Disaster Autopsy (2024) s01e02 Episode Script

1
[Narrator] In a high
rise building.
[building collapses]
- There was no warning.
- At sea.
- Innocent people died.
- In a train.
- Everything was on fire.
Everything was burning.
[explosion]
- Disasters can begin
with the smallest things.
- Changing the opening
hours of a restaurant.
- The bad glue job.
- A paperwork error.
- Now, combining
the latest research
with every available
source of evidence,
experts will forensically
analyze three disasters,
down to each tiny detail.
- You've really got to
think outside the box.
- You have to work
your way back
and understand each
link in the chain.
[missile fires]
[explosion]
- State-of-the-art
graphics reveal
every critical detail at
every critical moment.
- This whole disaster
could have been averted.
- We can dissect them,
get inside, or
underneath, freeze time,
and even reverse it.
To conduct a complete
Disaster Autopsy.
♪
[Narrator] The town of
Damascus, Arkansas.
September 19th, 1980.
- A fireball
erupts out of the
ground, shooting hundreds
of feet in the air.
- This is an enormous
explosion,
which tosses chunks
of concrete and steel
the size of buses
into the air.
[Narrator] The precise
location of the blast
sends a ripple of fear
through the US Air Force.
♪
- This site houses
a Titan II missile,
a 103 foot tall weapon
of mass destruction.
[News Report]
Witness this launch
of a Titan II.
[missile engines roaring]
- The Titan II is
a nuclear-tipped
intercontinental
ballistic missile.
At Damascus, it is housed
in a multi-million
dollar underground silo.
Or at least it was.
- The silo
doors are gone.
The area around
is a ruin,
and the missile is just
not there anymore.
- Now, combining
declassified
military records
and key witness
statements, we
will digitally
reconstruct the
disaster to answer the
vital question.
How could a
nuclear missile
accidentally explode
on American soil?
The accident happens at
Launch Complex 374-7.
- The US military built
their launch complexes
completely
underground, and in
three main sections.
You have the surface
access portal at the top.
Deep underground is
the control center,
deep enough to be
protected from
nuclear attack.
And then you have the
missile silo itself,
which is covered by an
enormous steel door.
- Filmed evidence
after the explosion
shows the scale of damage
to this apparently
impregnable structure.
[Dr. Auerbach] The
explosion is so powerful,
it launches the
740-ton silo door
into the air like
a bottle cap.
They find it 600 feet
away from the silo.
- The scale of
devastation
seems enormous,
but compared with
what the Titan II is
built for, it's tiny.
- The Titan II carries
a 9-megaton warhead.
That's three times
the explosive power
of all the bombs
dropped by both sides
in the Second World War.
Including the
two atomic bombs on
Hiroshima and Nagasaki.
- But this cannot be
a nuclear accident,
as Arkansas is
still here.
So what does cause
this huge explosion?
- If we look at the
missile in more detail,
it is powered
by two liquids.
One is dinitrogen
tetraoxide,
and the other is
unsymmetrical
dimethylhydrazine.
- Both are extremely
dangerous.
- They're
incredibly toxic
and nasty chemicals.
And oh, yeah, they're
highly volatile
and explosive.
- Why would anyone use
such unstable materials
near a nuclear warhead?
- When this site is
built in the early '60s,
the Soviet Union
and the U.S.
are locked at the height
of Cold War paranoia.
[News Report] These
underground launch sites
are hardened against
nuclear attack.
- Both sides
have hundreds of
nuclear-tipped missiles
pointed at the other.
What's keeping them
from starting a war
is a certain knowledge
that any launch would
be met with a devastating
counterlaunch.
Mutually assured
destruction.
-This strategy
relies completely
on being able to
launch missiles at
a moment's notice.
- You only have a few
minutes from the moment
you detect the
other side's
missiles in the
air to get your
own in the air before
everything you
have is wiped out.
♪
So speed of launch is
a technological and
strategic imperative.
- Some rockets use
cryogenic fuels,
but these must be
loaded immediately
before launch, and
that takes time.
[Professor Sella] The
great advantage of
hydrazine and nitrogen
tetroxide is the fact
that you can store
them in the missile
at room temperature,
ready to go.
