Scottish Court of Session Decisions

1.1. General

This is one of a series of cases arising out of the tragic accident on the Piper Alpha oil platform which occurred on the evening of 6 July 1988. As is well known the oil platform in question, located in an oilfield in the North Sea about 110 miles north-east of Aberdeen, was destroyed in an explosive conflagration with considerable loss of life. 166 persons lost their lives as a result of the accident either through being on board the platform or through being involved in rescue operations. Of those killed 159 were British and of the balance only one was an American citizen, he being from Texas. 62 of those aboard the platform survived the accident but many of these suffered varying degrees of injury or trauma. The accident was the worst disaster in the history of the British off-shore oil industry. The pursuers in each of the said cases are Elf Enterprise Caledonia Limited who are the successors to the owners and operators of the platform at the time of the incident. Following upon the accident the families of deceased victims and the survivors combined in various ways to present their claims against the platform operators and in particular they indicated that they were proposing to litigate their claims against the pursuers’ predecessors in Texas. The reason for this selection of Texas as a prospective forum to litigate claims, arising from an event largely involving British victims and occurring in Scottish waters, was that it was conceived that the Texas legal system was materially the most favourable which was potentially available for the pursuit of such claims both in relation to its Jury procedures and in quantification of damages. Negotiations took place throughout the autumn of 1988 between the pursuers’ predecessors and the representatives of the victims’ interests and eventually settlement terms were agreed and then implemented. The validity of the claimants’ assertion that a Texas court would accept jurisdiction in litigating their claims was a critical issue but compromise was reached on the assumption that the level of damages finally offered and accepted represented an approximate mid-point between the assumed Texas level of damages and the assumed Scottish one. This basis of settlement was referred to by the parties as a "mid-Atlantic formula". The relatively prompt settlement of claims is clearly to be applauded on humanitarian grounds but the question of who bears the ultimate responsibility for the monies paid to claimants raises contentious issues which have given rise to the present litigations. The operators of the platform employed a certain number of their own employees but most persons on board the platform at the time of the accident were in fact employees of various contractors who had arrangements with the operators to carry out specialist work tasks. Thus for example drilling, diving and catering work on the platform was conducted on behalf of the operators by specialist contractors. The contractors had each entered into contracts in connection with the work they had to perform and these contracts provided that in certain circumstances the contractors were to indemnify the operating parties in the event that damages had to be paid to those contractors’ employees as a result of incidents occurring while they were working on the platform. At the time of the accident there were 226 persons on board the platform. Of these 165 died and 61 survived. Of the persons who died 31 were employees of the Operators and 134 were employees of one or other of the contractors. There were also two persons killed while working on a rescue craft. Of the survivors 6 were employed by the Operators and 55 employed by contractors. There are 146 actions in the present series of cases and these are each directed against contractors who employed persons killed or injured in the accident and in respect of whom monies have been paid by way of damages and expenses to claimants under the settlement terms to which I have previously alluded. The pursuers claim that the defenders in each case are bound in terms of their contract to indemnify the pursuers for the monies paid out under the settlement. It is claimed by the pursuers that they were bound to compensate the victims or their relatives and that the sums that were payable under each settlement were reasonable. In the actions the pursuers are seeking to recover not only the sums paid to claimants as actual damages but also sums of expenses paid to the claimants in respect of legal expenses said to have been necessarily incurred in pressing home their claims including expenses incurred for representation at the Cullen Inquiry. The defenders for their part deny that they have any liability under the alleged indemnities. This puts in sharp focus the cause of the accident and any attribution of fault therefor. It also raises questions concerning the construction of the indemnity provisions in the contractors’ contracts. There is also a major dispute between the parties about the reasonableness of the damages and expenses paid out to claimants by the 0perators. The defenders contend that the Operators over-estimated the likelihood that a Texas court would have accepted jurisdiction in the cases and in any event that a Jury sitting in Texas would not have awarded (or been allowed to award) the high levels of damages on which the operators based their settlement offer. The level of expenses paid out is also queried. Lastly but not least the defenders advanced an argument that the pursuers had misconceived the present actions for indemnity and that the appropriate procedure following upon the settlement should have been actions by their insurers for contribution. The dispute between the parties in the various actions (which I have merely outlined above) gave rise to a multiplicity of complex questions as the considerable length of the Proof denotes.

At the commencement of the Proof I was informed by Counsel that the 146 actions before the Court largely raised the same questions. It was therefore proposed that seven of the actions which illustrated such differences as there were between the cases should proceed on a test case basis, and that Proof in these actions be conjoined. These seven actions, (which include the present action), were said to focus all the issues which arise in the other actions and I was asked to sist these other actions. Since there were no objections to these proposals I agreed to give effect to them. The seven actions which went to Proof were the cases against London Bridge Engineering Limited (employers of the deceased Robert Carroll), Northern and Industrial & Marine Services Limited (employing the deceased John Duncan), British Telecommunications P.L.C. (employing the deceased Graham Gill Whyte) , Wood Group Engineering Contractors Limited (employing the deceased Michael O’Shea), Eastman Christensen Limited (employing the deceased Neil Pyman), Kelvin International Services Limited (employing the deceased William John Cowie), and Stena Offshore Limited (employing the injured party Andrew Murray Carroll).

1.2 The Parties

The pursuers in all these actions are Elf Enterprise Caledonia Ltd. This company were formerly known inter alios as Occidental Petroleum (Caledonia) Ltd (hereinafter referred to as OPCAL). OPCAL were registered in England and had their principal place of business in London with further places of business in Scotland. In 1988 at the time of the accident OPCAL were the Operators of the Piper Alpha and Claymore oil production platforms as well as the Flotta terminal to which the oil was pumped. In 1988 OPCAL were a member of a large international group of companies known as the Occidental Group. Since the accident OPCAL has been acquired from Occidental by a French company known as Elf Enterprises and this no doubt explains the changes in the name of the company. Before a company can explore for or develop a North Sea oilfield it requires a licence to do so from the Government. By licence no. P220 dated 28 April 1972 the Secretary of State for Trade and Industry granted licence to four companies namely Occidental Petroleum (UK) Ltd. (hereinafter referred to as OPUK), Getty Oil International (England) Ltd., Allied Chemical (Great Britain) Ltd, and Thomson Scottish Associates Ltd. By 1988 the four last mentioned companies had transformed themselves into Texaco, Union Texas Petroleum and Thomson North Sea Ltd. respectively . The said licence was granted to relate to a number of exploration blocks including the block where Piper Alpha was eventually situated, namely the Piper Field. OPUK was another Occidental subsidiary and was a British Company (which attribute was needed to secure a licence). However the company was at that time effectively a nominee for an American company of the Group which provided the finance required. The said American company was Occidental of Britain Ltd. ( hereinafter referred to as OBI). They were registered under the laws of California and had a place of business in London. By a Deed of Variation dated 3 October 1974 Licence no. P220 was restricted to the Piper Field and it was agreed that a licence for the residual fields should be granted to OPCAL (and the three other companies who were licensees under the original licence). Moreover OPCAL and the said three licensee companies were by further licences given permission to lift oil from the Claymore field and from other blocks. All these oil fields were located in the United Kingdom sector of the North Sea in the Scottish area. On 28 July 1982 a further Deed of Variations was entered into by the relevant parties with reference to licence no. P220 with a view to amending certain model clauses. By an agreement dated 1 January 1984 Occidental Petroleum (Great Britain) Ltd., the holding company of OPCAL, sold to OPCAL the share capital of OPUK and indeed on that date OPCAL took over their whole interest in the Piper Field. The effect of a series of arrangements entered into at that time was that OPCAL became the representative of the Occidental interests in the North Sea and in particular acquired Occidental’s rights and liabilities in the Piper Field. On 1 March 1984 OPCAL were named in the licence for the Piper Field in place of OPUK. In 1977 the original four licensees entered into a Joint Venture Operating Agreement (the JVOA) in terms of which OBI were to act as Operators of the Piper Alpha platform on behalf of all the licensees whose respective interests in the operations were also defined. OBI were also "throughput parties" in the original JVOA. Throughput agreements were arrangements which enabled American companies to provide finance to British companies for North Sea oil development and obtain oil income in return. The parties to the JVOA were defined as "Participants". On 1 March 1984 the participants were parties to what is described as a "Novation Agreement" which related to the JVOA and this was made to operate retrospectively from 1 January 1984. In terms of this Novation Agreement OPCAL by agreement with the interested parties took over the former interests under the JVOA of OBI and OPUK and became Operators of the Piper Alpha platform on behalf of the Participants. A similar Joint Operating Agreement had been entered into in 1977 making OPCAL the Operators on behalf of the licensees of Claymore and by a further agreement on 27 July 1986 the effect of this was clarified. By the date of the accident in 1988 the Participants were OPCAL (successors to the original interest of OPUK), Texaco Britain Ltd (successors to the original interest of Getty Oil International (England) Ltd.), Union Texas Petroleum Ltd (successors to the original interest of Allied Chemical (Great Britain) Ltd.), and Thomson North Sea Ltd. (successors to the original interest of Thomson Scottish Associates Ltd.). Since the disaster Thomson North Sea Ltd have been taken over to become Lasmo (TNS) Ltd. At the date of the accident the said four Participants jointly owned the Piper Alpha platform as well as their joint interest in the licence and oil concession. Their respective shares in the Piper Alpha operations were as follows; OPCAL’s share was 36.5%, Texaco’s share was 23.5%, Union Texas Petroleum’s share was 20%, and Thomson’s share was 20%. In effect in operating the platform OPCAL were acting as agents for the other three Participants as well as looking after their own interest in the operations. In terms of the JOAV they had authority on behalf of the Participants to enter into such contracts as were necessary for the operations. Provision was made for the way in which the operations were to be supervised. Each participant had a right to its participation percentage of the petroleum recovered and the costs and expenses of the operations were to be borne by the participants on the basis of these percentages. The liabilities of the Participants were declared by the JOAV to be several and not joint. It was further declared that there was no intention to create a partnership. English law was to apply to the Agreement and there was an agreement to submit to the English Courts. In relation to the Piper Alpha platform the Operators had authority to enter into the relevant contracts on behalf of all the Participants but a requisite of approval was reserved for contracts of value over £5 million. There was a lack of precision in the evidence as to when the relevant platforms came on stream and began producing but Piper Alpha was certainly in production by the end of 1976 and Claymore by the end of 1977.

OPCAL pursues each of the actions on its own behalf and on behalf of the other Participants. They do this in terms of a contract entered into between the Participants in l987 which is governed by the law of Scotland and which provides that OPCAL as Operators should pursue all claims under the relevant indemnities on behalf of all the Participants. The respective claim of each Participant to any indemnity monies recovered is to be determined by their said participation percentage. The defenders are each contractors who at the time of the accident were employing a particular victim in respect of which a claim under the indemnities is made.

1.3 The Operations

By July 1988 when the accident happened OPCAL had developed important interests in the North Sea. They had discovered two major Oilfields, built the platforms needed to support them (Piper Alpha and Claymore), and constructed the necessary pipelines to the shore. OPCAL had a terminal in the Orkney Islands namely the Flotta Terminal. They had extensive related offices at Aberdeen, a warehouse facility at Peterhead and a helicopter facility at Aberdeen Airport. When I come to consider the Contracts entered into with the Contractors, it will be seen that there are references to "Operations envisaged herein" and the significance of the operations which I have just described derives from the defenders’ submissions that these are the backbone of the operations which OPCAL were conducting at the time when they entered into these contracts. These operations are to be distinguished from the contractual responsibilities of the contractors which are described as the "Work" and are detailed in the contracts as the "workscope". It is interesting to note that Mr Joseph Snape occupied a function until shortly before the accident which could generally be described as Managing Director of OPCAL (although it was designated by a variety of descriptions) and when he gave his evidence he did not list the sale of oil as being part of OPCAL’s North Sea operations. This may be significant when I come to consider the question of Texas jurisdiction. The outline of the management structure on Piper Alpha is set out in number 13/62 of process. In this production the references to "operations" have a more generalised meaning and refer to the production processes on the Piper Alpha platform. In effect the personnel who are described as production personnel operate the process and ensure that the oil and gas flow. Thus a person in the Divers section would not be considered as being part of the operations team. On the other hand the defenders contend, and I think that they are right, that on the platform everyone working there is ultimately responsible to an OPCAL supervisor. The Offshore Installation Manager (OIM) is the person in overall control of the platform. In respect of the Maintenance of equipment the hierarchy is the Superintendent, Deputy Maintenance Superintendent, and Lead Maintenance Hand. The technicians below the Lead Maintenance Hand are the Maintenance Technicians and other relevant personnel such as electricians. For Safety there is a Safety Supervisor, a Lead Safety Officer (vacant when the accident occurred), OPCAL’s safety operators and the Contractor’s Safety Operators. The most significant personnel are of course the Production personnel for apart from safety they would take over if anything went wrong. Moreover they were OPCAL’s own employees. Under the OIM there was an Operations Superintendent, a Deputy Operations Superintendent, Lead Production Operators, and the actual Operators. Of course there were also many employees of the various contractors on the platform but subject to the overall supervision of the permanent production staff. In fact there was no dispute that OPCAL’s management and staff structures affecting Piper Alpha were as set out in numbers 13/62 and 12/ 209 of process. As Mr Snape observed "This was our business, we take the oil out and export it". Ancillary services were generally provided by contractors brought on to the platform.

With regard to the management structure it can be seen that OPCAL had a Chairman and Chief Executive Officer. At the time of the accident this post was held by Mr Brading. He was based in London and had wider responsibilities than just OPCAL’s North Sea Operations. He was not a full time executive officer of OPCAL and the most senior full time executive manager until very shortly before the accident was Mr Snape. In fact he had been replaced by a Mr Schultz just before the accident. He had been, before being transferred to another post in the Occidental Group about 1 July 1988, the person in charge of the production of oil and exploration. In that regard he also had the ultimate responsibility for health and safety. In the management structure certain posts are identified as "senior management" and others as "line management". The company’s safety procedures were set out in a document described as the General Safety Procedures Manual (number 12/405 of process). There was some discussion in the evidence as to the provenance of this Manual but I think it was accepted that insofar as the accident goes it was a safety manual regulating the relevant procedures at the time of the accident. This manual provides Under the heading "Safety Meetings" that meetings of Senior Management shall be held at least quarterly to discuss matters relating to safety performance. The President and Managing Director (the post occupied by Mr Snape) was to chair these meetings. The concept of "senior management" appeared to have been relatively fluid but for the purposes of the said meeting it certainly extended to cover Mr Gordon, the Loss Prevention Manager. It would seem that the OIM did not generally attend these meetings. It was policy to keep safety distinct from operations. The Manual also provides that each line manager is responsible for identifying the statutory health and safety requirements relevant to his operations and to ensure that activities under his control are conducted in accordance with these requirements. Included in the line managers’ responsibilities are control and direction over all operations within their jurisdiction, to ensure adequate measures for the safety of all personnel including those of Occidental, contractors and visitors, and the reliability of operations. In terms of the Manual another responsibility of line management was declared to be the "Developing and maintaining adequate procedures for the safe control of operations, and monitoring their effectiveness in preventing injury and loss". A booklet on safety was allegedly issued to those coming onto the platform but just how effective it was in content is difficult to say.

Mr Snape’s evidence was that line management would start with him. It would run through the Vice President of Operations and insofar as relating to production operations , down to the Production and Pipeline Manager and then the Production and Pipelines Superintendent. From there the line would descend to the OIM and then down their chain of management. Apart from Production the line would go to the Drilling Manager for Drilling and to the Marine Operations Manager for Diving operations just to give two examples as to how line management might diverge. The Flotta terminal had its own manager. In Production, line management stops before the production operators. The same would apply to the Maintenance technicians. These groups had nobody to manage. The witnesses Todd and Sneddon (who were Maintenance Superintendent and Operations Superintendent respectively) indicated in evidence that they had never been instructed to monitor the permit to work system that was the safety control procedure. This may or may not be accurate because each of these men would presumably not be anxious to adopt a position where there might be an attempt to saddle them with responsibility for any deficiencies in the permit to work procedures. In any event clearly they each had responsibilities for the permits to work and the reference to monitoring is simply a requirement to take reasonable steps to check the system from time to time and see that it is working properly. It would be surprising if persons at their levels did not know that this would be part of their responsibility. It was of course claimed by the defenders that there was a flagrant and continuing failure to monitor the permit to work system and I shall deal with this later.

There was no doubt that OPCAL were in control of the platform and its operations and thus were deemed to be the owners of the platform under the Mineral Workings (Offshore Installations) Act 1971. Moreover the management and control which OPCAL had of the platform was direct. Ownership of the platform in the statutory sense which is different from ownership of a concession to work the oil as the participants had. Indeed OPCAL were also concession owners. OPCAL as the deemed owner of the platform and also as the actual Operators had statutory obligations for safety. This is a heavy responsibility for it is plain beyond doubt that an Oil Platform is a dangerous place unless careful and proper safety precautions are taken. The platform holds contained under pressure large quantities of gas and liquid hydrocarbon material which is explosive, very flammable and most dangerous if control of it is lost. Mr Snape described the operations as being "potentially hazardous". This was well recognised before the accident. The said Act provides that the platform shall be under the charge of an Offshore Installation Manager appointed by the owner. He had the overall right to regulate the platform just as a Master controls his ship. He has statutory authority over persons on the platform in connection with matters connected with safety, health, or welfare. Under section 5(4) of the said Act it is an offence not to obey the lawful command of an OIM. He also has the duty not to permit the installation to be used in any manner which would endanger the installation and the owner of the installation has a duty to ensure that he complies with this obligation.

The Offshore Installations (Operational Safety, Health and Welfare) Regulations 1976 were enacted in terms of the Act. Under Regulation 32(1) the owner, the concession owner, and the OIM have duties to ensure that the provisions of the regulations are complied with. Regulation 32(2) lays duties on employers and employees in relation to work on or near an offshore installation to ensure that the employee complies with the Regulations insofar as they impose a duty on him or expressly prohibit a specified act. In the case of a contractor he, of course, under this scheme only incurs liability for the activities of his own employee. The Operators on the other hand have a comprehensive duty to see that the regulations are observed. The contractors it should be noted are obliged to insure in respect of their own interest. Regulation 32(3)(a) provides that it shall be the duty of every person on or near an offshore installation not to do anything likely to endanger the safety or health of himself or other persons or to render any equipment unsafe. The defenders made a point extremely important to their case to the effect that the pursuers have no possibility of invoking that regulation unless the cause of the accident is established. Regulation 5 imposes a duty of general maintenance of equipment on the operator. If a flange had not been fitted properly there could be a breach of this regulation. The defenders submitted that if the only source of the defenders’ liability was a res ipsa loquitor situation that would not establish a breach of the Regulations. I think this is probably right. Regulation 30 provides that the OIM shall appoint a sufficient number of competent persons to be responsible for the control and safety of certain specified matters which are essentially matters likely to create dangers. Regulation 3 provides specifically for work permits. Essentially the provision requires that persons doing certain work shall require written permission from a person responsible for the work. In the Operators’ permit to work system it is clear that the designated authority (who issues the permit) is the person authorised to grant permits. As we shall see the designated authority was the Lead Production Operator. Regulation 30(2) provides checks to ensure that those carrying out certain work are themselves competent or closely supervised. Thus the OIM has the ultimate responsibility for safety on the platform and he exercises his function by delegating to competent persons.

In practice the platform was under the direct control of the OIM. There was only one OIM on the platform at a time so that if for any reason he was not available his responsibilities would devolve upon the Operations Superintendent. The Operations Superintendent reports to the OIM and is responsible for the safe production of oil and gas on the platform. This of course involved the responsibility of seeing that personnel were doing their jobs safely and properly. However the persons who had immediate and direct responsibility for supervising the production process were the Lead Production Operators. The Lead Production Operator in charge of production on the night of the accident was Robert Vernon and although he had recourse to senior managers if required he had to make the immediate decisions about the production process. Thus although he had immediate control when he was on duty he was just one in the ranks of line management. The defenders attempted to make much of Mr Vernon’s responsibilities and contended that Mr Vernon was the person who effectively represented the company in respect of the running of the process at the time of the accident. He certainly was the person "with hands on the job" at the time. As Mr Snape said "the supervisor and the designated authority is the one in overall control of what is going on in the operation". The Lead Production Operator could in an emergency shut down the plant and indeed even the Control Room Operator had an Emergency Shut Down button that he could use if necessary. Indeed after the explosion, the Control Room Operator, Mr Bollands, pressed this shut down button. However the shutting down of process was expensive and involved various subsequent problems so that it would not be done lightly.

In the light of the foregoing Mr Snape maintained that it was essentially the operations staff who caused the platform to function and everyone else was really there for support. Mr Snape also said that a function of the Permit to Work procedures was to ensure that a designated authority coming on duty was made aware of what had been happening on the previous shift. In respect of the specialist contractors the designated authority would still have the responsibility in a general sense for monitoring and supervising them and keeping them informed of the workload. The OPCAL safety personnel also monitor the contractors’ activities.

OPCAL engaged contractors upon contractual terms that obliged the contractors’ employees to comply with the requirements of the OPCAL’s Operations Manual. The contractors employees were also bound to observe the requirements of OPCAL’s General Safety Procedures Manual and of course as we have seen this incorporated the procedures for the Permit to Work system. OPCAL retained the right to stipulate not only which work was to be performed by the contractors’ employees but also how such work was to be performed. The Operators retain an ultimate control over the personnel the contractors may use and they could remove such personnel. The details of the work to be performed were set out in Schedules attached to the contracts. Indeed the work was most closely specified. The times to be worked by contractor’s personnel are specified as are provisions for overtime. The contracts provide that the work of the contractors shall be subject to inspection and approval by the Operators. The contractors are to provide competent and skilled personnel. The form of the Contract in the case against BT was somewhat distinctive but the contracts in the other cases illustrate the points I have been making. The point that the defenders were at pains to emphasise was that in the contracts there was a clear distinction between the Operator’s operations and the carefully defined workscopes which delineate the work the contractor has to perform. Although the Score contract is not one of these in the seven indemnity cases dealt with in the proof it is obviously a significant contract since it sets out the obligations Score had undertaken in respect of valve maintenance. Score of course were specialist contractors. The Contract was produced and is Number 12/366 of process. In paragraph 3 of page 3 of 9 in the first section of the contract there is a heading "Scope of Work". It is there declared that the work involves inspection, refurbishment, testing and re-certification at any part of the OPCAL operations which are both onshore and offshore. There is therefore a specific distinction made in the contract between "operations" and "work". The contract also provided that Score’s labour force and valve crew shall be responsible to OPCAL’s Maintenance Superintendent on-board Piper. It has to be noted that until the day before the accident the Maintenance Superintendent had been Mr Todd. He was due to be replaced by Mr Barry Clark but it seems that for some unknown reason Mr Clark did not arrive on the platform. On the other hand the Maintenance Superintendent had a deputy. OPCAL had once again reserved for themselves the right to supervise and control the work. They specified that the contractors’ employees attained a reasonable standard of competence and reserved the right to have anyone who was not competent removed. The scheme is clearly that the contractors are responsible for the proper carrying out of the work but their work is subject to overall control and inspection by OPCAL.

It has to be noticed that given the considerable standards expected by the Contract in respect of their work there seems no doubt that in general Score worked to a reasonable standard. They had been on the platform for valve maintenance work during March, June, and July 1988. Their work during that time was wholly acceptable to OPCAL’s Maintenance Superintendent, Mr Todd. During the periods in question Mr Rankin and Mr Sutton had been on the platform for Score acting as valve fitters.

