podcast series

an original podcast by SafetyCulture

We all accept a level of risk - in our lives, in our jobs. A baseline of risk is inevitable. But what happens when your baseline starts to shift? When you and everyone around you deviates from what is safe, bit by little bit?

baseline

02: Four Minutes Past Ten

It was gas leak that started it, like a banshee wail on the production deck. The 18-month long government inquiry set about investigating why Piper was destroyed, but with so many witnesses dead, questions remain over exactly what happened.


Transcript

Claire Stewart: They said it was like a banshee wail: loud, high pitched and screaming.

A few of the mechanics were in their break room when it happened. One of them turned and make a quip that it sounded like a woman being strangled.

It lasted, they reckon, less than a minute before it stopped. Just long enough to raise a few eyebrows, but not long enough to distract them from brewing their evening cup of tea.

Then into that quiet came the explosion. The team room’s accoutrements were flung from cupboards and off benches, cups smashed. A couple of the men who had been standing were knocked to the ground.

Geoff Bollands: That's the thing about it. You don't hear an explosion or anything like that. I was just, I was there one second, and then the next thing I knew I was picking myself up off the floor, and the place was full of smoke.

Read full transcript >

Steve Rae: It didn't feel like an explosion, it felt like someone had dropped something heavy, on the deck. It was like more of a big thud and a vibration.

Claire: Others feared worse: that a ship had collided with the platform. Afterwards investigators said the movement on the production deck was big enough to feel like a 6.5 magnitude earthquake.

This is Baseline, a podcast by SafetyCulture, and I’m Claire Stewart.

2018 marks thirty years since the world’s worst offshore oil and gas disaster, which killed 167 men.

The government inquiry that followed uncovered key pieces of evidence that showed American rig owner Occidental knew more about the risks facing Piper Alpha than it had let on to workers.

But if the risks were known, why hadn’t anyone seriously thought about the consequences if a rig was to blow up, especially if it was the biggest rig in the world?

William Cullen, Baron Cullen of Whitekirk, goes by the name of Douglas to his wife and Lord Cullen to strangers. He’s retired now, after a legal career of more than 50 years.

It’s a drizzly Saturday morning and we’ve been invited to meet him at his home. Lord Cullen lives in a surprisingly understated, single story affair set back in it’s garden, amongst sandstone mansions in one of the nicer suburbs of Edinburgh. 

It’s a three hour drive from where I’m staying in Aberdeen and the whole way down I feel more than a little nervous. Lord Cullen is a bit of a big deal.

He’s been Lord Justice General of the equivalent of the Scottish High Court… Lord President of the Court of Session, he led the five judge tribunal that heard the appeal of the convicted Lockerbie Bomber, chaired the inquiry into the Dunblane Primary School massacre where 16 children and a teacher had been shot, and led the inquiry into the massive London train crash at Ladbroke Grove in 1999.

The 106 recommendations he made following the Piper inquiry completely changed the UK oil and gas industry and had enormous ramifications globally. In effect, Lord Cullen became the author of safety standards for the sector.

[Claire: Your passionfruit flower is blooming!]

It turns out he’s also exactly as you’d imagine a favourite grandfather to be …

[Cullen: I don’t know if you want to use the loo]

He takes us through to his dining room and there’s a big table set out with chocolate biscuits and percolated coffee and a fire crackling in the hearth.  

Claire: Do you remember the day … when the scenes came through, do you remember seeing the footage on the television?

Lord Cullen: Of course I do. I'm sure people in Aberdeen were even more acutely conscious but nobody in Scotland would be unaware of it, this dreadful thing happening yeah.

Claire: What were your first thoughts when you were watching it, can you remember?

Lord Cullen: Horror. And then somebody said to me a bit or two later. Oh they might pick you to be inquiry chairman and I said "Oh no no no no". But I the thought stuck in my head. And then I think was that a very short time after that I was I was approached.

Claire: Not daunting?

Lord Cullen: I thought it was a tremendous challenge to try to create something good out of something awful. And every inquiry begins as it should with a completely blank sheet because you don't start with an accusation or a claim. You start with knowing nothing and you progress through that.

Lord Cullen: And that brought me to the safety case in due course and to the whole idea of changing the regulator. I never expected to get, go down any of these roads to begin with but when evidence came my way and I began to realise what it was telling me and I felt I just had to do it.

Claire: What that evidence showed, was that Occidental was operating a “slack system”, he tells me, and had been for some time. In all sorts of respects there was a failure in management to take safety protocol and risk seriously.

