Piper Alpha disaster

Piper Alpha on fire shortly after the failure of the Tartan gas riser
Piper Alpha Aberdeen Piper Alpha's location in the North Sea, around 120 miles (190 kilometres) north-east of Aberdeen, Scotland
Date	6 and 7 July 1988
Time	Approximately 22:00 (BST) (first explosion)
Location	Piper Alpha platform, Piper oilfield, North Sea (UK sector)
Coordinates	58°28′01″N 00°15′36″E / 58.46694°N 0.26000°E / 58.46694; 0.26000[1]
Type	Explosion and fire
Cause	- Startup of a condensate pump that had not been mechanically isolated due to ongoing maintenance - Lack of protection by design of gas risers
Filmed by	Scottish Television
Deaths	167
Property damage	£1.7 billion (£5 billion in 2021)
Inquiries	Piper Alpha Public Inquiry (Cullen Inquiry)
Awards	Seven George Medal, eight Queen's Gallantry Medal, and five Queen's Commendation for Brave Conduct recipients[2]

Piper Alpha was an oil platform located in the North Sea about 120 miles (190 km) north-east of Aberdeen, Scotland. It was operated by Occidental Petroleum (Caledonia) Limited (OPCAL) and began production in December 1976,^[3] initially as an oil-only platform, but later converted to add gas production.

Piper Alpha exploded and collapsed under the effect of sustained gas jet fires in the night between 6 and 7 July 1988, killing 165 of the men on board (30 of whose bodies were never recovered), as well as a further two rescuers.^[4] Sixty-one workers escaped and survived. The total insured loss was about £1.7 billion (£5 billion in 2021), making it one of the costliest man-made catastrophes ever.^[5][6] At the time of the disaster, the platform accounted for roughly 10% of North Sea oil and gas production^[3] and was the world’s single largest oil producer.^[7] The accident is the worst ever offshore oil and gas disaster in terms of lives lost, and comparable only to the Deepwater Horizon disaster in terms of industry impact.^[8][9][10] The inquiry blamed it on inadequate maintenance and safety procedures by Occidental, though no charges were brought.^[11][12] A separate civil suit resulted in a finding of negligence against two workers who were killed in the accident.^[13]

A memorial sculpture is located in the Rose Garden of Hazlehead Park in Aberdeen.^[14]

Piper oilfield

Four companies (Occidental Petroleum (UK) Ltd, Getty Oil International (England) Ltd, Allied Chemical (Great Britain) Ltd, and Thomson Scottish Associates Ltd) formed a joint venture^[a] and obtained an oil-exploration licence in 1972.^[15] They discovered the Piper oilfield located at 58°28′N 0°15′E / 58.467°N 0.250°E / 58.467; 0.250 in January 1973,^[16] and began fabrication of the platform, pipelines, and onshore support structures. Oil production started in December 1976, less than four years after discovery (a record rarely beaten ever since),^[17] with about 250,000 barrels (40,000 m³) of oil per day, later increasing to 360,000 barrels (57,000 m³).^[3] Production declined to 125,000 barrels (19,900 m³) by 1988.^[18]

A large, fixed platform, Piper Alpha was located in the Piper oilfield, around 120 miles (190 km) northeast of Aberdeen in 474 ft (144 m) of water.^[19] Piper Alpha produced crude oil and natural gas from 36 wells.^[3] OPCAL built the Flotta oil terminal in the Orkney Islands to receive and process oil from the Piper, Claymore (both operated by OPCAL), and Tartan (Texaco) oilfields, each with its own platform.^[17] One 30-inch (76 cm) diameter main oil pipeline ran 128 miles (206 km) from Piper Alpha to Flotta.^[3]

The Piper platform was the hub of a network of pipelines connecting it to nearby platforms and to shore. The Tartan field fed oil to Claymore, with the co-mingled oil flowing from Claymore through a short pipeline to join the Piper-Flotta line some 20 miles (32 km) to the west of Piper.^[20]

Separate 18-inch (46 cm) diameter gas pipelines were run from the Tartan platform to Piper, and from Piper to the Total-operated^[17] manifold compression platform MCP-01 some 30 miles (48 km) to the northwest. Another 16-inch (41 cm) line connected Claymore to Piper, primarily to provide gas from Piper to the Claymore gas lift system.^[3] MCP-01 would receive the gas from Piper and Tartan, as well as from the Frigg gas field (through a separate pipeline), and send the resulting stream to St Fergus Gas Terminal through a 108 miles (174 km), 2 × 32-inch pipeline.^[21][22]

The inventory of the pipelines was significant, with the main oil line to Flotta containing around 70,000 tonnes of oil and the three gas lines linking Piper to the surrounding platforms close to 2,000 tonnes of high-pressure gas.^[23] The pressure in the Tartan–Piper and Piper–MCP-01 pipelines was around 127 bar.^[24]

Construction and layout

Piper Alpha's production facilities were designed by Bechtel out of London.^[25] The supporting platform jacket, as well as the topside module structures and buildings, were designed by McDermott Hudson.^[26] The eight-legged jacket structure was constructed by J. Ray McDermott in Ardersier, Inverness-shire, and Union Industrielle et d'Entreprise in Le Havre, France, with the sections united in Ardersier before being towed out during 1975.^[27][28] The jacket weighed around 14,000 tonnes and was 165 metres (541 ft) tall, of which a length of 144.5 metres (474 ft) was permanently submerged. Four clusters of foundation piles extended a further 115.8 metres (380 ft) below the seabed. Topside modules weighing about 10,000 tonnes in aggregate were lifted from a crane ship and installed over the jacket in late 1976.^[29]

