PiperAlpha: 20 Years on01 August 2008

On 6 July 1988, at about 10.00pm, Occidental's Piper Alpha platform, operating 120 miles off the north east coast of Scotland, exploded in a ball of flames 120m high. 167 people died and many others were horrifically injured as they jumped or fell into the sea 30m below. The insured loss was £1.7 billion. Lord Cullen's ensuing inquiry revealed a catalogue of management failings, as well as construction, engineering and operational inadequacies that would be inconceivable today.

Or would they? Have we really learned the lessons of that terrible night? Have Cullen's 106 recommendations - which cut across the industry, the regulator and government - been fully implemented? Are risk assessments as thorough as they should be? Have plant managements instilled adequate safety cultures? Are maintenance and operations as joined up as we now know they need to be? Events such as the Esso Longford Australia natural gas plant explosion in 1998, Brent Bravo in 2003, and Buncefield and BP's Texas City explosions in 2005, suggest not quite.

Part of Piper Alpha's problem was rooted in its conversion from oil to gas production in the late ?80s, which resulted in some safety protection being compromised - specifically, gas compression plant was installed adjacent to the control room. Part also was in its structural engineering, which, although it met fire containment standards at the time for onshore major hazard plant, was never designed for large-scale, deep-sea offshore operations, much less the risks of gas production.

Management failings

As for the management regime, the list of failings is long. Occidental's risk management and emergency response organisation displayed a staggering lack of understanding of major hazard operations. It was a ?no news is good news' culture. Even the installation manager had not been trained in offshore response. Most died waiting for rescue that never came - in inadequate refuge, poorly protected from smoke and heat, without communication. Equally, shift leaders on adjacent platforms, who could see what was happening, were not empowered to take decisions as momentous as shutting down - and so, incredibly, continued pumping oil into the blaze.

However, what set in motion the devastating chain of events that night was nothing more sinister than a defective permit to work system. Routine fortnightly maintenance was being performed on one of two condensate pumps that compressed the gas for transport to the mainland. An associated, but remote, pressure relief valve had been removed and the line covered with a blind flange. As work was not completed by shift end, it remained there and a report was filed with - but not acknowledged by - duty management.

Within hours of the next shift starting, the other condensate pump failed, threatening to stop production. So, with the pressure on to keep the plant online, rapid checks were made that the pump in maintenance could be reinstated and, without readily available records indicating the absent relief valve, it was restarted. Gas leakage past the blank was immediate, alarms went off, but the initial explosion happened before anyone could react - ripping apart the control room firewall, which was not blast-proof.

From that point on, the platform's fate was sealed. Although gas production had stopped, with the plant's custodian initiating closure of valves in the sea lines, pieces of the firewall had smashed through a condensate line, causing another fire, initially fuelled by the on-board inventory, then by fresh oil and gas still pumping from Tartan and Claymore. Finally, the now massive fire melted first one and then the second of two nearby gas lines running at 120bar - instantaneously ejecting gas at a rate equivalent to the entire consumption of the UK into an area just 75 metres square, and causing massive detonations that, between them, destroyed what was left of the platform.

'We had all worked on these things for many years, but I don't think anybody had any idea that there could be that extent of devastation,' says Jake Molloy, general secretary of OILC (Offshore Industry Liaison Committee - now part of the RMT union), but on that fateful night, a process assistant on Shell's Brent Delta platform. 'To see it completely destroyed like that was utterly unbelievable.'

Nobody knew. Today, following Cullen and subsequent experience, we do know, so how are we faring? Ian Waldram, past president of IOSH (Institution of Occupational Safety and Health) and formerly a safety and health manager with Mobil, believes that, while most of Cullen's requirements have long since been met, key lessons are being forgotten. That's particularly the case, he says, with newer engineering blood, untouched by the horror of serious incidents. Which is a problem, given the haemorrhage of experienced engineers to projects around the globe. A thinly spread knowledge pool, a legacy of ageing plant and the HSE still calling upon the industry to bear down on hydrocarbon releases is hardly a recipe for safety.

Radical shake-up

However, it's not all bad. 'Prior to Piper Alpha, there were compliance standards for design and operations, but some weren't evidence-based,' observes Waldram. 'So, for example, the effects of explosions on offshore structures weren't factored in - ratings were based on carbonaceous fires, rather than hydrocarbon fires or explosions.' Since the standards were prescriptive, they had effectively stifled innovation and failed to keep up with advances in technology and usage.

Following Cullen, however, the design and operations approach changed completely to goal-setting standards, driven by a safety case that demonstrates understanding of the fundamental hazards - with mitigation and acceptable risks based on in-depth analysis, ultimately resting on the ALARP (as low as reasonably practicable) principle and cost/benefits. Chris Allen, health and safety director of the offshore industry association Oil and Gas UK - at the time in charge of safety for the Alwyn North offshore installation for Total - sees that as evidence of lessons certainly learned.