The year before the disaster, a contract worker had been killed on Piper. The investigation into that death found Occidental’s Permit to Work system, which was meant to be a foolproof way of knowing which parts of the rigs were safe to operate and which were out for maintenance, had failed. 

Occidental plead guilty to this, so they knew, and came under fire for the standard of information that was communicated at shift handovers.

It should have been a warning to them. Instead similars problem with the handover and Permit to Work system happened again, but this time it led to total destruction of the platform. And it wasn’t just the operational processes at issue.

Steve: Well there was a loss adjuster for Occidental that had been sent out to do a call it a study, if you want, or an inspection of Piper. And the findings of that report were that Piper was ill prepared to respond to open ended hydrocarbon fire that was fueled by one of the main rises. And the conclusion to that report was, if there was an uncontrolled outbreak of oil or gas on Piper, it wouldn't survive. It just wouldn't survive, it couldn't withstand it. And that report was issued, I haven't got the date exactly in my head, well before Piper went up.

Claire: It’s the knowledge of those failures that weighs so heavily on people like Piper survivor Steve Rae because there can never be a good enough explanation for why the danger signs were ignored. 

Now, you might just be able to hear Lord Cullen’s wife on the telephone out the back. I learned after our interview that she had been Patron of the OWLS group that Gina Sims founded.

There’s a fantastic photo of the two of them in classic early nineties outfits, shoulder pads and all, standing on one of the rigs in the North Sea, grinning.

One of the things I’d been wanting to ask Lord Cullen after seeing his CV, was whether the things he’d seen in his career had changed how he thought about risk - about the human propensity to ignore danger and think we’re invincible.

Lord Cullen: It sounds as if we can be inclined to be arrogant and I think probably there is arrogance from time to time. You’re really on the threshold of normalization aren't you. People think "Oh well I know what to do with this way for so long we can just get away with it". I think that's all part of the whole picture of deviance yeah. 

Claire: That deviance Lord Cullen talks about is the gradual creep away from what’s considered safe.

It happens most often when people get comfortable taking small risks. It’s how our baseline of safety changes. We all do it. If you’ve texted a one word message while you’re driving, and gotten away with it, that’s deviance.

If you do it again, sending a quick reply and then maybe next time text a proper five line message, and you keep getting away with it, you don’t get fined, you don’t run into the back of another car, that’s normalisation of deviance.

You haven’t made a conscious decision, but now your behaviour is a long way past that baseline of what’s deemed safe. 

As Steve describes it:

Steve: Normalisation of deviance, which means in incremental steps, you don't do things exactly the same every time. And if there's no real consequence of not doing it that way, it becomes your new baseline. And eventually, down the road, your baseline is 20 degrees off of full tilt, right? And I think if you spend enough time in a place, it just becomes normal. Whether it's right or wrong, is not what I'm saying. It becomes normal.

Claire: 310,000 barrels a day.

Steve: Could we get 315? Yeah.

Claire: Steve’s referring to a story he’d told me about the production-first culture on Piper: it was the highest-producing platform in the world and pumping oil at a time when the market was booming and the money flowing.

Steve: By a country mile, they pushed Piper to the limits from the get go.

Claire: Why?

Steve: Because they could. It was a phenomenal producer. And I had a conversation not long ago actually, with a couple of guys I didn't really know on the platform. But we ended up being together. And I talked about, Piper was only designed to produce 280,000 barrels a day, but you guys are producing 300-320,000. How?

And I'm not gonna mention any names, but the conversation went along the lines of, "Well, You could do things to make it produce more by adding slightly more chemical, lift it, or by increasing the pressure on this thing, or tweaking. He said they would tweak and watch the gauges to see how much they could get out of it. It was almost like a competition for them. We got 320 barrels today. Think you could get 321,000. It was a tweaker. It was production oriented, it was just a production.

And it was a cash cow. Occidental would've went bust if they didn't have Piper. It paid for Occidental. And they had a, and I'm saying this now and I don't necessarily think it's reflected now, I think things have changed. But it had a different mentality on board.

Claire: And don’t forget, Piper was considered an old rig. It was cobbled together from years of add-ons.

It had also just been converted to become a gas production facility as well as oil, and throughout the whole period was undergoing what Steve described as “intense” maintenance.

But that didn’t stop them running it at maximum capacity. 

