1
0/1261/5/1990
APPENDIX TO THE OPINIONS OF THE JUDGES
in
RECLAIMING MOTIONS
in the causes
CALEDONIA NORTH SEA LIMITED
Pursuers and Reclaimers;
Against
LONDON BRIDGE ENGINEERING LIMITED;
PICKUP NO. 7 LIMITED (formerly NORTHERN
INDUSTRIAL & MARINE SERVICES COMPANY
LIMITED);
BRITISH TELECOMMUNICATIONS plc;
WOOD GROUP ENGINEERING CONTRACTORS
LIMITED;
NORTON (NO. 2) LIMITED (In liquidation)(formerly
EASTMAN CHRISTENSEN LIMITED) and DAVID JOHN
PALLEN, Chartered Accountant, the Liquidator thereof;
KELVIN INTERNATIONAL SERVICES LIMITED
(formerly KELVIN CATERING LIMITED); and
COFLEXIP STENA OFFSHORE LIMITED (formerly
STENA OFFSHORE LIMITED)
Defenders and Respondents:
2 September 1997
CHAPTER ONE - INTRODUCTION
1.1. General
This is one of a series of cases arising out of the tragic accident on the
Piper Alpha oil platform which occurred on the evening of 6 July 1988. As is
well known the oil platform in question, located in an oilfield in the North Sea
about 110 miles north-east of Aberdeen, was destroyed in an explosive
conflagration with considerable loss of life. 167 persons lost their lives as a
result of the accident either through being on board the platform or through
being involved in rescue operations. Of those killed 159 were British and of
2
the balance only one was an American citizen, he being from Texas. 61 of
those aboard the platform survived the accident but many of these suffered
varying degrees of injury or trauma. The accident was the worst disaster in the
history of the British off-shore oil industry. The pursuers in each of the said
cases are Elf Enterprise Caledonia Limited who are the successors to the
owners and operators of the platform at the time of the incident. Following
upon the accident the families of deceased victims and the survivors combined
in various ways to present their claims against the platform operators and in
particular they indicated that they were proposing to litigate their claims against
the pursuers’ predecessors in Texas. The reason for this selection of Texas as a
prospective forum to litigate claims, arising from an event largely involving
British victims and occurring in Scottish waters, was that it was conceived that
the Texas legal system was materially the most favourable which was
potentially available for the pursuit of such claims both in relation to its Jury
procedures and in quantification of damages. Negotiations took place
throughout the autumn of 1988 between the pursuers’ predecessors and the
representatives of the victims’ interests and eventually settlement terms were
agreed and then implemented. The validity of the claimants’ assertion that a
Texas court would accept jurisdiction in litigating their claims was a critical
issue but compromise was reached on the assumption that the level of damages
finally offered and accepted represented an approximate mid-point between the
assumed Texas level of damages and the assumed Scottish one. This basis of
settlement was referred to by the parties as a “mid-Atlantic formula”. The
relatively prompt settlement of claims is clearly to be applauded on
humanitarian grounds but the question of who bears the ultimate responsibility
for the monies paid to claimants raises contentious issues which have given rise
3
to the present litigations. The operators of the platform employed a certain
number of their own employees but most persons on board the platform at the
time of the accident were in fact employees of various contractors who had
arrangements with the operators to carry out specialist work tasks. Thus for
example drilling, diving and catering work on the platform was conducted on
behalf of the operators by specialist contractors. The contractors had each
entered into contracts in connection with the work they had to perform and
these contracts provided that in certain circumstances the contractors were to
indemnify the operating parties in the event that damages had to be paid to
those contractors’ employees as a result of incidents occurring while they were
working on the platform. At the time of the accident there were 226 persons on
board the platform. Of these 165 died and 61 survived. Of the persons who
died 31 were employees of the Operators and 134 were employees of one or
other of the contractors. There were also two persons killed while working on a
rescue craft. Of the survivors 6 were employed by the Operators and 55
employed by contractors. There are 146 actions in the present series of cases
and these are each directed against contractors who employed persons killed or
injured in the accident and in respect of whom monies have been paid by way
of damages and expenses to claimants under the settlement terms to which I
have previously alluded. The pursuers claim that the defenders in each case are
bound in terms of their contract to indemnify the pursuers for the monies paid
out under the settlement. It is claimed by the pursuers that they were bound to
compensate the victims or their relatives and that the sums that were payable
under each settlement were reasonable. In the actions the pursuers are seeking
to recover not only the sums paid to claimants as actual damages but also sums
of expenses paid to the claimants in respect of legal expenses said to have been
4
necessarily incurred in pressing home their claims including expenses incurred
for representation at the Cullen Inquiry. The defenders for their part deny that
they have any liability under the alleged indemnities. This puts in sharp focus
the cause of the accident and any attribution of fault therefor. It also raises
questions concerning the construction of the indemnity provisions in the
contractors’ contracts. There is also a major dispute between the parties about
the reasonableness of the damages and expenses paid out to claimants by the
0perators. The defenders contend that the Operators over-estimated the
likelihood that a Texas court would have accepted jurisdiction in the cases and
in any event that a Jury sitting in Texas would not have awarded (or been
allowed to award) the high levels of damages on which the operators based
their settlement offer. The level of expenses paid out is also queried. Lastly
but not least the defenders advanced an argument that the pursuers had
misconceived the present actions for indemnity and that the appropriate
procedure following upon the settlement should have been actions by their
insurers for contribution. The dispute between the parties in the various actions
(which I have merely outlined above) gave rise to a multiplicity of complex
questions as the considerable length of the Proof denotes.
At the commencement of the Proof I was informed by Counsel that the
146 actions before the Court largely raised the same questions. It was therefore
proposed that seven of the actions which illustrated such differences as there
were between the cases should proceed on a test case basis, and that Proof in
these actions be conjoined. These seven actions, (which include the present
action), were said to focus all the issues which arise in the other actions and I
was asked to sist these other actions. Since there were no objections to these
proposals I agreed to give effect to them. The seven actions which went to
5
Proof were the cases against London Bridge Engineering Limited (employers of
the deceased Robert Carroll), Northern and Industrial & Marine Services
Limited (employing the deceased John Duncan), British Telecommunications
P.L.C. (employing the deceased Graham Gill Whyte) , Wood Group
Engineering Contractors Limited (employing the deceased Michael O’Shea),
Eastman Christensen Limited (employing the deceased Neil Pyman), Kelvin
International Services Limited (employing the deceased William John Cowie),
and Stena Offshore Limited (employing the injured party Andrew Murray
Carroll).
1.2
The Parties
The pursuers in all these actions are Elf Enterprise Caledonia Ltd. This
company were formerly known inter alios as Occidental Petroleum (Caledonia)
Ltd (hereinafter referred to as OPCAL). OPCAL were registered in England
and had their principal place of business in London with further places of
business in Scotland. In 1988 at the time of the accident OPCAL were the
Operators of the Piper Alpha and Claymore oil production platforms as well as
the Flotta terminal to which the oil was pumped. In 1988 OPCAL were a
member of a large international group of companies known as the Occidental
Group. Since the accident OPCAL has been acquired from Occidental by a
French company known as Elf Enterprises and this no doubt explains the
changes in the name of the company. Before a company can explore for or
develop a North Sea oilfield it requires a licence to do so from the
Government. By licence no. P220 dated 28 April 1972 the Secretary of State
for Trade and Industry granted licence to four companies namely Occidental
Petroleum (UK) Ltd. (hereinafter referred to as OPUK), Getty Oil International
6
(England) Ltd., Allied Chemical (Great Britain) Ltd, and Thomson Scottish
Associates Ltd. By 1988 the four last mentioned companies had transformed
themselves into Texaco, Union Texas Petroleum and Thomson North Sea Ltd.
respectively . The said licence was granted to relate to a number of exploration
blocks including the block where Piper Alpha was eventually situated, namely
the Piper Field. OPUK was another Occidental subsidiary and was a British
Company (which attribute was needed to secure a licence). However the
company was at that time effectively a nominee for an American company of
the Group which provided the finance required. The said American company
was Occidental of Britain Ltd. ( hereinafter referred to as OBI). They were
registered under the laws of California and had a place of business in London.
By a Deed of Variation dated 3 October 1974 Licence no. P220 was restricted
to the Piper Field and it was agreed that a licence for the residual fields should
be granted to OPCAL (and the three other companies who were licensees under
the original licence). Moreover OPCAL and the said three licensee companies
were by further licences given permission to lift oil from the Claymore field
and from other blocks. All these oil fields were located in the United Kingdom
sector of the North Sea in the Scottish area. On 28 July 1982 a further Deed of
Variations was entered into by the relevant parties with reference to licence no.
P220 with a view to amending certain model clauses. By an agreement dated
1 January 1984 Occidental Petroleum (Great Britain) Ltd., the holding company
of OPCAL, sold to OPCAL the share capital of OPUK and indeed on that date
OPCAL took over their whole interest in the Piper Field. The effect of a series
of arrangements entered into at that time was that OPCAL became the
representative of the Occidental interests in the North Sea and in particular
acquired Occidental’s rights and liabilities in the Piper Field. On 1 March 1984
7
OPCAL were named in the licence for the Piper Field in place of OPUK. In
1977 the original four licensees entered into a Joint Venture Operating
Agreement (the JVOA) in terms of which OBI were to act as Operators of the
Piper Alpha platform on behalf of all the licensees whose respective interests in
the operations were also defined. OBI were also “throughput parties” in the
original JVOA. Throughput agreements were arrangements which enabled
American companies to provide finance to British companies for North Sea oil
development and obtain oil income in return. The parties to the JVOA were
defined as “Participants”. On 1 March 1984 the participants were parties to
what is described as a “Novation Agreement” which related to the JVOA and
this was made to operate retrospectively from 1 January 1984. In terms of this
Novation Agreement OPCAL by agreement with the interested parties took
over the former interests under the JVOA of OBI and OPUK and became
Operators of the Piper Alpha platform on behalf of the Participants. A similar
Joint Operating Agreement had been entered into in 1977 making OPCAL the
Operators on behalf of the licensees of Claymore and by a further agreement on
27 July 1986 the effect of this was clarified. By the date of the accident in 1988
the Participants were OPCAL (successors to the original interest of OPUK),
Texaco Britain Ltd (successors to the original interest of Getty Oil International
(England) Ltd.), Union Texas Petroleum Ltd (successors to the original interest
of Allied Chemical (Great Britain) Ltd.), and Thomson North Sea Ltd.
(successors to the original interest of Thomson Scottish Associates Ltd.). Since
the disaster Thomson North Sea Ltd have been taken over to become Lasmo
(TNS) Ltd. At the date of the accident the said four Participants jointly owned
the Piper Alpha platform as well as their joint interest in the licence and oil
concession. Their respective shares in the Piper Alpha operations were as
8
follows: OPCAL’s share was 36.5%, Texaco’s share was 23.5%, Union Texas
Petroleum’s share was 20%, and Thomson’s share was 20%. In effect in
operating the platform OPCAL were acting as agents for the other three
Participants as well as looking after their own interest in the operations. In
terms of the JOAV they had authority on behalf of the Participants to enter into
such contracts as were necessary for the operations. Provision was made for
the way in which the operations were to be supervised. Each participant had a
right to its participation percentage of the petroleum recovered and the costs
and expenses of the operations were to be borne by the participants on the basis
of these percentages. The liabilities of the Participants were declared by the
JOAV to be several and not joint. It was further declared that there was no
intention to create a partnership. English law was to apply to the Agreement
and there was an agreement to submit to the English Courts. In relation to the
Piper Alpha platform the Operators had authority to enter into the relevant
contracts on behalf of all the Participants but a requisite of approval was
reserved for contracts of value over £5 million. There was a lack of precision
in the evidence as to when the relevant platforms came on stream and began
producing but Piper Alpha was certainly in production by the end of 1976 and
Claymore by the end of 1977.
OPCAL pursues each of the actions on its own behalf and on behalf of the
other Participants. They do this in terms of a contract entered into between the
Participants in l987 which is governed by the law of Scotland and which
provides that OPCAL as Operators should pursue all claims under the relevant
indemnities on behalf of all the Participants. The respective claim of each
Participant to any indemnity monies recovered is to be determined by their said
participation percentage. The defenders are each contractors who at the time of
9
the accident were employing a particular victim in respect of which a claim
under the indemnities is made.
1.3
The Operations
By July 1988 when the accident happened OPCAL had developed
important interests in the North Sea. They had discovered two major Oilfields,
built the platforms needed to support them (Piper Alpha and Claymore), and
constructed the necessary pipelines to the shore. OPCAL had a terminal in the
Orkney Islands namely the Flotta Terminal. They had extensive related offices
at Aberdeen, a warehouse facility at Peterhead and a helicopter facility at
Aberdeen Airport. When I come to consider the Contracts entered into with the
Contractors, it will be seen that there are references to “Operations envisaged
herein” and the significance of the operations which I have just described
derives from the defenders’ submissions that these are the backbone of the
operations which OPCAL were conducting at the time when they entered into
these contracts. These operations are to be distinguished from the contractual
responsibilities of the contractors which are described as the “Work” and are
detailed in the contracts as the “workscope”. It is interesting to note that
Mr Joseph Snape occupied a function until shortly before the accident which
could generally be described as Managing Director of OPCAL (although it was
designated by a variety of descriptions) and when he gave his evidence he did
not list the sale of oil as being part of OPCAL’s North Sea operations. This
may be significant when I come to consider the question of Texas jurisdiction.
The outline of the management structure on Piper Alpha is set out in number
13/62 of process. In this production the references to “operations” have a more
generalised meaning and refer to the production processes on the Piper Alpha
10
platform. In effect the personnel who are described as production personnel
operate the process and ensure that the oil and gas flow. Thus a person in the
Divers section would not be considered as being part of the operations team.
On the other hand the defenders contend, and I think that they are right, that on
the platform everyone working there is ultimately responsible to an OPCAL
supervisor. The Offshore Installation Manager (OIM) is the person in overall
control of the platform. In respect of the Maintenance of equipment the
hierarchy is the Superintendent, Deputy Maintenance Superintendent, and Lead
Maintenance Hand. The technicians below the Lead Maintenance Hand are the
Maintenance Technicians and other relevant personnel such as electricians. For
Safety there is a Safety Supervisor, a Lead Safety Officer (vacant when the
accident occurred), OPCAL’s safety operators and the Contractor’s Safety
Operators. The most significant personnel are of course the Production
personnel for apart from safety they would take over if anything went wrong.
Moreover they were OPCAL’s own employees. Under the OIM there was an
Operations Superintendent, a Deputy Operations Superintendent, Lead
Production Operators, and the actual Operators. Of course there were also
many employees of the various contractors on the platform but subject to the
overall supervision of the permanent production staff. In fact there was no
dispute that OPCAL’s management and staff structures affecting Piper Alpha
were as set out in numbers 13/62 and 12/ 209 of process. As Mr Snape
observed “This was our business, we take the oil out and export it”. Ancillary
services were generally provided by contractors brought on to the platform.
With regard to the management structure it can be seen that OPCAL had a
Chairman and Chief Executive Officer. At the time of the accident this post
was held by Mr Brading. He was based in London and had wider
11
responsibilities than just OPCAL’s North Sea Operations. He was not a full
time executive officer of OPCAL and the most senior full time executive
manager until very shortly before the accident was Mr Snape. In fact he had
been replaced by a Mr Schultz just before the accident. He had been, before
being transferred to another post in the Occidental Group about 1 July 1988, the
person in charge of the production of oil and exploration. In that regard he also
had the ultimate responsibility for health and safety. In the management
structure certain posts are identified as “senior management” and others as “line
management”. The company’s safety procedures were set out in a document
described as the General Safety Procedures Manual (number 12/405 of
process). There was some discussion in the evidence as to the provenance of
this Manual but I think it was accepted that insofar as the accident goes it was a
safety manual regulating the relevant procedures at the time of the accident.
This manual provides under the heading “Safety Meetings” that meetings of
Senior Management shall be held at least quarterly to discuss matters relating to
safety performance. The President and Managing Director (the post occupied
by Mr Snape) was to chair these meetings. The concept of “senior
management” appeared to have been relatively fluid but for the purposes of the
said meeting it certainly extended to cover Mr Gordon, the Loss Prevention
Manager. It would seem that the OIM did not generally attend these meetings.
It was policy to keep safety distinct from operations. The Manual also provides
that each line manager is responsible for identifying the statutory health and
safety requirements relevant to his operations and to ensure that activities under
his control are conducted in accordance with these requirements. Included in
the line managers’ responsibilities are control and direction over all operations
within their jurisdiction, to ensure adequate measures for the safety of all
12
personnel including those of Occidental, contractors and visitors, and the
reliability of operations. In terms of the Manual another responsibility of line
management was declared to be “Developing and maintaining adequate
procedures for the safe control of operations, and monitoring their effectiveness
in preventing injury and loss”. A booklet on safety was allegedly issued to
those coming onto the platform but just how effective it was in content is
difficult to say.
Mr Snape’s evidence was that line management would start with him. It
would run through the Vice President of Operations and insofar as relating to
production operations , down to the Production and Pipeline Manager and then
the Production and Pipelines Superintendent. From there the line would
descend to the OIM and then down their chain of management. Apart from
Production the line would go to the Drilling Manager for Drilling and to the
Marine Operations Manager for Diving operations, just to give two examples as
to how line management might diverge. The Flotta terminal had its own
manager. In Production, line management stops before the production
operators. The same would apply to the Maintenance technicians. These
groups had nobody to manage. The witnesses Todd and Sneddon (who were
Maintenance Superintendent and Operations Superintendent respectively)
indicated in evidence that they had never been instructed to monitor the permit
to work system that was the safety control procedure. This may or may not be
accurate because each of these men would presumably not be anxious to adopt
a position where there might be an attempt to saddle them with responsibility
for any deficiencies in the permit to work procedures. In any event clearly they
each had responsibilities for the permits to work and the reference to
monitoring is simply a requirement to take reasonable steps to check the
13
system from time to time and see that it is working properly. It would be
surprising if persons at their levels did not know that this would be part of their
responsibility. It was of course claimed by the defenders that there was a
flagrant and continuing failure to monitor the permit to work system and I shall
deal with this later.
There was no doubt that OPCAL were in control of the platform and its
operations and thus were deemed to be the owners of the platform under the
Mineral Workings (Offshore Installations) Act 1971. Moreover the
management and control which OPCAL had of the platform was direct.
Ownership of the platform in the statutory sense is different from ownership of
a concession to work the oil as the participants had. Indeed OPCAL were also
concession owners. OPCAL as the deemed owner of the platform and also as
the actual Operators had statutory obligations for safety. This is a heavy
responsibility for it is plain beyond doubt that an Oil Platform is a dangerous
place unless careful and proper safety precautions are taken. The platform
holds contained under pressure large quantities of gas and liquid hydrocarbon
material which is explosive, very flammable and most dangerous if control of it
is lost. Mr Snape described the operations as being “potentially hazardous”.
This was well recognised before the accident. The said Act provides that the
platform shall be under the charge of an Offshore Installation Manager
appointed by the owner. He had the overall right to regulate the platform just
as a Master controls his ship. He has statutory authority over persons on the
platform in connection with matters connected with safety, health, or welfare.
Under section 5(4) of the said Act it is an offence not to obey the lawful
command of an OIM. He also has the duty not to permit the installation to be
14
used in any manner which would endanger the installation and the owner of the
installation has a duty to ensure that he complies with this obligation.
The Offshore Installations (Operational Safety, Health and Welfare)
Regulations 1976 were enacted in terms of the Act. Under Regulation 32(1) the
owner, the concession owner, and the OIM have duties to ensure that the
provisions of the regulations are complied with. Regulation 32(2) lays duties
on employers and employees in relation to work on or near an offshore
installation to ensure that the employee complies with the Regulations insofar
as they impose a duty on him or expressly prohibit a specified act. In the case
of a contractor he, of course, under this scheme only incurs liability for the
activities of his own employee. The Operators on the other hand have a
comprehensive duty to see that the regulations are observed. The contractors, it
should be noted, are obliged to insure in respect of their own interest.
Regulation 32(3)(a) provides that it shall be the duty of every person on or near
an offshore installation not to do anything likely to endanger the safety or
health of himself or other persons or to render any equipment unsafe. The
defenders made a point, extremely important to their case, to the effect that the
pursuers have no possibility of invoking that regulation unless the cause of the
accident is established. Regulation 5 imposes a duty of general maintenance of
equipment on the operator. If a flange had not been fitted properly there could
be a breach of this regulation. The defenders submitted that, if the only source
of the pursuers’ liability was a res ipsa loquitur situation, that would not
establish a breach of the Regulations. I think this is probably right.
Regulation 30 provides that the OIM shall appoint a sufficient number of
competent persons to be responsible for the control and safety of certain
specified matters which are essentially matters likely to create dangers.
15
Regulation 3 provides specifically for work permits. Essentially the provision
requires that persons doing certain work shall require written permission from a
person responsible for the work. In the Operators’ permit to work system it is
clear that the designated authority (who issues the permit) is the person
authorised to grant permits. As we shall see, the designated authority was the
Lead Production Operator. Regulation 30(2) provides checks to ensure that
those carrying out certain work are themselves competent or closely supervised.
Thus the OIM has the ultimate responsibility for safety on the platform and he
exercises his function by delegating to competent persons.
In practice the platform was under the direct control of the OIM. There
was only one OIM on the platform at a time so that, if for any reason he was
not available, his responsibilities would devolve upon the Operations
Superintendent. The Operations Superintendent reports to the OIM and is
responsible for the safe production of oil and gas on the platform. This of
course involved the responsibility of seeing that personnel were doing their jobs
safely and properly. However the persons who had immediate and direct
responsibility for supervising the production process were the Lead Production
Operators. The Lead Production Operator in charge of production on the night
of the accident was Robert Vernon and although he had recourse to senior
managers if required he had to make the immediate decisions about the
production process. Thus although he had immediate control when he was on
duty he was just one in the ranks of line management. The defenders attempted
to make much of Mr Vernon’s responsibilities and contended that Mr Vernon
was the person who effectively represented the company in respect of the
running of the process at the time of the accident. He certainly was the person
“with hands on the job” at the time. As Mr Snape said, “the supervisor and the
16
designated authority is the one in overall control of what is going on in the
operation”. The Lead Production Operator could in an emergency shut down
the plant and indeed even the Control Room Operator had an Emergency Shut
Down button that he could use if necessary. Indeed after the explosion, the
Control Room Operator, Mr Bollands, pressed this shut down button. However
the shutting down of process was expensive and involved various subsequent
problems so that it would not be done lightly.
In the light of the foregoing Mr Snape maintained that it was essentially
the operations staff who caused the platform to function and everyone else was
really there for support. Mr Snape also said that a function of the Permit to
Work procedures was to ensure that a designated authority coming on duty was
made aware of what had been happening on the previous shift. In respect of the
specialist contractors the designated authority would still have the
responsibility in a general sense for monitoring and supervising them and
keeping them informed of the workload. The OPCAL safety personnel also
monitor the contractors’ activities.
17
1.4
Control of Contractors
OPCAL engaged contractors upon contractual terms that obliged the
contractors’ employees to comply with the requirements of the OPCAL
Operations Manual. The contractors’ employees were also bound to observe
the requirements of OPCAL’s General Safety Procedures Manual and of
course, as we have seen, this incorporated the procedures for the Permit to
Work system. OPCAL retained the right to stipulate not only which work was
to be performed by the contractors’ employees but also how such work was to
be performed. The Operators retain an ultimate control over the personnel the
contractors may use and they could remove such personnel. The details of the
work to be performed were set out in Schedules attached to the contracts.
Indeed the work was most closely specified. The times to be worked by
contractor’s personnel are specified as are provisions for overtime. The
contracts provide that the work of the contractors shall be subject to inspection
and approval by the Operators. The contractors are to provide competent and
skilled personnel. The form of the Contract in the case against BT was
somewhat distinctive but the contracts in the other cases illustrate the points I
have been making. The point that the defenders were at pains to emphasise was
that in the contracts there was a clear distinction between the Operator’s
operations and the carefully defined workscopes which delineate the work the
contractor has to perform. Although the Score contract is not one of these in
the seven indemnity cases dealt with in the proof it is obviously a significant
contract since it sets out the obligations Score had undertaken in respect of
valve maintenance. Score of course were specialist contractors. The Contract
was produced and is Number 12/366 of process. In paragraph 3 of page 3 of 9
in the first section of the contract there is a heading “Scope of Work”. It is
18
there declared that the work involves inspection, refurbishment, testing and recertification at any part of the OPCAL operations which are both onshore and
offshore. There is therefore a specific distinction made in the contract between
“operations” and “work”. The contract also provided that Score’s labour force
and valve crew shall be responsible to OPCAL’s Maintenance Superintendent
on-board Piper. It has to be noted that until the day before the accident the
Maintenance Superintendent had been Mr Todd. He was due to be replaced by
Mr Barry Clark but it seems that for some unknown reason Mr Clark did not
arrive on the platform. On the other hand the Maintenance Superintendent had
a deputy. OPCAL had once again reserved for themselves the right to
supervise and control the work. They specified that the contractors’ employees
attained a reasonable standard of competence and reserved the right to have
anyone who was not competent removed. The scheme is clearly that the
contractors are responsible for the proper carrying out of the work but their
work is subject to overall control and inspection by OPCAL.
It has to be noticed that, given the considerable standards expected by the
Contract in respect of their work, there seems no doubt that in general Score
worked to a reasonable standard. They had been on the platform for valve
maintenance work during March, June, and July 1988. Their work during that
time was wholly acceptable to OPCAL’s Maintenance Superintendent,
Mr Todd. During the periods in question Mr Rankin and Mr Sutton had been
on the platform for Score acting as valve fitters.
As well as a Safety Manual OPCAL had an Operations Manual (number
12/3 of process) and this had been revised as at February 1986. The purpose of
this manual was to provide guidance for operators in the field in respect of the
equipment and its operation. The Engineering Department also used it as a
19
reference document. It was divided into 9 sections namely Platform
Construction, Platform Loads, System Description, Procedures, Drilling,
Diving, Safety Equipment, Communications and Miscellaneous. The document
contains much detailed information about fire and gas detection and also hazard
classification. Obviously practice and procedures developed because I heard
evidence of approved practices that were not in strict accordance with the
Manual.
The General Safety Procedures Manual had been introduced in October
1987 (number 12/405 of process) to supersede a 1982 Manual. It dealt with the
institution, monitoring and control of safety policy for offshore operations as
well as details for personnel safety, safe operational procedures, control of
maintenance procedures and the control and use of hazardous substances.
There was also a statement of OPCAL’s Health and Safety policy. Some
aspects of the 1982 Manual continued in force, such as the arrangements for
safety auditing which were not repeated in 1987. As has been noted already
this Manual deals among many other matters with the Permit to Work
procedures. The Manual confirms that OPCAL at least aspired to maintain a
tight control over anything that happened on the platform that might affect
safety.
20
1.5. Summary
The defenders asked me to make findings in terms of a summary they
gave me and, given that the matters that concerned them seem perfectly clear, it
may be helpful to summarise certain of the findings that I can make in respect
of this chapter. First, the Piper Alpha platform was placed in the North Sea in
order to take hydrocarbon mixture from beneath the sea-bed, process it and
export it. Second, the operations performed on the platform were inherently
dangerous and hazardous. Third, the Piper Alpha platform was at all material
times operated by OPCAL. Fourth, OPCAL were the deemed owners of the
platform in terms of the Mineral Workings (Offshore Installations) Act 1971.
Fifth, OPCAL in their capacity as Operators, had the management and control
of the platform. Sixth, the core process of making oil and gas flow was
performed by OPCAL’s Operations Group. Seventh, while the Operations
Group were the ones operating the platform others were required for the
support functions. OPCAL relied mostly on the employees of contractors for
these support functions. Eighth, OPCAL engaged contractors upon a basis that
entitled OPCAL to stipulate not only what jobs were to be performed by the
contractor but how such jobs were to be performed. Ninth, OPCAL engaged
such contractors upon a basis that entitled OPCAL to impose such supervision
and guidance of a contractor’s work as it saw fit to furnish. Tenth, OPCAL had
direct management supervision of all work performed on the platform whether
performed by their own employees or contractor’s employees. Eleventh, all
personnel on the platform, whether OPCAL’s employees or contractors’
employees, were bound to perform work in accordance with the OPCAL
Operations Manual under the OPCAL General Safety Procedures Manual.
Twelfth, all personnel on the platform, whether OPCAL’s employees or
21
contractor’s employees were bound to perform all their work on the platform
under regulation by OPCAL’s Permit to Work system which gave OPCAL
control of any task which they regarded as other than routine and nonhazardous. I do not regard any of these findings as difficult to make.
1.6. The Cullen Inquiry
As is generally well known, shortly after the Piper Alpha disaster a Public
Inquiry was held by the Honourable Lord Cullen. This began at Aberdeen on
19 January 1989 and the evidence at the inquiry lasted 125 days. Some of the
contractors who are defenders in the present seven test actions were represented
at the inquiry for their interests. I was told in evidence by Mr George Smith
that the inquiry was in two parts and that in part one the circumstances
surrounding the accident were investigated whereas part two was concerned
with recommendations as to possible future safety measures. From time to time
during the Proof before me the evidence of a witness was tested by his being
asked if he has told the same story in evidence at the Inquiry. However I was
not shown the final Report nor told of its conclusions. Thus except in a very
general sense I am not aware of Lord Cullen’s conclusions. Nor am I aware of
the basis of his analysis of the incident. Except for a few matters of detail I do
not know the evidence which was before the Cullen inquiry but clearly the
present proof was differently focused and more extensive in scope. Certainly
there were witnesses in this case who did not appear at the Cullen Inquiry and
others who had reviewed their positions since the Inquiry. The findings of Lord
Cullen’s inquiry did not enter into my own consideration of the circumstances
of the accident and I am not aware of the extent by which my own findings may
coincide with or differ from Lord Cullen’s views. I mention this because the
22
findings of the Cullen Inquiry aroused much interest when they were first
published so that it may be important to emphasise that this Opinion is not in
any sense a review of these findings.
CHAPTER TWO - THE PLATFORM
2.1. General
The structure of the Piper Alpha platform was relatively complex.
