On 7 September 1987, a contract rigger was killed on Piper Alpha. The investigation found the two things Lord Cullen would find a year later: the permit-to-work system was not working, and neither was shift handover. Occidental pleaded guilty. The system was not substantially changed.
Ten months later, on the evening of 6 July 1988, the permit for condensate pump A's relief valve was carried back to the control room marked "SUSP". The supervisors were talking. The permit was put on the desk. Nobody mentioned it and nobody read it.
At 21.45 the duty pump tripped. The control room knew pump A was off for a coupling job and knew nothing about the valve. They started it. Behind the missing valve was a blind flange that had never been tightened down or tested. 167 men died.
Everyone in safety knows the second story. Almost nobody tells the first. It is one of seven things about permits to work that the standard training leaves out: five more from Cullen's report, and one from a courtroom last Thursday. Each ends in a question about your own site.
1. The platform had already had a permit-to-work death
Piper Alpha did not fail on a system that had never been tested. It failed on a system that had already killed someone, been examined in court, and been left as it was. The company had a worked example, with a body, of how its paperwork broke. The lesson sat available for ten months.
The question for your site is not "have we had a permit failure". It is "what did we change after the last one". If you cannot name the change, the next failure is not a surprise. It is a repeat.
2. The permit system was being monitored, and the monitoring said it was fine
Piper Alpha's permit system had a named person watching it, the lead safety operator. He reported no problems. Management did not look for themselves. Their words to the inquiry were that they "knew that things were going all right".
In practice, signatures and gas test results were routinely missing. Operations representatives often did not visit the job before suspending or closing a permit. Craft supervisors left permits on the control room desk instead of handing them over. A senior maintenance technician had raised permit concerns at a corporate meeting earlier that year. Cullen's summary of the whole platform fits in one line: "The safety policies and procedures were in place: the practice was different."
If your permit audit is a count of forms completed, it will say the same thing. Cullen's test was different: audit what is done, not what is documented.
3. The job was suspended to avoid overtime
The relief valve could not be refitted that evening. The crane was not available and the shift was ending. The choice was overtime or suspend. The permit was suspended.
Nothing about that is unusual, and that is the point. The same decision is made on every site, every week. A suspended permit means the plant is not back to normal and the hazard is still live. On Piper Alpha, suspension turned a missing valve into a piece of paper in a drawer, filed by trade rather than by equipment, in a system where the control room could not see it. The two permits on the same pump did not reference each other.
What physically happens to a suspended permit on your site at 18.00, and would the night shift find it before they started the pump?
4. The fire pumps were on manual on purpose
This is the one that stops people. Piper Alpha's diesel fire pumps were in manual mode that night because divers were working near the pump intakes, and a pump starting automatically could draw a diver in. It was a safety precaution. It was stricter than the company's own policy. A fire protection audit in 1983 had recommended the practice be stopped.
When the explosion came, starting the pumps meant walking to them through the fire. Nobody could. Not one drop of water from Piper Alpha's own system reached any of the fires. Tests had in any case found 40 to 50 per cent of the deluge nozzles blocked with scale.
The lesson is not about fire pumps. A control put in place for one hazard quietly removed the barrier against another, and a permit system that looks at one job at a time will never see it. The diving permit and the fire protection system never met on paper.
5. There was no written handover procedure
None. Handover did not include a review of live or suspended permits. The induction for new arrivals was a booklet, much of it out of date; for experienced hands, training was described as brief to the point of non-existent. Weekly evacuation drills were required; one six-month period recorded thirteen. No full-scale shutdown drill had been run in three years.
Cullen asked four questions of the permit system: was the procedure adequate, was it followed, was training adequate, was it monitored. The answer to all four was no. His lesson is that the permit is not the control. The permit is how one person's knowledge reaches the next person. On Piper Alpha the knowledge existed, was written down, and never arrived.
