopt the safety case and goal setting concepts.

The Fire and Blast Information Group (FABIG) was created in 1992 as a direct result of the research into hydrocarbon fires and explosions that was necessitated by the Piper Alpha disaster.

WHAT HAPPENED

The Piper Alpha platform was commissioned in 1976 as an oil platform, but was modified in 1978 to act in addition as a major gas processing and gathering hub. It received gas from two platforms (Tartan & Claymore) through two gas risers leading into the processing area. It processed the imported gas as well as the oil products it drilled itself and then piped the final products to shore. It was therefore handling large amounts of high-pressure gas.

The disaster began with a routine maintenance procedure. On the morning of the 6th of July, a backup propane condensate pump (pump A) in the processing area needed to have its pressure safety valve (PSV) checked and this required the valve to be demounted. The PSV was lifted by a crane and taken to the workshop. The work could not be completed by 18:00 and the workers asked for and received permission to leave the rest of the work until the next day. The open pipe was secured with a blind flange and pump A was isolated to stop it being activated. While pump A was isolated and its PSV removed, condensate injection continued using the parallel primary pump (pump B).

Later in the evening during the next work shift, pump B failed. The operators (not aware that the PSV on the line connected to pump A had been removed) believed they could get production re-started by removing the electrical isolation and restarting pump A. Soon after pump A was re-started, the blind flange started leaking hydrocarbon vapour at high pressure. The vapour cloud found a source of ignition and exploded, blowing through the firewalls. The fire spread, destroyed some oil lines and soon large quantities of stored oil were burning out of control. The automatic deluge system, which was designed to spray water on such a fire in order to contain it or put it out, was never activated because it had been turned off to protect divers who periodically worked near the water inlets to the fire water system.

About twenty minutes after the initial explosion, at 22:20, the fire had spread and become hot enough to weaken and then burst the gas risers from the other platforms. These were steel pipes of a diameter from 24 to 36 inches, containing flammable gas products at two thousand pounds per square inch of pressure. When these risers burst, the resulting jet of fuel dramatically increased the size of the fire.

The accommodation module was not smoke-proofed, and the lack of training that caused people to repeatedly open and shut doors only worsened the problem. Conditions got so bad in the accommodation module that some people realized that the only way to survive would be to escape the station. They, however, found that all routes to lifeboats were blocked by smoke and flames, and in the absence of any other instructions, they made the jump into the sea hoping to be rescued by boat. Sixty-two men were saved in this fashion; most of those who died suffocated on carbon monoxide and fumes in the accommodation module.

WHY IT HAPPENED

Several shortcomings allowed the disaster to develop, each contributing to the escalation and adding to the losses.

Permit-to-Work System (PTW)

This was a system of paperwork intended to promote communication between all parties affected by any maintenance activity on the platform. Workers had to fill out a form, which would then be submitted to a manager who would approve, cross reference, and track it until the work was completed. The PTW system was often not implemented according to procedure. For example:

• Omissions (e.g. signatures and gas test results) were common;
• Operations representatives often did not inspect the jobsite before suspending the permit at the end of the shift, or close the permit indicating the work had been completed;
• Supervisors often left permits on the control room desk at the end of a shift, rather than personally returning them to the responsible operations representative, as required by the procedure.

Firewalls

The firewalls could have stopped the spread of a fire but were not built to withstand an explosion. The initial blast blew these down, and the subsequent fire spread unimpeded.

Fire water pumps

The system was designed to automatically activate in the event of a fire and spray water on it to suppress it. The platform manager had ordered that the automatic start feature be turned off to protect divers in the water near the intake for the system (a fairly common practice among similarly designed platforms). Since divers were in the water up to half the time during the summer months, this meant that the automatic deluge was off for all that time also, including when the disaster happened. Since there was no control for just that purpose, it was probably done at the circuit breaker.

Safety training

The workers on the platform were not adequately trained in emergency procedures, and management was not trained to make up the gap and provide good leadership during a crisis situation. Evacuation drills were not done as frequently as the official schedule of once a week, and a full drill had not happened in over three years. There was also inadequate training in inter-platform communication. When the other platforms realized that there was a problem on Piper Alpha, they did not shut off the flow of gas that they were pumping onto it for over an hour, effectively tripling the available fuel supply. While training guidelines existed, they were not properly followed.

Safety audits

Safety audits often did not identify the problems that existed. When a major problem was found, it was sometimes ignored. For example, about a year before the accident, an independent audit whose purpose was to identify major fire risks correctly identified fire risk to the gas risers and stated that if they every burst, nothing could save the platform. It recommended installing specific safety systems (a specific deluge system with an automatic valve that would seal them off at sea level in the event of an alarming pressure loss) but his was not acted upon.