'The change to a safety case regime was of fundamental importance,' he says. 'Since Piper Alpha, all organisations have had to carry out detailed hazard analyses to identify the risks on their particular installations, building precautions into the design and showing all mitigation. And it wasn't just about the regulations: the role of the regulator was found to be lacking, so responsibility moved from the Department of Energy to HSE, which set up its offshore safety division, and has since provided much higher levels of competence and professionalism.'

And there's the hardware. 'Post Piper, research demonstrated the results of explosions in confined and semi-confined spaces, and the industry developed structures to mitigate worst case over-pressures and temperatures. It also realised that, unless you cut off the fuel supply, even with the right structure, the installation won't survive,' explains Waldram. So wholesale changes were made to minimise the impact of major inventory on platform topsides and the industry invested massively in pipeline isolation valves on the seabed, protected emergency shutdown valves, deluge systems etc - at an estimated cost of some £1 billion.

Beyond that, Allen also refers to specifics around post-event safety: temporary refuge, protected and hardened against explosion, smoke and flames, etc. 'More than half of Cullen's recommendations were around evacuation, escape and rescue, with a focus on training and testing exercises. That was a key lesson, and nowadays installation managers are properly trained and assessed, and the industry runs courses for emergency teams, with simulators designed to throw everything at them.'

There's also the issue that, no matter how state-of-the-art and robust the technology, it has to be operated and maintained safely. In the end, that's always about people, processes and good management. So, as Allen observes: 'For any industry, another of the lessons is the importance of good permit to work systems and formalised handovers between shifts.'

And he continues: 'On Piper Alpha, they didn't know those systems weren't robust because they hadn't audited them. If managers take away nothing else, they should be asking themselves, do they really know what's going on? Are they getting good quality audit information on a regular basis? You cannot assume that everything is ok, because you haven't heard to the contrary. As a manager, you should always be hearing news about safety and, if not, you should be worried.'

Waldram agrees and adds: 'However good your engineering design, both operations and maintenance are intrinsically linked with people, so they have got to understand them and their roles. For example, when you're maintaining plant, you lose some of your barriers to risk. So under what circumstances and whose authority do you shut down?'

The bottom line is the point made in last year's Buncefield Major Incident Investigation Board (MIIB) report: any organisation facing major hazards must be set up to encourage all people to work together safely. And that requires leadership from the top, but also an imperative for safety responsibility throughout the entire organisation. It's also not just about authority, but keeping eyes on the right balls, and focusing on a cycle of training and audit.

And here's another point: 'For too long, industry has been looking at lost time injury rates,' warns OILC's Molloy. 'You see people policing people climbing stairs properly and checking they've got protective equipment on. But then they fail to educate the workforce about major hazards and the process systems they're working with. Why are maintenance engineers not better educated about the purpose of that equipment? Why don't they accompany inspectors to enhance their competency and help minimise the potential for events?'

Allen speaks for many when he agrees that the focus on occupational safety has, to some extent, been at the expense of process safety. 'I think the industry had been somewhat lulled into a false sense of security by good occupational safety figures. We're now raising technical process safety up the agenda. You wouldn't judge an airline's safety by its injury rates among cabin crew.' Nevertheless, there have been improvements. 'Before Piper, there was strong resistance to safety representatives offshore,' comments Waldram. 'Post Piper, legislation requires safety representatives to be elected by the workforce offshore. And that's about workers being eyes and ears, providing early warning of potential plant maintenance and operational safety issues.'

Warning signals

Sadly, however, he concedes that you'll still find people quoting examples of managers ignoring workers' views - and that's certainly Molloy's experience. 'The Brent Bravo incident in 2003 [when a huge gas release filled one of the platform's three concrete legs directly beneath the accommodation block, killing two, but putting another 150 at risk] proves that the industry is still failing on workforce involvement,' he insists. 'And look at the Maersk Janice floating production installation, shut down in 2007 and only just restarted. Throughout last year, the workforce made complaints over temporary repairs. In the end, instead of a few days shut down for proper, timely correction, the HSE had to shut Maersk down for eight months.'

His personal view: 'Workforce dissent serves as an important warning signal of danger ahead, or of organisational decline. Industry leaders need to realise that dissent is not itself a crisis: it is a priceless insurance against disaster. If that lesson had been learned, and workers empowered to the point where they could intervene, those two men on Brent Bravo wouldn't have died.'

Instead, management still applies what's termed NRB (not required back), he says. 'Remember, 90% are contract workers and can be told at any time that they're no longer required back. Nine times out of 10, it's down to management being challenged on health and safety. Middle mangers need to be trained to understand that the workforce can have valid input into safety - and that Cullen concluded they have a right to do that.'

Taf Powell, manager of the Buncefield MIIB, believes that getting all this right is about money and understanding. 'You've got to look at the cost of Buncefield: not just the incident, but the cost to the local economy. We all understand ALARP - you can keep on spending but, in the end, with diminishing returns. But the sheer scale of Buncefield should recalibrate the threshold. Before, operators and the regulator took the view that the design safety event was a very large tank fire. When that becomes a violent exposition, the ALARP boundary changes dramatically.'

