“It was a terrible reminder of what can go wrong if we fail to manage risk properly in this business,” says PSA head Magne Ognedal.
The disaster began on the evening of 6 July with a gas leak from a condensate pump which had been shut down for maintenance. An operating problem meant that the other pump in this system was also taken out of service.
As the result of a communication failure, the control room started up the pump being maintained without realising that the work had yet to be completed.
A substantial leak of condensate and gas immediately occurred, and this ignited and exploded before anyone managed to intervene.
Everything had been peaceful at the Norwegian Petroleum Directorate’s head office in Stavanger. One of those at work when the first reports of the explosion ticked in was Ognedal, then the NPD’s safety director.
“I was in the office when I heard about the accident,” he recalls.
“I remember reacting at once, and wondering what on earth was happening. “The initial reports were short on details, and it was difficult to form an impression of what had occurred. But it soon became clear at this was a disastrous incident.
“We eventually got to see pictures of a platform ablaze. What we knew was limited, but all the signs indicated a major catastrophe.”
Piper Alpha was a big production installation with a steel jacket, operated by Occidental Petroleum and on stream since 1976. It had been built to produce oil, but was gradually converted to gas.
That partly reflected an increase in the share of gas produced as oil output declined, and partly gas being piped from nearby fields for processing and onward transport to land.
Since the facility was originally designed for crude, firewalls were dimensioned to protect against the heat of an oil blaze rather than the pressure of a gas explosion.
The blast accordingly blew out a number of panels in a firewall, and one of the fragments sliced through a condensate pipeline. That started another fire.
“More and more information began to come in about the scale of the incident, all those killed, the rescue efforts and what had happened,” says Ognedal.
“It was important for us as the Norwegian regulator to established what had occurred as quickly as possible in order to ascertain whether anything was relevant for the NCS.
“Little by little, we formed a picture of what had gone wrong, what lay behind the disaster. Soon afterwards, we asked all the players on the NCS to check the position on their facilities and undertake new safety studies.
“We were concerned to determine whether similar hazards existed in the Norwegian industry.”
Piper Alpha was originally built in accordance with recognised principles by putting the most safety-critical functions as far as possible from safe areas such as the control room and quarters.
However, these principles were breached when the platform was modified to receive and process gas from other installations. Locating the gas compression area close to the control room, for example, was significant for the progress of the accident.
The firewater pumps were supposed to start automatically when flames were detected, but they had been put in manual mode because diving was conducted from time to time near the installations.
It was assumed that the pumps could pose a threat to the divers if they got too close to the water intake while pumping was under way.
When the fire broke out, two people donned protective suits and tried to reach the pump room to start them manually. They were never seen again.
A public inquiry into the disaster, chaired by Scottish high court judge Lord Cullen, began work in November 1988 and requested input from the NPD. This contribution took the form both of written submissions and appearances at the open hearings held in Aberdeen, Scotland’s oil centre.
“I was called as a witness by the Crown Office,” says Ognedal.
“The inquiry showed great interest in the way we handled things in Norway. “Three assessors visited us for a week before the actual hearing began. The British knew little about the way we worked and were looking details.
“They wanted to know how we thought and why we did things in a particular way. We provided information and answers as best we could, explaining why our regulations took the form they did and how our regulatory regime functioned.”
Days 169-170 of the Scottish hearings – 10-11 January 1990 – were devoted to Ognedal’s testimony.
“I sat there in the witness box and looked up at the bench with Lord Cullen in the centre,” he recalls.
“The atmosphere was deeply serious. A lot of people were present. “Representatives of the various players paid close attention. The procedure was that I’d brought a written statement with me, which I was required to read out in the courtroom.”
Once that had been done, the questioning started from Lord Cullen, the assessors and legal counsel for the various parties. The whole process lasted almost 10 hours.
“All kinds of questions were put, covering different issues and varying angles,” Ognedal says.
“They were clearly interested in understanding what we did and thought in Norway.”
The emergency shutdown system on Piper Alpha was activated as soon as the explosion occurred, and the fire should therefore have died out by itself.
But it was maintained and strengthened because the Tartan and Claymore fields continued to send gas to the platform. This was fed into the heart of the blaze through the broken piping. The control room had to be evacuated less than 10 minutes after the first explosion, preventing further messages being sent over the public address system.
Organising the response became very difficult.
Published in November 1990, the Cullen commission’s 800-page report directed harsh criticism at Occidental and Britain’s energy department. It also recommended a long list of measures for improving safety on the UK continental shelf, Ognedal relates.
“There were 106 of them. We evaluated each one carefully to see how we took care of it on the NCS. Virtually all the Cullen recommendation were already in place here.”
Emergency response procedures had required the personnel on Piper Alpha to take to the lifeboats, but the fire made that impossible and many sought refuge in the living quarters. These were supposed to be protected from the process area by a firewall.
A number of people opted to jump into the sea, and the majority of the survivors were rescued by vessels already in the area or which headed for it.
The flames, smoke and wind direction made helicopter evacuation impossible, and smoke and fumes eventually began to penetrate the quarters.
Tartan and Claymore were still producing because their platform managers could not shut down without clearance from land. They also lacked a clear picture of conditions on Piper Alpha.
The disaster led to a complete overhaul of Britain’s offshore safety regime, including the transfer of responsibility for safety from the Department of Energy to the Health and Safety Executive.
These changes were inspired to a great extent by the Norwegian model, including the allocation of responsibility and the regulatory regime as well as the legal framework Norway had adopted the internal control principle in the 1980s.
This had been extensively criticised and widely questioned, particularly abroad, but the critics fell silent in the wake of the Cullen report.
“It confirmed that our thinking had been correct,” affirms Ognedal.
“I’d been to a number of conferences and talked about the internal control concept and its philosophy.
“I can certainly affirm that this hadn’t won much acceptance, and my presentations were always followed by plenty of discussion. But then came the inquiry. “Lord Cullen referred to Norway and stressed the significance of local management and safety systems. There wasn’t so much argument after that.”
After Piper Alpha had been burning for 25 minutes, the 45-centimetre-diameter riser from Tartan ruptured from the heat. Its internal pressure was 160 bar. A huge fireball enveloped the whole platform, with flames leaping more than 100 metres into the air. The fire was further reinforced when the Claymore riser fractured 25 minutes later.
Two hours after the first explosion, Piper Alpha broke up. The bulk of the topside, including the quarters, disappeared beneath the waves.
The disaster claimed the lives of 165 of the 226 people on board when it happened. Two people were also killed on a standby ship taking part in the rescue operation.
“Could the Piper Alpha accident happen today?” Ognedal asks rhetorically. “I think it could. We have better equipment, know more and are better at risk management, so the probability is lower. But that’s no guarantee.
“The disaster was – and remains – a powerful reminder that this industry has a high accident potential and that managing the risk is a challenge.
“You might then ask whether, with the equipment, the knowledge and the tools we now have, things don’t run of their own accord? The answer is that they most assuredly don’t.
“We’ve seen many incidents since Piper Alpha with a big potential to become a major accident, and which could easily have developed into one. That also goes for the NCS.
“The level of risk in this business is high, but can be managed. That demands full attention –24 hours a day, seven days a week throughout the year. The industry can never relax.”