Piper's hydrocarbon facilities and principal utilities were distributed in four main modules (A, B, C, and D) separated by firewalls and sitting atop the steel jacket. Above the main modules were a drilling derrick, various utilities, the living quarters, flare booms, two pedestal cranes, and the helideck.^[30][31]

For safety reasons, the modules were organized so that the most dangerous platform operations took place far from the personnel areas.^[23] However, the conversion from oil to gas broke this safety concept, with the result that sensitive areas were brought together; for example, the gas compression module was next to the control room. The close position of these two areas played a significant role in the accident.^[32]

The hydrocarbon inventory actually held within the platform was small in comparison with that contained in the pipelines, standing at around 80 tonnes of process fluids and 160 tonnes of diesel fuel (which was stored in tanks located above module C).^[23]

Upgrades and production modes

In 1978, major works were carried out to enable the platform to meet British government gas-conservation requirements, and to avoid waste from the flaring of excess gas.^[33] A gas conservation module (GCM) was added, built on top of module B. After this work, Piper Alpha operated in what was known as "phase-2 mode", i.e., using the GCM facility. In phase-2 mode, the GCM would treat the gas obtained in the crude oil separation process, separate condensate (or natural gas liquids, NGL) from it, reinject the condensate in the oil export pipeline to Flotta, and compress the gas for export to the pipeline to MCP-01. From the end of 1980 until July 1988, phase-2 mode was its normal operating state.^[34]

In the late 1980s, major construction, maintenance, and upgrade works were planned by Occidental, and by July 1988, the rig was already well into major revamp, with six projects identified, including the change-out of the GCM unit. This meant that the rig was returned to its initial "phase-1 mode", i.e., operating without the GCM unit, only three days before the accident.^[35] Despite the complex and demanding work schedule, Occidental made the decision to continue operating the platform in phase-1 mode throughout this period and not to shut it down, as had been originally planned. The planning and controls that were put in place were thought to be adequate.^[36] At the time of the accident, Piper weighed around 34,000 tonnes.^[37] It continued to export oil at just under 125,000 barrels (19,900 m³) per day (or 10% of the entire production of the UK sector of the North Sea, which made it the world’s single largest oil producer)^[3][7] and to export Tartan gas at some 33 million cubic feet (930,000 m³) per day at standard conditions during this period.

Events on 6 and 7 July 1988

Because the platform was completely destroyed, and many of those involved died, analysis of events can only suggest a possible chain of events based on known facts. Some witnesses to the events question the official timeline.^[38]

Preliminary events

At 7:45, 6 July 1988, the permit-to-work forms for the day shift were issued and signed.^[39] Of the two condensate pumps, both located in module C, pump B was operating to displace the platform's condensate for transport to the coast, while pump A was due for maintenance. Two permits were issued to that effect, one for a pump overhaul and another for the removal of the pump's pressure safety valve (PSV #504), which was due for recertification. During the day, pump A was electrically and mechanically isolated, but containment was not broken. The PSV, instead, was removed. The open condensate pipe upstream of the PSV was temporarily sealed with a disk cover (a flat metal disc also called a blind flange or blank flange). It was hand-tightened only. Because the work could not be completed by 18:00, the blind flange remained in place. The on-duty engineer filled in information on the PSV removal permit to the effect that pump A was not ready and must not be switched on under any circumstances. However, this information was not provided in the pump overhaul permit.^[40]

The night shift started at 18:00 with 62 men running Piper Alpha. As the on-duty custodian was busy, the engineer neglected to inform him of the condition of pump A. Instead, he placed the PSV permit in the control centre and left. This permit disappeared and was not found.^[32]

At 19:00 the diesel-driven fire pumps were put under manual control. Like many other offshore platforms, Piper Alpha had an automatic fire-fighting system, driven by both diesel and electric fire pumps. The pumps were designed to suck in large amounts of sea water for firefighting and had automatic controls to start them in case of fire. However, the Piper Alpha procedure adopted by the offshore installation manager (OIM) required manual control of the diesel pumps whenever divers were in the water (as they were for about 12 hours a day during summer) although in reality, the risk was not seen as significant, unless a diver was closer than 10–15 feet (3–5 m) from any of the four 120 feet (40 m) level caged intakes. A recommendation from an earlier audit had suggested that a procedure be developed to keep the pumps in automatic mode if divers were not working in the vicinity of the intakes, as was the practice on the Claymore platform, but this was never implemented.^{[3][32][41][42]}

At 21:45, condensate pump B stopped and could not be restarted. This was likely due to the formation of hydrates and the consequent blockage of gas compression pipework, following problems with the methanol system.^[43] The operators were anxious to reinstate condensate pumping capacity. Failure to do so would have meant needing to stop the gas compressors and venting to the flare all the gas that could not be processed.^[44][b]

