Piper Alpha: The Gas Chart Read the Valve, Not the Pipeline

Chapters

1. 0:00 A chart, and a flat line
2. 0:36 The wrong side of a valve
3. 1:02 Two platforms, one system
4. 1:43 The mayday reaches Claymore
5. 2:10 Production continues
6. 2:32 The lines that failed
7. 2:58 What the manual assumed
8. 3:26 Reading calm
9. 3:49 Tartan watches the fire
10. 4:17 Closing ECV 54
11. 4:34 A drop nobody could explain
12. 5:00 The sensor's blind side
13. 5:26 What the pipe still held
14. 5:46 Reopening the line
15. 6:14 The oil kept moving
16. 6:40 The third terminal
17. 7:12 Full authority, no order
18. 7:54 Two records, the same shape

Transcript

A chart, and a flat line 0:00

This is a pressure chart, from a gas platform called Tartan, on the night of the sixth of July, 1988. After twenty-five past ten it goes flat. A straight line, all the way across the page. A flat line usually means one thing. Nothing is happening. Nobody on Tartan raised an alarm over this chart that night. There was nothing on it to raise an alarm over. And yet, when someone finally opened the valve it was watching, close to an hour later, the pipeline behind it was already empty.

The wrong side of a valve 0:36

The chart was not broken, and nobody was asleep at it. The sensor that drew that line sat on the near side of a valve, not the far side. Closing that valve, by itself, was enough to flatten the trace, no matter what was happening in the pipeline beyond it. Nobody on the platform knew that. The chart was correct. It was simply answering a different question.

Two platforms, one system 1:02

Piper Alpha did not stand alone. Two other platforms, Claymore and Tartan, normally pumped crude oil into it, on the way to a terminal onshore called Flotta, which held a steady back pressure on the line. A gas line ran from each of them to Piper as well, and a third line carried gas onward to a terminal called MCP-01. This is Figure 3.1, from the inquiry's own report. Piper sits about twenty-two miles from Claymore, and about twelve from Tartan. Close enough to see, too far to reach. The same pipes that fed the platform would end up feeding the fire.

The mayday reaches Claymore 1:43

Shortly after ten that night, word of a mayday reached the OIM on Claymore. He tried to telephone Piper. Nobody answered. He was not alarmed by that alone. A platform like Piper could isolate itself and run its own communications in an emergency. He sent the standby vessel toward Piper, and called his own superior onshore to report what little he knew.

Production continues 2:10

At a quarter past ten, radio traffic said there was fire on Piper's west side, with black smoke over the helideck. Piper had already shut down its own oil production. The pipeline pressures, as far as Claymore could see, were stable. The OIM decided that Claymore's production should continue.

The lines that failed 2:32

Within minutes, the telemetry linking the platforms failed, and operators were reading gauges by hand. At twenty past ten, the telephone system failed too, while the OIM was trying to reach the onshore emergency centre. The company's own manual said each platform should shut itself down, and tell the others. It did not say what to do once telling the others was no longer possible.

What the manual assumed 2:58

Even the manual that did reach people had a mistake built into it. It assumed that closing a valve on Piper's end would shut down Tartan's gas process almost at once. Gas does not work that way. It compresses. The inquiry found that closure at one end would take over an hour to be felt at the other. A correct-looking instruction, timed for a pipeline that behaved like water instead of gas.

Reading calm 3:26

The OIM knew that a ruptured pipeline would hand the fire on Piper a very large source of fuel. He said later he would have shut down if word had come from Piper, or if he had known how extreme the situation truly was. What he had instead was a system reading calm: pressures holding, falling only gradually, the way they would on an ordinary night.

Tartan watches the fire 3:49

Twelve miles off, the OIM on Tartan looked toward Piper and saw a sheet of flame. He told his production supervisor to watch the pressure of the gas line running to it. Tartan's own telemetry froze at ten o'clock, showing only Tartan's own readings from then on. Then the pressure in that line began to rise. To Tartan, that reads one way: Piper had shut its own valve on the other end.

Closing ECV 54 4:17

At about a quarter past ten, Tartan shut its export compressors and closed the valve on its side, a valve called ECV 54. It is logged as closed at twenty-five past ten, minutes after an explosion on Piper that nobody on Tartan had yet been told about.

A drop nobody could explain 4:34

Between twenty and twenty-five past ten, Tartan's operators noticed a sharp drop in the line's pressure. They thought it was odd, talked it over, and could not explain it. It did not occur to them, in the moment, that it lined up with the explosion on Piper. It was not the explosion they were reading. It was the valve they had just closed, taking its own reading with it.

The sensor's blind side 5:00

Here is the mechanism. The sensor for that chart sat upstream of ECV 54, on Tartan's own side. Once the valve shut, the chart could only show what was trapped between the compressors and the valve, which is to say, almost nothing changing at all. There was a second gauge, downstream of the valve, on the pipeline side. Nobody watched it as a matter of routine.

What the pipe still held 5:26

That pipeline held about twenty million standard cubic feet of gas. Tartan's flare could only burn it off at a rate of ten million a day. Emptying it the ordinary way would have taken close to two days. So a flat chart was never going to turn into an empty pipeline quickly, whatever anyone did.

