The 380 km stretch of the North Sea between the Orkney Islands and the Norwegian coast looks homogenous and unrelieved to a lay observer. To anyone in the oil industry, however, the waters will be overlaid with an invisible grid dividing them into quadrants of 1° latitude by 1° longitude. Each quadrant is further broken down into 30 blocks. At the height of the UK's oil boom in the 1980s and 1990s, a licence to drill for oil below the waves in some blocks was the gateway to hundreds of millions of pounds a year in revenue.
In the upper part of block 17, quadrant 15, about halfway between Aberdeen in Scotland and Bergen in Norway, sits the 30 sq km Piper oilfield. Test drilling found oil there in 1973. Three years later, US operator Occidental Petroleum started production from one of the largest rigs in the North Sea, Piper Alpha, which was assembled at Ardersier on the Moray Firth and towed to the field where its four legs were anchored to the seafloor. By 1988 Piper Alpha's 20 wells were pumping 125,000 barrels a day from the Upper Jurassic sandstone around 2 km below the seabed.
The terminal was connected by pipelines to the Tartan and Claymore platforms nearby and to the Flotta oil terminal on Orkney. A gas recovery module was added to the rig in 1980 to capitalise on the gas reserves unlocked by oil drilling and to meet new regulations to curb gas flaring.
No chance
In July 1988 the rig was in the middle of long-running maintenance and upgrade work. Occidental decided to continue production during the work rather than shut down the platform, believing its safety procedures were adequate.
On 6 July the pressure valve on one of the rig's two compression pumps that produced condensate (natural gas liquids) was removed for two-yearly recalibration and recertification and a temporary hand-tightened plate was left in its place.
Later in the day, after a shift change, the second condensate pump malfunctioned. Operators and supervisors who did not see the form completed by the engineers who had worked on the first pump saying it was out of commission pending the valve refit, completed a permit to work and restarted it, pressurising the system.
It is likely that condensate gas leaked from the point where the valve had been removed and just before 22.00 hrs, seconds after multiple gas pressure alarms sounded in the control room, it ignited.
Fragments from the explosion in the gas compression module damaged pipework elsewhere and started multiple fires. Choking dense smoke from burning crude oil blocked routes to the rig's lifeboats and some of the crew gathered at a muster station at the top level of the accommodation block to wait for helicopter evacuation, which was rendered impossible by the wind, smoke, and flames.
The Department of Energy's enforcement role conflicted with its responsibility for maximising oil and gas production
Twenty minutes after the first explosion, the heat from the oil fires ruptured a gas pipeline from Texaco's Tartan Alpha platform, feeding another major fire under the platform. The rig's diesel tanks were breached, adding more fuel and, at 22.50 hrs, the pipeline to the MCP-O1 gas processing platform was breached. The result was another major explosion and a fireball more than 150 m wide that engulfed the rig.
By 23.30 hrs the fires' intensity caused the superstructure to sag in the middle; other oil and gas risers failed and, soon after, the accommodation block collapsed into the sea. The famous US firefighter Red Adair was brought in to direct the firefighters but could not contain the blaze.
Of the 226 people on the rig only 61 were rescued. Most of the survivors jumped into the water from the lower decks between the first and second explosions.
Only 135 bodies were recovered of the 165 crew who died, most from the accommodation module where they had been resting between shifts or sought sanctuary. The most common cause of death was smoke inhalation. Two of the crew on rescue vessels also died.
In Aberdeen, office staff at specialist contracting companies that supplied drilling engineers or catering staff to the rig found themselves providing impromptu bereavement counselling to relatives.
Failure all round
In November 1988, a public inquiry was convened, led by Lord William Cullen, a judge who had previously chaired the Medical Appeals Tribunals.
The inquiry sat for 180 days and took evidence from 260 witnesses under cross-examination from 11 QCs. For the first part, which focused on modelling the immediate causes of the disaster, the technical advisers drew on the services of 60 experts and specialist companies in fields including fire dynamics, compressor design, hydrate formation, gas detection and leak rates.
The second part of the inquiry focused on the failings that had made the catastrophe possible. And they were many.
In converting the rig from oil to oil and gas production, the safety principle that the most hazardous areas should be sited furthest from the staffed modules, including the control room, was ignored.
The initial explosion breached the firewalls between modules -- which had been designed to resist fire rather than explosion, in line with the rig's previous use for oil only. Fragments from the firewall disabled communications systems, electrical and emergency electrical supplies.
