Editing Piper Alpha (section)

==Events on 6 and 7 July 1988 ==
Because the platform was completely destroyed, and many of those involved died, analysis of events can only suggest a possible chain of events based on known facts. Some witnesses to the events question the official timeline.<ref>{{cite web |date=17 November 1998 |title=Piper Alpha Pair 'Wrongly Blamed' |url=http://news.bbc.co.uk/1/hi/uk/215866.stm |url-status=live |archive-url=https://web.archive.org/web/20170905063535/http://news.bbc.co.uk/1/hi/uk/215866.stm |archive-date=5 September 2017 |access-date=3 February 2017 |publisher=BBC News }}</ref>

=== Preliminary events ===
At 07:45, 6 July 1988, the [[permit-to-work]] forms for the day shift were issued and signed.<ref name=":17">{{Cite journal |last=Reid |first=Marc |date=2020 |title=The Piper Alpha Disaster: A Personal Perspective with Transferrable Lessons on the Long-Term Moral Impact of Safety Failures |journal=[[ACS Chemical Health & Safety]] |volume=27 |issue=2 |pages=88–95 |doi=10.1021/acs.chas.9b00022 |eissn=1878-0504 |doi-access=free}}</ref> Of the two condensate pumps, both located in module C, pump B was operating to displace the platform's condensate for transport to the coast, while pump&nbsp;A was due for maintenance. Two permits were issued to that effect, one for a pump overhaul and another for the removal of the pump's [[Safety valve|pressure safety valve]] (PSV #504), which was due for recertification. During the day, pump A was electrically and mechanically isolated, but containment was not broken. The PSV, instead, was removed. The open condensate pipe upstream of the PSV was temporarily sealed with a disk cover (a flat metal disc also called a blind [[flange]] or blank flange). It was hand-tightened only. Because the work could not be completed by 18:00, the blind flange remained in place. The on-duty engineer filled in information on the PSV removal permit to the effect that pump&nbsp;A was not ready and must not be switched on under any circumstances. However, this information was not provided in the pump overhaul permit.<ref name="pate">{{cite journal |last1=Paté-Cornell |first1=M. Elisabeth |date=April 1993 |title=Learning from the Piper Alpha Accident: A Postmortem Analysis of Technical and Organizational Factors |journal=[[Risk Analysis (journal)|Risk Analysis]] |volume=13 |issue=2 |pages=215–232 |bibcode=1993RiskA..13..215P |doi=10.1111/j.1539-6924.1993.tb01071.x |issn=0272-4332 |eissn=1539-6924}}</ref>

The night shift started at 18:00 with 62 men running Piper Alpha. As the on-duty custodian was busy, the engineer neglected to inform him of the condition of pump&nbsp;A. Instead, he placed the PSV permit in the [[Control room|control centre]] and left. This permit disappeared and was not found.<ref name=":28" />

At 19:00 the diesel-driven [[fire pump]]s were put under manual control. Like many other offshore platforms, Piper Alpha had an automatic fire-fighting system, driven by both diesel and electric fire pumps. The pumps were designed to suck in large amounts of sea water for firefighting and had automatic controls to start them in case of fire. However, the Piper Alpha procedure adopted by the [[offshore installation manager]] (OIM) required manual control of the diesel pumps whenever divers were in the water (as they were for about 12&nbsp;hours a day during summer) although in reality, the risk was not seen as significant, unless a diver was closer than {{convert|10–15|ft|m|0}} from any of the four {{convert|120|ft|m|-1}} level caged intakes. A recommendation from an earlier audit had suggested that a procedure be developed to keep the pumps in automatic mode if divers were not working in the vicinity of the intakes, as was the practice on the Claymore platform, but this was never implemented.<ref name=":18">{{cite journal |last1=Drysdale |first1=D.D. |author-link=Dougal Drysdale |last2=Sylvester-Evans |first2=R. |date=15 December 1998 |title=The Explosion and Fire on the Piper Alpha Platform, 6 July 1988. A Case Study |journal=[[Philosophical Transactions of the Royal Society A|Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences]] |volume=356 |issue=1748 |pages=2929–2951 |bibcode=1998RSPTA.356.2929D |doi=10.1098/rsta.1998.0304 |issn=1364-503X |eissn=1471-2962 |s2cid=83615637 |doi-access=free}}</ref><ref name=":28" /><ref name=":35">{{Cite video |title=Learning from Accidents: The Piper Alpha Oil Platform Disaster – Messages for Managing Safety |date=April 1991 |last=Johnson |first=Chris |type=Videotape |others=Presented by Brian Appleton ([[Imperial Chemical Industries|ICI]] Group Safety) for the International Management of Safety course |oclc=752255236}}</ref>{{sfnp|Bollands|2018|p=57}}