Detailed evidence of it was given by the pursuers’ witness, Mr Konrad Wottge,
(whose evidence lasted 18 days) and apart from certain limited areas his
evidence was unchallenged. At the time of giving his evidence Mr Wottge was
Vice-President operations for Occidental Columbia which job involved
responsibility for the production operations of that company in Columbia. He
had been transferred to Columbia from Aberdeen in 1991 until which time he
had been in the employment of Occidental International & Production Company
as a facility engineer. Much of his work was connected with the operations of
OPCAL. He held a B.Sc. in civil engineering and also had other professional
qualifications in engineering. He had spent all his working life as an engineer in
the oil industry (working on - and offshore in a variety of countries) and I was
impressed by the high level of his practical knowledge of his area of expertise.
He came to work in the North Sea in 1976 and was assigned to work with
OPCAL. His position eventually was that of Facilities Engineering Manager
and that was the position he enjoyed at the time of the accident in 1988. His
responsibilities included all plant and pipelines downstream of the wellhead. It
included the overall structure of the platforms and the network of pipelines. He
was also responsible for the Flotta Terminal facility. Originally he had visited
the Piper Alpha platform frequently, sometimes spending weeks aboard, but as
23
his responsibilities developed he would visit the platform about once every two
months. Initially the plant on Piper Alpha had experienced certain operational
problems and Mr Wottge had been involved in sorting these out. He had
prepared a Report and Glossary (number 12/1 of process) which he spoke to in
his evidence. He also illustrated his evidence with a number of detailed
drawings and schematics. The schematics were prepared under Mr Wottge’s
direction. He claimed that his Report represented a general description of the
design and operation of the Piper platform and associated pipelines and I think
this contention was on the whole well justified. He also spoke to the Piper
Alpha Operations Manual (number 12/3 of process ). This was issued to
persons who had been working on the platform to give them operational
instructions how to operate the individual items of equipment including data on
the relevant structures of the platform. His evidence was also illustrated by two
models which were in court, by photographs of the original model and by
photographs of the platform (12/8 of process). Mr Wottge spoke to the general
accuracy of the models (although they could show nothing like all the detail on
the platform) and they were used to give a picture of the general features of
areas of the platform for experiments carried out by the pursuers’ experts. The
original model had been built for various practical purposes like training
operators but, once the platform was running, it was donated to Aberdeen
University. After the disaster it was retrieved and formed the basis of the
models in court (12/6 and 12/7 of process) although these did not contain as
much fine detail as the original. The scale of the model is 1 to 33. A further
model in court of the whole platform (12/5 of process) is 1 to 100 scale.
Photographs numbers 69/1 and 69/2 of process also show certain details of the
original model and were relied upon by Mr Wottge but have to be regarded with
24
a degree of care since they became inaccurate in certain minor respects as the
modules were developed. However they show that there was much more
pipework in the Modules than the reconstructed models show. In fact I found
the models in court were useful for illustrative purposes in relation to evidence
being given but not much else. However Dr Davies used the models for his
experiments but in any event I think his results were intended to be no more
than approximate. Certainly at best that is how I would have regarded them.
The photographs 69/1 and 69/2 were not in court when Mr Wottge gave his
evidence (and the remaining photographs of the original model were never
produced). Therefore he could not be examined about them but I do not think
this could bear on the outcome of the proof. It should also be noted that the
defenders did not seek to recover documents relating to the structure of the
platform or models from the pursuers. Since photographs of the platform
(number 12/8 of process) were taken at different dates they too have to be
regarded with some care. At best the problems about models and photographs
concern matters of detail since witnesses who had been working on the platform
at the time of the accident seemed happy to accept them as being representative
of what they were describing. Occasionally when a witness thought that matters
had changed since a photograph he said so.
In his evidence Mr Wottge relied on a number technical drawings and
reports. A point was made that he was not always asked to identify the sources
of particular passages in his report. It is possible that he had relied upon
documents not lodged in the proof. This was said to cast a degree of shadow
over his reliability. However considering that the platform was an immensely
complicated structure and that Mr Wottge was in the witness box for many
weeks I do not think the pursuers could have expected him to consider every
25
detail in the report comprehensively. The defenders had ample opportunity to
challenge him about any detail that concerned them. He was very familiar with
the general structure of the platform and had obviously compiled his Report
with care. A substantial number of documents of a technical nature were lodged
in process. The defenders say that a drawing only has evidential value if it
reflects accurately the position on the platform at the time of the accident. That
statement is probably unexceptional. The defenders contended that insofar as
some of these documents were copies they could have been authenticated under
Section 6 of the Civil Evidence (Scotland) Act 1988. This was not done.
However I am happy to accept that in compiling his Report Mr Wottge relied
wholly or largely on technical Documents which formed part of the Company’s
general records. If the defenders thought that he may not have done so they
were of course free to examine him in detail about this. In any event most of
these technical documents only had illustrative significance.
The defenders made the point that some of the documents produced do not
accurately represent the position on the platform. Equipment can be built and
then modified rendering original drawings inaccurate. However such
inaccuracies on the whole relate to points of detail. Thus production 12/83
purports to be a representation of the B/C firewall. On this there is a
representation of a sliding door and in fact there was a hinged door on the actual
wall. In some of the drawings relating to fire detectors the location of these had
been in error as to the heights of the detectors since on many occasions their
position had been adjusted. The defenders pointed out that drawings marked
“as built” had more authority than others because they represented the final
drawing of the structure after it had been built. It was suggested that very few
of the documents produced were marked “as built”. For example in relation to
26
the B/C firewall all that was produced was a design drawing, which may have
been modified during construction, and not an “as built” drawing. Mr Wottge
accepted that even the “as built” documents were not all wholly accurate. The
ongoing process of modification, addition, and removal which continued to the
date of the accident was not always reflected on the Drawings produced.
However Mr Wottge indicated that what he described as “key drawings” were
generally kept up-to-date. Drawings were from time to time reviewed for the
purposes of structural certification which occurred every five years. It should
perhaps be noted that Mr Wottge indicated that he was not aware of any
significant changes in the flooring of the Modules having occurred although
there was localised strengthening. Nor was he aware of the ceilings being
altered. Some of the drawings produced were made after the accident on
Mr Wottge’s instructions. The pursuers had a difficult task in respect of
proving the detail of the structures on the platform. The platform itself was not
available for checking. Some of the records had gone to the bottom of the sea.
This the defenders argued just emphasises the uncertainty hanging over the
pursuers’ attempt to prove the cause of this terrible accident. What they
presented seemed to me on the whole to be the best available evidence of the
platform’s structure. Insofar as details may have been doubtful the witnesses
speaking to the matters in question were largely able to point these out if they
were significant. It should be noted that Mr Wottge claimed that many of the
documents produced were used by him as the basis of his work. For example
through his work he was very familiar with Module C but if he required detail
such as measurements he would often take these from the available documents.
I considered that I was provided with reasonably satisfactory material as to
the structure of the platform, subject of course to consideration of particular
27
points which the defenders asked me to consider especially and claimed to be
significant.
In general I found Mr Wottge to be a very informative witness whose
views were worthy of respect. He had a sound personal recollection of the basic
structure of the platform and personal knowledge of many of the details.
However for some details he had to avail himself of the recorded material
available to him after the accident. He had some experience of the production
processes but his experience was less extensive than in regard to structural
matters. His knowledge of alarms, process controls and trips was also limited.
I was provided with an extensive book of Schematics. I accept that these
are only of evidential interest insofar as they are spoken to by witnesses familiar
with their contents. They were really lodged to help illustrate the technical
evidence. They of course are not to scale and on occasions witnesses pointed
out inaccuracies.
28
2.2. History of the Platform and related Oilfields
The Piper Field was discovered in 1972 or early 1973 and following
thereon the platform was designed and built. The oilfield operated under
Licence Block 15/17. The constituent parts of the platform and, in particular,
the jacket, deck support frame, and modules were built onshore and later
shipped to location on the field. Over the years the platform was changed and
modified. By the end of 1980 a Gas Conservation Module had been installed
and was in operation. The field was highly productive. Initially the field
produced 250,000 barrels of oil per day and that increased to 300,000 barrels
during the early years of production. However by July 1988 the production had
declined to about 125,000 barrels per day. To accommodate the production
from the field Occidental built a pipeline to Flotta on Orkney and installed a
process plant there.
The Claymore field was discovered approximately one year after the Piper
Field and operated under Licence Block 14/19. The Claymore platform was
developed and the field came onstream about November 1977. Oil produced by
this field was also exported to the Flotta facility by means of a short pipeline
which linked into the pipeline from Piper Alpha to the Flotta Terminal.
The discovery of the Tartan Field post-dated the discovery of the
Claymore field. A platform was built which was owned and operated by
Texaco North Sea Limited and this came onstream about 1979.
Two years after the Piper Field the Frigg gas field was discovered. Gas
produced from this field was exported to the shore through a pipeline and a
booster platform known as the Manifold Compression Platform number 1
(otherwise known as MCPO 1). MCPO 1 was operated by Total Oil Marine.
29
The gas produced by both the Piper and the Tartan platforms was also exported
ashore by way of MCPO 1.
Subsequently to the discovery of the Claymore field a small field known
as the Scapa field was discovered about 7 miles from Claymore. This was
exploited by means of a sub-sea production facility. This facility was controlled
from the Claymore platform and the oil production from the Scapa field was
piped via the Claymore platform to the main oil line and subsequently to Flotta.
2.3. The Platform Location
The Piper oilfield is situated about 120 miles north-east of Aberdeen. It
has an oil reservoir situated about 8,000 feet below the sea level and the water
depth at the location is 474 feet. The reservoir covers an area of approximately
12 square miles. The natural pressure of the reservoir is about 3,400 lbs per
square inch absolute (psia). The design criterion for production was for a total
of 36 wells.
The platform was orientated 43 degrees counter-clockwise from true north
so as to coincide with the direction of the most severe wave loading. The
longitudinal axis was referred to as “platform north” and other directions
referred to in the productions such as east, west, and south are with reference to
platform north.
30
2.4. General Platform Layout and Structure
The platform was anchored to the seabed by each of its four corner legs.
Around each corner leg was a skirt pile driven into the seabed. The substructure from the sea-bed to the surface of the water and up to the 20-foot level
was known as the jacket. The deck support frame was attached to the jacket and
its purpose was to provide a frame structure to support the deck and the various
deck modules that had to be installed. The top part of the deck support frame
was known as the 68-foot level (such levels referring to levels above the sea.)
The 84-foot level consisted of four modules A, B ,C and D. A, B and C
were the main production modules. Module D was the generation and utilities
module. These modules as with other structural equipment had all been
fabricated onshore.
The next main level up was the 107-foot level which housed inter alia the
Mud Module and Storage Module on the west, and the Gas Conservation
Module (also known as the GCM or Phase 2 Module) and Utilities module on
the east. The 133-foot level contained the pipe deck and the 174-foot level the
helideck. The accommodation modules were at the north end of the platform
and were at levels ranging from 121 feet to 174 feet.
There were ten jacket legs. On the east side they were numbered from
north to south as A1 through to A5. On the north side the legs were numbered
from south to north as B1 through to B5.
31
2.5. Views of the platform
2.5.1 The West
The west face of the platform is shown in the drawing 12/18 of process
and in various aspects in the photographs which are 12/8D, 12/8E, 12/ 8F,
12/8G and 12/8L of process. The western ends of Modules A, B and C were
open. In the said photographs the west crane pedestal is shown at the join of
Modules B and C. The Chanter Riser gantry is shown in the photograph 12/8L.
The west face of the Dive Package which was mainly at the 68-foot level,
substantially below Module B, is also shown in these photographs.
2.5.2 The North
The north face is shown in the drawing 12/15 of process and in the
photographs 12/8B and 12/8C of process. The said drawing shows the main oil
and gas risers which carried the oil from Piper Alpha to Flotta and other
platforms . The 30 inch diameter oil export riser is approximately at the centre
of the north face. The 16 inch diameter Claymore Gas Riser is to the west of
this and formed part of the gas pipeline linking Piper Alpha and Claymore. At
the north west corner of the platform was a Navigational Aid Platform from
which point a number of men were able to escape from the platform after the
accident. The photographs 12/8B and 12/C also show the turbine exhausts of
the John Brown Turbines. The orange cabin seen on the north face in
photograph 12/E was the Maintenance Superintendent’s office.
32
2.5.3 The East
As with the western ends, the eastern ends of Modules A, B, and C were
open on the east face. The crane pedestal on the east is again at the point where
Module B joins Module C. The photographs 12/8H and 12/8I of process show
the east face and the GCM can be seen above Modules B and C at the 107-foot
level. The utility module is adjacent to the GCM to the north. Stairways linked
the 107-foot level down past the east face of Module B and down to the 68-foot
level. On the east face and to the north was sub-Module D.
2.5.4 The South
The South face elevation of the platform is shown in the drawing which is
12/16 of process whereas the relevant photographs are 12/8C and 12/8 D. The
south face is dominated by the east and west flare booms. There is in
consequence of these a heat shield on the east, west and south sides of Module
A. The precise location of this is shown on the drawing 12/16 of process. The
flare booms were each about 165 feet in length and it was necessary to have two
to accommodate changes in wind direction. Each flare boom had two flare tips.
Low pressure material flared through the low pressure flare and gases from high
pressure sources flared through the high pressure flare. When passing relatively
high rates of gas the flare made a noise and would get bigger. Even in normal
operation there would be some variation of flare. When the process was in
Phase 1 a greater amount of gas went to flare than was the case with the Phase 2
process. There was a stairway immediately inside the heatshield to the south
side of Module A linking the 84-foot level to the 107-foot level. This stairway
was about 1 metre out from the module and there were some structural members
between it and the module. Furthermore there were Navigational Aid Platforms
33
at the east and west of the south elevation and particularly the west of these
played a part in permitting some men to escape the conflagration.
2.6. Production level layout
2.6.1 General Description
The overall layout of the production level ( the 84-foot level) is set-out in
the layout drawing 12/108 of process. Since Module A was considered to be the
most hazardous module the production modules on the platform were arranged
to provide maximum separation between Module A containing the wellheads
and Module D containing various utilities and also separation from the
Accommodation Modules. Modules A, B, C and D, were each divided by
firewalls, referred to respectively as the A/B, B/C and C/D firewalls and were
really set in sequence according to the supposed level of hazard in each.
Mr Wottge indicated that gas leaks did from time to time occur in Module C but
he said that most of these were very small. The position of any leaks that were
not small was not explored. Thus for example I do not know if any previous
leaks had given rise to an escape of gas such as could have caused a serious
explosion or indeed how and when the leaks had been noted. He gave some
examples of situations that could feasibly cause a leak and these included faulty
pump seals, valve stem leakage, gasketed joints, leaks at sampling points,
operations which breach containment, effects from corrosive fluids, and loose
connections at the pulsation dampeners. The potentiality of such leaks was not
really explored with Mr Wottge. Nor was he asked if the detection
arrangements were such that he would have expected any such leak to be
detected. He did not say that leaks had occurred that were not detected until the
gas reached dangerous levels. Mr Wottge also indicated that the frequency of
34
recorded leaks in Module C was higher than in B. Thus although Module B had
a higher hydrocarbon inventory than C in general there was less chance of it
leaking. Of course in Module C there was much more pipework and vibration.
It seems that on one occasion there was a serious oil leak on the Claymore
platform due to an unexplained failure of a pipe but what this involved and how
it was detected are facts that were not explored.
Module A was the wellhead module and that was where the wellheads
controlled the flow of hydrocarbons and water produced from the wells.
Module B was a production module where inter alia the separation of oil from
other fluids took place and where the oil was pumped into the main oil line (the
MOL) for transmission onshore. Module C was the gas compression module
where some of the gas processing took place. Module D was the generation and
utilities module and contained the Control Building, the main generators, the
switchgear and other utility systems.
The open ends of Modules A, B and C, allowed access to personnel and
also natural ventilation. The south face of Module A was also open. The east
and eastern half of the north face of Module D were also open and this can be
seen in the photograph 12/8E of process.
Each module was approximately the same dimension, namely 50 feet
(15 metres) wide, 24 feet (7.5 metres) high and 150 feet (46 metres) long. The
decks and ceilings of Module B were of three-eighths of an inch steel plate
throughout. The ceiling of Module C was likewise plated throughout and the
deck from the west side to the skids on which the centrifugal compressor stood
at the east end of the module. Between the skids in the modules, at a height of
about 18 inches above the deck floor, were walkways consisting of grating and
these were to enable personnel to walk between various pieces of equipment.
35
One witness described this as a labyrinth of gratings. There were various
estimates by witnesses of the height of grating above the deck but 18 inches to
2 feet seems to represent a fair consensus. In Module B the grating ran
throughout the module so that personnel would be walking on grating rather
than deck. In relation to Module C there was a considerable amount of grating.
The witness Mr Henderson thought that in the area of the compressors
there was also some solid plating above the deck. He observed that there was a
considerable amount of cabling underneath the grating. However on this matter
I found Mr Henderson rather imprecise and not wholly consistent. The witness
Mr Ferguson contradicted Mr Henderson and was firm in recalling that the
walkways in Module C were grating. His evidence was not challenged.
Certainly on the basis of Mr Wottge’s evidence there was grating on the outside
platform adjacent to Module C. This matter of grating could have some bearing
on the manner of response of certain detectors. There does not appear to have
been a walkway down the south side of Module C. This may be significant
because the expert Mr Cubbage bases some of his calculations on the
assumption that there was such a walkway.
The floors of Modules B and C were of steel plating and were of
substantial construction in order to hold the weight of the heavy equipment that
was placed on them. The ceilings of the modules were also made of steel and of
substantial construction to hold the weight of any equipment placed on top.
A walkway ran along the west side of the 84-foot level outside Modules
A, B, C and D and this passed around the crane pedestal. This walkway passed
outboard of the crane pedestal and whether the part of it which also passed
inboard of the pedestal was passable is not entirely clear but there seems at least
36
to have been a space. The said walkway also ran past the other faces of the
platform.
Firewalls were attached to the trusses between each module. It is
important to note that these were not designed as blast protection walls and their
function was to localise fire and to prevent it spreading to other modules. They
were constructed of light steel plates and material called Durasteel. The fire
rating for the A/B and B/C firewalls about 4 to 4.5 hours and the C/D firewall
had an extended rating of about 6 to 6.5 hours.
2.6.2 Module A
This module had 36 well slots in three rows of 12. Each well had a
wellhead which comprised a number of valves and associated pipework known
as a “christmas tree”. Associated with each christmas tree was a well safety
shutdown panel. Each of these had its own controls to shut the flow from its
well and these panels were located on the north side of the module adjacent to
the firewall. The firewall was in the north separating Module A from
Module B.
The water injection system was also located in Module A. This system
was required for the re-injection of sea water into the oil reservoir in order to
maintain pressure. The sea water pumps were located to the south of the
module and the coarse filters associated with these pumps were located in the
south east corner. The de-oxygenation towers, which were part of the system,
were located at the south end. Water was extracted from these towers using the
three water booster pumps located immediately to the west of the towers. The
booster pumps then fed the three water injection pumps and these were located
at the west end of the module.
37
At the north wall to the east of the module there was a Chemical Injection
Package. This included a tank which contained compartments of chemicals
primarily for the water injection system. The overall length of the tank was
25 feet, the width 10 feet and the height 12 feet.
The heat shield that went round the east, south and west sides of the
module was located beyond the walkways which surrounded these sides of the
module. It was designed to protect against the radiant heat of the flares and
comprised two layers of tightly woven stainless steel mesh. A person in module
A could see through the heatshield mesh.
Means of access to the module could be obtained via the east and west
face walkways. Stairways to the north side of the module allowed access to the
68-foot level. There was also a stairway going up to the skid deck and down to
the 68-foot level on the south face.
The defenders made the point that Module A was extremely congested and
so it was, but perhaps no more so than, say, Module C. The defenders make this
point to explain why a witness such as Mr Gutteridge may not have seen a
breach in the A/B firewall.
2.6.3 Module B
In this module the two main production separators were located in the
centre of the module. These were essentially identical and were large
cylindrical vessels measuring approximately 11 feet in diameter by 44 feet in
length. Their function was to separate the oil, gas and water extracted from the
reservoir. They were fitted with internal baffle plates which deflected the fluid
and assisted with the separation process. The fluid separated into three flows by
means of gravity separation. These vessels had no moving parts. The water
38
being heavier than the oil settled in the bottom. The oil floated to the top of the
liquid level where it flowed over internal weirs and was pumped out of the end
of the vessel. The gas being the lightest came out of the top of the vessel. The
residence time of the oil within the separator was 2.5 to 3 minutes. The liquid
level in the separator was slightly below the centre line of the vessel and gas
occupied about 60% of the vessel volume.
Immediately to the west of the separators were the three MOL booster
pumps. There was one booster pump for each separator, the third serving as a
spare. The discharge line from each pump was routed to one of the three
metering runs. Each such run consisted of a fiscal turbine meter and associated
pipework. The meters themselves were located towards the north of the module
approximately 10 feet from the firewall. The metering skid occupied a little
more than 50% of the width of the module.
The four MOL pumps were at the west end of the module and indeed
could be seen at the west face from outside the module, as is demonstrated by
photograph 12/8G of process. Moving from north to south, these pumps were
designated B, A, C and D (the order being due to their historical development).
The configuration of these pumps is shown in the schematic 12/97 of process.
The MOL itself had a diameter of 30 inches and was located between the MOL
pumps and the metering skid. It penetrated the floor of the module as it made
its way downwards and thereafter dropped vertically at a point just below the
68-foot level. It then turned through 90 degrees and was routed in a northerly
direction, going slightly to the east beneath the 68-foot level, to the north face
of the platform. From there it turned through another 90 degrees angle before
descending to the sea-bed. On the MOL, at a point before it penetrated the floor
in Module B, was the emergency shut down valve designated ESV-208. This
39
was a large valve (weighing up to 3 tonnes) and, although described in the
Operations Manual as working manually, it in fact at the time of the accident
was set to be closed by an electric motor backed by a pneumatic device. The
piping was about 20 inches in diameter and the valve was approximately 36 to
40 inches long and about 36 inches in diameter. The valve was approximately 8
to 10 feet above the floor. It was designed to close in the event of an
emergency. It was suggested by the fire engineer Dr Drysdale that this valve
may have been damaged by the explosion, causing it to fail to close after the
accident. The valve because of its special significance was subject to regular
checks.
Situated above ESV-208 was the tie-in point for the four inch diameter
condensate line. This pipeline came from the condensate injection pumps at the
68-foot level up to Module C and then passed through the B/C firewall to the
east of the door in that firewall. Once in Module B it then turned west and ran
parallel with the B/C firewall for about 17.5 feet or so. It then turned through
90 degrees and ran south for about 15 feet 10 inches before tying in with the
MOL. It was supported on hangers. Mr Wottge was not entirely familiar with
the layout of the condensate line. He took his detail on this from a Schematic
but as I have indicated it was not proved that these were to scale and indeed it
was clear that many were not.
The door on the B/C firewall was about 30 to 40 feet from the western end
of Module B. It had been supplied by Durasteel Limited. It had a self-closing
mechanism. However there was evidence that during the day shift on 6 July
1988 this door had been partly open to accommodate some work intended for
the west end of the Module. One would expect that if the work did not extend
into the nightshift then the cables would have been dealt with when the permit
40
was suspended. There was no evidence to suggest that work at the West end of
Module B was continuing at the accident. The defenders claimed that no tests
had been carried out to determine the quantity of gas that would have had to be
released from the door to trigger an alarm at the detector in the C3 zone.
The pig launcher (apparatus used in connection with cleaning-out the
MOL) was designated 1-P-103 and was positioned between the MOL pumps
and the metering skid along the same axis as the MOL. Its position can be seen
by reference to photograph 12/4A or the video 41/21 of process. There was a
stairway over the pig launcher which gave access to the main walkway which
ran down the southern side of the separators.
The test separator (designated 1-C-109) was to the east of the production
separators about midway between the north and south sides of Module B. The
vessel had an outside diameter of 7 feet and it was about 20 feet long. To the
north of this separator was the condensate knock-out drum (designated 1-C-104)
and associated with this, and directly to the west, were two condensate transfer
pumps. They were in-line pumps sitting within the pipework. Just to the north
of the condensate knock-out drum and near the floor were two pressure control
valves , namely PCV 51/1 and 2. These were designed to relieve gas pressure
to flare and if necessary this would have happened if a centrifugal compressor
failed. However during normal Phase 1 operation no gas passed through these
valves. The gas that got to flare at or about the time the compressors failed
suggests to me that these pressure valves were functioning properly.
Along the east face of Module B there was a bank of four gas coolers.
These were substantial pieces of equipment as can be seen from Photograph
12/4A of process. Between the production separators and the condensate
knock-out drum at the east end of Module B were two fuel gas filter separators,
41
one on top of the other. These were horizontal cylindrical vessels and were
about 2.5 feet in diameter and 7.5 feet long. Within these vessels were filters
through which gas would flow.
To the south of the production separators and along the A/B firewall were
the inlet manifolds. There were about 27 flowlines connecting the wellheads in
Module A with the main inlet manifold. Each flowline fed into one of the three
main manifolds. The manifolds were connected to the production separators
and also to the test separator. The total length of the manifolds was about
100 feet running west to east. The main emergency shutdown valves for the
manifolds were located in the east end of the manifolds and adjacent to the A/B
firewall.
On the floor of the module various items of equipment such as the MOL
pumps, the metering runs, and the separators were located on skids. These
consisted of beams of substantial construction used to support the equipment
placed on them. Each skid formed a bounded area and each such area had a
drain which allowed material collected there to be routed to the sump pile which
was located at the south east corner of the platform at leg A1 at the 68-foot
level. Generally above the skids and about 18 inches to 2 feet above the deck
plating there had been placed grating to allow access for personnel to the
module and equipment.
Pipes led out of the module and, to allow this, there were a series of pipe
penetrations. Generally these were fitted with collars and were not necessarily
sealed. Gaps ranging from quarter of an inch to about three quarters of an inch
existed between pipes and collars. Such an unsealed gap existed where the
MOL penetrated the floor of the 84-foot level. If escaped oil had collected on
the floor of the module at the west end then it could have flowed through the
42
grating and drains to the sump or, if for any reason the sump could not
accommodate the quantity of the escape, it could have flowed through the gap at
the MOL penetration. The witness Mr Amaira had been at the 68-foot level
shortly before the accident and in the vicinity of the MOL but he had not
noticed any oil flow. On the other hand the collars round the pipe penetrations
had a lip about one and a half to two inches high so that water or oil would not
escape through the pipe orifice unless it was deep enough to flow into it. The
defenders suggested that it was only in relation to the MOLs that the evidence
showed gaps at the pipe orifices. Certainly it is difficult to tell from the
evidence if it was only the MOL penetrations which had collars or all
penetrations, although at one point in his evidence Mr Wottge seemed to
suggest that the use of collaring for pipe penetrations was fairly general. I think
if a pipe penetration did not have a collar it would be sealed.
The defenders made the point that the north-west corner of this module
was a great deal more cluttered than would appear from the model of it in court
and this is probably correct.
2.6.4 Module C
Although Module C was open at each end the opening at the east end was
restricted by the centrifugal compressors. There were three of these and they
were designated A, B and C running from north to south. Each centrifugal
compressor consisted of a compressing machine driven by a gas turbine. The
gas turbine had its own air filtration unit. The air filter and part of the gas
turbine of each compressor protruded from the eastern end of Module C. The
gas turbines required a supply of combustion air. The air filters were used to
draw in such air and filter it. Each compressor was located within an enclosure
43
divided into two compartments, one having the gas turbine machine and the
other having the compressing machine. The enclosure was approximately
10 feet high, 8 to 10 feet in width and 30 feet in length. Each machine had its
own exhaust which was on the east face of Module C and extended upwards
above the 107-foot level. The ventilation intakes for the compartments again
was located on the eastern face of Module C. Each compartment exhausted air
into Module C through louvres. In the Operating Manual the suction pressure
of these compressors was shown as 190 psig whereas in practice they operated
at 140 or 150 psig. The system required about 27,000 standard cubic feet per
minute of combustion air and about 8,000 of ventilation air. The combustion air
was drawn into each compressor from the outside and was drawn into the
machine through the grating outside the end of the skid. About 75% of this air
would come from below and, depending on ambient conditions, some might
come from the east or from within Module C. The ventilation air was drawn in
outside the east face of Module C towards the south side of compressor. A
centrifugal detector would not trip the compressor if it only detected enough
gas for a low alarm but would trip if the gas level reached the level required
for a high alarm. The ventilation air is not just for personnel entering the
compressor compartment. It is cooling air as well. As I have indicated, it
escapes from the compartment through a louvre. There was a louvre for each
compartment. The first alarm that went off was associated with the southmost
compressor. Ventilation air would be continue to be drawn in for about two
hours after a compressor had tripped.
To the west of the centrifugal compressors was an equipment package
known as the centrifugal compressor skid. This comprised equipment auxiliary
to the operation of the compressors and, in particular, suction and discharge
44
scrubbers and discharge coolers for each of the compressors. A scrubber is
equipment which alters the velocity of gas flow by altering direction and flow
area for the gas stream. The alteration is accomplished by baffles within the
scrubber. The equipment in each centrifugal compressor skid was known as a
“train” and there was one for each. The area was quite congested because of the
quantity of equipment. Indeed this congestion would have caused a sufficient
degree of restriction in the event of an explosion in Module C to have created
vibration of the platform structure as the rushing gases encountered it.
To the south of the skids were fresh-water pumps and coolers of which
there were two, one on top of the other. Between these coolers and the B/C
firewall were two pumps and a vertical vessel associated with the fresh-water
circulating system. Two pressure control valves, namely PCV 1000 A and B,
were located towards the east end of Module C between the reciprocating
compressors and the centrifugal compressors. These were positioned at floor
level.
In the centre of the module there were two reciprocating compressors, A
and B (A being in the centre of the module and B being to the west). These
were motor driven machines, the motor on each being to the north and the
compressor unit to the south. These were large machines and occupied a
substantial portion of the module. Each machine weighed about 70 tons. There
were two compressing stages to each machine known as the first stage and the
second stage. The west of each compressor was the first stage compression
which utilised three cylinders. There was a suction scrubber for the first stage
which was to the north of each of the reciprocating compressors. The second
stage was to the east and again utilised three cylinders. The second stage
suction scrubber was located to the south of each compressor. The control
45
panel for reciprocating compressor A was on the walkway to the north of the
compressor. This was designated as panel JCP-020. The control panel for
reciprocating compressor B was in a similar position and was designated as
panel JCP-021. If for any purpose it was considered necessary to suspend
compression each compressor had a facility to unload and recycle gas. The
control panels JCP-020 and 021 were those the operator would have required to
use if unloading and recycling was effected. The operator would have to
operate seven switches on each panel to complete a particular exercise, that is a
total of 14 switches. The defenders argued that it may not have been a
coincidence that the reciprocating compressors had been recycled about
5 minutes before the accident.
