Nobody Told the Next Shift

A safety valve gets pulled for testing. Somebody fits a blank where it was, writes it on a permit — and then the shift changes, and the paper never reaches the men who need it. That gap, on a platform in the North Sea, killed 167.

Thirty-eight years ago this week, 120 miles off Aberdeen, a night crew started a pump that was missing its safety valve. They didn’t know it was missing — the paperwork that would have told them was sitting on a control-room desk, unread. Within hours, 167 of the 226 men on Piper Alpha were dead.

It didn’t land on July 3 — it fell three days up the week, on the 6th, in 1988. The lesson has no expiration date.

Piper Alpha was a giant. Occidental’s platform pulled oil and gas from the North Sea, and two more platforms — Tartan and Claymore — fed their production through it. That afternoon, a pressure safety valve was pulled off one of two condensate pumps for routine recertification. A blank flange — a flat metal disk — was fitted hand-tight where the valve had been, and a permit-to-work recorded that the valve was out of service. A separate permit covered the pump itself.

Then the shift changed. Here is the hinge the whole night turns on: the men coming on never learned the pump’s safety valve was gone. The permit for that job never got passed hand-to-hand; it sat in the control room. Late that evening the running condensate pump tripped and wouldn’t restart. The control room, pressed to keep the gas flowing, reached for the spare — the very pump wearing a blank flange where its safety valve belonged. They started it, because nothing they could see told them not to.

Condensate forced its way out of that loose flange and found a spark. The first explosion ripped through the platform. It should have been survivable. It wasn’t — because of what came next.

The firewater deluge, the system that floods a burning platform with seawater, had been left on manual, isolated to protect divers working near the seawater intake. It couldn’t start itself, and no one could reach the switches through the fire. Worse: Tartan and Claymore watched Piper Alpha burn and kept pumping oil and gas into it, because their crews didn’t believe they had the authority to shut down without word from shore. That fuel fed the fire until the gas risers — pipelines thick as a man — ruptured into fireballs.

The men did what they were trained to do: they mustered in the accommodation block and waited for an orderly evacuation. It never came. At least 81 men sheltering there died as the module filled with smoke and finally slid into the sea. The ones who lived mostly disobeyed — they climbed to the rails and jumped a hundred feet into a burning ocean. Of 226 aboard, 167 were killed.

Lord Cullen’s inquiry laid it bare: hazards poorly analyzed, a permit-to-work system everyone trusted and no one truly ran, permits left on a desk instead of handed across at shift change, a chain of command that broke when it mattered. His 106 recommendations rebuilt offshore safety around the “safety case” — the operator now has to prove, on paper and in practice, that the hazards are understood and controlled.

The rule it carries into your world: 29 CFR 1910.147 — the control of hazardous energy, lockout/tagout. Most of us picture a padlock on a breaker. Read the part people skip — 1910.147(f)(4), continuity across a shift change: when a job spans a handover, there has to be a specific procedure to transfer that isolation so protection is never interrupted. That clause exists because a missing valve and an unpassed permit at a shift change once killed 167 people. Translated to the floor: an isolation you can’t account for is an isolation that’s protecting nobody. The paper is not the protection — the verified, communicated, hand-to-hand handover is.

Not one of those 167 men was careless. The crew that started the pump did the reasonable thing with the information they had. The system let a life-or-death fact — this pump has no safety valve — die on a desk between two shifts. A normal handover, done the normal loose way, turned one missing valve into the worst offshore disaster in history. The rule is the rulebook written in those men’s names. Build the handover so the next shift never has to guess what you left isolated.

EPA is moving to roll back the 2024 chemical-accident rule. In February 2026, EPA proposed its “Common Sense Approach to Chemical Accident Prevention,” and the comment window closed April 10. If finalized, it would pare back the Risk Management Program’s safer-technology analysis, third-party audits, public information-sharing, and some of the emergency-response and employee-participation requirements added in 2024. It is proposed, not final, and legal challenges are widely expected. So what: don’t thin out a working process-safety program chasing a rule that hasn’t landed. Piper Alpha and every disaster like it says the same thing — the hazard doesn’t care what the paperwork requires this quarter. And OSHA’s PSM standard, 29 CFR 1910.119, still governs your covered processes no matter what EPA does with RMP.

Day shift isolates a line to swap a valve — locks it out, drops a blind, tags it, writes it up. Good work. Then the job runs long and rolls into nights. The night crew sees the line is “down for maintenance,” but the day lead has gone home and the only record is a permit sitting on the control-room desk. A night operator, trying to get production back, lines up to re-pressurize the line — while a fitter still has his hands near the open flange. Somebody catches it at the last second, because they physically walked the line before anyone opened a valve. Nobody got hurt.

Here’s the blameless read: nobody on nights did anything crazy. They were trying to keep the plant running with the information in front of them — that’s the whole job. The failure was the handover: a lockout and an open line-break that lived on a desk instead of getting walked, hand-to-hand, from the shift that set it to the shift that inherited it. Same gap that lit up Piper Alpha, scaled down to your plant on a Tuesday.

Got a fail or a near-miss? Hit reply. We’ll feature it anonymously — no names, no company, no blame. Just the lesson, so the next crew doesn’t learn it the hard way.

Walk your isolations at shift change — don’t just pass the paper. Before the outgoing crew leaves, put boots on every lockout, blind, and open permit with the incoming crew standing there: what’s isolated, why, who’s still working it, and what it takes to restore. 29 CFR 1910.147(f)(4) requires that continuity for a reason. A tag on a board tells you a story; a lock you laid eyes on tells you the truth. Piper Alpha’s missing valve was written down — it just never got walked.

Please stay Safe & Hydrated!!!