What Have We Really Learned?

Twenty Five Years after Piper Alpha

Michael P. Broadribb
Baker Engineering and Risk Consultants, Inc., 3330 Oakwell Court, Suite 100, San Antonio,
TX 78218-3024; mbroadribb@bakerrisk.com (for correspondence)
Published online 27 June 2014 in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/prs.11691

Twenty five years ago, a major disaster in the North Sea

took the lives of 165 persons on board the Piper Alpha oil
production platform as well as 2 people from the rescue
crew. To this day, the incident represents the worst offshore
oil industry disaster ever and has become an industrychanging watershed event. The subsequent Public Inquiry
report made a number of recommendations that were related
to inherently safer design (ISD), including the mandatory
use of a systematic fire and explosion analysis, analysis of
smoke and gas ingress to living quarters, and the requirement for a temporary (safe) refuge area capable of surviving
the initial fire/explosion. Other recommendations addressed
analysis of the vulnerability of safety critical equipment/elements, and evacuation, escape, and rescue in the event of
major incidents. Implementation of the above recommendations aimed to reduce the residual risk of the design through
the use of an ISD approach. The residual risk then had to be
managed by a safety management system (SMS), which is
another inquiry recommendation that comprises many of the
elements of process safety. Finally, the inquiry recommended
developing a Safety Case to describe and justify the design,
the inherent hazards and residual risk, and the SMS. This
Safety Case is now the basis for periodic audits. Over the past
25 years this author has had the opportunity to visit offshore
production platforms and drilling rigs and to review new offshore projects in many regions of the world. This article
addresses both the strengths and weaknesses observed, and a
number of common themes involving management systems,
human factors, process safety and integrity management at
such facilities. Comparisons will be drawn to the evidence
aimed at preventing future major incidents that the author
and others presented at the Piper Alpha Inquiry, and to the
C 2014 American Institute of Chemical
Inquiry recommendations. V
Engineers Process Saf Prog 34: 1623, 2015

Keywords: process safety management; offshore; incidents;

permit to work; safety culture; human factors; emergency
response; regulatory regime

north east of Aberdeen, Scotland and was commissioned by

the Operator, Occidental Petroleum (Caledonia), in 1976.
Production peaked at 300,000 barrels of crude oil per day
(bbls/day) from 24 wells, but had declined to 125,000 bbls/
day by the time of the incident in 1988.
Piper Alpha (Piper) was connected to the Flotta oil terminal
in the Orkney Islands with a 30-inch diameter crude oil subsea
pipeline it shared with the Claymore platform (Figure 2).
In 1980, Piper had been modified to produce gas as well
as oil. After those modifications Pipers normal operating
mode was known as Phase 2, that is, operating with a gas
conservation module. Separate 16- and 18-inch diameter subsea gas pipelines connected the Piper to the Texaco Tartan
and Occidental Claymore platforms, as well as the Total
MCP-01 gas processing platform, thus giving the Piper four
main transport risers: the oil export riser, the Claymore gas
riser, the Tartan gas riser, and the MCP-01 gas riser.
The Piper platform was comprised of four main modules:
A.
B.
C.
D.

Wells,
Oil/gas separation,
Gas compression,
Utilities.

Firewalls separated those four modules from the living

quarters and the power generation located above the utilities
module (Figures 3 and 4).
Two high pressure condensate pumps were located in the
gas compression module, with one operating and one on
standby. As well as exporting gas to MCP-01, the processed
gas was also used to fuel the main power generators that
supplied the electrical power to the platform.
On July 6, 1988, a major disaster took the lives of 165 persons on board the Piper Alpha platform and 2 of the rescue
crew from the Sandhaven, a standby vessel for a mobile offshore drilling unit nearby. To this day, the incident represents the worst offshore oil industry disaster ever and has
become an industry changing watershed event.