Around 21:52 a search was made through the documents to determine whether condensate pump A could be started. The permit for pump A overhaul was found but that for its PSV removal was not. The valve was at a distance from the pump, so the permits were stored in different boxes, as they were sorted by location. Because the overhaul had just started on the day, with no equipment removed or containment broken, the operators were under the impression that the pump could be put back in operation quickly and safely. None of those present were aware that a vital part of the machine had been removed. The missing valve was not noticed by anyone, particularly as the blind flange replacing the safety valve was several metres (yards) above ground level and obstructed from view.^[32]

Explosion in module C and initial reactions

At or shortly before 22:00,^[23] gas was reintroduced into pump A, filling it. The loosely fitted flange did not withstand the resulting pressure.^[48] Gas audibly leaked out at high pressure, drawing the attention of several men and triggering multiple gas alarms. Before anyone could act, the gas ignited and exploded. The source of ignition is unclear, with the later investigation pointing to hot work, hot surfaces, broken light fittings or an electrostatic spark as potential sources (electrical equipment in the surroundings were rated for hazardous areas).^[49] The platform, which originally was built for oil production only, was not of a blast-proof design, so the firewalls were not designed to withstand explosions.^[50] The blast blew through the firewalls separating module C from the adjoining modules B and D (the latter of which housed the control room), made up of variously sized panels bolted together.^[51][52] As a result, the control room was almost entirely destroyed. Panels around module B were also dislodged, with one of them rupturing a small condensate pipe, thus creating another fire.^[17][39]

Immediately after the explosion, control room operator Geoff Bollands, who had witnessed the alarms going off in the control room and subsequently survived the blast, activated the rig's emergency stop button before escaping. This closed isolation valves in the wells and sea riser lines and ceased all oil and gas production. Theoretically, the platform would then have been isolated from the flow of oil and gas and the fire contained. The gas pipelines connecting Piper to Tartan and Claymore could only be isolated using separate push buttons, which were not actuated;^[3][53] however, the riser isolation valves probably closed due to loss of power supply in the explosion. (At any rate, the flare continued to burn until 23:30, indicating a leak in the Claymore riser isolation valve).^[54]

The control room of Piper Alpha was abandoned. Piper Alpha's design made no allowances for the destruction of the control room, and the platform's organization disintegrated. The diesel fire pumps having been switched to manual activation, the fire water system could not function properly. Additionally, their vulnerable location in module D, adjacent to the failed division from module C, was impossible to reach for the crew to manually activate them. Electrical power quickly failed too. Cables were routed through a vulnerable production area without redundancy. After the main generator tripped, the emergency generator did not take over. The drilling generator started but subsequently failed. Some battery-run systems remained operational for a while. The emergency lighting failed after briefly remaining functional.^[40] The failure of power generation facilities also made the electric fire pumps inoperable.^[41][c] Despite Bollands' activation of the emergency shutdown, no alarms warned workers of the unfolding disaster, as the public announcement and general alarm system had been impaired.^[56] Multiple mayday calls were made by radio operator David Kinrade starting at 22:04, before the radio room had to be abandoned at 22:08.^[57][58][d]

At 22:06 the heat from the flames ruptured crude oil pipework and processing vessels in module B. The released oil ignited and the subsequent pool fire created a black plume of smoke characteristic of oil fires, visible from nearby ships.^[39] There is evidence that isolation of the produced oil pipeline was not effective, which may have left a route open for oil flowing into the fire due to the backpressure from the Claymore oil pipeline.^[3][53] The burning oil later dripped onto a lower platform used by the rig for diving operations. The platform floor consisted of steel grates, and under normal circumstances would have allowed the burning oil to drip harmlessly into the sea, but divers on the previous shift had placed rubber matting on the metal grate (likely to cushion their bare feet from the sharp metal grates), allowing the oil to form a burning puddle on the platform.^[39] After conferring with Bollands and others while still on the main production deck, lead production operator Robert Vernon and safety officer Robert Carroll donned breathing apparatus and left for the diesel fire pumps in an attempt to start them manually. The pair were never to be seen again.^[59]

The OIMs of Tartan and Claymore shortly before 22:20 became aware that an explosion had taken place on Piper Alpha and a fire was raging. However, they both decided not to shut down production and instead await orders to that effect from Aberdeen.^[56] By this time, 70 to 80 men had mustered in the canteen, with access to the lifeboats or the helideck made impossible by smoke and fire. This room was becoming increasingly hot and full of smoke.^[3][60] Piper's OIM did not order an evacuation.^[40]

Subsequent gas pipeline ruptures and platform collapse

At 22:20, in a case of domino effect,^[61] the heat from the burning oil collecting on the diving platform caused the nearby Tartan pipeline to rupture violently.^[57] This discharged enormous amounts of highly flammable gas (some 30 tonnes only in the first minute of the release),^[3] which immediately ignited into a massive jet fire.^[39][62] The heat and vibrations of the fire were felt by the crews in vessels as far away as 1 kilometre (0.62 mi) from the rig. From that moment on, the platform's destruction was inevitable.^[63] This potential for an extreme escalation scenario was known to Occidental; a report commissioned by them in 1986 stated^[64] that "the gas pipelines, would take hours to depressurize because of their capacity. This could result in a high pressure gas fire on the cellar deck that would be virtually impossible to fight, and the protection systems would not be effective in providing the cooling needed for the duration of the depressurisation".