And when you mix them,
they form what is called
a hypergolic mixture,
which is perfect to
power a rocket at
very short notice.
- Hypergolic fuels
ignite instantly
on contact with
each other,
but there is a price to
pay for these advantages.
[Dr. Hollingsworth]
You've got a missile
full of these two
fuels that, if mixed,
will ignite, and you're
storing it in a confined
space of asylum.
That's a recipe
for disaster.
- Do these volatile
materials somehow
come into contact?
- The first accounts
we have come
from senior airmen
David Powell and
airman Jeffrey Plum.
Their job was to
transfer these highly
volatile substances
into the missile.
- This is a high-risk
occupation.
- Both of these liquids
are extremely hazardous.
They're very toxic.
In addition, the
nitrogen tetroxide
dissolves in your
lungs to produce acid.
[Ada McVean] To work
with these extremely
dangerous fuels, the
workers have to wear
rocket fuel handlers'
clothing outfits, which
are extremely bulky
and have their
own air supplies, almost
like space suits.
It is very difficult
to do anything.
They make the
users very clumsy
with their thick
rubber gloves.
- According to
their statements
before the accident,
the two airmen are
working near the top of
the 103-foot missile.
[Dr. Hollingsworth] So
one of the maintenance
technicians
picks up a ratchet with
a socket on the end.
- But Powell has the
wrong type of wrench.
- The socket falls out,
bounces on the platform,
and plunges down
into the darkness
of the main duct.
- The socket falls
something like 80 feet,
bounces off the
wall of the silo.
- Up into the rocket,
puncturing a hole,
and highly volatile
hydrazine gas
begins leaking out.
- If enough
fuel leaks out,
the pressure in the fuel
tank will drop too far,
and the missile
will collapse under
its own weight.
- At this point,
they're facing a
ticking time bomb.
[gas hissing]
- The launch site is
evacuated and shut down.
- The problem is
that since everyone
has left the silo,
they have no idea how
bad the situation is.
So they ask for
volunteers to go inside
and take a reading of
fuel concentrations
in the air and try to
stabilize the leak.
- Airmen Rex Hukle
and Greg Devlin
volunteer to go in.
Their statements provide
the first evidence
of what is happening
in the silo.
- They suit up to enter
the missile silo complex.
It's on lockdown, so
they have to break in.
- Records show that
they entered the
evacuated complex
around 2 a.m.,
seven and a half hours
after the leak begins.
- The entry into the silo
is a giant steel door
with a magnetic
lock, but that's
not functioning now.
So the only way
for them to get in
is to pry it open
with a crowbar.
- In their heavy
protective suits,
progress is slow.
- Once they're inside
the silo complex,
there are four
blast doors,
and each one of
them weighs upwards
of three tons.
They're all operated
by hydraulics,
which, of course,
are not working.
- Before they can
manually open the
first three-ton
door, their air
supply runs low.
Records show that
they are ordered out.
17 minutes later, a
new team is sent in.
- The second team of
Sergeant Jeff Kennedy
and Senior Airman
David Livingston
make it past the first
two blast doors,
and before the
last one, there is
a vapor detector.
- They urgently need to
know the concentration
of hydrazine,
because even in
protective suits,
it can be lethal.
- At high concentrations,
dimethyl hydrazine
will actually
melt and dissolve
certain plastics.
- The hydrazine in
the air is at 21,000
parts per million.
This could literally
melt the rubber suits
off their bodies.
- They are ordered
out immediately.
It is 3 a.m., 8 1/2 hours
since the leak began.
The two men are almost
clear of the complex
[explosion]
when the
missile explodes.
What sets it off?
[Narrator] So much
volatile hydrazine is
leaking from the
nuclear missile
inside the Arkansas
launch complex
that no one can
enter safely.
They have to try and
reduce the concentration
of hydrazine in the air.
- According to Kennedy,
the team chief suggests
they turn on the
ventilation fans.
So Livingston volunteers
while Kennedy
leaves the site.
- Livingston flips on
the ventilation system
and then goes topside.
Now all they have to do
is wait for the hydrazine
to vent out of the silo.
