Energy

On Piper Alpha on July 6, 1988, the night shift pumped gas through a valve sealed only by a maintenance permit that had not been cancelled, and 167 men died

On the night of July 6, 1988, Piper Alpha, a North Sea oil platform, caught fire and burned for hours while 226 men were on board. By morning, 167 were dead. The cause was a pump restart authorised by a supervisor who had not seen the right piece of paper.

By Bruno Teles · 27 June 2026

Piper Alpha oil platform engulfed in fire at night in the North Sea, massive orange and red flames with thick black smoke rising into a dark sky

Piper Alpha was an oil and gas production platform in the North Sea, 193 kilometres northeast of Aberdeen, Scotland, operated by Occidental Petroleum. On the evening of July 6, 1988, one of its gas condensate pumps broke down. A supervisor on the night shift decided to switch to the backup pump.

He did not know that a pressure safety valve had been removed from that backup pump hours earlier for scheduled maintenance. The maintenance crew had gone home. The permit to work documenting the missing valve was suspended in a filing tray in the control room, but nobody told the night shift. At 9:58 PM, condensate sprayed through the gap where the valve should have been, and Piper Alpha exploded.

Piper Alpha was an oil production platform in the North Sea operated by Occidental Petroleum. On July 6, 1988, a technician restarted a pump whose safety valve had been removed for maintenance, not knowing the permit to work had not been cancelled. The resulting fire killed 167 of the 226 men on board.

What was Piper Alpha, and who ran the North Sea oil platform?

Piper Alpha began producing oil in 1976.

At its peak, it generated around 10 percent of all North Sea oil and gas output, pumping roughly 300,000 barrels a day through underwater pipelines to three other platforms and then to shore.

The platform also processed natural gas and gas condensate, a highly flammable liquid that ignites more easily than crude oil and burns at lower temperatures.

Occidental Petroleum, an American oil company, had bought the platform in 1978.

By 1988 it had been converted to handle gas condensate as a major product stream, which made it more volatile than a conventional oil platform.

The 226 men on board that July night were a mix of Occidental employees, workers from contractor companies including Seaforth Maritime and Wood Group, and catering staff.

Most worked two-week rotations, living on the platform in shared cabins, eating together in a canteen, and returning to families in Aberdeen when their shift was over.

Many had worked the North Sea for years, moving between rigs and platforms as contracts came and went.

North Sea oil rig workers in orange survival suits on an offshore platform deck, offshore safety equipment visible in an industrial environment — Workers on North Sea offshore platforms wore survival suits and followed muster protocols — procedures that proved inadequate on the night Piper Alpha burned.

How did a single permit to work failure cause the Piper Alpha disaster?

Permit to work is the system offshore platforms use to control dangerous maintenance tasks.

Before a crew removes or disables safety equipment, they complete a paper permit that describes the work, the hazards, and what must happen before the equipment is used again.

When work is suspended overnight, the permit is supposed to remain visible and clearly flagged so the next shift knows what is still offline.

On the afternoon of July 6, a maintenance team on Piper Alpha removed a pressure safety valve (PSV) from Condensate Pump A.

The valve is a small but critical part: if pressure in the pump builds too high, the valve opens and releases it safely.

Without it, a temporary blank flange (a metal plate) was bolted over the opening to seal the gap.

The maintenance team completed their permitted hours and stopped work before finishing the job.

They left the permit to work in a suspended state in a filing tray in the control room.

The permit was filed alongside dozens of others covering routine maintenance across the platform.

Nothing on the outside of the tray indicated which permits covered active hazards and which covered routine tasks.

That evening, Condensate Pump B, the one that had been running, broke down.

The night shift supervisor went to the control room to find the permit for Pump A, to see if the backup could be used.

He found the permit in a suspended state and read this to mean the work was incomplete but not necessarily dangerous to run.

He authorised Pump A to be restarted.

No one checked whether the pressure safety valve was physically in place before the pump was switched on.