PCV 1000A and PCV 1000B were pressure control valves for these
compressors and when Phase 1 was in operation PCV 1000A was kept partly
open to relieve any excess pressure on the compressors. The state in which the
valve was kept in Phase 2 is not known.
The pressure safety valve PSV-504 was located close to the second stage
suction scrubber of the reciprocating compressor and was approximately 15 to
20 feet above deck level. (--------) The witness Mr Grieve located the PSV to
the east and south of reciprocal compressor A. Mr Bollands said that the PSV
was on the south-east corner of a reciprocating compressor. Mr A G Clark said
the valve was close to the freshwater pump on the south wall of Module C just
about level with the walkway. This does not accord with the balance of the
evidence. Mr Bagnall located the valve as being between the reciprocating
compressors and the centrifugal compressors but nearer to the former. Mr Todd
said that it was in Module C just to the east side of the reciprocating
compressors. The witness Pirie thought that the valve was just above the
46
reciprocating compressors. There was some minor adjustment of the position of
the PSV as between the two models that the pursuers produced and the reasons
for this were not adequately explained. The defenders contend that the pursuers
should have provided more precise information about the location of the PSV
such as may have been available if they had lodged an isometric plan . I am not
sure that on the whole these descriptions of the location of PSV 504 are
materially different. There was some divergence in the evidence about the
height of the PSV. Mr Wottge, Mr Grieve and Mr Bagnall said that the PSV
was about 15 feet above deck level. Mr Pirie gave the height as being about 12
to 15 feet above deck level but this could be explained if he was judging the
height not from the deck but from the walkway. Mr Wottge had agreed with the
suggestion that the PSV was close to the ceiling, which in fact would give it a
height of about 20 feet rather than 15. Mr Todd placed it in the roof space
which would also take it higher than 15 feet. Mr Henderson had placed the
valve as being close to the manual isolation valve. This raises the interesting
question, not explored, as to how an operator requiring to open the manual
isolation valve obtained access to it. We were also never told what steps had to
be taken to unlock this valve which when in a closed position was locked.
Whatever precise height the PSV valve had, we know that scaffolding was
required to have access to it for removal for calibration. We also know that it
was located above a walkway. We also are aware where the pipe loop on which
PSV 504 was sited was located. ( ---------)
At the time of the accident scaffolding had been erected to obtain access to
PSV 504 and the presence of this could have affected the dispersion of any leak
from the blind flange attached to the open end of the pipe when the valve was
removed for maintenance. We were not given any precise information about the
47
size, layout or composition of this scaffolding and all we know about is that it
must have been placed in a position to permit access to the valve work. It also
must have been of a sufficient dimension to accommodate at least three men and
the dismantled valve. The witness Mr McDonald explained that, if the PSV is
assumed to be at a height of about 15 feet, the scaffolding platform would be at
about 12 feet but of course I think it is possible it was rather higher, although
the height of the PSV was only proved within approximate limits. We also
know that if work was interrupted the scaffolding was left in situ.
Mr McGregor was able to confirm that, when about 9 pm on the night of the
accident he went to do some work near the reciprocating compressor second
stage suction scrubber, he was inhibited in doing this work because of
scaffolding around it. If this was the same scaffolding as the valve maintenance
men were using this evidence gives some additional information about the
location of PSV 504.
Adjacent and to the east of PSV 504 was PSV 505 and both valves were at
about the same height. They were about 2 to 2.5 feet apart. The pipe loop in
which PSV 504 was located ran from north to south. There was a manual
isolation valve next to the PSV on the horizontal pipework. This was
downstream of the PSV and about 1 foot to eighteen inches away. To the south
of reciprocating compressor A were gas coolers E - 103A and B and to the south
of compressor B were the gas coolers E - 103 C and D. Next to the western end
of the gas cooler E - 103 C was the location of the 4 inch diameter condensate
pipeline as it passed through Module C on the way to the point where it was
routed through the B/C firewall into Module B.
To the west of the reciprocating compressor was the potable water storage
tank. Originally this was circular but that tank was eventually replaced by a
48
square tank. The tank, which is light grey, is shown in the photograph 12/8 G.
PCV 501 which let down gas to the Claymore pipeline was located to the west
of the reciprocating compressors. There were instrument control panels for the
MOL pumps to the south and west of the potable water storage tank. There
were four separate such instrument control panels and these were constructed
from light weight sheet panelling, each having an access door to allow
maintenance personnel access to the instrumentation. North of the potable
water tanks were two vertical cylindrical vessels, the western of these being the
instrument air receiver and the other being the utility air receiver. Associated
with the instrument air receiver was an instrument air dryer which was located
on the west face of the Module and associated with the other receiver was a
compressor which was located to the north of the receivers. In photograph
12/8G can be seen one of the instrument air receivers, the instrument air dryer
and the potable water storage tank.
The percentage volume occupied by piping within Module C was
approximately 15%. The module was more congested than Module B.
Generally, access to the Module could be obtained from the east through two
doors fitted for that purpose and forming part of the air filtration units. It was
also possible to duck under the hoods to the north and south of the centrifugal
compressors A and C. In the western half of the module on the north side there
was an open stairwell which connected the Module to the 68-foot level. One of
the walkways in the module was to the north of the reciprocating compressors.
As in Module B there was grating about 18 inches to 2 feet above the floor and
the walkways themselves were made of grating. There was grating between the
centrifugal compressors. There were also piping penetrations in the module
which were fitted with collars and such penetrations had gaps ranging from
49
between one quarter inch to three quarters of an inch. There were some pipe
penetrations associated with the relief lines that went from the 68-foot level to
PSVs 504 and 505 and returned to the condensate suction drum 2-C-202 at the
68-foot level. The exact arrangements for the protection or sealing of these
particular pipe penetrations were not investigated in detail although there was a
certain amount of thermal sealing in the area of the reciprocating compressors to
prevent the rise of heat from the John Brown exhausts and also a measure of
insulation of the module ceiling.
2.65 Module D
This module is located at the north end of the platform. At the eastern end
of the module were the John Brown Turbines A and these were substantial
pieces of equipment. They generated electricity at 13800 volts. They were
located in cabinets about twelve feet high and most of the east end of Module D
was occupied by these. Otherwise the north-eastern side of Module D and the
west and east ends were open. The exhausts and inlets of the John Brown
generators can be seen in the photograph 12/8B of process. Adjacent to the C/D
firewall at the eastern end of the module was the fuel gas heater. Next to the
west within an enclosed area there was a diesel-driven firewater pump and
adjacent to it was an electric-driven firewater pump also called a utility water
pump, all adjacent to the C/D firewall. They drew water from below the sea
level. The two pumps were housed within a fireproof enclosure and access to
them was gained by entering the module on the north face, and going down
some steps to the right of the John Brown generators. There was also within the
enclosure a diesel oil tank to provide fuel for the diesel-driven firewater pump
and a further such tank was situated outside the enclosure. Outside the
50
enclosure and to the west, but again adjacent to the C/D firewall, were two
additional pumps to provide firewater and utility water for the platform.
Within the western half of Module D was a separate steel structure known
as the Control Building and this was on two levels. It was bolted to the ceiling
of the module. The outer skin of this building was lightweight steel threesixteenth of an inch thick. Thus the Control Room itself was protected by a
moderately strong independent skin. The lower level is shown in the schematic
12/75 of process. Access to that level could be gained through double doors and
an airlock either from the west or east of the Control Building. It housed the
Emergency Electrical Room at the south west corner and this contained the
emergency electrical switch board. This provided power to emergency related
equipment like the fire and gas detection systems, certain motorised valve
operators, certain emergency electrical equipment and certain lighting. In the
north west corner there was the Heating, Ventilation, and Air Conditioning
(HVAC) room. Also in the east of the Control Building was a room containing
electrical switchgear and known as the Electrical Room No. 2. This contained
the 4.16 Kv bus bar which provided power to a number of electrical motors
including the motor of the condensate injection pump B. Also in No. 2 room
was the 440 volt normal supply switchboard. This switchboard served the
auxiliary supplies, the heating control, ventilation and lighting systems. Again
in the lower level of the module but outside the structure of the Control
Building there was a partly-enclosed area to the West and this area incorporated
the workshop known as the Maintenance or Mechanical Workshop. The part of
the wall of the Control Building which formed the west wall of the Emergency
Electrical Room was a common wall with the Maintenance Workshop at this
level as can be seen in Schematic 12/75 of process. Access to the workshop
51
was from a sliding door on the west face and this can be seen in the photograph
12/8F of process. The south wall of this workshop was adjacent to the C/D
firewall. Directly to the north of the Maintenance Workshop was an office/tearoom which had formerly been a tool store. Normal access to this area was
from the Maintenance Workshop through a doorway which had a sliding door.
The west wall of the office/tea-room was an emergency door which was
normally closed and generally not used. There was a gap between the
Maintenance workshop and the C/D firewall.
To the north side of the Maintenance Workshop was a stairway leading to
the upper level of the Control Building. To the north of that stairway was the
Instrument Workshop shown in photograph 12/8F of process. It was a
portacabin which had been placed at the western end of Module D. Access was
obtained through a sliding door on the south wall and this door was always
open. There was also a separate internal hinged door before actual access into
the work shop could be obtained. In an open area at the north west corner of the
module was the diesel-powered Emergency Turbo-Generator which supplied
emergency electrical power for critical items on the platform via the
switchboard in the Emergency Electrical Room.
The upper level of the control building was called the mezzanine level.
Access to the mezzanine level was via the stairway at the west face and this
stairway can be seen in the Photograph 12/8F. At the top of the stairway to the
north and left was the Safety Office and this was above the Instrument
Workshop. Entry was through a door in its south wall. Safety personnel on the
platform were based in the Safety Office. In this office completed and
suspended permits to work were in certain circumstances filed. To the south and
right of the stairway at the mezzanine level were the Electrical Maintenance
52
shop, Electrical Store, and Instrumentation Store. These areas were directly
above the Maintenance Workshop and their south wall was adjacent to the C/D
firewall. At the top of the stairs to the mezzanine level moving eastwards there
were double airlock doors.
To the right, on entering the Control Room, were the control panels for the
John Brown Generators. Moving to the east there was a worktop and visual
display unit (VDU). The VDU displayed inter alia information relating to the
telemetry system. There was a rack on the worktop which contained the active
permits to work, according to their designated areas. Further to the east within
the Control Room were a series of display panels as shown in photograph
12/203. The panel to the left and nearest to the centre of the Control Room was
the electrical mimic panel. This panel displayed the status of the distribution of
electrical power throughout the platform. Next to that panel and to the south
was the main process control or mimic panel. This panel displayed the status of
process equipment and contained a number of lights indicating which major
items of equipment were operating or shut down. To the south of the mimic
panel were the fire and gas display panels. There was also an additional fire and
gas display panel on the south wall of the Control Room. Moving east and
behind the mimic panel and the main fire and gas display panels, there were
inter alia panels relating to the fire and gas and telemetry systems. Adjacent to
the east wall of the Control Room there were additional fire and gas panels.
Slightly north of these additional fire and gas panels there was a table which
was used for tea or coffee and by Phase 1 operators and the oil and water
operators. The Control Room operator normally sat in the general area of the
control desk and the mimic and main fire and gas display panels. The Lead
53
Operator usually sat at the area designated “worktop” on the drawing 12/188 of
process.
To the north of the Control Room area and within the Control Building
there were areas known as the DC room and the Battery Room. The DC Room
housed safety-related switchgear for the instrument systems. The Battery Room
housed the battery packs which provided DC electrical supplies via the DC
Room equipment. The eastmost part of the Control Building was soundproofed and had its own heating and ventilation system. The Control Building
had double doors to prevent the ingress of gas.
The fuel gas for the John Brown Generators originated from the
centrifugal compressors and was processed in the fuel gas heaters in Module D.
Thereafter it traversed Module C before reaching the generators.
2.7. The 68 foot level
2.7.1 Produced Water Package and Laboratories
On the east side of the 68-foot level on an extension, outwith the confines
of the jacket legs, there was the produced water treatment plant comprising the
plate skimmer and hydrocyclone units. The plate skimmer was below Module
B. There was a windwall protruding out from the 68-foot level a few feet
beyond the east ends of Module B and C. The hydrocyclone units were
positioned beneath Module C. One way of obtaining access to this area of the
68-foot level was via a stairway from the base of the east crane pedestal outside
the windwall. The water laboratory, fine filters, and oil laboratory were on the
west face and at the south end of the platform.
54
2.7.2 The Dive Package
Also at the west side of the platform underneath Module B and part of
Module C but extending westwards beyond these modules was the Dive
Package area. This area can be seen in photographs 12/8D, 12/8E and 12/8G of
process. Moving from north to south, the Dive Package extended from the blue
container seen at low level in photograph 12/8G to the divide between Modules
A and B. The blue container was for wet suit storage. The adjacent yellow
container were the switchgear room and dive machinery room. The Dive
Package extended partly under Module C but the greater part of it was beneath
Module B. It extended from Module C across the whole width of Module B and
inboard for some 50 feet in an easterly direction under Module B.
Inboard of the container that housed the Switchgear Room and the Dive
Machinery Room there were two decompression chambers. These are shown in
photograph 12/8N of process. To the north of these chambers were the Dive
Package Offices.
At a lower level some 10 or 15 feet below the dive complex there was a
dive staging platform known as the Divers’ Launch and Recovery Platform.
Photograph 12/80 of process shows the stairway that led downwards to the dive
staging platform and the view from the top of the stairway to the dive staging
platform is seen in photograph 12/8M of process. The structure at the bottom of
the stairway was known as the Dive Wendy Hut. The dive staging platform
provided an area from which divers would enter the water. (--------) The floor
of the dive staging platform was constructed primarily of grating and rubber
matting was normally laid over the grating in order to protect the divers’ feet.
The dive staging platform was substantially underneath Module B and, in
particular, underneath the part where the MOL descended through to the 68-foot
55
level. The Tartan Riser also passed above the dive staging platform at a point
just below the 68-foot level before turning to the north where it descended into
the sea adjacent to leg B4.
2.7.3 Condensate Handling Facilities
The condensate handling facilities are an important feature of this case
since the pursuers’ case involves them in their case as to how the accident
happened. These facilities were directly below Module C and are shown in the
schematic 13/49 and photographs 12/8Q and 12/8R. They included the JT valve
and the JT flash drum, the condensate suction drum, the condensate booster
pumps, the condensate injection pumps (and all their associated pipework) as
well as the control instrumentation. The JT flash drum was on the east side of
the 68-foot level. The JT valve was to the north east of the JT flash drum.
There were two condensate booster pumps which were directly to the east of the
JT flash drum. The condensate suction drum 2-C-202 was located in the roof
space of the 68-foot level to the west of the JT flash drum. It had an internal
diameter of 3 feet and its dimension from end to end was 13 feet.
The condensate injection pumps were generally located in the centre of the
68-foot level. There were two pumps A and B. Pump A was to the east and
pump B was to the west. Each pump consisted of an electric motor, a torque
converter (also known as the Voith coupling), a gearbox, crank casing and a
pump chest or head. The motor of the each pump was to the north and the
pump chest was to the south or east. The stairway connecting the 68-foot level
to Module C was to the west and north of the condensate injection pump B. The
distance from the bottom of this stairway to the pumps was about 20 feet. Each
pump had suction and discharge pipework and on the pipework there were gas
56
operated valves (GOVs) known respectively as the suction and discharge
GOVs. The GOVs were situated to the south of the pumps. They were
operated by push/pull buttons local to them. The push/pull buttons were on
stanchions some 2 feet or 3 feet further to the south of the GOVs. With regard
to pump A the GOVs were respectively GOV 5005 on the suction side and
GOV 5006 on the discharge side. The GOVs for pump B were GOV 5007 on
the suction side and G0V 5008 on the discharge side. There were pulsation
dampeners on the suction line of each pump and also on its discharge line. The
pulsation dampeners were added to the pumps about a year after the
commencement of the operations of the condensate injection pumps. There
were four pulsation dampeners - two for each pump. Each pump had a relief
line going to its PSV. Since this involved pipe penetration it offered a possible
route for escaped oil or condensate to pass from module C to the lower floor.
Even if the discharge GOV of the pump was closed gas would enter the PSV
relief line. Thus in a depressurised pump if the suction valve was opened the
pressure would reach the PSV.
Situated between the JT flash drum and pump A was the control panel
JCP-057. Amongst other things this panel displayed the status of the
condensate booster pumps and the condensate injection pumps as well of the
GOVs of those pumps. Each condensate injection pump had a local control
panel located to the north and east of each pump. The panel JCP-057 was some
4 or 5 feet from the local panel for Pump A. On the stanchion beside the local
control panel for Pump B there was a level indicator for the JT flash drum.
Because of the amount of equipment the area near and including the
Condensate Injection Pumps was fairly congested.
57
2.8. The 107-foot Level and Above
2.8.1 The Gas Conservation Module and Utility Module
This module comprised equipment aimed at improving the quality of the
gas produced on the platform. The module can be seen above Module B in the
photographs 12/8 H and I of process. It was also partly above Module C. The
equipment included in particular molecular sieve dryers, a turbo expander, and a
demethaniser. Located within this module was a sound-proofed hut which was
used by the Phase 2 operators. The Utility Module was directly above Module
C. This contained a main 13.8kv switchboard and 4.16kv switchgear. The
power supply for the condensate injection pump A came from this switchgear.
2.8.2 Sub -module D
Above Module D in the 107-foot level was sub-module D and the western
half of this was a self-contained building consisting principally of the
Telecommunications Room and Occidental Production Stores. The eastern half
of this sub-module was open to the north and east and housed the Occidental
Maintenance Office, foam storage, pumps, and HAVC systems. At the east of
the sub-module were the generator inlet ducts for the John Brown generators.
The exhaust ducts were on the north face and the inlet ducts were on the east
face. Immediately outboard of this area was the Occidental Maintenance
Superintendent’s Office. This can be seen as the orange portacabin protruding
from the north face in photograph 12/8E. Inboard of that office was the
Occidental Maintenance Office.
58
2.8.3 The Drilling - Related Modules
Immediately opposite the GCM and on the west side of the 107-foot level
was the Mud Module and the main items of equipment included two shakers
situated in the south east corner of the module. The west wall of the Mud
Module is seen in photograph 12/8G of process. To the north of the Mud
Module was the Storage or Sacks Module and to the north of this was the Pods
Module.
The skid deck was also on the 107-foot level directly above Module A.
On the skid deck, running east to west were the main skid beams on which the
drilling derrick was supported. This allowed the derrick to move and be centred
above any of the 36 well slots. The top of the derrick was about 289 feet above
sea level. Individual covers on the skid deck and above each of the well slots
allowed for access to each well for drilling or well maintenance operations.
There were two hatches for each well slot, namely an outer and smaller inner
hatch. The outer hatch had a dimension of about 10 feet by 7.5 feet. The inner
hatch was located within the outer hatch and was about one third of the size of
the outer hatch. Each type of hatch was made of a steel construction some
3/8 ths of an inch thick. The inner hatch was designed to be bolted to the outer
hatch. Part of the skid deck with one of the skid beams and hatch covers for the
well slots can be seen in photograph 41/11.
The pipedeck was located above the Mud and Gas Conservation Modules
at the 133-foot level and can be seen in photograph 12/8D. Access could be
obtained from the pipedeck to the drilling derrick via a pipebridge and V door.
On the west side and to the north of the pipedeck was the Submersible Pump
Electrical Module (SPEEM). This can be seen in the photographs 12/8D and
12/8G. The ERQ East consisted of four levels and is seen on photographs
59
12/8B and 12/8E of process. The helideck was on top of the ERQ at the 174foot level. Level 1 housed a number of cabins, the offices for the OIM and
Production Superintendent and a general office. The highest level housed the
dining and kitchen area. This area also housed additional accommodation and
recreational areas.
2.9. Hazardous Area Classification
In accordance with practice within the industry, the platform areas were
classified into different zones depending on the likelihood of the development
of a potential unsafe gas/air mixture. Zone 1 was where an explosive
atmosphere was likely to occur in normal operations. Zone 2 was where an
explosive atmosphere was not likely to occur in normal operations and if it did
it would only exist for a short time. Safe and unclassified was an area where an
explosive atmosphere was not expected to occur and which was considered to
be a safe area.
Module A was classified as Zone 2. Module B was classified both as
Zone 1 and Zone 2. The area in that module classified as Zone 1 was the area
associated with the production manifold where there were sample collections.
Module C was classified as Zone 2 and Module D was unclassified. These
classifications are shown diagrammatically in the Operations Manual 12/3 or
process. In the main the 68-foot level was classified as Zone 2 but with areas to
the north and east being unclassified. The design of equipment in a classified
area had to meet certain safety standards. These were directed towards
preventing ignition sources being caused during the normal operation of such
equipment. In areas designated as Zone 2 gas detectors were likely to be in
positions where gas was most likely to be detected.
60
2.10. Pipework Network/Flotta Oil Terminal
2.10.1 The Piper Network
The 30 inch diameter oil export riser and the 16 inch diameter Claymore
gas riser were on the north face of the platform. The 18 inch diameter Tartan
Gas Riser was in the vicinity of leg B4 on the west face. The 18 inch diameter
MCP-O1 Gas riser was in the vicinity of leg A4 on the east face. The MOL
travelled from the platform down to the seabed and along the seabed to Flotta, a
distance of 128 miles. The Claymore platform was located some 22 miles west
of the Piper Alpha platform. Oil was exported from the Claymore platform via
a pipeline which tied into the MOL at Flotta. The tie-in point was about
22 miles from Piper Alpha and was known as the Tee.
The pipeline of which the Tartan Gas Riser formed part was a gas line
about 12 miles long used for Tartan to export their gas via Piper towards MCPO1. The MCP-O1 Gas Riser travelled from the platform to the sea-bed and
thereafter to the MCP-O1 platform some 34 miles to the north of the Piper
Alpha platform. Gas from the Tartan Riser was routed into the MCP-O1 riser
on the Piper Alpha platform. There was also a 16 inch diameter pipe running
along the sea-bed between the Piper Alpha and Claymore platforms with
associated risers on each platform. This pipeline allowed the Piper Alpha to
supply fuel gas to the Claymore platform. Furthermore there was a 24 inch
diameter oil pipeline running from the Tartan platform to the Claymore
platform. This facilitated oil export from the Tartan platform via the Claymore
platform into the main oil line to Flotta. The network is set out in the
schematics 12/24 and 12/122 of process.
61
2.10.2 The Flotta Oil Terminal
This terminal in the Orkney Islands was built after the discovery of the
Piper Field in order to provide a base for receiving, storing and exporting
hydrocarbons discovered offshore. The plant at Flotta consisted mainly of two
areas, the processing area and the storage and transport area. As at 1988 Flotta
was receiving hydrocarbons from three platforms, namely Piper, Claymore and
Tartan, all via the MOL. At the time of the accident in 1988 the terminal was
owned and operated by OPCAL.
2.11. The Firewall Structure
The firewalls between the modules on the production level were fabricated
and supplied by Durasteel. This was done for OPCAL on the instruction of
their designers, Messrs Bechtel, and the walls were fabricated at the yard of
Allen & Grieve of Edmonton. Some challenge was presented by the defenders
to the pursuers’ evidence about the structure of the firewalls but I was satisfied
by this evidence. The firewalls had been altered to a degree from the original
drawings but the witnesses were able to describe such differences so far as it
mattered. I doubt in any event if at the end of the day they make much
difference. The witness Mr Pickett was employed by Durasteel from 1963 until
1991 and had reached the position of Office Manager. He confirmed that about
1973 Durasteel had supplied three firewalls to OPCAL. One had been a 6-hour
firewall both insulated and on integrity. The other two were fire integrity
partitions only and were of a 4-hour standard. The 6-hour firewall was
constructed of three thickness of Durasteel 3DF2 material with two layers of
insulation. The other firewalls were a single sheet of the Durasteel material. In
terms of their contract Durasteel supplied the whole firewall system including
62
the frames and every nut and bolt. Subsequently before the platform came into
operation the firewalls were assembled and installed on it. The effect was that
each of the modules was separated from adjacent modules by such a firewall.
The firewall between Module A and Module B was known as the A/B firewall,
that between Modules B and C as the B/C firewall, and that between Modules C
and D the C/D firewall.
Evidence about the construction of the firewall was given on behalf of the
pursuers by Mr Terry Rogers. This witness is now a self-employed project
engineer and he has a HND qualification in mechanical engineering. Between
1973 and 1980 he had been employed by Bechtel Great Britain as a piping
engineer. This is to a degree significant because the Bechtel Group had been
employed by the consortium as designers of the platform. He went to the Piper
Alpha platform in 1978 and was there during the phase 1 and 2 installation
programmes. After he left Bechtel in 1987 he remained in employment on the
platform and at the time of the accident was the Project Services Superintendent
for OPCAL. This meant that he was Superintendent for construction work. His
work involved supervising projects which required pipe penetrations through
the firewalls and this gave him a familiarity with their construction. He had not
worked specifically on the C/D firewall but had observed its construction.
There was a gap between the C/D firewall and the maintenance building and a
person could squeeze into this, as he had done, and observe the firewall
construction. He was responsible for the personnel whose job it was
periodically to check the firewalls. I had no difficulty in accepting his evidence
in relation to the construction of the firewalls.
The firewalls were attached to the trusses which were part of the module
structure. There were two trusses for each module. These trusses were
63
numbered 1 to 8 from south to north. The A/B firewall was built on the north
truss line for module A and was built to the south side of it. The consequence is
that an explosion within the module would push the firewall into the trusses.
The position in relation to the construction of the B/C firewall was the same. It
was built on the south side of truss 4. The C/D truss had a different construction
from the other two but was also built to the south side of the north truss of
Module C. The firewalls extended from the deck plate (rather than walkway
level) up to the underside of the main beam on top of the truss. The length of
the truss would be the length of the module, namely about 153 feet, and their
height was about 19 feet. The defenders claimed that it was not clear from the
evidence just how strong the connections of the firewall were at the junctions
between the firewall and the deck and the ceiling respectively. However they
accepted that this was not an issue.
The witness, Mr Crouch, was employed by Allen & Greaves until they
discontinued business in 1976. That firm carried out work for Durasteel and
Mr Crouch had a supervisory position in it. The timescale he gives for the
construction of the wall is broadly consistent with that of Mr Picket. The
pursuers’ witness, Mr Cole, was the Works Director of Durasteel and he had
joined them about 1987. He had no direct knowledge of the supply of the
firewalls to OPCAL by Durasteel but knew from his knowledge of the history of
his firm’s works systems and from their records that such walls had been
supplied and the details of the walls which were likely to have been supplied.
The construction systems employed by Durasteel do not seem to have varied
over the years. Durasteel supplied OPCAL with detailed drawings at the time
of the installation of the firewalls. Such drawings were retained by OPCAL and
updated where necessary. He spoke to the fact that the productions 12/80,
64
12/83, and 12/85 of process were accurate representations of how the firewalls
would have been constructed and the evidence when viewed as a whole leaves
me in little doubt that this is so. Indeed these drawings purport to be Durasteel
drawings and have a Durasteel stamp on them. Each bears a date round about
1975. Mr Rogers was able to say in evidence that the door in the actual B /C
firewall had a Durasteel logo on it. The schematic 12/93 of process also shows
an outline of the construction of the firewall A/B.
Mr Rogers indicated that the A/B and B/C firewalls were plated in with a
material called Durasteel which is a sandwich of perforated steel with a noninflammable material in between. These plates were about three-eighths of an
inch thick in all. The steel sheets were each about half a millimetre thick. The
composition of the core was cement mixed with asbestos. The weight of the
Durasteel sheets was about 21 kg per square metre. The flexural strength of the
Durasteel panel was 60 Newtons per square millimetre. The plates were
supported in an angle frame bolted together so as to form frames around each
panel. The angle frames were steel. The top and lower panels in the wall
measured 8 feet and a quarter inch in length and the intermediate was 4 feet and
a quarter of an inch. Each panel had a width of 5 feet. At the west section of
the A/B firewall the drawings show a section of wall with rather smaller panels
but Mr Rogers could not remember this detail. The frames were made of mild
steel angles measuring 2 inch by 2 inch by a quarter inch, mitred at the corner
and butt welded to form a 90 degree angle. The grade of steel was 43A. The
frames were bolted back to back using three-eighth of an inch Whitworth thread
bolts. When the firewalls were delivered to OPCAL the bolt holes were predrilled. The frame bolts were spaced at 18 inch centres. There was a distance
from the outer edge of the angle iron to the centre of the frame bolt hole of
65
30 millimetres and this is referred to as the structural backmark. The distance
from the centre of the bolt hole to the toe is 20 millimetres. These
measurements have some significance when the prying action of the angle iron
when subjected to pressure is being considered. They come from Mr Cole and
Mr Crouch who agree within general limits.
With regard to the clamping of the frames to the trusses of the A/B and
B/C firewalls the frames were fixed to the trusses by an arrangement of cleats as
shown in the drawings I have referred to above (and also the schematic 12/93).
Six inch long L cleats were positioned and welded on to the frames. Threeeighth of an inch screw rods are then used to secure other cleats at the back of
the trusses so as to hold the firewall tight against the trusses. The clamps
appeared at the points where the trusses intersected the panels of the firewall.
These points are shown on the drawings by way of asterisks. Clamps were
attached to both the vertical and diagonal members of the trusses. At the top the
connection was a weld to the main chord of the truss and then a bolted angle
connection to the angle iron frame. This arrangement is illustrated in the
drawing 12/80 of process. At the bottom the firewalls were secured by a weld
to the deckplates. The panels themselves were attached to the frames by fivesixteenths of an inch diameter Whitworth bolts and at 12 inch centres.
The defenders’ witness, Mr Barron was 58 years old and he was a
foreman painter with Wood Group. He had been on the Piper Alpha at the time
of the accident. An objection was taken by the pursuers to his evidence because
he was only called on day 171 of the Proof and the matters he spoke to were not
put to the pursuers’ witnesses. The thrust of Mr Barron’s evidence was that in
February 1988 he had cut Mandolite from the B/C firewall in order to expose
pipes at the western end of the firewall. He claimed that the whole of the wall
66
where he had been working has been covered in Mandolite and he had needlegunned some of it to remove it. He stated that it was one or two inches thick.
