Podcast: Piper Alpha Disaster -- 22 Terrifying Minutes, Countless Lessons Learned

Welcome to Process Safety with Trish and Traci, the podcast that aims to share insights from past incidents to help avoid future events. This podcast and its transcript can be found at chemicalprocessing.com.

This episode is sponsored by Vicinity Software.

Vicinity Software is a scalable batch processing software that's been serving the needs of chemical manufacturers since 2001. Vicinity Software will structure and streamline your operations to give you the highest levels of confidence in product quality and safety. By implementing Vicinity, eliminate outdated basic or disjointed systems and start maximizing your manufacturing capabilities. Since safety is paramount, chemical processes and products are subject to rigid regulations and requirements, making it imperative to use software that supports the unique compliance needs of the industry. Ensuring regulatory and customer driven compliance is just one way to keep manufacturers and end users safe.

I'm Traci Purdum, editor-in-chief of Chemical Processing, and as always, I'm joined by Trish Kerin, the director of the IChemE Safety Centre.

Traci: Hey, Trish, I understand you've been moonlighting and doing another podcast without me.

Trish: I have. I'm in demand, Traci. Yeah. Just recorded a podcast with ABC Radio National in Australia, so hopefully, that'll be going to air at some stage soon.

Traci: Wonderful. And you were talking about the Platypus; that was your topic?

Trish: It was, yeah. So, the weak signals and the Platypus philosophy and how we can get safer workplaces if we can get better at recognizing and managing those weak signals.

Traci: Well, perfect. Well, our last episode, this is episode number 49, episode 48 was the, in case you missed it, and that was when you read your column on the Platypus. So that's fresh in the minds of our listeners right now, so I'm glad you're getting the word out everywhere.

Trish: I certainly am. The Platypus was in Jordan and Bahrain last week, and next week he's going to Osaka.

Traci: That Platypus gets around.

Trish: He does.

Traci: All right, let's get a little more somber here. Today, we're going to be discussing the Piper Alpha oil platform explosion. Located in the North Sea, about 120 miles northeast of Aberdeen, Scotland, it was operated by Occidental Petroleum and began production in 1976, initially as an oil-only platform, but later converted to add gas production. This year marks the 35th anniversary of that disaster in 1988, which killed 167 men. For anyone in process safety, this is sort of required reading. Can you give us a little bit of an overview of the events that led up to the fires and the explosions?

Trish: Absolutely. So this is a terribly tragic event that took place. Work was taking place on the platform in the lead-up to the incident where they were removing relief valves for regular testing and maintenance, which is an activity that happens in processing facilities all over the world. And so, the pump had been isolated and racked out electrically, and the relief valve had been removed, and it was going away to be tested and reinstated and put back. And at the time, they thought it looked pretty good, and it's not going to take too long, so instead of applying blank flanges and properly torquing them up so that the system was completely sealed, even though it was still isolated, the studs were only put on finger tight on those particular blank flanges. And then there was a series of delays in getting the relief valve installed back onto that pump. So, all of that happened on the day shift.

It's important to remember as well that that relief valve was actually located physically away from the pump, so you couldn't stand at the pump and notice the relief valve was missing. It was actually on a different level of the platform, a distance away. Then that evening, they had a problem with some of their other pumps shutting down, and they needed to keep production going. So, what they attempted to do was bring that pump that was isolated back into service. Now, the communication had failed over the shift handover that that pump was certainly not fit for service. It was racked out, it was isolated, but it was deisolated and put back in. And when they started up that pump, they almost immediately had a gas release detected through their detector systems, and it was quite a quick explosion that then took place after that.

So what had been determined as part of that investigation was that gas leaked out of the blank flange that was only finger tight, the operators that started up that pump had no idea that it didn't have a relief valve on it, and the people that put the blank flange on had no idea that pump was going to be started up because it was racked out for maintenance. As part of the permit-to-work system, it was out of service, it shouldn't have been run. It couldn't accidentally be started; it was a deliberate action to restart it. And so what then happened was that the initial explosion took out communications to the platform as well as the control room and effectively left the platform unable to take any response. It then actually, as this fire burned, it caused pipe ruptures and the isolation valves that fed product to the platform also were irrelevant because the pipes had then actually failed around them. So the fire was effectively continually fed by several sources, including two other platforms that were connected to it in the North Sea.