IMPLICATIONS FOR THE REGULATORY FRAMEWORK

Creation of the Health and Safety Executive Offshore Safety Division

The Offshore Safety Division (OSD) was established as a division within HSE in 1991 in response to recommendations of the Cullen Inquiry. At the time of the disaster, the Department of Energy (DEn) was responsible for both production and offshore safety; this was perceived as entailing a conflict of interests. The Offshore Safety Act 1992 made the Mineral Workings (Offshore Installations) Act 1971 and its subsidiary Regulations relevant statutory provisions of the Health and Safety at work etc., Act 1974. The OSD's initial responsibilities included the establishment of the Safety Case Regulations; a thorough review of existing safety legislation and the move towards a goal setting regulatory regime. OSD became part of the HSE's new Hazardous Installations Directorate in 1999; it became part of the new Energy Division in 2013.

Performance based standards

The offshore regulatory regime became one in which the emphasis was on the operator demonstrating to the regulatory authority the safe design and operation of its installation rather than demonstrating mere compliance with regulations. Regulations became goal-setting instead of prescriptive. The Offshore Safety Act 1992 which amongst others extended the application of Part I of the Health and Safety at Work Act 1974 came into force. A great deal of new regulation followed. Notable legislation included:

• The Offshore Installations (Safety Case) Regulations (OSCR) 1992, No. 2885. These have since been replaced by The Offshore Installations (Safety Case) Regulations 2005 (OSCR);
• The Offshore Installations (Prevention of Fire Explosions and Emergency Response) Regulations 1995, No. 743 (PFEER) (as amended in 2005 and 2015), called for demonstration of performance criteria - that is, if any assessment used any performance criteria in the Emergency Response assessments, they have to be stated and justified;
• The Offshore Installations and Wells Design and Construction etc, Regulations 1996, No. 913 (DCR) called for the correct and appropriate design, operation, maintenance and ultimate abandonment of the installation;
• The Offshore Installations and Pipeline Wells (Management and Administration) Regulations 1995, No 738 (MAR) goes deeper and addresses safety management systems including weather data.

Formal Safety Assessment (FSA) became the means to demonstrate compliance with goal-setting regulations or with the general requirements of the Health and Safety at Work etc. Act (HASAWA). A FSA is formalised in a safety case - a written document in which the operator must demonstrate that an effective safety management system (SMS) is in place on a particular offshore installation. The SMS sets safety objectives, a system to achieve those objectives, performance standards to be met, and a system by which those standards should be enforced. Safety cases must demonstrate that the SMS of the offshore installation can ensure that the design and operation of the installation are safe, that possible major risks to workers have been minimized, and that both a Temporary Safe Refuge (TSR) and a full evacuation, escape, and rescue plan are in place in case of an emergency.

Demonstration is usually by Quantitative Risk Assessment (QRA) so that structured, objective, numerical data is applied to the measurement of risk in order to make clear comparisons between the effectiveness of safety methods. QRA focuses on demonstrating how probable a harmful event is and how severe a particular consequence would be as a result of using a certain safety measure. With respect to the TSR, the QRA requires setting criteria which define the failure of the TSR, its endurance and its failure frequency. Performance could then be demonstrated by reducing the frequency of accidental events, increasing the durability of the TR or by some combination of these.

IMPLICATIONS FOR DESIGN AND OPERATION

Design issues with emphasis on preventing and/or mitigating explosions and fire and their impact

• Blast and fire walls should be designed to ensure the separation and protection of sensitive modules and safety critical equipment. Both the fire and explosion rating of the protection should be adequate to resist credible fire and explosion scenarios;
• The design of the TSR should be such that it is protected from fire and explosion, pressurized, and specified with an HVAC system with automated fire dampers to prevent the ingress of smoke and gas;
• The design must ensure that more than one route to helicopters and lifeboats is present at any given time to ensure evacuation of the platform in a crisis situation. To facilitate escape from a hazardous situation, the design should include luminescent strips and heat shielding to provide visibility in smoke and protection from flames, respectively. Secondary escapes such as ropes, ladders, and nets should also be available as backup for the more sophisticated escape methods;
• Each installation must have lifeboat capacity to accommodate 150% of people on the installation at any given time. Free-falling lifeboats should be introduced to more quickly and safely evacuate platform personnel;
• At least one standby vessel within 5 miles of each installation must be available at any given time to accommodate all platform personnel;
• Emergency equipment needs to be designed for the emergency scenarios under which it may be required to function and meet its design intent;
• Control and communication centres should be remote from hazardous areas;
• ESDVs should be installed to protect against large hazardous inventories in pipelines, and should be protected from fire and explosion;
• Hydrocarbon inventories should be limited. This may be achieved using “not normally manned” platforms as collector hubs;
• Diesel tanks should be located away from process plant.

Operation and maintenance issues with emphasis on preventing and/or mitigating explosions and fire and their impact

• A new permit to work system is required. It should provide workers and supervisors with more communication about ongoing work. It should comprise a tiered authorization and central coordination of permits, clear visibility of the status of work, computer-based permit information and tracking system, enhanced control of isolation and formal training and audits. A platform coordination facility should contain a permit rack of all current permits, a permit location board to display all areas undergoing work, and an isolation diagram to display all isolated areas. The facility should also contain a permit tracking and information system providing management information, shift and crew hand over reports, permit information and information in case of emergencies. All isolations have to be clearly displayed or marked at the platform information centre and included in the new permit to work system to provide assurance that the isolations are authorized and properly controlled;
• Offshore installation managers must have met competency criteria and completed training to take control in crises;
• Lifeboat station mustering, firefighting, breathing apparatus usage, and first aid are among training exercises that must be completed by platform workers;
• A critique of drills and exercises should be used as a basis for continuous improvement of emergency plans. Emergency drills need to include major incident scenarios in which the chain of command may be impaired;
• In order to be permitted to work offshore, personnel must complete a basic emergency survival course;
• Periodic safety audits must be performed and problems with safety systems must be resolved in a timely manner;
• Emergency equipment must be maintained and periodically tested to assure its fitness for purpose and reliability.