At 21:45, condensate pump B stopped and could not be restarted. This was likely due to the formation of [[Clathrate hydrate|hydrates]] and the consequent blockage of gas compression pipework, following problems with the [[methanol]] system.{{sfnp|Spouge|1999|loc=appendix III, p. 6}} The operators were anxious to reinstate condensate pumping capacity. Failure to do so would have meant needing to stop the [[compressor|gas compressors]] and venting to the flare all the gas that could not be processed.{{sfnp|Bollands|2018| pp=137–138}}{{Efn|At least two documentaries<ref name=":28" /><ref name="NatGeo" /> state that the operators were under pressure to have one of the condensate pumps running because failing to do so would have caused a total power and production shutdown. This has been put in question because generators could also be run on [[diesel fuel]], of which there were 160 tonnes on board.<ref name="Crawleynotes">{{Cite book |last=Crawley |first=F.K. |title=Safety and Loss Prevention/Safety Engineering: Notes Prepared by Eur Ing F K Crawley, for Use in UK University Courses Based on Notes Produced for the University of Strathclyde |publisher=[[University of Strathclyde]] |year=2014 |location=Glasgow, Scotland |pages=374}}</ref> It is possible that operators were concerned that the automatic switch of the [[John Brown & Company|John Brown]] turbine generators from gas to diesel might not be successful and therefore a [[black start]] might be required, an event that could result in the drill becoming stuck at depth.{{sfnp|McGinty|2009|p=74}} In any case, control room operator Geoff Bollands wrote of the ''Seconds from Disaster'' documentary: "The film states that 'The condensate pumps had tripped and production crew were all feeling the pressure as the whole production facilities would soon shut down'. I was contradicting this statement as it wasn't true, the worst that would have had to happen is that we would have to stop making condensate, i.e. flare the gas."{{sfnp|Bollands|2018| pp=137–138}}}}

Around 21:52 a search was made through the documents to determine whether condensate pump&nbsp;A could be started. The permit for pump&nbsp;A overhaul was found but that for its PSV removal was not. The valve was at a distance from the pump, so the permits were stored in different boxes, as they were sorted by location. Because the overhaul had just started on the day, with no equipment removed or containment broken, the operators were under the impression that the pump could be put back in operation quickly and safely. None of those present were aware that a vital part of the machine had been removed. The missing valve was not noticed by anyone, particularly as the blind flange replacing the safety valve was several metres above ground level and obstructed from view.<ref name=":28" />

===Explosion in module C and initial reactions===
At or shortly before 22:00,<ref name=":26" /> gas was reintroduced into pump&nbsp;A, filling it. The loosely fitted flange did not withstand the resulting pressure.{{sfnp|Lord Caplan|1997|loc=vol. 2, section 5.1.1}} Gas audibly leaked out at high pressure, drawing the attention of several men and triggering multiple [[Gas detector|gas alarms]]. Before anyone could act, the gas ignited and exploded. The source of ignition is unclear, with the later investigation pointing to [[hot work]], hot surfaces, broken light fittings or an electrostatic spark as potential sources (electrical equipment in the surroundings were [[Electrical equipment in hazardous areas|rated for hazardous areas]]).{{sfnp|The Hon Lord Cullen|1990|loc=vol. 1, p. 60}} The platform, which originally was built for oil production only, was not of a blast-proof design, so the firewalls were not designed to withstand explosions.{{sfnp|Lord Caplan|1997|loc=vol. 1, section 2.6.1}} The blast blew through the [[Firewall (construction)|firewalls]] separating module C from the adjoining modules B and D (the latter of which housed the control room), made up of variously sized panels bolted together.<ref>{{cite journal |last1=Pask |first1=Ed |last2=Palmer |first2=Andrew |last3=Miles |first3=John |date=October 2000 |title=Breakup of the Firewall Between the B and C Modules of the Piper Alpha Platform: II. Analysis by Finite Elements and Comparison with Hand Calculation |journal=[[Engineering Failure Analysis]] |volume=7 |issue=5 |pages=311–322 |doi=10.1016/S1350-6307(99)00032-1 |issn=1350-6307 |eissn=1873-1961}}</ref>{{sfnp|Lord Caplan|1997|loc=vol. 1, section 2.11}} As a result, the control room was almost entirely destroyed. Panels around module B were also dislodged, with one of them rupturing a small condensate pipe, thus creating another fire.<ref name=":19" /><ref name=":17" />