Because we need to remember that this was 35 years ago, so in some ways, things have changed. In other ways, we still have to be very cognizant of the lessons, but the other platforms could see on the horizon that Pipe Alpha had flames, and they couldn't reach them on the radio, and they couldn't get authority from anybody on shore to stop pumping oil and gas to Piper Alpha because the other two platforms actually pumped oil and gas to Piper and Piper then pumped it to shore. Literally, they were pumping fuel to a fire as that fire continued to burn. There were so many different tragic things that we saw in that. Now, to us today, that makes no sense; well, why didn't someone press a stop button? 35 years was a different time when people did not have the ability to be able to intervene and stop unsafe work. That was not an accepted action. Sadly, in some facilities today, it's still not an accepted action, but it is an absolutely vital thing that we need people to be able to do.

Traci: Now, when you say the stop action, and from what I was reading, and there are so many documentaries on this, I was watching a few of them, and the control room wasn't fortified for more than fire protection. The explosions rendered the room useless, which led to the series of events that you just spoke of that caused so many more casualties. I'm trying to get my head around it. So, someone could have hit the stop in the control room, they could have hit the stop production, or in where the valves were... I'm trying to understand what that was about.

Trish: So, what I was suggesting was the other two platforms that were located away from Piper Alpha but connected; no one on those platforms stopped pumping oil and gas to Piper Alpha whilst it was on fire.

Traci: Gotcha. Okay.

Trish: Now, you could actually challenge, would it have made a difference had they actually been able to press the stop buttons? And the reason that that would be a challenge is there was still a lot of oil and gas pressurized in the pipelines that even the moment the other platform stopped pumping, the lines had to be depressured, and they wouldn't have pressured fast enough into their original platforms. Would it have lessened the incident? Probably not. In the grand scheme of things, it probably wouldn't. That oil and gas had to go somewhere and it was going to go to the path of least resistance, a ruptured pipe at the Piper Alpha end.

Traci: What has been learned here after? 35 years was a different time. What has been learned from it since?

Trish: So, Piper is a really interesting one. So, you mentioned that the control room was fire rated but not blast-rated. That was a result of a management of change that had taken place. So originally, it was an oil platform, as you said, that was then converted to handle gas as well. When it was converted to handle gas, in that changeover, it was never thought to install, or they didn't install a blast-proof wall. Now when you're handling gas and higher volatile flammables, you actually need to be protecting against blast and explosion, not only fire. So, it was not actually suitable from that perspective, it hadn't been converted adequately. We also learned an enormous amount around permit to work systems, how they need to be managed, how the organizational culture needs to support them, how they need to be handed over, how permits need to be closed out, how isolations need to be done safely.

And a lot of what we do now in lockout, tagout, and permit-to-work systems or safe work systems is a direct result of what we saw as a cause at Piper Alpha. We've really taken an enormous amount in there. There's also been some changes in how platforms are designed and where the isolation valves to feeder lines are located so that it's unlikely now that a fire on a platform, a modern-day platform, would actually damage a feeder pipe upstream of its isolation valve so that we can positively isolate fuel sources going into a platform. So there certainly have been a lot of practical safety design and system changes that we've seen over the years now.

Traci: With these changes, I mean, have they evolved even more so since then? I know that there were several recommendations for changes, and many you just mentioned, ultimately leading to the enactment of the Offshore Safety Act of 1992. How have they evolved since then? Obviously, things change.

Trish: Yeah, so the safety laws around the world have continued to evolve, and in this particular regime where Piper Alpha was in the North Sea, that's under the UK Health and Safety Executive, and so they do have the safety case regulations there as a direct result of how Piper Alpha evolved. In a number of other countries around the world, they also have the safety case type regulations. So certainly where I'm from in Australia, we have them for offshore activities as well.

