The Piper Alpha Disaster: A Personal Perspective with Transferrable Lessons on the Long-Term Moral Impact of Safety Failures

: The 1988 Piper Alpha disaster remains one of the worst safety-related accidents of its kind in the Oil & Gas sector. However, whereas the myriad lessons learned from this disaster are common knowledge among chemical and process engineers, the valuable safety lessons from this harrowing story are arguably not so obvious to laboratory chemists. Herein, a breakdown of and personally lived long-term perspective on the Piper Alpha accident is provided to show the transferrable lessons available for improving chemical laboratory safety culture.


■ INTRODUCTION
On the 6th July, 1988, safety lapses aboard the Piper Alpha oil rig resulted in a series of devastating explosions. 1,2 This and related process safety accidents are well-known among chemical engineers, 3 but less so among chemists. 4 Situated 140 miles off the coast of Aberdeen, Scotland, the Piper Alpha oil rig disintegrated in under 3 h, claiming the lives of 165 of the 226 men on board, plus those of 2 rescue crewmen ( Figure 1). With only 61 survivors of the accident and approximately $3.4 billion total insured damages, 5−7 the Piper Alpha disaster remains one of the worst such events in the Oil & Gas sector and now serves as a perennial process safety textbook case study. 8 I have chosen to share the transferrable safety lessons from Piper Alpha specificallyrather than those from any other such accident because my father, Mark Archibald Reid, was among the 61 survivors. 9,10 ■ AIMS The aim of this Commentary is to strip back the particulars and specifics of a disaster like Piper Alpha and distill out the valuable long-term process safety lessons applicable across sectors and scales of operation. It is hoped that, despite the seeming disconnect between an oil rig accident and an audience of chemists, the personal motivations and experience of this author will make the key lessons clear and transferrable to those working at the bench. As I grew older and more mature, so too did the forthcoming details of my father's ordeal. His once funny-looking hands now told the story of a man who screamed with uncontrolled fear when he was in plunged into darkness after the first explosion hit the rig. 13 His tired and elderly hands were the same hands used to squeeze tomato juice onto his burning face to relieve the intense heat of the evolving fire aboard Piper Alpha. Slowly, surely, over the years, the difficult details of just one disaster survivor's experience came into my knowing. Whereas I knew only the playful side of my father in my youth, I grew to learn that this was the same person who negotiated his way through burning decks, passed collapsed colleagues and plumes of smoke, to a burning helideck some 175 feet (six London buses) above sea level. The man I was fortunate enough to grow up with was the same man who was somehow able to jump from the Piper Alpha inferno, through an eerie silence, and resurface in the freezing North Sea.
The true lasting lesson of how safety failures impact lives over a long time was still to come. Like some 3.9% of the worldwide population exposed to disaster situations, 14 my father suffered from post-traumatic stress disorder (PTSD) 15 following his Piper Alpha ordeal, as did 21% of Piper Alpha survivors interviewed after their experience. 16 (See Figure 3.) Long after the details of his escape were revealed to me, the story became that of a man periodically relapsing into alcoholism, fracturing family ties, and losing all hope of establishing a normal working life. 9,10 The Piper Alpha disaster may have occurred in the summer of 1988, but its impact would ripple like a tidal wave through our family life for another 23 years. While the accident was the first and most visible domino to fall, many other dominos, initially obscured from view, would tumble one by one until the last. On 25th August, 2011, just a few months before I started my PhD, my father succumbed to his recurring PTSDinduced alcoholism, dying as a result of related health

■ PIPER ALPHA BACKGROUND
Prior to the disastrous events that ended operations in 1988, Piper Alpha had operated successfully in the North Sea for some 12 years. Erected in 1976, the rig was a highly profitable and productive platform for operators Occidental Petroleum. 3

■ ACCIDENT TIMELINE
From the public inquiry led by Lord Cullen, 17 a timeline of the accident has been mapped out, delineating the combination of events that led to the first explosion. While this timeline can be (and has been) articulated in several different ways, 18−21 a simplified timeline is presented (Table 1) and focuses on the main events that occurred on 6th−7th July, 1988.

