CHAPTER 8: PIPER ALPHA AND ALEXANDER L. KIELLAND: A COMPARISON OF TWO NORTH SEA TRAGEDIES – CARL DAKIN AND JON SIGURD JACOBSEN

‘The oil and gas fatality rate is 7.6 times higher than the all-industry rate of 3.2 deaths per 100,000 workers.’ – (King, 2013).

The oil industry is a multi-trillion dollar business and the world’s reliance upon its products grows year-on-year. But working in the oil industry, particularly off shore, is not without its risks as the following table chronicles:

Figure 8: Offshore oil industry accidents

Source: Offshore Technology Market & Customer Insight, 2014

This case study considers the worst two of these accidents, the Piper Alpha (PA) and the Alexander L. Kielland (ALK) disasters. Although caused by human error and structural failure respectively, a combined total of 290 oil workers lost their lives. Analysis of a purposive sample of available publications on the PA and ALK disasters has been performed which identifies some of the critical elements around these tragedies. Figure 9, below, shows an overview comparison of the two disasters.

Figure 9: Overview comparison of the two disasters

Piper Alpha

‘Even after the Deepwater Horizon explosion, Piper Alpha remains the industry’s shorthand for horror.’ – (Steffy, 2011).

Piper Alpha was a large North Sea oil platform operating in the British sector of the North Sea, approximately 120 miles north east of Aberdeen. It was part of a complex network of three rigs that were connected via sub-sea gas or oil pipelines, with PA being utilised as the hub or central platform in the network.

During the night of 6 July 1988 the platform suffered a critical failure that resulted in an explosion. This was followed by an intense gas and oil fuelled fire that very quickly led to the catastrophic loss of the platform. The collapsing time frame from the first explosion to the point of structural failure lasted approximately 22 min. The disaster was the world’s worst offshore oil accident with a human cost of 167 lives. There were 61 survivors. It is believed that only two fatalities were caused by the initial explosion. Several also succumbed to injuries that were consistent with falling or jumping, such as broken necks. Around 80 died in the accommodation block from carbon monoxide poisoning while waiting for direction from management.

The cost of rebuilding the platform was in excess of £1 billion and the wider cost to the global offshore industry has been estimated at £5 billion. The PA disaster demonstrated beyond doubt that the catastrophic loss of an offshore platform could result from human error. This should be considered alongside the ‘once in 100 year wave’ scenario as a low probability but very high impact event and certainly should not be ignored by risk managers.

It is clear that Occidental Petroleum (OP) were aware that the PA super structure could not withstand a high-intensity fire, but OP dismissed the scenario as too unlikely to be taken seriously. Unfortunately, lack of foresight prevented OP from conducting any form of risk assessment that a fire or explosion event would have on the platform. This is illustrated by the apparent lack of consideration given to the position of critical functions aboard the platform, such as the control room. This was located above an area that would be most vulnerable in the event of a serious fire.

Ultimately, the layout of the topside facilitated the propagation of the fire, which quickly destroyed critical centres during the early stages of the accident.

‘Many evacuation routes were blocked and the life boats, all in the same location, were mostly inaccessible. The firefighting equipment on board could not be operated because the diesel pumps, which had been put on manual mode, were inaccessible and seem to have been damaged from the beginning.’ – Dr Elisabeth Paté-Cornell.

With several crucial single points of failure, including the positioning of firefighting equipment and lifeboats, the chances of saving the rig and its operatives were severely reduced. Many of the survivors had no option except to jump into the sea, which for some was from a height of 175 feet (53 m). Some subsequently drowned.

Furthermore, OP added components to the platform structure over a long period of time which critically altered the characteristics of the platform by creating areas congested with pipe work and equipment. These built-up areas prevented the explosion and subsequent fire from venting. The unvented blast damaged the firewalls which became ineffective.

There were processes in place aboard PA designed to reduce the risk to the safety of the platform and its operatives. The processes were reliant upon human compliance and careful management, however, a target driven culture dominated within OP, often at the expense of safety. This was in spite OP’s track record of various accidents including the death of a worker; the company considered these accidents to be small. Moreover, during PA’s design phase, there had been no systematic assessment of potential hazards and therefore no thought had been given to an explosion being just as likely as a fire.

The frequent of small accidents tended to grab management attention but at the expense of potentially more significant albeit ‘less likely’ events. The corporate attitude towards accidents usually involves measures being put in place to reduce the likelihood of small accidents occurring if this can be achieved at an acceptable cost. Often no consideration is given to serious, catastrophic potential accidents that would have a huge cost to life and assets.