INTRODUCTION

The Piper Alpha platform (Figure 1) was located in 474 ft

of water in the UK sector of the North Sea about 120 miles

This article was originally presented at the 10th Global Congress

on Process Safety, New Orleans, LA, 31 March to 2 April 2014.
C 2014 American Institute of Chemical Engineers
V

Process Safety Progress (Vol.34, No.1)

SEQUENCE OF EVENTS

A major turnaround and upgrade modifications commenced in July 1988, including the replacement of the gas
conservation module. Occidental decided not to shut down
the platform during the turnaround as originally planned and
the Piper Alpha reverted to its initial Phase 1 mode of operation, that is, operating without a gas conservation module.
Since the detailed sequence of events has been extensively reported, most notably in the report of the subsequent
March 2015

16

public inquiry (known as the Cullen Report) [1], the following is a brief summary of the major contributory events:
On the morning of July 6, 1988, pressure safety valve
(PSV #504) on one of two Condensate Pumps (Pump A) was
removed for routine maintenance. The open condensate
pipe was temporarily sealed with a blind flange that was
either not rated for the normal pressure or was not tightened
properly. Because the routine maintenance work was not
completed by the end of day shift (6:00 pm), the engineer
noted on the work permit that the job was incomplete and
removed the permit from the job site to the control room,
but neglected to inform the night shift.
The diesel and electric fire pumps were on manual control during the evening of July 6 as divers were working on

Figure 1. The Piper Alpha Platform. [Color figure can be

viewed in the online issue, which is available at wileyonlinelibrary.com.]

the platform jacket structure. At 9:45 pm, Condensate Pump

B stopped due to a suspected hydrates blockage and could
not be restarted. Power supply for construction work
depended on Pump B and there were only a few minutes to
get the pump back on line. Therefore, a decision was made
by the night shift crew to start Pump A, as no one knew the
actual status of the permit and the PSV location was not visible from the pump.
At 9:55 pm, gas leaked from the blind flange at high pressure and activated numerous gas alarms. Before anyone
could act, the gas cloud exploded destroying the firewalls of
the gas compression module. Missiles and debris from the
explosion ruptured condensate and oil pipework, creating
secondary fires that escalated generating thick black smoke
and toxic fumes. An emergency shutdown (ESD) was activated to immediately stop production and processing from
Pipers wells before the damaged control room was abandoned. Unfortunately, the public address system likely failed
in the initial explosion, and several managers and

Figure 3. Piper Alpha (west elevation) [1].

Figure 2. Pipeline Connections to Piper Alpha [1].

Process Safety Progress (Vol.34, No.1)

Published on behalf of the AIChE

DOI 10.1002/prs

March 2015

17

A public inquiry was convened by the UK government

under the chairmanship of The Hon. Lord W. Douglas

Cullen, a senior member of the Scottish judiciary. He was

ably assisted by three assessors, most notably an experienced
process safety expert, Professor Frank Lees (of Loss Prevention in the Process Industries [2] fame). The inquiry was
conducted in two parts to determine (i) the circumstances
and causes of the disaster and (ii) examine means to prevent
future major accidents.
The oil and gas production companies trade association,
the UK Offshore Operators Association (later renamed Oil &
Gas UK), provided 34 expert witnesses, including this author,
to the second part of the inquiry. The authors evidence
focused on process safety management. More specifically,
with a regulator proposing mandatory installation of subsea
isolation valves (SSIVs) on all platform/pipeline interfaces,
the author presented a quantitative risk assessment approach
to demonstrate that SSIVs did not universally provide the
most effective risk reduction and that other alternative safety
measures should be considered.
The subsequent public inquiry report (known as the
Cullen Report) [1] determined that the initial cause was due
to a leak of gas condensate as a result of pressurizing the
pipework where the PSV had been removed. Lord Cullen
was highly critical of the Operators inadequate maintenance
and safety practices. He also determined that there were a
number of contributory factors, including a breakdown in
Pipers chain of command and communication to the crew,
failure of firewalls, and absence of blast walls when Piper
was upgraded to handle gas, and the continued operation of
other platforms that were not shut down when Piper raised
the initial emergency.
Even before these findings were published, most prudent
offshore Operators conducted internal assessments of their
own platforms and management systems as these causes
began to emerge from the evidence heard by the public
inquiry. Some of those assessments included evaluations of
work permit systems; pipeline ESD systems; ingress of smoke
into living quarters; evacuation, escape, and rescue systems;
and developments in Formal Safety Assessment methodologies for offshore platforms [3,4].
The Cullen Report made 106 far-reaching recommendations, which were all accepted by the North Sea industry,
and set new standards for the management of safety on offshore oil and gas platforms that are still in force today.
Nearly half (48) were directed at operating companies, while,
with the exception of one for the Standby Ship Owners
Association, the remainder (57) fell to the regulator.
In fact, Lord Cullen recommended that a specialist division
of the UK Health and Safety Executive (HSE) should oversee
health and safety offshore, in place of the Department of
Energy, as having both production and safety overseen by the
same agency provided a conflict of interest. The inquiry
directed that the HSE should be well-resourced (in both competencies and numbers) to fulfill its duties, unlike its predecessor that was under-resourced. Furthermore, the existing
prescriptive regulatory framework was replaced with a goalsetting framework driving toward continuous improvement.
Central to this framework was a Safety Case that Operators/
owners of every fixed and mobile installation operating in UK
waters are required to submit and receive acceptance from
the regulator before proceeding with activities.
Subsequently, new regulations were promulgated in the
UK sector of the North Sea mandating the Cullen Report recommendations. Similar regulations have been adopted in
other offshore areas such as Norway and Australia. Even
before some regulations had been finalized, the UK industry
acted immediately to carry out their recommendations, which
expedited learning of many of the lessons below.
Finally and often overlooked in the aftermath of the
worlds worst offshore disaster, Lord Cullen reassured