■ FAILINGS
Following 12 years of successful operation, the Piper Alpha became the first ever offshore platform to be lost to disaster. The in-depth investigation into the disaster revealed the harrowing series of events that led to its untimely demise. 17 Working primarily from scattered eye-witness accounts and serendipitous photographs taken from neighboring boats, 18 the root cause of the disaster was determined over the course of a two-year investigation.
The rig produced three possible sources of ignition: crude oil, natural gas, and petroleum condensate. From the eye-witness descriptions of the initial explosion, it could be determined that condensate was the most likely fuel source. Indeed, this was consistent with the reported series of alarms sounding in the control room. Zeroing in on the location of the condensate leak led investigators to the aforementioned condensate pumps and safety valves. One of the safety valves had been removed for maintenance. To seal the open pipe while the safety valve was off, a metal disk (or flange) was temporarily inserted. Crucially, this was judged to be safe because the particular pump connected to the pipe was switched off, containing no fuel at the time maintenance workers finished their shift and fitted the open pipe with the temporary disk to continue their work the next day.
It was not yet clear how a pipe fitted with a temporary sealing disk and apparently not connected to an active pump could lead to the catastrophic loss of condensate containment. The question was: How does a pipeline containing no f uel lead to a high-pressure leak and explosion? Reconstructions revealed that the replacement disk in place while the safety valve was off for maintenance was likely to have been only loosely fitted, tightened by hand rather than by wrench. Under such conditions, a gap (perhaps invisible to the eye) was left open, Permit to work forms for routine maintenance are issued and signed. A common safety system, the permit to work aims to ensure that only qualified personnel are working on a task and only when it is safe to do so. 12:00 Maintenance staff begin work to remove a safety valve on the rig's production deck.
The aim is to finish valve maintenance within the day shift. 17:10 The current shift leader begins discussions with the incoming nightshift leader in order to provide a brief on the day's activities.
There is nothing out-of-the-ordinary or significant to report. 18:00 Day shift ends, but maintenance work on the safety valve is not yet complete. The pump that said valve is connected to is shut down, and it was decided that the maintenance work will continue the next morning. Because the connected pump is shut down, this raises no issue or concern. 21: 45 An alarm sounds in the control room, signaling an issue with a condensate pump (holding pressurized and highly flammable liquified petroleum). The pump had tripped, but this common problem was normally easy to fix. Despite the crew's best efforts to attend the faulty pump, it could not be restarted successfully on this occasion. This leads to increased stress among staff who are aware that, if the pump problem cannot be resolved, the rig will go into unproductive shutdown. As a potential solution to the problem, there is a reserve pump available; however, it is currently down for maintenance. The operations manager checks the associated permit for maintenance work on the pump that is currently out of operation.
Confirming that maintenance has not yet started on the reserve pump, it is signed back into service so that it can serve to resolve the escalating issue with the active condensate pump that has tripped. 21:55 Additional alarms go off in the control room, signaling gas leaks in the deck above the location of the pumps. The number of alarms sounding continues to increase, culminating in the most serious such alarmhigh gas. 22:00 The first explosion occurs. A nearby boat captain reports a flash of a blue flame projecting out from underneath the platform. The control room operator hits the emergency shutdown panel, causing power generators to turn off and all main oil and gas line valves to close. Because the main alarm panel has been destroyed in the explosion, no emergency alarms sound. The later inquiry would conclude that this explosion most likely originated in Module C (there were fouradjacent modules A -D), where there was a condensate leak from the poorly sealed disk that had been temporarily employed in place of the safety valve removed for maintenance.

22:05
Nearby boats all launch small safety vessels to help recover survivors.

22:20
A second major explosion engulfs the Piper Alpha platform. This explosion sets the helideck ablaze, making a helicopter rescue impossible for those men trapped in living areas near the top of the platform.

22:50
A third huge explosion rages through the burning core of Piper Alpha. This explosion captures a rescue boat in the vicinity of the platform, killing some survivors and crewmen. 23:20 As the platform begins to disintegrate, a fourth explosion rips through the remaining structure.
The platform begins to lean and collapse. 00: 45 The vast majority of the oil rig is no more. Large sections of the platform, including cranes, living quarters, and drilling decks, have crumbled into the North Sea.