As well as a safety Manual OPCAL had a Operations Manual (number 12/3 of process) and this had been revised as at February 1986. The purpose of this manual was to provide guidance for operators in the field in respect of the equipment and its operation. The Engineering Department also used it as a reference document. It was divided into 9 sections namely Platform Construction, Platform Loads, System Description, Procedures, Drilling, Diving, Safety Equipment, Communications and Miscellaneous. The document contains much detailed information about fire and gas detection and also hazard classification. Obviously practice and procedures developed because I heard evidence of approved practices that were not in strict accordance with the Manual.

The General Safety Procedures Manual had been introduced in October 1987 (number 12/405 of process) to supersede a 1982 Manual. It dealt with the institution, monitoring and control of safety policy for offshore operations as well as details for personnel safety, safe operational procedures, control of maintenance procedures and the control and use of hazardous substances. There was also a statement of OPCAL’s Health and Safety policy. Some aspects of the 1982 Manual continued in force such as the arrangements for safety auditing which were not repeated in 1987. As has been noted already this Manual deals among many other matters with the Permit to Work procedures. The Manual confirms that OPCAL at least aspired to maintain a tight control over anything that happened on the platform that might affect safety.

The defenders asked me to make findings in terms of a summary they gave me and given that the matters that concerned them seem perfectly clear it may be helpful to summarise certain of the findings that I can make in respect of this chapter. First, the Piper Alpha platform was placed in the North Sea in order to take hydrocarbon mixture from beneath the sea-bed, process it and export it. Second, the operations performed on the platform were inherently dangerous and hazardous. Third, the Piper Alpha platform was at all material times operated by OPCAL. Fourth, OPCAL were the deemed owners of the platform in terms of the Mineral Workings (Offshore Installations) Act 1971. Fifth, OPCAL in their capacity as Operators, had the management and control of the platform. Sixth, the core process of making oil and gas flow was performed by OPCAL’s Operations Group. Seventh, while the Operations Group were the ones operating the platform others were required for the support functions. OPCAL relied mostly on the employees of contractors for these support functions. Eighth, OPCAL engaged contractors upon a basis that entitled OPCAL to stipulate not only what jobs were to be performed by the contractor but how such jobs were to be performed. Ninth, OPCAL engaged such contractors upon a basis that entitled OPCAL to impose such supervision and guidance of a contractor’s work as it saw fit to furnish. Tenth, OPCAL had direct management supervision of all work performed on the platform whether performed by their own employees or contractor’s employees. Eleventh, all personnel on the platform, whether OPCAL’s employees or contractors’ employees, were bound to perform work in accordance with the OPCAL’s Operations Manual under the OPCAL General Safety Procedures Manual. Twelfth, all personnel on the platform, whether OPCAL’s employees or contractor’s employees were bound to perform all their work on the platform under regulation by OPCAL’s Permit to Work system which gave OPCAL control of any task which they regarded as other than routine and non-hazardous. I do not regard any of these findings as difficult to make.

As is generally well known shortly after the Piper Alpha disaster a Public Inquiry was held by the Honourable Lord Cullen. This began at Aberdeen on 19 January 1989 and the evidence at the inquiry lasted 125 days. Some of the contractors who are defenders in the present seven test actions were represented at the inquiry for their interests. I was told in evidence by Mr George Smith that the inquiry was in two parts and that in part one the circumstances surrounding the accident were investigated whereas part two was concerned with recommendations as to possible future safety measures. From time to time during the Proof before me the evidence of a witness was tested by his being asked if he has told the same story in evidence at the Inquiry. However I was not shown the final Report nor told of its conclusions. Thus except in a very general sense I am not aware of Lord Cullen’s conclusions. Nor am I aware of the basis of his analysis of the incident. Except for a few matters of detail I do not know the evidence which was before the Cullen inquiry but clearly the present proof was differently focused and more extensive in scope. Certainly there were witnesses in this case who did not appear at the Cullen Inquiry and others who had reviewed their positions since the Inquiry. The findings of Lord Cullen’s inquiry did not enter into my own consideration of the circumstances of the accident and I am not aware of the extent by which my own findings may coincide with or differ from Lord Cullen’s views. I mention this because the findings of the Cullen Inquiry aroused much interest when they were first published so that it may be important to emphasise that this Opinion is not in any sense a review of these findings.

The structure of the Piper Alpha platform was relatively complex. Detailed evidence of it was given by the pursuers’ witness, Mr Konrad Wottge, (whose evidence lasted 18 days) and apart from certain limited areas his evidence was unchallenged. At the time of giving his evidence Mr Wottge was Vice-President operations for Occidental Columbia which job involved responsibility for the production operations of that company in Columbia. He had been transferred to Columbia from Aberdeen in 1991 until which time he had been in the employment of Occidental International & Production Company as a facility engineer. Much of his work was connected with the operations of OPCAL. He held a B.Sc. in civil engineering and also had other professional qualifications in engineering. He had spent all his working life as an engineer in the oil industry (working on - and offshore in a variety of countries) and I was impressed by the high level of his practical knowledge of his area of expertise. He came to work in the North Sea in 1976 and was assigned to work with OPCAL. His position eventually was that of Facilities Engineering Manager and that was the position he enjoyed at the time of the accident in 1988. His responsibilities included all plant and pipelines downstream of the wellhead. It included the overall structure of the platforms and the network of pipelines. He was also responsible for the Flotta Terminal facility. Originally he had visited the Piper Alpha platform frequently, sometimes spending weeks aboard, but as his responsibilities developed he would visit the platform about once every two months. Initially the plant on Piper Alpha had experienced certain operational problems and Mr Wottge had been involved in sorting these out. He had prepared a Report and Glossary (number 12/1 of process) which he spoke to in his evidence. He also illustrated his evidence with a number of detailed drawings and schematics. The schematics were prepared under Mr Wottge’s direction. He claimed that his Report represented a general description of the design and operation of the Piper platform and associated pipelines and I think this contention was on the whole well justified. He also spoke to the Piper Alpha Operations Manual (number 12/3 of process ). This was issued to persons who had been working on the platform to give them operational instructions how to operate the individual items of equipment including data on the relevant structures of the platform. His evidence was also illustrated by two models which were in court, by photographs of the original model and by photographs of the platform (12/8 of process). Mr Wottge spoke to the general accuracy of the models (although they could show nothing like all the detail on the platform) and they were used to give a picture of the general features of areas of the platform for experiments carried out by the pursuers’ experts. The original model had been built for various practical purposes like training operators but once the platform was running it was donated to Aberdeen University. After the disaster it was retrieved and formed the basis of the models in court (12/6 and 12/7 of process) although these did not contain as much fine detail as the original. The scale of the model is 1 to 33. A further model in court of the whole platform (12/5 of process) is 1 to 100 scale. Photographs numbers 69/1 and 69/2 of process also show certain details of the original model and were relied upon by Mr Wottge but have to be regarded with a degree of care since they became inaccurate in certain minor respects as the modules were developed. However they show that there was much more pipework in the Modules than the reconstructed models show. In fact I found the models in court were useful for illustrative purposes in relation to evidence being given but not much else. However Dr Davies used the models for his experiments but in any event I think his results were intended to be no more than approximate. Certainly at best that is how I would have regarded them. The photographs 69/1 and 69/2 were not in court when Mr Wottge gave his evidence (and the remaining photographs of the original model were never produced). Therefore he could not be examined about them but I do not think this could bear on the outcome of the proof. It should also be noted that the defenders did not seek to recover documents relating to the structure of the platform or models from the pursuers. Since photographs of the platform (number 12/8 of process) were taken at different dates they too have to be regarded with some care. At best the problems about models and photographs concern matters of detail since witnesses who had been working on the platform at the time of the accident seemed happy to accept them as being representative of what they were describing. Occasionally when a witness thought that matters had changed since a photograph he said so.

In his evidence Mr Wottge relied on a number technical drawings and reports. A point was made that he was not always asked to identify the sources of particular passages in his report. It is possible that he had relied upon documents not lodged in the proof. This was said to cast a degree of shadow over his reliability. However considering that the platform was an immensely complicated structure and that Mr Wottge was in the witness box for many weeks I do not think the pursuers could have expected him to consider every detail in the report comprehensively. The defenders had ample opportunity to challenge him about any detail that concerned them. He was very familiar with the general structure of the platform and had obviously compiled his Report with care. A substantial number of documents of a technical nature were lodged in process. The defenders say that a drawing only has evidential value if it reflects accurately the position on the platform at the time of the accident. That statement is probably unexceptional. The defenders contended that insofar as some of these documents were copies they could have been authenticated under Section 6 of the Civil Evidence (Scotland) Act 1988. This was not done. However I am happy to accept that in compiling his Report Mr Wottge relied wholly or largely on technical Documents which formed part of the Company’s general records. If the defenders thought that he may not have done so they were of course free to examine him in detail about this. In any event most of these technical documents only had illustrative significance.

The defenders made the point that some of the documents produced do not accurately represent the position on the platform. Equipment can be built and then modified rendering original drawings inaccurate. However such inaccuracies on the whole relate to points of detail. Thus production 12/83 purports to be a representation of the B/C firewall. On this there is a representation of a sliding door and in fact there was a hinged door on the actual wall. In some of the drawings relating to fire detectors the location of these had been in error as to the heights of the detectors since on many occasions their position had been adjusted. The defenders pointed out that drawings marked "as built" had more authority than others because they represented the final drawing of the structure after it had been built. It was suggested that very few of the documents produced were marked "as built". For example in relation to the B/C firewall all that was produced was a design drawing, which may have been modified during construction, and not an "as built" drawing. Mr Wottge accepted that even the "as built" documents were not all wholly accurate. The ongoing process of modification, addition, and removal which continued to the date of the accident was not always reflected on the Drawings produced. However Mr Wottge indicated that what he described as "key drawings" were generally kept up-to-date. Drawings were from time to time reviewed for the purposes of structural certification which occurred every five years. It should perhaps be noted that Mr Wottge indicated that he was not aware of any significant changes in the flooring of the Modules having occurred although there was localised strengthening. Nor was he aware of the ceilings being altered. Some of the drawings produced were made after the accident on Mr Wottge’s instructions. The pursuers had a difficult task in respect of proving the detail of the structures on the platform. The platform itself was not available for checking . Some of the records had gone to the bottom of the sea. This the defenders argued just emphasises the uncertainty hanging over the pursuers’ attempt to prove the cause of this terrible accident. What they presented seemed to me on the whole to be the best available evidence of the platform’s structure. Insofar as details may have been doubtful the witnesses speaking to the matters in question were largely able to point these out if they were significant. It should be noted that Mr Wottge claimed that many of the documents produced were used by him as the basis of his work. For example through his work he was very familiar with Module C but if he required detail such as measurements he would often take these from the available documents.

I considered that I was provided with reasonably satisfactory material as to the structure of the platform subject of course to consideration of particular points which the defenders asked me to consider especially and claimed to be significant.

In general I found Mr Wottge to be a very informative witness whose views were worthy of respect. He had a sound personal recollection of the basic structure of the platform and personal knowledge of many of the details. However for some details he had to avail himself of the recorded material available to him after the accident. He had some experience of the production processes but his experience was less extensive than in regard to structural matters. His knowledge of alarms, process controls and trips was also limited.

I was provided with an extensive book of Schematics. I accept that these are only of evidential interest insofar as they are spoken to by witnesses familiar with their contents. They were really lodged to help illustrate the technical evidence. They of course are not to scale and on occasions witnesses pointed out inaccuracies.

The Tartan Field was discovered in 1972 or early 1973 and following thereon the platform was designed and built. The oilfield operated under Licence Block 15/17. The constituent parts of the platform and, in particular, the jacket, deck support frame, and modules were built onshore and later shipped to location on the field. Over the years the platform was changed and modified. By the end of 1980 a Gas Conservation Module had been installed and was in operation. The field was highly productive. Initially the field produced 250,000 barrels of oil per day and that increased to 300,000 barrels during the early years of production. However by July 1988 the production had declined to about 125,000 barrels per day. To accommodate the production from the field Occidental built a pipeline to Flotta on Orkney and installed a process plant there.

The Claymore field was discovered approximately one year after the Piper Field and operated under Licence Block 14/19. The Claymore platform was developed and the field came onstream about November 1977. Oil produced by this field was also exported to the Flotta facility by means of a short pipeline which linked into the pipeline from Piper Alpha to the Flotta Terminal.

The discovery of the Tartan Field post-dated the discovery of the Claymore field. A platform was built which was owned and operated by Texaco North Sea Limited and this came onstream about 1979.

Two years after the Piper Field the Frigg gas field was discovered. Gas produced from this field was exported to the shore through a pipeline and a booster platform known as the Manifold Compression Platform number 1 (otherwise known as MCPO 1). MCPO 1 was operated by Total Oil Marine. The gas produced by both the Piper and the Tartan platforms was also exported ashore by way of MCPO 1.

Subsequently to the discovery of the Claymore field a small field know as the Scapa field was discovered about 7 miles from Claymore. This was exploited by means of a sub-sea production facility. This facility was controlled from the Claymore platform and the oil production from the Scapa field was piped via the Claymore platform to the main oil line and subsequently to Flotta.

The Piper oilfield is situated about 120 miles north-east of Aberdeen. It has an oil reservoir situated about 8,000 feet below the sea level and the water depth at the location is 474 feet. The reservoir covers an area of approximately 12 square miles. The natural pressure of the reservoir is about 3,400 lbs per square inch absolute (psia). The design criterion for production was for a total of 36 wells.

The platform was orientated 43 degrees counter-clockwise from true north so as to coincide with the direction of the most severe wave loading. The longitudinal axis was referred to as "platform north" and other directions referred to in the productions such as east, west, and south are with reference to platform north.

The platform was anchored to the seabed by each of its four corner legs. Around each corner leg was a skirt pile driven into the seabed. The sub-structure from the sea-bed to the surface of the water and up to the 20-foot level was known as the jacket. The deck support frame was attached to the jacket and its purpose was to provide a frame structure to support the deck and the various deck modules that had to be installed. The top part of the deck support frame was known as the 68-foot level (such levels referring to levels above the sea.)

The 84-foot level consisted of four modules A, B ,C, and D. A, B, and C were the main production modules. Module D was the generation and utilities module. These modules as with other structural equipment had all been fabricated onshore.

The next main level up was the 107-foot level which housed inter alia the Mud Module and Storage Module on the west, and the Gas Conservation Module (also known as the G CM or Phase 2 Module) and Utilities module on the east. The 133-foot level contained the pipe deck and the 174-foot level the helideck. The accommodation modules were at the north end of the platform and were at levels ranging from 121 feet to 174 feet.

There were ten jacket legs. On the east side they were numbered from north to south as A1 through to A5. On the north side the legs were numbered from south to north as B1 through to B5.

2.5.1 The West

The west face of the platform is shown in the drawing 12/18 of process and in various aspects in the photographs which are 12/8D, 12/8E, 12/ 8F, 12/8G and 12/8L of process. The western ends of Modules A, B, and C were open. In the said photographs the west crane pedestal is shown at the join of Modules B and C. The Chanter Riser gantry is shown in the photograph 12/8L. The west face of the Dive Package which was mainly at the 64-foot level, substantially below Module B, is also shown in these photographs.

2.5.2 The North

The north face is shown in the drawing 12/15 of process and in the photographs 12/8B and 12/8C of process. The said drawing shows the main oil and gas risers which carried the oil from Piper Alpha to Flotta and other platforms . The 30 inch diameter oil export riser is approximately at the centre of the north face. The 16 inch diameter Claymore Gas Riser is to the west of this and formed part of the gas pipeline linking Piper Alpha and Claymore. At the north west corner of the platform was a Navigational Aid Platform from which point a number of men were able to escape the platform after the accident. The photographs 12/8B and 12/C also show the turbine exhausts of the John Brown Turbines. The orange cabin seen on the north face in photograph 12/E was the Maintenance Superintendent’s office.

2.5.3 The East

As with the western ends the eastern ends of Modules A, B, and C were open on the east face. The crane pedestal on the east is again at the point where Module B joins Module C. The photographs 12/8H and 12/8I of process show the east face and the GCM can be seen above Modules B and C at the 107-foot level. The utility module is adjacent to the GCM to the north. Stairways linked the 107-foot level down past the east face of Module B and down to the 68-foot level. On the east face and to the left was sub-Module D.

2.5.4 The South

The South face elevation of the platform is shown in the drawing which is 12/16 of process whereas the relevant photographs are 12/8C and 12/8 D. The south face is dominated by the east and west flare booms. There is in consequence of these a heat shield on the east, west, and south sides of Module A. The precise location of this is shown on the drawing 12/16 of process. The flare booms were each about 165 feet in length and it was necessary to have two to accommodate changes in wind direction. Each flare boom had two flare tips. Low pressure material flared through the low pressure flare and gasses from high pressure sources flared through the high pressure flare. When passing relatively high rates of gas the flare made a noise and would get bigger. Even in normal operation there would be some variation of flare. When the process was in Phase 1 a greater amount of gas went to flare than was the case with the Phase 2 process. There was a stairway immediately inside the heatshield to the south side of Module A linking the 84-foot level to the 107-foot level. This stairway was about I metre out from the module and there were some structural members between it and the module. Furthermore there were Navigational Aid Platforms at the east and west of the south elevation and particularly the west of these played a part in permitting some men to escape the conflagration.

2.6.1 General Description

The overall layout of the production level ( the 84-foot level) is set-out in the layout drawing 12/108 of process. Since Module A was considered to be the most hazardous module the production modules on the platform were arranged to provide maximum separation between Module A containing the wellheads and Module D containing various utilities and also separation from the Accommodation Modules. Modules A, B, C, and D, were each divided by firewalls referred to respectively as the A/B, B/C, and C/D firewalls and were really set in sequence according to the supposed level of hazard in each. Mr Wottge indicated that gas leaks did from time to time occur in Module C but he said that most of these were very small. The position of any leaks that were not small was not explored. Thus for example I do not know if any previous leaks had given rise to an escape of gas such as could have caused a serious explosion or indeed how and when the leaks had been noted. He gave some examples of situations that could feasibly cause a leak and these included faulty pump seals, valve stem leakage, gasketed joints, leaks at sampling points, operations which breach containment, effects from corrosive fluids, and loose connections at the pulsation dampeners. The potentiality of such leaks was not really explored with Mr Wottge. Nor was he asked if the detection arrangements were such that he would have expected any such leak to be detected. He did not say that leaks had occurred that were not detected until the gas reached dangerous levels. Mr Wottge also indicated that the frequency of recorded leaks in Module C was higher than in B. Thus although Module B had a higher hydrocarbon inventory than C in general there was less chance of it leaking. Of course in Module C there was much more pipework and vibration. It seems that on one occasion there was a serious oil leak on the Claymore platform due to an unexplained failure of a pipe but what this involved and how it was detected are facts that were not explored.

Module A was the wellhead module and that was where the wellheads controlled the flow of hydrocarbons and water produced from the wells. Module B was a production module where inter alia the separation of oil from other fluids took place and where the oil was pumped into the main oil line (the MOL) for transmission onshore. Module C was the gas compression module where some of the gas processing took place. Module D was the generation and utilities module and contained the Control Building, the main generators, the switchgear and other utility systems.

The open ends of Modules A, B, and C, allowed access to personnel and also natural ventilation. The south face of Module A was also open. The east and eastern half of the north face of Module D were also open and this can be seen in the photograph 12/8E of process.

Each module was approximately the same dimension namely 50 feet (15 metres) wide, 24 feet (7.5 metres) high and 150 feet (46 metres) long. The decks and ceilings of Module B were of three-eighths of an inch steel plate throughout. The ceiling of Module C was likewise plated throughout and the deck from the west side to the skids on which the centrifugal compressor stood at the east end of the module. Between the skids in the modules at a height of about 18 inches above the deck floor were walkways consisting of grating and these were to enable personnel to walk between various pieces of equipment. One witness described this as a labyrinth of gratings. There were various estimates by witnesses of the height of grating above the deck but 18 inches to 2 feet seems to represent a fair consensus. In Module B the grating ran throughout the module so that personnel would be walking on grating rather than deck. In relation to Module C there was a considerable amount of grating.

The witness Mr Henderson thought that in the area of the compressors there was also some solid plating above the deck. He observed that there was a considerable amount of cabling underneath the grating. However on this matter I found Mr Henderson rather imprecise and not wholly consistent. The witness Mr Ferguson contradicted Mr Henderson and was firm in recalling that the walkways in Module C were grating. His evidence was not challenged. Certainly on the basis of Mr Wottge’s evidence there was grating on the outside platform adjacent to Module C. This matter of grating could have some bearing on the manner of response of certain detectors. There does not appear to have been a walkway down the south side of Module C. This may be significant because the expert Mr Cubbage bases some of his calculations on the assumption that there was such a walkway.

The floors of Modules B and C were of steel plating and were of substantial construction in order to hold the weight of the heavy equipment that was placed on them. The ceilings of the modules were also made of steel and of substantial construction to hold the weight of any equipment placed on top.

A walkway ran along the west side of the 84-foot level outside Modules A, B, C and D and this passed around the crane pedestal. This walkway passed outboard of the crane pedestal and whether the part of it which also passed inboard of the pedestal was passable is not entirely clear but there seems at least to have been a space. The said walkway also ran past the other faces of the platform.

Firewalls were attached to the trusses between each module. It is important to note that these were not designed as blast protection walls and their function was to localise fire and to prevent it spreading to other modules. They were constructed of light steel plates and material called Durasteel. The fire rating for the A/B and B/C firewalls about 4 to 4.5 hours and the C/D firewall had an extended rating of about 6 to 6.5 hours.

2.6.2 Module A

This module had 36 well slots in three rows of 12. Each well had a wellhead which comprised a number of valves and associated pipework known as a "christmas tree". Associated with each christmas tree was a well safety shutdown panel. Each of these had its own controls to shut the flow from its well and these panels were located on the north side of module adjacent to the firewall. The firewall was in the north separating Module A from Module B.

The water injection system was also located in Module A. This system was required for the re-injection of sea water into the oil reservoir in order to maintain pressure. The sea water pumps were located to the south of the module and the course filters associated with these pumps were located in the south east corner. The de- oxygenation towers, which were part of the system, were located at the south end. Water was extracted from these towers using the three water booster pumps located immediately to the west of the towers. The booster pumps then fed the three water injection pumps and these were located at the west end of the module.

At the north wall to the east of the module there was a Chemical Injection Package. This included a tank which contained compartments of chemicals primarily for the water injection system. The overall length of the tank was 25 feet, the width 10 feet and the height 12 feet.

The heat shield that went round the east, south and west sides of the module was located beyond the walkways which surrounded these sides of the module. It was designed to protect against the radiant heat of the flares and comprised two layers of tightly woven stainless steel mesh. A person in module A could see through the heatshield mesh.

Means of access to the module could be obtained via the east and west face walkways. Stairways to the north side of the module allowed access to the 68-foot level. There was also a stairway going up to the skid deck and down to the 68-foot level on the south face.

The defenders made the point that Module A was extremely congested and so it was but perhaps no more so than say Module C. The defenders make this point to explain why a witness such as Mr Gutteridge may not have seen a breach in the A/B firewall.

2.6.3 Module B

In this module the two main production separators were located in the centre of the module. These were essentially identical and were large cylindrical vessels measuring approximately 11 feet in diameter by 44 feet in length. Their function was to separate the oil, gas, and water extracted from the reservoir. They were fitted with internal baffle plates which deflected the fluid and assisted with the separation process. The fluid separated into three flows by means of gravity separation. These vessels had no moving parts. The water being heavier than the oil settled in the bottom. The oil floated to the top of the liquid level where it flowed over internal weirs and was pumped out of the end of the vessel. The gas being the lightest came out of the top of the vessel. The residence time of the oil within the separator was 2.5 to 3 minutes. The liquid level in the separator was slightly below the centre line of the vessel and gas occupied about 60% of the vessel volume.