18

DOI 10.1002/prs

Figure 4. Piper Alpha (east elevation) [1].

supervisors had already been killed during the initial blast.

No orders were given to evacuate the platform.
In an emergency, the normal procedure was to muster at
the lifeboat stations, but since they were exposed to the large
fires, the crew had no option but to muster in the fireproof living quarters. Although the living quarters were situated under
the helideck, smoke from the fires prevented helicopters from
landing. The ingress of combustion products (smoke, carbon
monoxide, and carbon dioxide) into the living quarters
through doors and penetrations caused the situation to deteriorate. With the chain of command having failed, no instructions
were given to the crew. However, on their own initiative, two
men tried to reach the fire pumps that were on local manual
start, but were apparently killed doing so.
The Claymore and Tartan platforms continued to pump
oil despite being aware of an emergency, as they had no
voice communication with Piper Alpha and neither platform
manager had permission to shut down from his respective
leadership. The back pressure from this pumping continued
to feed the fires through ruptured pipework, although the
fires would have burnt out had Claymore and Tartan shut
down when they first became aware of Pipers emergency.
At 10:20 pm, the Tartan gas riser failed catastrophically,
releasing in excess of 15 tonnes of gas per second at 120 bar
pressure. While most of the Piper employees were still sheltering in the smoke-filled living quarters, some desperately
tried to jump into the sea from various levels of the platform
including the helideck.
The fire from the Tartan gas line was dwarfed at 10:50
pm when the gas riser for MCP-01 platform also exploded
catastrophically. With flames in excess of 300 ft high, the
extreme heat started to melt the surrounding structure. Two
crewmen on a fast rescue boat and some of the jumpers
they had rescued were killed in the explosion. At this point,
the Claymore platform stopped pumping oil.
At 11:20 pm, the Claymore gas riser also failed, and 30
min later the living quarters and the power generation/
utilities module collapsed into the sea and sank. Within
another hour, the remaining platform structure collapsed
with the exception of the wells module.
Later that year, the living quarters were recovered from
the sea bed, and the bodies of 87 men were found inside.
Thirty bodies were never found. There were only 61 survivors, mainly those who took matters into their own hands
and jumped into the sea.
THE AFTERMATH

March 2015

Published on behalf of the AIChE

Process Safety Progress (Vol.34, No.1)

stakeholders (industry, government, regulator, and public)

that offshore oil and gas operations could be conducted
safely if a logical, goal-oriented approach was implemented,
together with effective application of technology and rigorous inspection practices.
LESSONS LEARNED