Mr Rogers had spoken to the fact that Mandolite had been used to seal pipe
penetrations but it was never suggested to him that at any point that the
substance covered other parts of the firewall. Certainly it was put to Professor
Reid that a two inch coat of Mandolite would have an effect on the mass of the
wall but until that point in the evidence there had been no suggestion that there
was such a coat to the various witnesses (such as Mr Wottge, Mr Wylie, or
Mr Rogers) who might have been expected to have had a better knowledge of
the position than Mr Barron. Professor Reid did say that a coat of Mandolite
would affect mass and thus by implication velocity but he did not attempt to
quantify this effect. The suggested occasion in February was the only occasion
Mr Barron claimed to have worked at the firewall. He also agreed that it was
generally used as a sealant. It should be noted that the Durasteel Plates had a
honeycomb construction. If Mandolite was spread over any substantial area of
the wall it would have been at the west end only but I am not convinced that
even at that part of the wall the panels were covered in Mandolite although a
certain amount will have been applied in the area of pipe penetrations as a
sealant. Mr Wottge had given the fire rating of the wall as 4 to 4.5 hours
whereas the witness Mr Picket had ventured that the fire rating supplied by
Durasteel had been 2.5 hours. Defenders’ counsel had sought to take from this
that Mandolite could increase the fire resistance of a wall and that it may have
been for that reason that OPCAL had sprayed Mandolite on the wall. However
the only evidence was that the Mandolite had been used at the west end of the
wall and if one was seeking to increase the fire resistance of a partition wall it is
difficult to see why one would want to apply Mandolite at one end only. There
67
is I think a certain amount of doubt as to whether or not there was at least some
Mandolite on the wall (as distinct from the pipe penetration points). However
any such doubts could probably have been resolved if the matter had been put to
the pursuers’ witnesses (and in particular Mr Rogers) and in the circumstances I
think the pursuers must get the benefit of the situation. Moreover the pursuers’
structural engineers were not asked about any effect the Mandolite could have
had on their calculations.
Mr Barron also said that he was familiar with the door at the west end of
the B/C firewall and gave evidence that when he was working on the platform
this door was always left slightly ajar. He confirmed that he had informed Lord
Cullen’s inquiry that during the period of eight months before the accident he
had used the door three times. Once again this matter was first raised by the
defenders at a late stage of the proof and neither the pursuers’ experts nor the
platform witnesses were asked about it. Mr Rogers had claimed that the door in
question had a self-closing mechanism which was very effective and snapped
the door shut. There of course is the possibility that as workmen painted or
worked at pipe penetrations the door was jammed in an open position but this
may well have been temporary.
As I have already indicated the C/D firewall differed from the others in
that it had three layers of Durasteel which sandwiched two layers of mineral
wool each about 2 inches thick. In this construction the plates were rather
smaller. Details of the construction of this wall are set out in the drawing which
is 12/85 of process. The panels were about three feet square and the wall was
seven panels in height. The firewall was considerably thicker than the other
two firewalls. The panels were applied to the south face of the angle irons and
this was secured to the truss line. The skins of the wall were attached to each
68
other by coach bolts, four to each three foot length and these also held the angle
frames together. The frames were fixed to the trusses by fabricated straps
attached to cleats. This is illustrated in the schematic 12/94 of process and in
the drawing 12/85. Because of the difference in this module any overpressure
from Module C would push the panels on to the angle frames whereas the
panels in the B/C firewall would be pushed away from their trusses.
2.12. The Electrical Circuitry
2.12.1 The Power Supply
The main witness for the pursuers on the matter of the power supply was
Mr Lloyd who presently is their Chief Electrical Engineer. He is a Chartered
Electrical Engineer and a Member of the Institute of Electrical Engineers. He
holds the Higher National Certificate in Electrical Engineering. He first joined
OPCAL in 1976 as a Platform Electrical Technician and worked in that capacity
on the Piper Alpha platform for about 4 years. At that time he worked regularly
with all aspects of the electrical system. He was also familiar with the air
supply system. He then became a Facilities Electrical Engineer with OPCAL
onshore. During this period any alterations on Piper to the electrical system
would pass through his hands. In 1985 he was promoted to the position of
Senior Electrical Engineer. In respect of the technical matters about which he
gave evidence he was clearly well informed.
The productions 12/73 and 12/74 which were taken from the Operations
Manual, but were spoken to by the witnesses, set out in detail the normal and
emergency electrical supplies. The top bus-bar shown there on the left was
located in Module D at the Mezzanine level in Electrical Room No 2 and is
13.8 kV. The power passes down to a bus-bar of 4.16 kV also in Module D and
69
this supplies the Condensate Injection Pump B. The first bus-bar next to the
right is 13.8 kV and is located in the Utility Module. This transfers electricity to
a 4.16 kV bus-bar also in the Utility Module and this in turn supplies
Condensate Injection Pump A. The bus-bar coming down beyond that was a
440 V normal services bus-bar. The main implication of this is that at the time
of the accident any electrical de-isolation of pump A would have required to
take place in the Utility Module.
The productions number 12/75 and 12/76 of process show the John Brown
generators which were the principal power source on the platform and, as I have
said, these were located at the east end of Module D. 12/76 shows the main
13.8 kV switch-board which was located within Electrical Room No 1 at the
east end of the Mezzanine level in Module D. The 440V and the 4.16 kV
supply controls are in Electrical Room No 2. The drawing number 12/72 of
process shows the power supplies to the various auxiliary services. The relevant
bus-bar was located in Electrical Room No 2. In respect of emergency
distribution Mr Wottge explained that this came from a solar generator
illustrated in the drawing 12/75. This generator supplied power to the
emergency services switchgear in the Emergency Electrical Room in Module D.
The emergency supply would come on automatically if power was lost from the
John Brown generators. The drawing number 12/73 of process shows two
diesel-fired generators principally designed to provide an emergency supply for
drilling operations but also available as an emergency supply for emergency
services. Finally for emergency purposes there was an Uninterruptable Power
System charged from a Trickle Charger from the 440 Volt emergency services
bus-bar. This was intended to supply emergency power to essential services
such as essential instrumentation, the general alarm system and the public
70
address system. Indeed there are three independent batteries covering the
various critical services. The batteries were in the Battery Room as shown in
drawing 12/76. There was also a back-up system to supply emergency lighting.
2.12.2 Control Panels
The local control panels for the condensate injection pumps are located as
shown in the Schematic number 13/49 of process. The elements displayed on
the panel are as shown in 15/21 of process. The panel contains alarm lights.
These signal a range of difficulties that might arise such as those relating to
pressures, levels and temperatures. A light shown as number 1 remains on if the
pump is running and if this goes off it of course signals that the pump has
stopped. There is a further lamp which signals that power is servicing the
relevant pump. If the power lamp is on and the pump is not shown as running
the reason for this is not indicated. There is also a local Instrument Panel (JCP57) which provided local alarm indications of the process conditions. The
Control Panel will signal if the Gas Operated Valves which relate to the suction
and discharge sides of the Condensate Injection Pumps are open or closed.
There is also a selector switch which governs the source from which the pumps
are fed (that is from the JT Flash Drum or the Condensate Suction Vessel).
When the production system was running in Phase 1 the feed was always taken
from the Flash Drum. The control panel had a bulb test button and an
emergency shut-down button to shut down the condensate system. If the power
supply to a pump was interrupted during isolation by being racked out there
would still be a lamp to indicate the status of the GOVs. Racking-out is the
procedure of isolating the electrical switchgear by withdrawing the
compartment containing it. On the other hand the procedure of locking-off
71
involves isolating the circuit by pulling the isolation switch. In both procedures
the withdrawn compartment or switch as the case may be is locked in position
to prevent accidental de-isolation of the circuit. In racking-out not only is the
supply disconnected from the apparatus but also the relevant supply from the
mimic. This means that there will be no supply going from the Control Room
to the solenoid logic within JCP57 and this in turn affects the procedures
required to re-pressurise the GOV of the condensate injection pump. When the
pump is being jagged in such circumstances the complementary air supply of
50 psi is unavailable to hold open the push-pull button which opens the GOVs.
This means that the button can only be retained in the open position by holding
it open manually. The Control Room Operator would know if a pump had been
racked out by the absence of lights and thus by looking at his mimic board he
would know if a pump was out of commission. On the other hand if a supply to
a pump is simply locked off, the supply to the solenoid continues and the 50 psi
supply to the GOVs can be maintained.
The Control Room has electrical and process mimics which indicate the
status of equipment as shown on the local panels. From this the Control Room
Operator is alerted to the position in relation to production equipment. The
layout of these is shown in 12/76 of process. What is described as the “Main
Process Control Panel” is the process mimic. Adjacent to this at the left is the
electrical mimic. Above the Control Panel is an annunciator or alarm panel for
common alarms from the process equipment. If an alarm is annunciated, there
would be a flashing light and an audible signal. In respect of the Electrical
Panel the status of electrical equipment is signalled by a red or green lamp
depending on the signal received. If the circuit breaker relating to a condensate
injection pump is closed and the pump is running then a red light would be
72
shown. If the circuit breaker is open and the pump trips, the red light would go
out and the green lamp would light up. If the pump is not running and has been
racked out then no light at all is shown on the electrical mimic.
If an alarm relating to the production process annunciates then the relevant
red lamp goes off and in the case of major pieces of equipment such as the
Condensate Injection Pumps a flashing amber light comes on. There is also an
audible alarm. The operator accepts the alarm by pressing the accept button at
the bottom of the Process Control Panel. This has the effect of silencing the
audible alarm but the relevant alarm lamp remains lit and in a steady state. On
the occasion of the accident the only process alarms noted by Mr Bollands, the
Control Room Operator, prior to the explosion were alarms showing that
Condensate Injection Pump B had tripped and that the three Centrifugal
Compressors had also tripped. No other alarms which could have indicated
other process upsets were noted by him. Working equipment such as the pumps
and valves each had their alarms. These alarms were as set out in the drawing
12/193. It will be noted that the MOL pressure is also shown on the Control
Panel. At the bottom of the Control Panel there is also a reset button which
either as a result of automatic setting or by manual operation resets the amber
lamp by extinguishing it. Furthermore there is an emergency shutdown button
which if pressed shuts down the whole process. Of course as I have explained if
a Condensate Injection Pump was not in production there would be no mimic
light at all.
2.12.3 Pneumatic and Electrical Operation of Pumps
The primary sources of power for the instrument air and utility air systems
so far as relating to the condensate injection pumps were the John Brown
73
Generators in Module D and there was back-up for both systems by way of
stand-by compressor. The starting procedure for a pump which had been out of
action would involve first re-pressurising the pump (which will have been depressurised while out of action). Since the deactivated pump will have been
isolated physically by having its suction GOV closed it is necessary as a first
step to have the GOV open at any time when hydrocarbon is to be reintroduced to the pump. The GOVs are operated by way of a push/pull button
for each pump. These buttons are attached to stanchions and their relationship
to their relative pumps is shown in the Schematic number 13/49 of process. By
means of these buttons an air supply of 100 psi can be introduced to the valve
system and this will work an actuator which will open the pump. However the
button once pulled can only be held open automatically by the force of a
separate air stream of 50 psi and this will only be possible if the pump is
electrically connected. This is because the solenoid that operates the 50 psi
system needs to be energised. Otherwise the GOV can be kept open so long as
the button is held in the pulled out position manually. When the button is
released the GOV will close. The re-pressurisation is a different process from
actually starting the motor of the pump and must precede it. There is a limit
switch that ensures that the motor of the pump cannot be opened until the GOVs
are opened. Thus whether or not an operator engaged in jagging a condensate
injection pump will have to remain at the push/pull button during the process
may depend on whether the electrical supply to the machine has been racked out
or simply locked off.
74
CHAPTER THREE - THE PRODUCTION PROCESS
3.1. General
The details of the production processes on the platform were extensively
discussed during the proof and an understanding of many aspects of them is
essential to an understanding of the case. During the early stages after the
platform was put into production there were no Condensate Injection Pumps
and little condensate was produced. Condensate is not a distinctive substance
but describes in relation to hydrocarbons their state when vapour has been
condensed out so as to become liquid. Condensate is a mixture containing a
number of liquefied gases and of these methane (C1H4) is the lightest. Next
lightest would be ethane (C2). Then comes propane (C3), butane (C4) and
pentane (C5). Thus of that list of hydrocarbons each on the list is heavier than
the one above and has a lower boiling point. They are ranked according to their
molecular weight. By determining the molecular weight we can determine the
molecular weight of the mixture and compare it to the weight of air. If a gas is
neutrally buoyant it is approximately the same weight as air and in a general
sense will neither rise nor fall in relation to air. Whether a particular gas is in
liquid or gas form will depend on its pressure and temperature. If a particular
gas is compressed at a pressure substantially higher than atmospheric pressure
then it will become denser and therefore heavier. If condensate at under
pressure is released into the atmosphere or an unpressurised container, it will
flash and become a two phase substance of gas and liquid. The flashing
process is very quick and will occupy no more than milliseconds. When
flashing occurs one is likely to get a greater proportion of the lighter gases
coming off the liquid since, having a lower boiling point, they are more volatile
although the heavier gases also flash off in lesser proportions. It is
75
understandable that lighter molecules should come off the gas more easily than
heavier ones. However the process is a differential process so that it cannot be
assumed that all of a particular gas will flash off or remain in liquid state.
(-----) Liquid crude oil is just a particular form of hydrocarbon condensate.
However it will flash far less readily than the condensate formed from other
combinations of gas as produced on the platform since these comprise a far
lighter mixture of gases. In the platform processes some of the oil extracted
from the reservoir flashes off to gas and some of this is then processed to
become a liquid and thus condensate. Of course the condensate thus produced
could never re-emerge as crude oil since not all the constituents of the crude oil
gasify. In the reservoir the crude oil is at considerable pressure. When it enters
the separator the pressure is drastically reduced and this explains why some of
the gases flash off. However all in all condensate, as referred to in relation to
platform processes, is simply the name given to liquid hydrocarbons which
have condensed out of the vapour and gas streams. The objective of the
platform processes was to convert as much gas as possible to the lighter gases
(and particularly methane) since these had a higher commercial value but the
remaining condensate was also taken off the platform and converted to various
uses. At various points in the Phase 1 operation, after the initial separation in
the Module B separators, the process machinery would bring about changes in
pressure and temperature which would cause the hydrocarbons in the gaseous
or vapour state to condensate out into liquid condensate. Moreover it cannot be
assumed that condensate formed at one stage of the process will have the same
components as condensate formed at a different stage. Flashing can be a two
way process so that gas put under a sudden change of pressure and temperature
can produce a two phase flow which of course would include liquid. This is
76
known as the Joule Thomson effect and is what happens at the JT valve. It
happens because the reduction in pressure causes a reduction in temperature
and it is this that causes the gas to condense out as liquid.
Any condensate produced by the process was injected into the MOL for
export to Flotta. However with the introduction of the Claymore field the MOL
pipeline pressure increased and it became necessary to add Condensate
Injection Pumps to export the condensate. The pumps and the associated
Condensate Suction Vessel were added to the platform at the 68-foot level. The
platform was operating in this mode from about 1977 to early 1978 - that is for
a relatively short time. During the later part of 1978 the condensate handling
facilities on the platform were upgraded. The JT (Joule Thompson) drum and
JT valve were also installed at the 68-foot level. Condensate booster pumps
were installed to improve the flow of condensate to the injection pumps. The
mode of operation employed at the time was known as Phase 1. During this
period the condensate produced was all sent to Flotta in the MOL. The gas
produced (as distinct from the condensate) was used as lift gas (to facilitate the
extraction by lifting of oil from the reservoir) or as fuel gas for the platform.
Any excess gas was sent to flare and essentially wasted.
Between 1978 and December 1980 the Frigg field was developed and this
led to the construction of a manifold compression platform, MCP01. The effect
of this was to open-up the possibility of exporting gas to the shore. Thus the
pursuers’ predecessors began the construction of a gas processing module on
the platform to refine the gas for export. This Module was known as the Gas
Conservation Module (GCM) and pending its introduction to the process the
gas produced on the platform was treated by a Glycol Dehydration unit located
above Module A at the east end of the 107-foot level. The aim of this unit was
77
to remove water from the gas and make it of exportable quality. This particular
mode of operation was known as Phase 1A.
The GCM was located above Modules B and C and was brought into
operation about December 1980 with the effect of rendering the Glycol
Dehydration Unit redundant. Moreover the platform was then enabled to
operate in a mode of production known as Phase 2. The difference which the
introduction of Phase 2 made to the process did not affect the processes in
Modules A and B, nor the operation of the centrifugal compressors. Indeed the
main difference to the process was in the treatment of gas. The gas was treated
in the GCM so as to improve its suitability for export. Thus after leaving the
first stage of the reciprocating compressors the gas was routed to the GCM for
treatment. The gas passed through the mole sieve dryers to remove water.
Thereafter it passed to the turbo expander where condensate was produced and
the gas and condensate were then routed to the demethaniser and the JT drum.
An important difference between Phase 1 and Phase 2 is that in the latter the JT
valve was not used to produce condensate and the condensate produced came
directly from the demethaniser.
3.2. Mode of operation at date of accident
As at 6 July 1988 the platform was in general capable of being adapted to
operate in either Phase 1 or Phase 2 modes. The platform had operated in
Phase 1 during a period of some months between early 1978 and about
December 1978. Then until about 1980 the platform generally operated on
Phase 1A. About December 1980 Phase 2 began to be the mode of operation
and this was generally the position until a few days before the accident. About
1984 Phase 1 was introduced for a period of no longer than 60 days. In the
78
summer of 1988 the pursuers’ predecessors decided that it was advisable to
carry out significant maintenance work in the GCM and to this end it was
decided to withdraw that module from the production process during the
maintenance procedures and to re-introduce Phase 1. The implication of
reverting to Phase 1 was that many of the experienced process operators on the
platform would have had no direct experience of operating the production
process when the platform was in that phase. The conversion work to transfer
to Phase 1 was planned for the beginning of July 1988. The work began about
1 or 2 July 1988. Initially the greater part of the plant had to be shut down. A
substantial part of the platform equipment required to be depressurised.
However one of the centrifugal compressors was kept running to provide a
supply of fuel gas for the platform. Advantage was taken of the opportunity
presented by the shutdown to change valves on two of the reciprocating
compressors while they were not operating. Before Phase 2 could be
eliminated from the process the GCM had to be isolated. This meant
depressurising equipment in the module and physically isolating it from
Phase 1. Much of the hydrocarbon material in the GCM was routed to flare in
order to effect the depressurisation. Then the isolation was completed by way
of closing valves, spading, and blind flanges. Some of this work was done in
Module C. All such isolations had been effected by about 4 pm on 3 July.
They were checked and pressure tested. The isolation work was such that some
gas (-------) was trapped in the piping that had been sealed off. The planning
for the conversion had been controlled from the beach. Phase 1 operation
began about 4 pm on 3 July after the isolations of the GCM were complete. By
11 am on 5 July Phase 1 was operating with two reciprocating compressors,
two centrifugal compressors and two condensate injection pumps. However
79
late on 5 July the third centrifugal compressor was available. By the evening of
6 July Phase 1 was operating with three centrifugal compressors running. The
witness Mr Clark said that, although Phase 1 was in operation for several days
before the accident, there was a degree of instability until all the processes had
been adjusted to the new system. Three centrifugal compressors tripped just
before the accident. Mr Henderson indicated that he had never known all three
centrifugal compressors to trip but then it was not clear how often in Phase 2
operation there would have been all three compressors running at the same
time. The tripping of the centrifugal compressors at the time of the accident
was attributed to the fact that the reciprocal compressors had been recycled. Of
course if this affected centrifugal compressors so as to cause them to trip then,
if all three of such compressors were running, it is perhaps not surprising that
they tripped. An alternative cause of tripping may be the entry of a sufficient
quantity of gas to trigger the trip alarms. On the other hand in this event one
might expect the trip to be preceded by the detector signalling an alarm in the
Control Room since the trip concentration is higher than the percentage of
LEL needed for a low alarm. As each compressor tripped an additional amount
of gas would be released to flare as the separators sent gas forward.
The defenders argued that the extensive work done in connection with the
conversion to Phase 1 could have put the equipment under all sorts of strains
and stresses which could have led to the accident.
It should be noted that none of the witnesses suggested that the platform
as adjusted was not equipped to deal adequately with the Phase 1 process.
Indeed at the time of the accident the platform had been coping successfully
with Phase 1 for some days. We were not told who had planned the changeover
to Phase 1, on the basis of what experience and advice, and with what
80
precautions. It would not be appropriate that I should find that the Phase 1
conversion was misconceived or not properly carried out. Insofar as it could be
suggested that Phase 1 could have been a cause of the accident this could only
be on the basis that it was a considerable and recent change in the process. The
defenders argued that the equipment was much older when Phase 1 was reintroduced in 1988 as compared with the earlier operation of Phase 1. However
the possibility that the accident was due to ageing equipment is not one that was
explored with the experts. Nor were witnesses asked anything about the
recommended working life of the equipment. Moreover when a line was
opened as must have happened when the conversion to Phase 1 was effected,
the open end of a line would not merely have a blind flange or spade fitted but
this would be pressure tested before it was exposed to production pressure.
Moreover the system entailed having a double precaution such as a closed
manual valve. Thus in relation to PSV 504 the blind flange was not exposed to
pressure so long as the pump GOV valves remained closed. However if the
pump required to be re-pressurised the pump suction GOV would be opened
and the pressure would be diverted to the blind flange. Normally there would
not be pressure right up to a blind flange itself.
The conversion to Phase 1 had various implications for the processes.
The JT valve had to be restored and this thereafter was a source of condensate
production. Because the valve was less efficient less condensate was produced
and therefore it was thought possible that the plant could function with only one
condensate pump running unlike Phase 2 when two such pumps were generally
in use. Less was produced by this method than had been the case with the
GCM. (--------) The fuel gas line required adjustment since in Phase 2
operation a proportion of the fuel gas had been produced in the GCM. As to
81
the gas this could no longer be exported during the Phase 1 operation. Much of
it was routed to flare and the balance, if not required as fuel gas, was used to
the effect of increasing the gas available for gas lift. With more gas lift it was
possible to extract more hydrocarbon from the oil reservoir. Thus the system
was required to deal with more hydrocarbon than had been the case latterly
when Phase 2 was functioning. It should be noted that the wells were
generally producing substantially less oil than they had produced at the time in
1984 when Phase 1 had last operated. The platform originally produced about
250,000 barrels of oil per day. This increased over the earlier years to about
300,000 barrels but then began to reduce and by 1988 was about 125,000
barrels per day. During Phase 1 the gas routed to flare increased about eight
times compared to the position under Phase 2. This increased flaring caused a
noticeable increase of heat at the south-west corner of the platform. It also
caused some additional vibration of the platform structure.
It should be noted that generally the production flows fluctuated and this
was probably rather more pronounced when Phase 1 was operating. The
processes were designed to be largely self regulating so that they adapted to
changes in flow. However in Phase 1 operation particularly, a measure of
adjustment of the plant was needed to keep the processes flowing.
The crux of the defenders’ submission on Phase 1 was that the effect of
the change from Phase 2 to Phase 1 was that a far greater quantity of
hydrocarbon was in the platform system. However they claimed that because
particularly of the removal of the GCM the platform was less well equipped to
deal with the extra hydrocarbon.
82
3.3. Reservoir and Module A
The reservoir fluids were a mixture of crude oil, gas, water and sand.
They were brought to the surface by pumping a proportion of the 34 wells
which connected the reservoir to the platform. The wellheads (also known as
christmas trees) were designed to control the flow of the material extracted
from the reservoir and to isolate the reservoir as required. The contents of the
reservoir were kept in liquid state by the intense pressures generated there but
by the time they had reached the surface during extraction they had become gas
and fluid and accordingly a two phase flow. The well heads were all in
Module A. No processing was carried out there and once the material was
extracted it was transferred by pipeline to the manifold in Module B.
It should be noted that in referring to oil, gas and condensate one is not
considering three totally different substances but rather hydrocarbon in various
states.
Each wellhead is connected to the reservoir by a 20 inch conductor pipe
that extends several hundred feet into the sea-bed. The reservoir materials were
extracted through tubing inside the casing round the conductor pipes. In early
years the pressure within the reservoir itself was sufficient to send the reservoir
materials to the surface. However over a period of time the reservoir pressures
declined so that artificial methods had to be used to raise the material from it.
The most used of these methods was gas lift. By this method gas was pumped
into the reservoir. This lightened the reservoir fluids and helped them to rise to
the surface. As they rose the gas came bubbling through the fluid. The
introduction of gas was achieved by routing gas from the platform to each gas
lift well. Other wells were assisted by the use of submersible pumps. As at
July 1988 there were from 25 to 27 wells in production. About 15 or 16 of
83
these operated with the assistance of gas lift. In the case of a gas lift well it
would suffer a loss of production if its gas were withdrawn. This would happen
progressively and some of the gas wells could maintain a reasonable level of
production even if deprived of gas. Any loss of production from the reservoir
would be recorded at Claymore and at Flotta by way of the telemetry system.
The flow of reservoir material to each wellhead was controlled by a system of
valves. The valves in each wellhead were designed to close automatically in
the event that the wellhead was shut-off or if an emergency occurred. Each
wellhead had the protection of a downhole safety valve, the hydraulic master
valve and pneumatic wing valves.
Gas lift for the wells was routed from the second stage of the
reciprocating compressors. A gas supply then travelled from Module C (where
the compressors were situated) to Module A. A shutdown valve was installed
on the pipeline and in the event of a shutdown gas could be isolated from the
wellheads by means of a GOV.
Water injection facilities were used to inject sea water into the reservoir to
help maintain the reservoir pressure. These facilities were part of the
responsibilities of the Oil and Water Operators. Generally there were two such
operators on duty together on each shift. Their duties covered Modules A and
B as well as the part of the 68-foot level on the skid deck. Their main location
was normally Module A. However they would visit Module B and
occasionally would be in the Control Room or on the Skid Deck. Among their
duties were the checking of various controls and gauges and the starting and
stopping of certain equipment. Mr Grieve passed near the produced water
package at the 68-foot level shortly before the accident and did not claim to
have seen either of the Oil and Water Operators there.
84
3.4. Module B
3.4.1 General
The main function of the equipment in Module B was to separate gas and
produced water from the crude oil. After this separation the treated crude oil
was pumped by way of the MOL to Flotta. The outline of the process in
Module B was that the gas was cooled and a small quantity of condensate was
collected and transferred back to the production separators. As to the gas this
was routed into Module C for further processing. The produced water was
diverted to the water treatment package at the 68-foot level.
Each of the separate flow lines from the wellheads in Module A passed
through the A/B firewall into manifolds in Module B. There were separate
manifolds for each of the two production separators and a third for the test
separator. Wells could be allocated to these separators by manually operated
valves. Samples of well fluids could be taken periodically from each flow line
by access through sample points. The process flow at this stage was largely
unstabilised crude oil and this began to go into a two phase flow of gas and oil.
There were emergency shutdown valves on the manifolds to the three
separators and these were designed to close automatically in the event of
platform shutdown.
Each production separator had a number of alarms associated with it.
Thus there were low and high level alarms (PAL and PAH and for more
extreme situations PALL and PAHH). If any of these alarms were triggered, a
common alarm in the Control Room would give an indication that there was a
problem with the separator concerned without specifying the nature of the
problem. The separators also had equivalent alarms to register high and low
85
levels. These alarms were designed to deal with serious disturbances in the
process flows and would only show up a leak if it was relatively material. This
is because the whole system was designed to be self regulatory so that trips
should only occur if the equipment went outside acceptable operation limits.
Minor deviations in the process were intended to be dealt with by automatic
adjustment of the equipment concerned. The defenders made the point that the
amount of gas needed to cause the explosion which caused the accident was
very small compared with the amount of hydrocarbons passing through the
system. The production separators each had a shutdown system and, in the
event of alarms for materially abnormal levels or pressures being triggered, an
inlet emergency safety valve would close. Other related valves would also
close although only the separator triggering the alarm would be affected. It has
to be noted however that a separator could trip for a cause unrelated to the
process flow. There were no moving parts within the separators.
After the fluids entered the production separators they divided into three
flows by gravity separation. The water went to the bottom. The oil flowed
over internal weirs before leaving the separator. The gas moved to the top and
left the separator there. As at the date of the accident the pressure and
temperature in each production separator should have been 155 psia and
150 degrees Fahrenheit respectively.
The function of the test separator was to check the flow rate and
composition of the well fluids so that at regular intervals oil from each well was
routed into the test separator for this purpose. The oil was thereafter transferred
back to the production separator by a transfer pump.
The produced water being heavier than oil dropped to the bottom of the
separators and the interface between water and oil in the separators was
86
regulated by a level control system. If the water in the separator dropped to a
pre-set point the level control valve associated with the separator would close to
a degree to balance the situation and the reverse would happen if the level rose
beyond its pre-set point. When the water left the separator it went through the
produced water treatment system. Thereafter the water went through a
skimming process at the 68-foot level. A small quantity of oil was skimmed off
the water or removed in the hydrocyclone units and this water was re-routed to
the production separators. The produced water was disposed of into the sea.
The oil level in the production separator was also controlled by a level
control system. The control valves that operated the system were located in the
metering streams in Module B. These valves controlled the flow of crude oil
from the production separators into the MOLs. Because the water separation
system was not wholly efficient a certain proportion of water known as the
“water cut” remained in the oil and went with it to Flotta. On 6 July 1988 at
1600 hours the water cut was higher than normal being 10.5% compared with a
normal cut of about 5%. This was due to work being carried out on the
overboard dump line.
Each production separator had one exit line for oil flow and the oil was
pumped out of its exit using a booster pump. The oil was discharged from its
pump through its metering skid. There was a non-return valve on the discharge
line from the booster pump and this prevented the discharged oil from flowing
back to the suction side. The shutdown of a production separator would cause
its booster pump to trip. There was a third booster pump (the middle pump)
which was used as a spare pump for either separator. The discharge from the
spare pump went to a third metering skid which was also in effect a spare skid.
Normally two booster pumps would be in operation.
87
If oil were to escape in Module B then some gas would flash off,
particularly in relation to the lighter ends, although the molecular weight of the
mixture would exceed the average molecular weight of these ends because
some of the heavier ends would also flash off. The extent of the gas flashing
off from oil can be estimated at about 5%.
3.4.2 The Metering Skid
The metering skid comprised three metering runs. The turbine meters
were situated towards the north end of the meter run. The level control valves
controlling the level in the production separators were downstream of the
turbines in the metering runs. Data taken from the runs passed into the
metering and telemetry system. Associated with the metering system there
were a number of alarms which would be triggered in the event of malfunction
or if measured parameters deviated outwith the predetermined set limits.