Immediately to the west of the separators were the three MOL booster pumps. There was one booster pump for each separator the third serving as a spare. The discharge line from each pump was routed to one of the three metering runs. Each such run consisted of a fiscal turbine meter and associated pipework. The meters themselves were located towards the north of the module approximately 10 feet from the firewall. The metering skid occupied a little more than 50% of the width of the module.

The four MOL pumps were at the west end of the module and indeed could be seen at the west face from outside the module as is demonstrated by photograph 12/8G of process. Moving from north to south these pumps were designated B, A, C, and D (the order being due to their historical development). The configuration of these pumps is shown in the schematic 12/97 of process. The MOL itself had a diameter of 30 inches and was located between the MOL pumps and the metering skid. It penetrated the floor of the module as it made its way downwards and thereafter dropped vertically at a point just below the 68-foot level. It then turned through 90 degrees and was routed in a northerly direction, going slightly to the east beneath the 68-foot level, to the north face of the platform. From there it turned through another 90 degrees angle before descending to the sea-bed. On the MOL at a point before it penetrated the floor in Module B was the emergency shut down valve designated ESV-208. This was a large valve (weighing up to 3 tonnes) and although described in the Operations Manual as working manually it in fact at the time of the accident was set to be closed by an electric motor backed by a pneumatic device. The piping was about 20 inches in diameter and the valve was approximately 36 to 40 inches long and about 36 inches in diameter. The valve was approximately 8 to 10 feet above the floor. It was designed to close in the event of an emergency. It was suggested by the fire engineer Dr Drysdale that this valve may have been damaged by the explosion causing it to fail to close after the accident. The valve because of its special significance was subject to regular checks.

Situated above ESV-208 was the tie-in point for the four inch diameter condensate line. This pipeline came from the condensate injection pumps at the 68-foot level up to Module C and then passed through the B/C firewall to the east of the door in that firewall. Once in Module B it then turned west and ran parallel with the B/C firewall for about 17.5 feet or so. It then turned through 90 degrees and ran south for about 15 feet 10 inches before tying in with the MOL. It was supported on hangers. Mr Wottge was not entirely familiar with the layout of the condensate line. He took his detail on this from a Schematic but as I have indicated it was not proved that these were to scale and indeed it was clear that many were not.

The door on the B/C firewall was about 30 to 40 feet from the western end of Module B. It had been supplied by Durasteel Limited. It had a self-closing mechanism. However there was evidence that during the day shift on 6 July 1988 this door had been partly open to accommodate some work intended for the west end of the Module. One would expect that if the work did not extend into the nightshift then the cables would have been dealt with when the permit was suspended. There was no evidence to suggest that work at the West end of Module B was continuing at the accident. The defenders claimed that no tests had been carried out to determine the quantity of gas that would have had to be released from the door to trigger an alarm at the detector in the C3 zone.

The pig launcher (apparatus used in connection with cleaning-out the MOL) was designated 1-P-103 and was positioned between the MOL pumps and the metering skid along the same axis as the MOL. Its position can be seen by reference to photograph 12/4A or the video 41/21 of process. There was a stairway over the pig launcher which gave access to the main walkway which ran down the southern side of the separators.

The test separator (designated 1-C-109) was to the east of the production separators about midway between the north and south sides of Module B. The vessel had an outside diameter of 7 feet and it was about 20 feet long. To the north of this separator was the condensate knock-out drum (designated 1-C-104) and associated with this, and directly to the west, were two condensate transfer pumps. They were in-line pumps sitting within the pipework. Just to the north of the condensate knock-out drum and near the floor were two pressure control valves , namely PSV 51/1 and 2. These were designed to relieve gas pressure to flare and if necessary this would have happened if a centrifugal compressor failed. However during normal Phase 1 operation no gas passed through these valves. The gas that got to flare at or about the time the compressors failed suggests to me that these pressure valves were functioning properly.

Along the east face of Module B there was a bank of four gas coolers. These were substantial pieces of equipment as can be seen from Photograph 12/4A of process. Between the production separators and the condensate knock-out drum at the east end of Module B were two fuel gas filter separators, one on top of the other. These were horizontal cylindrical vessels and were about 2.5 feet in diameter and 7.5 feet long. Within these vessels were filters through which gas would flow.

To the south of the production separators and along the A/B firewall were the inlet manifolds. There were about 27 flowlines connecting the wellheads in Module A with the main inlet manifold. Each flowline fed into one of the three main manifolds. The manifolds were connected to the production separators and also to the test separator. The total length of the manifolds was about 100 feet running west to east. The main emergency shutdown valves for the manifolds were located in the east end of the manifolds and adjacent to the A/B firewall.

On the floor of the module various items of equipment such as the MOL pumps, the metering runs, and the separators were located on skids. These consisted of beams of substantial construction used to support the equipment placed on them. Each skid formed a bounded area and each such area had a drain which allowed material collected there to be routed to the sump pile which was located at the south east corner of the platform at leg A1 at the 68-foot level. Generally above the skids and about 18 inches to 2 feet above the deck plating there had been placed grating to allow access for personnel to the module and equipment.

Pipes led out of the module and to allow this there were a series of pipe penetrations. Generally these were fitted with collars and were not necessarily sealed. Gaps ranging from quarter of an inch to about three quarters of an inch existed between pipes and collars. Such an unsealed gap existed where the MOL penetrated the floor of the 84-foot level. If escaped oil had collected on the floor of the module at the west end then it could have flowed through the grating and drains to the sump or, if for any reason the sump could not accommodate the quantity of the escape, it could have flowed through the gap at the MOL penetration. The witness Mr Amaira had been at the 68-foot level shortly before the accident and in the vicinity of the MOL but he had not noticed any oil flow. On the other hand the collars round the pipe penetrations had a lip about one and a half to two inches high so that water or oil would not escape through the pipe orifice unless it was deep enough to flow into it. The defenders suggested that it was only in relation to the MOLs that the evidence showed gaps at the pipe orifices. Certainly it is difficult to tell from the evidence if it was only the MOL penetrations which had collars or all penetrations although at one point in his evidence Mr Wottge seemed to suggest that the use of collaring for pipe penetrations was fairly general. I think if a pipe penetration did not have a collar it would be sealed.

The defenders made the point that the north-west corner of this module was a great deal more cluttered than would appear from the model of it in court and this is probably correct.

2.6.4 Module C

Although Module C was open at each end the opening at the east end was restricted by the centrifugal compressors. There were three of these and they were designated A, B, and C running from north to south. Each centrifugal compressor consisted of a compressing machine driven by a gas turbine. The gas turbine had its own air filtration unit. The air filter and part of the gas turbine of each compressor protruded from the eastern end of Module C. The gas turbines required a supply of combustion air. The air filters were used to draw in such air and filter it. Each compressor was located within an enclosure divided into two compartments, one having the gas turbine machine and the other having the compressing machine. The enclosure was approximately 10 feet high 8 to 10 feet in width and 30 feet in length. Each machine had its own exhaust which was on the east face of Module C and extended upwards above the 107-foot level. The ventilation intakes for the compartments again was located on the eastern face of Module C. Each compartment exhausted air into Module C through louvres. In the Operating Manual the suction pressure of these compressors was shown as 190 psig whereas in practice they operated at 140 or 150 psig. The system required about 27,000 standard cubic feet per minute of combustion air and about 8,000 of ventilation air. The combustion air was drawn into each compressor from the outside and was drawn into the machine through the grating outside the end of the skid. About 75% of this air would come from below and depending on ambient conditions some might come from the east or from within Module C. The ventilation air was drawn in outside the east face of Module C towards the south side of each compressor. A centrifugal detector would not trip if it only detected enough gas for a low alarm but would trip if the gas level reached about 50% which is rather less than the level required for a high alarm. The ventilation air is not just for personnel entering the compressor compartment. It is cooling air as well. As I have indicated it escapes from the compartment through a louvre. There was a louvre for each compartment. The first alarm that went off was associated with the southmost compressor. Ventilation air would be continue to be drawn in for about two hours after a compressor had tripped.

To the west of the centrifugal compressors was an equipment package known as the centrifugal compressor skid. This comprised equipment auxiliary to the operation of the compressors and, in particular, suction and discharge scrubbers and discharge coolers for each of the compressors. A scrubber is equipment which alters the velocity of gas flow by altering direction and flow area for the gas stream. The alteration is accomplished by baffles within the scrubber. The equipment in each centrifugal compressor skid was known as a "train" and there was one for each. The area was quite congested because of the quantity of equipment. Indeed this congestion would have caused a sufficient degree of restriction in the event of an explosion in Module C to have created vibration of the platform structure as the rushing gases encountered it.

To the south of the skids were fresh water pumps and coolers of which there were two one on top of the other. Between these coolers and the B/C firewall were two pumps and a vertical vessel associated with fresh water circulating system. Two pressure control valves, namely PCV 1000 A and B, were located towards the east end of Module C between the reciprocating compressors and the centrifugal compressors. These were positioned at floor level.

In the centre of the module there were two reciprocating compressors A and B (A being in the centre of the module and B being to the west). These were motor driven machines the motor on each being to the north and the compressor unit to the south. These were large machines and occupied a substantial portion of the module. Each machine weighed about 70 tons. There were two compressing stages to each machine known as the first stage and the second stage. The west of each compressor was the first stage compression which utilised three cylinders. There was a suction scrubber for the first stage which was to the north of each of the reciprocating compressors. The second stage was to the east and again utilised three cylinders. The second stage suction scrubber was located to the south of each compressor. The control panel for reciprocating compressor A was on the walkway to the north of the compressor. This was designated as panel JCP-020. The control panel for reciprocating compressor B was in a similar position and was designated as panel JCP-021. If for any purpose it was considered necessary to suspend compression each compressor had a facility to unload and recycle gas. The control panels JCP-020 and 021 were those the operator would have required to use if unloading and recycling was effected. The operator would have to operate seven switches on each panel to complete a particular exercise, that is a total of 14 switches. The defenders argued that it may not have been a coincidence that the reciprocating compressors had been recycled about 5 minutes before the accident.

PSV 1000A and PSV 1000B were pressure safety valves for these compressors and when Phase 1 was in operation PSV 1000A was kept partly open to relieve any excess pressure on the compressors. The state in which the valve was kept in Phase 2 is not known.

The pressure safety valve PSV-504 was located close to the second stage suction scrubber of the reciprocating compressor and was approximately 15 to 20 feet above deck level. This valve is shown in red in the photograph of the 84-foot model 12/14B of process. The position of this PSV as shown on the model is only approximate since it had been moved at one stage but it is clear from the evidence that the actual PSV was close to where it is shown to be. The witness Mr Grieve located the PSV to the east and south of reciprocal compressor A. Mr Bollands said that the PSV was on the south-east corner of a reciprocating compressor. Mr A G Clark said the valve was close to the freshwater pump on the south wall of Module C just about level with the walkway. This does not accord with the balance of the evidence. Mr Bagnell located the valve as being between the reciprocating compressors and the centrifugal compressors but nearer to the former. Mr Todd said that it was in Module C just to the east side of the reciprocating compressors. The witness Pirie thought that the valve was just above the reciprocating compressors. There was some minor adjustment of the position of the PSV as between the two models that the pursuers produced and the reasons for this were not adequately explained. The defenders contend that the pursuers should have provided more precise information about the location of the PSV such as may have been available if they had lodged an isometric plan . I am not sure that on the whole these descriptions of the location of PSV 504 are materially different. There was some divergence in the evidence about the height of the PSV. Mr Wottge, Mr Grieve and Mr Bagnell said that the PSV was about 15 feet above deck level. Mr Pirie gave the height as being about 12 to 15 feet above deck level but this could be explained if he was judging the height not from the deck but from the walkway. Mr Wottge had agreed with the suggestion that the PSV was close to the ceiling which in fact would give it a height of about 20 feet rather than 15. Mr Todd placed it in the roof space which would also take it higher than 15 feet. Mr Henderson had placed the valve as being close to the manual isolation valve. This raises the interesting question not explored as to how an operator requiring to open the manual isolation valve obtained access to it. We were also never told what steps had to be taken to unlock this valve which when in a closed position was locked. Whatever precise height the PSV valve had we know that scaffolding was required to have access to it for removal for calibration. We also know that it was located above a walkway. We also are aware where the pipe loop on which PSV 504 was sited was located. We know from the expert Dr Davies who did experiments in relation to PSV 504 that moving it a few metres in one direction or another would not make a material difference to his results. If anything the height was more significant.

At the time of the accident Scaffolding had been erected to obtain access to PSV 504 and the presence of this could have affected the dispersion of any leak from the blind flange attached to the open end of the pipe when the valve was removed for maintenance. We were not given any precise information about the size, layout or composition of this scaffolding and all we know about is that it must have been placed in a position to permit access to the valve work. It also must have been of a sufficient dimension to accommodate at least three men and the dismantled valve. The witness Mr McDonald explained that if the PSV is assumed to be at a height of about 15 feet the scaffolding platform would be at about 12 feet but of course I think it is possible it was rather higher although the height of the PSV was only proved within approximate limits. We also know that if work was interrupted the scaffolding was left in situ. Mr McGregor was able to confirm that when about 9pm on the night of the accident he went to do some work near the reciprocating compressor second stage suction scrubber he was inhibited in doing this work because of scaffolding around it. If this was the same scaffolding as the valve maintenance men were using this evidence gives some additional information about the location of PSV 504.

Adjacent and to the east of PSV - 504 was PSV - 505 and both valves were at about the same height. They were about 2 to 2.5 feet apart. The pipe loop in which PSV - 504 was located ran from north to south. There was a manual isolation valve next to the PSV on the horizontal pipework. This was downstream of the PSV and about 1 foot to eighteen inches away. To the south of reciprocating compressor A were gas coolers E - 103A and B and to the south of compressor B were the gas coolers E - 103 C and D. Next to the western end of the gas cooler E - 103 C was the location of the 4 inch diameter condensate pipeline as it passed through Module C on the way to the point where it was routed through the B/C firewall into Module B.

To the west of the reciprocating compressor was the potable water storage tank. Originally this was circular but that tank was eventually replaced by a square tank. The tank, which is light grey, is shown in the photograph 12/8 G. PCV 501 which let down gas to the Claymore pipeline was located to the west of the reciprocating compressors. There were instrument control panels for the MOL pumps to the south and west of the potable water storage tank. There were four separate such instrument control panels and these were constructed from light weight sheet panelling, each having an access door to allow maintenance personnel access to the instrumentation. North of the potable water tanks were two vertical cylindrical vessels, the western of these being the instrument air receiver and the other being the utility air receiver. Associated with the instrument air receiver was an instrument air dryer which was located on the west face of the Module and associated with the other receiver was a compressor which was located to the north of the receivers. In photograph 12/8G can be seen one of the instrument air receivers, the instrument air dryer and the potable water storage tank.

The percentage volume occupied by piping within Module C was approximately 15%. The module was more congested than Module B. Generally, access to the Module could be obtained from the west through two doors fitted for that purpose and forming part of the air filtration units. It was also possible to duck under the hoods to the north and south of the reciprocating compressors A and C. In the western half of the module on the north side there was an open stairwell which connected the Module to the 68-foot level. One of the walkways in the module was to the north of the reciprocating compressors. As in Module B there was grating about 18 inches to 2 feet above the floor and the walkways themselves were made of grating. There was grating between the centrifugal compressors. There were also piping penetrations in the module which were fitted with collars and such penetrations had gaps ranging from between one quarter inch to three quarters of an inch. There were some pipe penetrations associated with the relief lines that went from the 68-foot level to PSVs 504 and 505 and returned to the condensate suction drum 2- C-202 at the 68-foot level. The exact arrangements for the protection or sealing of these particular pipe penetrations was not investigated in detail although there was a certain amount of thermal sealing in the area of the reciprocating compressors to prevent the rise of heat from the John Brown exhausts and also a measure of insulation of the module ceiling.

2.65 Module D

This module is located at the north end of the platform. At the eastern end of the module were the John Brown Turbines A and these were substantial pieces of equipment. They generated electricity at 13800 volts. They were located in cabinets about twelve feet high and most of the east end of Module D was occupied by these. Otherwise the north-eastern side of Module D and the west and east ends were open. The exhausts and inlets of the John Brown generators can be seen in the photograph 12/8B of process. Adjacent to the C/D firewall at the eastern end of the module was the fuel gas heater. Next to the west within an enclosed area there was a diesel driven firewater pump and adjacent to it was an electric-driven firewater pump also called a utility water pump all adjacent to the C/D firewall. They drew water from below the sea level. The two pumps were housed within a fireproof enclosure and access to them was gained by entering the module on the north face, and going down some steps to the right of the John Brown generators. There was also within the enclosure a diesel oil tank to provide fuel for the diesel driven firewater pump and a further such tank as situated outside the enclosure. Outside the enclosure and to the west but again adjacent to the C/D firewall were two additional pumps to provide firewater and utility water for the platform.

Within the western half of Module D was a separate steel structure known as the Control Building and this was on two levels. It was bolted to the ceiling of the module. The outer skin of this building was lightweight steel three-sixteenth of an inch thick. Thus the Control Room itself was protected by a moderately strong independent skin. The lower level is shown in the schematic 12/75 of process. Access to that level could be gained through double doors and an airlock either from the west or east of the Control Building. It housed the Emergency Electrical Room at the south west corner and this contained the emergency electrical switch board. This provided power to emergency related equipment like the fire and gas detection systems, certain motorised valve operators, certain emergency electrical equipment and certain lighting. In the north west corner there was the Heating, Ventilation, and Air Conditioning (HVAC) room. Also in the east of the Control Building was a room containing electrical switchgear and known as the Electrical Room No. 2. This contained the 4.16 Kv bus bar which provided power to a number of electrical motors including the motor of the condensate injection pump. Also in No. 2 room was the 440 volt normal supply switchboard. This switchboard served the auxiliary supplies, the heating, control ventilation and lighting systems. Again in the lower level of the module but outside the structure of the Control Building there was a partly-enclosed area to the West and this area incorporated the workshop known as the Maintenance or Mechanical Workshop. The part of the wall of the Control Building which formed the west wall of the Emergency Electrical Room was a common wall with the Maintenance Workshop at this level as can be seen in Schematic 12/75 of process. Access to the workshop was from a sliding door on the west face and this can be seen in the photograph 12/8F of process. The south wall of this workshop was adjacent to the C/D firewall. Directly to the north of the Maintenance Workshop was an office/tea-room which had formerly been a tool store. Normal access to this area was from the Maintenance Workshop through a doorway which had a sliding door. The west wall of the office/tea-room was an emergency door which was normally closed and generally not used. There was a gap between the Maintenance workshop and the C/D firewall.

To the north side of the Maintenance Workshop was a stairway leading to the upper level of the Control Building. To the north of that stairway was the Instrument Workshop shown in photograph 12/8F of process. It was a portacabin which had been placed at the western end of Module D. Access was obtained through a sliding door on the south wall and this door was always open. There was also a separate internal hinged door before actual access into the work shop could be obtained. In an open area at the north west corner of the module was the diesel-powered Emergency Turbo-Generator which supplied emergency electrical power for critical items on the platform via the switchboard in the Emergency Electrical Room.

The upper level of the control building was called the mezzanine level. Access to the mezzanine level was via the stairway at the west face and this stairway can be seen in the Photograph 12/8F. At the top of the stairway to the north and left was the Safety Office and this was above the Instrument Workshop. Entry was through a door in its south wall. Safety personnel on the platform were based in the Safety Office. In this office completed and suspended permits to work were in certain circumstances filed. To the south and right of the stairway at the mezzanine level were the Electrical Maintenance shop, Electrical Store, and Instrumentation Store. These areas were directly above the Maintenance Workshop and their south wall was adjacent to the C/D firewall. At the top of the stairs to the mezzanine level moving eastwards there were double airlock doors.

To the right on entering the Control Room were the control panels for the John Brown Generators. Moving to the east there was a worktop and visual display unit (VDU). The VDU displayed inter alia information relating to the telemetry system. There was a rack on the worktop which contained the active permits to work according to their designated areas. Further to the east within the Control Room were a series of display panels as are shown in photograph 12/203. The panel to the left and nearest to the centre of the Control Room was the electrical mimic panel. This panel displayed the status of the distribution of electrical power throughout the platform. Next to that panel and to the south was the main process control or mimic panel. This panel displayed the status of process equipment and contained a number of lights indicating which major items of equipment were operating or shut down. To the south of the mimic panel were the fire and gas display panels. There was also an additional fire and gas display panel on the south wall of the Control Room. Moving east and behind the mimic panel and the main fire and gas display panels, there were inter alia panels relating to the fire and gas and telemetry systems. Adjacent to the east wall of the Control Room there were additional fire and gas panels. Slightly north of these additional fire and gas panels there was a table which was used for tea or coffee and by Phase 1 operators and the oil and water operators. The Control Room operator normally sat in the general area of the control desk and the mimic and main fire and gas display panels. The Lead Operator usually sat at the area designated "worktop" on the drawing 12/188 of process.

To the north of the Control Room area and within the Control Building there were areas known as the DC room and the Battery Room. The DC Room housed safety-related switchgear for the instrument systems. The Battery Room housed the battery packs which provided DC electrical supplies via the DC Room equipment. The eastmost part of the Control Building was sound-proofed and had its own heating and ventilation system. The Control Building had double doors to prevent the ingress of gas.

The fuel gas for the John Brown Generators originated from the centrifugal compressors and was processed in the fuel gas heaters in Module D. Thereafter it traversed Module C before reaching the generators.

2.7.1 Produced Water Package and Laboratories

On the east side of the 68-foot level on an extension, outwith the confines of the jacket legs, there was the produced water treatment plant comprising the plate skimmer and hydrocyclone units. The plate skimmer was below Module B. There was a windwall protruding out from the 68-foot level a few feet beyond the east ends of Module B and C. The hydrocyclone units were positioned beneath Module C. One way of obtaining access to this area of the 68-foot level was via a stairway from the base of the east crane pedestal outside the windwall. The water laboratory, fine filters, and oil laboratory were on the west face and at the south end of the platform.

2.7.2 The Dive Package

Also at the west side of the platform underneath Module B and part of Module C but extending westwards beyond these modules was the Dive Package area. This area can be seen in photographs 12/8D, 12/8E, and 12/8G of process. Moving from north to south the Dive Package extended from the blue container seen at low level in photograph 12/8 G to the divide between Modules A and B. The blue container was for wet suit storage. The adjacent yellow container was the switchgear room and dive machinery room. The Dive Package extended partly under Module C but the greater part of it was beneath Module B. It extended from Module C across the whole width of Module B and inboard for some 50-feet in an easterly direction under Module B.

Inboard of the container that housed the Switchgear Room and the Dive Machinery Room there were two decompression chambers. These are shown in photograph 12/8N of process. To the north of these chambers were the Dive Package Offices.

At a lower level some 10 or 15 feet below the dive complex there was a dive staging platform known as the Diver’s Launch and Recovery Platform. Photograph 12/80 of process shows the stairway that led downwards to the dive staging platform and the view from the top of the stairway to the dive staging platform is seen in photograph 12/8M of process. The structure at the bottom of the stairway was known as the Dive Wendy Hut. The dive staging platform provided an area from which divers would enter the water. It protruded somewhat from the face of the platform. The floor of the dive staging platform was constructed primarily of grating and rubber matting was normally laid over the grating in order to protect the divers’ feet. The dive staging platform was substantially underneath Module B and, in particular, underneath the part where the MOL descended through to the 68-foot level. The Tartan Riser also passed above the dive staging platform at a point just below the 68-foot level before turning to the north where it descended into the sea adjacent to leg B4.

2.7.3 Condensate Handling Facilities

The condensate handling facilities are an important feature of this case since the pursuers’ case involves them in their case as to how the accident happened. These facilities were directly below Module C and are shown in the schematic 13/49 and photographs 12/8Q and 12/8R. They included the JT valve and the JT flash drum, the condensate suction drum, the condensate booster pumps, the condensate injection pumps (and all their associated pipework) as well as the control instrumentation. The JT flash drum was on the east side of the 68-foot level. The JT valve was to the north east of the JT flash drum. There were two condensate booster pumps which were directly to the east of the JT flash drum. The condensate suction drum 2-C-202 was located in the roof space of the 68-foot level to the west of the JT flash drum. It had an internal diameter of 3 inches and its dimension from end to end was 13 feet.