One of the beauties about safety case regulation is that by the very nature that determining what is reasonably practicable, which is a legal term in the legislation, by determining that term, you are aware that the goalposts can change on what's acceptable in safety. So the regulations don't mandate and specify specific details, they actually require performance to a particular standard, and it's up to the facility to achieve that standard. And so the facility has the ability to put a case together and say, here's how we're going to achieve this safety, which is effectively what the safety case is.

The reason that sort of legislation continues to evolve without it being redrafted or rewritten is because our knowledge and our techniques, and our technologies continue to improve as well. And so that means that what's reasonably practicable 10 years ago might not be accepted as reasonably practicable today, meaning that you'd need to update and improve and put different control measures in place if they're now reasonably practicable and they weren't then. The performance-based legislation regime that came out of Piper Alpha, particularly in the North Sea first, actually provides almost an evergreen type of regulation without the regulation actually needing to be updated to take into account new technologies, new developments that occur. It's an interesting type of legislation. It's not a type of legislation that's at use in the US, but it is certainly in other parts of the world.

Traci: As I was reading through the investigations and watching the documentary, there was a suggestion that there was a lack of ownership over the events that also might have contributed to the catastrophe and played a part in this. Can you give us some insight into that aspect?

Trish: Yeah, so it was really interesting. As a result, there was a very substantial investigation into it led by a gentleman called Lord Cullen. And Lord Cullen had a number of technical advisors working with him as part of that investigation to determine what had happened and who was at fault. And the interesting thing was, in his investigation, he found no one individual at fault on this incident, but rather he found a complete lack of organizational culture and processes that led to it.

And so the reason that's so interesting is because it was 35 years ago that he stood out and said, "We're not going to blame people for doing things that, at the point in time, when not viewed in hindsight appeared reasonable." There were reasons why they did things, they're the things we need to tackle, they're the things we need to fix. So really focusing on making sure that we understand and have the ability for people to stop work, that we have accountability in our systems and processes, and that our organizational culture and our human factors actually works for what we are trying to achieve as well as our design intent and application.

He really found organizational faults that caused the particular incident, which at the time, was a very interesting finding. Now, that's really what we see a lot more of in findings for very good reason because people will make mistakes, the system needs to be resilient enough to cope with that and not lead to a catastrophic incident. One of his advisors that was involved in it was a safety assessor by the name of Sir Brian Appleton. And he had a famous quote that was said as a result of this investigation, and he said, "Safety is not an intellectual exercise to keep us in work. It is a matter of life and death. It is the sum of our contributions to safety management that determines whether the people we work with live or die." And I think that sums it up really well.

It's not a paper-pushing exercise, it's not a checkbox exercise, people live or die on the basis of how well we do safety management, and that's a really important thing. As safety professionals and as people working in an operational environment and in an office environment contributing to those decisions need to remember what we do, the decisions we make, impact how people do things in the field, and that can result in catastrophic incidents.

Traci: Very powerful quote.

Trish: It is.

Traci: Would a HAZOP have prevented this incident?

Trish: That's a really difficult question to answer. The challenge is that I mean, a HAZOP is a very specific sort of risk assessment. A HAZOP probably would not have identified the specific circumstances that led to this particular incident because a HAZOP would've said, well, we have control measures, and we would've isolated the pump, and we would've blanked out the missing valve, and that would've been fine. And the HAZOP wouldn't also have noted the specific location of the isolation valves feeding the platform as well. So it might have picked up some aspects of it, but would it have picked up the whole part of it? No, I think that's why we need to be looking at scenario management as well and understanding what the complete scenarios are. That's why the use of by bow ties and bow tie analysis is so useful for what we are doing because that could have actually shown an incident pathway that led to this. This is not the first pump that's been deisolated from a permit to work system that's leaked, so we should be picking that up. So I think there's other risk techniques that are important there.