6. Two other platforms fed the fire for an hour
Tartan and Claymore shared pipelines with Piper Alpha. After the first explosion both kept producing for roughly an hour; Tartan began shutting down at about 22.40 and Claymore at about 23.00. The risers failed at 22.20 and 23.20 and turned a fire into a furnace. Their operators could see what was happening. They did not believe they had the authority to stop production without instruction.
That is a permit question too. Who on your site can stop a job, or a process, on their own judgement, and does everyone know it?
7. It happened again last Thursday
On 15 November 2019, in the engine room of the trawler Resurgam at Newlyn in Cornwall, a contractor was installing a fire suppression system. Four other people were working in the same cramped space, reached by a ladder and a hatch; at one point there had been six or seven. The suppression system activated unexpectedly and filled the room with hot, toxic gas. Three got out. Conor Moseley, a 20-year-old apprentice engineer, did not.
HSE's finding, published on 16 October 2026 after the owner was fined £100,000 at Truro Crown Court, was that nobody had properly considered the risk of several contractors working together in that space, there was no safe system of work for the installation and no effective rescue plan. HSE said in terms that a permit-to-work system could have coordinated the different activities and kept them safe.
Thirty-one years after Piper Alpha, on a fishing boat, two jobs in the same space never met on paper. The company was not responsible for the system going off. It was responsible for knowing who was in the room when it did.
What the law asks, in two lines
Cullen made 106 recommendations; the Offshore Safety Act received Royal Assent on 6 March 1992 and safety cases became law. Onshore there is no regulation called permit to work. The duty is section 2 of the Health and Safety at Work Act, a safe system of work, and HSE's guidance in HSG250 says what a good one looks like: roles with no gaps or overlaps, cross-shift work left safe with written instructions, related permits displayed and linked, a hand-back process. HSE's own warning is the shortest: issuing a permit does not, by itself, make the job safe.
Five things to check on Monday
Find the last permit failure on your site, however small, and name what changed because of it. Piper Alpha's answer was nothing. Ask who monitors the permit system and what they reported last quarter. If the answer is "no problems", stand at the permit desk for the first half hour of a shift and see whether that is true. Pull every permit that is suspended right now and ask the incoming supervisor to describe each one. The ones they can't describe are the ones on the desk marked SUSP. List every safety system that can be switched to manual or inhibited for a job. Deluge, gas detection, trips, interlocks, suppression. For each, which permit records it, and who checks it is restored? Pick a space where two trades work at once and ask whether either permit names the other. On the Resurgam the answer was no.
The question worth asking
Ten months before the disaster, Piper Alpha was handed its lesson with a death attached, and filed it.
What has your site already been told, and not yet changed?
Sources
- The Public Inquiry into the Piper Alpha Disaster (Lord Cullen), HMSO, November 1990
- Macleod & Richardson, Piper Alpha: the disaster in detail, Loss Prevention Bulletin 261 / The Chemical Engineer, 2018: https://www.thechemicalengineer.com/features/piper-alpha-the-disaster-in-detail/
- CCPS/AIChE, Piper Alpha case history: https://www.aiche.org/sites/default/files/docs/embedded-pdf/Piper_Alpha-case-history.pdf
- HSE press release, Fishing fleet company fined following engine room fatality, 16 October 2026: https://press.hse.gov.uk/2026/10/16/fishing-fleet-company-fined-following-engine-room-fatality/
- HSE, Why are permit-to-work systems important?: https://www.hse.gov.uk/humanfactors/topics/ptw.htm
- HSE, HSG250 Guidance on permit-to-work systems, 2005: https://www.hse.gov.uk/pubns/books/hsg250.htm
- Offshore Safety Act 1992: https://www.legislation.gov.uk/ukpga/1992/15/contents
- Health and Safety at Work etc. Act 1974, section 2: https://www.legislation.gov.uk/ukpga/1974/37/section/2
First published on the HartfellCo LinkedIn page, 20 October 2026.
Want this built into your training programme? See our Permit to Work Training Course.