Immediately after the explosion, control room operator Geoff Bollands, who had witnessed the alarms going off in the control room and subsequently survived the blast, activated the rig's [[Plant process and emergency shutdown systems#Emergency shutdown (ESD)|emergency stop button]] before escaping. This closed isolation valves in the wells and sea riser lines and ceased all oil and gas production. Theoretically, the platform would then have been isolated from the flow of oil and gas and the fire contained. The gas pipelines connecting Piper to Tartan and Claymore could only be isolated using separate push buttons, which were not actuated;<ref name=":18" />{{sfnp|Mannan|2012| p=683|}} however, the riser isolation valves probably closed due to loss of power supply in the explosion. (At any rate, the flare continued to burn until 23:30, indicating a leak in the Claymore riser isolation valve.){{sfnp|Spouge|1999|loc=appendix III, p. 7}}

The control room of Piper Alpha was abandoned. The rig's design made no allowances for the destruction of the control room, and the platform's organization disintegrated. As the diesel fire pumps had been switched to manual activation, the fire water system could not function properly. Additionally, their vulnerable location in module D, adjacent to the failed division from module C, was impossible to reach for the crew to manually activate them. Electrical power quickly failed too, as cables were routed through vulnerable production areas without redundancy. After the main generator tripped, the [[Emergency power system|emergency generator]] did not take over. The drilling generator started but subsequently failed. Some battery-run systems remained operational for a while. The emergency lighting failed after briefly remaining functional.<ref name="pate" /> The failure of power generation facilities also made the electric fire pumps inoperable.<ref name=":35" />{{efn|In any case, had any of the fire pumps worked, it is unlikely that fire water would have been delivered as intended or where it was actually needed. In several areas, including critical parts of the production modules, deluge systems did not even exist. In other areas, water deluge started but rapidly failed, e.g., at the site of the Tartan riser. In module C, the deluge system had experienced repeated blockage and was inoperable).<ref name="pate" /><ref name=":35" />{{sfnp|The Hon Lord Cullen| 1990|loc=vol. 1, p. 215}}}} Despite Bollands' activation of the [[Plant process and emergency shutdown systems#Emergency shutdown (ESD)|emergency shutdown]], no alarms warned workers of the unfolding disaster, as the [[Public address system|public announcement]] and general alarm system had been impaired.{{sfnp|Matsen|2011| |loc=chapter 8}} Multiple [[mayday]] calls were made by [[radio operator]] David Kinrade starting at 22:04, before the radio room had to be abandoned at 22:08.{{sfnp|The Hon Lord Cullen|1990|loc=vol. 1, p. 43}}{{sfnp|McGinty|2009|pp=88–89}}{{Efn|At 22:04: "Mayday. Mayday ... explosion and fire on the oil rig on the
platform and we'll [''sic''] abandoning abandoning the rig." At 22:06: "Mayday Mayday ... we require any assistance available any assistance available we've had an explosion and er
... a very bad explosion and fire er ... the radio room is badly damaged." At 22:08: "Mayday Mayday ... we're abandoning the radio room we're abandoning the radio room we can't talk any more we're on fire."{{sfnp|McGinty|2009|pp=88–89}}}}

At 22:06 the heat from the flames ruptured crude oil pipework and processing vessels in module B. The released oil ignited and the subsequent [[pool fire]] created a black plume of smoke characteristic of oil fires, visible from nearby ships.<ref name=":17" /> There is evidence that isolation of the produced oil pipeline was not effective, which may have left a route open for oil flowing into the fire due to the backpressure from the Claymore oil pipeline.<ref name=":18" />{{sfnp|Mannan|2012|p=683|}} The burning oil later dripped onto a lower platform used by the rig for diving operations. The platform floor consisted of [[Grating#As decking|steel grates]], and under normal circumstances would have allowed the burning oil to drip harmlessly into the sea, but divers on the previous shift had placed rubber matting on the metal grate (likely to cushion their bare feet from the sharp metal grates), allowing the oil to form a burning puddle on the platform.<ref name=":17" /> After conferring with Bollands and others while still on the main production deck, lead production operator Robert Vernon and safety officer Robert Carroll donned [[breathing apparatus]] and left for the diesel fire pumps in an attempt to start them manually. The pair were never to be seen again.{{sfnp|Bollands|2018|p=59}}

The OIMs of Tartan and Claymore shortly before 22:20 became aware that an explosion had taken place on Piper Alpha and a fire was raging. However, they both decided not to shut down production and instead await orders to that effect from Aberdeen.{{sfnp|Matsen|2011|loc=chapter 8}} By this time, 70 to 80 men had mustered in the canteen, with access to the [[TEMPSC|lifeboats]] or the helideck made impossible by smoke and fire. This room was becoming increasingly hot and full of smoke.<ref name=":18" />{{sfnp|Matsen|2011|loc=chapter 11}} Piper's OIM did not order an evacuation.<ref name="pate" />

