Roger Vielvoye
International Editor
Wide ranging changes in U.K. North Sea operating practices and regulations lie ahead.
They will occur as a result of an official report on explosions and fires aboard the Piper Alpha platform in July 1988 with the loss of 167 lives. Operator of the platform in the U.K. North Sea was Occidental Petroleum (Caledonia) Ltd.
A total of 106 detailed recommendations on offshore operations designed to prevent another catastrophic failure was issued last week by a Scottish judge, Lord Cullen, who conducted a 13 month inquiry into the tragedy. John Wakeham, Britain's secretary of state for energy, said the government will implement all recommendations as quickly as possible.
Cullen's recommendations were welcomed by the United Kingdom Offshore Operators Association, which represents all operators in the U.K. North Sea.
The report will also be widely studied by companies outside the U.K. Industry sources say offshore operations around the world are likely to change as a result of the recommendations.
Ukooa has received questions from operators in Norway and Australia about details of the recommendations.
The report is divided into two sections: one covering causes of the disaster and its aftermath and the second spelling out the recommendations.
The Cullen report also sharply criticizes Oxy and the U.K. Department of Energy's safety inspectorate. Those criticisms quickly spawned demands from the British labor party and trade unions that Oxy face criminal prosecution.
Wakeham said he was not empowered to recommend legal action against the company. That is the responsibility of Scotland's most senior law officer, the Lord Advocate, who has received a copy of the report.
As a result of the Piper Alpha accident, DOE will be stripped of its responsibility for offshore safety. The Cullen report said this role should be transferred to the Health and Safety Executive (HSE), the agency responsible for safety at all large onshore industrial plants in the U.K.
DISASTER'S CAUSE
The report confirmed that the cause of the disaster was a leak of condensate in the gas compression module. That led to an explosion that knocked out the main power supply and put the control room out of action.
Other emergency systems, including fire water supply, failed soon after the first explosion.
What followed was a series of larger explosions and fires that heavily damaged the platform.
Only 61 men survived. The report said the toll might have been less if personnel had not remained in the accommodation unit that turned out to be a death trap. At no stage, it added, was a systematic attempt made to lead men out of the accommodation area.
OXY CRITICIZED
The Cullen report holds these criticisms of Oxy:
Company management adopted a superficial attitude to assessment of the risk of a major hazard and failed to assure that emergency training was provided as intended.
Platform personnel and management were not prepared for a major emergency as they should have been. Safety policies and procedures were in place, but practice was deficient.
Management should have been more aware of the need for a high standard of accident prevention and fire fighting.
It was too easily satisfied that the permit to work system was operating correctly, regarding the absence of feedback on problems as an indication that all was well.
Permits to work are issued from a central point on a platform to all personnel working on platform systems and are designed to assure that the operation does not conflict with other work in progress.
Oxy failed to provide adequate training to ensure that an effective permit to work system was operating, the Cullen report said.
There also were criticisms of company practice with fire pumps and the water deluge system.
Keeping diesel fire pumps on manual mode during diving operations was peculiar to Piper Alpha and continued despite a recommendation that it be changed. This hindered operation of the system.
But the report said even if the fire water system had been activated a substantial number of the deluge heads would have been blocked with scale.
Cullen said this was a long standing problem, but by the time of the disaster, replacement of the distribution pipework had not been carried out.
Oxy said it does not believe it is constructive to respond piece by piece to criticisms by Cullen.
The company accepted the Cullen recommendations and is committed to implementing any that are within its authority. Oxy said it tried to deal with the consequences of the disaster promptly and humanely.
MINISTRY CRITICIZED
The Cullen report is equally stringent in its evaluation of DOE.
North Sea platforms were subject to regular DOE inspections that used sampling techniques to assess the adequacy of safety of installation as a whole.
Piper was inspected in June 1987 and June 1988. The findings of those inspections were in striking contrast with what was revealed in evidence at the inquiry, the report said.
Cullen said, "Even after making allowance for the fact that the inspections were based on sampling, it was clear to me they were superficial to the point of being little use as a test of safety on the platform.
"They did not reveal a number of clear cut and readily ascertainable deficiencies.
"While effectiveness of inspections has been affected by persistent undermanning and inadequate guidance, the evidence led me to question in a fundamental sense whether the type of inspection practiced by the Department of Energy could be an effective means of assessing or monitoring management of safety by operators."
CHANGE IN OPERATIONS
The most fundamental change in operations will come from the transfer of safety responsibility to a single department in the HSE and introduction by U.K. operators of formal safety assessments (FSAs) of major hazards on platforms.
The new regulatory body will take over some functions of the Department of Transport covering standby vessels. Cullen said the body should employ a specialist inspectorate and have a clear identity and strong influence in the HSE.
A chief executive, responsible directly to the director general of HSE, should be given the task of developing offshore safety and especially implementation of safety management systems.
Operators have been expecting the change to FSAs. They have been preparing for a system in which they are required to demonstrate potential major hazards on an installation and provide appropriate safety measures.
Cullen said presentation of FSAs should take the form of a safety case to be updated at regular intervals and whenever there is a significant change in circumstances.
Each operator should be required in the safety case to demonstrate that the safety management systems of the company and the installation are adequate to assure that design and operation of the platform and its equipment are safe.
The safety management system should set out objectives, the system by which the objectives would be achieved, the performance standard to be met, and the means for monitoring the standards.
Cullen said many current safety regulations are unduly restrictive because they impose solutions rather than objectives. They also are out of date in relation to technological advances. Guidance notes lend themselves to interpretations that discourage alternatives.
There is a danger, he said, that compliance takes precedence over wider safety considerations and that sound innovations are discouraged.