The lack of a rigid chain of command led to staff on the other platforms connected to Piper Alpha failing to shut down the flow of hydrocarbons to the rig when they knew it was burning. But even if they had closed the lines, a report for Occidental management in 1984 had warned that it would take several hours to depressurise the lines in an emergency and that it would be impossible to fight a fire while fuel was flowing through them.
The shift change between the work on the compression pump and the attempt to restart it was marked by an inadequate handover. Under the flawed permit-to-work system, which drew some of the strongest criticism from Lord Cullen for its lack of rigour and associated training, the permit for the maintenance on the first pump was stored separately from the form that warned it should not be restarted. The Department of Energy, which regulated offshore oil and gas operations, had reviewed Piper Alpha's permit system months before the disaster after a rigger died in 1987.
Lack of adequate emergency training or backup procedures to cope with the disabling of the control room left the rig's crew to respond as best they could to the crisis.
Overall, Occidental relied on a set of disjointed measures rather than a coherent safety management system.
All change
The events of 6 July 1988 completely reshaped the offshore safety regime. The Cullen Inquiry made more than 100 recommendations on 24 topics, from emergency pipeline shutdown systems to lifeboat drills and hydrocarbon release recording; all of them were accepted by the government.
One of the main recommendations led to the Offshore Installations (Safety Case) Regulations, which came into force in 1992. The regulations require operators to submit a safety case dossier detailing the hazards and risks for each installation and the safety management system they will use to bring them as low as is reasonably practicable, plus arrangements for emergency evacuation and rescue.
The safety case must be accepted by the Health and Safety Executive's (HSE) Hazardous Installation Division, Energy Division Offshore. The responsibility for deciding the ways to reduce risk stays primarily with the operator, but those ways have to be justified in advance to the regulator, adding an extra check to the system. The regime has been extended to other high-hazard industries in the UK and copied in other jurisdictions, including Australia and Singapore.
The transfer of regulatory responsibility to the HSE was another Cullen recommendation. The report concluded that, though the Department of Energy's inspectorate was underfunded and under-trained, the fundamental problem was that its enforcement role was at odds with its responsibility for maximising oil and gas production.
The regulatory changes and the shock that the disaster had sent through the oil industry prompted an estimated £2bn investment by operators in new safety systems and procedures.
When production restarted in the Piper field five years after the disaster, the new Piper Bravo platform, installed 800 m from where Piper Alpha had stood and still operating today, featured safety measures including multiple emergency shutdown valves on all lines to and from the rig and enclosed direct evacuation routes for crew from their living quarters to the sea.
Declining balance
In the 30 years since Piper Alpha there have been no safety failures on North Sea installations involving fatalities on even one-twentieth of the scale. Excluding air accidents, there were six fatalities in the ten years to 2016.
In 2015, before a fall in the oil price, the North Sea remained the world's most active drilling region with 174 installations. This year BP announced two new finds expected to help it to double its oil production to about 200,000 barrels a day. But that is just two-thirds of what Piper Alpha alone was producing at its peak in the late 1970s.
What has been described as the "layer cake" geology of the North Sea may yet yield surprises, but even the most optimistic estimates of reserves suggest that more than three-quarters of recoverable oil in the region has been extracted. What remains is harder and more expensive to get at.
As the accessible hydrocarbon reserves have dwindled, the regulator has voiced concern about the potential for inattention born of the interval since a major incident involving loss of life and a desire by operators to cut costs, resulting in a raised risk level.
In 2007 the HSE released its Key Programme 3 report - the result of a three-year investigation into the safety and integrity of more than 100 offshore installations (bit.ly/2JkDXUc). The study noted that many North Sea facilities were already beyond their design life and there was a "poor understanding across the industry of potential impact of degraded, non-safety-critical plant and utility systems on safety-critical elements in the event of a major accident". The use of operational risk assessments to manage degraded safety critical elements is also "often not well controlled".
Unions have repeatedly warned that a reducing but still significant number of large hydrocarbon releases from platforms and vessels in recent years makes another disaster hard to rule out. A survey by the Unite union in January 2017 found that almost 60% of offshore workers believed safety standards had dropped in recent years.
At a gathering of oil and gas executives in 2010, Judith Hackitt, then HSE chair, warned against "another cycle where improved short-term performance leads to complacency and reduced investment".
Measured in annual fatality rates, the UK boasts a world-beating safety record. But as incidents such as Piper Alpha, Hillsborough Stadium in 1989 and most recently last year's fire at Grenfell Tower in London show, the virtuous trend in deaths due to failures to manage a duty of care is punctuated by catastrophes on a scale that removes any scope for feelings of superiority.
Anniversaries like this month's are opportunities not just to pay respects to those who lost their lives but to rehearse the oversights and errors that allowed the worst to happen.