The condensate injection pumps were generally located in the centre of the 68-foot level. There were two pumps A and B. Pump A was to the east and pump B was to the west. Each pump consisted of an electric motor, a torque converter (also known as the Voith coupling), a gearbox, crank casing and a pump chest or head. The motor of the each pump was to the north and the pump chest was to the south or east. The stairway connecting the 68-foot level to Module C was to the west and north of the condensate injection pump B. The distance from the bottom of this stairway to the pumps was about 20 feet. Each pump had suction and discharge pipework and on the pipework there were gas operated valves (GOVs) known respectively as the suction and discharge GOVs. The GOVs were situated to the south of pumps. They were operated by push/pull buttons local to them. The push/pull buttons were on stanchions some 2 feet or 3 feet further to the south of the GOVs. With regard to pump A the GOVs were respectively GOV 5005 on the suction side and GOV 5006 on the discharge side. The GOVs for pump B were GOV 5007 on the suction side and G0V 5008 on the discharge side. There were pulsation dampeners on the suction line of each pump and also on its discharge line. The pulsation dampeners were added to the pumps about a year after the commencement of the operations of the condensate injection pumps. There were four pulsation dampeners - two for each pump. Each pump had a relief line going to its PSV. Since this involved pipe penetration it offered a possible route for escaped oil or condensate to pass from module C to the lower floor. Even if the discharge GOV of the pump was closed gas would enter the PSV relief line. Thus in a depressurised pump if the suction valve was opened the pressure would reach the PSV.

Situated between the JT flash drum and pump A was the control panel JCP- 057. Amongst other things this panel displayed the status of the condensate booster pumps and the condensate injection pumps as well of the GOVs of those pumps. Each condensate injection pump had a local control panel located to the north and east of each pump. The panel JCP - 057 was some 4 or 5 feet from the local panel for Pump A. On the stanchion beside the local control panel for Pump B there was a level indicator for the JT flash drum.

Because of the amount of equipment the area near and including the Condensate Injection Pumps was fairly congested.

2.8.1 The Gas Conservation Module and Utility Module

This module comprised equipment aimed at improving the quality of the gas produced on the platform. The module can be seen above Module B in the photographs 12/8 H and I of process. It was also partly above Module C. The equipment included in particular molecular sieve dryers, a turbo expander, and a demethaniser . Located within this module was a sound proofed hut which was used by the Phase 2 operators. The Utility Module was directly above Module C. This contained a main 13.8kv switchboard and 4.16kv switchgear. The power supply for the condensate injection pump came from this switchgear.

2.8.2 Sub -module D

Above Module D in the 107-foot level was sub-module D and the western half of this was a self-contained building consisting principally of the Telecommunications Room and Occidental Production Stores. The eastern half of this sub-module was open to the north and east and housed the Occidental Maintenance Office, foam storage, pumps, and HAVC systems. At the east of the sub-module were the generator inlet ducts for the John Brown generators. The exhaust ducts were on the north face and the inlet ducts were on the east face. Immediately outboard of this area was the Occidental Maintenance Superintendent’s Office. This can be seen as the orange portacabin protruding from the north face in photograph 12/8E. Inboard of that office was the Occidental Maintenance Office.

2.8.3 The Drilling - Related Modules

Immediately opposite the GCM and on the west side of the 107-foot level was the Mud Module and the main items of equipment included two shakers situated in the south east corner of the module. The west wall of the Mud Module is seen in photograph 12/8G of process. To the north of the Mud Module was the Storage or Sacks Module and to the north of this was the Pods Module.

The skid deck was also on the 107-foot level directly above Module A. On the skid deck, running east to west were the main skid beams on which the drilling derrick was supported. This allowed the derrick to move and be centred above any of the 36 well slots. The top of the derrick was about 289 feet above sea level. Individual covers on the skid deck and above each of the well slots allowed for access to each well for drilling or well maintenance operations. There were two hatches for each well slot namely an outer and smaller inner hatch. The outer hatch had a dimension of about 10 feet by 7.5 feet. The inner hatch was located within the outer hatch and was about one third of the size of the outer hatch. Each type of hatch was made of a steel construction some 3/8 ths of an inch thick. The inner hatch was designed to be bolted to the outer hatch. Part of the skid deck with one of the skid beams and hatch covers for the well slots can be seen in photograph 41/11.

The pipedeck was located above the Mud and Gas Conservation Modules at the 133-foot level and can be seen in photograph 12/8D. Access could be obtained from the pipedeck to the drilling derrick via a pipebridge and V door. On the west side and to the north of the pipedeck was the Submersible Pump Electrical Module (SPEEM). This can be seen in the photographs 12/8D and 12/8G. The ERQ East consisted of four levels and is seen on photographs 12/8B and 12/8E of process. The helideck was on top of the ERQ at the 174-foot level. Level 1 housed a number of cabins, the offices for the OIM and Production Superintendent and a general office. The highest level housed the dining and kitchen area. This area also housed additional accommodation and recreational areas.

In accordance with practice within the industry the platform areas were classified into different zones depending on the likelihood of the development of a potential unsafe gas/air mixture. Zone 1 was where an explosive atmosphere was likely to occur in normal operations. Zone 2 was where an explosive atmosphere was not likely to occur in normal operations and if it did it would only exist for a short time. Safe and unclassified was an area where an explosive atmosphere was not expected to occur and was considered to be a safe area.

Module A was classified as Zone 2. Module B was classified both as Zone 1 and Zone 2. The area in that module classified as Zone 1 was the area associated with the production manifold where there were sample collections. Module C was classified as Zone 2 and Module D was unclassified. These classifications are shown diagrammatically in the Operations Manual 12/3 or process. In the main the 68-foot level was classified as Zone 2 but with areas to the north and east being unclassified. The design of equipment in a classified area had to meet certain safety standards. These were directed towards preventing ignition sources being caused during the normal operation of such equipment. In areas designated as Zone 2 gas detectors were likely to be in positions where gas was most likely to be detected.

2.10.1 The Piper Network

The 30 inch diameter oil export riser and the 16 inch diameter Claymore gas riser were on the north face of the platform. The 18 inch diameter Tartan Gas Riser was in the vicinity of leg B4 on the west face. The 18 inch diameter MCP-O1 Gas riser was in the vicinity of leg A4 on the east face. The MOL travelled from the platform down to the seabed and along the seabed to Flotta, a distance of 128 miles. The Claymore platform was located some 22 miles west of the Piper Alpha platform. Oil was exported from the Claymore platform via a pipeline which tied into the MOL at Flotta. The tie-in point was about 22 miles from Piper Alpha and was known as the Tee.

The pipeline of which the Tartan Gas Riser formed part was a gas line about 12 miles long used for Tartan to export their gas via Piper towards MCP-O1. The MCP-O1 Gas Riser travelled from the platform to the sea-bed and thereafter to the MCP-O1 platform some 34 miles to the north of the Piper Alpha platform. Gas from the Tartan Riser was routed into the MCP-O1 riser on the Piper Alpha platform. There was also a 16 inch diameter pipe running along the sea-bed between the Piper Alpha and Claymore platforms with associated risers on each platform. This pipeline allowed the Piper Alpha to supply fuel gas to the Claymore platform. Furthermore there was a 24 inch diameter oil pipeline running from the Tartan platform to the Claymore platform. This facilitated oil export from the Tartan platform via the Claymore platform into the main oil line to Flotta. The network is set out in the schematics 12/24 and 12/122 of process.

2.10.2 The Flotta Oil Terminal

This terminal in the Orkney Islands was built after the discovery of the Piper Field in order to provide a base for receiving, storing, and exporting hydrocarbons discovered offshore. The plant at Flotta consisted mainly of two areas, the processing area and the storage and transport area. As at 1988 Flotta was receiving hydrocarbons from three platforms, namely Piper, Claymore and Tartan, all via the MOL. At the time of the accident in 1988 the terminal was owned and operated by OPCAL.

2.11. The Firewall Structure

The firewalls between the modules on the production level were fabricated and supplied by Durasteel. This was done for OPCAL on the instruction of their designers, Messrs Bechtel, and the walls were fabricated at the yard of Allen & Grieve of Edmonton. Some challenge was presented by the defenders to the pursuers’ evidence about the structure of the firewalls but I was satisfied by this evidence. The firewalls had been altered to a degree from the original drawings but the witnesses were able to describe such differences so far as it mattered. I doubt in any event if at the end of the day they make much difference. The witness Mr Pickett was employed by Durasteel from 1963 until 1991 and had reached the position of Office Manager. He confirmed that about 1973 Durasteel had supplied three firewalls to OPCAL. One had been a 6-hour firewall both insulated and on integrity. The other two were fire integrity partitions only and were of a 4-hour standard. The 6-hour firewall was constructed of three thickness of Durasteel 3DF2 material with two layers of insulation. The other firewalls were a single sheet of the Durasteel material. In terms of their contract Durasteel supplied the whole firewall system including the frames and every nut and bolt. Subsequently before the platform came into operation the firewalls were assembled and installed on it. The effect was that each of the modules was separated from adjacent modules by such a firewall. The firewall between Module A and Module B was known as the A/B firewall, that between Modules B and C as the B/C firewall, and that between Modules C and D the C/D firewall.

Evidence about the construction of the firewall was given on behalf of the pursuers by Mr Terry Rogers. This witness is now a self-employed project engineer and he has a HND qualification in mechanical engineering. Between 1973 and 1980 he had been employed by Bechtel Great Britain as a piping engineer. This is to a degree significant because the Bechtel Group had been employed by the consortium as designers of the platform. He went to the Piper Alpha platform in 1978 and was there during the phase1 and 2 installation programmes. After he left Bechtel in 1987 he remained in employment on the platform and at the time of the accident was the Project Services Superintendent for OPCAL. This meant that he was Superintendent for construction work. His work involved supervising projects which required pipe penetrations through the firewalls and this gave him a familiarity with their construction. He had not worked specifically on the C/D firewall but had observed its construction. There was a gap between the C/D firewall and the maintenance building and a person could squeeze into this, as he had done, and observe the firewall construction. He was responsible for the personnel whose job it was periodically to check the firewalls. I had no difficulty in accepting his evidence in relation to the construction of the firewalls.

The firewalls were attached to the trusses which were part of the module structure. There were two trusses for each module. These trusses were numbered 1 to 8 from south to north. The A/B firewall was built on the north truss line for module A and was built to the south side of it. The consequence is that an explosion within the module would push the firewall into the trusses. The position in relation to the construction of the B/C firewall was the same. It was built on the south side of truss 4. The C/D truss had a different construction from the other two but was also built to the south side of the north truss of Module C. The firewalls extended from the deck plate (rather than walkway level) up to the underside of the main beam on top of the truss. The length of the truss would be the length of the module, namely about 153 feet, and their height was about 19 feet. The defenders claimed that it was not clear from the evidence just how strong the connections of the firewall were at the junctions between the firewall and the deck and the ceiling respectively. However they accepted that this was not an issue.

The witness, Mr Crouch, was employed by Allen & Greaves until they discontinued business in 1976. That firm carried out work for Durasteel and Mr Crouch had a supervisory position in it. The timescale he gives for the construction of the wall is broadly consistent with that of Mr Picket. The pursuers’ witness, Mr Cole, was the Works Director of Durasteel and he had joined them about 1987. He had no direct knowledge of the supply of the firewalls to OPCAL by Durasteel but knew from his knowledge of the history of his firm’s works systems and from their records that such walls had been supplied and the details of the walls which were likely to have been supplied. The construction systems employed by Durasteel do not seem to have varied over the years. Durasteel supplied OPCAL with detailed drawings at the time of the installation of the firewalls. Such drawings were retained by OPCAL and updated where necessary. He spoke to the fact that the productions 12/80, 12/83, and 12/85 of process were accurate representations of how the firewalls would have been constructed and the evidence when viewed as a whole leaves me in little doubt that this is so. Indeed these drawings purport to be Durasteel drawings and have a Durasteel stamp on them. Each bears a date round about 1975. Mr Rogers was able to say in evidence that the door in the actual B /C firewall had a Durasteel logo on it. The schematic 12/93 of process also shows an outline of the construction of the firewall A/B.

Mr Rogers indicated that the A/B and B/C firewalls were plated in with a material called Durasteel which is a sandwich of perforated steel with a non-inflammable material in between. These plates were about three-eighths of an inch thick in all. The steel sheets were each about half a millimetre thick. The composition of the core was cement mixed with asbestos. The weight of the Durasteel sheets was about 21 kg per square metre. The flexural strength of the Durasteel panel was 60 Newton’s per square millimetre. The plates were supported in an angle frame bolted together so as to form frames around each panel. The angle frames were steel. The top and lower panels in the wall measured 8 feet and a quarter inch in length and the intermediate was 4 feet and a quarter of an inch. Each panel had a width of 5 feet. At the west section of the A/B firewall the drawings show a section of wall with rather smaller panels but Mr Rogers could not remember this detail. The frames were made of mild steel angles measuring 2 inch by 2 inch by a quarter inch, mitred at the corner and butt welded to form a 90 degree angle. The grade of steel was 43A. The frames were bolted back to back using three-eighth of an inch Whitworth thread bolts. When the firewalls were delivered to OPCAL the bolt holes were pre-drilled. The frame bolts were spaced at 18 inch centres. There was a distance from the outer edge of the angle iron to the centre of the frame bolt hole of 30 millimetres and this is referred to as the structural backmark. The distance from the centre of the bolt hole to the toe is 20 millimetres. These measurements have some significance when the prying action of the angle iron when subjected to pressure is being considered. They come from Mr Cole and Mr Crouch who agree within general limits.

With regard to the clamping of the frames to the trusses of the A/B and B/C firewalls the frames were fixed to the trusses by an arrangement of cleats as shown in the drawings I have referred to above (and also the schematic 12/93). Six inch long L cleats were positioned and welded on to the frames. Three-eighth of an inch screw rods are then used to secure other cleats at the back of the trusses so as to hold the firewall tight against the trusses. The clamps appeared at the points where the trusses intersected the panels of the firewall. These points are shown on the drawings by way of asterisks. Clamps were attached to both the vertical and diagonal members of the trusses. At the top the connection was a weld to the main chord of the truss and then a bolted angle connection to the angle iron frame. This arrangement is illustrated in the drawing 12/80 of process. At the bottom the firewalls were secured by a weld to the deckplates. The panels themselves were attached to the frames by five-sixteenths of an inch diameter Whitworth bolts and at 12 inch centres.

The defender’s witness, Mr Barron was 58 years old and he was a foreman painter with Wood Group. He had been on the Piper Alpha at the time of the accident. An objection was taken by the pursuers to his evidence because he was only called on day 171 of the Proof and the matters he spoke to were not put to the pursuers’ witnesses. The thrust of Mr Barron’ evidence was that in February 1988 he had cut Mandolite from the B/C firewall in order to expose pipes at the western end of the firewall. He claimed that the whole of the wall where he had been working has been covered in Mandolite and he had needle-gunned some of it to remove it. He stated that it was one or two inches thick. Mr Rogers had spoken to the fact that Mandolite had been used to seal pipe penetrations but it was never suggested to him that at any point the substance covered other parts of the firewall. Certainly it was put to Professor Reid that a two inch coat of Mandolite would have an effect on the mass of the wall but until that point in the evidence there had been no suggestion that there was such a coat to the various witnesses (such as Mr Wottge, Mr Wylie, or Mr Rogers) who might have been expected to have had a better knowledge of the position than Mr Barron. Professor Reid did say that a coat of Mandolite would affect mass and thus by implication velocity but he did not attempt to quantify this effect. The suggested occasion in February was the only occasion Mr Barron claimed to have worked at the firewall. He also agreed that it was generally used as a sealant. It should be noted that the Durasteel Plates had a honeycomb constructions. If Mandolite was spread over any substantial area of the wall it would have been at the west end only but I am not convinced that even at that part of the wall the panels were covered in Mandolite although a certain amount will have been applied in the area of pipe penetrations as a sealant. Mr Wottge given the fire rating of the wall as 4 to 4.5 hours whereas the witness Mr Picket had ventured that the fire rating supplied by Durasteel had been 2.5 hours. Defenders’ counsel had sought to take from this that Mandolite could increase the fire resistance of a wall and that it may have been for that reason that OPCAL had sprayed Mandolite on the wall. However the only evidence was that the Mandolite had been used at the west end of the wall and if one was seeking to increase the fire resistance of a partition wall it is difficult to see why one would want to apply Mandolite at one end only. There is I think a certain amount of doubt as to whether or not there was at least some Mandolite on the wall (as distinct from the pipe penetration points). However any such doubts could probably have been resolved if the matter had been put to the pursuers’ witnesses (and in particular Mr Rogers) and in the circumstances I think the pursuers must get the benefit of the situation. Moreover the pursuers’ structural engineers were not asked about any effect the Mandolite could have had on their calculations.

Mr Barron also said that he was familiar with the door at the west end of the B/C firewall and gave evidence that when he was working on the platform this door was always left slightly ajar. He confirmed that he had informed Lord Cullen’s inquiry that during the period of eight months before the accident he had used the door three times. Once again this matter was first raised by the defenders at a late stage of the proof and neither the pursuers’ experts nor the platform witnesses were asked about it. Mr Rogers had claimed that the door in question had a self-closing mechanism which was very effective and snapped the door shut. There of course is the possibility that as workmen painted or worked at pipe penetrations the door was jammed in an open position but this may well have been temporary.

As I have already indicated the C/D firewall differed from the others in that it had three layers of Durasteel which sandwiched two layers of mineral wool each about 2 inches thick. In this construction the plates were rather smaller. Details of the construction of this wall are set out in the drawing which is 12/85 of process. The panels were about three feet square and the wall was seven panels in height. The firewall was considerably thicker than the other two firewalls. The panels were applied to the south face of the angle irons and this was secured to the truss line. The skins of the wall were attached to each other by coach bolts, four to each three foot length and these also held the angle frames together. The frames were fixed to the trusses by fabricated straps attached to cleats. This is illustrated in the schematic 12/94 of process and in the drawing 12/85. Because of the difference in this module any overpressure from Module C would push the panels on to the angle frames whereas the panels in the B/C firewall would be pushed away from their trusses.

2.12.1 The Power Supply

The main witness for the pursuers on the matter of the power supply was Mr Lloyd who presently is their Chief Electrical Engineer. He is a Chartered Electrical Engineer and a Member of the Institute of Electrical Engineers. He holds the Higher National Certificate in Electrical Engineering. He first joined OPCAL in 1976 as a Platform Electrical Technician and worked in that capacity on the Piper Alpha platform for about 4 years. At that time he worked regularly with all aspects of the electrical system. He was also familiar with the air supply system. He then became a Facilities Electrical Engineer with OPCAL onshore. During this period any alterations on Piper to the electrical system would pass through his hands. In 1985 he was promoted to the position of Senior Electrical Engineer. In respect of the technical matters about which he gave evidence he was clearly well informed.

The productions 12/73 and 12/74 which were taken from the Operations Manual, but were spoken to by the witnesses, set out in detail the normal and emergency electrical supplies. The top bus-bar shown there on the left was located in Module D at the Mezzanine level in Electrical Room No 2 and is 13.8 kV. The power passes down to a bus-bar of 4.16 kV also in Module D and this supplies the Condensate Injection Pump B. The first bus-bar next to the right is 13.8 kV and is located in the Utility Module. This transfers electricity to a 4.16 kV bus-bar also in the Utility Module and this in turn supplies Condensate Injection Pump A. The bus bar coming down beyond that was a 440 V normal services bus-bar. The main implication of this is that at the time of the accident any electrical de-isolation of pump A would have required to take place in the Utility Module.

The productions number 12/75 and 12/76 of process show the John Brown generators which were the principal power source on the platform and as I have said these were located at the east end of Module D. 12/76 shows the main 13.8 kV switch-board which was located within Electrical Room No 1 at the east end of the Mezzanine level in Module D. The 440V and the 4.16 kV supply controls are in Electrical Room No 2. The drawing number 12/72 of process shows the power supplies to the various auxiliary services. The relevant bus-bar was located in Electrical Room No 2. In respect of emergency distribution Mr Wottge explained that this came from a solar generator illustrated in the drawing 12/75. This generator supplied power to the emergency services switchgear in the Emergency Electrical Room in Module D. The emergency supply would come on automatically if power was lost from the John Brown generators. The drawing number 12/73 of process shows two diesel-fired generators principally designed to provide an emergency supply for drilling operations but also available as an emergency supply for emergency services. Finally for emergency purposes there was an Uninterruptable Power System charged from a Trickle Charger from the 440 Volt emergency services bus-bar. This was intended to supply emergency power to essential services such as essential instrumentation, the general alarm system and the public address system. Indeed there are three independent batteries covering the various critical services. The batteries were in the Battery Room as shown in drawing 12/76. There was also a back-up system to supply emergency lighting.

2.12.2 Control Panels

The local control panels for the condensate injection pumps are located as shown in the Schematic number 13/49 of process. The elements displayed on the panel are as shown in 15/21 of process. The panel contains alarm lights. These signal a range of difficulties that might arise such as those relating to pressures levels and temperatures. A light shown as number 1 remains on if the pump is running and if this goes off it of course signals that the pump has stopped.. There is a further lamp which signals that power is servicing the relevant pump. If the power lamp is on and the pump is not shown as running the reason for this is not indicated. There is also a local Instrument Panel (JCP-57) which provided local alarm indications of the process conditions. The Control Panel will signal if the Gas Operated Valves which relate to the suction and discharge sides of the Condensate Injection Pumps are open or closed. There is also a selector switch which governs the source from which the pumps are fed ( that is from the JT Flash Drum or the Condensate Suction Vessel). When the production system was running in Phase 1 the feed was always taken from the Flash Drum. The control panel had a bulb test button and an emergency shut-down button to shut down the condensate system. If the power supply to a pump was interrupted during isolation by being racked out there would still be a lamp to indicate the status of the GOVs. Racking-out is the procedure of isolating the electrical switchgear by withdrawing the compartment containing it. On the other hand the procedure of locking-off involves isolating the circuit by pulling the isolation switch. In both procedures the withdrawn compartment or switch as the case may be is locked in position to prevent accidental de-isolation of the circuit. In racking-out not only is the supply disconnected from the apparatus but also the relevant supply from the mimic. This means that there will be no supply going from the Control Room to the solenoid logic within JCP57 and this in turn affects the procedures required to re-pressurise the GOV of the condensate injection pump. When the pump is being jagged in such circumstances the complementary air supply of 50 psi is unable to hold open the push-pull button which opens the GOVs. This means that the button can only be retained in open position by holding it open manually. The Control Room Operator would know if a pump had been racked out by the absence of lights and thus by looking at his mimic board he would know if a pump was out of commission. On the other hand if a supply to a pump is simply locked off the supply to the solenoid continues and the 50 psi supply to the GOVs can be maintained.

The Control Room has electrical and process mimics which indicate the status of equipment as shown on the local panels. From this the Control Room Operator is alerted to the position in relation to production equipment. The layout of these are shown in 12/76 of process. What is described as the "Main Process Control Panel" is the process mimic. Adjacent to this at the left is the electrical mimic. Above the Control Panel is an annunciator or alarm panel for common alarms from the process equipment. If an alarm is annunciated there would be a flashing light and an audible signal. In respect of the Electrical Panel the status of electrical equipment is signalled by red or green lamp depending on the signal received. If the circuit breaker relating to a condensate injection pump is closed and the pump is running then a red light would be shown. If the circuit breaker is open and the pump trips the red light would go out and the green lamp would light up. If the pump is not running and has been racked out then no light at all is shown on the electrical mimic.