Reopening the line 5:46

Around a quarter to eleven, Tartan began working to depressurise that gas line. The last step was reopening ECV 54, at twenty past eleven. Only then did anyone learn that the pipeline beyond it had already lost virtually all its pressure, burned off through the rupture at Piper's end. For close to an hour, a flat line had been read as nothing happening. The truth was closer to the opposite.

The oil kept moving 6:14

Through most of this, Tartan kept pumping crude oil toward Piper as well. It did not occur to Tartan's production supervisor that stopping it might affect the fire. He assumed Piper's own fire pumps were handling things. The OIM on Tartan wondered, out loud, whether some check valve might be stopping that oil from flowing back toward Piper. There was no such valve.

The third terminal 6:40

There was a third terminal in this system, onshore, called MCP-01. Its telephone to the shore worked. Its links to Tartan and Piper did not, and neither did its telemetry from either one. With nothing telling it otherwise, MCP-01 simply kept running, until a sharp drop in pressure at ten to eleven. Radio contact with Tartan was not made until half past one in the morning, almost three and a half hours into the disaster.

Full authority, no order 7:12

Back on Claymore, the OIM held full authority to shut down oil production. Nothing in company policy stood in his way. He did not shut down until after twenty past ten, when the riser carrying Tartan's gas to Piper had already ruptured, and he could see for himself that the fire was out of control. The inquiry's own words: he should have shut down sooner. But the same report will not let the story end there. Even shut down earlier, neither pipeline's flaring capacity came close to the volume of gas already sitting inside it. Cutting off the flow sooner would not have changed the fire that killed a hundred and sixty-seven people on Piper.

Two records, the same shape 7:54

So if none of it would have saved Piper, why does any of it matter? Because nobody on any of the three platforms had ever drilled for this exact night. Their own inquiry said as much: regular practice for a neighboring platform going down would have cut through much of the confusion and delay. Their procedures assumed a working telephone between platforms. Their instruments answered questions about their own valves, not about their neighbor's fire. It is the same shape as the last case. A record existed. It was accurate. It simply was not built to answer the question that night was asking. Next case leaves the sea. A gas plant onshore, in Australia, where cold liquid met a hot pipe. The fracture there was not a surprise of physics. It was a piece of knowledge that had simply never been written down.

Description and sources

Piper Alpha did not stand alone. Claymore and Tartan normally pumped crude oil into it on the way to an onshore terminal at Flotta, with a gas line from each as well, and a third gas line ran onward to a terminal called MCP-01. Piper sat about twenty-two miles from Claymore and twelve from Tartan.

After the mayday, Claymore's OIM could not reach Piper by phone but was not alarmed -- platforms could isolate themselves in an emergency. By 22:15, with radio reports of fire and pipeline pressures looking stable, he chose to continue production. Minutes later inter-platform telemetry failed, then the telephone system at 22:20. He held full authority to shut down oil production and did not, until after the Tartan riser to Piper had already ruptured and the fire was plainly out of control. The inquiry's own words: he should have shut down sooner.

On Tartan, the OIM saw the fire from twelve miles off. At about 22:15 Tartan closed its export compressors and a valve called ECV 54, logged closed at 22:25, minutes after an explosion on Piper it did not yet know about. The pressure chart for that line went flat right after. Nobody knew its sensor sat upstream of ECV 54: closing the valve alone flattened the trace, whatever was happening in the pipeline beyond it. That line held about twenty million standard cubic feet against a flare capacity of ten million a day, so no response would have emptied it fast. Only at 23:20, reopening ECV 54, did anyone learn the pipeline was already empty.

MCP-01, a third terminal, lost contact with both platforms and kept running until a pressure drop at 22:50; contact with Tartan was not restored until 01:30. The inquiry is explicit that depressurising sooner would not have changed the fire that killed a hundred and sixty-seven people on Piper -- the gas already committed to each line was too large. What it does conclude: none of the three platforms had ever drilled for a neighbor going down, and their procedures assumed a telephone link the emergency itself would sever.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

• The Public Inquiry into the Piper Alpha Disaster (Lord Cullen), Cm 1310, HMSO, 1990, volume 1, chapter 7. Read in full: https://www.hse.gov.uk/offshore/piper-alpha-disaster-public-inquiry.htm
• Fig. 3.1 is reproduced from that report (Crown copyright, Open Government Licence v3.0), previously extracted for this channel's Piper Alpha episode on the permit-to-work system.

ARCHIVE FIGURES — drawings and documents from the official report, with title, author, archive and licence. Crown copyright, used under the Open Government Licence v3.0 (contains public sector information), reframed for the screen.

• Fig. 3.1 — Cullen Inquiry | Piper Alpha Public Inquiry report, HMSO Cm 1310, 1990 | OGL v3.0

The 14 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system — the figures above are from the official report, the drawings are ours, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using official investigation reports and primary technical literature. Sources for this episode are linked above.

The pipeline diagram in this episode reproduces Fig. 3.1 of the Cullen report, credited on screen. Contains public sector information licensed under the Open Government Licence v3.0.

#engineering #processsafety #rootcause