- Livingston reaches
the top of the stairs
of the access portal
and is about to head
out and join Kennedy when
the missile explodes.
[explosion]
[Ada McVean] The amount
of hydrazine in the air
just after the
ventilation fans
are switched on was
so abundant that it
would not have taken
much to ignite it.
- Turning on the
ventilation fans
are a good suspect.
It ignites hydrazine
vapors in the air,
which ruptures the fuel
and oxidizer tanks,
combining the hydrazine
and nitrogen tetroxide
for a much bigger
explosion
[explosion]
which blows
the roof off.
- And at the tip
of this fireball
is a nine-megaton
nuclear warhead.
- The fact that there
isn't a huge crater
in the middle of Arkansas
suggests that the nuclear
device did not explode.
- Do the people of
Arkansas just catch
a very lucky break?
- It's actually
really difficult
to set off a
nuclear warhead.
[explosion]
You have to have a set
of perfectly placed
and timed
explosive charges,
and unless all of them go
off perfectly in sync,
you won't get a
nuclear reaction.
- The warhead is
discovered 100 feet
from the launch
complex's entry gate,
battered but
basically intact.
We can now explain
the chain of events
that lead to
the disaster.
- The two-man team
working on the missile,
they drop a heavy
metal socket
that falls between
the duct walls
and the missile itself.
- The falling socket
ruptures the missile's
hydrazine fuel tank.
Highly volatile and
explosive vapor
leaks into the silo.
Teams sent in
to investigate
discover lethal
concentrations of
hydrazine vapor.
- An order comes
over the radio
to turn on the
ventilation fans
to vent the
hydrazine vapor.
That probably causes
an electric spark
which ignites the
hydrazine vapors
in the silo.
[explosion]
- It ruptures the
missile's oxidizer tank.
Nitrogen tetroxide
comes into contact
with the leaking
hydrazine.
It causes a massive
hypergolic explosion.
[Dr. Auerbach] The
explosion launches a
nine-megaton warhead
flying through the air,
and it crashes to the
Earth some distance away,
a bit dented
but undamaged.
The state of
Arkansas is spared
the specter of
nuclear annihilation.
[explosion]
[helicopter whirring]
♪
[Narrator] Although
nobody is killed in
the explosion, Livingston
dies later after
inhaling nitrogen
tetroxide vapor.
- The Titan II
maintenance structure
at Little Rock
Air Force Base
is later renamed the
Livingston Building
in honor of the
dead airman.
- The disaster is a
wake-up call
for the U.S. military.
In October 1981,
President Reagan
announces that all the
Titan II missile silos
will be deactivated, and
Launch Complex 374-7
is the first one
to be deactivated.
- The technicians
actually saw this
disaster begin when
the socket fell
off their hand tool.
But sometimes no one sees
the disaster coming.
The Baltic Sea,
September 28, 1994.
The passenger
ferry MV Estonia
is en route
from Estonia's
capital, Tallinn, to
Stockholm in Sweden.
There are 989
people on board.
- This is a really
high-end luxury ferry.
It's designed to
take 2,000 people,
lots of cars and
other vehicles.
- By 1 a.m., the
Estonia has been at
sea for six hours and
is making good time
across the stormy Baltic.
But in the middle of the
night, far from land,
the Estonia sinks.
In under an hour,
852 people are dead.
Fewer than 100 bodies
are ever recovered.
- The Estonia is
the worst peacetime
disaster in Europe
since the Titanic.
It is understandable that
people wanted answers.
We all want to find out
what actually happened
with this disaster.
♪
- Now, using
photographic evidence,
radio transmissions,
and survivor testimony,
we will digitally
dissect the disaster
to piece together the
tragic sequence
of events.
What sinks this
massive ferry?
[Narrator] Is there
something wrong with the
luxury passenger
ferry MV Estonia
before she even
leaves port that
leads to her sinking with
the loss of 852 lives?
- Well, it doesn't
really seem so.
The Estonia is a
pretty modern vessel,
and according to all of
her maintenance records
and certifications,
she's in good condition.
- And construction
records confirm
that she is
specifically designed
for the kind of
conditions found in
the stormy Baltic Sea.
- This was a
regular route by
a scheduled ferry.