Significant improvements have been made in the UK offshore industry since Piper Alpha, including improvements in
both hardware and safety culture. The following details
some of the lessons learned:
Safety Case
The Safety Case regulations [5,6] came into force in 1992,
and by late 1993 Safety Cases for every platform and rig had
been submitted to the HSE, who accepted the last of them
by the end of 1995. The Safety Case must describe and justify
the platform/rig design, the inherent hazards and residual
risk (As Low As Reasonably Practicable), and the means of
managing the residual risk to ensure health and safety. These
means are known as the Safety Management System (SMS)
which embraces the elements of both process safety and
occupational safety. The Safety Case must be maintained up
to date over the lifecycle of the platform/rig, and is the basis
for periodic audits. The regulations were revised in 2005 to
reflect the experience gained from the early Safety Cases.
The Safety Case is backed up by a regulator with
adequate and competent resources. The former regulators
inspections had been superficial and had not revealed latent
deficiencies in safety management when Pipers work permit
system was audited in 1988 before the incident. The HSEs
inspections by contrast are now thorough and conducted in
depth by knowledgeable and experienced inspectors.
The Safety Case has forced a more robust and systematic
assessment of major hazards and has driven risk reduction
much more so than OSHA PSM [7], EPA RMP [8], MMS SEMP
[9], or what BSEE SEMS [10] is likely to achieve. This has
probably reduced the likelihood of a similar incident occurring in UK waters by several orders of magnitude. It is a best
in class regulatory regime second to none, a lesson for other
regimes around the world, and a fitting legacy in memory of
those who died on Piper Alpha.
While the safety case regime is best in class, the practice
of developing the Safety Case is sometimes not without fault.
Some operating companies have allowed the Safety Case to
become a paper exercise produced by consultants. It has still
driven risk reduction, but much of the potential learning and
understanding has been lost as a result of the operating companies employing consultants to write the document instead
of doing it themselves. Some of the consultants in turn have
developed voluminous documents that, at the very least,
would benefit from a concise but comprehensive summary
manual. Such a manual could be read in a day by a new
manager or employee, who would then have a good understanding of the platform design, its residual risk and how the
SMS manages those risks. Thus, the Safety Case could
become an excellent training tool.
Forthwith Studies
A number of Cullens recommendations are related to
inherently safer design (ISD), including the mandatory
use of:
 Systematic analysis of fire and explosion hazards,
 Analysis of smoke and gas ingress into living quarters,
and the requirement for a temporary (safe) refuge capable
of surviving the initial fire/explosion and any escalation
for a reasonable duration to permit evacuation and
escape,
Process Safety Progress (Vol.34, No.1)

 Analysis of the vulnerability of safety critical equipment or

elements, such as emergency shutdown valves (ESDVs),
 Analysis of evacuation, escape, and rescue in the event of
major incidents.
The sum of these recommendations has reduced residual
risk of the design through use of an ISD approach. The
residual risk then has to be managed by the SMS. These four
analyses, known as the Forthwith Studies, were subsequently promulgated in detailed goal-setting regulations [11],
which set out the objectives that must be achieved. This
approach allows flexibility in the choice of methodology or
equipment that may be used by Operators to meet the
requirements.
The Forthwith Studies have been responsible for a fundamental change in platform design, and to a lesser extent in
drilling rig design. Early platform design, even in the North
Sea, owed allegiance to designs used in the less hostile and
shallower environment of the Gulf of Mexico (GoM). As
such, the platform plot plan was essentially square, and,
although the modules were normally organized so that the
most hazardous operations were separated from the living
areas, the Piper conversion to gas processing ruined this
safety concept. The end result brought together sensitive
areas with gas compression, probably the highest risk, next
to the control room. As a result of the Forthwith Studies,
future production platform designs invariably have a more
exaggerated rectangular plot plan/layout than the Piper
Alphas essentially square layout. This increases the separation of accommodation from hazardous modules.
The layout of Piper Bravo, the platform designed for Elf
Enterprise Caledonia to replace Piper Alpha when they took
over the license block from Occidental, was rectangular
(Figure 5). Piper Bravo set the standard for a new generation
of offshore platforms with safety as an inherent feature [13].
An alternative to the rectangular layout is the provision of
a separate bridge-linked accommodation platform, which
creates an even greater separation to hazardous modules.
However, it is sometimes difficult to justify the extra cost of a
second platform for living quarters, especially in lower production oil/gas fields and/or greater water depths.
Other design lessons learned were:
 Blast walls (as well as firewalls) can aid separation of sensitive modules, unlike Piper where firewalls were not
upgraded to blast walls, and were destroyed in the first
gas explosion.
 The design of the temporary refuge, invariably the living
quarters, should be protected from fire and explosion,
pressurized, and specified with an HVAC system equipped
with automated fire dampers to prevent the ingress of
smoke and gas.
 Unlike Pipers control center and radio room that were
devastated in the first explosion, control rooms (process
and emergency) should be remote from hazardous
modules.
 It is important to avoid common mode failure of communication systems (radio and public address). Pipers systems were both knocked out by loss of the control room,
radio room, and uninterruptible power supply.
 ESDVs are necessary to protect against large hazardous
inventories in pipelines, and should be protected from
fire and explosion by enclosures.
 Exposure to huge inventories in hydrocarbon pipelines
can be limited using not normally manned platforms as
collector hubs. The Forties Unity riser platform is a good
example of this concept.
 Diesel should not be stored above the process plant. This
was responsible for some of the fire escalation on Piper.