ACS Chemical Health & Safety
pubs.acs.org/acschas Commentary creating gaps through which any adventitious pressurized material could leak. Still, it was supposed to be the case that this pipe was connected to an inactive pump, containing no fuel and thus no source of ignition. How, then, could it be the case that the loosely fitted disk was the most likely point of the first explosion? In the fray to keep production running after the active condensate pump tripped at 21:45, the inactive reserve pump, connected to the pipe containing the loose disk, was signed back into service. Condensate was then released by an operator into the reserve pump that, unknown to operators, was connected to the pipe that had been inadequately sealed. This eventually led to the major condensate release in Module C that led to the first explosion.
Going further, the first explosion was assessed to be minor compared to what was to come. Located in Module C, serendipitous photographic evidence revealed that the explosion unexpectedly broke through into neighboring Module B, supposedly protected by fire walls. 22 While this barrier to protection was fit to withstand hot flames for up to 6 h, the same protective barrier was not able to withstand explosions. The investigation later revealed that the fire wall between platform Modules B and C was completely unable to withstand explosions of any notable force. The resulting debris from the explosion in Module C was believed to have ruptured a weak condensate pipe in the adjacent Module B once the fire wall between Modules B and C failed.
Remarkably, this domino-like series of events 23 is still not telling the full story. The explosions occurring in the first two neighboring modules were not large enough to account for the observable fire ball that engulfed the entire platform at 22:20. Further photographic evidence pointed to an unexpected third location of fire, not in or adjacent to the aforementioned modules, but rather in the deck below all of these modules. This third fire location was additionally surprising on account of the fact that it was seemingly situated at a grated floor, through which burning oil should have dripped straight through and into the sea without any major incident. However, the photograph revealed a localized fire that eventually indicated that rubber matting had been placed on the grated flooring (by divers not wanting to place their bare feet on the sharp grating). The rubber matting collected burning oil dripping down from Module B above it. This, in turn, superheated a pipeline containing a highpressure gas link running to a sister rig, Tartan. The pipeline ruptured as a result, providing a near instantaneous source of 15−30 tons of fuel for the existing fire. The fuel released at this point, that which led to the massive fire ball at 22:20, was equivalent to the immediate release of the entire annual domestic gas consumption of the UK (Figure 4).
The crucial loss of the live pipeline running from Piper Alpha to Tartan was just one of three such connecting pipelines. In other words, there remained two active, fuel-containing pipelines running along Piper Alpha after two major explosions had already torn through the rig. Inevitably, the two remaining pipelines eventually failed, leading to the third and fourth explosions on the rig. Alas, this was the final death nail, the last domino to fall, for all those workers who still remained onboard Piper Alpha. Tragically, the automatic fire drench system on Piper alpha was in manual mode the night of the blast. Such an auto-to-manual switch was common given that the system was often in manual mode to protect divers under the rig from being sucked into the turbines. On the night of the fire, no water to drown the fire was released from the Piper Alpha platform itself.
The final causal issue revealed in the Piper Alpha investigation pointed to the crucial paperwork in place to ensure that all works, maintenance or otherwise, were only carried out when it was safe to do so, and when no parallel tasks was ongoing that could jeopardize the safety of those working. From astonishing efforts to recover the sunken wreckage, surviving paperwork was discovered that revealed that two separate permits to work were issued for both the maintenance on the condensate pump and, separately, for the work to maintain the safety valve. Why should it matter that these two safety permits were issued separately? Each permit to work, authorizing safe working conditions at a given point in time, was stored in the location where it was used. The condensate pump and its safety valve were located in two separate decks on the rig. As a result, operators looking at the permit to work for the pump had nothing accompanying this paperwork to suggest that the pump's safety valve was removed and replaced by a simple, loosely fitted flat disk. When the decision was made to try to start the reserve pump after the first proved faulty, the decision was made by operators who had no knowledge of the accompanying safety valve for this pump having been removed. The permit to work for the pump did not mention the safety valve. In this mismatch of paperwork is the most compelling evident root cause of the whole series of devastating events that played out over the 90 min that would later consume the Piper Alpha oil rig and 167 men involved on that fateful evening (see Figure 5).