However the evidence did not disclose what these limits were. The meters
were in place to serve a fiscal purpose and not to detect leaks so that it is
unlikely they would be triggered by other than a relatively large leak which
made a material impact on the flow. Any alarms generated were activated by
the Solatron system and the Solatron alarm panel was located on the Control
Room Operator’s desk. Alarms only sounded if the oil flow exceeded the
predetermined levels. An automatic sampling system was also installed on
each metering run. Manual sampling connections were also installed. These
were small three-eighth of an inch connections from which a sample container
could be filled. Oil discharged from the metering runs went into the MOLs.
The metering equipment itself sat in horizontal pipework running north to
south. The pipework was 8 inch diameter. The equipment was 12 to 16 inches
88
long and contained a turbine wheel from the metering runs. Pipework ran
vertically up the B/C firewall and met in a common header called the main oil
line pipe suction header. This was 20 inch diameter pipework and it ran along
the B/C firewall at the western end of the module and then ran north to south.
Its total length was 60 feet. The defenders argued that this pipework would
have protected the 4 inch condensate injection pump against any projectile from
the B/C firewall. However this line of attack was not explored with the experts
in any detail. The main oil line discharge header also ran north to south. The
large bore pipework was in general supported by hangers.
3.4.3 The Prover Loop
The prover loop was normally located above the metering skid and was
used to check the accuracy of the measurements in the metering system. By
6th July 1988 the prover loop had been removed from the flow system so that
its lining could be repaired. The loop consisted of a four-way valve, a loop of
pipework, and a considerable amount of ancillary pipework. Connections to
the prover loop were blanked off but when the prover loop was removed from
the flow line any flange or spade used to isolate the flow would not have been
exposed to the flow pressure unless previously pressure tested. There were
about 6 lines blanked off and of course they were also protected from the flow
by safety valves. When the prover loop was disconnected a portable prover
loop was from time to time connected to the system and then removed after use.
Any system in force for the use of this portable prover loop was not explored in
the evidence. The metering skid also had its own alarms. A major alarm would
be registered if there was, say, a malfunction of one of the transducers. What
would be regarded as a minor alarm would annunciate if there was a significant
89
deviation from what would be regarded as normal. Because the prover loop
was away, maintenance men would remove the meters and clean them. On the
day of the accident, according to the witness Mr Dixon, a team of men had been
preparing to perform some work in the general area of the prover loop. A
scaffold had been erected. However we had no indication of the work that they
were intending to carry out although it involved welding equipment. Moreover
the men seem to have been withdrawn before they got on with their work.
There was not even any evidence that work on the prover loop would need
scaffolding. Nor was there any indication that they were working during the
nightshift when the accident happened. Indeed on the contrary Mr Bollands
said that there were no permits issued for welding work on the night of the
accident. Also round about the day of the accident some work had been carried
out with the meters.
3.4.5 The MOL Pumps
At the date of the accident three MOL pumps were in operation. These
pumps operated in series with the discharge of one pump feeding the suction of
the next pump. A non-return valve associated with each pump prevented the
backflow of oil from the discharge side to the suction side. If for any reason a
pump was shut down the non-return valve opened thus allowing the flow to bypass that pump and to flow to the next pump in the series. Each MOL pump
had motor operated valves on its suction and discharge sides. These were
designed to close automatically if a pump was shut down or tripped. The
pumps were centrifugal pumps operating on the impeller principle. The
impeller rotated at speed drawing fluid from the suction side towards the central
part of the impeller where it was accelerated. The diameter of the discharge
90
line was of smaller bore than the suction side and the process generated higher
pressure. The fluid entering the MOL was at a temperature of approximately
153 degrees Fahrenheit and at a pressure of 905 psia. The MOL pumps had
separate local control panels at the west end of Module C.
Each MOL pump was equipped with a process alarm system that relayed
a common alarm to the Control Room. When an MOL pump was running, a
red running light appeared on the main process mimic there. If a pump tripped
the red running light was extinguished, an amber light would flash, and an
audible alarm would sound. A button was then pressed by the Control Room
Operator. This had the effect of accepting the alarm. When the alarm had been
accepted the audible alarm would stop and the flashing light would become
steady.
The MOL pumps were also equipped with a process shutdown system.
Some disturbances of the flow would cause a common shutdown of all the
MOL pumps. This would occur in the event that (a) a local shutdown button
was operated for all pumps, (b) no booster pumps were running, (c) there was
low pressure in the common suction header, (d) there was high pressure in the
common suction header or (f) the emergency shutdown valve ESV 208 was not
open. If any of these conditions occurred the MOL pumps were designed to
shut down and ESV 208 to close. However the process system was designed to
be self adjusting so that not every variation in the flow would shut down the
pumps. For this to happen the predetermined parameters had to be exceeded.
However there was a leak detector which would shut down and isolate the
pump if greater than normal drain came off the seal of the pump.
Each MOL pump was fitted with its own process trips. The pump could
be tripped (among other possibilities) by (a) operation of the pump emergency
91
stop button, (b) low pump discharge pressure, (c) high pump discharge
pressure, (d) low pump oil lube pressure, (e) failure of the seal system, (f) low
lube oil level, (g) high pump vibration, (h) high coupling bearing temperature,
(i) high motor bearing temperature, (j) high motor winding temperature and (k)
high pump bearing temperature. In the event of any of these contingencies
materialising the pump was designed to shut down and the motor operated
valves were designed to close. On the discharge side of the MOL pumps there
was a pressure transmitter with an associated low alarm (PALL 111) so that if
the pressure dropped in the MOL downstream of the pumps then an alarm was
relayed to the Control Room. In the event of high pressure in the MOL there
was a pressure switch the purpose of which was to activate a platform
shutdown in the event of an excess of pressure in the MOL.
From the discharge side of the MOL pumps the fluid passed through a
non-return valve installed in the discharge header and then through ESV 208
before entering the MOL. The tie-in point was located directly upstream of the
main shutdown valve that isolated the MOL from the process equipment in
Module B. There was an arrangement whereunder the valve could be closed by
nitrogen pressure in the event of failure in the electrical power supply.
Notwithstanding the above the main system for detecting leaks of
hydrocarbons was the Gas Detector System and the absence of trips was not a
sign of the absence of leaks unless in respect of leaks that had allowed the
escape of significant amounts of material.
3.4.6 Gas and Condensate Flows in Module B
Gas came out of the production separators from exits at both ends of
these. The streams were routed separately to the east end of Module B where
92
the two streams merged and were again separated into two streams before
entering the four gas coolers. The purpose of these coolers was to improve the
quality of the gas by cooling it and separating the condensate from the gas.
This caused the formation of a certain amount of condensate but not much at
this stage. The temperature of the gas stream was thus reduced from
approximately 150 degrees Fahrenheit to approximately 65 degrees Fahrenheit
(being the temperature the gas retained until it emerged from the suction side of
the centrifugal compressors). Gas and condensate formed in the gas coolers
went into the condensate knock-out drum towards the east end of Module B.
This vessel was also used to separate condensate from gas although again at
this stage of the process very little condensate was knocked out of the gas. The
vessel contained baffles but no moving parts. The pressure entering and
leaving this vessel remained about the same as the production separators that is
approximately 155 psia. The level in the vessel was controlled by a level
control system. Condensate collected in the knock-out drum was returned to
the production separators by means of a transfer pump located just to the west
of the condensate knock-out drum. The knock-out drum had its own local
control panel (JCP 009). There were process alarms associated with the
condensate knock-out drum and these were relayed by common alarm to the
Control Room. For example if there was a high level in the drum there was an
alarm and if this progressed to become high, high, level, the inlet valves to all
the production separators would trip. During Phase 1 the condensate knockout
drum only received relatively small amounts of condensate. This tended to be
composed of the heavier ends of the gas flow.
Gas left in the condensate knock-out drum was routed through the B/C
firewall into Module C. Moreover a line was taken from the gas line before it
93
entered Module C, and this led to pressure control valves (PCV-51 1/2). Thus
the pressure within the production separators and the condensate knock-out
drum could be controlled. The PCVs effected this by removing any excess
pressure to the flare system. Accordingly if a centrifugal compressor tripped
(thus rendering it incapable of continuing to receive and compress a continuing
flow of gas) the said PCVs would relieve the excess gas to flare. Downstream
of the condensate knock-out drum there was a slipstream which routed some of
the gas to the deoxygenisation towers in the 84-foot level. This gas was used to
remove oxygen from the sea water to reduce its corrosivity.
The responsibility for operating the equipment in Module B was also part
of the responsibilities of the Oil and Water Operators. These duties included
(a) responding to any changes in the throughput of oil in Module B and of any
changes in the water cut, (b) ensuring that the interface controllers on the
production separators controlled the produced water that was being routed to
the water treatment facilities and (c) in the event of the unloading and recycling
of the reciprocating compressors and consequent loss of gas lift, checking the
oil and interface levels of the two production separators.
The layout of the main equipment in Module B is generally as set out in
the schematic number 12/97 of process. It should be noted that there was a
chemical tank just to the east of the metering skid and a thick steel ladder
giving access to the gas lift isolation valve. There was a point where the valve
bringing gas for gas lift from Module C went into Module B at the west end of
the firewall. The significance of these pieces of equipment is that the defenders
claimed that such equipment reduced the possibility that the condensate pipe
had been breached by a projectile.
94
3.5. Module C
3.5.1 General
The process equipment in Module C was designed to process the gas
produced by the production separators in order to remove the condensate from
the gas and thus to increase the pressure of the gas. Gas compression was
achieved by the use of centrifugal and reciprocating compressors. The major
production of condensate was achieved when the gas flowed through the JT
valve at the 68-foot level but, as I have already noted, some condensate was
collected at the condensate knock-out drum and (------) was also collected at the
centrifugal discharge scrubber. The defenders were concerned to emphasise
that there was a large amount of hydrocarbon present in the various pipes and
machines to be found in Module C. Much of this is under considerable
pressure. Some of the hydrocarbons in question pass through the east end of
the module. This is observable in the drawings and schematics whereas the
pressures at different points can be derived from Mr Clark’s flow chart which I
will later refer to. Since many of the hydrocarbons are in a single phase state
there is no question of flashing involved should they escape. (--------).
3.5.2 Gas and Condensate Flows in Module C
The design philosophy which prevailed on the platform at the time of the
accident was that emergency liquid inventories would be trapped in their
containers whereas gas inventories would be released to flare. Thus if you have
an emergency you try and shut down liquid-containing vessels whereas gascontaining vessels are emptied to flare for the gas to be burned off.
95
The hydrocarbons which went through the JT valve process had all
previously flowed through Module C. When it entered Module C the gas line
from the condensate knock-out drum split into three streams and was routed to
one of three centrifugal compressors. These compressors and indeed the main
equipment in Module C were set out as is generally illustrated in the schematic
number 12/98 of process. Each compressor had its suction scrubber but before
entering this the gas had to pass through a GOV. In the event of a centrifugal
compressor shutdown the relevant GOV would close. The objective of the
procedure at this stage was to see that only gas entered the centrifugal
compressor and the function of the scrubber was to remove any liquid.
However only a small amount of condensate was collected in the condensate
suction scrubber. Leaving the suction scrubber, gas was routed to the suction
side of the centrifugal compressors. Each such compressor was driven by a gas
turbine. The gas turbine was similar to a jet engine and was fuelled by fuel gas.
This gas when mixed with air created a flow of hot gases which drove the
power turbine. The power turbine normally ran at between 80 to 105% of its
design rpm. The expansion of hot gases caused rotation of a shaft linked to a
gear box which in turn reduced the rotational speed and enabled the
compressing mechanism to be driven. Each machine had seven impellers (like
propellers). Their rotation imparted velocities to the gas and these velocities
were converted into pressure. The compressors required a great deal of air for
the combustion process and at the end of the Module there were air intakes
which drew air up from Module C and from beneath the open grating below
them. Each intake drew in air at the rate of about 27,000 scfm. 80% to 90% of
this air was drawn in from outside the Module, the remainder being taken from
within it. Any gas drawn in from Module C would undergo a certain degree of
96
dilution by air before being sucked into the combustion air intakes. At some
height above the air intakes there were exhausts for the combustion air. These
features are clearly displayed in the schematics numbers 12/100, 12/106 and
12/107 of process. The compressors themselves are enclosed in compartments
there being separate compartments for the turbine sections and the compressor
sections, as is illustrated in the schematic number 12/126 of process. The
Turbines gave off a lot of radiant heat. As part of the process of cooling the
machines’ ventilation air was drawn into these compartments and the
arrangements for achieving this are also generally illustrated in 12/26. This
ventilation air was drawn in from outside Module C but the amount of air
required was much less than was needed for combustion, being about
8,000 scfm for each machine.
In the centrifugal compressors the gas was substantially increased in
pressure to about 675 psia and in temperature as well to about 700 degrees
Fahrenheit. The gas was then cooled in coolers in the centrifugal compression
skid. There was one such cooler for each compressor train. The effect of this
cooling was to generate (---) quantities of condensate. Thus a two-phase flow
(gas and liquid) was created and this went to discharge scrubbers which were
located directly below the gas coolers. In these scrubbers the condensate was
separated from the gas by gravity and it was collected at the bottom of the
vessel in a protrusion known as a boot. The condensate thus collected was then
routed to the condensate suction vessel which was located in the roof space of
the 68-foot level and it flowed there by gravity. The pressure in the condensate
suction vessel was maintained at the same pressure as the pressure in the
discharge pipework of the centrifugal compressors to prevent back-flow. To
deal with this need for pressure equilibrium, GOVs were installed on each line
97
coming from the discharge scrubbers and these were designed to close in the
event of a pressure differential. If one of these GOVs closed the condensate in
the boot of the associated discharge scrubber would increase quickly and if the
operator did not remedy the situation the associated centrifugal compressor
would trip and shut down. It should perhaps be noted that each centrifugal
compressor was equipped with two suction GOVs.
There were also GOVs on the gas lines from the discharge scrubbers
which were designed to close in the event of a shutdown of the centrifugal
compressor. Downstream of these GOVs the discharge lines for each of the
discharge scrubbers merged into a common manifold and the gas then went to
the first stage of the reciprocating compressors. The pressure and temperature
downstream of the discharge scrubbers of the centrifugal compressors were
approximately 675 psia and 105 degrees Fahrenheit respectively.
The valves controlling the discharge pressures from the centrifugal
compressors were PCV-1000A and PCV-1000B respectively. If excess
pressure was seen at the discharge of the centrifugal compressors these valves
would open and relieve the excess pressure to flare. Gas to supply the fuel
needs of the platform was taken from the discharge header of the centrifugal
compressor. Moreover each of these compressors was fitted with a minimum
flow by-pass or surge control system. This was an example of the selfregulatory arrangements which were built into the design of the process system
and the facility recycled gas from the outlet of the discharge scrubber to the
inlet of the suction scrubber on each compressor train. The intention was to
keep an adequate supply of gas going through each compressor train. The
amount of gas going through the recycle line was controlled by an anti-surge
valve. Some quantity of condensate was produced after the centrifugal
98
compressor stage and this was taken up by the discharge scrubbers. The mass
flow at the outlet of the centrifugal compressors was considerable. The closing
of the discharge and suction GOVs of the centrifugal compressors enables these
compressors with their discharge scrubbers to be depressurised. Thus after the
tripping of the centrifugal compressors the inventory of the centrifugal skid is
gradually reducing as vapour escapes to flare. (-----) . Since there were three
discharge scrubbers there was condensate about the middle of the east end of
Module C in three lines. These must have penetrated the decking to the 68-foot
level to join up with the condensate suction vessel. In fact the defenders
submitted that the centrifugal skids contained a considerable mass of pipes,
valves and flanges each carrying large quantities of gas or condensate. In a
general sense this was true. Moreover stopping the equipment does cause
pressure peaks and surges. On the other hand the flaring system is there to deal
with these phenomena.
Each centrifugal compressor was fitted with a number of process
shutdown trips. For example each compressor would trip on gas generator
overspeed and underspeed, power turbine overspeed, turbine high temperature,
compressor high discharge pressure, high discharge scrubber level and selected
fire and gas detection. The compressor could also be closed down locally by a
stop button. The exact settings which would cause these trip devices to operate
were not proved. However it was clear from the evidence that the recycling can
also cause these compressors to trip. It was not common but not unknown for
all three centrifugal compressors to trip. In the event of a centrifugal
compressor tripping or being shut down it was designed to be automatically
depressurised.
99
Gas from the discharge of the centrifugal compressors was normally
routed to two suction scrubbers associated with the first stage of the
reciprocating compressors. If any condensate entered with the gas it was
collected at the bottom of these scrubbers and then routed to the condensate
knock-out drum in Module B. However little condensate formed at this point.
There were two GOVs at the inlet of each of the first stage reciprocating
suction scrubbers and these were designed to shut in the event of the
reciprocating compressors being shut down.
The gas exited at the top of each suction scrubber was routed to the first
stage of the reciprocating compressors 1-K-103A and B. These compressors
were motor driven large machines each weighing about 70 tons. The purpose
of the first stage of this compression was to compress the gas but there was a
limit to the compression that could be carried out because compression
increases the temperature of the gas. The packing on the piston seals could not
tolerate too high a temperature. When the gas originally enters these
compressors it contains the whole range of hydrocarbons. Indeed nothing is put
into the system after the material leaves the separators. When the hydrocarbon
first leaves the separators there is oil that is diverted to MOL, there is a small
amount of condensate that is dealt with as such, and there is a large amount of
gas, some of which at least has the potential to become condensate. The
purpose of the process I am now describing is to turn gas into liquid
condensate. Liquid is easier to handle than gas. The light ends of the gas, such
as methane can be exported for domestic use but the heavier ends require to be
liquefied to be useful. The advantage of the Phase 2 programme was that
unlike Phase 1 one could separate a useful amount of the lighter ends. Only a
100
relatively small amount of condensate was actually produced in Module C. The
JT valve was the main instrument for condensate production.
If the reciprocating compressors for any reason had too much
hydrocarbon to deal with, the excess went to flare through PCV 1000A and B.
The defenders argued that when the system went into Phase 1 there were only
two reciprocating compressors in operation (the third compressor in the GCM
being out of the equation). There is likely to be more gas coming forward since
the increased use of lift gas should improve production. Thus the reciprocating
compressors were unable to cope with the increased load and it was for this
reason that PCV 1000A was left partly open. However it is not clear how far
this can take the defenders. Gas excess to the reciprocating compressors’
capacity might be wasted by sending it to flare but this would relieve any
pressure on the reciprocating compressors. At the time of the accident certain
equipment tripped but not the reciprocating compressors. There is nothing to
suggest that they were not functioning perfectly normally. Moreover because
oil production generally from the platform had declined compared with 1984 it
cannot in any way be assumed that at the time of the accident the system was
under Phase 1 coping with a higher flow of oil than it had coped with in 1984.
The gas first went through a snubber which distributed the flow to each of
the three cylinders of the compressor which were involved at the first stage.
Pistons within these cylinders compressed the gas. The gas then left the
cylinders and went through a lower snubber manifold. The gas leaving the
cylinders was the same mass as had entered, only compressed. The action of
compression increased the temperature of the gas to approximately 190 degrees
Fahrenheit and the pressure to about 1465 psia. It was routed from the lower
snubber to the after-coolers of the reciprocating compressors. These worked on
101
the same principle as the set of coolers which served the centrifugal
compressors. This completed the first stage of the reciprocating compression.
The gas at the end of this stage had a pressure of about 1465 psia and a
temperature of about 92.5 degrees Fahrenheit. A cross section of the first stage
of the reciprocating compressor is well illustrated in the schematic number
12/130 of process and 12/129 shows a plan view.
After leaving the two sets of after-coolers the gas went through GOVs
which were designed to close in the event of shutdown of the reciprocating
compressors. Each of these compressors could be put on recycle. This
procedure allowed the compressor to keep running without maintaining a
forward flow. This was achieved by opening a by-pass or recycle valve in a
line that went from the discharge side of the after-coolers to the suction side of
the suction scrubber and this was done by a switch. The by-pass valve for
reciprocating compressors A and B were GOV 902 and GOV 904 respectively.
Under normal circumstances these valves would be closed. When a
reciprocating compressor was placed on a recycle mode then high temperatures
could be created within the compressor cycle due to the act of compressing the
gas. To deal with this, the inlet and outlet valves in the cylinders of the
reciprocating compressors could be held open. This prevented gas from being
compressed yet enabled the pistons to continue to move within the cylinders.
The facility was known as unloading. A separate switch was required for each
of the three cylinders on the first stage of each reciprocating compressor. The
switches which effected unloading were located in local control panels near the
reciprocal compressors in Module C. To complete the process 14 switches had
to be thrown and this took about two minutes to achieve. When recycling, the
discharge pressure is not maintained and indeed a substantial amount of the gas
102
goes to flare through PCVs 1000A and B. These valves are two valves which
operate in tandem. The smaller takes up the normal flow and the larger takes
up the balance if the volume of gas increases. The unloading process does not
result in complete unloading but pressure within the reciprocating system is
reduced because effectively the gas is merely returned to suction. (------)
In the event of the reciprocating compressors being shut down, GOVs on
the upstream of the suction scrubbers and downstream of the after-coolers
automatically closed. Each reciprocating compressor was fitted with a number
of process trips. These included high discharge temperature in the cylinders,
high level in the first stage suction scrubber, and high discharge pressure. If the
apposite conditions occurred the reciprocating compressors shut down and
depressurised automatically.
When gas left the first stage of the reciprocating compressors it was
routed to the 68-foot level of the platform where it passed through the J.T.
(Joule Thompson) valve PCV-721A. The effect of this valve was to reduce the
pressure of the gas. The pressure was reduced from about 1465 psia to about
635 psia and this in turn had the effect of reducing temperature from about
92 degrees Fahrenheit to about 50 degrees Fahrenheit. The purpose of this
stage of the operation was to separate condensate from gas. Thus downstream
of the JT valve was a two phase flow. (-------) When as at the time of the
accident the process was in Phase 1 operation the GCM was isolated and the
two phase flow of gas and condensate went into the JT Flash Drum 3-C-701.
Just prior to the entry of the 2 phase flow into the JT drum was the tie-in point
of the pipeline containing the condensate flow from the condensate suction
vessel. The flow from this was routed to the JT drum by way of a level control
valve. This maintained a predetermined level of condensate in the condensate
103
suction vessel. The driving force for the transfer of the condensate from the
condensate suction vessel to the JT drum was differential pressure and this was
controlled by two valves located in the 68-foot level.
An understanding of the production of condensate illustrates why, when
the condensate injection pump failed, it was advisable to recycle and unload the
reciprocating compressors. The objective was to prevent further gas going
forward to condensate production while the injection pump system was not able
to cope with it. However a certain amount of additional condensate would be
reaching the JT flash drum from the condensate suction vessel. In fact the
centrifugal compressors were producing about 1537 barrels a day of condensate
and this has to be compared with the total production of condensate which was
7394 barrels per day when the amount produced at the JT valve is added. By
unloading the reciprocal compressors the amount of condensate produced by
the JT valve is substantially reduced and this relieves the pressure on the
JT flash drum. Obviously when the condensate injection pumps cease
pumping, the operators are concerned to avoid an excessive increase of the
level of condensate in the JT flash drum. If the condensate level in the JT flash
drum became excessive some condensate liquid could be carried into the
second stage of the reciprocating compressors and could damage them as well
as tripping them. After the condensate injection pump trips an alarm goes off
when the flash drum is about half full and after that there is about one hour left
before the flash drum reaches critical levels provided that the reciprocating
compressors are unloaded. Otherwise the available time is about 13 minutes.
After critical levels are reached the condensate runs to flare and is wasted.
The JT drum was a horizontal vessel and its function was to separate
condensate from gas. It contained no moving parts but operated by way of
104
baffles. The level of condensate in the drum was controlled by a level control
system. This worked by control being exercised over the speeds of the
condensate injection pump. If the liquid level of the drum increased, the speed
of the pump increased in order to pump away more liquid and the opposite
occurred if the level dropped. The normal liquid level in the JT drum was
about a quarter of the vessel. The drum was fitted with a high level alarm that
would be triggered at a liquid level that was some 8 inches beneath the centre
line of the vessel. If the level indicator located between the condensate
injection pumps showed the level in the drum to be 100% this in fact meant that
the actual liquid level in the drum corresponded to the centre line of the drum
and thus that the drum was half full. The pressure of condensate in the drum
was approximately 635 psia. The temperature was about 55.6 degrees
Fahrenheit.
The gas that left the JT drum was routed back up to Module C to undergo
the second stage of reciprocating compression. If one of the reciprocating
compressors were to trip then the pressure would build up on this line and that
pressure would be sensed by the differential pressure control valves, PCVs 723
A and B. These valves would then open to relieve to flare any additional gas
that could not be compressed and moved forward by the other reciprocating
compressor. Normally these valves were in any event partly open to control the
pressure on the JT drum and thereby maintain the pressure differential required
between that vessel and the condensate suction vessel.
As part of the second stage of the reciprocating compressor process, the
gas passed through suction scrubbers 1-C-116 A and B on the east side of each
compressor. In the compressors themselves the gas flows of the second stage
105
were entirely separate from those of the first stage. Once again there were
three cylinders in which the gas was compressed.
The suction scrubber for the second stage of the reciprocating
compressors was situated to the south of each compressor. The location of
these scrubbers is not without significance, for a number of witnesses identified
the location of PSV 504 by reference to the location of these scrubbers. In
Phase 1 the gas going to the second stage of compression in stage 2 was lighter
than the gas in the first stage because some of the heavier ends had been taken
off as condensate. However some of the heavier ends still remained in the gas.
In general, though, the molecular weight of the second stage gas would be less
heavy.
The pressure and temperature of the compressed gas leaving the second
stage of the reciprocating compressors were approximately 1735 psia and
198 degrees Fahrenheit respectively.
The arrangements for the recycling and unloading of the second stage of
the reciprocating compressors were equivalent to those of the first stage.
However in the case of the second stage only two of the three cylinders could
be unloading and therefore there were only two switches required. The
unloading and recycling of both stages of the reciprocating compressors
stopped the forward flow of gas from these compressors. This meant that the
bulk of the gas would go to flare from the discharge header of the centrifugal
compressors through PCV 1000 A and B.
The gas lines from the second stage of each of the reciprocating
compressors merged and gas was then routed into the gas lift system although a
small amount would go to flare via PCV-945.
106
The Phase 1 Gas Operator was responsible for the operation of the gas
compression facilities in Module C and also for the condensate system at the
68-foot level. In the course of his duties the operator was expected to be in his
areas of responsibility from time to time to check that the equipment was in
order
3.6. The 68-foot level
3.6.1 Condensate Flows
In general condensate is formed when gas is cooled. Condensate is
essentially a state of the gas but when gas becomes condensate the proportions
of hydrocarbon constituents will change as between the gas and the liquid. The
heavier ends of the hydrocarbon chain have a greater tendency to form
condensate so that the proportion of these in the condensate will increase,
whereas the lighter ends have more propensity to remain or flash-off as gas.
However even a condensate will retain some material proportion of the lighter
ends such as methane and ethane although heavier ends such as butane and
propane will preponderate. In a two phase flow, although the proportions of the
hydrocarbon constituents may have changed as between liquid and gas,
nevertheless none of the original constituents will have been lost in terms of the
totality of the flow.
3.6.2 The Condensate Booster Pumps
The condensate collected in the JT drum was routed to the suction side of
the two condensate booster pumps 3-G-701 A and B. Normally only one of
these two pumps would operate but they could operate in tandem. The pumps
had a minimum flow by-pass system whereby condensate was simply re-routed
107
back into the JT drum to ensure that there was a minimum amount of flow
through the booster pumps if the downstream condensate injection pumps were
not operational. For condensate booster pump 3-G-701 A there was a
shutdown valve located on the suction side of the pump to isolate it in the event
of a shutdown. This valve was SDV (shutdown valve) 5009. The condensate
exited the pump through a non-return valve and another shutdown valve SDV
5010. In the event of the booster pump being shut down or tripping then the
SDVs would automatically close. For condensate booster pump 3-G-701 B the
shutdown valves for the suction and discharge side of the pump were SDV
5011 and SDV 5012 respectively. These SDVs operated generally on the same
principle as the GOVs. The pressure of the condensate was increased from
about 635 to 670 psi by the booster pumps and this is a point the defenders
made much of in their submissions in relation to any condensate entering the
condensate injection pump and then escaping. Indeed the purpose of the
booster pumps was to give that small pressure increment. 635 psi is equivalent
to about 43 bar whereas 670 psi is equivalent to about 47 bar. If gas at 43 bar
enters an empty pump chest some of the liquid will flash off and return to gas
form. It will not be possible to repressure or condense all of the gas which has
flashed off. However at 47 bar it is possible to reconvert the gas to liquid. The
action of pumping caused a small temperature increase. If both pumps were
running then the flow from these pumps merged in a common pipeline before
being routed to the condensate injection pumps. If the condensate booster
pumps stopped they could be restarted after operating a reset button on the local
control panel. The defenders contended that it was important to know if the
booster pumps had been restarted at the point of any jagging or whether they
were in a tripped condition. On the control panel which houses the restart
108
apparatus for the condensate injection pump there are equivalent mechanisms
for the booster pumps. The GOVs would have to be reset and the pump started.
One difference between the position of the booster pumps and condensate
injection pump A on the evening of the accident is that it had never been
suggested that the booster pumps had been electrically isolated. There was
certainly no evidence that Mr Vernon had restarted the booster pumps before
any repumping, but it would have been a simple operation for him to have done
so were this an advisable preliminary to re-pressurisation. Moreover, if it were
obvious that any gas in the pump had behaved as it would when under the
boosted pressure, it would not be difficult to infer that the relevant booster
pump had been restarted. It would in any event have had to be restarted at
some point before the injection pump was restarted. Mr Vernon was not merely
awaiting the initiation of pump A but it seems that he was still trying to start
pump B and this could have started very quickly had it been in working
condition. Thus he may well have restarted both booster pumps. Mr Wottge
certainly said that one would require to have the booster pumps running before
restarting the condensate injection pump. However all this assumes that the
booster pumps trip or stop pressurising when the injection pump trips. We
never had very precise information about this although there was evidence that
the booster pumps have a minimum flow bypass facility which will create a
continuous flow through the pumps if the flow cannot proceed forward. In any
event, with the condensate injection pump A isolated, it may seem logical that
the relevant booster pump would be turned off. Moreover Mr Wottge has
remarked that unlike in the case of the reciprocating compressors the recycling
process in the booster pumps occurs automatically. It may be that, if the pump
remains switched on, the flow returns automatically if the stream begins to flow
109
forward again or possibly the recycled flow is at the boosted pressure. The fact
is that the matter of the booster pumps was not really fully explored in the
evidence but none of the experts suggested that any flow into the condensate
injection pump would be at less pressure than its planned level.
