RISKOPILOT Editorial Team, 16 September 2026, 4 min read

How to verify critical controls before work starts: lessons from Piper Alpha

A permit is not a barrier. The CCHI gate turns critical control verification into a stop-or-go decision.

A barrier that existed only on paper

On 6 July 1988, the pressure safety valve of a standby condensate pump on the Piper Alpha platform was removed for maintenance and replaced by a blind flange that had not been leak-tested. That evening, after the other pump tripped, the night shift took steps to restart the standby pump without knowing that its valve was missing. Condensate leaked from the flange and ignited. The explosion and the fires that followed killed 167 people.

The public inquiry led by Lord Cullen found failures in communication at shift handover and in the permit-to-work system, and said the permit failure was not an isolated mistake. Nothing physically prevented the equipment from being pressurised again: there was no locking of isolation valves and no double block and bleed.

From checklist to gate

Most organisations already check their critical controls. The weakness lies in what happens with the answer. CCHI turns the check into a gate. Before a high-energy task starts, each critical control is verified in the field as present, functional and in use, and scored 1 if verified or 0 if not. The gate is the product of those scores, so a single unverified control closes it and the task does not start. Three out of four is a stop.

Rules that keep the gate honest

Evidence that is only a document scores 0, because a signed permit does not prove that a valve is fitted. A sample of gate checks is repeated by an independent verifier, and the share of false passes becomes a board indicator (O3). Read together with the rate of closed gates (E1), it separates organisations that find problems from organisations that only record passes.

What a closed gate means

A closed gate is the system working, not a crew failing. It should be reported as a success, logged, and used to move the weakest pathways up the hierarchy of controls, for example from isolation that relies on people to locked or interlocked isolation.

Sources

• Lord Cullen (1990), public inquiry findings, as reported by Oil & Gas Journal
• The Chemical Engineer (IChemE, 2018). Piper Alpha: the disaster in detail