Assimilation of information and generation of new knowledge

• Two major joint industry projects, the first phase (a desk study leading to The Interim Guidance Notes for the Design and Protection of Topside Structures against Fires and Explosions) in 1990-1991 and the second phase in 1994-1997 (with full scale experimental studies on explosions, jet fires in the open, confined jet and pool fires and explosion and fire model evaluation against test results);
• Establishment of the Fire and Blast Information Group (FABIG) in 1992;
• Further medium and full scale experimental studies on gas dispersion and explosions.

As a result of research into explosions it became possible to identify areas within the process where high overpressure may occur and then to reduce these overpressures by redesign of the piping/equipment congestion or to reinforce blast walls so as to prevent escalation.

The research on fires - particularly in partially confined environment typical of offshore modules - has resulted in a better understanding of fire mechanics. Knowledge of the rate of generation of carbon monoxide and soot has enhanced the understanding of the Temporary Safe Refuge impairment mechanism and the escape potential. Knowledge of the temperature profiles and heat flux at flame engulfed structures (pool and jet fires) can be used to identify structurally critical steel members and an assess the correct level of passive fire protection.

USEFUL RESOURCES

1. The Public Inquiry into the Piper Alpha Disaster (The Cullen Report)
   1. Volume 1, The disaster, November 1990
   2. Volume 2, The Future, November 1990
2. Blast and Fire Engineering for Topside Structures
   1. Phase 1, State of the art, 1992
   2. Phase 2, Selby, C.A. and Burgan, B.A., Blast and Fire Engineering for Topside structures Phase 2 Final Summary report, SCI P253, The Steel Construction Institute, 1998
   3. Phase 3a, Explosions in full scale offshore module geometries (main report), OTO 1999 043, BG Technology, April 2000
   4. Phase 3b, D.M. Johnson; R.P. Cleaver; J.S. Puttock; C.J.M. Van Wingerden, Investigation of gas dispersion and explosions in offshore modules, Offshore Technology Conference, Paper Number: OTC-14134-MS, Houston, Texas, May 2002
3. Interim Guidance Notes for the design and Protection of Topside Structures against explosion and fire, SCI P112, The Steel Construction Institute, 1992
4. FABIG Technical Meetings and Webinars
   1. On the modelling of gas explosions: A historical review, September 2020, www.fabig.com/publications-and-videos/online-lectures-webinars/webinar-010
   2. Major hazards research since 1990: Fires, September 2020, www.fabig.com/publications-and-videos/online-lectures-webinars/webinar-009
   3. Offshore major hazards research 1990-2000: Dispersion and explosions, July 2020, www.fabig.com/publications-and-videos/online-lectures-webinars/webinar-008
   4. Major accidents in the oil & gas industry, follow-up research and lessons learnt, July 2020, www.fabig.com/publications-and-videos/online-lectures-webinars/webinar-007
   5. Managing Fire & Explosion Hazards in a Low Oil Price Environment, March 2018, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-094
   6. Advances in Fire & Explosion Engineering Since Piper Alpha (Session at Oil & Gas UK Piper 25 Conference), June 2014, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-075
   7. Designing an Integrated Fire and Explosion Strategy, September 2007, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-051
   8. Managing Explosion Risks, Mau 2007, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-050
   9. Disseminating the lessons learnt from recent onshore and offshore accidents, December 2006, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-048
   10. Fire Resistant Design for Offshore Structures, October 2003, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-036
   11. Passive Fire Protection, July 2003, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-034
   12. Structural Design of Offshore Facilities for Blast Loads, February 2003, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-031
   13. Phase 3B Fire and Blast Joint Industry Project, June 2002, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-027
   14. Process Integrity and its Role in Mitigating Fire and Blast, December 2001, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-024
   15. Human Factors Engineering Vs. Design of Offshore Structures, June 2001, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-022
   16. Mitigation, September 2000, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-020
   17. Fire - Phase 2 and beyond, May 1999, https://www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-017
   18. Inherently Safe Design, January 1997, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-009
   19. Explosion Mitigation with Water Deluge, September 1996, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-008
   20. Performance Standards Approach in Offshore Installations Regulations (PFEER - Prevention of Fire and Explosion, and Emergency Response), October 1995, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-007
   21. Bang: A Historical Overview of Hydrocarbon Explosions, May 1994, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-003
   22. Active Explosion Suppression Systems, October 1993, www.fabig.com/publications-and-videos/technical-presentations-videos/technical-meeting-001