Claire: If you knew that they were tweaking and playing with production and pushing it to its limits-

Steve: I didn't, I didn't.

Claire: But if you had known that, would you have chosen to go out or do you think you still would've gone out anyway?

Steve: Back then? Back then I would've still went out. I would've went out. Because at that time, my perception of risk was different, my approach to getting involved was different, for me. If it wasn't happening on the drilling, it wasn't nothing to do with me. You know, and that's a sad reflection, but that's the way I thought. If it's not happening in my area, I'm okay.

Claire: How on earth was everyone thinking things were fine and dandy on Piper, and how much of that normalisation of risk played into to the way things turned out? What went wrong?

Lord Cullen: Well of course the simple but not simple straight answer is the failures in the management of safety. They range from what you might call the big picture which is to say failing to appreciate the huge risks that the platform faced if the integrity of the gas risers was breached because that simply blew the platform apart - until that point there had been an explosion, a lot of smoke which made evacuation by lifeboats impossible but there was, the personnel were still reasonably safe within the accommodation.

Claire: What Lord Cullen is talking about, is the fact there wasn’t just one explosion on the night, but five: The damage from first one could, hypothetically have been contained had the rig been designed differently.

But it wasn’t and it didn’t, and the subsequent fire created so much heat that it ruptured the pipes that  delivered the gas up from the sea.

Lord Cullen: But the rupture of the gas risers within the space of just over an hour was horrendous. It was like a Bunsen burner burning right through the centre of the platform.

Claire: And that’s what no-one had anticipated.

Lord Cullen: Now as the report I think demonstrates the design of the platform had been changed to route these risers through. The management could have been no doubt as to the appalling consequences if there was rupture, but they put their faith in - so it's said - the emergency shutdown valves and so on.

Claire: We’ll meet Associate Professor Jan Hayes later, but it’s useful here noting her explanation of these shut down valves.

Up until Piper, these valves were always fitted well above the water line, just below the production area. It meant that even in an emergency shutdown, gas could still be trapped in the pipes right up to the platform structure.

Everyone had always assumed the risers couldn’t possibly be damaged by a platform fire.

After Piper, that changed: shutdown valves are now fitted deep under the sea, as far away from the platform as possible. It’s one of the most significant impacts Piper had on the industry.

It was 10 o’clock at night, and Geoff Bolands was OIC, in charge of monitoring all the machinery on the rig.

He was in the control room - the hub of the rig - which was located on the production floor below the drilling deck and directly below the accommodation area.

Geoff: One minute I'm seeing all the gas alarms come in, trying to stop them, and then next thing I knew there was the explosion.

The Cullen Inquiry found that the most likely cause of the disaster was that gas condensate, the liquid form of gas,had been leaking from a loose valve, and and ignited.

Steve summarises the problem:

Steve: The problem was the missing valve, that hadn't been blanked off and tightened up, adequately. That was the problem. Not the only problem, so that's a control of work and that's about a ... dare I say it ... that's about a complacent approach to work.

Claire: Because of the sheer volume of pipework on the rig, maintenance of the huge pressure safety valves that regulated the flow of oil and gas was a serious undertaking. 300-odd PSVs as the valves were known, had to be recertified every 18 months.

This meant bringing in a specialist contractor team to remove the PSVs, which were so big they had to be carted around using trollies.

They were taken to a special shed on the rig to test them, and while the PSV was missing, the team would put on a blank or blind flange, to temporarily seal the pipe.

The specialist team of four men had been working for months on this job, checking at best three or four valves a day. There can be no doubt it was a repetitive and mundane task.

On July 6, 1988 the very last PSV of the 300 they had checked was the one on gas condensate Pump A.

They took it off, put it in the trolly to take to the shed and quickly put on a blind flange as a stop gap while they were gone. They didn’t screw it on super tight because they weren’t going to be away for long.

Steve: But then you can easily justify that because those guys had changed out so many valves in the last six weeks, without anything happening and they may have known at the time that that line was dead because the pump was isolated so why did they really need to crimp up it tight because they weren't planning to put the valve back on the same day.

Claire: It was nearly 5:30 at night and heading towards the end of shift. No-one liked paying contractors overtime so when things got held up with testing and replacing that last PSV the team decided to wait and do it the next day.

At least that’s what people think happened - no-one really knows for sure.

The problem was, Piper Alpha had two condensate pumps, A and B.