If an alarm relating to the production process annunciates then the relevant red lamp goes off and in the case of major pieces of equipment such as the Condensate Injection Pumps a flashing amber light comes on. There is also an audible alarm. The operator accepts the alarm by pressing the accept button at the bottom of the Process Control Panel. This has the effect of silencing the audible alarm but the relevant alarm lamp remains lit and in a steady state. On the occasion of the accident the only process alarms noted by Mr Bollands, the Control Room Operator, prior to the explosion were alarms showing that Condensate Injection Pump B had tripped and that the three Centrifugal Compressors had also tripped. No other alarms which could have indicated other process upsets were noted by him. Working equipment such as the pumps and valves each had their alarms. These alarms were as set out in the drawing 12/193. It will be noted that the MOL pressure is also shown on the Control Panel. At the bottom of the Control Panel there is also a reset button which either as a result of automatic setting or by manual operation resets the amber lamp by extinguishing it. Furthermore there is an emergency shutdown button which if pressed shuts down the whole process. Of course as I have explained if a Condensate Injection Pump was not in production there would be no mimic light at all.

2.12.3 Pneumatic and Electrical Operation of Pumps

The primary sources of power for the instrument air and utility air systems so far as relating to the condensate injection pumps were the John Brown Generators in Module D and there was back-up for both systems by way of stand-by compressor. The starting procedure for a pump which had been out of action would involve first re-pressurising the pump (which will have been de-pressurised while out of action). Since the deactivated pump will have been isolated physically by having its suction GOV closed it is necessary as a first step to have the GOV open at any time when hydrocarbon is to be re-introduced to the pump. The GOVs are operated by way of a push/pull buttons for each pump. These buttons are attached to stanchions and their relationship to their relative pumps is shown in the Schematic number 13/49 of process. By means of these buttons an air supply of 100 psi can be introduced to the valve system and this will work an actuator which will open the pump. However the button once pulled can only be held open automatically by the force of a separate air stream of 50 psi and this will only be possible if the pump is electrically connected. This is because the solenoid that operates the 50 psi system needs to be energised. Otherwise the GOV can be kept open so long as the button is held in the pulled out position manually. When the button is released the GOV will close. The re-pressurisation is a different process from actually starting the motor of the pump and must precede it. There is a limit switch that ensures that the motor of the pump cannot be opened until the GOVs are opened. Thus whether or not an operator engaged in jagging a condensate injection pump will have to remain at the push/pull button during the process may depend on whether the electrical supply to the machine has been racked out or simply locked off.

3.1. General

The details of the production processes on the platform were extensively discussed during the proof and an understanding of many aspects of them is essential to an understanding of the case. During the early stages after the platform was put into production there were no Condensate Injection Pumps and little condensate was produced. Condensate is not a distinctive substance but describes in relation to hydrocarbons their state when vapour has been condensed out so as to become liquid. Condensate is a mixture containing a number of liquefied gases and of these methane (C1H4)is the lightest. Next lightest would be ethane (C2). Then comes propane (C3), butane (C4), and pentane (C5). Thus of that list of hydrocarbons each on the list is heavier than the one above and has a lower boiling point. They are ranked according to their molecular weight. By determining the molecular weight we can determine the molecular weight of the mixture and compare it to the weight of air. If a gas is neutrally buoyant it is approximately the same weight as air and in a general sense will neither rise or fall in relation to air. Whether a particular gas is in liquid or gas form will depend on its pressure and temperature. If a particular gas is compressed at a pressure substantially higher than atmospheric pressure then it will become denser and therefore heavier. If condensate at under pressure is released into the atmosphere or an unpressurised container it will flash and become a two phase substance of gas and liquid. The flashing process is very quick and will occupy no more than milliseconds. When flashing occurs one is likely to get a greater proportion of the lighter gases coming off the liquid since having a lower boiling point they are more volatile although the heavier gases also flash off in lesser proportions. It is understandable that lighter molecules should come off the gas more easily than heavier ones. However the process is a differential process so that it cannot be assumed that all of a particular gas will flash off or remain in liquid state. Moreover because the process is differential only mixtures can flash. Liquid crude oil is just a particular form of hydrocarbon condensate. However it will flash far less readily than the condensate formed from other combinations of gas as produced on the platform since these comprise a far lighter mixture of gases. In the platform processes some of the oil extracted from the reservoir flashes off to gas and some of this is then processed to become a liquid and thus condensate. Of course the condensate thus produced could never re-emerge as crude oil since not all the constituents of the crude oil gasify. In the reservoir the crude oil is at considerable pressure. When it enters the separator the pressure is drastically reduced and this explains why some of the gases flash off. However all in all condensate as referred to in relation to platform processes is simply the name given to liquid hydrocarbons which have condensed out of the vapour and gas streams. The objective of the platform processes was to convert as much gas as possible to the lighter gases (and particularly methane) since these had a higher commercial value but the remaining condensate was also taken off the platform and converted to various uses. At various points in the Phase 1 operation, after the initial separation in the Module B separators, the process machinery would bring about changes in pressure and temperature which would cause the hydrocarbons in the gaseous or vapour state to condensate out into liquid condensate. Moreover it cannot be assumed that condensate formed at one stage of the process will have the same components as condensate formed at a different stage. Flashing can be a two way process so that gas put under a sudden change of pressure and temperature can produce a two phase flow which of course would include liquid. This is known as the Joule Thomson effect and is what happens at the JT valve. It happens because the reduction in pressure causes a reduction in temperature and it is this that causes the gas to condense out as liquid.

Any condensate produced by the process was injected into the MOL for export to Flotta. However with the introduction of the Claymore field the MOL pipeline pressure increased and it became necessary to add Condensate Injection Pumps to export the condensate. The pumps and the associated Condensate Suction Vessel were added to the platform at the 68-foot level. The platform was operating in this mode from about 1977 to early 1978 - that is for a relatively short time. During the later part of 1978 the condensate handling facilities on the platform were upgraded. The JT (Joule Thompson) drum and JT valve were also installed at the 68-foot level. Condensate booster pumps were installed to improve the flow of condensate to the injection pumps. The mode of operation employed at the time was known as Phase 1. During this period the condensate produced was all sent to Flotta in the MOL. The gas produced (as distinct from the condensate) was used as lift gas (to facilitate the extraction by lifting of oil from the reservoir) or as fuel gas for the platform. Any excess gas was sent to flare and essentially wasted.

Between 1978 and December 1980 the Frigg field was developed and this led to the construction of a manifold compression platform, MCP01. The effect of this was to open-up the possibility of exporting gas to the shore. Thus the pursuers’ predecessors began the construction of a gas processing module on the platform to refine the gas for export. This Module was known as the Gas Conservation Module (GCM) and pending its introduction to the process the gas produced on the platform was treated by a Glycol Dehydration unit located above Module A at the east end of the 107-foot level. The aim of this unit was to remove water from the gas and make it of exportable quality. This particular mode of operation was known as Phase 1A.

The GCM was located above Modules B and C and was brought into operation about December 1980 with the effect of rendering the Glycol Dehydration Unit redundant. Moreover the platform was then enabled to operate in a mode of production known as Phase 2. The difference which the introduction of Phase made to the process did not affect the processes in Modules A and B, nor the operation of the centrifugal compressors. Indeed the main difference to the process was in the treatment of gas. The gas was treated in the GCM so as to improve its suitability for export. Thus after leaving the first stage of the reciprocating compressors the gas was routed to the GCM for treatment. The gas passed through the mole sieve dryers to remove water. Thereafter it passed to the turbo expander where condensate was produced and the gas and condensate were then routed to the demethaniser and the JT drum. An important difference between Phase 1 and Phase 2 is that in the latter the JT valve was not used to produce condensate and the condensate produced came directly from the demethaniser.

As at 6 July 1988 the platform was in general capable of being adapted to operate in either Phase 1 or Phase 2 modes. The platform had operated in Phase1 during a period of some months between early 1978 and about December 1978. Then until about 1980 the platform generally operated on Phase 1A. About December 1980 Phase 2 began to be the mode of operation and this was generally the position until a few days before the accident. About 1984 Phase 1 was introduced for a period of no longer than 60 days. In the summer of 1988 the pursuers’ predecessors decided that it was advisable to carry out significant maintenance work in the GCM and to this end it was decided to withdraw that module from the production process during the maintenance procedures and to re-introduce Phase 1. The implication of reverting to Phase 1 was that many of the experienced process operators on the platform would have had no direct experience of operating the production process when the platform was in that phase. The conversion work to transfer to Phase 1 was planned for the beginning of July 1988. The work began about 1 or 2 July 1988. Initially the greater part of the plant had to be shut down. A substantial part of the platform equipment required to be depressurised. However one of the reciprocating compressors was kept running to provide a supply of fuel gas for the platform. Advantage was taken of the opportunity presented by the shutdown to change valves on two of the reciprocating compressors while they were not operating. Before Phase 2 could be eliminated from the process the GCM had to be isolated. This meant depressurising equipment in the module and physically isolating it from Phase 1. Much of the hydrocarbon material in the GCM was routed to flare in order to effect the depressurisation. Then the isolation was completed by way of closing valves, spading, and blind flanges. Some of this work was done in Module C. All such isolations had been effected by about 4pm on 3 July. They were checked and pressure tested. The isolation work was such that some gas and possibly also some condensate was trapped in the piping that had been sealed off. The planning for the conversion had been controlled from the beach. Phase 1 operation began about 4pm on 3 July after the isolations of the GCM were complete. By 11am on 5 July Phase 1 was operating with two reciprocating compressors, two centrifugal compressors and two condensate injection pumps. However late on 5 July the third centrifugal compressor was available. By the evening of 6 July Phase 1 was operating with three centrifugal compressors running. The witness Mr Clark said that although Phase 1 was in operation for several days before the accident there was a degree of instability until all the processes had been adjusted to the new system. Three centrifugal compressors tripped just before the accident. Mr Henderson indicated that he had never known all three centrifugal compressors to trip but then it was not clear how often in Phase 2 operation there would have been all three compressors running at the same time. The tripping of the centrifugal compressors at the time of the accident was attributed to the fact that the reciprocal compressors had been recycled. Of course if this affected centrifugal compressors so as to cause them to trip then if all three of such compressors were running it is perhaps not surprising that they tripped. An alternative cause of tripping may be the entry of a sufficient quantity of gas to trigger the trip alarms. On the other hand in this event one might expect the trip to be preceded by the detector signalling an alarm in the Control Room since the trip concentration is lower than the LEL needed for a low alarm. As each compressor tripped an additional amount of gas would be released to flare as the separators sent gas forward.

The defenders argued that the extensive work done in connection with the conversion to Phase1 could have put the equipment under all sorts of strains and stresses which could have lead to the accident.

It should be noted that none of the witnesses suggested that the platform as adjusted was not equipped to deal adequately with the Phase 1 process. Indeed at the time of the accident the platform had been coping successfully with Phase 1 for some days. We were not told who had planned the changeover to Phase 1, on the basis of what experience and advice, and with what precautions. It would not be appropriate that I should find that the Phase 1 conversion was misconceived or not properly carried out. Insofar as it could be suggested that Phase 1 could have been a cause of the accident this could only be on the basis that it was a considerable and recent change in the process. The defenders argued that the equipment was much older when Phase 1 was re-introduced in 1988 as compared with the earlier operation of Phase 1. However the possibility that the accident was due to ageing equipment is not one that was explored with the experts. Nor were witnesses asked anything about the recommended working life of the equipment. Moreover when a line was opened as must have happened when the conversion to Phase 1 was effected the open end of a line would not merely have a blind flange or spade fitted but this would be pressure tested before it was exposed to production pressure. Moreover the system entailed having a double precaution such as a closed manual valve. Thus in relation to PSV 504 the blind flange was not exposed to pressure so long as the pump GOV valves remained closed. However if the pump required to be re-pressurised the pump suction GOV would be opened and the pressure would be diverted to the blind flange. Normally there would not be pressure right up to a blind flange itself.

The conversion to Phase 1 had various implications for the processes. The JT valve had to be restored and this thereafter was the source of condensate production. Because the valve was less efficient less gas was produced and therefore it was thought possible that the plant could function with only one condensate pump running unlike Phase 2 when two such pumps were generally in use. Less was produced by this method than had been the case with the GCM. The line between the condensate flash drum and the condensate suction vessel had to be re-routed. The fuel gas line required adjustment since in Phase 2 operation a proportion of the fuel gas had been produced in the GCM. As to the gas this could no longer be exported during the Phase 1 operation. Much of it was routed to flare and the balance if not required as fuel gas was used to the effect of increasing the gas available for gas lift. With more gas lift it was possible to extract more hydrocarbon from the oil reservoir. Thus the system was required to deal with more hydrocarbon than had been the case latterly when Phase 2 was functioning . It should be noted that the wells were generally producing substantially less oil than they had produced at the time in 1984 when Phase 1 had last operated. The platform originally produced about 250,000 barrels of oil per day. This increased over the earlier years to about 300,000 barrels but then began to reduce and by 1988 was about 125,000 barrels per day. During Phase 1 the gas routed to flare increased about eight times compared to the position under Phase 2. This increased flaring caused a noticeable increase of heat at the south-west corner of the platform. It also caused some additional vibration of the platform structure.

It should be noted that generally the production flows fluctuated and this was probably rather more pronounced when Phase 1 was operating. The processes were designed to be largely self regulating so that they adapted to changes in flow. However in Phase 1 operation particularly a measure of adjustment of the plant was needed to keep the processes flowing.

The crux of the defenders’ submission on Phase 1 was that the effect of the change from Phase 2 to Phase 1 was that a far greater quantity of hydrocarbon was in the platform system. However they claimed that because particularly of the removal of the GCM the platform was less well equipped to deal with the extra hydrocarbon.

3.3. Reservoir and Module A

The reservoir fluids were a mixture of crude oil, gas, water, and sand. They were brought to the surface by pumping a proportion of the 34 wells which connected the reservoir to the platform. The wellheads (also known as christmas trees) were designed to control the flow of the material extracted from the reservoir and to isolate the reservoir as required. The contents of the reservoir were kept in liquid state by the intense pressures generated there but by the time they has reached the surface during extraction they had become gas and fluid and accordingly a two phase flow. The well heads were all in Module A. No processing was carried out there and once the material was extracted it was transferred by pipeline to the manifold in Module B.

It should be noted that in referring to oil, gas, and condensate one is not considering three totally different substances but rather hydrocarbon in various states.

Each wellhead is connected to the reservoir by a 20 inch conductor pipe that extends several hundred feet into he sea-bed. The reservoir materials were extracted through tubing inside the casing round the conductor pipes. In early years the pressure within the reservoir itself was sufficient to send the reservoir materials to the surface. However over a period of time the reservoir pressures declined so that artificial methods had to be used to raise the material from it. The most used of these methods was gas lift. By this method gas was pumped into the reservoir. This lightened the reservoir fluids and helped them to rise to the surface. As they rose the gas came bubbling through the fluid. The introduction of gas was achieved by routing gas from the platform to each gas lift well. Other wells were assisted by the use of submersible pumps. As at July 1988 there were from 25 to 27 wells in production. About 15 or 16 of these operated with the assistance of gas lift. In the case of a gas lift well it would suffer a loss of production if its gas were withdrawn. This would happen progressively and some of the gas wells could maintain a reasonable level of production even if deprived of gas. Any loss of production from the reservoir would be recorded at Claymore and at Flotta by way of the telemetry system. The flow of reservoir material to each wellhead was controlled by a system of valves. The valves in each wellhead were designed to close automatically in the event that the wellhead was shut-off or if an emergency occurred. Each wellhead had the protection of a downhole safety valve, the hydraulic master valve and pneumatic wing valves.

Gas lift for the wells was routed from the second stage of the reciprocating compressors. A gas supply then travelled from Module C (where the compressors were situated) to Module A. A shutdown valve was installed on the pipeline and in the event of a shutdown gas could be isolated from the wellheads by means of a GOV.

Water injection facilities were used to inject sea water into the reservoir to help maintain the reservoir pressure. These facilities were part of the responsibilities of the Oil and Water Operators. Generally there were two such operators on duty together on each shift. Their duties covered Modules A and B as well as the part of the 68-foot level on the skid deck. Their main location was normally Module A. However they would visit Module B and occasionally would be in the Control Room or on the Skid Deck. Among their duties was the checking of various controls and gauges and the starting and stopping of certain equipment. Mr Grieve passed near the produced water package at the 68-foot level shortly before the accident and did not claim to have seen either of the Oil and Water Operators there.

3.4.1 General

The main function of the equipment in Module B was to separate gas and produced water from the crude oil. After this separation the treated crude oil was pumped by way of the MOL to Flotta. The outline of the process in Module B was that the gas was cooled and a small quantity of condensate was collected and transferred back to the production separators. As to the gas this was routed into Module C for further processing. The produced water was diverted to the water treatment package at the 68-foot level.

Each of the separate flow lines from the wellheads in Module A passed through the A/B firewall into manifolds in Module B. There were separate manifolds for each of the two production separators and a third for the test separator. Wells could be allocated to these separators by manually operated valves. Samples of well fluids could be taken periodically from each flow line by access through sample points. The process flow at this stage was largely unstabilised crude oil and this began to go into a two phase flow of gas and oil. There were emergency shutdown valves on the manifolds to the three separators and these were designed to close automatically in the event of platform shutdown.

Each production separator had a number of alarms associated with it. Thus there were low and high level alarms (PAL and PAH and for more extreme situations PALL and PAHH). If any of these alarms were triggered a common alarm in the Control Room would give an indication that there was a problem with the separator concerned without specifying the nature of the problem. The separators also had equivalent alarms to register high and low levels. These alarms were designed to deal with serious disturbances in the process flows and would only show up a leak if it was relatively material. This is because the whole system was designed to be self regulatory so that trips should only occur if the equipment went outside acceptable operation limits. Minor deviations in the process were intended to be dealt with by automatic adjustment of the equipment concerned. The defenders made the point that the amount of gas needed to cause the explosion which caused the accident was very small compared with the amount of hydrocarbons passing through the system. The production separators each had a shutdown system and in the event of alarms for materially abnormal levels or pressures being triggered an inlet emergency safety valve would close. Other related valves would also close although only the separator triggering the alarm would be affected. It has to be noted however that a separator could trip for a cause unrelated to the process flow. There were no moving parts within the separators.

After the fluids entered the production separators they divided into three flows by gravity separation. The water went to the bottom. The oil flowed over internal weirs before leaving the separator. The gas moved to the top and left the separator there. As at the date of the accident the pressure and temperature in each production separator should have been 155 psia and 150 degrees Fahrenheit respectively.

The function of the test separator was to check the flow rate and composition of the well fluids so that at regular intervals oil from each well was routed into the test separator for this purpose. The oil was thereafter transferred back to the production separator by a transfer pump.

The produced water being heavier than oil dropped to the bottom of the separators and the interface between water and oil in the separators was regulated by a level control system. If the water in the separator dropped to a pre-set point the level control valve associated with the separator would close to a degree to balance the situation and the reverse would happen if the level rose beyond its pre-set point. When the water left the separator it went through the produced water treatment system. Thereafter the water went through a skimming process at the 68-foot level. A small quantity of oil was skimmed off the water or removed in the hydrocyclone units and this water was re-routed to the production separators. The produced water was disposed of into the sea.

The oil level in the production separator was also controlled by a level control system. The control valves that operated the system were located in the metering streams in Module B. These valves controlled the flow of crude oil from the production separators into the MOLs. Because the water separation system was not wholly efficient a certain proportion of water known as the "water cut" remained in the oil and went with it to Flotta. On 6 July 1988 at 1600 hours the water cut was higher than normal being 10.5% compared with a normal cut of about 5%. This was due to work being carried out on the overboard dump line.

Each production separator had one exit line for oil flow and the oil was pumped out of its exit using a booster pump. The oil was discharged from its pump through its metering skid. There was a non-return valve on the discharge line from the booster pump and this prevented the discharged oil from flowing back to the suction side. The shutdown of a production separator would cause its booster pump to trip. There was a third booster pump (the middle pump) which was used as a spare pump for either separator. The discharge from the spare pump went to a third metering skid which was also in effect a spare skid. Normally two booster pumps would be in operation.

If oil were to escape in Module B then some gas would flash off particularly in relation to the lighter ends although the molecular weight of the mixture would exceed the average molecular weight of these ends because some of the heavier ends would also flash off. The extent of the gas flashing off from oil can be estimated at about 5%.

3.4.2 The Metering Skid

The metering skid comprised three metering runs. The turbine meters were situated towards the north end of the meter run. The level control valves controlling the level in the production separators were downstream of the turbines in the metering runs. Data taken from the runs passed into the metering and telemetry system. Associated with the metering system there were a number of alarms which would be triggered in the event of malfunction or if measured parameters deviated outwith the predetermined set limits. However the evidence did not disclose what these limits were. The meters were in place to serve a fiscal purpose and not to detect leaks so that it is unlikely they would be triggered by other than a relatively large leak which made a material impact on the flow. Any alarms generated were activated by the Solatron system and the Solatron alarm panel was located on the Control Room Operator’s desk. Alarms only sounded if the oil flow exceeded the predetermined levels. An automatic sampling system was also installed on each metering run. Manual sampling connections were also installed. These were small three-eighth of an inch connections from which a sample container could be filled. Oil discharged from the metering runs went into the MOLs.

The metering equipment itself sat in horizontal pipework running north to south. The pipework was 8 inch diameter. The equipment was 12 to 16 inches long and contained a turbine wheel from the metering runs. Pipework ran vertically up the B/C firewall and met in a common header called the main oil line pipe suction header. This was 20 inch diameter pipework and it ran along the B/C firewall at the western end of the module and then ran north to south. Its total length was 60 feet. The defenders argued that this pipework would have protected the 4 inch condensate injection pump against any projectile from the B/C firewall. However this line of attack was not explored with the experts in any detail. The main oil line discharge header also ran north to south. The large bore pipework was in general supported by hangers.

3.4.3 The Prover Loop

The prover loop was normally located above the metering skid and was used to check the accuracy of the measurements in the metering system. By 6th July 1988 the prover loop had been removed from the flow system so that its lining could be repaired. The loop consisted of a four-way valve, a loop of pipework, and a considerable amount of ancillary pipework. Connections to the prover loop were blanked off but when the prover loop was removed from the flow line any flange or spade used to isolate the flow would not have been exposed to the flow pressure unless previously pressure tested. There were about 6 lines blanked off and of course they were also protected from the flow by safety valves. When the prover loop was disconnected a portable prover loop was from time to time connected to the system and then removed after use. Any system in force for the use of this portable prover loop was not explored in the evidence. The metering skid also had its own alarms. A major alarm would be registered if there was say a malfunction of one of the transducers. What would be regarded as a minor alarm would annunciate if there was a significant deviation from what would be regarded as normal. Because the prover loop was away maintenance men would remove the meters and clean them. On the day of the accident according to the witness Mr Dixon a team of men had been preparing to perform some work in the general area of the prover loop. A scaffold had been erected. However we had no indication of the work that they were intending to carry out although it involved welding equipment. Moreover the men seem to have been withdrawn before they got on with their work. There was not even any evidence that work on the prover loop would need scaffolding. Nor was there any indication that they were working during the nightshift when the accident happened. Indeed on the contrary Mr Bollands said that there were no permits issued for welding work on the night of the accident. Also round about the day of the accident some work had been carried out with the meters.