And tellingly: 'I recall a year or so after Piper Alpha, the industry said we must do everything possible. But then costs were getting a bit high and the debate was around whether ALARP should be about the floor on which we stand, or the ceiling to spending. I believe that both Piper Alpha and Buncefield show that ALARP must be the ground on which we stand and then the sky's the limit for the best companies. As someone said, if you think safety is expensive, try having an accident.'

Pointers
- Evidence-based, goal-setting standards are key to the safety case - but so is good practice
- Emergency shutdown and alarm hardware are essential, but so are calibration and testing
- Never neglect safety training and testing
- Permit to work and handover processes must be bulletproof and audited
- Safety responsibility must be plant-wide
- Engineers need to know the purpose of plant they are maintaining
- Ageing installations and young engineers are among today's greatest safety challenges
- Insistence that an event could not have been foreseen is no defence in the eyes of the law

Today's key challenges
There are two key challenges for major hazard plants going forward, according to Oil & Gas UK's
Chris Allen. One concerns ageing installations; the other, people - and keeping the appalling lessons of Piper Alpha alive.

'We have a much longer future ahead of us in the North Sea. On Alwyn North, for example, the original project approval was for 11 years to finish in 1998. In 2008, the installation celebrated 21 years and now there's another 20-30 to go, because technology has improved, they've developed small satellite fields and tapped into the infrastructure.

'So the issue is asset integrity. That requires senior management to be able to measure performance against safety standards - and that means maintenance management systems should have a means of tracking, for example, the closing time of emergency shutdown valves, to calibrate their fire protection against a gas release of a certain size, as laid out in the safety case.

'That requires a very joined-up maintenance and inspection regime with robust auditing, and it's proving hugely expensive. In the 1990s, industry didn't expect to be around 30 years later, so there is some catch-up to do. We estimate that the offshore industry has spent £3 billion on asset integrity in the last three years and will spend a further £1.5 billion this year in the UK sector alone.'

As for people and lessons, Allen agrees that the 20th anniversary of Piper Alpha has rekindled the focus, but warns: 'This is a serious challenge for management, not only in the major hazard industry, but on downstream plants with all sorts of processes. Thankfully, we cannot rely on low-frequency, high-consequence accidents, like Piper Alpha, to keep people alert. So it's about how do you keep the focus on safety?'

Oil and Gas UK's answer is multi-faceted, including training for new generations of engineers and technicians, run by the industry skills academy OPITO. There's also a DVD, available free from the organisation. 'We've produced a docudrama of the events on that night, pulling out the lessons and focusing on process safety, industry management, and the crucial roles of everyone working onshore and offshore to minimise the chance of another Piper Alpha ever happening again.'


Golden thread of engineering
With the caveat that he must be circumspect in his comments, given that decisions are pending on potential prosecutions over Buncefield, Taf Powell, manager of the Buncefield Major Incident Investigation Board (MIIB), says that, although the major hazard industry is well regulated - particularly with everything that's enshrined in the safety case approach post Piper Alpha - there remain challenges.

'The safety case is key, but the offshore industry recognised that you can't undertake quantitative risk assessments for everything, so you also need to encapsulate good engineering practice and technical standards. That's a golden thread that's not been maintained adequately over the years. And taking that into onshore plants gives cause for concern. In our initial design and operations report, we called for standards to be updated, clarified and expressed in terms of outcomes - so that the regulator and operators know what needs to be achieved.'

Getting to specifics, though, Powell observes that similar risks are not being controlled in a consistent fashion. He gives the example of tank overfill protection and comments: 'There will always be compromises to make configurations and instrumentation applicable, but a consistent approach, expressed in standards, seems eminently more sensible than a first principles approach every time.'

Then there's emergency preparedness: 'The emergency response at Buncefield was heroic, but, because of the scale, unplanned. Going back to Piper Alpha, the loss of a platform was just not considered feasible and in that case most died waiting for rescue that never came. The lesson for all plants is that you have to prepare for something other than what you believe is the worst that could possibly happen.'

For Powell, though, primary containment remains a key lesson from Buncefield, Piper Alpha and other events, including the Corus, South Wales accident that came to court recently. 'Any defence that an incident couldn't have been foreseen, so a breakdown in your plant's safety system doesn't confer responsibility, just doesn't wash in a major hazard environment. You have to install robust controls, backed by primary containment in process vessels and pipework. The job is always to prevent process breakdown running away, with unforeseen consequences.'

And one final point: Powell notes that in the Baker report (Texas City), BP was asked to appoint an expert in process safety to the board to ensure that it is always fully aware of major hazard issues. 'That should be in everyone's thinking. BP isn't the only company to have lost control of major hazard plant, and the downstream sector needs this kind of leadership to bring all facility operators to a level of good standards and adequate risk controls. If we don't do this, we won't sustain the lessons of Piper Alpha or Buncefield. It would be shameful if we moved on and forgot; if we didn't take into account all that has happened. We must learn these lessons.'

SOE

Related Downloads
23712\piperalpha.pdf

This material is protected by MA Business copyright
See Terms and Conditions.
One-off usage is permitted but bulk copying is not.
For multiple copies contact the sales team.