At around 9:45 a series of alarms in the control room showed Pump B had tripped and stopped working. It’s not entirely clear what happened next because most of the witnesses were killed, but the Cullen report suggests that Bobby Vernon, one of the lead operators working in the control room with Geoff Bollands on that night shift, decided to turn on Pump A after he realised Pump B had failed. 

As the report states he probably did so because ”he either had no knowledge of the maintenance work at all or because he believed the valve had been put back.”

Geoff tells me everyone in the control room should have known from the paperwork, and from shift handover briefings that the pump was out.

Geoff: The paperwork on the permits, we thought we had a [inaudible 00:56:50] system, but two permits weren't cross-referenced. They should have been. So that in effect, two of them instead of one should have been together. In fact, the PSV was missing, wasn't handed over. That's the only thing I can't get right in my mind, cause the lads were conscientious who did the job, and we did proper handovers, but it wasn't handed over, so it wouldn't have happened.

Claire: Lord Cullen wrote in his report: “The failure in the operation of the permit to work system was not an isolated mistake but that there were a number of respects in which the laid down procedure was not adhered to and unsafe practices were followed.”

It would seem that workers on Piper had become so used to operating in a risky environment that their baselines had shifted.

For the contractors it was just repetitive, every-day work that hadn’t caused any issues before.

Geoff: And the blank that was fitted on the pipework when they removed the PSV shouldn't have leaked.

Claire: So that was the one that was finger tight? Or not?

Geoff: Occi thought it was ... well, I'm not gonna cast aspersions on the lad, but he thought he was going back in an hour's time.

Claire: What do you think happened with the missing valve? The one that didn't get handed over that you thought was-

Geoff: I don't know why they didn't hand it over. Cause, again, the gas plant operator that night was a good lad; conscientious. The production supervisor on days was good, should've handed it over. And the main supervisor should've handed it over. And all three of them forgot; it's just about beyond belief. And yet if they did hand it over, all three of them on shift forgot, and that's beyond belief as well. Just about, what, five out of six of them were killed. So you don't get the answers.

We’ll also never know for sure if the banshee wail sound the mechanical team heard was the flow of gas through the blind flange on Pump A, because it hadn’t been fitted tightly enough.

What is clear, is that an explosion triggered a huge crude oil fire on the production deck.

Very quickly fire spread down and up the rig and completely shrouded one end of the structure in toxic black smoke. It just happened to be the end of the rig that housed the accommodation block and the lifeboats.

Had it not been, things might have been very different.

When the first explosion happened, Steve was in a small switch room at the back of the drill floor, a few levels up from where it started.

Steve: I could tell right away, when I looked at my driller, he was like, "Wow, what just happened?" And it was obvious to me that he had lost control of the drilling process, immediately. Because you need power to operate your drilling system and that power had went immediately.

Claire: At about four minutes past 10 o’clock, the first Mayday went out from Piper. It was a call to let the other platforms know that Piper was abandoning their rig. The record notes that radio interference was already being experienced.

Two minutes later another call went out: “Mayday mayday .... we require any assistance available any assistance available …

Four minutes after the first explosion the final mayday came through: “Mayday mayday mayday.... we’re abandoning the Radio Room we can’t talk anymore we’re on fire.”

Gina Sims says men could hear them on the other platforms, powerless to act

Gina: Guys that had been in control rooms, offshore on every platform had heard the mayday go out - they could hear the screams. Absolutely helpless.

Steve: I'd had general musters before many times, but not in anger, this was in anger because something had happened. So at that time you become, okay, let's just follow instruction, let's just do what we're trained to do if you like.

Steve had been in the drilling room and hadn’t realised what he’d felt had been an explosion until he got out onto the deck where others were gathering, and saw the smoke.

Steve: We formed a human chain, I remember, I can't remember exactly who was in the chain but I know it would have been about one, two, three, four, five, about eight of us. I recall, that we took hold of each other by the collar as we left the drill floor.

Claire: Why did you do that?

Steve: It was thick, black, acrid, smoke. It was oil burning. Smelled very rubbery, very oily. And it was blowing across the full deck because the prevailing wind was doing that. It was just like a column, it was a column of smoke, which we had to duck down under to get across the pipe deck, the pipe deck would have been about, 50 feet long. Then you come to the far side of the pipe deck, we would have turned right but that would have been towards the accommodation entrance.