3.4.5 The MOL Pumps

At the date of the accident three MOL pumps were in operation. These pumps operated in series with the discharge of one pump feeding the suction of the next pump. A non-return valve associated with each pump prevented the backflow of oil from the discharge side to the suction side. If for any reason a pump was shut down the non-return valve opened thus allowing the flow to by-pass that pump and to flow to the next pump in the series. Each MOL pump had motor operated valves on its suction and discharge sides. These were designed to close automatically if a pump was shut down or tripped. The pumps were centrifugal pumps operating on the impeller principle. The impeller rotated at speed drawing fluid from the suction side towards the central part of the impeller where it was accelerated. The diameter of the discharge line was of smaller bore than the suction side and the process generated higher pressure. The fluid entering the MOL was at a temperature of approximately 153 degrees Fahrenheit and at a pressure of 905 psia. The MOL pumps had separate local control panels at the west end of Module C.

Each MOL pump was equipped with a process alarm system that relayed a common alarm to the Control Room. When an MOL pump was running a red running light appeared on the main process mimic there. If a pump tripped the red running light was extinguished, an amber light would flash, and an audible alarm would sound. A button was then pressed by the Control Room Operator. This had the effect of accepting the alarm. When the alarm had been accepted the audible alarm would stop and the flashing light would become steady.

The MOL pumps were also equipped with a process shutdown system. Some disturbances of the flow would cause a common shutdown of all the MOL pumps. This would occur in the event that (a) a local shutdown button was operated for all pumps, (b) no booster pumps were running, (c) there was low pressure in the common suction header, (d) there was high pressure in the common suction header, or (f) the emergency shutdown valve ESV 208 was not open. If any of these conditions occurred the MOL pumps were designed to shut down and ESV 208 to close. However the process system was designed to be self adjusting so that not every variation in the flow would shut down the pumps. For this to happen the predetermined parameters had to be exceeded. However there was a leak detector which would shut down and isolate the pump if greater than normal drain came off the seal of the pump.

Each MOL pump was fitted with its own process trips. The pump could be tripped (among other possibilities) by (a) operation of the pump emergency stop button, (b) low pump discharge pressure, (c) high pump discharge pressure, (d) low pump oil lube pressure, (e) failure of the seal system, (f) low lube oil level (g) high pump vibration, (h) high coupling bearing temperature, (i) high motor bearing temperature, (j) high motor winding temperature and (k) high pump bearing temperature. In the event of any of these contingencies materialising the pump was designed to shut down and the motor operated valves were designed to close. On the discharge side of the MOL pumps there was a pressure transmitter with an associated low alarm (PALL 111) so that if the pressure dropped in the MOL downstream of the pumps then an alarm was relayed to the Control Room. In the event of high pressure in the MOL there was a pressure switch the purpose of which was to activate a platform shutdown in the event of an excess of pressure in the MOL.

From the discharge side of the MOL pumps the fluid passed through a non-return valve installed in the discharge header and then through ESV 208 before entering the MOL. The tie in point was located directly upstream of the main shutdown valve that isolated the MOL from the process equipment in Module B. There was an arrangement whereunder the valve could be closed by nitrogen pressure in the event of failure in the electrical power supply.

Notwithstanding the above the main system for detecting leaks of hydrocarbons was the Gas Detector System and the absence of trips was not a sign of the absence of leaks unless in respect of leaks that had allowed the escape of significant amounts of material.

3.4.6 Gas and Condensate Flows in Module B

Gas came out of the production separators from exits at both ends of these. The streams were routed separately to the east end of Module B where the two streams merged and were again separated into two streams before entering the four gas coolers. The purpose of these coolers was to improve the quality of the gas by cooling it and separating the condensate from the gas. This caused the formation of a certain amount of condensate but not much at this stage. The temperature of the gas stream was thus reduced from approximately 150 degrees Fahrenheit to approximately 65 degrees Fahrenheit (being the temperature the gas retained until it emerged from the suction side of the centrifugal compressors). Gas and condensate formed in the gas coolers went into the condensate knock-out drum towards the east end of Module B. This vessel was also used to separate condensate from gas although again at this stage of the process very little condensate was knocked out of the gas. The vessel contained baffles but no moving parts. The pressure entering and leaving this vessel remained about the same as the production separators that is approximately 155 psia. The level in the vessel was controlled by a pressure control system. Condensate collected in the knock-out drum was returned to the production separators by means of a transfer pump located just to the west of the condensate knock-out drum. The knock-out drum had its own local control panel (JCP O09). There were process alarms associated with the condensate knock-out drum and these were relayed by common alarm to the Control Room. For example if there was a high level in the drum there was an alarm and if this progressed to become high, high, level the inlet valves to all the production separators would trip. During Phase 1 the condensate knockout drum only received relatively small amounts of condensate. This tended to be composed of the heavier ends of the gas flow.

Gas left in the condensate knock-out drum was routed through the B/C firewall into Module C. Moreover a line was taken from the gas line before it entered Module C, and this led to pressure control valves (PCV -51 1/2). Thus the pressure within the production separators and the condensate knock-out drum could be controlled. The PCVs effected this by removing any excess pressure to the flare system. Accordingly if a centrifugal compressor tripped (thus rendering it incapable of continuing to receive and compress a continuing flow of gas) the said PCVs would relieve the excess gas to flare. Downstream of the condensate knock-out drum there was a slipstream which routed some of the gas to the deoxygenisation towers in the 84-foot level. This gas was used to remove oxygen from the sea water to reduce its corrosivity.

The responsibility for operating the equipment in Module B was also part of the responsibilities of the Oil and Water Operators. These duties included (a) responding to any changes in the throughput of oil in Module B and of any changes in the water cut, (b) ensuring that the interface controllers on the production separators controlled the produced water that was being routed to the water treatment facilities and (c) in the event of the unloading and recycling of the reciprocating compressors and consequent gas lift checking the oil and interface levels of the two production separators.

The layout of the main equipment in Module B is generally as set out in the schematic number 12/97 of process. It should be noted that there was a chemical tank just to the east of the metering skid and a thick steel ladder giving access to the gas lift isolation valve. There was a point where the valve bringing gas for gas lift form Module C went into Module B at the west end of the firewall. The significance of these pieces of equipment is that the defenders claimed that such equipment reduced the possibility the condensate pipe had been breached by a projectile.

3.5.1 General

The process equipment in Module C was designed to process the gas produced by the production separators in order to remove the condensate from the gas and thus to increase the pressure of the gas. Gas compression was achieved by the use of centrifugal and reciprocating compressors. The major production of condensate was achieved when the gas flowed through the JT valve at the 68-foot level but as I have already noted some condensate was collected at the condensate knock-out drum and a small amount was also collected at the centrifugal discharge scrubber. The defenders were concerned to emphasise that there was a large amount of hydrocarbon present in the various pipes and machines to be found in Module C. Much of this is under considerable pressure. Some of the hydrocarbons in question pass through the east end of the module. This is observable in the drawings and schematics whereas the pressures at different points can be derived from Mr Clark’s flow chart which I will later refer to. Since many of the hydrocarbons are in a single phase state there is no question of flashing involved should they escape. In fact at the east end of Module C they are likely to be neutrally buoyant.

3.5.2 Gas and Condensate Flows in Module C

The design philosophy which prevailed on the platform at the time of the accident was that emergency liquid inventories would be trapped in their containers whereas gas inventories would be released to flare. Thus if you have an emergency you try and shut down liquid containing vessels whereas gas containing vessels are emptied to flare for the gas to be burned off.

The hydrocarbons which went through the JT valve process had all previously flowed through Module C. When it entered Module C the gas line from the condensate knock-out drum split into three streams and was routed to one of three centrifugal compressors. These compressors and indeed the main equipment in Module C was set out as is generally illustrated in the schematic number 12/98 of process. Each compressor had its suction scrubber but before entering this the gas had to pass through a GOV. In the event of a centrifugal shutdown the relevant GOV would close. The objective of the procedure at this stage was to see that only gas entered the centrifugal compressor and the function of the scrubber was to remove any liquid. However only a small amount of condensate was collected in the condensate suction scrubber. Leaving the suction scrubber, gas was routed to the suction side of the centrifugal compressors. Each such compressor was driven by a gas turbine. The gas turbine was similar to a jet engine and was fuelled by fuel gas. This gas when mixed with air created a flow of hot gases which drove the power turbine. The power turbine normally ran at between 80 to 105% of its design rpm. The expansion of hot gases caused rotation of a shaft linked to a gear box which in turn reduced the rotational speed and enabled the compressing mechanism to be driven. Each machine had seven impellers, (like propellers). Their rotation imparted velocities to the gas and these velocities were converted into pressure. The compressors required a great deal of air for the combustion process and at the end of the Module there were air intakes which drew air up from Module C and from beneath the open grating below them. Each intake drew-in air at the rate of about 27,000 scfm. 80% to 90% of this air was drawn in from outside the Module, the remainder being taken from within it. Any gas drawn in from Module C would undergo a certain degree of dilution by air before being sucked into the combustion air intakes. At some height above the air intakes there were exhausts for the combustion air. These features are clearly displayed in the schematics numbers 12/100, 12/106, and 12/107 of process. The compressors themselves are enclosed in compartments there being separate compartments for the turbine sections and the compressor sections as is illustrated in the schematic number 12/126 of process. The Turbines gave off a lot of radiant heat. As part of the process of cooling the machines ventilation air was drawn into these compartments and the arrangements for achieving this are also generally illustrated in 12/26. This ventilation air was drawn in from outside Module C but the amount of air required was much less than was needed for combustion being about 8,000 scfm for each machine.

In the centrifugal compressors the gas was substantially increased in pressure to about 675 psia and in temperature as well to about 700 degrees Fahrenheit. The gas was then cooled in coolers in the centrifugal compression skid. There was one such cooler for each compressor train. The effect of this cooling was to generate small quantities of condensate. Thus a two-phase flow (gas and fluid) was created and this went to suction scrubbers which were located directly below the gas coolers. In these scrubbers the condensate was separated from the gas by gravity and it was collected at the bottom of vessel in a protrusion known as a boot. The condensate thus collected was then routed to the condensate suction vessel which was located in the roof space of the 68-foot level and it flowed there by gravity. The pressure in the condensate suction vessel was maintained at the same pressure as the pressure in the discharge pipework of the centrifugal compressors to prevent back-flow. To deal with this need for pressure equilibrium GOVs were installed on each line coming from the discharge scrubbers and these were designed to close in the event of a pressure differential. If one of these GOVs closed the condensate in the boot of the associated discharge scrubber would increase quickly and if the operator did not remedy the situation the associated centrifugal compressor would trip and shut down. It should perhaps be noted that each centrifugal compressor was equipped with two suction GOVs.

There were also GOVs on the gas lines from the discharge scrubbers which were designed to close in the event of a shutdown of the centrifugal compressor. Downstream of these GOVs the discharge lines for each of the discharge scrubbers merged into a common manifold and the gas then went to the first stage of the reciprocating compressors. The pressure and temperature downstream of the discharge scrubbers of the centrifugal compressors was approximately 675 psia and 105 degrees Fahrenheit respectively.

The valves controlling the discharge pressures from the centrifugal compressors were PCV - 1000A and PCV - 1000B respectively. If excess pressure was seen at the discharge of the centrifugal compressors these valves would open and relieve the excess pressure to flare. Gas to supply the fuel needs of the platform was taken from the discharge header of the centrifugal compressor. Moreover each of these compressors was fitted with a minimum flow by-pass or surge control system. This was an example of the self-regulatory arrangements which were built into the design of the process system and the facility recycled gas from the outlet of the discharge scrubber to the inlet of the suction scrubber on each compressor train. The intention was to keep an adequate supply of gas going through each compressor train. The amount of gas going through the recycle line was controlled by an anti-surge valve. Some quantity of condensate was produced after the centrifugal compressor stage and this was taken up by the discharge scrubbers. The mass flow at the outlet of the centrifugal compressors was considerable. The closing of the discharge and suction GOVs of the centrifugal compressors enables these compressors with their discharge scrubbers to be depressurised. Thus after the tripping of the centrifugal compressors the inventory of the centrifugal skid is gradually reducing as vapour escapes to flare. It would however take hours for all the pressure in the system to flash off to flare. Since there were three discharge scrubbers there was condensate about the middle of the east end of Module C in three lines. These must have penetrated the decking to the 68-foot level to join up with the condensate suction vessel. In fact the defenders submitted that the centrifugal skids contained a considerable mass of pipes, valves and flanges each carrying large quantities of gas or condensate. In a general sense this was true. Moreover stopping the equipment does cause pressure peaks and surges. On the other hand the flaring system is there to deal with these phenomena.

Each centrifugal compressor was fitted with a number of process shutdown trips. For example each compressor would trip on gas generator overspeed and underspeed, power turbine overspeed, turbine high temperature, compressor high discharge pressure, high discharge scrubber level and selected fire and gas detection. The compressor could also be closed down locally by a stop button. The exact settings which would cause these trip devices to operate were not proved. However it was clear from the evidence that the recycling can also cause these compressors to trip. It was not common but not unknown for all three centrifugal compressors to trip. In the event of a centrifugal compressor tripping or being shut down it was designed to be automatically depressurised.

Gas from the discharge of the centrifugal compressors was normally routed to two suction scrubbers associated with the first stage of the reciprocating compressors. If any condensate entered with the gas it was collected at the bottom of these scrubbers and then routed to the condensate knock-out drum in Module B. However little condensate formed at this point. There were two GOVs at the inlet of each of the first stage reciprocating suction scrubbers and these were designed to shut in the event of the reciprocating compressors being shut down.

The gas exited at the top of each suction scrubber was routed to the first stage of the reciprocating compressors 1-K-103A and B. These compressors were motor driven large machines each weighing about 70 tons. The purpose of the first stage of this compression was to compress the gas but there was a limit to the compression that could be carried out because compression increases the temperature of the gas. The packing on the piston seals could not tolerate too high a temperature. When the gas originally enters these compressors it contains the whole range of hydrocarbons. Indeed nothing is put into the system after the material leaves the separators. When the hydrocarbon first leaves the separators there is oil that is diverted to MOL, there is a small amount of condensate that is dealt with as such, and there is a large amount of gas, some of which at least has the potential to become condensate. The purpose of the process I am now describing is to turn gas into liquid condensate. Liquid is easier to handle than gas. The light ends of the gas, such as methane can be exported for domestic use but the heavier ends require to be liquefied to be useful. The advantage of the Phase 2 programme was that unlike Phase 1 one could separate a useful amount of the lighter ends. Only a relatively small amount of condensate was actually produced in Module C. The JT valve was the main instrument for condensate production.

If the reciprocating compressors for any reason had too much hydrocarbon to deal with the excess went to flare through PCV 1000A and B. The defenders argued that when the system went into Phase 1 there were only two reciprocating compressors in operation (the third compressor in the GCM being out of the equation). There is likely to be more gas coming forward since the increased use of lift gas should improve production. Thus the reciprocating compressors were unable to cope with the increased load and it was for this reason that PCV 1000A was left partly open. However it is not clear how far this can take the defenders. Gas excess to the reciprocating compressors’ capacity might be wasted by sending it to flare but this would relieve any pressure on the reciprocating compressors. At the time of the accident certain equipment tripped but not the reciprocating compressors. There is nothing to suggest that they were not functioning perfectly normally. Moreover because oil production generally from the platform had declined compared with 1984 it cannot in any way be assumed that at the time of the accident the system was under Phase 1 coping with a higher flow of oil than it had coped with in 1984.

The gas first went through a snubber which distributed the flow to each of the three cylinders of the compressor which were involved at the first stage. Pistons within these cylinders compressed the gas. The gas then left the cylinders and went through a lower snubber manifold. The gas leaving the cylinders was the same mass as had entered only compressed. The action of compression increased the temperature of the gas to approximately 190 degrees Fahrenheit and a pressure of about 1465 psia. It was routed from the lower snubber to the after-coolers of the reciprocating compressors. These worked on the same principle as the set of coolers which served the centrifugal compressors. This completed the first stage of the reciprocating compression. The gas at the end of this stage had a pressure of about 1465 psia and a temperature of about 92.5 degrees Fahrenheit. A cross section of the first stage of the reciprocating compressor is well illustrated in the schematic number 12/130 of process and 12/129 shows a plan view.

After leaving the two sets of after-coolers the gas went through GOVs which were designed to close in the event of shutdown of the reciprocating compressors. Each of these compressors could be put on recycle. This procedure allowed the compressor to keep running without maintaining a forward flow. This was achieved by opening a by-pass or recycle valve in a line that went from the discharge side of the after-coolers to the suction side of the suction scrubber and this was done by a switch. The by-pass valve for reciprocating compressors A and B were GOV 902 and GOV 904 respectively. Under normal circumstances these valves would be closed. When a reciprocating compressor was placed on a recycle mode then high temperatures could be created within the compressor cycle due to the act of compressing the gas. To deal with this the inlet and outlet valves in the cylinders of the reciprocating compressors could be held open. This prevented gas from being compressed yet enabled the pistons to continue to move within the cylinders. The facility was known as unloading. A separate switch was required for each of the three cylinders on the first stage of each reciprocating compressor. The switches which effect unloading were located in local control panels near the reciprocal compressors in Module C. To complete the process 14 switches had to be thrown and this took about two minutes to achieve. When recycling, the discharge pressure is not maintained and indeed a substantial amount of the gas goes to flare through PCVs 1000A and B. These valves are two valves which operate in tandem. The smaller takes up the normal flow and the larger takes up the balance if the volume of gas increases. The unloading process does not result in complete unloading but pressure within the reciprocating system is reduced because effectively the gas is merely returned to suction. During unloading some gas will recycle through the centrifugal relief system and some will go to flare through PCVs 51-1 and 2. Thus when the said valves opened under pressure the equipment was automatically depressurised.

In the event of the reciprocating compressors being shut down GOVs on the upstream of the suction scrubbers and downstream of the after-coolers automatically closed. Each reciprocating compressor was fitted with a number of process trips. These included high discharge temperature in the cylinders, high level in the first stage suction scrubber, and high discharge pressure. If the apposite conditions occurred the reciprocating compressors shut down and depressurised automatically.

When gas left the first stage of the reciprocating compressors it was routed to the 68-foot level of the platform where it passed through the J.T. (Joule Thompson) valve PCV - 721A. The effect of this valve was to reduce the pressure of the gas. The pressure was reduced from about 1465 psia to about 635 psia and this in turn had the effect of reducing temperature from about 92 degrees Fahrenheit to about 50 degrees Fahrenheit. The purpose of this stage of the operation was to separate condensate from gas. Thus downstream of the JT valve was a two phase flow. When the whole process was in Phase 2 the condensate would be diverted upstairs to the GCM to be processed there and then returned to the JT flash drum at the 68-foot level. When as at the time of the accident the process was in Phase 1 operation the GCM was isolated and the two phase flow of gas and condensate went into the JT Flash Drum. 3-C-701. Just prior to the entry of the 2 phase flow into the JT drum was the tie-in point of the pipeline containing the condensate flow from the condensate suction vessel. The flow from this was routed to the JT drum by way of a level control valve. This maintained a predetermined level of condensate in the condensate suction vessel. The driving force for the transfer of the condensate from the condensate suction vessel to the JT drum was differential pressure and this was controlled by two valves located in the 68-foot level.

An understanding of the production of condensate illustrates why when the condensate injection pump failed it was advisable to recycle and unload the reciprocating compressors. The objective was to prevent further gas going forward to condensate production while the injection pump system was not able to cope with it. However a certain amount of additional condensate would be reaching the JT flash drum from the condensate suction vessel. In fact the centrifugal compressors were producing about 1537 barrels a day of condensate and this has to be compared with the total production of condensate which was 7394 barrels per day when the amount produced at the JT valve is added. By unloading the reciprocal compressors the amount of condensate produced by the JT valve is substantially reduced and this relieves the pressure on the JT flash drum. Obviously when the condensate injection pumps cease pumping the operators are concerned to avoid an excessive increase of the level of condensate in the JT flash drum. If the condensate level in the JT flash drum became excessive some condensate liquid could be carried into the second stage of the reciprocating compressors and could damage them as well as tripping them. After the condensate injection pump trips an alarm goes of when the flash drum is about half full and after that there is about one hour left before the flash drum reaches critical levels provided that the reciprocating compressors are unloaded. Otherwise the available time is about 13 minutes. After critical levels are reached the condensate runs to flare and is wasted.

The JT drum was a horizontal vessel and its function was to separate condensate from gas. It contained no moving parts but operated by way of baffles. The level of condensate in the drum was controlled by a level control system. This worked by control being exercised over the speeds of the condensate injection pump. If the liquid level of the drum increased the speed of the pump increased in order to pump away more liquid and the opposite occurred if the level dropped. The normal liquid level in the JT drum was about a quarter of the vessel. The drum was fitted with a high level alarm that would be triggered at a liquid level that was some 8 inches beneath the centre line of the vessel. If the level indicator located between the condensate injection pumps showed the level in the drum to be 100% this in fact meant that the actual liquid level in the drum corresponded to the centre line of the drum and thus that the drum was half full. The pressure of condensate in the drum was approximately 635 psia. The temperature was about 55.6 degrees Fahrenheit.

The gas that left the JT drum was routed back up to Module C to undergo the second stage of reciprocating compression. If one of the reciprocating compressors were to trip then the pressure would build up on this line and that pressure would be sensed by the differential pressure control valves, PCVs 723 A and B. These valves would then open to relieve to flare any additional gas that could not be compressed and moved forward by the other reciprocating compressor. Normally these valves were in any event partly open to control the pressure on the JT drum and thereby maintain the pressure differential required between that vessel and the condensate suction vessel.

As part of the second stage of the reciprocating compressor process the gas passed through suction scrubbers 1-C-116 A and B on the east side of each compressor. In the compressors themselves the gas flows of the second stage were entirely separate to those of the first stage. Once again there were three cylinders in which the gas was compressed.

The suction scrubber for the second stage of the reciprocating compressors was situated to the south of each compressor. The location of these scrubbers is not without significance for a number of witnesses identified the location of PSV 504 by reference to the location of these scrubbers. In Phase 1 the gas going to the second stage of compression in stage 2 was lighter than the gas in the first stage because some of the heavier ends have been taken off as condensate. However some of the heavier ends still remain in the gas. In general though the molecular weight of the second stage gas would be less heavy.

The pressure and temperature of the compressed gas leaving the second stage of the reciprocating compressors was approximately 1735 psia and 198 degrees Fahrenheit respectively.

The arrangements for recycling and unloading of the second stage of the reciprocating compressors were equivalent to those of the first stage. However in the case of the second stage only two of the three cylinders could be unloading and therefore there were only two switches required. The unloading and recycling of both stages of the reciprocating compressors stopped the forward flow of gas from these compressors. This meant that the bulk of the gas would go to flare from the discharge header of the centrifugal compressors through PCV 1000 A and B.

The gas lines from the second stage of each of the reciprocating compressors merged and gas was then routed into the gas lift system although a small amount would go to flare via PCV - 945.

The Phase 1 Gas Operator was responsible for the operation of the gas compression facilities in Module C and also for the condensate system at the 68-foot level. In the course of his duties the operator was expected to be in his areas of responsibility from time to time to check that the equipment was in order

3.6.1 Condensate Flows

In general condensate is formed when gas is cooled. Condensate is essentially a state of the gas but when gas becomes condensate the proportions of hydrocarbon constituents will change as between the gas and the liquid. The heavier ends of the hydrocarbon chain have a greater tendency to form condensate so that the proportion of these in the condensate will increase whereas the lighter ends have more propensity to remain or flash-off as gas. However even a condensate will retain some material proportion of the lighter ends such as methane and ethane although heavier ends such as butane and propane will preponderate. In a two phase flow although the proportions of the hydrocarbon constituents may have changed as between liquid and gas nevertheless none of the original constituents will have been lost in terms of the totality of the flow.