It's also really important to understand, I think what compounded this tragedy was around how the rescue took place. Because of the smoke coming off the platform due to the fire, the idea was that people were going to be rescued by helicopter, and so they were meant to be waiting in the mess hall to then go to the helicopter deck to be helicoptered off. But there was no way helicopters were going to get there, and also how were helicopters going to rescue that many people. There were lifeboats, but they were struggling to get to the lifeboats because of the fire and the smoke. Helicopters were unable to render any assistance because of the fire and the smoke. Most of the workers that died in the incident were together in the mess hall awaiting further instruction because there was confusion on what to do. Nobody knew where to go or what to do.

The evacuation part of the emergency response did not work. Tragically, the men in that area all died from smoke inhalation and their bodies were eventually recovered after the platform had sunk into the sea. Interestingly, those that actually survived the incident jumped off the platform into a burning sea at night in the dark. Now, there's obviously a bit of light around with the fire, but just picture that idea of literally jumping off a burning platform into a burning sea. Now, it's the North Sea, so it's also quite cold water, even in summer. And when you talk, or you hear some of these people, some of the survivors talk about it, they actually talk about how they decided they wanted to die quickly rather than wait slowly to die. Now, they were rescued, most of them, not all of them, but the ones that survived it actually went into the sea, and they were then rescued by supply boats and support boats.

I mean, I cannot even vaguely imagine what making a decision in that situation would be like to have decided to jump to your death and then realize that actually you survived, and then the survivor guilt that goes with that as well. I mean, this incident destroyed so many lives, not only the 167 men and their families, but the survivors as well from the survivor guilt from the experience of that, the impact it had on Aberdeen, which was quite a small place at that point in time because people knew everybody and everybody lived in Aberdeen then. We didn't have so many fly in, fly out people happening then. Everybody lived in Aberdeen, so there were families impacted there. It is truly just one of the most horrific combination events that had such a human impact I think.

Traci: Just terrifying.

Trish: There's an interesting video that I actually shared around the anniversary that's produced by a group called Step Change in Safety. And Step Change is actually led by one of the survivors, a gentleman called Steve Ray, and a few years ago, they actually made a video. It's a dramatization, and I think for me, it's a very emotive video; it portrays what they think was going on at the time, and keep in mind there were survivors to be able to report these things as well. But the thing that struck me the most about the video, I think, is that it's 22 minutes long. And the reason it's 22 minutes long is because that's how long the incident took.

Traci: Wow.

Trish: This was not hours of time, 22 minutes. So I'd certainly urge anybody, it's available on the Step Change for Safety website, go and have a look at that particular video because... And it's under a Pledge for Piper is what they're saying. Pledge to give 22 minutes of your life to watch this video because in 22 minutes, 167 men died, and I would certainly recommend people watch that video and gather your workmates around to watch it. It is worth it.

Traci: I will link to that in the transcript and make sure that our listeners can get to that powerful stuff. Is there anything that you'd like to add to this topic?

Trish: It's really just focusing on making sure we do our risk assessment, we understand our risks, we put our controls in place, and we make sure our controls work. We can't just assume they work because someone designed them that way 15 years ago. We have to be checking them to make sure they're performing to their standard. Make sure people understand the hazards and understand the emergency response and create a culture that has psychological safety where people can stop and say, "No, this is wrong. There's something that's not right here. This is not safe." Piper Alpha sums up all of those things I think. And that would be my call to people, is if you see something that's not safe, you have to stand up and say something about it. And as leaders in an organization, you need to create the culture where your workforce can stand up and say that something's not right.

Traci: Well, Trish, as always, you point out that safety is not an intellectual exercise, and you let us understand that the goalposts change and help us navigate that change. I appreciate the time and the thoughtfulness into this conversation today. Unfortunate events happen all over the world, and we will be here to discuss and learn from them. Subscribe to this free podcast so you can stay on top of best practices. You can also visit us at chemicalprocessing.com for more tools and resources aimed at helping you run efficient and safe facilities. On behalf of Trish, I'm Traci, and this is Process Safety with Trish and Traci.

Trish: Stay safe.