Published on behalf of the AIChE

DOI 10.1002/prs

March 2015

19

the Piper Alpha disaster. However, the human element is still

important, especially in delivering an effective SMS performance. Indeed, the Cullen report recognized the need for better leadership competencies for Offshore Installation
Managers (OIMs), especially during emergencies. It is especially important that OIMs, supervisors, and operators are
empowered to shut down operations in the event of significant safety issues, unlike the crews of the Tartan and Claymore platforms who did not believe they had authority to
stop production, even though they could see that Piper was
burning.
Other important human factors offshore include correctly
and diligently implementing operating and maintenance procedures, permits to work, management of change, and emergency preparedness, that is, many of the traditional elements
of process safety. However, the regulator also expects the
SMS to address some of the additional process safety elements in Risk-Based Process Safety [14].
Workforce involvement is an important facet of the SMS
and was mandated in 1989 through regulation [15]. This has
been a major driver of improvements in offshore health and
safety, and safety representatives have made a valuable contribution and are actively engaged with the industrys Step
Change in Safety [16] campaign to share best practices. This
initiative aims to continue the post-Piper Alpha improvements, avert complacency, and drive even greater improvement through employee participation.
Some of the specific operations and maintenance lessons
learned include:

Figure 5. Piper Bravo Layout [12]. [Color figure can be

viewed in the online issue, which is available at wileyonlinelibrary.com.]

 Fire pumps must have spatial separation and remote start,

unlike Piper where the fire pumps were in the same location and on local start.
Figure 5 clearly shows the rectangular design of the Piper
Bravo supporting jacket and each level of the platform.
Accommodation is located as far as possible from the hazardous modules (wells/drilling, gas compression, and oil/gas
separation). The nonhazardous utilities module separates the
accommodation and production modules.
The accommodation is designed as the temporary refuge
with at least 2 h of fire/explosion protection, and has
shielded escape routes (an industry first) leading to free-fall
lifeboats.
Walls and decks separating each module were analyzed
and designed to contain any blast within the immediate area.
In an emergency, the process equipment has a rapid
blowdown capability to remove hydrocarbons. Diesel firewater pumps supplying the deluge systems are located in
the wellhead and utilities areas.
Piper Bravo has six risers under the wells module (remote
from accommodation) connecting it to subsea oil and gas
pipelines. Each pipeline has duplicated ESDVs (topsides and
subsea), closing automatically on loss of hydraulic pressure.

 There must be written operating procedures, unlike

Pipers Phase 1 operation that had only been implemented once since 1979.
 Temporary promotion is undesirable during critical operations, such as a nonroutine operating mode. The Operations Superintendent, deputy Operations Superintendent,
and Lead Production Operator on Piper were all temporary promotions during a nonroutine operation.
 Training of contractors is essential. It had been the first
day on the platform for the Production Operator (a contractor) on the gas plant, who was on his own without
any operating procedures.
 Work permit systems must be foolproof. If two or more
jobs are being performed on the same equipment or in
the same area, the chance for confusion as to which permit applies exists. Multiple work permits must be properly controlled. The permit to remove the PSV was
suspended after PSV removal and had been removed
from the job site without any communication to others.
Work on the second permit had not commenced.
 Shift logs and handover must be comprehensive. The
night shift did not know the PSV had been removed or
that the condensate pump had been electrically isolated.
 Blanks must be rated for the full service pressure and
fully bolted. It is unlikely that this was done properly.
 Fire pumps, especially diesel emergency pumps, must
always be available and accessible. Both fire pumps on
Piper were on local manual control due to diving operations near their suctions. An earlier audit recommendation
had not been implemented to keep the fire pumps in
automatic mode if divers were not working directly in the
vicinity of their intakes.
 Safety equipment needs maintenance, too. Only two life
rafts were launchedneither inflated.