3.6.2 The Condensate Booster Pumps

The condensate collected in the JT drum was routed to the suction side of the two condensate booster pumps 3-G-701 A and B. Normally only one of these two pumps would operate but they could operate in tandem. The pumps had a minimum flow by-pass system whereby condensate was simply re-routed back into the JT drum to ensure that there was a minimum amount of flow through the booster pumps if the downstream condensate injection pumps were not operational. For condensate booster pump 3-G-701 A there was a shutdown valve located on the suction side of the pump to isolate it in the event of a shutdown. This valve was SDV (shutdown valve) 5009. The condensate exited the pump through a non-return valve and another shutdown valve SDV 5010. In the event of the booster pump being shutdown or tripping then the SDVs would automatically close. For condensate booster pump 3-G-701 B the shutdown valves for the suction and discharge side of the pump were SDV 5011 and SDV 5012 respectively. These SDVs operated generally on the same principle as the GOVs. The pressure of the condensate was increased from about 635 to 670 by the booster pumps and this is a point the defenders made much of in their submissions in relation to any condensate entering the condensate injection pump and then escaping. Indeed the purpose of the booster pumps was to give that small pressure increment. 635 psi is equivalent to about 43 bar whereas 670 psi is equivalent to about 47 bar. If gas at 43 bar enters an empty pump chest some of the liquid will flash off and return to gas form. It will not be possible to repressure or condense all of the gas which has flashed off. However at 47 bar it is possible to reconvert the gas to liquid. The action of pumping caused a small temperature increase. If both pumps were running then the flow of these pumps merged in a common pipeline before being routed to the condensate injection pumps. If the condensate booster pumps stopped they could be restarted after operating a reset button on the local control panel. The defenders contended that it was important to know if the booster pumps had been restarted at the point of any jagging or whether they were in a tripped condition. On the control panel which houses the restart apparatus for the condensate injection pump there are equivalent mechanisms for the booster pumps. The GOVs would have to be reset and the pump started. One difference between the position of the booster pumps and condensate injection pump A on the evening of the accident is that it had never been suggested that the booster pumps had been electrically isolated. There was certainly no evidence that Mr Vernon had restarted the booster pumps before any repumping but it would have been a simple operation for him to have done so were this an advisable preliminary to re-pressurisation. Moreover if it were obvious that any gas in the pump had behaved as it would when under the boosted pressure it would not be difficult to infer that the relevant booster pump had been restarted. It would in any event have had to be restarted at some point before the injection pump was restarted. Mr Vernon was not merely awaiting the initiation of pump A but it seems that he was still trying to start pump B and this could have started very quickly had it been in working condition. Thus he may well have restarted both booster pumps. Mr Wottge certainly said that one would require to have the booster pumps running before restarting the condensate injection pump. However all this assumes that the booster pumps trip or stop pressurising when the injection pump trips. We never had very precise information about this although there was evidence that the booster pumps have a minimum flow bypass facility which will create a continuous flow through the pumps if the flow cannot proceed forward. In any event with the condensate injection pump A isolated it may seem logical that the relevant booster pump would be turned off. Moreover Mr Wottge has remarked that unlike in the case of the reciprocating compressors the recycling process in the booster pumps occurs automatically. It may be that if the pump remains switched on the flow returns automatically if the stream begins to flow forward again or possibly the recycled flow is at the boosted pressure. The fact is that the matter of the booster pumps was not really fully explored in the evidence but none of the experts suggested that any flow into the condensate injection pump would be at less pressure than its planned level.

A problem for the defenders was that it was only after Dr Richardson had given his evidence that the implications of the booster pump increasing pressure became clear. This may explain why they did not examine say Mr Wottge in more detail about this matter. Mr Wottge gave his evidence on the relevant matter about day 41 of the proof whereas Dr Richardson did not raise the question of differential pressures until day 115.

3.6.3 The condensate injection pumps

These pumps were situated at the 68-foot level towards the east end of the platform. They are of course of critical importance to the case because the pursuers aver that the accident was caused by a leak coming off the relief system for one of these pumps. The two pumps were identical. Condensate from the booster pump would enter the lower chamber of the pump chest of the injection pump. The shutdown valve for the discharge side of the condensate injection pump A was GOV 5005 and for pump B GOV 5007.

The condensate injection pumps were reciprocating-type pumps. The pump chest contained three internal cylinders each containing internal suction and discharge valves. Liquid was compressed within these cylinders and pressurised by the reciprocating action of the pistons driven by the crank shafts. There were three suction valves for each cylinder that allowed liquid into the pump chest as the piston was withdrawn. As the piston moved forward into the cylinder the pressure in the pump chest built up and when the pressure exceeded the pump discharge pressure the internal discharge valve opened. From the internal discharge valve in each cylinder condensate passed into an upper chamber and was then routed into the upper chamber of the injection pump. A non-return valve and a GOV were located on the discharge line. For condensate injection pump A the GOV was GOV 5006 and for pump B it was GOV 5008. The discharge pressure of the condensate injection pumps was approximately 1100 psi. Once again the action of pumping the condensate increased its temperature slightly.

The general layout of the pumps and their controls is shown in the schematics 13/48 and 13/49 of process. The control panel JCP O57 was located about 4 to 5 feet from the local control panel. On the stanchions beside the local control panel there was an level indicator for the JT flash drum. Indeed the witness, Mr Grieve, had approached this indicator just minutes before the accident.

The slight pressure surges associated with the operation of the condensate injection pumps were catered for pulsation dampeners. They had a spherical shape and a capacity of about 20 US gallons each. At about the mid-point of the sphere there was a pneumatic diaphragm. If for example the top half of the sphere was filled with nitrogen gas to a pressure of about half the operating pressure then the lower half of the sphere would be filled by condensate and pressure pulsations would be absorbed by the diaphragm moving slowly compressing the nitrogen in the upper part of the sphere. The setting of the pulsation dampeners determines the extent to which one would get a liquid flow at the alleged leak orifice.

Between the two pumps there was a half-inch equalisation line. If the pump which is not being restarted is still running this can be used to assist in the repressurisation of the other pump. It has isolation valves which can be closed.

The GOVs located on the suction and discharge piping of each condensate injection pump were pneumatically operated valves and supplied from the instrument air system. The GOVs were ball valves. The ball required to be turned through 90 degrees in order to fully close or fully open the valve. Each valve had a pneumatic actuator which operated a Scotch Yoke mechanism. Movement of a piston in the actuator caused the valve stem to rotate thereby turning the ball within the valve body. To open a GOV once it had closed instrument air had to be applied to one side of the piston housed in the valve actuator body. This caused the piston to move the Scotch Yoke mechanism and compress a spring in the other side of the actuator. The valve was closed by the air in the actuator being vented. This released the pressure on the spring and the spring, in turn, pushed the piston back. This action caused the Scotch Yoke mechanism to close the valve. The control system for the GOVs was arranged so that the pump motor could not be started until the GOVs were opened. The valve took an measurable time to open. Because it is spring loaded once the air valve begins to close the GOV closes faster than it opens. An operator attempting to open the valve to restart the pump would have the advantage of an indicator to show the extent by which the valve had opened at any point of time.

The condensate injection system had certain relief valves which are an important feature of the case because the pursuers attribute the cause of the accident to allegations that an attempt was made to start condensate injection pump A when its pressure control valve PCV 504 had been removed for maintenance and not replaced. The interruption of the line had been sealed off with a blind flange and the allegation is that this had not been fitted properly with the result that a dangerous amount of hydrocarbon leaked out of it and exploded. The PSVs for the two pumps namely PSV 504 for pump A and PSV 505 for pump B were designed to ensure that if the system pressure in either pump reached a certain point the excess pressure would be relieved. This was done by routing the hydrocarbon to the condensate suction vessel. The relief line for each pump was taken from the upper chamber of the pump chest. The valves were on the discharge side of the pumps. The set pressure for the said two PSVs was 1750 psig. Any flow from PSV 504 or PSV 505 passed through manual ball valves on the downstream side and then merged before entering the condensate suction vessel. The condensate injection pumps were designed to trip when the pressure reached 1700 psig. This was initiated by a high pressure switch. Each pump had its own independent lube oil system in order to lubricate the pump, gear box, and associated bearings. There were a number of trip devices associated with the lube oil system that would shut the condensate injection pump automatically.

The start buttons for each condensate injection pump were on the local control panels of these pumps, namely JCP-043 and JCP-044 respectively. These panels also had running and alarm indicating lights. Each condensate injection pump had a number of trip devices. These individual trips included low suction pressure, high discharge pressure, and various lube oil failures. If a condensate injection pump tripped its associated GOVs on the suction and discharge side would close. If the suction and discharge GOVs were not open then the pump could not be started. It was clear from the evidence of operators that the condensate injection pumps had a tendency to trip at intervals.

The status of the condensate injection pump GOVs was displayed on JCP-057. When starting a condensate injection pump it was necessary to reset the control system so as to be able to re-open the GOVs. The reset button for each condensate injection pump was located on JCP-057. The GOVs themselves were operated by use of push/pull buttons located some 2 or 3 feet to the south of the GOVs. If there was a fault indicated on JCP-057 a common alarm would be transmitted to the main control panel in the Control Room. If the pumps were being started the motor would be speeded only gradually to avoid creating a pressure surge that could again trip the pumps on high discharge pressures. Thus when restarting a pump the manual speed controller had to be adjusted. Before the pump was run it would be necessary and was practice to open the manually operated relief valve on the relief line in case there was such a pressure surge. Condensate from the discharge of the condensate injection pumps was routed to the condensate metering run at the 68-foot level. The metering run utilised an orifice plate mechanism in the measurement process. From this metering run the flow of condensate went through a pressure control valve PCV-511. This valve maintained back pressure on the condensate coming from the discharge from the condensate injection pumps to prevent gas from flashing-off from the condensate and affecting the meter reading.

From PCV-511 the condensate was routed in the condensate line up into Module C and then into Module B at the west end where it proceeded to its tie-in point in the MOL. There was a non-return valve and a ball valve on the 4 inch diameter condensate line at points close to the tie-in point with the MOL.

There is no doubt that the process arrangements generally involved the movement of very large amounts of hydrocarbons and that under considerable pressures and at elevated temperatures. The lay out arrangements meant that the hydrocarbon material had to traverse at various process stages substantial areas of Modules C and B and also the 68-foot level. Both the centrifugal compressors and the condensate injection pumps were sufficiently sensitive for a trip not to be out of the ordinary but if that happened the GOVs were intended to trip thus stopping the forward flow of gas.

On the Tuesday prior to the accident there had been a problem with condensate injection pump B. It was discovered that the problem was caused by a low pressure switch that leaked due to overpressure. However this was smelt by the operators and did not create an alarm. Of course it has to be noted that on the night of the accident apparently neither Mr Vernon nor Mr Richard smelt any leak of gas from condensate injection pump B. Moreover on that occasion the pump had tripped and stopped pumping some time before the accident occurred.

The Operators had in force on the platform a number of procedures aimed at securing the safety of the platform and those who worked on it. I do no think it was disputed that a production platform which retains and circulates a very considerable amount of potentially explosive and flammable hydrocarbon creates serious dangers if adequate safety measures are not taken. I think it goes without saying that many of the safety arrangements and in particular those for the prevention of explosions and the containment of fire drastically failed on the night of the accident. I believe that the sufficiency of the safety measures was explored at the Cullen Inquiry. However I am not concerned with the evaluation of these measures except insofar as parties in their pleadings have raised them as having a bearing on the cause of the accident or the legal responsibility therefor. In general OPCAL’s specific safety arrangements were set out in the document headed General Safety Procedures - Offshore Operations which is Number 12/405 of process. This was intended to regulate the organisation of safety for those working on the Platform. Two of the safety considerations which arose sharply in these cases were the Permit to Work system and the system for handover between shifts.

4.2. The Permit to Work System

4.2.1 General

This system is set out in Part 3 of 12/405 and the pursuers’ principal witness on the matter was Mr Snape. When he gave his evidence Mr Snape was the Vice-President of Operations for Occidental’s Latin American businesses and in fact was employed by OIEPC. He was aged 55. He had degrees in Science, Mathematics, Physics, and Chemistry from Leeds University and in Petroleum Engineering from Imperial College. He was born in England but held American citizenship. In 1981 he took over as General Manager of OPCAL and became responsible for their entire North Sea operations. From then on until about the time of the accident he was in charge of the company although his official designation changed from time to time. From about 1987 he was President of OPCAL and his office was in London. He had overall responsibility for the day to day running of the company and that would include safety. He took specific responsibility for safety in 1983 when the Board of Directors confirmed this particular responsibility. In safety matters the line of responsibility descended from Mr Snape to the Vice-President of Engineering and then to the Loss Prevention Department. Mr Snape was the most senior officer of OPCAL to give evidence and his situation assumes special relevance in relation to the provisions about wilful misconduct in the exemptions in the Indemnities for the Pursuers argued that only a decision by Mr Snape could be the wilful misconduct of the company in respect of the indemnities. Thus it was maintained that since he was effectively in charge of OPCAL Mr Snape’s decisions and his alone could represent the intentional will of the company. The Board of Directors (so it was argued) had a greater responsibility to represent the company than Mr Snape but it was said that they had delegated the responsibility to him. I do not think that Mr Snape alone had the obligation to answer for the acts of the Company as shall I think be obvious from the cases I shall review elsewhere in this opinion.

A Permit to Work system is a formal set of procedures designed to ensure that any work carried out on the platform is done in a safe and regular way. Because one is dealing with a dynamic and ever-changing environment the control of work activities is essential for the safety of personnel and equipment. Essentially it is a communications system designed to ensure that those in control of work have the information to supervise it and that those performing the work have a clear awareness of how the work is to be performed particularly in respect of safety. Those in charge must have a clear idea of what is happening on the platform so that a decision can be made as to whether or not the work can be done safely in the particular circumstances pertaining. For safety reasons the individual pieces of work performed on the platform require to be correlated with care. A permit to work system is required in certain situations by the 1976 regulations and it is also a standard of United Kingdom Petroleum practice. Not only can permits to work be a statutory requirement but Cancellation Certificates are in the same position.

4.2.2 OPCAL’s System

When the person who wants to do the work has specified what he wants to do he takes his application for a permit to a senior manager who decides if the work should be done and if it is his view that it should he issues the general approval. In the second stage of the procedure the permit application is taken to an operations manager so that he can check if the work can begin, that the preparation for the work has been done properly, that it is convenient at the time to do the work, that it will not interfere unduly with the production operations or conflict with other work going on so as to create an unnecessary hazard and to lay down any specific safety precautions that need to be taken. It is obviously important that the equipment to be worked upon has been rendered safe before work commences. When the person in immediate control of production is satisfied that the work can proceed conveniently and safely the completed permit is given to the person who is to perform the work. The work is then performed and it is the obligation of the performing authority to carry it out as described and in the manner specified in the Permit to Work. When the work is completed the performing authority tidies up the site and if necessary renders it safe. Then the operations management are supposed to check the work, the safety of the site, and decide if the equipment can be returned to operations. Inspection of course becomes particularly important at the end of the work because it is at that stage that in many cases equipment will be returned to production. Routine or uninterrupted processes did not require a permit but any work out of ordinary routine did. A Hot Work Permit covered any work which carried the possibility of creating a source of ignition which could ignite the flammable products on the platform. This would include work on electrical systems and work involving the use of intrinsically unsafe electrical equipment. A Cold Work Permit covered work that did not involve that particular risk. Hot Work had a pink permit whereas Cold Work had a blue permit and this was a practical way of differentiating them although of course their contents differed. Hot Work is defined "as any work which produces sufficient energy to ignite a flammable cloud, eg welding, burning, flame cutting, heat treatment, soldering, grinding etc." There were permits for access to vessels (which have no bearing on this case) and an electrical permit system which ensures that electrical equipment was properly isolated before work was done on it. The permit for the removal and calibration of PSV 504 would have been a Cold Work Permit and the permit for the projected planned maintenance of Condensate Injection Pump A would have been a Hot Work Permit. This distinction assumes some importance because when Mr Bollands speaks about seeing a permit in the Control Room shortly before the accident he refers to a pink permit.

In the circumstances we are considering the approval authority would be the Operations Superintendent. However when the task concerns more than one group senior personnel in each group are involved in the formulation of the permit.

Number 14/1 of process shows a copy of a Permit to Work. There are two sections in each permit, an application for the permit section and a work permit section. The former section contains information on the work scope, the location of the work, any mechanical or electrical isolation requirements, the name and signature of the person requesting the work (the Requesting Authority), the name (or names) of the person (or persons) who will be in charge of performing the work (the Performing Authority), and the name and signature of the Senior Manager who has approved the work scope concept (the Approval Authority). At the top of the of the application section are boxes indicating whether the work is for planned maintenance, inspection, breakdown or other and the person completing the application is expected to mark the appropriate box. Then there is a section for describing the work to be done and the equipment to be used for it. Opposite this is a box for the expected starting time and date. The tag number of the equipment to be worked on and the location of the equipment are also to be filled in. The title of the person requesting the permit has to be described and he signs the application. In the case of maintenance work the requesting authority would normally be the Maintenance Superintendent. There are provisions for detailing the electrical or mechanical isolation requirements and these can be specified by either the performing authority or the approval authority or failing these the authority who actually grants and issues the permit (the Designated Authority). Generally the Designated Authority would be the Lead Production Operator in the Control Room. As the person directly in charge of production he should be best placed to know what was happening on the platform and to decide when and with what restrictions work could be performed safely. Indeed he had the responsibility for making all the checks necessary for the issue of the permit before he allows work to begin. To illustrate the matter of isolations in the case of PSV maintenance it would be provided that a blind flange had to be fitted to the open pipework. The performing authority has to be specified on the application and should that authority change there is provision for effecting such change. In the case of the PSV work which interests us the performing authority would be the Score foreman. If a large number of people were to be involved in the work the performing Authority would normally be the supervisor of such persons. Thus the Lead Maintenance Technician would be the performing authority for the planned maintenance of the condensate injection pump since this would be a multi-trade operation. If condensate injection pump B had seriously broken down and not merely suffered a malfunction and tripped then the Maintenance Superintendent would be asked to request the permit. On the other hand in general a decision to switch production to pump A would be an operating problem and would not require a permit. The unloading of the reciprocating compressors is in the same situation. However because pump A had been isolated prior to planned maintenance the permit situation would be material to taking it back into production. Restoring it to functioning was not merely a routine operating procedure. Since the pump had been mechanically isolated in that it had been de-pressurised and it had also been electrically isolated to bring the pump back into production (I shall deal with that matter in detail later) Mr Vernon would have had to contact the Maintenance Department to ascertain the status of the pump and then if the response he got was positive to arrange for any existing permit affecting the situation to be signed-off. The electrical equipment would have had to be de-isolated before the permit could be signed off.

In the permit there is a section for what is described as the "Safety Audit Requirements and Precautions". There is further provision for the detailing of "Safety Check and Isolation Details" also "Protective Equipment Required" and "Electrical Isolation Certificates". In fact a check list is provided. Before issue a declaration on the permit must be signed by the designated authority and there is a space for this. The performing authority on receipt of the issued permit signs a declaration that he will only carry out the work permitted by the permit.

In the normal situation when the work has been completed the equipment is given back to production. This would involve the performing authority signing the clearance certificate on the form. In that event the Designated authority having checked the work and the safety of the worksite would cancel the permit in the section provided for this.

Under this scheme of things when on the day of the accident Score required a permit to carry out their maintenance operation it would have been Mr White the Deputy Maintenance Superintendent who would have acted as requesting authority and requested the permit. The permit application would then be taken to the Approval Authority, the Operations Superintendent, for approval and even if the latter was inclined to grant approval it would be open to him to specify safety requirements. The requesting authority would have the task of seeing that the application was in correct form before presenting it to the Approval Authority. However it was often the performing authority who would actually complete the permit application to be considered by the requesting authority presumably because they were best familiar with the work to be carried out. Thus when Mr Rankin required a permit the application was already made out and awaiting his attention in the Score cabin. Score employees had been waiting some time for PSV 504 to become available and the Score employees who had been on the platform servicing valves in the period before Mr Rankin came on to the platform had filled in the permit application in readiness for the availability of the PSV. Number 12/233 of process is the permit that was issued for the work on PSV 504. Most equipment on the platform had two PSVs. On the other hand the condensate injection pumps had only one PSV each which meant the PSV could only be maintained when the relevant pump was not in use.

The completed permit has an entry showing the time when the permit was issued and indicating the time over which it would be valid. The general practice was to issue the permit just before the work was carried out because the designated authority required to be aware of the state of the platform when the work was to be done. Mr Henderson considered that in general the permit would be issued at most twenty minutes before the work was to be done. When a permit is issued before work commences the designate authority has his own copy and a copy should be passed to the Control Room Operator for display in the Control Room. Mr Lynch thought that if two or more permits were interrelated they would be folded together for retention. There is a copy of the permit retained at the job site and the Approval authority should also have a copy which stays with him in his office. At the end of a shift (there were two twelve hour shifts on the platform namely from 6 am to 6 pm and then from 6 pm to 6 am) the permit had to be cancelled, or signed off (or suspended or re-validated if work was to continue). Normally the Lead Operator coming on duty would determine what course was taken. When a performing authority brings his copy of the permit to the Control Room at the end of a shift the carbonated copies of the permit are put together and the Lead Production Operator signs them as required. Permits would generally only be valid until the end of a 12 hour shift without further intervention. For practical reasons some permits were not issued over the period of the normal shifts but from 12 noon to midnight in which case of course the permit would not be reconsidered until the expiry of its valid time. In the case of the PSV calibration if the valve technicians brought the permit to the Control Room at the end of their day shift but were not proposing to do further work on the valve during the night shift the procedure was to suspend the permit over the night shift so that it could be re-validated at the beginning of the day shift when further work would be done. Although changes to the status of a permit were normally made at the end of a shift this could happen at other points in the day. If work was going on during the next shift - say by way of overtime work - the permit may be revalidated for a specified length of time to allow the overtime to proceed. When a permit is suspended the only requirement is for the designated authority to retain the permit and it need not be displayed in the Control Room. Indeed it seems that at some stage in each shift (said to be about 9.30 or 10 o’clock) the suspended permits were removed to the Safety Office for retention there. The purpose of the display of permits in the Control Room appears to be to indicate to the Lead Hand what work was actually going on the platform during the shift. Cancellations, revalidation, suspensions etc. were all noted on the permit and signed. A completed permit is handed to the Safety Department for filing. Once a permit which is suspended has been revalidated it would require to be displayed again in the Control Room. A provision in the safety regulations that could have a particular bearing on these cases is that the designated authority is supposed to be satisfied with the worksite conditions before he suspends a permit. It would appear that whether or not in practice the Lead Hand would actually go in person to inspect the site would depend on the significance of the work being done. Thus the witness Henderson said that if there was breach of the hydrocarbon system he would probably go personally to look at the site - that is when he was a Lead Production Operator.

The Regulations provide that a designated authority should retain suspended permits and the defenders argued that to remove permits to the Safety Office was not properly retention of the permits. However I think that would be too narrow a view of the Regulations. The Regulations are in my view concerned about the retention of the permits under the control of the designated authority rather than that they should be left in the hands of the performing authority who might then carry out work on them without appropriate permission. I doubt whether it was intended to regulate the location where permits were actually retained. The designated authority had an opportunity for easy access to the permits until they were collected about 9.30 am or pm. If he had felt it necessary to study them he could have done so then. One reason for the collection time about 10 o’clock was that until that time permits were being returned after the completion of overtime. Thereafter they remained under his control since there was nothing to suggest that he could not have retrieved any permit that was needed and of course he required to have them in the Control Room when arrangements were being made for the next shift. There is no very conclusive evidence as to whether on the night of the accident the suspended permits had actually been removed from the Control Room about the time the accident occurred. In any event the evidence given by Mr Bollands is that when Vernon required access to the permit to get hold of the red tags he removed a permit from the pigeon hole where live permits were displayed. If this evidence is correct it may suggest that the red tags in question were attached to a live permit rather than to a suspended one but, as I shall discuss later, there is some doubt about the position.