It was running a
little bit late,
but only 15 minutes.
But this is nothing
the Estonia
hadn't seen before.
- According to
port records,
the ship leaves
at 7:15 p.m.
from Tallinn, bound
for Stockholm.
[Dr. Shini Somara]
Nothing about the ship
or its departure seems
out of the ordinary.
Whatever causes
this disaster must
happen at sea.
- One of the things that
is difficult is that
the main evidence is
lying in the seabed.
- The wreck of Estonia is
located two days later.
- The Estonia being
around 260 feet of depth,
there are capabilities
of having ROVs
look for evidence and see
what actually happened.
- The ROV is a Remotely
Operated Vehicle,
a robotic submarine
controlled from
the surface.
[ROV Footage Comms]
We're just coming to an
area which we feel
was a position
of one of the
main lifeboats.
[Narrator] The
footage reveals
something shocking.
The wreck is incomplete.
- The entire bow
visor is missing.
[Narrator] Estonia is a
RO-RO ferry,
a roll-on,
roll-off ferry.
These are designed to
make vehicle loading
as rapid and efficient
as possible.
- On Estonia, the
vehicles enter
through the front
of the ship,
and that means the bow
section is lifted up
by the series of
hydraulic rams.
This bit called the visor
then gets out of the way
and allows the vehicles
to drive in underneath.
- But this visor is not
found on the wreck.
Could it have been torn
off as Estonia sinks?
- This visor is a heavy
piece of equipment.
It's 56 tons.
If it had sunk
with the vessel,
it probably would
have been next to it
because it's so heavy.
Currents wouldn't
have been able
to carry it away.
- But the visor is not
found near the ship.
[Dr. Blanco-Davis] The
Estonia Coast Guard
actually ends up
finding the visor
about a mile away
from the wreckage.
- There is only one
explanation for this.
It must have snapped
off before the
ship went down.
♪
- The 56-ton visor is
connected to the ship
by steel hinges
at the top
and secured in place
by hydraulic locks
on the base and side.
How could this huge
assembly just fall off?
[Dr. Steele] Looking at
footage, we can see
damage to the
bottom lock.
- The bottom lock
secures the visor
by pushing a massive
bolt into a heavy
tube in the hull.
And it's big
for a reason.
- That's where the
most impact happens
because of waves
and other forces.
It's a very
vulnerable spot.
- For that reason,
both the bolt
housing and the tube
are welded in place
with two-inch-thick
steel lugs.
The bottom lock, lugs,
and bolt housing
are recovered from the
wreck on the seafloor.
All show evidence
of major damage.
♪
- When we look
at the visor,
there's evidence that
tells us that the lugs
holding the locking
mechanism in place
were actually torn.
This is indicative
of most likely waves
hitting the ship
very, very hard.
- Meteorological data
for September 28th
records gale-force
winds and wave heights
of up to 18 feet.
But this is the kind of
extreme Baltic weather
the Estonia is
designed for.
So why would Estonia's
visor lock break?
A metallurgical report
on the visor's mechanism
is illuminating.
- The report showed
that the metal lugs
were poorly welded.
Essentially, they just
weren't very strong.
So the waves literally
tore the lugs
off of the ship.
- No longer locked at
its base, the Estonia's
massive 56-ton visor
will flex under
the action of the
heavy weather.
This fits with
survivors' statements.
[Nadia El-Awady] The
witnesses say that they
heard banging noises.
Now, what that probably
was, was the visor
going up and down,
up and down,
banging against the
hull, with the waves
crashing into it,
causing it to go up and
down in that manner.
- Magnifying segments
of the ROV video
supports this theory.
- The video footage show
repetitive impact damage.
So that's further
evidence of this visor
banging up and down
against the hull.
- Every movement
of the visor will put
extreme fatigue loads
on the other
attachment points
the side locks,
the hydraulics,
and the hinges.
- And as that
happens repeatedly,
that strain damages these
things ever further,
to the point where the
visor just breaks off.
- According to survivors,
the banging noises stop
at around 1:15 a.m.
This is probably the time
when the entire visor
rips away from
the Estonia.
- And this is
incredibly serious,
because they're now
sailing a vessel
that has a massive
hole in the bow.