The MCP-01 pipeline failed at 22:50 as a result of domino effect, and the ensuing jet fire^[62] shot huge flames over 300 ft (90 m) into the air.^[63] Personnel still left alive were either desperately sheltering in the scorched, smoke-filled accommodation block or leaping from the various deck levels, including the helideck, 175 ft (53 m) into the North Sea.^[65]

The Claymore gas line ruptured at 23:20, adding even more fuel to the already massive jet fires on board Piper Alpha.^[66] At this point the Claymore OIM had received orders from Aberdeen to shut down production, and the gas flowline to Piper with it. He had initiated a pipeline blowdown (depressurization) but this was not yet complete at the moment of the rupture. Tartan's gas pipeline had been shut down around 22:30, with its blowdown commencing around 23:20.^[67][68][e]

Around 23:45, with critical support structures failing from the intense heat, the platform began to collapse. One of the cranes fell first, followed by the drilling derrick. The generation and utilities module (D) and the fireproofed accommodation block, still occupied by crewmen who had sheltered there, then slipped into the North Sea.^[40] By 00:45, July 7, almost all of Piper Alpha was gone, with only module A still standing.^[39]

Rescue operations

Nearby vessels and rescue crafts

Vessels that were close to Piper Alpha at the moment of the first explosion included MSV Tharos, a large semi-submersible firefighting, diving/rescue, and accommodation vessel; standby safety vessel MV Silver Pit, who immediately sent her fast rescue boat towards Piper;^[f] Maersk Cutter, which started dousing the drilling floor of Piper with her fire monitors as early as ten minutes after the blast; Lowland Cavalier, which had no monitors but immediately deployed a workboat; and converted supply ship Sandhaven, which was the standby vessel for Santa Fe 135, a semi-submersible drilling rig several miles away, and had her fast rescue craft in the water minutes after she spotted the first fire on Piper Alpha.^[73][74] Other vessels that attended the operation later were Loch Shuna, Maersk Logger and Maersk Leader.^[75] Overall, 11 fast rescue crafts (FRC) from nearby vessels were involved in the rescue operations.^[76]

Tharos launched her Sikorsky S-76 helicopter at 22:11 but it was unable to land on Piper due to smoke.^[77] At 22:23 Tharos received a message from Piper: "People majority in galley area. Tharos come. Gangway. Hoses. Getting bad."^[78] She drew alongside Piper Alpha around 22:30 and used her water cannon to cool the platform, which was useful in assisting survivors escape from the pipe deck and helideck.^[79] Attempts to deploy her extendable gangway over to Piper were unsuccessful. One survivor who jumped when the Tartan riser failed swam to Tharos and climbed out unaided. When the MCP-01 riser failed, Tharos withdrew to 200 metres (220 yd) away.^[79] The MSV was equipped with a hospital with an offshore medic assisted by diver paramedics from a saturation diving team. A triage and reception area were set up on the vessel's helideck to receive injured casualties.^[80]

Silver Pit's FRC was launched within two minutes of the first explosion and rescued the first nine people from the northwest corner within 13 minutes. She rescued a total of 29 people, with Silver Pit herself rescuing a further eight. When the Tartan riser failed Silver Pit withdrew to 300 metres (330 yd) away. When the MCP-01 riser failed, rope on the deck began to smoulder and the vessel withdrew further away.^[79]

Lowland Cavalier deployed a workboat that picked up two people who had fallen from a rope at the northwest corner. When the first gas riser failed, the workboat crew sheltered in the water.^[79]

Sandhaven's FRC picked up four men who had climbed down ropes. She returned and picked up two more when the MCP-01 riser failed. At that moment, the craft's propeller got entangled in debris. The boat was engulfed in the fire, throwing the survivors and the three crew into the water. All perished with the exception of coxswain Iain Letham.^{[4][66][81][65][79]} He was picked up from the sea one hour later with his lifejacket and safety helmet melted by the scorching heat.^[79]

Support vessel Maersk Cutter began using her fire monitors ten minutes after the explosion.^[79]

Aircraft

A mayday launched by Lowland Cavalier at 22:01 was relayed to a rescue coordination centre, which instructed RAF Kinloss station to scramble a Hawker Siddeley Nimrod maritime patrol aircraft. This was to be sent to the area to act as flying communications platform, handling the signals from helicopters and reporting them back. At 22:22 and 22:28 Sea King helicopters Rescue 137 and Rescue 131 took off from RAF Lossiemouth and RAF Boulmer respectively.^[82] Shetland Coastguard helicopter Rescue 117 took off at 22:45. Sea King Rescue 138 left Lossiemouth at 22:51. The Nimrod took off from Kinloss at 22:55 using the designation Rescue 01.^[83]

When Rescue 01 was still about 80 miles (130 km) from Piper, the aircraft crew radioed the rescue coordination centre that they could already see the fire.^[84] Rescue 01 arrived at the scene at 23:27.^[66] Three minutes later the first search-and-rescue helicopter, Rescue 137, reached Tharos, followed by the arrival of Rescue 117, Rescue 138 and Rescue 131 at 23:44, 23:48 and 23:53 hours respectively.^[85] Tharos requested Rescue 138 to evacuate 12 nonessential personnel to make room for incoming casualties. The helicopter transferred them to nearby Ocean Victory, before returning with paramedics.^[86][87] The search-and-rescue helicopters made unsuccessful sweeps for survivors in the water and ferried injured survivors from rescue vessels to Tharos and to Aberdeen Royal Infirmary.^[87]

