Piper Alpha: The Pump That Should Not Have Been Started
At about 10 p.m. on July 6, 1988, operators on the Piper Alpha platform in the North Sea started a standby condensate pump. They did not know that its pressure safety valve had been removed for maintenance. Condensate escaped, ignited, and set off the first explosion. By the time the fire was over, 167 people had died.
A missed handover was part of the problem. So was the fact that the crew could select a pump under repair without having its full status in front of them. When the running pump failed, they had to make a decision with information the system should have supplied.
How the Pump Became Available
Piper Alpha had two condensate pumps. During the day shift, workers removed the pressure safety valve from one pump and fitted a temporary blind flange over the opening. Work on the pump was still incomplete when the shift ended.
Later, the pump in service tripped. The night crew turned to the other pump to keep production moving. The permit for the valve work had not reached the operators making that decision. The public inquiry concluded that condensate most likely leaked from the blind flange assembly after the pump was started.
The permits and the shift handover were supposed to make unfinished work visible. They did not. Two maintenance activities affected the same pump, but the people in the control room did not have a clear picture of what had been removed and what could be operated safely.
If a piece of equipment is unsafe to start, that fact has to follow it everywhere a startup decision can be made. A permit in the right office does little good when the incoming operator cannot see the restriction.
The Fire Had Room to Grow
The first explosion was not the end of the event. Fires and further explosions damaged the platform and its emergency systems. Gas from pipelines connected to other installations continued to feed the fire. Heat and smoke made evacuation far more difficult, and many workers were left to find their own way off the platform.
The Cullen Inquiry examined the permit system, platform design, fire protection, emergency response, and the decisions made on connected installations. Each mattered to the outcome. Once the condensate ignited, the platform needed other defenses to limit the damage and protect the people aboard. Those defenses were not dependable enough.
In many facilities, maintenance procedures, fire protection, and emergency plans are reviewed separately. Piper Alpha shows why somebody has to walk through what happens when a failure moves from one system to the next.
What to Check in Your Own Operation
Start with a recent maintenance job on equipment that your operation depends on. Follow it from the work request through the next shift and back into service. Could an operator tell, without hunting for several documents, exactly what was incomplete? Would a second job on the same equipment show up in the same place? Who confirms that all work is finished before the equipment is available again?
Then look beyond the first failure. If that equipment leaks, trips, or catches fire, what else is connected to it? Which protections still work after the initial damage? How will people receive instructions and get out if the normal route or communications fail?
This kind of review applies in a plant, a mine, a utility, or any business running hazardous equipment. Do it with the people who work nights, handle shift changes, and respond to urgent repairs. They know where the written process and the real one part company.
The ARGO SH&E Perspective
The pump on Piper Alpha should never have been started. Once it was, the platform’s other safeguards did not contain the fire or give the crew a reliable way out. Leaders need to make unfinished work obvious to operators and know whether the next line of defense will hold.
ARGO SH&E works with leadership teams to see how maintenance handovers, operating controls, and emergency plans perform in practice. If you want an experienced look at those systems in your organization, reach out to ARGO SH&E.