■ TRANSFERRABLE LESSONS FROM PIPER ALPHA
The specifics of the Piper Alpha disaster may seem to the reader to be entirely disconnected with the safety concerns of the bench chemist. 24−26 It is a large-scale process-level accident that, on the surface, is nothing like the tragic death of Sheri Sangji at UCLA in 2008, 26 or the horrendous debilitating explosion at the University of Hawai'i in 2016 in which Dr. Thea Ekins-Coward lost her arm. 27−29 However, stripping back the specific detail reveals core lessons that are transferrable lessons of deep value, regardless of the specific industry. Such lessons include the following.
(i) Moral (human) costs: Perhaps most obviously, safety failings can lead to fatalities, physical injuries, and deep mental struggles. This is the message central to the     ACS Chemical Health & Safety pubs.acs.org/acschas Commentary that all necessary information could be made available to incoming staff when the shift changed. (iv) Equipment specification and fit-for-purpose: A full and proper assessment of equipment versus its intended purpose is crucial in any lab or process environment. In the case of Piper Alpha, the fire walls fitted between operational modules were known to protect against intense f ires, but were not adequately designed to protect against ferocious explosions. Similarly, improper electrical grounding lay at the cause of the explosion that irreparably injured Thea Ekins-Coward at the University of Hawai'i. 27,29 In the chemistry lab, another exemplar comparison could include use of improper personal protective equipment. This was indeed the case for Professor Karen Wetterhahn, who died as a resulted of mercury poisoning after she was exposed to a lethal dose of the infamously toxic metal in her laboratory in 1997. 26,34 (v) Permit to work system: Whether working on an oil rig, chemical plant, nuclear site, or university laboratory, one should be able to prove, when challenged, proof of competency and clear justification for working at a given place and at any given time. For Piper Alpha, two separate permits to work (one dealing with a safety valve, the other dealing with its separately located pump) led to ineffective and incomplete information for two different groups of workers. Fateful decisions that were made with regards to activating the pump that was not fitted with an appropriate safety valve thus led to an unintended but altogether catastrophic accident. (vi) Root cause analysis: 35 It was a full two years after the Piper Alpha disaster that the official inquiry was published. 17 It covers two volumes, one of which was in part dedicated to analyzing the "root cause" of the disaster. In other words, a great deal of work was placed in finding the most likely culprit that started the chain of events leading to the demise of the entire oil rig. For any accident, it is possible to explain, in a sentence, what happened in the immediacy of the event. However, this approach fails to spot the first in a series of linked events leading to the accident itself. Using Piper Alpha as the continued exemplar, one might describe the accident as being caused by the ignition of flammable condensate lost from a loose pipe fitting in Module C. However, this is merely the last in the chain of events leading to the first explosion. The root cause, rather than the immediate cause, is the source event in the working environment that, if preempted and mitigated, could have prevented all future events leading to the disaster. For Piper Alpha, failures in the permit to work, described in point (v) above, was the root cause of what later became the worst ever oil rig disaster as well as a source of long-term struggles for survivors and bereaved families alike. In the study of behavior-based safety, it is now becoming more widely accepted that the working environment, less-so the individual, is responsible for 90% of actions that lead to safety failures. 36 Therefore, in analyzing accidents in the chemistry laboratory, it is worth assessing the current laboratory setup, mandatory safety protocols, and safety culture as part of any investigation. It is useless to limit investigation timelines to the immediate events surrounding the accident.  Having survived the disaster but endured many lifelong struggles as a result of post-traumatic stress disorder (PTSD), the story of Mark Archibald Reid can serve as an informative, moralistic exemplar of how a difficult narrative can promote clearer understanding of the long-term impact of safety-related failures. Additional exemplars of the often-hidden long-term moral consequences of accidents have been combined with the detailed Piper Alpha commentary to bridge this story to those more directly relevant to the research chemical laboratory. The root cause of the Piper Alpha disaster was primarily an inappropriate permit to work system. On the night of the tragedy, workers reinstated and injected condensate fluid into a pump, not knowing a safety valve on another deck had been removed and replaced by a non-leak-proof disk. The highpressure condensate flow leaked from the disk and soon ignited. The first explosion broke through a fire wall that was not fit to stand up to explosive events. This led to secondary explosions in the module neighboring the location of the initial leak. Rubber matting used by divers on a lower deck accumulated a pool fire which ultimately resulted in the devastating and irreversible damage of the fire ball that engulfed the platform at 22:20 on 6th July, 1988. From this point onward, the fate of the oil rig was sealed.
From a safety-focused conference some 30 years later, the investigative lead, the Rt Hon Lord Cullen, remarked: "It's not much good having an investigation if it doesn't lead to lasting improvements in safety ... results being embedded in the control of risk and reflected in the way in which work is tackled and done." 50 By providing a personal account of the longer-term moral consequences of an accident, it is hoped that it contributes to heightened safety awareness and practices in all dangerous environments, offshore, onshore, in chemistry laboratories, and beyond. Future research is encouraged to shed light on the chemistry-specific value-added from raised awareness of the moral consequences of accidents often hidden in long-term obscurity.