A civilian Sikorsky S-61 of Bristow Helicopters carrying a medical emergency team arrived at the scene by 1:20 on 7 July.^[86] At 2:00 another helicopter landed on Tharos the Offshore Specialist Team from Aberdeen Royal Infirmary, with a significant amount of medical equipment.^[85] The last survivors were picked up by Rescue 138 from Tharos at 7:25.^[86] By 8:15, 63 personnel (among whom one survivor who subsequently died and the surviving member of the crew of Sandhaven's FRC) had been brought ashore. Aircraft were used to search the area of the platform until the afternoon hours.^[88]

Casualties and survivors

At the time of the disaster, 226 people were on the platform; 165 died and 61 survived.^[89] Two men from the Sandhaven were also killed in attempts to pick up survivors in a fast rescue boat.^[90] Of the 135 deceased whose bodies were recovered, the vast majority died from inhalation of smoke and gas, with only four indicating death from burning, and several others from injury sustained from jumping into the sea.^[3] Thirty bodies were never recovered.^[17]

Since both the lifeboats and the helideck were impaired by smoke or flames, all the survivors were among those that jumped to the water from various decks or climbed down knotted ropes.^[g] Five were the survivors that jumped off the helideck from a height of 175 feet (53 m) into the North Sea.^[92][93] Luckily, the sea conditions were calm on the evening of the disaster.^[94] The largest number of survivors (37 out of 61) were recovered by MV Silver Pit or her fast rescue boat,^[88] whose coxswain James Clark later received the George Medal, as did Iain Letham of the Sandhaven.^[2] Others awarded the George Medal were Charles Haffey from Methil, Andrew Kiloh from Aberdeen, and James McNeill from Oban. Sandhaven crewmates Malcolm Storey, from Alness, and Brian Batchelor, from Scunthorpe, were awarded George Medals posthumously.^{[2][95][96][97]}

Aftermath

Controversy exists about whether time was sufficient for a more effective emergency evacuation. Systems critical for emergency management such as the public announcement/general alarm, emergency power, safe haven, and –crucially– the lifeboats, were destroyed or impaired due to poor platform design. Executing the actions described in the emergency response plan became effectively impossible. Additionally, the OIM was perhaps not capable of thinking outside the established procedures and of ordering an improvised evacuation.^[40][98]

It was estimated that the fires had produced flames with a height of about 200 metres and a peak rate of about 100 gigawatts, or three times the total power consumption of the United Kingdom.^[17]

Around 670 tonnes of oil were spilled in the accident. On 9 July a slick 3.6 kilometres (2.2 mi) long and 100 metres (330 ft) wide was reported. Force 4 conditions, together with dispersant sprayed from a supply vessel, helped disperse it.^[87]

Only two downhole safety valves failed to close, and five oil wells were left burning.^[87] The fires were eventually extinguished by a team onboard Tharos led by firefighter Red Adair,^[99] who had been asked to intervene by Occidental chairman Armand Hammer.^[100] A relief well was started on 14 July. The wells were capped by 22 July by fitting new valves on top, which allowed introduction of kill fluids.^[101]

The accommodation modules where the majority of those onboard had taken refuge were recovered from the seabed in late 1988. They were transported to Flotta, where they were searched by a team led by twenty officers of Grampian Police and including divers as well as Occidental, Department of Energy and Health and Safety Executive personnel.^[102] The bodies of 87 men were found inside.^[4] The remains of the platform were toppled into the sea on 28 March 1989.^[17]

The total insured loss of the disaster was about £1.7 billion (£5 billion in 2021), making it one of the costliest man-made catastrophes ever.^[5][6] The event had a considerable impact on North Sea oil and gas production. Piper, Tartan, and Claymore were not the only fields impacted, with Scapa, Highlander and Petronella also having to wait up to 13 months before half production was regained. The total deferred production amounted to 3.2 billion barrels of oil.^[103]

Inquiry and safety recommendations

The Piper Alpha Public Inquiry was set up in November 1988 to establish the cause of the disaster. It was chaired by the Scottish judge William Cullen. A variety of sources of evidence were used, including eyewitness accounts from survivors and crews of nearby vessels, data from nearby platforms, the recovery of the deceased, debris collected from the seabed, documentation available ashore, and accounts from 'back-to-back' personnel who had recently worked on Piper Alpha. Highly unusual for an inquiry of this scope was the fact that the entire scene of the accident had effectively disappeared into the sea.^[3][23] The inquiry decided against the recovery of the process modules from the seabed, due to the time required, the hazards involved, and the low chance that that evidence could actually prove useful for the investigation.^[104] The living quarters had, however, been recovered, and this allowed for the collection of key documents to support the investigation.^[105]

After 180 days of proceedings extending for 13 months,^[105] the report Public Inquiry into the Piper Alpha Disaster (short: Cullen Report) was issued in November 1990.^[11][12] It concluded that the initial condensate leak was the result of maintenance work being carried out simultaneously on a pump and related safety valve. The inquiry was critical of Piper Alpha's operator, Occidental, which was found guilty of having inadequate maintenance and safety procedures, but no criminal charges were ever brought against the company.^[4]

The second part of the report made 106 recommendations for changes to North Sea safety procedures:

• Thirty-seven recommendations covered procedures for operating equipment, 32 the information of platform personnel, 25 the design of platforms and 12 the information of emergency services.^[106]
• The responsibility to implement was for 57 with the regulator, 40 for the operators, 8 for the industry as a whole and 1 for stand-by ship owners.^[107]

The recommendations led^[108] to the enactment of the Offshore Safety Act 1992^[109] and the making of the Offshore Installations (Safety Case) Regulations 1992.^[110]

Most significant of these recommendations was that operators were required to present a safety case and that the responsibility for enforcing safety in exploitation operations in the part of the North Sea apportioned to the UK should be moved from the Department of Energy to the Health and Safety Executive, as having both production and safety overseen by the same agency was a conflict of interest.^{[3][111][112]}

Civil suit

Occidental and their insurers, Lloyd's of London, paid survivors and families of the dead a total of $220 million in settlements.^[113] Later, Lloyd's and Elf Enterprise Caledonia Ltd, successors to Occidental Petroleum, brought civil proceedings against a number of contractor companies who were working on Piper at the time of the accident. Based on the argument that the responsibility for the accident should be shared among the platform operator and the contractors working onboard immediately prior to the accident, Elf was seeking to recover from the defendants a part of the monies paid to the injured and the affected families.^[114] Among the companies involved were British Telecommunications, Wood Group, and Stena Offshore.^[115]

Giving verdict in what was then the longest civil trial in Scottish history, in 1997 Lord Caplan ruled that two workers who were killed in the explosion, Robert Vernon (who had posthumously received the Queen's Commendation for Bravery)^[2] and Terence Sutton, were to blame for the accident.^{[114][116][117]} Lord Caplan found that Sutton had failed to tighten the bolts of the blind flange at the suction side of the removed PSV, and that Vernon had put the pump back in operation without checking its status first.^[118] Vernon was employed by Occidental and Sutton by contractor Score (UK) Ltd.^[119] The finding against Vernon and Sutton was controversial among the families of the victims.^[114][117]

Insurance claims

The disaster led to insurance claims of around US$1.4 billion, making it at that time the largest insured man-made catastrophe. The insurance and reinsurance claims process revealed serious weaknesses in the way insurers at Lloyd's of London and elsewhere kept track of their potential exposures and led to their procedures being reformed.^[120]

One of the 1997 rulings by Lord Caplan was that, albeit in principle contractors were obliged to indemnify Elf, Elf's insurers could not claim back monies from the defendant contractors, because Elf had already largely been indemnified by Lloyd's.^[119][121] Elf and Lloyd's appealed this finding in Scotland to the Inner House of the Court of Session, which decided in their favour in December 1999. Subsequently, the contractors appealed the decision to the House of Lords in London in November 2001, but their appeal was rejected. As a result, Elf and their insurers were able to recoup £136 million with accrued interest.^[121]

Legacy

The accident is the world's worst offshore oil and gas disaster in terms of lives lost. Only the 2010 Deepwater Horizon tragedy has caused a comparable impact in the industry.^[8][9][10]

Survivors and relatives of those who died went on to form the Piper Alpha Families and Survivors' Association, which campaigns on North Sea safety issues.^[122][123] A lasting effect of the Piper Alpha disaster was the establishment of the Offshore Industry Liaison Committee, the trade union for oil and gas rig workers.^[124] The union, while still in the form of an unofficial committee drawn from different North Sea rigs, organized large strikes in the summers of 1989 and 1990.^[125][126]

Piper Bravo was installed in 1992 to replace Alpha and commenced production in February 1993.^[127] A wreck buoy marking Alpha's remains was installed and lies approximately 120 metres (130 yd) from Bravo.^[128]

Beginning in 1998, one month after the 10th anniversary, professor David Alexander, director of the Aberdeen Centre for Trauma Research at Robert Gordon University carried out a study into the long-term psychological and social effects of Piper Alpha. He managed to find 36 survivors who agreed to give interviews or complete questionnaires. Almost all of this group reported psychological problems. More than 70% of those interviewed reported psychological and behavioural symptoms of post-traumatic stress disorder. Twenty-eight (or 78%) said they had difficulty in finding employment following the disaster; some offshore employers apparently regarded Piper Alpha survivors as "Jonahs" – bringers of bad luck, who would not be welcome on other rigs and platforms. The family members of the dead and surviving victims also reported various psychological and social problems.^[129] Alexander also stated, "some of these lads are stronger than before Piper. They've learned things about themselves, changed their values, some relationships became stronger. People realised they have strengths they didn't know they had. There was a lot of heroism took place."^[4]

In 2013, on the 25th anniversary of the tragedy, trade association Oil and Gas UK organized a three-day conference in Aberdeen to reflect on lessons learned from Piper Alpha and industry safety issues in general.^[130][131]

In process safety

The Piper Alpha disaster and the Cullen Report are milestones in the development of process safety.^[132] Its effects on the offshore oil and gas industry can be compared with those the Flixborough disaster had on the onshore chemical and petroleum process industry in the 1970s.^[133] The Cullen Report put a strong emphasis on the importance of a robust safety management system (SMS).^[134] The requirement for a safety management system to be in place was introduced in British legislation in the wake of Piper Alpha.^[135] Elements of process safety management that failed on Piper Alpha included:

• Permit-to-work, and in particular the mechanism of permit handover. The whole accident chain of events commenced due to the attempt to start-up a pump which was actually under maintenance.^{[39][136][137]}
• Company audits, which did not pick up on the systemic failings of the permit-to-work system.^[41][138] The Cullen Report included a recommendation to shift the regulatory regime to a greater focus on SMS audit rather than on inspection.^[139]
• Contractor management.^[135] It had been the first day on the platform for the production operator, who was a contractor and was left on his own without any operating procedures.^[9]
• Management of change. The platform, originally thought for oil production only, was retrofitted to handle gas. The change was not properly thought out and assessed, as the placement of critical gas facilities next to the unprotected control room stood to demonstrate.^[17]
• Asset integrity, by way of inspection and maintenance. Safety-critical systems such as liferafts, fire pumps, or emergency lighting do not seem to have received proper attention.^[40]

In general, Piper Alpha marked a watershed moment in that it ushered in a greater focus on process safety management and on a risk-based, rather than purely prescriptive, hazard management.^[140][141] As a result of the tragedy, the Safety Case Regulations came into force in 1992. By late 1993, a safety case had to be submitted to the Health and Safety Executive for every platform and rig in British waters (including the exclusive economic zone). The safety case must describe and justify the design, inherent hazards and residual risk in the spirit of the ALARP (as low as reasonably practicable) principle, as well as the means of managing such residual risk. The safety case must be maintained up to date through the lifecycle of the installation.^[9]

The safety case regime has been ascribed a measure of success in promoting safer facility design and management of offshore operations in the United Kingdom.^{[9][142][143][144]} Trade association Oil and Gas UK linked a significant fall in lost time injury frequency rate observed since 1997 to the introduction of the regime.^[107] The decrease in the number of accidental hydrocarbon release events in the British offshore oil and gas industry has also been correlated to the new regulatory approach.^[145] A study commissioned by the Health and Safety executive found that the regime heightened awareness of risks throughout the industry and set in motion a more structured decision-making process targeting risk reduction efforts, safety management system improvements, and a better safety culture.^[146] According to another source, Piper was the catalyst for a development from an unsystematic, albeit well-meaning, collection of standards and processes to a systematized approach specific to safety.^[147]

However, some criticism of the safety case approach has also been voiced, pointing to implementation and communication problems as well as issues with the supporting safety studies.^[112] The industry's cost-cutting initiatives as well as the handling of workers' involvement in the development of safety cases have also been identified as potential factors of degradation of the safety case regime.^[148]

The safety case regime has been adopted outside the United Kingdom, both as a regulatory instrument (for example in Australia,^[149][150] Malaysia,^[151] and Norway,^[149] among others) and as a voluntary initiative taken by several oil companies.^[152] In the United States, the American Petroleum Institute's Recommended Practice 75 for Development of a Safety and Environmental Management Program for Outer Continental Shelf (OCS) Operations and Facilities was issued, at least in part, in response to the tragedy.^[153][154]

In terms of facility design, some of the Cullen Report's recommendations have become tenets for the safe design of offshore oil and gas installations:^[9]

• Systematic identification and assessment of fire and explosion hazards.
• Analysis of and protection against smoke and gas ingress as well as survivability against fire and explosion of a temporary refuge (usually within, and potentially extending to the entirety of, the living quarters), where the crew could muster and wait out the accident, while arrangements for emergency management and/or facility evacuation are put in place.
• Analysis of escape routes and means of evacuation, with due regards to their survivability, accessibility and redundancy.
• Analysis of the survivability of safety-critical systems required for emergency management, such as emergency shutdown valves (in particular those along hydrocarbon risers), primary structural elements, hydrocarbon piping and vessels, fire pumps, firewater distribution and deluge, control and radio rooms, public announcement and general alarm system, emergency sources of power, emergency lighting, all of which failed on Piper, additionally to the aforementioned impairments of escape routes and safe muster area.^[40]

These analyses, which are called "forthwith studies" by the Cullen Report, are now standard engineering deliverables in the design of offshore oil and gas facilities.^[h] Quantified risk assessment (QRA) also became more common, particularly in support to ALARP arguments.^[157] One effect of these studies was that a rectangular (rather than square) layout became common for new North Sea platforms, to allow for increased spacing between vulnerable areas and major hazard modules. For the same reason, bridge-linked platforms became more common to increase separation from the accommodation module.^[9][158] Other lessons learnt in design were the importance of blast walls in protecting safety-critical systems; the need to minimize congestion and promote natural ventilation in process areas, to decrease the chance of explosions; the need to ensure that the temporary refuge HVAC system be capable to repel smoke and gas ingress by positive pressurization and implementation of gas-tight dampers automatically actuated from smoke and gas detectors; redundancy of critical communication systems, like radio and public address; remote start of fire pumps; need to optimize the location and fireproofing of riser emergency shutdown valves;^[3][107] assessment for the need of subsea pipeline isolation valves, to segregate the amount of hydrocarbon available for fire escalation in case of riser or riser valve failure.^{[3][9][159][i]} The resulting changes in the design philosophy of offshore facilities have therefore been towards an inherently safer design (ISD) concept.^[9]