A problem for the defenders was that it was only after Dr Richardson had
given his evidence that the implications of the booster pump increasing
pressure became clear. This may explain why they did not examine, say,
Mr Wottge in more detail about this matter. Mr Wottge gave his evidence on
the relevant matter about day 41 of the proof whereas Dr Richardson did not
raise the question of differential pressures until day 115.
3.6.3 The condensate injection pumps
These pumps were situated at the 68-foot level towards the east end of the
platform. They are of course of critical importance to the case because the
pursuers aver that the accident was caused by a leak coming off the relief
system for one of these pumps. The two pumps were identical. Condensate
from the booster pump would enter the lower chamber of the pump chest of the
injection pump. The shutdown valve for the discharge side of the condensate
injection pump A was GOV 5005 and for pump B GOV 5007.
The condensate injection pumps were reciprocating-type pumps. The
pump chest contained three internal cylinders each containing internal suction
and discharge valves. Liquid was compressed within these cylinders and
pressurised by the reciprocating action of the pistons driven by the crank shafts.
There were three suction valves for each cylinder that allowed liquid into the
pump chest as the piston was withdrawn. As the piston moved forward into the
cylinder the pressure in the pump chest built up and when the pressure
110
exceeded the pump discharge pressure the internal discharge valve opened.
From the internal discharge valve in each cylinder condensate passed into an
upper chamber and was then routed into the discharge line of the injection
pump. A non-return valve and a GOV were located on the discharge line. For
condensate injection pump A the GOV was GOV 5006 and for pump B it was
GOV 5008. The discharge pressure of the condensate injection pumps was
approximately 1100 psi. Once again the action of pumping the condensate
increased its temperature slightly.
The general layout of the pumps and their controls is shown in the
schematics 13/48 and 13/49 of process. The control panel JCP-57 was located
about 4 to 5 feet from the local control panel. On the stanchion beside the
local control panel for pump B there was an level indicator for the JT flash
drum. Indeed the witness, Mr Grieve, had approached this indicator just
minutes before the accident.
The slight pressure surges associated with the operation of the condensate
injection pumps were catered for by pulsation dampeners. They had a spherical
shape and a capacity of about 20 US gallons each. At about the mid-point of
the sphere there was a pneumatic diaphragm. If for example the top half of the
sphere was filled with nitrogen gas to a pressure of about half the operating
pressure then the lower half of the sphere would be filled by condensate and
pressure pulsations would be absorbed by the diaphragm moving slowly
compressing the nitrogen in the upper part of the sphere. The setting of the
pulsation dampeners determines the extent to which one would get a liquid flow
at the alleged leak orifice.
Between the two pumps there was a half-inch equalisation line. If the
pump which is not being restarted is still running this can be used to assist in
111
the repressurisation of the other pump. It has isolation valves which can be
closed.
The GOVs located on the suction and discharge piping of each condensate
injection pump were pneumatically operated valves and supplied from the
instrument air system. The GOVs were ball valves. The ball required to be
turned through 90 degrees in order to fully close or fully open the valve. Each
valve had a pneumatic actuator which operated a Scotch Yoke mechanism.
Movement of a piston in the actuator caused the valve stem to rotate, thereby
turning the ball within the valve body. To open a GOV once it had closed,
instrument air had to be applied to one side of the piston housed in the valve
actuator body. This caused the piston to move the Scotch Yoke mechanism and
compress a spring in the other side of the actuator. The valve was closed by the
air in the actuator being vented. This released the pressure on the spring and
the spring, in turn, pushed the piston back. This action caused the Scotch Yoke
mechanism to close the valve. The control system for the GOVs was arranged
so that the pump motor could not be started until the GOVs were opened. The
valve took a measurable time to open. Because it is spring loaded, once the air
valve begins to close the GOV closes faster than it opens. An operator
attempting to open the valve to restart the pump would have the advantage of
an indicator to show the extent by which the valve had opened at any point of
time.
The condensate injection system had certain relief valves which are an
important feature of the case because the pursuers attribute the cause of the
accident to allegations that an attempt was made to start condensate injection
pump A when its pressure safety valve PSV 504 had been removed for
maintenance and not replaced. The interruption of the line had been sealed off
112
with a blind flange and the allegation is that this had not been fitted properly
with the result that a dangerous amount of hydrocarbon leaked out of it and
exploded. The PSVs for the two pumps, namely PSV 504 for pump A and
PSV 505 for pump B, were designed to ensure that if the system pressure in
either pump reached a certain point the excess pressure would be relieved. This
was done by routing the hydrocarbon to the condensate suction vessel. The
relief line for each pump was taken from the upper chamber of the pump chest.
The valves were on the discharge side of the pumps. The set pressure for the
said two PSVs was 1750 psig. Any flow from PSV 504 or PSV 505 passed
through manual ball valves on the downstream side and then merged before
entering the condensate suction vessel. The condensate injection pumps were
designed to trip when the pressure reached 1700 psig. This was initiated by a
high pressure switch. Each pump had its own independent lube oil system in
order to lubricate the pump, gear box and associated bearings. There were a
number of trip devices associated with the lube oil system that would shut the
condensate injection pump automatically.
The start buttons for each condensate injection pump were on the local
control panels of these pumps, namely JCP-043 and JCP-044 respectively.
These panels also had running and alarm indicating lights. Each condensate
injection pump had a number of trip devices. These individual trips included
low suction pressure, high discharge pressure, and various lube oil failures. If a
condensate injection pump tripped, its associated GOVs on the suction and
discharge side would close. If the suction and discharge GOVs were not open
then the pump could not be started. It was clear from the evidence of operators
that the condensate injection pumps had a tendency to trip at intervals.
113
The status of the condensate injection pump GOVs was displayed on JCP057. When starting a condensate injection pump it was necessary to reset the
control system so as to be able to re-open the GOVs. The reset button for each
condensate injection pump was located on JCP-057. The GOVs themselves
were operated by use of push/pull buttons located some 2 or 3 feet to the south
of the GOVs. If there was a fault indicated on JCP-057 a common alarm would
be transmitted to the main control panel in the Control Room. If the pumps
were being started the motor would be speeded only gradually to avoid
creating a pressure surge that could again trip the pumps on high discharge
pressures. Thus when restarting a pump the manual speed controller had to be
adjusted. Before the pump was run it would be necessary and was practice to
open the manually operated relief valve on the relief line in case there was such
a pressure surge. Condensate from the discharge of the condensate injection
pumps was routed to the condensate metering run at the 68-foot level. The
metering run utilised an orifice plate mechanism in the measurement process.
From this metering run the flow of condensate went through a pressure control
valve PCV-511. This valve maintained back pressure on the condensate
coming from the discharge from the condensate injection pumps to prevent gas
from flashing-off from the condensate and affecting the meter reading.
From PCV-511 the condensate was routed in the condensate line up into
Module C and then into Module B at the west end where it proceeded to its tiein point in the MOL. There was a non-return valve and a ball valve on the
4 inch diameter condensate line at points close to the tie-in point with the MOL.
There is no doubt that the process arrangements generally involved the
movement of very large amounts of hydrocarbons and that under considerable
pressures and at elevated temperatures. The lay-out arrangements meant that
114
the hydrocarbon material had to traverse at various process stages substantial
areas of Modules C and B and also the 68-foot level. Both the centrifugal
compressors and the condensate injection pumps were sufficiently sensitive for
a trip not to be out of the ordinary but if that happened the GOVs were intended
to trip thus stopping the forward flow of gas.
On the Tuesday prior to the accident there had been a problem with
condensate injection pump B. It was discovered that the problem was caused
by a low pressure switch that leaked due to overpressure. However this was
smelt by the operators and did not create an alarm. Of course it has to be noted
that on the night of the accident apparently neither Mr Vernon nor Mr Richard
smelt any leak of gas from condensate injection pump B. Moreover on that
occasion the pump had tripped and stopped pumping some time before the
accident occurred.
CHAPTER FOUR - SAFETY
4.1. General
The Operators had in force on the platform a number of procedures aimed
at securing the safety of the platform and those who worked on it. I do no think
it was disputed that a production platform which retains and circulates a very
considerable amount of potentially explosive and flammable hydrocarbon
creates serious dangers if adequate safety measures are not taken. I think it
goes without saying that many of the safety arrangements and in particular
those for the prevention of explosions and the containment of fire drastically
failed on the night of the accident. I believe that the sufficiency of the safety
measures was explored at the Cullen Inquiry. However I am not concerned
with the evaluation of these measures except insofar as parties in their
115
pleadings have raised them as having a bearing on the cause of the accident or
the legal responsibility therefor. In general OPCAL’s specific safety
arrangements were set out in the document headed General Safety Procedures Offshore Operations which is Number 12/405 of process. This was intended to
regulate the organisation of safety for those working on the Platform. Two of
the safety considerations which arose sharply in these cases were the Permit to
Work system and the system for handover between shifts.
4.2. The Permit to Work System
4.2.1 General
This system is set out in Part 3 of 12/405 and the pursuers’ principal
witness on the matter was Mr Snape. When he gave his evidence Mr Snape
was the Vice-President of Operations for Occidental’s Latin American
businesses and in fact was employed by OIEPC. He was aged 55. He had
degrees in Science, Mathematics, Physics, and Chemistry from Leeds
University and in Petroleum Engineering from Imperial College. He was born
in England but held American citizenship. In 1981 he took over as General
Manager of OPCAL and became responsible for their entire North Sea
operations. From then on, until about the time of the accident, he was in charge
of the company although his official designation changed from time to time.
From about 1987 he was President of OPCAL and his office was in London.
He had overall responsibility for the day to day running of the company and
that would include safety. He took specific responsibility for safety in 1983
when the Board of Directors confirmed this particular responsibility. In safety
matters the line of responsibility descended from Mr Snape to the VicePresident of Engineering and then to the Loss Prevention Department.
116
Mr Snape was the most senior officer of OPCAL to give evidence and his
situation assumes special relevance in relation to the provisions about wilful
misconduct in the exemptions in the Indemnities, for the Pursuers argued that
only a decision by Mr Snape could be the wilful misconduct of the company in
respect of the indemnities. Thus it was maintained that since he was effectively
in charge of OPCAL Mr Snape’s decisions and his alone could represent the
intentional will of the company. The Board of Directors (so it was argued) had
a greater responsibility to represent the company than Mr Snape but it was said
that they had delegated the responsibility to him. I do not think that Mr Snape
alone had the obligation to answer for the acts of the Company as will, I think,
be obvious from the cases I shall review elsewhere in this opinion.
A Permit to Work system is a formal set of procedures designed to ensure
that any work carried out on the platform is done in a safe and regular way.
Because one is dealing with a dynamic and ever-changing environment the
control of work activities is essential for the safety of personnel and equipment.
Essentially it is a communications system designed to ensure that those in
control of work have the information to supervise it and that those performing
the work have a clear awareness of how the work is to be performed
particularly in respect of safety. Those in charge must have a clear idea of what
is happening on the platform so that a decision can be made as to whether or
not the work can be done safely in the particular circumstances pertaining. For
safety reasons the individual pieces of work performed on the platform require
to be correlated with care. A permit to work system is required in certain
situations by the 1976 regulations and it is also a standard of United Kingdom
Petroleum practice. Not only can permits to work be a statutory requirement
but Cancellation Certificates are in the same position.
117
4.2.2 OPCAL’s System
When the person who wants to do the work has specified what he wants
to do he takes his application for a permit to a senior manager who decides if
the work should be done and, if it is his view that it should, he issues the
general approval. In the second stage of the procedure the permit application is
taken to an operations manager so that he can check if the work can begin, that
the preparation for the work has been done properly, that it is convenient at the
time to do the work, that it will not interfere unduly with the production
operations or conflict with other work going on so as to create an unnecessary
hazard, and to lay down any specific safety precautions that need to be taken. It
is obviously important that the equipment to be worked upon has been rendered
safe before work commences. When the person in immediate control of
production is satisfied that the work can proceed conveniently and safely, the
completed permit is given to the person who is to perform the work. The work
is then performed and it is the obligation of the performing authority to carry it
out as described and in the manner specified in the Permit to Work. When the
work is completed the performing authority tidies up the site and if necessary
renders it safe. Then the operations management are supposed to check the
work and the safety of the site, and to decide if the equipment can be returned
to operations. Inspection of course becomes particularly important at the end of
the work because it is at that stage that in many cases equipment will be
returned to production. Routine or uninterrupted processes did not require a
permit but any work out of ordinary routine did. A Hot Work Permit covered
any work which carried the possibility of creating a source of ignition which
could ignite the flammable products on the platform. This would include work
118
on electrical systems and work involving the use of intrinsically unsafe
electrical equipment. A Cold Work Permit covered work that did not involve
that particular risk. Hot Work had a pink permit whereas Cold Work had a blue
permit and this was a practical way of differentiating them although of course
their contents differed. Hot Work is defined “as any work which produces
sufficient energy to ignite a flammable cloud, eg welding, burning, flame
cutting, heat treatment, soldering, grinding etc.” There were permits for access
to vessels (which have no bearing on this case) and an electrical permit system
which ensures that electrical equipment was properly isolated before work was
done on it. The permit for the removal and calibration of PSV 504 would have
been a Cold Work Permit and the permit for the projected planned maintenance
of Condensate Injection Pump A would have been a Hot Work Permit. This
distinction assumes some importance because, when Mr Bollands speaks about
seeing a permit in the Control Room shortly before the accident, he refers to a
pink permit.
In the circumstances we are considering, the approval authority would be
the Operations Superintendent. However when the task concerns more than
one group, senior personnel in each group are involved in the formulation of the
permit.
Number 14/1 of process shows a copy of a Permit to Work. There are
two sections in each permit, an application for the permit section and a work
permit section. The former section contains information on the work scope, the
location of the work, any mechanical or electrical isolation requirements, the
name and signature of the person requesting the work (the Requesting
Authority), the name (or names) of the person (or persons) who will be in
charge of performing the work (the Performing Authority), and the name and
119
signature of the Senior Manager who has approved the work scope concept (the
Approval Authority). At the top of the of the application section are boxes
indicating whether the work is for planned maintenance, inspection, breakdown
or other and the person completing the application is expected to mark the
appropriate box. Then there is a section for describing the work to be done and
the equipment to be used for it. Opposite this is a box for the expected starting
time and date. The tag number of the equipment to be worked on and the
location of the equipment are also to be filled in. The title of the person
requesting the permit has to be described and he signs the application. In the
case of maintenance work the requesting authority would normally be the
Maintenance Superintendent. There are provisions for detailing the electrical or
mechanical isolation requirements and these can be specified by either the
performing authority or the approval authority or failing these the authority
who actually grants and issues the permit (the Designated Authority).
Generally the Designated Authority would be the Lead Production Operator in
the Control Room. As the person directly in charge of production he should be
best placed to know what was happening on the platform and to decide when
and with what restrictions work could be performed safely. Indeed he has the
responsibility for making all the checks necessary for the issue of the permit
before he allows work to begin. To illustrate the matter of isolations in the case
of PSV maintenance, it would be provided that a blind flange had to be fitted to
the open pipework. The performing authority has to be specified on the
application and should that authority change there is provision for effecting
such change. In the case of the PSV work which interests us, the performing
authority would be the Score foreman. If a large number of people were to be
involved in the work the performing Authority would normally be the
120
supervisor of such persons. Thus the Lead Maintenance Technician would be
the performing authority for the planned maintenance of the condensate
injection pump since this would be a multi-trade operation. If condensate
injection pump B had seriously broken down and not merely suffered a
malfunction and tripped, then the Maintenance Superintendent would be asked
to request the permit. On the other hand in general a decision to switch
production to pump A would be an operating problem and would not require a
permit. The unloading of the reciprocating compressors is in the same
situation. However because pump A had been isolated prior to planned
maintenance the permit situation would be material to taking it back into
production. Restoring it to functioning was not merely a routine operating
procedure. Since the pump had been mechanically isolated, in that it had been
de-pressurised, and it had also been electrically isolated, to bring the pump back
into production (I shall deal with that matter in detail later) Mr Vernon would
have had to contact the Maintenance Department to ascertain the status of the
pump and then, if the response he got was positive, to arrange for any existing
permit affecting the situation to be signed-off. The electrical equipment would
have had to be de-isolated before the permit could be signed off.
In the permit there is a section for what is described as the “Safety Audit
Requirements and Precautions”. There is further provision for the detailing of
“Safety Check and Isolation Details” also “Protective Equipment Required”
and “Electrical Isolation Certificates”. In fact a check list is provided. Before
issue a declaration on the permit must be signed by the designated authority and
there is a space for this. The performing authority on receipt of the issued
permit signs a declaration that he will only carry out the work permitted by the
permit.
121
In the normal situation when the work has been completed the equipment
is given back to production. This would involve the performing authority
signing the clearance certificate on the form. In that event the Designated
authority, having checked the work and the safety of the worksite, would cancel
the permit in the section provided for this.
Under this scheme of things, when on the day of the accident Score
required a permit to carry out their maintenance operation it would have been
Mr White, the Deputy Maintenance Superintendent, who would have acted as
requesting authority and requested the permit. The permit application would
then be taken to the Approval Authority, the Operations Superintendent, for
approval and, even if the latter was inclined to grant approval, it would be open
to him to specify safety requirements. The requesting authority would have the
task of seeing that the application was in correct form before presenting it to the
Approval Authority. However it was often the performing authority who would
actually complete the permit application to be considered by the requesting
authority, presumably because they were best familiar with the work to be
carried out. Thus when Mr Rankin required a permit the application was
already made out and awaiting his attention in the Score cabin. Score
employees had been waiting some time for PSV 504 to become available and
the Score employees who had been on the platform servicing valves in the
period before Mr Rankin came on to the platform had filled in the permit
application in readiness for the availability of the PSV. Number 12/233 of
process is a copy of the application for the permit that was issued for the
work on PSV 504. Most equipment on the platform had two PSVs. On the
other hand the condensate injection pumps had only one PSV each, which
122
meant the PSV could only be maintained when the relevant pump was not in
use.
The completed permit has an entry showing the time when the permit was
issued and indicating the time over which it would be valid. The general
practice was to issue the permit just before the work was carried out because
the designated authority required to be aware of the state of the platform when
the work was to be done. Mr Henderson considered that in general the permit
would be issued at most twenty minutes before the work was to be done. When
a permit is issued before work commences the designated authority has his
own copy and a copy should be passed to the Control Room Operator for
display in the Control Room. Mr Lynch thought that if two or more permits
were interrelated they would be folded together for retention. There is a copy
of the permit retained at the job site and the Approval authority should also
have a copy which stays with him in his office. At the end of a shift (there
were two twelve hour shifts on the platform namely from 6 am to 6 pm and
then from 6 pm to 6 am) the permit had to be cancelled, or signed off (or
suspended or re-validated if work was to continue). Normally the Lead
Operator coming on duty would determine what course was taken. When a
performing authority brings his copy of the permit to the Control Room at the
end of a shift the carbonised copies of the permit are put together and the Lead
Production Operator signs them as required. Permits would generally only be
valid until the end of a 12 hour shift without further intervention. For practical
reasons some permits were not issued over the period of the normal shifts but
from 12 noon to midnight in which case of course the permit would not be
reconsidered until the expiry of its valid time. In the case of the PSV
calibration, if the valve technicians brought the permit to the Control Room at
123
the end of their day shift but were not proposing to do further work on the valve
during the night shift, the procedure was to suspend the permit over the night
shift so that it could be re-validated at the beginning of the day shift when
further work would be done. Although changes to the status of a permit were
normally made at the end of a shift this could happen at other points in the day.
If work was going on during the next shift - say by way of overtime work - the
permit may be revalidated for a specified length of time to allow the overtime
to proceed. When a permit is suspended the only requirement is for the
designated authority to retain the permit and it need not be displayed in the
Control Room. Indeed it seems that at some stage in each shift (said to be
about 9.30 or 10 o’clock) the suspended permits were removed to the Safety
Office for retention there. The purpose of the display of permits in the Control
Room appears to be to indicate to the Lead Hand what work was actually going
on on the platform during the shift. Cancellations, revalidation, suspensions
etc. were all noted on the permit and signed. A completed permit is handed to
the Safety Department for filing. Once a permit which is suspended has been
revalidated it would require to be displayed again in the Control Room. A
provision in the safety regulations that could have a particular bearing on these
cases is that the designated authority is supposed to be satisfied with the
worksite conditions before he suspends a permit. It would appear that whether
or not in practice the Lead Hand would actually go in person to inspect the site
would depend on the significance of the work being done. Thus the witness
Henderson said that if there was breach of the hydrocarbon system he would
probably go personally to look at the site - that is when he was a Lead
Production Operator.
124
The Regulations provide that a designated authority should retain
suspended permits and the defenders argued that to remove permits to the
Safety Office was not properly retention of the permits. However I think that
would be too narrow a view of the Regulations. The Regulations are in my
view concerned about the retention of the permits under the control of the
designated authority rather than that they should be left in the hands of the
performing authority who might then carry out work on them without
appropriate permission. I doubt whether it was intended to regulate the location
where permits were actually retained. The designated authority had an
opportunity for easy access to the permits until they were collected about
9.30 am or pm. If he had felt it necessary to study them he could have done so
then. One reason for the collection time about 10 o’clock was that until that
time permits were being returned after the completion of overtime. Thereafter
they remained under his control since there was nothing to suggest that he
could not have retrieved any permit that was needed and of course he required
to have them in the Control Room when arrangements were being made for the
next shift. There is no very conclusive evidence as to whether on the night of
the accident the suspended permits had actually been removed from the Control
Room about the time the accident occurred. In any event the evidence given by
Mr Bollands is that when Vernon required access to the permit to get hold of
the red tags he removed a permit from the pigeon hole where live permits were
displayed. If this evidence is correct it may suggest that the red tags in question
were attached to a live permit rather than to a suspended one but, as I shall
discuss later, there is some doubt about the position.
It is the authorised electrical person who decides what steps and how
many tags are required to electrically isolate a piece of equipment. After such
125
isolation has been carried out the lower tag portions (that is those parts not
attached to the switches) are passed to the designated authority to be attached to
the task permit. To de-isolate, the designated authority and the performing
authority sign the portion of the tags they retain (designated “Request for Deisolation”). At the time of the accident the Score employees were off duty and
thus unavailable to sign off the red tags. In such a situation, seeing that the
work was maintenance work, the Maintenance Lead Hand would act as
substitute performing authority to provide any certificates or signatures. Thus
given that the condensate injection pump was electrically isolated at the time of
the accident the machine could not be de-isolated without signatures from
Mr Vernon and Mr Clark, the Maintenance Lead Hand on duty, on the lower
portion of any applicable red tags.
It should perhaps be specifically noted that if a machine had been
electrically isolated a section of the red tag was attached to the relevant switch
gear. This meant that an electrician could not accidentally or otherwise
reconnect the electrical supply until the red tag had been revoked.
It should perhaps be noted that if a machine was electrically isolated it
was the practice for the Phase 1 operator to note this fact and the manner of
isolation in his log kept in the Control Room. If the planned maintenance of an
injection pump was proposed then the adjoining pipework would be spaded by
Maintenance before maintenance work began. However this spading was the
responsibility of Maintenance and had nothing to do with Production.
Mr Snape acknowledged that it was important for safety that the permit to
work system was supervised and that it was operated properly. Given its
central position in the operations I should have thought that this was obvious,
126
especially in the context of production operations that were essentially
hazardous.
4.2.3 Relationship of Accident to Permit to Work System
The pursuers’ operation of the Permit to Work system is relevant to the
case since the defenders aver that OPCAL knowingly and persistently
disregarded the system and that if the accident did occur as the pursuers allege
it was caused by this aspect of the system. This of course would have a bearing
on any liability under the indemnities since the defenders contend that a
persistent and knowing disregard of the system would constitute “wilful
misconduct” in terms of the indemnities. The defenders aver that the pursuers’
Permit to Work system “was a formal written system which was intended to
control certain types of work which were potentially dangerous. Within that
system the permit was a formal written means of making sure that potentially
dangerous jobs were approached and carried out with the use of appropriate
safety procedures”. Up to that point I doubt if there could be any objection to
what is averred. Then a specific attack on the operation of the system is
pleaded. The defenders say that the pursuers “failed to give operatives arriving
on the Piper Alpha Platform adequate induction training in the Permit to Work
procedure and shift handovers”. The defenders’ averments proceed as follows;
“they failed to enforce the proper operation of the said procedures by persons
working on the Piper Alpha Platform. By 6 July 1988 the operating staff on the
Piper Alpha Platform had no commitment to working to these written
procedures, which were knowingly and flagrantly disregarded”. Some
specification of particular lapses in the operation of the system follows. It is
averred “The procedure required that the Performing Authority take the permit
127
to the Approving Authority in person but this was often not done in practice.
The pursuers’ practice with respect to the completion of Permits to Work in
about July 1988 were subject to numerous errors in completion of the various
details” and some of these errors are specified. It is also averred “the precise
nature of the tasks to be carried out were not always set out on the permit by the
Performing Authority”. Then “Section D10 of the permit form employed by
the pursuers asks ‘Is there any work which may affect this work?’ This section
was seldom used”. Then “Contrary to the written procedure multiple jobs are
undertaken on a single permit. Contrary to the written procedure the
Performing Authority’s copy of the permit was frequently not displayed at the
job site”. (The only evidence of this was that on one occasion Mr Snape
discovered that an operative was not displaying his permit but had it in his
pocket). Then there are averments that instead of the Performing Authority and
the Designated Authority meeting to sign-off permits the former would often
leave them on the Control Room desk for the later attention of the latter. There
was also an averment “Designated Authorities would regularly (but not always)
sign off permits both for completion and for suspension prior to having the job
site inspected. This was contrary to the pursuers’ procedure”.
There were further allegations from the defenders in relation to the
monitoring and auditing of the relevant safety systems. Thus it was averred
“As at 6 July 1988 the operation of the PTW was not being adequately
monitored or audited by management. The system was operated routinely in a
casual and unsafe manner”.
It must I think be emphasised that OPCAL ‘s safety system may have
been far short of exemplary but I am not here to make a general value
judgement in that respect. The only departures from good practice that are of
128
interest in this Proof are such as may have led to the accident. I think the
defenders well recognised this. They aver “Had the pursuers implemented their
own Permit to Work system then Robert Vernon would have been aware at the
material time that PSV 504 had been removed and not replaced”. The
defenders’ main case is of course that Vernon well knew that the PSV was
missing but decided to ignore this. Their alternative case is that, if by chance
he did not know, then that was because of the faulty operation of the Permit to
Work and handover systems.
It should perhaps be noted that no-one is claiming that work was ever
carried out with no permit to work at all. Moreover the defenders’ attack is not
on the system itself but on the way it is operated. Further the defenders
maintained that the general slackness concerning the operation of the permit to
work system reinforces the likelihood that Mr Vernon had not followed the
system properly. However it must be observed that there was no evidence that
Mr Vernon habitually committed the sort of serious irregularities which the
defenders seek to attribute to him on the occasion of the accident. Indeed for
example there was no evidence that he or any of the Lead Production Operators
habitually failed to carry out the required Site inspection. The evidence of
habitual inadequacy in the permit to work system largely relates to various
irregularities in filling in the detail in the forms.
I do not consider that the case based on the defenders’ averments that the
induction training was ineffectual was very significant. There is no apparent
relationship between any such training and the accident. No-one presented
evidence that Mr Rankin or Mr Vernon or Mr Clark or indeed any of the other
persons who may have been involved in the accident were not properly trained.
Indeed Mr Rankin and Mr Sutton were not even employed by OPCAL. There
129
were no averments as to the practice for induction recognised as good and
practicable by the Offshore Industry nor as to how an improvement in that
practice would have affected the accident. The best that the defenders can
make from it is that the indifference of OPCAL to training illustrates that the
departures from general safety procedures (which the defenders claim
happened) were chronic and thus a mark of an intentional general indifference.
It should be noted that there was some evidence about inadequacies in
OPCAL’s induction arrangements from Mr Thomson, who was a rigger
employed by the Wood Group. We do not really know what training such a
rigger would require and to what extent any such training was in practice
expected from OPCAL rather than his employers (as provided in their
contracts). A Mr Elliot, a foreman rigger, also gave evidence that he had
received no formal training but he did concede that an Oxy representative had
taken him through the system.
A witness, Mr John Wood, gave evidence about training. He was a
Diving Technician employed by Messrs Stena and he indicated that he had not
received training when he first came aboard Piper Alpha. However he accepted
that he had been trained when he had previously worked on the Claymore
platform and he indicated that it was assumed that this training was good
enough. There was no evidence that this assumption was unjustified.
The last witness speaking to training was Mr Fowler, another employee of
Wood Group. He was a joiner who first worked on Piper Alpha in 1980. He
claimed to have received no training when he first worked on the platform.
Further he accepts that he was not one of the authorities required to regulate the
permit to work system but just one of a number of men who had to work under
130
permits. He gives some indication that perhaps over the last two years of his
work on Piper Alpha there was some sort of formal training system.
In relation to the Score contract OPCAL had extensive discussions with
their representatives before they began any work on the platform and during
these discussions various safety matters were discussed. It is worth noting in
this connection that within Score’s Container Mr Rankin had been provided
with a check list of his responsibilities under the permit to work procedure.
At the end of the day it can be asked just what knowledge that might have
been acquired in training and which was lacking contributed to the accident. I
do not think that this was ever established.
There seems to be no doubt that on occasions the Performing Authority
did not take the permit personally to the Approval Authority for signature. For
example Mr Lynch said that if there was a sudden need for a permit in the
middle of the night he might sign the permit ‘pp’ for the Production
Superintendent and get him to accept it in the morning. Thus occasionally the
designated authority would sign for the Approval Authority if the latter was off
shift. Clearly there must be occasions when general practical considerations
make it tempting to adjust the strict written procedures. If there is no loss of
safety then it would be difficult to contend that this in itself was a departure
from good and proper practice although such a judgment may depend on the
individual circumstances of a situation.. Any such departure should, if tolerable
at all, be exceptional and be acceptable to the management. In a dangerous
environment like an offshore platform it is important that the carefully evolved
safety procedures should be carried out strictly. It may well be that Mr Lynch
only refrained from waking up the Production Superintendent if he considered
that the circumstances of the case made it perfectly reasonable and safe to do
131
so, and that the practice in such circumstances was acceptable to the Production
Superintendent involved. However I need not form a concluded view as to
whether even the minor degree of irregularity Mr Lynch spoke to is tolerable in
safety terms since there is no obvious connection between this limited
deviation from the strict procedures and the accident. Moreover if such practice
was followed widely there is no evidence that the senior management above the
Production Superintendent would have known this. Two permits were
produced where this problem appears to have occurred.