===Subsequent gas pipeline ruptures and platform collapse===
At 22:20, in a case of [[Domino effect accident|domino effect]],{{sfnp|Mannan|2012|p=340|}} the heat from the burning oil collecting on the diving platform caused the nearby Tartan pipeline to rupture violently.{{sfnp|The Hon Lord Cullen|1990| loc=vol. 1, p. 43}} This discharged enormous amounts of highly flammable gas (some 30&nbsp;tonnes only in the first minute of the release),<ref name=":18" /> which immediately ignited into a massive [[jet fire]].<ref name=":17" />{{sfnp|Mannan|2012| p=1276|}} The heat and vibrations of the fire were felt by the crews in vessels as far away as {{Convert|1|km|mi}} from the rig. From that moment on, the platform's destruction was inevitable.<ref name=":14" /> This potential for an extreme escalation scenario was known to Occidental; a report commissioned by them in 1986 stated{{sfnp|McGinty|2009| pp=55–56|}} that the gas pipelines "would take hours to depressurize because of their capacity. This could result in a high pressure gas fire on the cellar deck that would be virtually impossible to fight, and the protection systems would not be effective in providing the cooling needed for the duration of the depressurisation".

The MCP-01 pipeline failed at 22:50 as a result of domino effect, and the ensuing jet fire{{sfnp |Mannan|2012|p=1276}} shot huge flames over {{convert|300|ft|m|-1|abbr=on}} into the air.<ref name=":14" /> At this time, around 187 men had not evacuated; however, many of them had already perished.<ref name=":5">{{Cite news |date=6 July 2013 |title=Piper Alpha: How We Survived North Sea Disaster |url=https://www.bbc.com/news/uk-scotland-22840445 |url-status=live |archive-url=https://web.archive.org/web/20231214114752/https://www.bbc.com/news/uk-scotland-22840445 |archive-date=14 December 2023 |access-date=1 April 2025 |work=[[BBC News]] |language=}}</ref> Personnel still left alive were either desperately sheltering in the scorched, smoke-filled accommodation block or leaping from the various deck levels, including the helideck, {{convert|175|ft|m||abbr=on}} into the North Sea.<ref name=":36">{{Cite episode |title=Oil Rig Explosion |series=Make It Out Alive! |network=[[Smithsonian Channel]] |date=5 November 2017 |season=1 |number=4 |last=Keane |first=Garry}}</ref>

The Claymore gas line ruptured at 23:20, adding even more fuel to the already massive jet fires on board Piper Alpha.{{sfnp|The Hon Lord Cullen|1990|loc=vol. 1, p. 44}} At this point the Claymore OIM had received orders from Aberdeen to shut down production, and the gas flowline to Piper with it. He had initiated a pipeline blowdown (depressurization) but this was not yet complete at the moment of the rupture. Tartan's gas pipeline had been shut down around 22:30, with its blowdown commencing around 23:20.{{sfnp|Matsen|2011|loc=chapter 15}}{{sfnp|The Hon Lord Cullen|1990|loc=vol. 1, pp. 140–141}}{{Efn|Although the isolation and blowdown of the Claymore and Tartan gas pipelines occurred so late, it is unlikely that prompter action would have changed the fate of the disaster. In fact, the inventory and pressure in the pipelines were too high and depressurization would have taken too long even if it had started immediately.{{sfnp|The Hon Lord Cullen|1990|loc=vol. 1, p. 144}}{{sfnp|Spouge|1999|loc=appendix III, p. 8}} However, a quicker action to shut down oil production may have had some positive effect in delaying the failure of the Tartan riser (the conflagration occurred at 22:20 that doomed Piper),{{sfnp|The Hon Lord Cullen|1990|loc=vol. 1, pp. 143–144}} because the main oil pipeline shutdown valve on Piper was leaking, thus allowing a backflow of oil into the fire.{{sfnp|Mannan|2012|p=683}}}}

Around 23:45, with critical support structures failing from the intense heat, the platform began to collapse. One of the cranes fell first, followed by the drilling derrick. The generation and utilities module (D) and the fireproofed accommodation block, still occupied by crewmen who had sheltered there, then slipped into the North Sea.<ref name="pate" /> Some 80 men were in the block at the time.<ref name=":5" /> By 00:45, 7 July, almost all of Piper Alpha was gone, with only module A still standing.<ref name=":17" />