- Thousands of tons
of water will come in
through the
opening in the bow
and float the
vehicle deck,
which is a disastrous for
a RO-RO type of ship.
- Why does Estonia's
roll-on, roll-off design
make the situation
so disastrous?
[Narrator] Because the MV
Estonia is a RO-RO ferry,
it is built differently
to most other
commercial vessels.
- The hulls of most ships
have vertical walls
called bulkheads
separating them
into compartments,
and what that does is
that it prevents
water from being able
to freely move
from one area to
another in the ship.
- But like most
RO-RO ferries,
the huge vehicle
decks behind the
visor of the Estonia
have no bulkheads.
- And the reason it
doesn't have bulkheads
is to allow cars and
trucks to easily
roll into the ferry
and roll off when
they get to port.
♪
- On the Estonia, this
open vehicle deck
is now being flooded
with water through
the hole in the bow.
- The ship is now
unstable because
of something
called the free
surface effect.
- Hundreds, maybe
thousands of
tons of water just
sloshing around
in the car deck.
Imagine the boat starts
listing over to one side,
and suddenly
those thousands
of tons of water are
all gonna move in
that same direction,
and that's gonna
cause the boat to
tilt even further in
that direction,
encouraging the water to
move further and faster.
- The free surface
effect can be so bad
that it can tilt the
vessel to one side
and roll it over.
- This theory of
increasing instability
fits with the
eyewitness statement
of passenger
Pierre Thiger.
He is in the bar at
the top of the ship.
- Thiger reported that
after that metallic
banging had stopped,
presumably because the
visor has just fallen off
the front of the ship,
the boat started to
roll very heavily.
- Survivor reports
suggest the Estonia
starts listing 15
degrees to starboard
shortly after 1:15 a.m.,
when it appears,
the visor detaches.
- The officers on
the bridge decide
to steer the boat
in such a way as
they hope the wind
and the waves
would push it into a
more vertical position.
- The bridge crew do
not know the visor
has fallen off.
They try to turn the
nose of the ship
so that the wind and
waves are on the right,
pushing the ship
more upright.
- This is actually
one of the most
disastrous actions
they could have taken,
because at some point
during that turn,
the nose of the boat
is pointing directly
into the wind and
waves, and that means
you've got huge
quantities of seawater
being blown and
thrown into that
giant gaping hole
that's in the
bow of the ship.
- It is the ship's
last maneuver.
According to
eyewitnesses, not
long after the turn, all
four engines cut out.
The Estonia is adrift.
- Losing power at sea
is incredibly serious.
It means you can no
longer steer the ship
to protect it from
the worst of the
wind and the waves.
[Third Mate, archive]
Europa, Estonia.
[Dr. Blanco-Davis] At
1:22 a.m., the third mate
sends out a May Day call.
[Third Mate, archive]
This is Europa
speaking, Estonia.
May Day, May Day.
- The ship is now listing
severely to starboard.
It's being battered by
the wind and the waves.
It's only a matter of
time before the windows
on that side of the
ship start breaking,
allowing even more
water into the
body of the vessel.
[Narrator] According to
survivors, by 1:35,
Estonia is listing
at 80 degrees.
- There's so much
water inside that the
buoyancy of the vessel
has been fundamentally
compromised, and
survivors report
that at 1:50 or so,
the Estonia sank.
♪
♪
- Out of the
989 on board,
only 137 survived.
- Why do so few
people escape?
[helicopter whirring]
- Almost everyone
who survives
is on the higher
decks of the ship,
but because it's
late at night,
many passengers are
asleep in their cabins.
- Most of the passengers
are on decks six,
five, four, and
one, and they're
completely trapped.
- The ship is tilting
over increasingly,
and water is flooding
in through the
broken windows.
- Once you have a
ship that is tilted
significantly, you
wouldn't really
be escaping through
the usual route,
which is stairwells.
You would actually be
walking onto walls.
[Dr. Steele] The walls
have become the floor.
The floor has
become the walls.
There's water
rising everywhere,
and passengers are
trying to make their
way up staircases
that are now
at completely
unusable angles.
- This isthis
is a nightmare.
- Being down in those
passenger cabins
becomes a death sentence.