A number of Permits to Work were recovered after the accident and about
34 of these (all relating to a period of about two weeks before the accident)
were produced in an effort by the defenders to demonstrate that the system was
not properly operated. The permits I refer to were in a bundle of documents
number 15/4 of process. These permits would be part of the 120 or so permits
that would have been issued during the period being considered. There is no
doubt that the permits produced had not all been properly completed and that
their review shows that a degree of irregularity in the completion of some
permits was a recurring phenomenon at least in the period just before the
accident.
It has to be noted that the departures from the strict completion of permits
are for the most part not such as to show a total disregard for safety on the part
of the persons responsible for the permits and I can accept that in most cases
they would have believed that the irregularities were minor and
inconsequential. However that does not mean that if a system as important to
safety as the completion of permits has been laid down personnel should depart
from the system. If the permit forms were unnecessarily complicated (as
Mr Snape thought that they might be) then the proper approach was to modify
132
the permit system. Some of the irregularities that were allowed (albeit a
minority) could in some circumstances have had serious consequences although
this might not have been the view of the operators concerned. Senior
management who spoke indicated that they would not approve of the permits
being filled in irregularly in any respect and I think it must be assumed that
they did not know of the fact that permits were not being completed properly.
However this does not reflect well on their supervising and safety auditing
arrangements. In respect of the failure to complete permits properly many of
the permits produced showed that the boxes intended to indicate that the permit
was for planned maintenance, inspection, breakdown or other had not been
completed. All that was required was an appropriate tick. No doubt the terms
of the work to be done as spelt out in the permit itself would make it fairly clear
what category of work the permit referred to but the authors of the safety rules
obviously thought that it might be beneficial to have an immediate reference to
the category of work covered by the permits. Indeed this may have been for
administrative rather than safety reasons and some of the operatives thought
that this was so.
A number of permits had times of various incidents such as the date or
time of signature or the expected starting date which for whatever reason were
obviously inaccurate or irregular. Sometimes the time of the permit’s validity
is not clear. The times ascribed to isolations did not always correspond to the
times of the issue of a permit. Timings on the face of the permit did not always
show a logical or acceptable chronological sequence. I suspect that many of
these irregularities were due to inaccuracy in the completion of the permits
rather than unsafe working practice but of course the permit is intended to
ensure that this can be checked. There were five permits which did not have an
133
estimated starting time and two of the rigging permits did not have an estimated
starting date or time. Some of the isolation certificates are ambiguous.
However if a person has need to know if a piece of equipment has been isolated
the tags and listing attached to the permit would make this quite clear. In any
event there is no suggestion that the work was ever authorised to proceed
before necessary isolations had been effected. In fact the evidence points in the
other direction. Thus there were four permits where ex facie there may have
been irregularity about the completion of gas tests but the evidence was clearly
to the effect that the work would not have been allowed to proceed until such
tests had been carried out. There may have been some confusion as to just at
what point the gas tester should sign his certificate. Moreover sometimes
permits appear to have been cancelled before the de-isolations. Nevertheless
the work would not be returned to Operations until the de-isolations had been
signed off. As Mr Sneddon said, there is no danger in a delayed de-isolation.
Other permits, and this is perhaps the most serious departure, did not have
certificates (such as statements as to the safety of the work) adjusted to make it
clear ex facie just what the certificate was saying. Thus for example in terms of
the certificate it would not be possible to tell if the work had been left in a safe
or unsafe condition. Of course the safety implications of this can be
exaggerated since the Operators might well have known in what circumstance a
designated authority would append a signature to such a certificate. This matter
of incomplete certificates was certainly very general and few of the permits
produced had their certificates accurately completed. There was evidence that
the Designated Authorities did not in fact cancel certificates until the work was
safe. In one permit there was reference to work on 5 separate PSVs and strictly
there should have been 5 separate permits taken out. However as Mr Sneddon
134
and Mr Henderson both say it was in fact only one job since the valves related
to the same machine so that there may well have been a serious question as to
the proper practice. An omission relating to an isolation requirement could
arise because the person raising the permit might not have been certain that
isolations were required. The safety requirements can be filled in later by the
Designated Authority. The main function of the Approval Authority is to
approve the workscope and detailed safety requirements can often be better
considered by the Designated Authority. In some cases a number of persons
were nominated as Performing Authority and we were told that this would be
likely to refer to protracted work such as planned maintenance when a number
of different operatives might be expected to be involved in the work.
Nevertheless this practice could result in a lack of clarity. Sometimes if there
had been a transfer of authority the appropriate box had not been completed.
With other permits the time of an extension had not been completed properly.
In other cases cancellations or suspensions had not been properly dealt with in
the formal sense. In one permit there was a reference to there being other work
which could affect the work being done under the permit without that other
work being specified although again it was claimed in the evidence that the
nature of the work would be known. In fact the work in question was major
work in the Gas Conservation Module which would have been known about
throughout the platform. Most of the permits scrutinised had at least one
irregularity. In general the Operators appear to have paid attention to the main
features of the permit system and to have carried out the main safety
requirements of the system but nevertheless to have been slack about certain
elements of the detail. A number (but not all) of the irregularities could be due
to clerical error. However there seems to be little doubt that the more formal
135
parts of the system were regularly ignored basically as a corner cutting exercise
rather than a conscious disregard of safety. As far as concerns those actually
completing permits I doubt if there was any intended departure from safety
standards. It clearly was assumed, probably wrongly, that the omissions in the
permits were not such as could affect safety (at least in the majority of these
cases). On the other hand as far as management are concerned the omission to
control the operation of permits is more serious since it is their responsibility to
see that their own procedures are implemented. Moreover they had Lead
Production personnel who as designated authorities and line managers should
have been controlling the completion of permits and their certificates in the first
instance. There were more senior production personnel who should have been
in a position to supervise the Lead Production personnel’s control of the
system. In fact they did not seem to have any structured system for monitoring
the detailed operation of the permit system. OPCAL also had Safety Officers
on the platform and it might have been expected that they would have noted
any recurrent irregularities in the system. Mr Snape certainly expected that the
Safety Department would have been monitoring the permits but it rather looks
as if his confidence was misplaced.
Mr Todd the Maintenance Superintendent gave evidence and he accepted
that it was part of his function to ensure that the men in the Maintenance
Department operated the Permit system properly. Indeed the duties of line
management in this regard are set out in 13/60 of process which was issued by
OPCAL to all employees and which was entitled “A Statement of Policy on
Health and Safety at Work with related implementation responsibilities and the
System for Monitoring and Control”. A number of the permits produced which
had irregularities were concerned with the Maintenance Department. Yet he
136
does not recall ever having been instructed by management to carry out spot
checks. It can be implied from the terms of his evidence that he himself did not
take the initiative and carry out spot checks.
It perhaps ought to be noted that Mr Vernon and Mr Lynch both appear as
Designated Authorities in some of the defective permits. It also has to be noted
that what were produced are about 34 permits when in the course of a year three
to five thousand might be issued. However most of the permits relate to a short
period of some two to three weeks before the accident. During that period there
was intensive work going on in relation to the switch from Phase 2 to Phase 1.
I think the reality is that the permit to work forms could have been
improved and simplified without any sacrifice of safety. Mr Snape recognised
as much. Nevertheless the fact remains that it was not for operatives to devise
their own practice in respect of how they operated the system. Mr Snape
acknowledged this. Moreover he accepted that certain irregularities such as not
making it clear if a permit had been cancelled or suspended were so serious that
they could not be condoned. However in most cases the men were no doubt
paying regard to safety in the practical sense but not completing the permits
properly. I think it would be impossible to conclude from the relatively small
number of permits that were produced that it was common to find a production
operative knowingly carrying out an operation in a dangerous manner.
Nevertheless it is apparent that at least during the period just before the
accident the production operators were not paying sufficient attention to detail
when they completed permits and certificates. It also has to be emphasised that
the platform work was carried out in a difficult environment, with much noise,
vibration, awkward protective clothing and exposure to the elements so that a
temptation to take shortcuts in regard to any seemingly formal requirements
137
had to be allowed for. On the other hand perhaps this made careful monitoring
all the more essential.
4.3. Handovers
4.3.1 General
When a shift was reaching its conclusion it was necessary that the
incoming employees on the new shift should be made aware of anything going
on on the platform that might concern them. Thus there was a system
whereunder certain employees had a handover procedure with those coming on
duty. Thus in particular the Lead Production Operator going off duty would
have a handover with his equivalent coming on duty. This of course has special
significance in this case in relation to the handover that occurred between
Mr Vernon when he came on duty on the evening of the accident and Mr Flook
the Lead Operator who was on duty before him. Clearly the information which
Mr Vernon received or ought to have received could have a bearing on
Mr Vernon’s knowledge of the status of the PSV 504 at the time of the accident
and this bears upon what he might have been doing later. Mr Snape had no
hesitation in stating during his evidence that “Obviously it was important for
information to be passed from an outgoing worker through to an incoming one
on the job that was to be done and how it was to be done”. There is of course
some interconnection between the Permit to Work system and the handover
system given that both systems are designed to ensure the passing of relevant
knowledge.
The defenders made the point that in respect of the handover to
Mr Vernon he was not only coming on to a new shift but indeed was
138
commencing a new tour of duty so that he should have been particularly
concerned to acquaint himself with what was happening on the platform.
(-----).
4.3.2 The System in Operation for Production
The outgoing operator would have the currently live permits sorted out on
his desk according to the various disciplines and these would be left to await
the performing authorities coming to the Control Room to have them regulated.
The day shift handovers between Lead Production Operators generally took
place in the Control Room between about 5 pm and 5 .30 pm. The performing
authorities generally came to the Control Room nearer to 6 pm since their shift
did not finish for practical purposes until about 5.30 pm. There were no written
guidelines issued by OPCAL in relation to procedures for handovers. The
Phase I, Phase II, and Control Room Operators all kept logs and the witness
Mr Henderson explained that, if he had been an outgoing Lead Production
Operator, he would have looked at these prior to the handover to see precisely
the work which had been going on. (-------) The Lead Operator could instruct
the Control Room Operator to make particular entries. However the Control
Room Operator would be logging material relevant to the production processes
and would not be expected to log maintenance matters. Mr Henderson also had
the practice of taking a general walk-about before the handover to see how
matters stood. Mr Lynch on the other hand although he also had a walk-about
did not do this until the beginning of the new shift, although it is perhaps not
clear whether he did this before or after he had dealt with the incoming permits.
His walk-about normally took about 20 minutes. Having taken the live permits
from the pigeon holes where they were kept displayed Mr Henderson would
139
look at them. He found that a handover would normally take about 20 minutes
although Mr Grieve thought that a handover could take up to 30 minutes if
there was any problem. I accept these figures as approximately accurate. Most
witnesses thought that it was the incoming Lead Production Operator who
suspended permits. Mr Lynch initially took a different view but eventually
agreed that he was not sure. Indeed in general Mr Lynch was not as clear in his
recollections as some of the other production witnesses. I think it is likely that
the normal practice was that it was for the incoming Lead Production Operator
to suspend the permits because normally it would be late in the preceding shift
when the performing authority appeared. The outgoing Lead Operator was
usually free to finish his shift about twenty minutes to six. However it has to be
emphasised that on occasions permits were signed off or suspended in the
middle of a shift when the progress of the work rendered this convenient. The
outgoing Lead Production Operator would keep a note pad on which he would
note anything significant arising from his walkabout, or reading of logs and
permits. There would generally be a timed series of events recording the
activities on the platform during the shift relevant to production. The log if
kept properly should conclude with a note of the status of equipment which had
been worked on. (--------) He would explain anything significant directly to
the incoming Lead Operator. The handover would not cover every event of the
day but what was considered to be significant. Not only the lead operators but
the ordinary operators would handover to each other detailing what was a
material note in respect of the preceding shift. In this respect they would pay
regard to the logs they kept. It seems clear that during what may generally be
described as the handover hour between 5 and 6 pm there would not be much
time for the outgoing Lead Operator (or for that matter the incoming Lead
140
Operator) to go out onto the platform to inspect individual jobs. The
impression left by the evidence was that in practice the obligation for a Lead
Operator to inspect the site was not always scrupulously adhered to but rather
the Lead Production Operators would exercise their judgment as to when and
how to make such inspections. On occasions they would rely on an Operator’s
report as to the condition of a site. However if a Lead Production Operator did
require to go out onto the platform to inspect particular work he could be
radioed to return to the Control Room if he was required urgently to attend to a
permit. However he would generally be in the Control Room at the time of his
handover to attend to the considerable duties he had at that time. Indeed the
busiest time in the Control Room was towards the end of the day shift. A great
deal of the work on the platform was performed during the day shift and at the
end of the shift those performing the work would resort to the Control Room to
have their Permits to Work attended to. (--------)
(--------)
Once the handover had been completed the incoming Lead Operator
became the designated authority and in immediate charge of production.
4.3.3 Maintenance Handovers
The procedure for handovers between Superintendents in the Maintenance
Department was described by Mr Todd who no doubt gave accurate evidence
on this matter. He was a Maintenance Superintendent at the time of the
accident and on the day of the accident it was he who had handed over to the
late Mr White who had come onto the platform and taken over from him on the
evening of the accident. The normal procedure was to do a written handover
and this would contain a note of the on-going work. Again the written material
141
was set out on a note pad and this would normally contain a list of outstanding
work, the plans for the next few days, and any problem areas as well as safetyand personnel-related items. Any points requiring clarification would be
discussed and, if the incoming operator thought he should see any piece of
equipment, he would go and inspect it. The note pad was left with the
incoming person. The handover took place in the Maintenance Office and
would take place at the end of a spell of duty since only one Maintenance
Superintendent was on the platform at one time. The Maintenance
Superintendent who was on duty would each day in the morning attend the
handover between the night shift and day shift lead maintenance technician.
The problems during the night shift were discussed, as was the plan of work for
the day. There was also a meeting in the Maintenance Office at the handover
between the day shift and the night shift but Mr Todd would not attend the
whole of that because he had to attend the Offshore Installation Manager’s
(OIM’s) meeting which took place about the same time. However he did
normally manage to attend part of the evening handover meeting. Mr Todd’s
hours of work were from 6 am to 6 pm but he often worked as late as 11 pm or
midnight. If the Maintenance Superintendent wanted a major piece of
equipment for maintenance purposes there would be a discussion between him
and the Operations Superintendent and also the OIM as to when it could be
made available.
Mr Clark, the Maintenance Lead Hand on the night of the accident, also
gave evidence about Maintenance handovers. He confirmed that there would
always be a meeting with the off-going and the in-coming person at the end of
each shift. This is the meeting referred to by Mr Todd and takes place in the
Maintenance Control Room. The in-coming person would appear for the
142
purpose of this meeting about 5 pm or am, as the case might be, and then the
handover meeting would take place about 5.30. On the night of the accident
Mr Clark had taken over from Mr William Smith. It was maintained by
counsel for the pursuers on the basis of Mr Clark’s evidence that the incoming
Lead Maintenance Technician would not know any work that had been carried
out during the day by independent contractors such as Valve Contractors.
However it is obvious that any such work that might affect Maintenance ought
to have been communicated to him at the handover. Specialist contractors
reported to the Maintenance Superintendent and the Maintenance Controller.
This was because the Maintenance Lead Technician would have no
responsibility for supervising such work. However I think it could be expected
that a reasonably careful Maintenance Supervisor would ensure that any
information coming to him that would affect Maintenance, particularly in
regard to safety, would be passed down the line to those who might require to
know about it. On the other hand Maintenance does not itself have
responsibility for the actual conduct of independent contractors’ work since it
has no participation in the Permit procedures. His function is primarily that of
contract control and he reports the state of matters to the beach. However Mr
Clark himself refers to the fact that in addition to the continuing notes kept by
the Lead Maintenance Technicians (and a diary which was also kept) he
sometimes got notes from the Maintenance Superintendent. Thus the
Maintenance Superintendent had the means of passing down significant
information and at least occasionally did so.
In the case of the work done on PSV 504 which had been removed and
not replaced on the evening of the accident, Mr Rankine, the witness who was
an employee of Score and in immediate charge of the operation, indicated that
143
he had not in fact passed the status of the valve at the end of the shift to
Mr White the acting Maintenance Superintendent but had passed on the
information to Mr Smith, the day Lead Maintenance Technician. This was
done, he said, in the accommodation recreation hall about 6.30 pm which
would be after any shift handover had been completed and at a time when
Mr Smith would be off duty. Mr White for his part, although he would have
seen the permit to work application earlier in the day, would not know if it had
been approved or issued. Mr Clark claimed that he did not know that the PSV
was off the pipe system although he was challenged on this in crossexamination. However Mr Clark was asked just before the accident to sign off
tags so that electricity could be restored to the condensate injection pump and if
it is true that he did not know about the valve maintenance work he must
certainly have assumed that the electrical isolation was connected with the
planned maintenance.
Mr Clark stated that he would at handover discuss with his back-to-back
the work which was intended for the week and any problems this might entail.
They might also discuss imminent work and priorities. A worklist was kept on
a note-pad which was updated on a daily basis. The individual jobs would be
highlighted on this as work progressed. The jobs to be completed would be
taken from a Maintenance Departments Print-out. This handover would also
take 15 to 30 minutes.
The maintenance technicians who were acting as a performance authority
would have to get their permits to work treated by the Lead Production
Operators in the Control Room in the same way as would Production
Operators.
144
4.3.4 The Sutherland Case
0n 7 September 1987 a Mr F Sutherland, who was at the time employed
on Piper Alpha as a rigger, was killed in an accident while working in Module
A. Because of this fatality the pursuers were prosecuted under section 3(1) and
section 33 (1)(a) of the Health and Safety at Work Act 1974. As the defenders
aver, the Complaint to which the pursuers pled guilty on 17 March 1988
referred to failures in the Permit-to-Work system and to inadequate
communication of information at handovers. The defenders claim that the
Operators of the platform failed to improve their systems in respect of the
matters raised by the criminal proceedings and that in any event they failed to
enforce any changes made. It is said by the defenders that the pursuers’ said
failures were equivalent to wilful misconduct in terms of the indemnity
contracts and so the precise details of the Sutherland accident and prosecution
assume some importance. The essence of the defenders’ position is that the
platform’s Operators deliberately failed to take the measures which the
Sutherland enquiry showed to be necessary. One sequel to the fatality was the
issue of advice by Mr J L McAllan, Occidental’s Production and Pipeline
manager to all OIMs on 24 September 1987 in which he emphasised that
persons filling out permits to work should be encouraged to be more specific in
detailing the job description. The defenders’ case is that this advice was simply
disregarded and no effective steps were taken by senior management to ensure
its implementation. Mr McAllan worked on the beach and had a general
responsibility for production on all the platforms. (The organisational structure
of OPCAL is set out in the Organisational Chart which is number 13/62 of
process). Another suggested failing on the part of the Operators was that
following the Sutherland tragedy they issued instructions to rigging supervisors
145
referring to the assessment of the job by rigging foremen and the raising of
permits for certain categories of lift. The pursuers’ response is that the
consequential measures adopted by the Operators was appropriate and
sufficient.
In any survey of responsibility for the consequences of the Sutherland
fatality some account must be taken of OPCAL’s management structure. At the
top of the tree was the President and General Manager who until very shortly
before the accident in July 1988 was Mr Snape. Immediately below were a
series of vice-presidents. At the relevant time the Vice-President of operations
was a Mr McReynolds and Mr McAllan reported to him. The Vice-President of
Engineering was a Mr Grogan and below him there was a Mr Gordon who was
the Loss Prevention Manager. Further below in the engineering structure was
the Safety Superintendent, Mr Boden. He divided his time between the beach
and the platform. Thus Safety was kept separate from Operations and in effect
Engineering was divided into Facilities Engineering, Petroleum Engineering
and Safety. The Safety Engineer onshore was a Mr Latham. The managerial
hierarchy could be significant since questions arose in the case about the level
of responsibility which could attract the application of the provisions about
wilful misconduct in the Indemnities.
In my view it was clearly made out that Mr Sutherland was killed because
he stood on a platform that was not safe for that purpose. He was a rigger and
his accident took place on 7 September 1987. After the accident OPCAL
carried out their own enquiry and a Mr Jenkins of the Health and Safety
Inspectorate also investigated the matter. He gave evidence and his report was
produced. It is plain that the accident to Mr Sutherland happened because the
platform he was working on was not bolted and moreover was corroded. The
146
task being performed by Mr Sutherland had been lifting a heavy motor and the
men involved in this had among themselves changed the method by which the
motor was to be lifted thus exposing the deceased to the danger which caused
his death.
Above the motor being lifted there was a canopy to prevent fluids
dripping onto it. This canopy consisted of a number of panels. To obtain
access to the motor it was necessary to remove a hatch and also to remove
panels from the canopy. About 7.30 am on the day of Mr Sutherland’s accident
it was noted that the bearing on the motor was overheating and thereafter the
pump, having been closed down and isolated, was handed over to the
Maintenance Department for remedial work. Mr Thomson, OPCAL’s Lead
Maintenance Technician, assigned the work to Mr Edwards a Maintenance
Engineer but did not at the time visit the site himself. It was ultimately decided
that the motor would require to be lifted and Mr Thomson obtained the
assistance of riggers for this purpose. The riggers devised a method for
hoisting out the motor. About 17.30 hours it became necessary for the day shift
workers to hand over the said task to the night shift. Mr Thomson handed over
to Mr Taylor the night shift Lead Maintenance Technician. The deceased, a
rigger, was one of the crew of men who were working on the motor lift on
night shift. As the night shift crew proceeded with their work, Mr Brewer, a
Maintenance Technician, who was one of the team decided that he was not
happy with the method that was being used to lift the motor because he had
previously had a bad experience with that method. The proposed change of
method was not discussed with Mr Taylor. Thus the men on the site
themselves decided to change the method that had been laid down by the day
shift. The method they proposed to employ was contrary to standing
147
instructions other than for vertical lifts. Taylor had in fact visited the site prior
to the commencement of the night shift work but had not noticed that the bolts
on the canopy were not in place. As a result of the change in lifting method
Mr Sutherland went on to the canopy to attach clamps to eye beams and this
brought about his accident when the canopy collapsed. As a result of this
collapse he fell some distance to the deck below and suffered injuries from
which he died. The change in the method of work had occurred because of
failure of communication and supervision following upon a handover. The
Lead Maintenance Technicians had effected their handover in one location
whereas the men in the crew had carried out the handover in another place and
without proper supervision. However on the evidence before me it was not
clear how all those involved could carry out their handover in the one place so
that at the root of the accident was a failure of the Lead Maintenance
Technician to keep abreast of what was happening. Moreover he had not
checked the site and thus not noticed an obvious danger.
The responsibility for OPCAL’s internal enquiry into the death of
Mr Sutherland was left to Mr Grogan but he kept Mr Snape informed. Three
investigators were appointed and one of these was a solicitor. I have certainly
no evidence from which I could conclude other than that the investigators were
competent to carry out the task entrusted to them. The initial report to
Mr Snape was verbal because, before the investigators issued their final written
report, they required to instruct certain technical investigations to be carried out
by Robert Gordon’s Institute of Technology. Indeed because of this it took two
months before the written report was available. When he discovered the results
of the internal enquiry Mr Snape had a series of discussions with his senior
managers with a view to deciding what could be done to avoid a similar
148
accident in the future. I had no reason to distrust the evidence of Mr Snape that
he personally was anxious to take such measures as were necessary to eliminate
the kind of situation which had caused the accident. Mr Snape read the results
of the Report as showing that the accident happened because of a failure in
supervision and that OPCAL had platforms that were from time to time used as
workplaces which were not designed for that use and therefore were not safe
when used in that way. In fact it emerged that the said canopy had been used as
a working platform over a period of about ten years. Accordingly a survey was
instructed to ensure that there were no similar cases. Moreover an audit of
supervision was instructed. The management requested that there should be
more detail of the proper working method in permits to work and recommended
tighter communications between the worker and his supervisor. The
improvement of rigging procedures was also identified as an area for action.
Consideration was to be given to the adequacy of the handover procedures to
prevent such accidents. In an oblique way the accident also pointed to a failure
in the operation of the permits to work in that the change to the working
methods should have been added to the permit. However the Report saw the
accident as really highlighting a supervision problem and the investigators did
not recommend any change to the permit to work system. Mr Snape accepted
that there were failures by the Company in relation to the Sutherland case.
There had been a failure to supervise the work, to check the worksite, and also
a failure in the job specification on the permit to work.
In answer to the defenders’ suggestion that the Operators had failed to
learn and act upon the lessons of the Sutherland case the pursuers argued that
the problems highlighted by that case related to the setting out and supervision
of work procedures. OPCAL’s own Report concluded, with relation to the
149
cause of the accident, that the incident occurred inter alia because of poor
design and lack of maintenance and inspection of the canopy structure. The
Report also concludes that the extension of the original work to the extent that
it required the lifting of the motor did not alert the Supervisor to the additional
measures that might have been taken to ensure the safe conduct of the new
workscope. The Report makes recommendations for improving the system.
Among other things it makes recommendations for the supervision by the
Facilities Engineering Department of structural additions and alterations. Then
there was a recommendation that the survey, that I have already referred to, be
initiated. There was a recommendation that supervisors should be reminded of
their responsibility to inspect sites before the commencement of work, with
particular emphasis on the access to and egress from areas involving work at
height, and also to remind their work force as to the specific requirements of
each job and as to the need for approval of any changes to these. There were
also recommendations in respect of the rigging procedures. Although permits
to work were not mentioned specifically, the Company accepted that there was
a need to improve the specification in these of working methods. The said
Report made no recommendations in respect of the handover procedures. The
issues arising from the Report bore no relationship to the problems in the
present cases which relate to the transmission of information about the status of
plant from one shift to the other. If there were deficiencies in the permit to
work in the Sutherland case they were that the permit did not specify that
riggers would be required. The pursuers also deny that the Operators’ response
to the Sutherland case displays a cavalier approach to safety. It certainly seems
to me that even if the handover had been perfect Mr Taylor would not have
known that Mr Thomson’s working method was going to be changed without
150
reference to him. Of course it could be said that if he had inspected and
supervised the job the events leading to the accident could have been avoided.
Even if OPCAL’s perception as to the problems that caused Mr Sutherland’s
accident and the procedures needed to avoid a similar accident were wrong, I
could not conclude that their views were untenable and not genuinely held.
In setting out the steps that OPCAL took to respond to the problems
thrown up by the Sutherland situation the pursuers relied on a number of
reports and Minutes of meetings. However the defenders made the point that
certain of these documents had not been spoken to as to their nature and that
therefore I was precluded from looking at these. Indeed the defenders point
out, and level it as a criticism, that nobody from the safety side of the
defenders’ organisation was called as a witness. Not only could such witnesses
have been examined as to OPCAL’s safety arrangements and their responses to
problems but there were such witnesses who could have spoken to the
unvouched documents. I think that technically the defenders are right in
respect of their objection to documents unspoken to by any witness. Such a
document is merely a piece of paper until its identity is established. As it
happens I do not think that the point is very significant. Mr Snape spoke about
his own knowledge of the Operators’ general approach to the safety situation
and as far as his evidence went I think that it was reliable without being
confirmed by documentation.
However the pursuers relied on the documents in question to establish the
Operators’ concern and good faith in improving safety and in case I am wrong
in rejecting the unvouched documents I set out the relevant import of the
documents in question. In a memorandum to the OIMs on Piper and Claymore
dated 24 September 1987 Mr McAllan made certain suggestions for the
151
improvement of procedures (number 12/407 of process). In this in addition to
other measures proposed, the author recommended that the permits to work
should give more detail about the job description. Moreover it was suggested
that the designated authority should satisfy himself that all aspects of the job
had been covered by asking questions at the time of the issue of the permit to
work. It was claimed that there is no evidence in the terms of this
memorandum of an indifference to security. In fact the memorandum
purportedly had been sent before the formal Report of the investigators was
available. The aim was to effect an immediate improvement. Moreover
Mr McAllan’s memorandum had been sent after discussion with senior
personnel.
A further memorandum was said to have been sent on 12 October 1987 by
the Safety Supervisor to all departmental supervisors (number 12/410 of
process). This followed upon a supervisors’ safety meeting on 4 October. This
was designed to formalise procedures for identifying dangers such as the said
canopy. The significance of this again is said to be that it shows that the
Operators were not simply ignoring the lessons to be drawn from the accident.
A further memorandum was said to have been sent on 21 October 1987 by the
OIM on Piper to rigging personnel with a view to tightening up rigging
procedures. This also provided that permits to work should be raised for certain
categories of rigging work. If this instruction had been in place at the time of
the Sutherland accident it would not have been possible to change the lifting
work method without reference to a supervisor. Thus it was claimed that in
changing the rigging procedures OPCAL were clearly addressing themselves to
at least some of the implications of the accident. These steps were taken before
the issue of the formal Report and indeed Mr Snape said that the Report told
152
him nothing that he had not already discovered. Number 12/412 of process are
said to be Minutes of a Supervisors Safety Meeting on Piper on 1 November
1987. This indicates that the meeting was chaired by the Piper OIM. Copies of
these would go to Mr McAllan and Mr Boden but Mr Snape would not
necessarily see them. These Minutes purport to show that, following upon the
accident, improvements were needed to what was called the defects book and to
rigging procedures. Number 12/417 of process are said to be Minutes of the
Safety Co-ordination Committee dated 17 November 1987, which committee
was a level above the Supervisors’ meetings and met monthly. There was also
a Management Safety Committee which was often chaired by Mr Snape. This
was the controlling safety group in OPCAL and would see the Minutes of the
Safety Co-ordination Committee. The said Minutes showed that steps had been
taken to inspect areas on Piper where access was not allowed and recorded that
more details were by that time put on permits. These steps were said by the
pursuers to have been taken in response to Mr McAllan’s earlier memorandum.