This kind of physical check was not required by any procedure Occidental had in place for the platform.

What happened on Piper Alpha from the first explosion to the platform collapse?

At 9:58 PM on July 6, 1988, condensate sprayed from the gap where the pressure safety valve had been removed.

It ignited immediately.

The first explosion blew through the condensate injection module and sent a fireball into the accommodation block, where men were eating, watching television, and preparing for sleep.

The tannoy ordered all men to their muster stations, the fire-safe rooms designed to hold workers while they waited for lifeboat deployment.

But the fire had already cut off the main lifeboat decks, and smoke was filling the accommodation block from below.

The muster stations became death traps.

Most men who went to the muster stations died there, overcome by smoke and heat before rescue could reach them.

The men who survived were, almost without exception, those who disobeyed the order.

They went to the outer edges of the oil platform, found ropes, hoses, or ledges, and jumped or climbed toward the sea.

Some fell from as high as 45 metres into water partially covered in burning oil.

Survival suits are not designed for that kind of impact.

Several men died on contact with the water.

Several more were burned as they swam through the surface oil.

But enough made it into clear water to swim toward the rescue vessels circling below.

At 10:04 PM, the Tartan gas riser ruptured and exploded.

The Tartan platform was 4 kilometres away and had been pumping gas into Piper Alpha through a subsea pipeline since before the fire started.

The riser was carrying that gas at high pressure when the heat caused it to fail.

The second explosion was far larger than the first and destroyed the control room and the platform's firefighting systems.

At 10:20 PM, the MCP-01 gas riser also ruptured, triggering a third and even larger fireball.

The main structure collapsed into the North Sea shortly after.

By 11:00 PM, all that remained of Piper Alpha above the waterline was burning wreckage.

Why did neighbouring platforms keep feeding fuel into the Piper Alpha fire?

The destruction of Piper Alpha was made catastrophically worse by a decision that was never actually made: the decision not to shut down the adjacent platforms.

Both Tartan and MCP-01 continued pumping gas into Piper Alpha through subsea pipelines for several minutes after the first explosion.

Those pipelines fed the riser fires that destroyed the platform.

The Tartan platform operators could see fire on Piper Alpha from 4 kilometres away, but not clearly enough to assess its severity.

Shutting down a North Sea gas pipeline requires authorisation from the installation manager.

The Piper Alpha installation manager was on board Piper Alpha when it exploded.

He died in the fire.

Nobody at Tartan could reach him.

Nobody else issued the shutdown order.

The same communication failure applied to MCP-01.

Standing procedures required coordination between platforms before a pipeline shutdown.

There was no emergency protocol that said: if you cannot contact the receiving platform and you can see flames, shut down immediately and explain later.

The Cullen Inquiry later found that neither Tartan nor MCP-01 management bore criminal responsibility for this delay.

The systems they were operating under had not anticipated a scenario where the receiving platform was destroyed faster than communication could travel between them.

It is one of the most costly communication gaps in the history of the offshore industry, and the lessons it forced into offshore safety regulation were among the most expensive ever learned.

Why did rescue ships hold their position while men burned on Piper Alpha?

Three vessels were near Piper Alpha that night: the Tharos, a giant fire-fighting support ship; the Silver Pit, a fast rescue craft; and the Sandhaven.

All three could see men in the water.

The Tharos was built precisely for offshore disasters.

Its fire monitors were not effective against the scale of the riser fires, and its captain held position to avoid running over survivors.

By the time the second riser exploded at 10:20 PM, the Tharos had rescued two men.

The Silver Pit was smaller and faster.

Its captain, David Bedworth, watched the disaster unfold, then drove the Silver Pit directly under the burning platform.

He held station in water covered in burning oil, with debris falling from the structure above, while his crew pulled survivors from the sea.

By the time he withdrew, he had rescued 35 men.

Two crew members were injured.

Bedworth later said he was not certain he had the authority to do what he did.