A serious accident involving many casualties was a rare event and therefore some corporations could not justify to themselves the effort and cost of reducing the risk. Furthermore, in the event of a serious incident the corporation will attempt to exonerate itself on the basis that it was a ‘freak event’ and the company was justified in ignoring the possibility.

To further illustrate the culture of productivity before safety and the paradigm within OP that serious incidents were rare events, it is worth considering the actions carried out by the Offshore Installation Managers (OIM) aboard the Tartan and Claymore platforms at the time of the PA incident. The OIM aboard the Tartan platform ordered production to stop once he realised the severity of the PA situation, but the OIM aboard the Claymore platform remained focused on production and even ordered the pressure in the pipeline to be increased when a fall in pressure was experienced during the incident. The Claymore did not stop production until an hour after the initial explosion aboard the PA.

High-risk work environments, such as offshore platforms, are heavily reliant upon effective safety procedures that are adhered to by all levels of the workforce. It is clear from research that PA had a process in place, ‘Permit to Work (PTW)’, but the effectiveness of the process was greatly reduced by lack of enforcement and poor management. The PTW process should have formed an integral part of risk assessment. Managers and knowledge workers should have understood the reasons for risk assessments and corrective actions, as well as and the consequences of critical failure from non-compliance with the process.

The PA disaster was a sequence of events that, once a critical tipping point had been reached, could not be reversed. With careful analysis, however, the key failures can be isolated so that lessons can be learned and solutions applied.

Following the disaster a public inquiry was chaired by Lord Cullen who based his conclusions on eyewitness evidence, supported by technical evidence and expert opinion. A common thread that runs throughout the evidence was poor management and lack of adherence to safety procedures. This can be illustrated by the PTW process that formed the basis for a safe working environment aboard the platform. The PTW process is a suitable method to ensure a ‘safe systems of work’ and should ensure full and detailed consideration of any task before work is commenced. The process includes a thorough risk assessment and requisite risk reducing measures that should precede any work, as well as detailed contingencies in the event of a problem.

It is widely acknowledged that the likely cause of the initial explosion was the activation of a pump which was under maintenance. A pressure valve had been removed for servicing and the valve opening was sealed with a ‘finger tight’ flange. When the pump was activated a combustible vapour cloud was released under pressure, which subsequently ignited. If the permit to work process had been correctly supervised and adhered to, the relief crew would have been aware that the pump was unserviceable.

In order to reduce the risk of critical failure during routine maintenance, greater thought should be applied to each task. Every task should be considered in the context of the whole operation. In the case of PA, there were only two pumps to perform a given role, enabling one pump to operate and the second to be a back-up. When there is reduced or limited resilience, work should be completed to ensure essential function can be maintained, even at a reduced rate. In addition, a time appraisal should have taken place to identify if the task was feasible within the time available or if the relief crew should have conducted a ‘relief in place’ to complete the task.

Effective communication is essential for every organisation and can take many forms, specific to requirement. In the context of PA the level of communication between the day and night crew could not have been fully comprehensive, otherwise the day crew would have ensured the night crew had a full understanding of the status of the pump under maintenance. Moreover, the pump that was under maintenance was subject to two discrete PTW. One permit was held in the control room while the other permit was held in the safety officers’ office. It is highly likely that separate facets of management were unaware of either or both permits, thus demonstrating a simple but significant breakdown in vital communication.

Cullen made 106 recommendations to improve safety in the offshore industry. As illustrated throughout this case study, formal safety procedures can be in place, but without careful management, measuring, monitoring and testing, the processes are ineffective. Prior to the disaster the Department of Energy (DoE) provided a regulatory function across UK industry but the PA disaster illustrated beyond doubt that an independent body with legal authority was required to regulate and ensure minimum standards were met. Responsibility for regulating safety within the offshore industry was transferred from DoE to the Health and Safety Executive (HSE).

The Offshore Safety Case Regulation was brought into force in 1993. It attempts to ensure that the safety management system is adequate, namely: that equipment design and operation are safe; that potential risks to personnel have been identified and appropriate controls provided; and suitable safe refuge, evacuation equipment and contingencies are provided. Each installation is required to submit a detailed safety case that requires HSE endorsement.

The Cullen Report and the PA disaster have had a lasting impact on the offshore industry. Most countries now have regulations that are enforced by bodies with statutory powers. Many companies also encourage a safety-focused culture that ensures a safe worker environment and minimum impact on the environment. This safeguards brand name and reputation. An example of a company that has adopted the safe approach is Qatar-based RasGas.