Number 12/413 of process are said by the pursuers to be further Minutes of a
meeting described as a Maintenance Safety Meeting and chaired by Mr Todd, a
Maintenance Supervisor. The date shown was 4 December 1987. Copies of
this are sent to the beach. The chairman is shown to have asked all present to
comment on any possible improvement to safe working practices and indicated
that on no account should “chances” be taken. The fact that changes to rigging
practices had been by that time put in place was discussed. Number 12/414 of
process are said to be Minutes of a further meeting of the same committee on
9 January 1988. The chairman was shown as the OIM and to have opened the
meeting by indicating that it was an aim for 1988 to improve safety
performance and he detailed how supervisors could help in this respect.
153
Number 12/418 of process are the Minutes of the Management Safety
Committee which met on 3 March 1988. Mr Snape attended that particular
meeting. It is clear that Mr Snape raised the question of the points brought out
in the Report and wanted a report prepared of actions that had been taken. In
fact Mr Snape wanted to be sure that the action needed after the Sutherland
accident had been carried out. Thus he had not lost sight of the fact that the
report into the accident had revealed that certain action was required. The
Committee met quarterly so that it next met on 21 May 1988 and number
12/419 of process are the Minutes. Reference was made to a follow-up report
by Mr Latham prepared following the questions raised at the meeting of
3 March. Mr Latham is said to have reported that there had been a satisfactory
response by OPCAL to the recommendations in their Report although he was
not happy about the steps which had been taken to inform the workforce of the
situation. He detailed the steps that had been taken to bring the
recommendations into effect. He raised queries about the generality of some of
the instructions that had been issued. Even if Mr Latham’s report is accepted as
an accurate account of the situation as seen by him, it would appear that
although improvements had been made since the Sutherland accident matters
remained that required to be attended to.
On 1 July 1988 Mr Snape gave up his post in OPCAL and was transferred
to South America. He was replaced by a Mr Schulz and of course this
happened very shortly before the explosion on Piper. Before Mr Snape left
OPCAL it would appear that he had remained interested to see any
recommendations, that had been made by his staff or by the Report, put in
place.
154
The defenders made a case that OPCAL had ignored the implications of
the prosecution arising out of Mr Sutherland’s death that had been raised
against them in the Spring of 1988. The terms of the Complaint are shown in
number 12/406 of process. In the charge it is alleged inter alia “and you did
fail to supervise said job in the following respects ( 1) there was an inadequate
communication of information from the preceding day shift to the night shift
during which said accident occurred” (the accident referred to was of course
that involving Mr Sutherland). The information alleged to have been
inadequately conveyed was not specified. The complaint went on to allege that
“no new permit was taken out to cover the installation of the said lifting gear
and other necessary work”. That certainly seems to be true and indeed
Mr Snape accepted that the proper course would have been to obtain a new
permit. The complaint continues “the said deceased had been allowed to select
his own method of performing the job without discussion with the Supervisor”.
This too seems to have been beyond dispute. Then it is said in the complaint
that “suitable access to the working area had not been provided nor had safety
equipment such as harness and lines and (5) said canopy had not been bolted
down and was being used as a working platform”. The charge then went on to
allege a violation of the Health and Safety at Work Act. Mr Snape agrees that
OPCAL had pled guilty to the complaint as it stood. The defenders take that
fact as signifying that OPCAL had had their attention drawn to the fact that
there were deficiencies in their permit-to-work system and yet they allegedly
took no steps to correct the position. However the plea of guilty needs to be
viewed in the light of Mr Snape’s evidence. He claimed that he had pled guilty
to the charge as it stood because he had been advised by his lawyer to do so.
He maintained that his position was all along that he did not consider that any
155
failure in the permit work system had caused the accident but rather a failure in
supervision. He claimed that although he did not agree with certain elements in
the charge (and in particular item (1)) he felt that a guilty plea should be entered
because in a general sense the accident had been due to fault on part of
OPCAL. As he said in evidence, a man having died he thought that it would be
unseemly to quibble about details of the charge. He also claimed that he did
not see any problem about handover as having been a cause of the accident. I
accept Mr Snape’s evidence about the matter under consideration. In the first
place he seemed to me to be an honest witness. Moreover Mr Snape had the
internal Report into the facts of the accident. This had been prepared by
persons he considered well equipped to investigate the accident and they had
not attributed any fault to the permit to work or handover system. Indeed Mr
Snape indicated that following upon the accident he had discussed the question
of handover with his staff and concluded that the transfer of information which
is the point of a handover had effectively occurred. The change in the lifting
method happened after the handover.
The defenders called in respect of this matter the witness Mr Jenkins.
This witness was when he gave his evidence the Safety Manager with AOC
International, a company working in the petro-chemical industry. He held the
degrees of BSc and MBA. From 1987 until 1991 he had worked as a Senior
Inspector with the Safety Inspectorate. The evidence does not disclose what
experience he had of Oil Platforms before 1987. He went to the platform on the
day after the accident and he spoke to the Report and Addendum he issued
thereafter, namely numbers 14/43 and 14/44 of process. In this Report he
confirms that, in relation to the accident when the job scope had been increased,
a new permit should have been taken out and I do not think that anyone
156
disputes this. Mr Jenkins reported that the tradesmen and the supervisors
conducted their respective handovers at different places and that after the
handovers had taken place the supervisor saw the tradesmen and allocated work
to them. He observes that subsequent to the handovers Mr Taylor did not
discuss the job with the men nor visit the site. I agree with Senior Counsel for
the Pursuers that the facts reported by Mr Jenkins suggest a failure of
supervision rather than of the handover. In his Supplementary Report
Mr Jenkins observes that the handovers were badly co-ordinated in that the
supervisors handed-over in one place and the Supervisors in another. However
the defenders do not specify in their pleadings that a proper handover procedure
would involve those concerned meeting together in the same place. Indeed I do
not know if such a system would be practicable (the Lead Hands might require
to see a lot of men) and witnesses were not asked about it. Mr Jenkins does
agree that faulty supervision was an important cause of the accident.
Mr Jenkins also makes the point, which I have referred to before, that a new
permit should have been taken out when the job method changed. An
important conclusion of Mr Jenkins was that the company had a number of
safety precautions in place and a safety department but they were caught out
because the task being done was done on an ad hoc basis and there was no
established procedure for handling it. The core criticism appears to be that Mr
Taylor did not do his job properly. It should be noted that there was no
suggestion that the Jenkins’ Report had been handed over to OPCAL.
However he did have a meeting with OPCAL at which his views were
discussed. There was no suggestion from Mr Snape that any proposals from
Mr Jenkins about handovers had ever been handed to him.
157
Mr Jenkins carried out a Routine Inspection of Piper Alpha in June 1988
and his Report is 14/45 of process. In fact he claims to have been told by
Mr Barry Clark that handovers had been “tidied up”. In particular Mr Clark,
who was a Maintenance Superintendent, told him that the incoming
Supervisor sat in on the tradesmen’s handovers but Mr Clark would have been
referring to the maintenance department. Mr Jenkins also observes in his
Report that OPCAL had adopted part of the International Loss Control System
of working but that they looked as if they were about to burst at the seam with
the effort involved. There was some question as to what this might involve but
it can be said that there is this evidence that OPCAL were not totally indifferent
to safety and were trying to improve their system.
Mr Snape gave evidence that until the Sutherland accident it was not
perceived in the company that handover was a problem. On the evidence I
think I can accept this. I can also accept Mr Snape’s evidence that after the
accident some steps were taken to review the handover procedure. Thus
Mr Todd, the Maintenance Superintendent, was asked to look at the adequacy
of the handover procedure. He claimed how he had discussed handovers with
his OIM and they decided that not much could be done, nor indeed was needed,
to improve that particular aspect of the safety procedures. This of course
coincides with the view of OPCAL’s own internal inquiry. The complaint does
not seem to have been that sometimes there were no handovers but rather that
the handovers that did take place could have been improved. The defenders did
not set out in their pleadings any specific standards or procedures for an
effective handover system which the operators were neglecting. I am in the
whole circumstances unable to conclude that there was any essential deficiency
in the handover system as such. On the other hand the fatality may have
158
highlighted problems over supervision and the operation of the permit to work
system which required to be addressed. Whatever culpability OPCAL may
have had in relation to the unfortunate accident to Mr Sutherland, I do not see
that this has much direct bearing on this case. If the Proof had been a general
inquiry into the sufficiency of OPCAL’s safety systems then the Sutherland
affair may be another adminicle showing deficiencies in these systems.
However I must not lose sight of the fact that I am not here to evaluate the
status of OPCAL’s safety arrangements except insofar as inadequacies in that
system can be shown to have contributed to the present disaster.
4.3.5 Relationship of Accident to Handover Procedures
Just as the defenders attribute the accident (if it occurred as alleged) to
intentional departures from the Permit to Work system, they aver that the
pursuers caused the accident by intentionally failing to enforce the handover
system. Thus they aver that
“at a seminar held at the headquarters in Aberdeen of Occidental, a lead
Maintenance Hand, A G Clark, made criticism of the permit to work
system and the communication of information at shift handover. These
criticisms, which were similar to the criticisms arising out of the
Sutherland fatality were disregarded.”
Of course it has to be noted that at best for the defenders Mr Clark was talking
about the handovers for Maintenance personnel. The defenders also aver
“In relation to shift handovers there were no rules or other written
guidelines as to the content of the report to be given by the person going
off duty. There was no requirement that the suspended and active permits
were to be reviewed at handover”.
159
The defenders have not averred nor proved just what detailed arrangements for
the regulation of handovers should have been in force. Moreover the defenders
extend their case about the monitoring and auditing of the Permit to Work
system to handovers. They also say that if by chance Mr Vernon did not know
that the PSV had been removed he would have acquired this knowledge if the
handover procedure had been properly implemented.
4.4. Monitoring and Auditing
4.4.1 General
If the accident happened as the pursuers allege and if contrary to the
defenders’ submissions Mr Vernon attempted to jag the pump without
knowledge of the missing PSV, then according to the defenders this resulted
from OPCAL’s failure to monitor and audit their permit to work and handover
systems. In a nutshell the defenders’ case on this point is that the enforcement
of safety procedures was so slack that an environment accrued in which
employees became careless about applying the safety procedures. There in my
view can be no doubt that the supervision of the permit to work system was
quite ineffectual. The divergence from the strict system was obviously not a
rarity but occurred on a regular basis (at least in the weeks before the accident).
At least most of these irregularities certainly would not have affected safety.
However the purpose in having safety rules is to have clear guidance from
management as to what is expected from employees and it is not for the latter to
adapt the rules at their will. Even if many of the irregularities in the operation
of the permit system were minor, the employers should have been aware of
them and if necessary have considered changing the details of the system. At
the lowest level of control, if Lead Hands and Superintendents (that is to say
160
the line managers) had from time to time investigated the day to day working of
the permit system, it would have become obvious from the permits they were
handling that the completion of permits required some control (that of course is
assuming that the permits recovered and relating to the last two weeks on the
platform were fairly typical). Indeed the Lead Production Operators were
themselves committing many of the irregularities. It is impossible to avoid the
conclusion that, at least in the period shortly before the accident, the lower level
of management colluded in a somewhat slack performance of the permit system
particularly in regard to the filling-in of the permits (it should perhaps be noted
that, since permits were returned to the shore base, had either party wanted to
review a wider range of actual permits, this may well have been possible). In
any event I am not suggesting that any practice which was thought seriously to
impinge upon safety would necessarily have gone unnoticed but even Mr Snape
agreed that if you have a prescribed system relating to safety aboard an oil
platform it is important to operate it strictly. Clearly OPCAL took a lot of
trouble to set out the detail of the safety system and this could only have been
in the expectation that the detail would be followed. The pursuers argued that,
even if their submissions as to the applicability of the good and prudent practice
provisions are rejected (and I shall deal with this in another chapter), minor
discrepancies in the completion of permits are not necessarily departures from
such practice, but I think it can be readily inferred that for employees
deliberately to ignore the specific safety rules that their employers have laid
down must be a departure from what generally would be referred to as good
and prudent practice (unless perhaps it can be shown that it was totally
impracticable to apply the rules rigorously; but that was not shown to be the
case). In a case where experienced managers have evolved a safety system, to
161
me it seems obvious that it is a departure from good practice if the employees
exercise their own judgment in deciding what parts of the system to follow.
Counsel for the pursuers seemed to suggest that if immediate supervisors
thought that departures from established system were perfectly safe then it
cannot be said that such departures are contrary to good practice. That was not
a view that Mr Snape could support. As he declared “the reason you have
procedures is that they be followed”. Nevertheless I shall have to consider the
technical legal arguments which the parties advanced in relation to this aspect
of their cases.
It must be noted that my comments relate to permits to work. Perhaps
with the exception of the specification of the work to be done (the point that
arose in the Sutherland case) there was really no evidence that the handover
system was inadequately supervised or operated in a casual or routine manner.
This of course does not mean that an operative could not make an error of
judgment in deciding just what information to pass on, but if clearer guidance
for handovers was required just what such guidance should have consisted of
was not seriously developed.
Since the Operators must anticipate the possibility that even their own
supervisors may not enforce good practice sufficiently, it is, as a practical
measure, important to conduct audits. Monitoring can be done by line
supervisors but auditing should involve some degree of independence. Again
there is ample material in the evidence to show that OPCAL recognised that.
Indeed Mr Snape acknowledged that auditing was a necessary procedure if he
was to be kept aware of the state of the safety arrangements. Mr Snape agreed
that a worthwhile audit of the permit to work system would have included
someone looking at a selection of the permits to see that they were being used
162
properly. I would hesitate to leave the impression that the Operators took no
steps to check the efficacy of their safety arrangements. They held regular
meetings at various levels of management devoted to safety matters. In fact
they spent at least a fair bit of time considering safety on their plant and of
course for practical reasons they probably could not scrutinise all safety aspects
all the time. Certain audits took place in the year or so before the accident but
no organised internal audit took place between 1985 and 1988. However I
think it can be concluded that, if anyone conducting any kind of reasonable
audit of the permit system in the period approaching the summer of 1988 had
looked at the way permits were being filled in, it would have become readily
obvious that there were deficiencies. If OPCAL did have a safety auditing
system Mr Snape was unable to help us much as to how often it took place.
Nevertheless it must be acknowledged that, whereas monitoring could be an
ongoing process, auditing would be an exceptional event likely on practical
grounds only to take place at intervals. Any failure to enforce adequate
auditing standards would of course be a failure of the senior management. It is
true, as the pursuers contend, that there were no pleadings or evidence relating
to what period between audits would be consistent with good and prudent
practice. However I think prima facie if there are no firm arrangements at all to
ensure regular auditing such cannot be consistent with good and prudent
practice. No one doubted (Mr Snape included) that in general auditing of safety
procedures was necessary.
The defenders led one witness, Mr Fearon, in an attempt to establish what
constituted good and prudent practice in relation to monitoring and audit. The
pursuers objected to this evidence on the ground of “no record” and I allowed it
under reservation. It has to be observed that what Mr Fearon spoke to was
163
essentially his opinion rather than factual evidence about other procedures
followed in practice in the industry. Indeed it was contended by the pursuers
that Mr Fearon laid no proper foundation for the opinions he expressed. He
was 57 years of age and was a self-employed Technical Safety Consultant. He
had a BSc in Chemical Engineering. He was a Chartered Engineer and a
Fellow of the Institute of Chartered Engineers. He had worked for 26 years
with British Petroleum. He accepted that he had had relatively little
involvement with offshore work. He had been head of technical safety between
1976 and 1980 but it was not made clear whether his responsibility related only
to hardware and not procedures. Until 1993 he worked with BP as a Safety
Engineer but not in relation to offshore work. In 1989 he passed examinations
and was accredited to the International Loss Control Institution. He had a
certain amount of experience of safety audits. He certainly had from time to
time assumed a monitoring function. I think it would also be fair to say that, as
from about 1986, he had a certain amount of experience in the initiation and
implementation of permit to work procedures although in respect of the former
experience he had merely issued guidelines. He had some experience in
instructing personnel in the use of permits to work. The workers he was
responsible for got a measure of formal training. He also had been a member of
the Petroleum Industry Training Board with a view to overseeing the
production of training packages in connection with permits to work. The
pursuers made a number of points aimed at discounting Mr Fearon’s ability to
speak with authority about permits to work but, although he may have lacked
concentrated experience in relation to offshore platforms, it is obvious that he
had wide experience of the nature and operation of permit to work systems
generally. He had worked with various systems in various capacities. He also
164
had experience of audit systems and indeed he had worked with two kinds of
audit. The first were technical audits which were broad-brush audits of perhaps
a whole refinery and theme audits which were more specific and would from
time to time include permits to work. The witness accepted that this last
category of audits were very time- and resource-consuming. His involvement
with this kind of auditing dated from about 1988. He indicates in his evidence
that in 1988 an auditing procedure would have been regarded as good practice
but this generality leaves a number of questions unanswered. He defined an
audit of a permit to work system as being an independent inspection or audit of
what a particular organisation or site is doing - a structured review carried out
against specific checklists and involving interviews and a number of spot
checks. The central safety organisation of the Operator could provide the
degree of independence that was critical to an audit or external consultants
could be brought in. Even before 1988 BP carried out audits but they reviewed
their auditing procedures extensively after the Cullen Inquiry. Mr Fearon
obviously had some experience of auditing but had not himself carried out
theme audits nor did he know what the general practice in relation to auditing
was in the North Sea in 1988. The pursuers contended that Mr Fearon’s
experience of auditing particularly in the period prior to 1988 was too particular
to BP to be relevant to the questions in these cases.
In his evidence Mr Fearon referred to a document entitled “A Guide to the
Principles and Operation of Permits to Work as Applied in the UK Petroleum
Industry” (number 15/2 of process). It was prepared by the Oil Industry
Advisory Committee Group of the Health and Safety Commission. The
document was directed at the petroleum industry and was dated 1986.
However Mr Snape did not appear to have been aware of its contents until after
165
the accident. OPCAL’s formal permit to work system mirrors closely the
recommendations in the Report. In any event Mr Snape agreed that the
recommendations in the report represented sound practice and I think it can be
said that the Report represented what could be said to be generally recognised
practice in the industry in relation to permits to work. The Report emphasises
the importance of a sound permit to work system if accidents in this highly
dangerous industry are to be avoided. Moreover one main purpose of the
system is that persons directing operations should be aware what is going on at
any time. Since none of the personnel in OPCAL’s Safety Department gave
evidence, their knowledge or response, if any, in relation to it in 1988 was not
explored. The general requirements set out in the document are declared as
having to be read in conjunction with the specific guidance produced by
individual petroleum companies in relation to their own operations and
activities. The publication is only introducing Guidelines which require to be
adapted to the specific requirements of the organisations using them. However
it refers to a need to monitor a permit to work system and I doubt if the
pursuers required to labour that point because Mr Snape accepts that any permit
to work system would require to be monitored. The Report suggests that there
should be spot checks. The Guidelines indicate that an objective of a permit to
work system should include “Ensuring that the person in direct charge of a unit,
plant or installation is aware of all the work being done there”. Mr Snape did
not demur to that. However I accept that this objective would be achieved if
the system makes adequate provision for the line manager having the
information of the range of work being done. However the objective could
only be realised in a general sense since obviously it would be difficult to
ensure that a manager knew the detail of all the work going on at any moment.
166
Mr Snape agrees with the Guidelines in that satisfactory arrangements,
including training, should exist for implementing the procedures on a
day-to-day basis. Then the guidelines set out that it is a responsibility of
employers and occupiers to ensure “that the operation of the procedure is
monitored to ensure that it is correctly applied” and “that the procedures are
reviewed regularly, and amended or updated as necessary”. To this point I
doubt if Mr Fearon’s evidence, admissible or not, takes the cases very far for it
was clear, from Mr Snape’s own evidence and the Operators’ Minutes that
were produced, that OPCAL accepted the responsibilities I have mentioned.
Indeed OPCAL had in place a comprehensive safety structure both onshore and
offshore. So far as offshore is concerned, there would normally be eight safety
personnel on the platform at any time. Whether this system always worked to
best effect is another matter. The safety hierarchy is illustrated in the
organisation charts numbers 12/209 and 13/62 of process. The structure
contained arrangements for some safety management which was independent of
Operations management. Thus the safety personnel were able to report to
senior management without going through Operations. Mr Snape considered
that it was the role of the Safety staff on the platform to monitor safety on the
platform and I would accept that there was a system in place but whether the
reasonable operation of the system was itself monitored is another question.
However one regards OPCAL’s monitoring system, the fact remains that
regular, albeit possibly minor, infringements of the safety system were
occurring without anyone picking them up or responding to them.
Mr Snape was also referred to a document produced by the Health and
Safety authorities entitled “Statement of Policy on Health and Safety at Work
with related implementation responsibilities and the system for monitoring and
167
control” (number 13/60 of process). This is dated July 1987. This provides
that the platform operators should carry out routine and ad hoc reviews and
technical safety audits of facilities equipment, systems and procedures.
Mr Snape thought that these were important provisions. It also provided that
the Loss Prevention Department had the duty to monitor the effectiveness of
company policies and procedures. There is a further responsibility on the
Department to ensure professional co-ordination of the in-house technical
safety audits.
Now Mr Snape indicated that the company had a scheme of inspection to
be carried out, both internally and by people who were external, to audit their
operations. In general it was the Loss Prevention Department’s function to
keep control of the implementation of safety measures. In fact they submitted
regular reports to management and these purported to show that there were
regular inspections of facilities and procedures. I think all this means is that the
defenders do not need Mr Fearon to establish that monitoring and auditing were
good practice. OPCAL were experienced platform operators and in the absence
of contrary indications I think that it must be inferred that they were aware of
what was good and prudent practice for the operation of an oil platform. Were
this not so they should not be in the business. If they had gone to the trouble to
instal a safety practice it can be assumed that they did so because they thought
it to be significant. If they were to contest that a practice is required then what
other operators did may be of some importance, but OPCAL do not dispute that
monitoring and audit were advisable. In any event for an operator to depart
from the prescribed safety rules without special reason must in itself be a
departure form good and prudent practice. It would be most surprising if the
industry were to tolerate the practice of workers taking it upon themselves to
168
deviate from the prescribed rules for safety that their employers have no doubt
devised after careful consideration. Moreover in the broad sense it is obvious
that there is no point in having a system if you do not take steps to check that it
is working. It must also be noted that Mr Snape was not so much challenged on
the detailed structure of OPCAL’s system as to how well it worked. The
defenders place weight on the fact that the pursuers did not bring any witnesses
directly involved in the safety system to speak to its efficiency or otherwise.
The pursuers’ answer to that of course was that in relation to wilful misconduct
the onus of proof was on the defenders.
It was not disputed that Mr Snape had an overall responsibility to see not
only that a work system was provided but that it was maintained. Line
managers and line supervisors had a duty to ensure that formal procedures,
standing instructions and safety standards are complied with at all times.
Mr Fearon was asked if the mechanisms required to ensure that a permit
to work system is implemented would include training, monitoring and auditing
and he agreed. This does not take us much further for the reasons I have
already discussed. Mr Fearon indicated that the frequency of monitoring once a
day would not be an unreasonable frequency. Now I think, in respect of that
evidence, the pursuers are correct to say that they got no notice that the
defenders were to develop an attack on the frequency of monitoring permits.
Indeed if there was any deficiency in the exercise by line managers and
supervisors of their supervision of the permits it may well be that they were
willing to tolerate departures from the strict procedures rather than that they
were not exercising their supervisory function frequently enough. In fact the
various witnesses of the pursuers who had experience of line supervision were
not asked about frequency of the scrutiny of permits.
169
On no view can it be claimed that OPCAL were totally indifferent to
monitoring since it is clear from the Loss Prevention Annual Report for 1987
that at least certain routine checks were carried out on permits and the safety of
work sites.
According to Mr Fearon he would expect auditing to be done annually.
Here once again the defenders’ evidence falls foul of pleading rules for there is
nothing in their case to alert the pursuers that they are alleged to have failed to
audit according to specific standards as to interval of audit. But nevertheless
the evidence seemed to show (and this is irrespective of Mr Fearon) that
OPCAL had no effective system at all for audits of the permits to work to be
conducted at prescribed intervals.
A point of some interest is that OPCAL themselves had put permits to
work on their programme for internal audit. This had been done in 1985 (as
one of a number of audit programmes for that year) but by 1988 the audit had
still not been carried out. The audit was certainly not carried out in 1985 and
we were told that this was because there were no resources (there is an
indication that this may have related to lack of manpower and physical
resources). However the defenders were over the period interested in their
permit to work system and indeed reviewed it in 1987. A review is of course
different from an audit. A review is concerned with the content of the safety
arrangements whereas an audit is concerned with the effectiveness of
implementation. Moreover in 1988 one of the Participants, Texaco, carried out
an audit of safety procedures. This was certainly some check but Mr Snape
accepted that internal audits were also necessary and indeed he appears not
personally to have seen the Report of the Texaco audit. Such an audit by
Participants tended to occur every few years. The Department of Energy had
170
carried out what was described as an audit not long before the accident but
Mr Snape accepted that this was more of an inspection and would not be as
comprehensive as an internal audit, Mr Fearon complained that the failure to
carry out the audit proposed for 1985 represented non-compliance with good
and prudent practice. Nevertheless it can be said that OPCAL themselves
thought in 1985 that an audit was desirable of permits to work but they had not
given substance to their hopes even by 1988. In any event Mr Snape indicated
that the headquarters of the Oxy Group centred in Los Angeles audited in a
general sense once a year and on that occasion all aspects of safety would be
examined. The associated company, Oil and Gas Corporation, carried out an
audit once a year which was specifically directed at Health, Safety and
Environmental matters. The Texaco audit reported in March 1987 that “The
safety and environmental programmes on the platforms and Tharos are well
established and well managed” (13/5 of process). Certainly as far as Claymore
was concerned they looked at permits to work and indeed found some
irregularities. One of their remits was to verify that permits were being
prepared in detail according to instructions. OPCAL’s insurers and the health
and safety authorities also carried out periodic audits, the former once a year.
The 1986 audit covered hot work permits. Mr Barnes who was an OIM was
allowed time away from his normal function to carry out a review of the permit
to work system. This began in 1984 and took until about 1987 to follow
through. It is not clear to what extent OPCAL’s failure to carry out the 1985
proposal for an audit after that year was affected to any degree by the fact that
subsequent alternative audits had taken place. Thus OPCAL do not seem to
have had a very reliable practice for auditing but it would not be fair to say that
they were totally regardless of such safety checks. However not to have a
171
reliable audit procedure would be a departure from good and prudent practice.
I think it is clear that Mr Snape recognised this. If the pursuers did have an
effective auditing system then their position in this respect would have been
more convincing if they had led someone from their Loss Prevention
Department since that Department was responsible for internal auditing. Many
of the documents which they produced purportedly from the Loss Prevention
Department were not spoken to by witnesses qualified to speak to them and
thus were evidentially worthless.
4.4.2 Mr Fearon’s Evidence about Handovers
The witness Mr Fearon claimed that the training, monitoring and auditing
requirements that he had discussed in relation to permits to work were equally
applicable to OPCAL’s handover system. Of course, as I have mentioned, his
evidence was taken under reservation because the pursuers objected to it. The
witness expressed the view that it would not be in accordance with good and
prudent practice if there had been no monitoring and auditing system in relation
to handovers. If it is merely being suggested that it would not be good and
proper practice to have an important matter such as handover neither supervised
nor independently checked from time to time, then I think I could form a view
on that without reference to Mr Fearon. As is obvious, the transfer of
information between shifts is critical to the safe function of the platform
operations and I do not think that the pursuers would dispute that there ought to
be some degree of supervision and checking so that management can rest
satisfied that the system is working. However the next point Mr Fearon makes
is more contentious for he is asked if it would be good practice to leave it to
individual lead operators to decide at their discretion what particular
172
information should be communicated at handover. He indicates that in his
opinion this would not be good practice. However his explanation for his
answer may not help the defenders for he says that, if there was a discretion left
with Lead Operators to decide what information should be passed over, there
would be no mechanism for the transmission of information. He did not like a
system of notes being handed over which might then be disposed of since this
could mean that the incoming man might forget some important information.
This would suggest that in Mr Fearon’s experience it is not at all surprising if
the incoming person may from time to time allow a piece of information to slip
his mind. Moreover in fact the notes handed over at the Piper handovers were
noted in a notebook (called a log) and there is no indication that this was
destroyed or thrown away during the new shift. In any event OPCAL’s system
did embrace a number of written records as to what was happening on the
platform including, as well as the Lead Operator’s log, the Control Room
Operator’s log, the Operators’ logs and the permit to work system. There were
other documents as well, like computer worklists. Above all, if the defenders
were going to seek to prove that a particular detailed procedure is required in
accordance with good practice, they should certainly have laid a foundation for
this in their pleadings. The defenders’ specific complaint in the pleadings is in
fact extremely general and is to the effect that OPCAL left it to individual Lead
Operators to decide what to pass on.
Mr Fearon’s evidence on the matter of handover systems must be
reviewed against his concession that he had no detailed knowledge of the
handover systems employed in offshore platforms in 1988. One unfortunate
reflection on the handover system was that Mr Rankin, because he did not know
Mr White, did not report to him about the state of the PSV work as he should
173
have done. Instead he thought that Mr Smith was Mr Todd’s equivalent but by
the time he found Mr Smith and reported to him Mr Smith was off duty. If
Mr White had known about the state of the PSV then, when Mr Vernon called
Mr Clark (who as it happens was in his office), then he may have intervened and
told Mr Clark that the Pump A was not available for use. However no-one
suggested that the misunderstanding on the part of Mr Rankin concerning
Mr White ought to have been predicted and avoided by a particular system. That
matter simply was not explored. The whole problem in respect of Mr White may
have arisen because Mr Rankin was new to the job of being supervisor.
However well or badly the monitoring of handovers worked there was
evidence that at least there was some degree of supervision of the process.
Thus Mr Todd, a Maintenance Superintendent, attended the morning handovers
involving Lead Maintenance Hands and indeed participated in them. He also
attended some of the evening handovers before going to the OMI’s meeting.
He had discussed with the Maintenance Lead Hands what ought to go into
the log.
It should be noted in regard to safety matters generally that the 1976
Offshore Installations Regulations only apply to work that gives rise to a source
of ignition - that is to say to Hot Permit Work. However although it was not a
statutory requirement, the Health and Safety Commission in production number
15/2 of process recommended that the permit to work procedure should apply
to cold work as well as hot work. The reason for that is obvious when one
considers the circumstances of this accident.
As will be seen from the above material, there is little doubt that there
were deficiencies in OPCAL’ s Safety systems particularly in regard to
174
Supervision and audit. Whether or not these deficiencies had anything to do with
the cause of the accident is another matter.