He did it anyway.

Marine rescue vessel on rough North Sea waters at night, searchlights illuminating the dark sea during an offshore emergency operation — Standby rescue vessels near Piper Alpha that night faced unclear protocols and deteriorating conditions. The captain of the Silver Pit ignored the uncertainty and drove into the fire.

The two divers who died that night were Barry Barber and Bob Ballantyne, employed by Wharton Williams Ltd.

They entered the water to help men who were too injured or exhausted to swim to the boats.

Neither came back.

Their bodies were not recovered.

The Cullen Inquiry praised Bedworth while finding that the standing procedures for standby rescue vessels near offshore platforms had been wholly inadequate for a disaster of this scale.

That gap was among the 106 recommendations Cullen included in his 1990 report.

What the Cullen Inquiry found and how Piper Alpha changed offshore safety

Lord William Douglas Cullen began his public inquiry into the disaster in January 1989 and delivered his two-volume report in November 1990.

Cullen's central finding was that Occidental's permit-to-work system was confusing, inconsistent, and inadequately managed.

Supervisors did not understand what a suspended permit meant.

The filing system for active permits did not distinguish between routine maintenance and work involving removed safety equipment.

Nobody on the night shift was trained or required to physically verify the status of a pump before restarting it.

Cullen also found that Occidental had no effective major accident hazard assessment for the platform.

The company knew condensate was more dangerous than crude oil but had not formally mapped what a condensate fire at the injection module would mean for the accommodation block, the gas risers, or the escape routes.

All 106 of Cullen's recommendations were accepted by the industry and by the UK government.

The most significant was the introduction of the Safety Case regime under the Offshore Installations (Safety Case) Regulations 1992.

The Safety Case requires every offshore operator to formally identify all major hazard scenarios and demonstrate, in writing, how those hazards are controlled.

Before Piper Alpha, no such requirement existed in the UK offshore industry.

Operators could build and run a platform without ever submitting a document that described what would happen if a gas riser failed and what escape routes remained viable.

The Safety Case framework is now applied in offshore industries across Europe, Australia, and much of the rest of the world.

It is one of the most direct examples of a disaster producing a lasting structural change in industrial regulation, comparable in its field to the Aberfan disaster and the overhaul it triggered in the rules governing coal tips and spoil heaps in Britain, or to the way the Banqiao dam collapse in China eventually rewrote the engineering standards for reservoir safety.

The honest catch

Occidental Petroleum was found civilly liable for the Piper Alpha disaster.

The company dissolved its North Sea subsidiary before many of the compensation claims were fully settled.

Surviving workers and bereaved families spent years in legal proceedings.

No criminal charges were brought against any individual or company.

The offshore industry did improve substantially after Piper Alpha, and the Safety Case regime has demonstrably changed how major hazard risks are managed.

But on April 20, 2010, the Deepwater Horizon platform exploded in the Gulf of Mexico, killing 11 workers and triggering the largest accidental marine oil spill in history.

Investigators found permit-to-work failures and inadequate emergency communication among the contributing factors.

The causes of Piper Alpha and Deepwater Horizon were not identical.

But the underlying pattern (communication gaps, ambiguous authority, offshore safety equipment removed under time pressure) was recognisable in both.

Offshore safety in the North Sea is measurably better than it was in 1988.

That is a fact worth acknowledging.

So is this: the Great Smog of 1952 killed thousands and led to the Clean Air Act; the Chalk River reactor accidents shaped how the world thinks about nuclear emergency response.

Disasters have a pattern of producing their own regulation, after the fact.

The men on Piper Alpha paid for the next generation's safety standards.

The survivors of Piper Alpha were, almost without exception, the ones who ignored the official instruction to muster and instead went to the edge of the platform and jumped. When the rules are designed for the average emergency and you are living through the catastrophic one, the question of whether to follow them becomes very hard. What would it take to build that kind of autonomous judgment into emergency procedures from the start? Leave a comment below.