In the same spirit, companies also sought to decrease the number of operators needed to run offshore facilities, in an attempt to reduce human exposure to major accidents.^[22] The first totally unoccupied (normally unmanned) installation, in the Amethyst gas field, was commissioned in September 1990.^[141] There is debate as to whether unmanned facilities are actually beneficial in terms of decreasing risk to the workers, given the requirements to transfer personnel to and from the platform (for inspection and maintenance activities), which in itself carries an amount of risk associated to helicopter flights, boating, and boat-to-platform personnel transfer.^[165]

Memorials

A condolence banner was gifted in 1989 by the Victorian Trades Hall Council of Australia, and is now in the Aberdeen Maritime Museum.^[166][167]

On 6 July 1991, the third anniversary of the disaster, a memorial sculpture was unveiled by the Queen Mother in the Rose Garden within Hazlehead Park in Aberdeen.^[14][123] In it are three figures of oil workers, one facing west and representing the physical nature of offshore activities, one facing east and representing eternal movement and youth and the central one, facing north and whose left hand holds a pool of oil sculpted in the shape of an unwinding spiral.^[168] It was created by Sue Jane Taylor, a Scottish sculptor who based much of her work around what she saw in and around the oil industry and had actually visited Piper Alpha in 1987.^[123][169] One of the survivors was used as a model for one of the figures.^[14][166] Also in 1991, Scottish composer James MacMillan wrote Tuireadh, a piece for clarinet and string quartet, as a musical complement to the memorial sculpture.^[170]

A memorial stone was erected in 1992 in Strathclyde Country Park to commemorate the men lost from that region.^[166]

The Piper Alpha Window was created in 1994 by congregation member Jennifer Jane Bayliss for Ferryhill Church in Aberdeen.^[166][171]

The Oil Chapel in the Kirk of St Nicholas, Aberdeen was dedicated in 1990 to mark 25 years of North Sea oil. The chapel hosts a book of remembrance to all those who have died offshore in British waters.^[166][172]

In the media

The incident was featured in the 1990 STV documentary television series Rescue,^[173] about the RAF Search and Rescue Force at RAF Lossiemouth, in the episode "Piper Alpha". Coincidentally, the film crew had been documenting the rescue teams at Lossiemouth at the time of accident and were able to accompany the helicopter during the Piper Alpha disaster, filming events as they happened from helicopter Rescue 138.^[174][86]

The disaster was featured in the first episode of the BBC television series Disaster, aired in January 1997.^[32][175]

In 1998, on the occasion of the 10th anniversary, Prospero Productions of Australia released the documentary Paying for the Piper. It was written and produced by Ed Punchard, who was one of the divers that managed to escape the inferno. The film follows Punchard's return to Scotland to confront his past and culminates in a meeting with Occidental officers.^{[176][177][178]}

In 2004, National Geographic featured this incident in its Seconds from Disaster documentary as the episode "Explosion in the North Sea".^[45]

On 6 July 2008, BBC Radio 3 broadcast a 90-minute play by Stephen Phelps entitled Piper Alpha.^[179] Based on the actual evidence given to the Cullen Inquiry, the events of that night were retold 20 years to the minute after they happened.

Also in 2008, to mark the 20th anniversary of the disaster, a stage play, Lest We Forget was commissioned by Aberdeen Performing Arts and written by playwright Mike Gibb. It was performed in Aberdeen in the week leading up to the anniversary with the final performance on 6 July 2008, the 20th anniversary.^[180]

In 2011, Lee Hutcheon produced and directed The Men of Piper Alpha, a documentary with several interviews to the survivors.^[63][181]

In 2013, on the 25th anniversary of the disaster, the video Remembering Piper: The Night That Changed Our World was released by British offshore oil and gas industry initiative Step Change in Safety. It incorporates passages from the BBC radio play and artwork by Sue Jane Taylor.^[93]

The documentary film Fire in the Night was also released in 2013. It was made by Berriff McGinty Films and co-produced by STV. Producer and cameraman Paul Berriff had been with Sea King Rescue 138 during the filming of the Rescue series.^[174][182]

In 2017 the episode "Oil Rig Explosion" of the Smithsonian Channel documentary series Make It Out Alive! focused on the disaster, with interviews to, among others, Geoff Bollands, Iain Letham, Charles Haffey, and Paul Berriff.^[65][183]

In 2018, a special edition of the Monopoly board game was released to commemorate the 30th anniversary of the tragedy. It was sponsored by a number of companies working in the North Sea offshore oil and gas industry, including majors such as Shell, whose Brent platforms substituted for the four train station squares. The game release was part of a fundraiser for the maintenance costs of the memorial in Hazlehead Park. The box lid prominently featured Piper Alpha imagery and a "Piper Alpha 30th Anniversary" title, which led the game to be referred to as the "Piper Alpha Monopoly". The reactions of some of the survivors and victims' families were negative, calling the game "callous" and a "sick joke". The game was re-released with a different design to clarify that it was really an oil-and-gas (and not a Piper Alpha-themed) Monopoly edition.^[184]

Also in 2018, the disaster was featured on the History documentary series James Nesbitt's Disasters That Changed Britain. Testimonials were heard from survivors and relatives of victims.^[185]

In 2023, to mark the 35th anniversary, writer Mike Gibb adapted his stage play as a novel titled I Had Never Heard a City Cry Before, a quote from the script.^[186][187]