Piper Alpha, 38 Years On
One story, told three times — and the one link in the safety chain we never engineered.
Thirty-eight years ago today, a permit failed to cross a shift handover. By midnight, 167 men were gone.
That was Piper Alpha — 6 July 1988, still the deadliest offshore disaster in history. I've spent the last two weeks writing about it, and about two others: Texas City, 2005. Toledo, 2022.
Different plants. Different decades. Different equipment. A missing safety valve, an overfilled tower, an alarm flood.
But stand back far enough and it's one story, told three times.
01Piper Alpha, 1988
At Piper Alpha, the night crew didn't know the valve was missing — the suspended permit never crossed the handover.
02Texas City, 2005
At Texas City, the day shift didn't know how full the tower already was — the logbook was incomplete and the face-to-face relief never happened.
03Toledo, 2022
At Toledo, the signal was there all along — buried under 3,712 alarms, too noisy to read, let alone hand to the next crew.
04The link we never engineered
184 people. Three inquiries. One finding, repeated for three decades:
The most dangerous place in a process plant isn't inside the equipment. It's the gap between two crews.
Think about what we've engineered since 1988. Interlocks. Trips. Permit systems. Alarm rationalization. Layer upon layer of protection — all of it on the equipment.
And the handover? In most plants it's still a conversation, a notepad, and someone's memory at the end of a twelve-hour night. The one link in the chain we never engineered.
That's what I'll be digging into over the coming posts: what a handover actually has to carry, why plants drown in data but starve for capture, and what it takes for an open item to survive the night without depending on anyone's memory.
For today, one question — the same one those three inquiries kept circling: in your plant, what carries the shift's knowledge across the gap. A system? Or a memory?
Different plants, different decades, different equipment. Stand back far enough and it is one story. The night crew didn't know the valve was missing. The suspended permit never crossed the handover. The day shift didn't know how full the tower already was. The logbook was incomplete. The signal was there all along — buried under 3,712 alarms, too noisy to hand to the next crew. Layer upon layer of protection, all of it on the equipment. What carries the knowledge across the gap — a system, or a memory?
Get the next piece.
Get the free field guide — The Handover Gap: three disasters, one lesson, and a checklist for your next shift. Plus the occasional piece worth your shift. No noise, no pitch.
Run a shift somewhere? I compare notes with operators and supervisors on how real floors handle handover and capture — what works, what quietly doesn't. No pitch; I'm not selling anything. Tell me how yours does it: [email protected]