Safety Management System

The ISD approach recommended by the inquiry indirectly
places less reliance on the human than was the case before

Safety Culture
Culture is the result of everything that happened or failed
to happen. The quality of leadership and commitment to

20

DOI 10.1002/prs

March 2015

Published on behalf of the AIChE

Process Safety Progress (Vol.34, No.1)

safety can drive or limit the safety culture of an organization.

The essential features of a sound safety culture include
enforcing high standards of operation while maintaining a
sense of vulnerability, open and effective communication,
and timely response to known issues and workforce
concerns. Managers must develop and sustain a culture that
embraces both process safety and occupational safety [17].
There are a number of safety culture lessons from the
Piper Alpha:
 Safety yields greater production in the long term. The
operator tried to keep the gas plant running after a high
level alarm and did not know there was no trip in the
Phase 1 mode.
 Safety must not be compromised by production or cost
priorities. The Claymore and Tartan platforms continued
to pump hydrocarbons, as the OIMs did not have permission to shut down due to the huge cost, since it would
take several days to restart production with substantial
financial consequence. If they had shut down after the
initial blast, the rupture of the gas risers responsible for
Pipers destruction would likely have been prevented enabling the crews evacuation.
 Procedures are of no use if they are not followed.
Adequate safety policies and procedures were in place,
but their implementation was deficient. The work permit
system was often knowingly and flagrantly disregarded,
for example, missing signatures and gas tests, and there
was failure to inspect jobsites or return permits to the
responsible person at end of shift. These problems were
not reported and management did not verify operation of
the system.
 Periodic safety audits must be performed with rigor to
identify management system weaknesses before a major
incident occurs. Pipers audits were superficial, few if any
issues were found, and not all were reported.
 Known problems with safety systems must be resolved in
a timely manner. Problems with the firewater deluge system had been known since 1984, and 50% of firewater
sprinklers in the gas compression module were corroded
and blocked. Even if firewater had been available, its
effectiveness would have been limited. Management also
knew that the Piper structure had no fireproofing and that
structural integrity could be lost in minutes in the event of
a large hydrocarbon fire.
It is clear from these examples that Piper management
adopted a superficial attitude to risk management and did
not personally probe problems or verify compliance to company practices. Other Piper cultural issues are described in a
CCPS publication [18].

Emergency Response
It is unclear if there was sufficient time for a more effective emergency evacuation. Most of the personnel with
authority to order evacuation were killed in the first blast
which destroyed the control room. The second explosion
occurred 22 min later. By the time rescue helicopters reached
the scene, flames over 300 ft in height prevented safe
approach.
The Piper area of the North Sea had a dedicated firefighting and rescue semisubmersible vessel, the Tharos, which
included an extending gangway bridge. By chance, the
Tharos was moored in the vicinity of Piper, but its arrival at
Piper was delayed by 30 min due to its thrusters cutting out.
Then, Thaross fire monitors did not discharge water until 14
min after the fire pump was started, due to too many monitors being opened. Tharos attempted to extend its gangway
Process Safety Progress (Vol.34, No.1)

Figure 6. Selected major events from Piper to present.

to Piper but the slow moving mechanism failed, probably

due to the high temperatures.
The massive fire, high temperatures, and thick smoke prevented escape by Pipers own lifesaving equipment (lifeboats
and life rafts). Eventually, due in part to spray from Thaross
monitors, some men climbed down the platform and jumped
into the sea. Most survived, but many suffered horrific burns
from burning oil on the sea. Other men trapped higher up
jumped from the helideck at the 174-ft level, but few survived the fall. Those who did survive jumping into the sea
were picked up by fast rescue craft and Pipers dedicated
standby safety boat, Silver Pit, a converted trawler. The Silver
Pit, whose searchlight did not work, suffered significant damage from the heat and missiles, but picked up 37 of the 59
survivors from the burning sea.
The above description reveals a number of specific emergency response lessons learned including:
 Management and platform crews need to be prepared for
a major emergency. Pipers emergency training was cursory, and needed to be much more thorough. Management failed to ensure that emergency training was being
provided as intended.
 Emergency plans need to be exercised and understood by
all concerned. A critique of drills and exercises should be
used as a basis for continuous improvement. Emergency
drills need to include major incident scenarios in which
the chain of command may be impaired. The Tharos
could have responded sooner if the operation of its fire
monitors had been better understood.
 Emergency equipment needs to be designed for the emergency scenarios under which it may be required to function and meet its design intent. The Thaross gangway
was too slow and not designed to operate under intense
heat. Like many standby safety boats at the time, the Silver Pit was essentially unsuitable for the purpose of rescuing survivors.