- So when the
rescuers arrive,
there are very few
people to pick up.
- We now have the
critical elements
to the disaster on
the MV Estonia.
The sinking can trace
its roots back to the
ship's construction.
- The welding on the
locking mechanism
for the visor was faulty.
- Heavy waves crashing
against the visor
eventually tear the lugs
off the bottom lock.
Movement of the
partially secured visor
in the heavy weather
snaps the remaining
connections. The
visor falls off
the ship and sinks
to the sea floor.
- Without the visor, the
cold water from the
Baltic Sea would
have poured in.
- You have a big hole in
the front of the ship,
and water is
rushing through.
It's rolling
around freely in
the vehicle deck.
- The free surface effect
makes the ship unstable,
ultimately listing
over to the right.
More water floods in
as windows and doors
are broken by the
crashing waves.
Passengers asleep
on the lower decks
are trapped by
the rushing water
and the increasing
angle of the ship.
Around 1:50, Estonia
sinks below the surface.
♪
852 people are killed.
The sinking
shocks the world.
[Dr. Steele] This
tragedy was on such
a profound scale
that it fundamentally
influenced RO-RO design
and operations
around the world.
A year after the
disaster, several
different countries
Estonia, Sweden,
Finland, the United
Kingdom, and Russia
signed the Estonia
Agreement 1995,
which makes the
site of the wreck a
protected grave site.
And that means that
approaching or
exploring the site
is prohibited by all
of those signatories.
- The tragedy of
the MV Estonia
begins with a
physical defect
that has been there since
the ship was built.
♪
But a simple
organizational issue
could be just as deadly.
♪
[Narrator] The North Sea,
110 miles from the
Scottish mainland,
sits the 34,000-ton oil
platform Piper Alpha.
This huge gas and oil
rig can produce around
360,000 barrels
of oil every day.
- The Piper Alpha
platform has
226 people on it.
It's basically
like a small town.
- At 10 p.m. on
July 6, 1988
[explosion]
♪
The giant platform
is rocked by
colossal explosions.
- The whole rig becomes
a giant inferno.
It's completely
encased in flames.
People are trying to jump
off the side of the rig,
but there are many people
still trapped inside.
- Less than three
hours after the
first explosion,
most of the rig
has collapsed into
the North Sea.
[News Report] The
crumpled, smoldering
remains of Piper Alpha
could be seen at
close quarters
as the once
34,000-ton rig
continued to hiss
thick black smoke.
[Narrator] 167 people
are killed.
30 bodies are
never recovered.
- At the time, it was
the deadliest oil
rig disaster ever
and one of the
costliest man-made
disasters of all time.
- Now, using
evidence from
eyewitness statements
and the fragments
of surviving data, we
will digitally dissect
the Piper Alpha disaster
to understand what really
causes the explosion
that kills so many.
[Narrator] It takes just
under three hours
for the Piper Alpha
disaster to destroy
the entire oil rig.
A witness statement
from the captain of
the Lowland Cavalier, a
ship close to the rig,
states that the first
explosion happens
around 10 p.m.
[explosion booms]
- The captain reports
that the flames
have a characteristic
blue color.
- That evidence holds
the key to what
initially ignites.
- Piper Alpha was
a production rig
connected to the seafloor
that pumped up a mixture
of oil, of methane,
and of condensate,
which we call propane.
Crude oil burns
with a very
characteristic orange
and very smoky flame.
On the other hand,
methane and propane
are both gases.
They mix easily
with the air,
and they have a very,
very characteristic
blue flame.
[explosion booms]
- The blue flame proves
that the disaster
begins with a
gas explosion.
But is it methane or
propane that ignites?
- There's another
important part of the
witness statement,
and that is that the
flames actually came
out below the rig.
- Methane is
actually lighter,
less dense than air, and
therefore you would
expect it to rise.
On the other hand,
condensate is
significantly denser.
[explosion]
And the fact that
the flames are
seen below the rig
really makes it
clear that this is
a condensate fire.
- So where does
this exploding
condensate come from?
♪
[Professor Bisby] The
rig is laid out with
production modules A
to D, and on top of
that, you have the
accommodation modules.