RasGas, a subsidiary of Qatar Petroleum, started extracting liquefied natural gas in 2001. The RasGas magazine carries the strategic message from the top level of the company that high standards of safety ensure a safe working environment for workers and protect the environment. The company are keen to ensure operations are underpinned by a comprehensive competency assurance programme to ensure workers are trained and fit for task. Rigorous and frequent testing of safety systems occurs, including:

• fire-fighting equipment and drills
• evacuation drills and life craft
• emergency shut-down procedures

The effect of this safety driven culture has been no unplanned disruption to production and no ‘lost-time incidence’ during an eight-year period.

The RasGas example is underpinned by a BCM process that has enabled it to identify elements that are critical to business and areas vulnerable to risk. Although BCM was still in its infancy in 1988, had a similar approach been adopted by OP a thorough threat analysis exercise would have highlighted many of the underlying risks that ultimately contributed to the PA disaster. Moreover, the Cullen inquiry revealed there had been no emergency simulation training or exercises between the three connected platforms. Had both the Tartan and Claymore platforms promptly stopped production, the fire on PA may well have quickly burned itself out with minimal loss of life.

The Alexander L. Kielland

Located in the Ekofisk field, 235 miles to the east of Dundee, Scotland, the Alexander L. Kielland (ALK) Platform was a semi-submersible mobile rig of the Pentagon type. The rig was a French-built model constructed between 1972 and 1976. The ALK was originally intended to be operated as a drilling rig, but was only ever used as an accommodation platform. Both a drilling tower and accommodation units were mounted at the main deck and there was accommodation for up to 360 people on-board. The owner of the platform at the time of the accident was the Stavanger Drilling Company.

On Thursday 27 March 1980, the walkway connecting the ALK to the Edda 2/7 C platform was removed and using the anchorage points the ALK was shifted a short distance. This was standard practice in the face of inclement weather.

Approximately half an hour after the relocation was completed, a steel beam bolted to a main pillar broke. Very rapidly, all the other steel connections bolted to this main pillar also broke. This led to instability of the main pillar and it was reported to be listing at an angle of 30°–35°. One anchor temporarily remained in situ preventing further listing, and when that finally failed the ALK capsized. There were 212 people on board the ALK platform of which 123 perished.

The ALK accident was the first offshore accident with this magnitude of casualties. In fact it has only ever been surpassed by the Piper Alpha disaster. It occurred as a combination of bad weather, the failure of a steel connection bolted to a main pillar, and a lack of resilience within the original platform design to compensate for this failure.

While examples abound of offshore oil and gas rigs succumbing to explosions, fires, extreme weather conditions and collisions, it is very rare for a working rig to be lost simply because of severe structural failure.

The ALK situation was further compounded by the lack of safety training that the crew had undertaken. All staff on the platform should have attended a three week safety course, both theoretical and practical, although there was no such requirement for visitors. Furthermore, all key staff on the platform should have undertaken a six month safety course and the platform executive had to hold a ship master’s certificate. The course content focused on firefighting, the operation of rescue boats and rafts, and overall knowledge of safety. The training had, however, fallen well short of the requirement and none of the platform executives had attended the mandatory six month course. It further transpired that only four crew members had attended the safety course.

The ALK was well equipped with life jackets, life boats and rafts which were positioned at various points around the platform. Each crew member was allocated their own lifejacket and survival suit which they kept in their cabins. As the ALK began to list, there was also a power failure which added to the ensuing confusion. With many of the crew in the cinema as the crisis began, it was simply too dangerous to return to their cabins to collect their survival suits and life jackets. Consequently, there were insufficient accessible life jackets available for the crew and guests onboard. In fact, only eight crew members are known to have been wearing survival suits, and only four were rescued alive.

‘The 14 minutes between initial failure of the leg and the rig’s eventual capsize left a window in which most of the personnel on board could have escaped, given a more effective command structure. But it would seem that no one took charge on the night.’ – (Officer of the Watch, 2013).

Many of the crew were thrown into the sea as the ALK capsized. The rig held twenty 20-man rafts and seven 50-man lifeboats although launching them from the listing platform proved almost impossible. Of the four lifeboats lowered only one was released from the cables and was adrift upside down. The survivors inside righted the lifeboat and proceeded to rescue 19 other survivors from the water while seven crew swam to the Edda 2/7 C platform.

The Norwegian Rescue Services took the lead in the rescue operation and a NRS helicopter was quickly on the scene. In addition to the Edda 2/7 C platform, support came from the police, national and local authorities, paramedics and hospitals, the fire department and ambulance services. Attempts to launch life rafts from the Edda 2/7 C were only partially successful as it was discovered that the releasing mechanisms had been incorrectly configured.