Published on behalf of the AIChE

DOI 10.1002/prs

March 2015

21

 More than one route to helicopters and lifeboats

must be present at any given time to ensure evacuation of the platform in a crisis situation. The lifeboats and other escape routes were inaccessible due
to the fires.
 Emergency equipment needs to be maintained and periodically tested to assure it is reliable and fit for purpose.
Two life rafts were launched but neither inflated.
As a result of these lessons, many platforms today have a
greater number of self-inflating life-rafts, ladders, knotted
ropes, lifebuoys, and other escape devices in diverse locations on all deck levels. However, these systems are only
backup to the main escape method, totally enclosed lifeboats, with at least two protected routes to the lifeboats from
anywhere on the platform.
Some Operators in the North Sea have opted for free-fall
lifeboats rather than conventional davit launched boats.
These free-fall boats are located in a heat shield, designed to
withstand temperatures as high as 1,000 C (1,832 F) and can
be launched from inside the boat when everyone is strapped
in. The lifeboat hits the sea at an angle such that its momentum takes it underwater away from the platform until it
emerges about 150 ft clear of the platform structure (so that
it cannot strike the structure due to wave action) or any fires
at sea level. Piper Bravo was the first platform in the UK sector equipped with free-fall lifeboats.

Similar weaknesses in leadership, human factors, culture,

and safety management were apparent from the authors
recent visits to drilling rigs [1921] around the world in the
aftermath of the Deepwater Horizon incident [22]. Unless the
drilling industry changes its focus on monitoring individual
worker injuries, while ignoring warning signs of process
safety problems that have the potential to lead to major incidents, then the industry is likely destined for more disasters.
While nothing in the drilling industry may ever match the
enormity of Piper, every life lost is unacceptable.
While safety on production platforms has undoubtedly
improved in the last 25 years, we owe it to the memory of
those who lost their lives in the Piper incident to continue to
make safety absolutely the first priority. A disaster like Piper
must never be allowed to happen again. That would be a fitting legacy in memory of those who died.

LITERATURE CITED

Twenty five years ago a truly horrific catastrophic disaster

took many lives in the space of less than 3 h, and to this day
most of the relatively few survivors still bear mental scars,
not to mention horrendous burns. Today all that is visible of
what in 1988 was the North Seas largest and oldest platform
is a wreck buoy. The Piper Alpha disaster has become a
watershed event that provided the impetus for change in the
management of offshore safety, and justly changed the
industry in the North Sea and further afield.
The Piper Alpha tragedy is rich in lessons involving many
aspects of engineering design, risk management, management systems, human factors, process safety and integrity
management. Many of these lessons are as equally applicable
to the onshore refining and chemical industries as they are
to offshore oil and gas drilling and production. The North
Sea industry embraced many of the lessons and Public
Inquiry recommendations in the immediate aftermath of the
disaster, and significant improvements have been achieved.
There were so many lessons to learn that the author may
have missed some, while the industry, particularly outside
the North Sea, has forgotten others that are being relearned
the hard way. Figure 6 lists some of the major incidents that
have occurred around the world since Piper, and that share
some similar lessons.
The tremendous foresight of Lord Cullen and his Public
Inquiry assessors paved the way for a new rigorous goalsetting Safety Case regime that is second to none, and has
driven risk reduction in the North Sea by several orders of
magnitude. It is a lesson for other regulatory regimes
around the world, but alas too few have heeded these lessons and are still committed to outdated prescriptive
approaches.
Nevertheless, even in the North Sea and elsewhere
around the world, incidents on offshore production platforms and onshore refineries and chemical plants continue
to occur that contain a similar cocktail of leadership and
organizational failures, poor behaviors and operating discipline, deficient asset integrity, and an absence of coherent
safety management. Those incidents were all foreseeable and
preventable. We can never become complacent.