According to the
witness testimony,
the first explosion
occurs near Module C,
and this is where the
condensate is compressed.
- The disaster
begins in Module C.
- But according to the
eyewitness account,
this first explosion
isn't actually
that large.
- How does one
small explosion
become an inferno
that destroys
the entire rig?
[massive explosion]
- Some of the most
useful evidence we have
is from Charles
Miller, who happens
to have his camera
on him at the time,
and he's on a
neighboring ship.
- This vital
photographic evidence
captures the
second explosion.
[explosion]
It is clear this
isn't in Module C,
where the first explosion
occurs seconds earlier.
It is in the module
next door, Module B.
- This is possibly
the worst place
you could have
an explosion.
- Pipes in Module
B carry all three
of the flammable
products on the rig,
not just propane,
but methane and
crude oil as well.
How could an explosion
happen in such
a dangerous area?
[explosion]
- The second
explosion at Module B
is clearly triggered by
the first explosion,
but that shouldn't
be possible
because a firewall
has been designed
specifically to prevent
that sort of thing
between Modules B and C.
- What goes wrong?
♪
- The firewall
that separates
Unit C from Unit B is
supposed to be able
to withstand a fire
lasting 4 1/2 hours,
but all the evidence
shows that this thing
was gone almost
immediately.
- The reason the
firewall doesn't contain
the initial explosion
may be found in
the rig's history.
[Professor Bisby] Piper
Alpha had originally
been designed
just to process oil,
but it had subsequently
been upgraded to deal
with gas as well.
- However, there
was a fatal issue
in that they didn't
modify the firewalls.
- Crude oil
firewalls only have
to be fireproof, but
for gas handling,
they have to resist
explosions as well.
- This firewall was made
from fireproof panels
that were bolted
together.
Great for heat, but not
so good for explosions.
- The first
smaller explosion
clearly destroys the
unmodified firewall
between Module B and
C, but what actually
explodes in Module B?
- You can see it here
in the photographs
from nearby vessels,
and the flame is
orange with billowing
black smoke.
This is clearly
an oil fire,
and it almost certainly
represents the rupture
of an oil pipe
in Module B.
- More than 80 of
Piper Alpha's crew
have now gathered in the
accommodation module
beneath the helicopter
pad for evacuation,
and their situation
becomes increasingly
threatening.
-19 minutes after
that explosion,
there's an even
bigger explosion
that engulfs
the entire rig.
[explosion]
- What triggers this
colossal third explosion?
♪
- From photos, we
can see that before
the third explosion,
something really
interesting happens.
There's a localized
fire that's not in
either of the modules,
but it's on one of
the decks below.
- Magnifying the
photographs shows flames
that can only come
from burning oil
dripping onto the
deck below Module B.
- But that shouldn't
be possible,
because the floors
underneath Module B
were all metal gratings,
and the oil should have
fallen straight through.
- How can oil collect
on an open grating?
- The explanation for how
the oil is able to pool
is pretty mundane.
It turns out that
divers who'd been using
the underside of the
rig had been coming up
and walking in their
bare feet on the
metal gratings,
and so they'd put
down rubber mats
over the gratings,
so it wasn't
painful for them.
- But how can a
small oil fire
on the rubber matting
under Module B
be connected to
the huge explosion
that engulfs
the entire rig?
- Immediately above where
the oil was pooling,
you have a feed
pipe coming from
Tartan, a nearby rig.
- This pipe carries a
highly pressurized,
highly flammable
mix of methane and
condensate gas.
- Now, this pipe
keeps getting
hotter and hotter,
and eventually
it ruptures, and
the gas starts
shooting out at
between 16 and
33 tons per second.
And the end result
is a giant fireball
about 500 feet
in diameter
engulfing the rig.
- By 12:45 a.m., all that
remains of Piper Alpha
is the burnt-out
wreckage of Module A.
We now know the stages
of the disaster
that ends with the
deaths of 167 people,
which leaves one
final question.
What causes that first
gas leak in Module C?
[Narrator[Key
eyewitness testimony
about the origin
of the Piper Alpha
oil rig disaster comes
from Geoff Bollands.
He is the control
room operator on duty
when the disaster begins.