As a part of the rescue plan four supply ships and the Edda 2/7 C platform under the command of Philips were standing by with rescue boats, lifelines and a staff elevator. The ships were instructed to take up stations close to the ALK but owing to the severity of the weather, this instruction was not followed. It was a full hour before the first of these ships arrived on station and even then it rescued no survivors. It took a further three hours for all four ships to finally be on station.

The common factors

Although the causes of the Piper Alpha and Alexander L. Kielland tragedies are very different, there are clearly some common themes that contributed towards the high death tolls:

1. When the crisis began there was an absence of leadership taking control of the situation. On both platforms, men died while they waited for their respective management teams to provide direction, if only to instruct them to abandon the rigs. In both scenarios, the only possible means of survival was in fact to evacuate the rigs.
2. An absence of training and rehearsals for emergencies was a common denominator. Although training standards had been defined they were not followed.
3. Many crew members drowned, particularly from the ALK. Even summer temperatures in the North Sea can be cold enough that the best of swimmers can quickly find themselves in difficulty. Heart failure in the prevailing conditions is not unknown.

What went well

• Following the Piper Alpha disaster, responsibility for ensuring safety in the offshore oil and gas industry was passed to the Health and Safety Executive. They must approve a detailed safety case for each installation.

What could have been done better

• Although OP were at least aware that Piper Alpha was vulnerable to a high-intensity fire, they ignored the problem as it was considered an unlikely event.
• No risk assessment was carried out, resulting in critical functions being located in high-risk areas.
• Staff on the ALK had not attended supposedly mandatory safety training courses.
• Life jackets and life rafts became inaccessible to crew after power failure.

What did not go well

• Those safety procedures which had been put in place on Piper Alpha were ignored due to a culture which prioritised targets over safety.
• Communications between day and night crews were not comprehensive.
• Management teams on both rigs did not provide leadership during the disasters.
• Attempts to launch rescue lifeboats from the Edda 2/7C were less successful because they had not been properly configured.

Conclusion – could tragedies of the PA and ALK magnitude reoccur?

As illustrated by Figure 8, while offshore oil related fatalities continue, the number of casualties per incident has fallen drastically since the 1980s, implying that safety on rigs has greatly improved.

In the case of the ALK, the design fault and subsequent structural failure that caused its capsizing present a risk to rigs of a similar design. In fact, just ten days after the ALK tragedy its sister rig the Henrik Ibsen listed 20° in Stavanger harbour, forcing the crew to take to the lifeboats. Ironically, the Ibsen had been earmarked to replace the ill-fated ALK although questions were subsequently asked about the safety and stability of this particular rig design. Springing to the defence of its product, ALK manufacturer Compagnie Francaise d’Enterprises Metalliques said there were eleven rigs of this design all operating without any problems.

Ibsen was righted and is still in use although it has since been renamed. It is now constantly monitored with acoustic emission devices to detect any potential structural failure. This safety precaution should provide an early warning of any developing problems, making a repeat of the ALK tragedy less likely.

Conversely, the PA disaster was primarily the result of human error although a series of other issues undoubtedly made the incident far worse than it needed to be. Statistically the safety of the North Sea installations has been improving but more progress still needs to be made.

‘This is a work in progress and the momentum for improvement must continue.’ – Judith Hackitt, UK Health and Safety Executive.

In 2003, on the Forties Alpha platform, escaping gas quickly formed a huge and potentially lethal cloud around the rig. But unlike the PA disaster, no one died or was even hurt that day predominantly because strong winds helped to rapidly scatter the lethal gas cloud.

‘Unlike a similar incident on the ill-fated Piper Alpha platform, the gas did not ignite, so what could have been a major disaster for myself and everyone else on board was averted by sheer luck.’ – Oberon Houston.

The HSE review of the UK’s offshore installations has been critical after a major three-year investigation into safety on more than 100 offshore installations. HSE also noted one major gas leak in the North Sea in 2008 on a scale comparable to the one that caused the PA explosion. The previous year there were five. Arguably Cullen’s key health and safety recommendation, which underpins this work, was the introduction of safety regulations requiring the operator/owner of every fixed and mobile installation operating in UK waters to submit a safety case to the HSE for their approval.

With the Forties Alpha platform and Houston’s words in mind, let us hope that luck continues to prevent more Piper Alpha scenarios until HSE’s work in progress comes to a satisfactory conclusion.