I recall, standing as a group, coming across two guys in BA sets, breathing apparatus sets, and an exchange going on with those guys. Not with me personally, but with, I guess, the people at the front of the line and us no longer heading for the life boats, but heading to go inside the accommodation

That’s the point Steve peeled off from the rest of the group and headed in the other direction. It was an instinctive response, he can’t explain it except to say he didn’t feel right to go into the accommodation block.

It probably saved his life.

Geoff Bollands was finding his way off the rig too, and he was injured.

Geoff: I just met my colleagues on the 90-foot level and discussed what had happened with them and told them from my point of view. A couple of them went and tried to start the fire pump, which would have been my job but for my injuries. Bobby Vernon, the Supervisor and the Safety Officer. Last time I saw them, again, that's another one. I see them going into the smoke with their big headsets on, and they both were killed.

Geoff: One of the riggers got a rope and threw it over the side, and people started climbing down it. There was a queue there. And I thought, there's nothing you can do here, get off; and I just got off.

Claire: Piper Alpha sits a bit over an hour’s helicopter ride off the north east coast of Scotland.

There is nothing else out there for miles, except other oil rigs, including the Tartan and Claymore platforms and one known as MCP-01.

All the rigs were connected by huge undersea pipelines that carried gas and oil from those rigs, up through Piper and to shore. 

It meant there was massive amounts of gas flowing through four pipes seemingly haphazardly woven into the heart of the structure.

These risers were thought to be indestructible. But Occidental management had failed to consider the possible consequence of catastrophic heat from explosions and oil fires in other parts of the rig.

And Occidental hadn’t done anything to properly isolate the modules on the rig processing oil, from the modules that’d they’d put in when they wanted to start producing gas.

Steve: When you're sitting in the inquiry, you know, and evidence is being given, you kinda go, "Wow, really?" You know, I find out that the blast walls are not being there, and you go, "Why would you produce gas and not have a blast wall?"

Claire: What's the blast wall?

Steve: Well, Piper wasn't designed initially as an oil production platform. So, oil burns, it doesn't explode, so you need a firewall to stop oil fire spreading. Sometime later on, Piper, they decided it can no longer flare off the gas, 'cause they were just burning the gas, they weren't producing it. So they went, "We'll put in a gas compression module."

Well immediately, you start pressurising gas, you better put a blast wall in. But they didn't put a blast wall in, they just kept the fire wall in. So effectively, they hadn't managed the change very well, because-

Claire: Is that just a cost thing?

Steve: I don't know, I think it, you have to think it has an implication from a cost point of view for sure. Was it oversight? I don't know, it's a big oversight. But if you think it, Piper on the day, was producing 94 million standard cubic feet of gas.

Claire: That's a huge amount.

Steve: That's unbelievable. It's enough to - ten percent of the U.K. demand to think - it wasn't producing it, it was effectively flowing through Piper, 'cause it was coming from different places. So if you think about changing from something that burns to something that explodes, and not getting measures in place, it's a fairly fundamental error, right?

Claire: This is what Lord Cullen meant when he said there could have been no doubt as to the consequences if one of the gas risers ruptured.

Until this point, the problems created by the initial explosion on the production deck could, hypothetically have been controlled.

As the fury of the oil fires increased, without blast walls to contain anything, and with shrapnel and debris flying around, the integrity of the risers were compromised, basically turning them into industrial scale pipe bombs.

It took just twenty minutes before there was a second, phenomenal bang. The Tartan riser under the rig had exploded. The vibration was felt more than a mile away.

From there it was inevitable that the MCP-01 pipeline would also rupture, and finally, the Claymore pipeline. It was the end of Piper.

By that time Geoff Bollands had made it to a rescue vessel, but only just.

Geoff: And the heat, even though we were that distance away, was intense. Watching men jumping off and on fire and falling off, and falling off the rope and that ... Of all the different memories, the two memories that stick the most, watching the accommodation block fall in the sea, watching the men.

Claire: You’ve been listening to Baseline, from SafetyCulture, the makers of iAuditor.

For more information on how SafetyCulture can help businesses identify what’s working and what’s not in their own operations, visit www.safetyculture.com

Next time on Baseline, we’ll hear more about the accommodation block and what went wrong with the safety protocol.

Geoff: The advice to stay where you are, it's unbelievable. My advice to anybody is get out, as quick as you can.

David: I don't think there was a single survivor came from the accommodation because that's where we got the bodies and the bits out of.

So what impact did all that death and trauma have on the men who were there, their families and aberdeen?

Gina: The ripple effect was enormous. It was enormous.