- Bollands reports that
at about 9:45 p.m.,
the main condensate
pump breaks down.
- The condensate
pumps are on the
deck below Module C.
They are critical
to rig operations,
so Piper Alpha
carries two.
When pump B fails,
standard procedure is
to switch to pump A.
The crew checks pump
A's paperwork first.
This says it has
been shut down for
routine maintenance.
- But maintenance
hadn't actually begun,
and therefore safe to
use, safe to operate.
And so they switched
the pump on.
- Almost immediately,
it's clear that
something is wrong.
- At about 9:55
p.m., according to
Bolland's testimony,
gas alarms start
going off on the rig.
But these alarms aren't
coming from the floor
where the pump
is operating.
They're coming from
the floor above.
- The gas alarms point
to a leak in Module C,
where the first
explosion will
happen minutes later.
But Module C isn't
even on the same
deck as the pumps.
It is on the
next deck up.
How could alarms
caused by starting
the pump go off there?
Three months after
the disaster,
the accommodation
module is raised
from the bottom
of the North Sea.
- Inside the
crew quarters,
they find the paperwork
for the pump.
- But this is not
the work permit
that the crew checks
before starting pump A.
It's a different one.
- There's a second
permit to work notice,
and this one is connected
to the safety valve
that's connected
to pump A.
- Pump A's safety valve
is not next to the pump.
It's on the deck
above in Module C,
where the first
explosion happens.
- And what this permit
says is that on July 6th,
the safety valve
has been removed
for routine maintenance,
which is absolutely
fine to do
because the pump
it is connected
to is also down
for maintenance.
- How is it possible
that pump A gets started
when there is paperwork
clearly identifying
that its essential safety
valve has been removed?
- Looking at the
permit to work system
on Piper Alpha, there's
a very obvious flaw.
While both permits to
works were completed,
they were completed in
two separate areas,
and each of the
different components
that were affected
by those permits
were on two
different floors,
which meant the permit to
work on that top floor
was not seen by the
ones on the bottom,
and the ones
at the bottom
did not see the ones
on the floor above.
So the heart of
this awful tragedy
that killed 167 people
is essentially just
a paperwork error.
- We can now explain
the critical steps
that lead to the
disaster on Piper Alpha.
- At some point, one
of the safety valves
on one of the condensate
pumps was removed.
- A permit to work
order makes clear
that pump A's safety
valve has been removed.
- A second permit
is issued for the
maintenance work on
the pump itself,
but the two permits make
no mention of each other.
- Around 9:45 p.m.,
condensate pump B
stops working,
so the crew check
their paperwork to
make sure it is safe
to start pump A instead.
- The permit for
the pump overhaul
said that the work
hadn't started yet.
- The operators
do not know
that pump A's safety
valve has been removed.
- The safety valve
paperwork was, in fact,
on a different deck,
and therefore, the
workers had no idea
that they mustn't
touch the pump.
- As soon as pump
A is switched on,
there is a gas
leak in module C.
It ignites.
- The explosion blows
through the firewalls,
ruptures oil pipelines
in the neighboring unit,
and this triggers a
second huge explosion.
- Burning oil pools
below module B
because rubber matting
has been laid down
to protect divers' feet.
Directly above this fire
is a huge high-pressure
gas pipeline from
the Tartan rig.
- At 10:20, the Tartan
gas line melts
and starts to burn.
This triggers a
huge explosion
[explosion]
And fire engulfs
the entire rig.
And at this point,
there is no hope left
for the men on
Piper Alpha.
♪
[helicopter whirring]
- 81 crew die
by following
the standard
evacuation procedures
to wait for a helicopter.
- Because of the scale of
the fires and the smoke
and the sheer
amount of heat
that comes from an
explosion like that,
the helicopters
couldn't get to the
helicopter pads, so
there was no way
for people to get off
of the top floor.
- Only 61 of
a crew of 226
make it off the
burning rig.
[Sophie Harker] Those
that survived were the
ones that actually
ignored the
safety procedure and just
jumped off the sides.
- Following the tragedy,
radical changes are made
to safety and procedures
on North Sea oil rigs
to try and prevent
a repeat of the
Piper Alpha tragedy.