The main regulations arising from the report's recommendations should take the form of requiring stated objectives to be met. Guidance notes should give nonmandatory advice.
But Cullen said in some areas detailed measures should be prescribed.
Cullen added that operators should audit the systems and the new regulatory body would review these audits on a selective basis. The new body would also carry out any further audits it felt were required and, through regular inspections, assure that the output of the system was satisfactory.
He added that this was a completely new approach to regulation in the U.K.
Operators of mobile rigs will also have to make a safety case, approved by regulatory authorities, before they can operate off the U.K.
REFUGES REQUIRED
One of the main features of the safety case will be provision of refuges on platforms that will give temporary protection for personnel while an emergency is assessed and preparations made for possible evacuation.
The report places considerable emphasis on the importance of the refuge, along with clear passages for escape routes and integrity of embarkation points and lifeboats.
The refuge normally would be in the accommodation area. On existing installations this could require upgrading to meet new recommendations on fire protection, emergency power supplies and systems, ventilation, emergency lighting, and smoke and gas alarms.
Facilities for monitoring and control of an emergency must also be made available in the accommodation/refuge, an attempt to prevent the chaos that occurred in the Piper Alpha accommodation unit when all emergency services failed.
PERMIT FAILURE
The Cullen report identifies the failure of the permit to work system on Piper Alpha as one of the causes of the disaster. It recommends that operators and regulators should pay close attention to training and competence of contractors' supervisors who are required to operate the system.
While it is not necessary or practical to have a standard system throughout the industry, Cullen suggested companies should work toward harmonization in the colors used for different types of permits and the rules on the period in which a permit remains valid. All permit to work systems should have a procedure that involves locking off and tagging of isolation valves.
The report reviewed the role of the Piper Alpha permit to work system in the cause of the disaster.
Because most of the equipment on the platform was not recovered from seabed wreckage and key witnesses did not survive, there are a number of possible explanation for the first condensate leak.
Cullen concluded the leak resulted from steps taken by night shift personnel after one of the two condensate injection pumps tripped. The men tried to restart the other pump, which had been shut down for maintenance, and were unaware that a pressure safety valve had been removed from the relief line of that pump. A blank flange assembly fitted to the side of the valve was not leak tight.
Lack of awareness of the removal of the valve resulted from failure in communication of information at shift hand over earlier in the evening and failure in operation of the permit to work system in connection with the work that had entailed its removal.
Cullen said failure of the permit to work system was not an isolated mistake. Evidence at the inquiry also revealed dissatisfaction with the standard of information that was communicated at shift handover.
This was the subject of criticism after a fatality in September 1987.
PROCESS CONTROL
In the area of process control, the report recommends that key process variables should be monitored and controlled from a control room manned around the clock with a qualified operator in charge. All operators should have onshore instruction in dealing with emergencies.
Almost immediately after the Piper Alpha disaster, the U.K. government ordered operators to install platform emergency shutdown valves or move existing valves as close to the splash zone as possible.
At one stage the industry expected Cullen to recommend that subsea isolation valves should be fitted to most subsea pipelines. However, the report said there should be no immediate requirements for those valves, although the operator would have to show that adequate provision had been made against hazards from risers and pipelines.
The report also recommended studies to improve the reliability and reduce the cost of subsea valves to make them more practical to install. Work should also be done on effective passive fire protection of risers without aggravating corrosion.
Operators will be required by new regulations to institute and review regularly a procedure for shutting down production in the event of an emergency on another platform connected by pipeline. The report said installation managers on Claymore and Tartan field platforms were ill prepared for an emergency on Piper.
Cullen also wants a minimum number of pipeline connections to platforms and recommends studies to explore the feasibility of emergency dumping of large oil inventories, such as those in separators, in a safe, environmentally acceptable manner to reduce the supply of fuel that could feed a fire.
Regulators should be required to maintain a database on hydrocarbon leaks, spills, and ignitions that will be available to operators. It also will look for trends in this area and report them to the industry.
ESCAPE METHODS
The investigation into Piper Alpha highlighted the fact that escape by lifeboat or helicopter was impossible because of the intensity of the fire. Most of the 61 survivors escaped by reaching the sea down ropes or hoses or by jumping off the platform.
Cullen said the disaster demonstrated the value of fast rescue craft and bravery of crews in getting close to the platform where the fire was raging at its fiercest. It also demonstrated the shortcoming of the Piper Alpha standby vessel.
Changes in regulations for standby boats will be made to improve the quality of existing boats and lay down higher specifications for new vessels.
These boats must be maneuverable, able to hold position, have at last two 360 searchlights, have two rapid launch fast rescue craft with fully equipped communications systems, and two methods of rescuing survivors from the sea.
Lifeboats must be able to accommodate 150% of the offshore crew.
On new installations, davit launched boats should point away from the installation. The new regulatory body also must work on equipment and methods that will enable davit-launched lifeboats that lie parallel to the side of a platform to be launched clear of the installation.
There will be no regulatory requirement for free-fall lifeboats. Regulations will be changed to allow them to be installed when an operator finds it appropriate.
Each U.K. installation must have life rafts with capacity equal to the number of offshore personnel. Platforms must have a variety of methods for escape to the sea, including fixed ladders and stairways, ropes, and personal devices for controlled descent by rope.
Each member of the crew must have a survival or immersion suit, a life jacket, a smokehood that provides at least 10 min of protection, a torch, and fireproof gloves.
Cullen suggests that small transmitters or detectors on life jackets should be considered to assist in finding personnel in the dark.
Cullen also calls for improved command systems, training for emergencies, safety drills, and precautionary musters on platforms.
The new regulatory board must be informed by operators of the reasons for precautionary musters and evacuations.
Copyright 1990 Oil & Gas Journal. All Rights Reserved.