1. The Hon. Lord W.D. Cullen, The Public Inquiry into the
Piper Alpha Disaster, HMSO, London, 1990.
2. F.P. Lees, Loss Prevention in the Process Industries, Hazard Identification, Assessment and Control, Elsevier, London, 1979 (and subsequent editions).
3. M.P. Broadribb, The application of formal safety assessment to a new installation, Risk Analysis in the Offshore
Industry Workshop, Aberdeen, UK, October 1990.
4. M.P. Broadribb, The application of formal safety assessment to an existing offshore installation, International
Conference Proceedings - Management and Engineering
of Fire Safety and Loss Prevention, Aberdeen, UK, February 1991.
5. HM Government, Offshore Installations (Safety Case)
Regulations 1992, Statutory Instruments, 1992 No. 2885,
Health and Safety, UK, 1992.
6. S.T. Maher, G.D. Long, R.S. Comartie, I.S. Sutton, and
M.R. Steinhilber, Paradigm shift in the regulatory application of safety management systems to offshore facilities,
Process Saf Prog 33 (2013).
7. US Department of Labor, Occupational Safety and Health
Administration, Process Safety Management of Highly
Hazardous Chemicals, 29 CFR Part 1910.119, 1992.
8. US Environmental Protection Agency, Accidental Release
Prevention Requirements: Risk Management Programs
Under Clean Air Act Section 112(r)(7), 40 CFR Part 68,
1996.
9. US Department of the Interior, Minerals Management
Service, Safety & Environmental Management Program,
Voluntary program based upon American Petroleum Institute, Recommended Practice for Development of a Safety
and Environmental Management Program (SEMP) for
Offshore Operations and Facilities, API RP 75, 1994.
10. US Department of the Interior, Bureau of Safety and Environmental Enforcement, Safety and Environmental Management Systems, 30 CFR Part 250 Subpart S, 2010.
11. HM Government, The Offshore Installations (Prevention
of Fire and Explosion, and Emergency Response) Regulations 1995, Statutory Instruments, 1995 No. 743, Health
and Safety, UK, 1995.
12. Talisman Energy (UK) Ltd., Piper B, Infrastructure Code of
Practice, Talisman Energy Ltd., Aberdeen, UK, 2004.
13. New Piper B reflects Piper A safety lessons, Oil Gas J 91
(1993).
14. CCPS, Guidelines for Risk Based Process Safety, CCPS,
New York, 2007.
15. HM Government, The Offshore Installations (Safety Representatives and Safety Committees) Regulations 1989,
Statutory Instruments, 1989 No. 971, Health and Safety,
UK, 1989.

22

DOI 10.1002/prs

CONCLUSIONS

March 2015

Published on behalf of the AIChE

Process Safety Progress (Vol.34, No.1)

16. Step Change in Safety, Strategic Plan 20102015, Aberdeen, UK, 2010, Available at www.stepchangeinsafety.
net, Accessed on December 21, 2013.
17. S.H. Kadri and D.W. Jones, Nurturing a strong process
safety culture, Process Saf Prog 25 (2006), 1620.
18. CCPS, Building Process Safety Culture: Tools to Enhance
Process Safety Performance; Piper Alpha Case History,
CCPS, New York, 2005.
19. M.P. Broadribb, What have we REALLY learned bit by bit? Oil
& Gas UK Piper 25 Conference, Aberdeen, UK, June 2013.

Process Safety Progress (Vol.34, No.1)

20. M.P. Broadribb, Well, Well! are we drilling in the

right direction? 5th CCPS Latin America Conference on
Process Safety, Cartagena de Indias, Colombia, August
2013.
21. M.P. Broadribb, Culture, leadership and accountability
reviews of offshore drilling operations, Offshore Technology Conference, Houston, TX, May 2014.
22. National Commission on the BP Deepwater Horizon Oil
Spill and Offshore Drilling, Deep Water; The Gulf Oil
Disaster and Future of Offshore Drilling, January 2011.

Published on behalf of the AIChE

DOI 10.1002/prs

March 2015

23