One person's account of the Cormorant Alpha explosion in April 1989: This bulletin is based primarily upon a July 9, 2009, interview with an engineer who was on the platform the day of the accident—20 years ago. All attempts were made to accurately report on this incident; any potential errors or omissions are unintentional.
An Industry Still Reeling
The April 18, 1989, explosion on Cormorant Alpha, a North Sea production platform, sent shock waves through the oil and gas industry. It was so disturbing because the industry was still reeling from what is called the world’s worst offshore oil disaster—the Piper Alpha fire—nine months earlier (July 6, 1988). Both production platforms were off the coast of Scotland and the two incidents compounded losses of production, export revenues, and British petroleum revenue tax income.
With Piper Alpha, the fire destroyed the platform and killed 167 of 229 persons on board, and production stopped for months at five other fields. Total loss of production was about 300,000 barrels per day—12% of the production in the North Sea.
In the Cormorant Alpha incident, there was no fire and no one was killed but damage was extensive. The platform was a hub—a pumping station with a 36-inch main oil line that transported about 17% of the UK’s daily oil production. Full production resumed in July, three months after the explosion.
Cormorant Alpha had a concrete deep-water gravity base structure with oil storage cells, which was specifically made for the heavy weather conditions and water depths of the North Sea. These structures include large concrete oil storage tanks on the sea floor with concrete shafts rising to about 30 meters above sea level. If you looked down on this platform, it had very large, concrete legs that went about 150 meters into the sea.
Background on the 1989 Explosion
Because oil and gas risers could not be isolated on Piper Alpha, even before the report on that incident was issued, the industry had started testing riser emergency shutdown valves for tight shut-off.
The 16-inch gas export riser on the Cormorant Alpha had an emergency shutdown (ESD) valve in the topsides transition area that, when tested, was found to have a small leak across it.
It was decided to replace the leaking valve. To do this required temporarily reducing pressure in the line by isolating the gas with an inflatable plug downstream of where the new valve would be installed. As a back-up to the inflatable seals, the plug had mechanical grips to attach to the inside of the riser. This should have allowed the offshore construction team to safely cut a section out of the line and weld the new valve and associated spool pieces in place.
Preventive Maintenance Becomes Dangerous
The new valve was welded onto the truncated riser and the workers prepared to hydrotest the weld. During this period, the valve remained open, and the workers became alarmed when they noticed the plug had started to come up the line toward them. That was a terrifying experience. The plug came out of the line and gas started spewing out; the workers mustered and the platform was shut down.
One man volunteered to go into the leg to manually close the valve to isolate the flow of gas to the platform.
With all the power off, they sat and waited for the gas to disperse so it would be safe to restart.
Another Problem in Another Leg
The design of the concrete gravity based structure required the water levels inside the legs to be carefully controlled. If the difference in hydrostatic head across the leg wall became too high, the concrete could become overstressed and the leg could fail.
One of the platform's utility legs had a pipe penetration below sea level that had a leaking blind flange. It had been like that for several years because remedial action would have been expensive—it was never seen as a priority. During normal operations, an electric pump was used to maintain safe water levels inside the leg. However, this pump was not running as all power had been shut down. Consequently, the water level was steadily rising in the leg. Also, a storm was approaching that would increase the stress in the concrete legs; the situation had to be remedied.
While this was going on, readings were continually being taken with portable gas detectors to monitor the dispersion of the gas and to establish when it would be safe to restart the platform.
After many hours, the decision was made to start emergency power so that the pump in the utility leg could be re-started.
The Consequence of The Decision to Turn Power On
As soon as emergency power came back on, a spark ignited gas at the transition cone area near the leg and deck, causing explosions and flash fires around the platform. High overpressures were generated, particularly at the top of the legs.
The explosion rocked the platform, and it was very lucky that a leg did not fail and cause total collapse.
It was later concluded that water from the fire water system (deluge) had entered an emergency light fitting leading to the spark that caused ignition.
A worker with a portable gas detector was walking past a process module when the power was turned on. The module cladding flew past him into the sea, nearly taking him with it.
After the accident, workers labored 24 hours a day for six weeks trying to get government approval for the main oil line pumps to start running again.
As a result of this event, the business unit was restructured, and some employees were never the same after the incident.
Conclusions
- The platform operator was trying to do the right thing but it ended in a major accident
The actual risk posed by the leaking valve was very small as riser ESDVs are more about controlling very high flow rates associated with riser failure. Small leaks across them have little impact to platform risk.
- Even though the leak was very small, they replaced the valve, which probably was not necessary
If there had been a clear performance standard for the riser ESD valve relating to an acceptable leak rate, it is unlikely the valve would have been replaced with such urgency. (Note: performance standards were not a recognized concept at the time of this accident.)
- It was later found that the hydraulic lines to the inflatable seals in the plug were inadequately secured (push-fit) to the plug instead of a secure mechanical connection
The lines disengaged, causing a loss of hydraulic pressure and subsequent release of the plug.
Practical Lessons
- Similar high-risk activities that rely on a single item (the plug) to prevent a major accident need a very good failure modes, effects, and criticality analysis (FMECA) on the detailed final design
It was amazing that critical pressure containment items (the hoses) were allowed to be push fit on site by people who had not been intimately involved in every stage of the project.
- Inherent safety – relying on the pump to maintain the relative height of seawater in the leg to prevent overstress of the concrete eventually came back to haunt platform management
Try to rely on passive systems for safety not active systems.
- Generally, accidents do not happen in steady state of operation but do occur when there is change or modification
A thorough risk assessment of the leaking valve and of replacing it in another location would have been prudent in this case.
- Temporary fixes that are left over time will increase risk, usually without a good understanding of the possible impact of these fixes; the ballast pump in this case was used for a significant period of time
It is very difficult to foresee every eventuality, and major hazards usually occur where a combination of barriers fail. Reasonable time limits should be placed on temporary fixes or overrides.
References
- Centre for Economics and Management, Ed., Oil and Gas Exploration and Production. Paris: Editions Technip, 2004, p. 278.
- Cormorant Alpha Platform (Explosion). House of Commons Debate (HC Deb) 20 April 1989. vol 151 cc459–63. (Website) Available at http://hansard.millbanksystems.com/commons/1989/apr/20/cormorant-alpha-platform-explosion. Accessed 09 July 2009.
- Lohr S. (5 May 1989) North Sea Oil Mishaps Cost Up to $4 a Barrel. Special to The New York Times. correction Appended. Available at http://www.nytimes.com/1989/05/05/business/north-sea-oil-mishaps-cost-up-to-4-a-barrel.html?pagewanted=all. Accessed 15 July 2009.
- Condeep. (23 March 2009) Wikipedia. Available at http://en.wikipedia.org/wiki/Condeep. Accessed 15 July 2009.
Photo Sources
• Cormorant Alpha: Condeep. (23 March 2009) Wikipedia. Available at http://en.wikipedia.org/wiki/Condeep. Accessed 15 July 2009.
• Condeep gravity base structure: File: Oil platform Norway new.jpg. Wikimedia Commons. Online at http://commons.wikimedia.org/wiki/File:Oil_platform_Norway_new.jpg. Accessed 27 July 2009.
About IRC Risk and Safety
IRC
Risk and Safety provides practical answers to tough risk and safety
issues. We promise remarkable delivery and to always be
responsive.
We are based in Houston with an office in the Netherlands. Our speaking engagements receive outstanding feedback.
Copyright © 2009 IRC Risk and Safety, LLC |
|