It is the authorised electrical person who decides what steps and how many tags are required to electrically isolate a piece of equipment. After such isolation has been carried out the lower tag portions (that is those parts not attached to the switches) are passed to the designated authority to be attached to the task permit. To de-isolate the designated authority and the performing authority sign the portion of the tags they retain (designated "Request for De-isolation"). At the time of the accident the Score employees were off duty and thus unavailable to sign off the red tags. In such a situation seeing that the work was maintenance work the Maintenance Lead Hand would act as substitute performing authority to provide any certificates or signatures. Thus given that the condensate injection pump was electrically isolated at the time of the accident the machine could not be de-isolated without signatures from Mr Vernon and Mr Clark, the Maintenance Lead Hand on duty, on the lower portion of any applicable red tags.

It should perhaps be specifically noted that if a machine had been electrically isolated a section of the red tag was attached to the relevant switch gear. This meant that an electrician could not accidentally or otherwise reconnect the electrical supply until the red tag had been revoked.

It should perhaps be noted that if a machine was electrically isolated it was the practice for the Phase 1 operator to note this fact and the manner of isolation in his log kept in the Control Room. If the planned maintenance of an injection pump was proposed then the adjoining pipework would be spaded by Maintenance before maintenance work began. However this spading was the responsibility of Maintenance and had nothing to do with Production.

Mr Snape acknowledged that it was important for safety that the permit to work system was supervised and that it was operated properly. Given its central position in the operations I should have thought that this was obvious especially in the context of production operations that were essentially hazardous.

4.2.3 Relationship of Accident to Permit to Work System

The pursuers’ operation of the Permit to Work system is relevant to the case since the defenders aver that OPCAL knowingly and persistently disregarded the system and that if the accident did occur as the pursuers allege it was caused by this aspect of the system. This of course would have a bearing on any liability under the indemnities since the defenders contend that a persistent and knowing disregard of the system would constitute "wilful misconduct" in terms of the indemnities. The defenders aver that the pursuers’ Permit to Work system "was a formal written system which was intended to control certain types of work which were potentially dangerous. Within that system the permit was a formal written means of making sure that potentially dangerous jobs were approached and carried out with the use of appropriate safety procedures". Up to that point I doubt if there could be any objection to what is averred. Then a specific attack on the operation of the system is pleaded. The defenders say that the pursuers "failed to give operatives arriving on the Piper Alpha Platform adequate induction training in the Permit to Work procedure and shift handovers". The defenders’ averments proceed as follows; "they failed to enforce the proper operation of the said procedures by persons working on the Piper Alpha Platform. By 6 July 1988 the operating staff on the Piper Alpha Platform had no commitment to working to these written procedures, which were knowingly and flagrantly disregarded". Some specification of particular lapses in the operation of the system follows. It is averred "The procedure required that the Performing Authority take the permit to the Approving Authority in person but this was often not done in practice. The pursuers’ practice with respect to the completion of Permits to Work in about July 1988 were subject to numerous errors in completion of the various details" and some of these errors are specified. It is also averred "the precise nature of the tasks to be carried out were not always set out on the permit by the Performing Authority". Then "Section D10 of the permit form employed by the pursuers asks ‘Is there any work which may affect this work?’ This section was seldom used". Then "Contrary to the written procedure multiple jobs are undertaken on a single permit. Contrary to the written procedure the Performing Authority’s copy of the permit was frequently not displayed at the job site". (The only evidence of this was that on one occasion Mr Snape discovered that an operative was not displaying his permit but had it in his pocket). Then there are averments that instead of the Performing Authority and the Designated Authority meeting to sign-off permits the former would often leave them on the Control Room desk for the later attention of the latter. There was also an averment "Designated Authorities would regularly (but not always) sign off permits both for completion and for suspension prior to having the job site inspected. This was contrary to the pursuers’ procedure".

There were further allegations from the defenders in relation to the monitoring and auditing of the relevant safety systems. Thus it was averred "As at 6 July 1988 the operation of the PTW was not being adequately monitored or audited by management. The system was operated routinely in a casual and unsafe manner".

It must I think be emphasised that OPCAL ‘s safety system may have been far short of exemplary but I am not here to make a general value judgement in that respect. The only departures from good practice that are of interest in this Proof are such as may have led to the accident. I think the defenders well recognised this. They aver "Had the pursuers implemented their own Permit to Work system then Robert Vernon would have been aware at the material time that PSV 504 had been removed and not replaced". The defenders main case is of course that Vernon well knew that the PSV was missing but decided to ignore this. Their alternative case is that if by chance he did not know then that was because of the faulty operation of the Permit to Work and handover systems.

It should perhaps be noted that no-one is claiming that work was ever carried out with no permit to work at all. Moreover the defenders’ attack is not on the system itself but on the way it is operated. Further the defenders maintained that the general slackness concerning the operation of the permit to work system reinforces the likelihood that Mr Vernon had not followed the system properly. However it must be observed that there was no evidence that Mr Vernon habitually committed the sort of serious irregularities which the defenders seek to attribute to him on the occasion of the accident. Indeed for example there was no evidence that he or any of the Lead Production Operators habitually failed to carry out the required Site inspection. The evidence of habitual inadequacy in the permit to work system largely relates to various irregularities in filling in the detail in the forms.

I do not consider that the case based on the defenders’ averments that the induction training was ineffectual was very significant. There is no apparent relationship between any such training and the accident. No-one presented evidence that Mr Rankin or Mr Vernon or Mr Clark or indeed any of the other persons who may have been involved in the accident were not properly trained. Indeed Mr Rankin and Mr Sutton were not even employed by OPCAL. There were no averments as to the practice for induction recognised as good and practicable by the Offshore Industry nor as to how an improvement in that practice would have affected the accident. The best that the defenders can make from it is that the indifference of OPCAL to training illustrates that the departures from general safety procedures (which the defenders claim happened) were chronic and thus a mark of an intentional general indifference. It should be noted that there was some evidence about inadequacies in OPCAL’s induction arrangements from Mr Thomson, who was a rigger employed by the Wood Group. We do not really know what training such a rigger would require and to what extent any such training was in practice expected from OPCAL rather than his employers (as provided in their contracts). A Mr Elliot, a foreman rigger also gave evidence that he had received no formal training but he did concede that an Oxy representative had taken him through the system.

A witness, Mr John Wood, gave evidence about training. He was a Diving Technician employed by Messrs Stena and he indicated that he had not received training when he first came aboard Piper Alpha. However he accepted that he had been trained when he had previously worked on the Claymore platform and he indicated that it was assumed that this training was good enough. There was no evidence that this assumption was unjustified.

The last witness speaking to training was Mr Fowler, another employee of Wood Group. He was a joiner who first worked on Piper Alpha in 1980. He claimed to have received no training when he first worked on the platform. Further he accepts that he was not one of the authorities required to regulate the permit to work system but just one of a number of men who had to work under permits. He gives some indication that perhaps over the last two years of his work on Piper Alpha there was some sort of formal training system.

In relation to the Score Contract OPCAL had extensive discussions with their representatives before they began any work on the platform and during these discussions various safety matters were discussed. It is worth noting in this connection that within Score’s Container Mr Rankin had been provided with a check list of his responsibilities under the permit to work procedure.

At the end of the day it can be asked just what knowledge that might have been acquired in training and which was lacking contributed to the accident. I do not think that this was ever established.

There seems to be no doubt that on occasions the Performing Authority did not take the permit personally to the Approval Authority for signature. For example Mr Lynch said that if there was a sudden need for a permit in the middle of the night he might sign the permit ‘pp’ for the Production Superintendent and get him to accept it in the morning. Thus occasionally the designated authority would sign for the Approval Authority if the latter was off shift. Clearly there must be occasions when general practical considerations make it tempting to adjust the strict written procedures. If there is no loss of safety then it would be difficult to contend that this in itself was a departure from good and proper practice although such a judgment may depend on the individual circumstances of a situation.. Any such departure should, if tolerable at all, be exceptional and be acceptable to the management. In a dangerous environment like an offshore platform is important that the carefully evolved safety procedures should be carried out strictly. It may well be that Mr Lynch only refrained from waking up the Production Superintendent if he considered that the circumstances of the case made it perfectly reasonable and safe to do so, and that the practice in such circumstances was acceptable to the Production Superintendent involved. However I need not form a concluded view as to whether even the minor degree of irregularity Mr Lynch spoke to is tolerable in safety terms since there is no obvious connection between this limited deviation from the strict procedures and the accident. Moreover if such practice was followed widely there is no evidence that the senior management above the Production Superintendent would have known this. Two permits were produced where this problem appears to have occurred.

A number of Permits to Work were recovered after the accident and about 34 of these (all relating to a period of about two weeks before the accident) were produced in an effort by the defenders to demonstrate that the system was not properly operated. The permits I refer to were in a bundle of documents number 15/4 of process. These permits would be part of the 120 or so permits that would have been issued during the period being considered. There is no doubt that the permits produced had not all been properly completed and that their review shows that a degree of irregularity in the completion of some permits was a recurring phenomenon at least in the period just before the accident.

It has to be noted that the departures from the strict completion of permits are for the most part not such as to show a total disregard for safety on the part of the persons responsible for the permits and I can accept that in most cases they would have believed that the irregularities were minor and inconsequential. However that does not mean that if a system as important to safety as the completion of permits has been laid down personnel should depart from the system. If the permit forms were unnecessarily complicated (as Mr Snape thought that they might be) then the proper approach was to modify the permit system. Some of the irregularities that were allowed (albeit a minority) could in some circumstances have had serious consequences although this might not have been the view of the operators concerned. Senior management who spoke indicated that they would not approve of the permits being filled in irregularly in any respect and I think it must be assumed that they did not know of the fact that permits were not being completed properly. However this does not reflect well on their supervising and safety auditing arrangements. In respect of the failure to complete permits properly many of the permits produced showed that the boxes intended to indicate that the permit was for planned maintenance, inspection, breakdown or other had not been completed. All that was required was an appropriate tick. No doubt the terms of the work to be done as spelt out in the permit itself would make it fairly clear what category of work the permit referred to but the authors of the safety rules obviously thought that it might be beneficial to have an immediate reference to the category of work covered by the permits. Indeed this may have been for administrative rather than safety reasons and some of the operatives thought that this was so.

A number of permits had times of various incidents such as the date or time of signature or the expected starting date which for whatever reason were obviously inaccurate or irregular. Sometimes the time of the permit’s validity is not clear. The times ascribed to isolations did not always correspond to the times of the issue of a permit. Timings on the face of the permit did not always show a logical or acceptable chronological sequence. I suspect that many of these irregularities were due to inaccuracy in the completion of the permits rather than unsafe working practice but of course the permit is intended to ensure that this can be checked. There were five permits which did not have an estimated starting time and two of the rigging permits did not have an estimated starting date or time. Some of the isolation certificates are ambiguous. However if a person has need to know if a piece of equipment has been isolated the tags and listing attached to the permit would make this quite clear. In any event there is no suggestion that the work was ever authorised to proceed before necessary isolations had been effected. In fact the evidence points in the other direction. Thus there were four permits where ex facie there may have been irregularity about the completion of gas tests but the evidence was clearly to the effect that the work would not have been allowed to proceed until such tests had been carried out. There may have been some confusion as to just at what point the gas tester should sign his certificate. Moreover sometimes permits appear to have been cancelled before the de-isolations. Nevertheless the work would not be returned to Operations until the de-isolations had been signed off. As Mr Sneddon said there is no danger in a delayed de-isolation. Other permits, and this is perhaps the most serious departure, did not have certificates (such as statements as to the safety of the work) adjusted to make it clear ex facie just what the certificate was saying. Thus for example in terms of the certificate it would not be possible to tell if the work had been left in a safe or unsafe condition. Of course the safety implications of this can be exaggerated since the Operators might well have known in what circumstance a designated authority would append a signature to such a certificate. This matter of incomplete certificates was certainly very general and few of the permits produced had their certificates accurately completed. There was evidence that the Designated Authorities did not in fact cancel certificates until the work was safe. In one permit there was reference to work on 5 separate PSVs and strictly there should have been 5 separate permits taken out. However as Mr Sneddon and Mr Henderson both say it was in fact only one job since the valves related to the same machine so that there may well have been a serious question as to the proper practice. An omission relating to an isolation requirement could arise because the person raising the permit might not have been certain that isolations were required. The safety requirements can be filled in later by the Designated Authority. The main function of the Approval Authority is to approve the workscope and detailed safety requirements can often be better considered by the Designation Authority. In some cases a number of persons were nominated as Performing Authority and we were told that this would be likely to refer to protracted work such a planned maintenance when a number of different operatives might be expected to be involved in the work. Nevertheless this practice could result in a lack of clarity. Sometimes if there had been a transfer of authority the appropriate box had not been completed. With other permits the time of an extension had not been completed properly. In other cases cancellations or suspensions had not been properly dealt with in the formal sense. In one permit there was a reference to there being other work which could affect the work being done under the permit without that other work being specified although again it was claimed in the evidence that the nature of the work would be known. In fact the work in question was major work in the Gas Conservation Module which would have been known about throughout the platform. Most of the permits scrutinised had at least one irregularity. In general the Operators appear to have paid attention to the main features of the permit system and to have carried out the main safety requirements of the system but nevertheless to have been slack about certain elements of the detail. A number (but not all) of the irregularities could be due to clerical error. However there seems to be little doubt that the more formal parts of the system were regularly ignored basically as a corner cutting exercise rather than a conscious disregard of safety. As far as concerns those actually completing permits I doubt if there was any intended departure from safety standards. It clearly was assumed, probably wrongly, that the omissions in the permits were not such as could affect safety (at least in the majority of these cases). On the other hand as far as management are concerned the omission to control the operation of permits is more serious since it is their responsibility to see that there own procedures are implemented. Moreover they had Lead Production personnel who as designated authorities and line managers should have been controlling the completion of permits and their certificates in the first instance. There were more senior production personnel who should have been in a position to supervise the Lead Production personnel’s control of the system. In fact they did not seem to have any structured system for monitoring the detailed operation of the permit system. OPCAL also had Safety Officers on the platform and it might have been expected that they would have noted any recurrent irregularities in the system. Mr Snape certainly expected that the Safety Department would have been monitoring the permits but it rather looks as if his confidence was misplaced.

Mr Todd the Maintenance Superintendent gave evidence and he accepted that it was part of his function to ensure that the men in the Maintenance Department operated the Permit system properly. Indeed the duties of line management in this regard are set out in 13/60 of process which was issued by OPCAL to all employees and which was entitled "A Statement of Policy on Health and Safety at Work with related implementation responsibilities and the System for Monitoring and Control". A number of the permits produced which had irregularities were concerned with the Maintenance Department. Yet he does not recall ever having been instructed by management to carry out spot checks. It can be implied from the terms of his evidence that he himself did not take the initiative and carry out spot checks.

It perhaps ought to be noted that Mr Vernon and Mr Lynch both appear as Designated Authorities in some of the defective permits. It also has to be noted that what were produced are about 34 permits when in the course of a year three to five thousand might be issued. However most of the permits relate to a short period of some two to three weeks before the accident. During that period there was intensive work going on in relation to the switch from Phase 2 to Phase 1.

I think the reality is that the permit to work forms could have been improved and simplified without any sacrifice of safety. Mr Snape recognised as much. Nevertheless the fact remains that it was not for operatives to devise their own practice in respect of how they operated the system. Mr Snape acknowledged this. Moreover he accepted that certain irregularities such as not making it clear if a permit had been cancelled or suspended were so serious that they could not be condoned. However in most cases the men were no doubt paying regard to safety in the practical sense but not completing the permits properly. I think it would be impossible to conclude from the relatively small number of permits that were produced that it was common to find a production operative knowingly carrying out an operation in a dangerous manner. Nevertheless it is apparent that at least during the period just before the accident the production operators were not paying sufficient attention to detail when they completed permits and certificates. It also has to be emphasised that the platform work was carried out in a difficult environment, with much noise, vibration, awkward protective clothing and exposure to the elements so that a temptation to take shortcuts in regard to any seemingly formal requirements had to be allowed for. On the other hand perhaps this made careful monitoring all the more essential.

4.3.1 General

When a shift was reaching its conclusion it was necessary that the incoming employees on the new shift should be made aware of anything going on the platform that might concern them. Thus there was a system whereunder certain employees had a handover procedure with those coming on duty. Thus in particular the Lead Production Operator going off duty would have a handover with his equivalent coming on duty. This of course has special significance in this case in relation to the handover that occurred between Mr Vernon when he came on duty on the evening of the accident and Mr Flook the Lead Operator who was on duty before him. Clearly the information which Mr Vernon received or ought to have received could have a bearing on Mr Vernon’s knowledge of the status of the PSV 504 at the time of the accident and this bears upon what he might have been doing later. Mr Snape had no hesitation in stating during his evidence that "Obviously it was important for information to be passed from an outgoing worker through to an incoming one on the job that was to be done and how it was to be done". There is of course some interconnection between the Permit to Work system and the handover system given that both systems are designed to ensure the passing of relevant knowledge.

The defenders made the point that in respect of the handover to Mr Vernon he was not only coming on to a new shift but indeed was commencing a new tour of duty so that he should have been particularly concerned to acquaint himself with what was happening on the platform. On the other hand that may be a double edged point because it could mean he had more than the usual amount of handover material to assimilate and he may not have had much attention to spare for what could seem to him a minor matter - that is the state of a pump that had been depressurised and handed over to maintenance.

4.3.2 The System in Operation for Production

The outgoing operator would have the currently live permits sorted out on his desk according to the various disciplines and these would be left to await the performing authorities coming to the Control Room to have them regulated. The day shift handovers between Lead Production Operators generally took place in the Control Room between about 5 pm and 5 .30 pm. The performing authorities generally came to the Control Room nearer to 6 pm since their shift did not finish for practical purposes until about 5.30 pm. There were no written guidelines issued by OPCAL in relation to procedures for handovers. The Phase I, Phase II, and Control Room Operators all kept logs and the witness Mr Henderson explained that if he had been an outgoing Lead Production Operator he would have looked at these prior to the handover to see precisely the work which had been going on. The Control Room Operator’s log was in effect the Lead Production Operator’s main log because everything that occurred in the Control Room was entered in it and indeed the Lead Operator could instruct the Control Room Operator to make particular entries. However the Control Room Operator would be logging material relevant to the production processes and would not be expected to log maintenance matters. Mr Henderson also had the practice of taking a general walk-about before the handover to see how matters stood. Mr Lynch on the other hand although he also had a walk-about did not do this until the beginning of the new shift although it is perhaps not clear whether he did this before or after he had dealt with the incoming permits. His walk-about normally took about 20 minutes. Having taken the live permits from the pigeon holes where they were kept displayed Mr Henderson would look at them. He found that a handover would normally take about 20 minutes although Mr Grieve thought that a handover could take up to 30 minutes if there was any problem. I accept these figures as approximately accurate. Most witnesses thought that it was the incoming Lead Production Operator who suspended permits. Mr Lynch initially took a different view but eventually agreed that he was not sure. Indeed in general Mr Lynch was not as clear in his recollections as some of the other production witnesses. I think it is likely that the normal practice was that it was for the incoming Lead Production Operator to suspend the permits because normally it would be late in the preceding shift when the performing authority appeared. The outgoing Lead Operator was usually free to finish his shift about twenty minutes to six. However it has to be emphasised that on occasions permits were signed off or suspended in the middle of a shift when the progress of the work rendered this convenient. The outgoing Lead Production Operator would keep a note pad on which he would note anything significant arising from his walkabout, or reading of logs and permits. There would generally be a timed series of events recording the activities on the platform during the shift relevant to production. The log if kept properly should conclude with a note of the status of equipment which had been worked on. However it is not clear that this would specify that a PSV had been removed if the pump equipment was out of commission for a planned maintenance. He would explain anything significant directly to the incoming Lead Operator. The handover would not cover every event of the day but what was considered to be significant. Not only the lead operators but the ordinary operators would handover to each other detailing what was a material note in respect of the preceding shift. In this respect they would pay regard to the logs they kept. It seems clear that during what may generally be described as the handover hour between 5 and 6 pm there would not be much time for the outgoing Lead Operator (or for that matter the incoming Lead Operator) to go out onto the platform to inspect individual jobs. The impression left by the evidence was that in practice the obligation for a Lead Operator to inspect the site was not always scrupulously adhered to but rather the Lead Production Operators would exercise their judgment as to when and how to make such inspections. On occasions they would rely on an Operator’s report as to the condition of a site. However if a Lead Production Operator did require to go out onto the platform to inspect particular work he could be radioed to return to the Control Room if he was required urgently to attend to a permit. However he would generally be in the Control Room at the time of his handover to attend to the considerable duties he had at that time. Indeed the busiest time in the Control Room was towards the end of the day shift. A great deal of the work on the platform was performed during the day shift and at the end of the shift those performing the work would resort to the Control Room to have their Permits to Work attended to. When a new Control Room Operator came on duty it was his duty to look at the permits to work so that he was aware of what was going on, on the platform.

One difficulty with the handover system is that the information imparted to the incoming employee depends to a degree on the judgment of the person making the handover. Thus for example when the outgoing Phase I Operator handed over to Mr Richard on the day of the accident he may have specifically mentioned that the PSV 504 was missing. On the other hand he may have thought it sufficient to mention that the condensate injection pump A was not available because it had been handed over to the Maintenance Department for a planned maintenance. Moreover it is even possible that he did not know that the PSV work had not been completed since the expectation was that it would be completed in one day. Certainly in a general sense the production operators did not require to know the details of maintenance work except insofar as it could affect the production processes.

Once the handover had been completed the incoming Lead Operator became the designated authority and in immediate charge of production.

4.3.3 Maintenance Handovers

The procedure for handovers between Superintendents in the Maintenance Department was described by Mr Todd who no doubt gave accurate evidence on this matter. He was a Maintenance Superintendent at the time of the accident and on the day of the accident it was he who had handed over to the late Mr White who had come onto the platform and taken over from him on the evening of the accident. The normal procedure was to do a written handover and this would contain a note of the on-going work. Again the written material was set out on a note pad and this would normally contain a list of outstanding work, the plans for the next few days, and any problem areas as well as safety and personnel related items. Any points requiring clarification would be discussed and if the incoming operator thought he should see any piece of equipment he would go and inspect it. The note pad was left with the incoming person. The handover took place in the Maintenance Office and would take place at the end of a spell of duty since only one Maintenance Superintendent was on the platform at one time. The Maintenance Superintendent who was on duty would each day in the morning attend the handover between the night shift and day shift lead maintenance technician. The problems during the night shift were discussed as was the plan of work for the day. There was also a meeting in the Maintenance Office at the handover between the day shift and the night shift but Mr Todd would not attend the whole of that because he had to attend the Offshore Installation Manager’s (OIM’s) meeting which took place about the same time. However he did normally manage to attend part of the evening handover meeting. Mr Todd’s hours of work were from 6am to 6pm but he often worked as late as 11pm or midnight. If the Maintenance Superintendent wanted a major piece of equipment for maintenance purposes there would be a discussion between him and the Operation’s Superintendent and also the OIM as to when it could be made available.

Mr Clark, the Maintenance Lead Hand on the night of the accident, also gave evidence about Maintenance handovers. He confirmed that there would always be a meeting with the off-going and the in-coming person at the end of each shift. This is the meeting referred to by Mr Todd and takes place in the Maintenance Control Room. The in-coming person would appear for the purpose of this meeting about 5pm or am as the case might be and then the handover meeting would take place about 5.30. On the night of the accident Mr Clark had taken over from Mr William Smith. It was maintained by counsel for the pursuers on the basis of Mr Clark’s evidence that the incoming Lead Maintenance Technician would not know any work that had been carried out during the day by independent contractors such as Valve Contractors. However it is obvious that any such work that might affect Maintenance ought to have been communicated to him at the handover. Specialist contractors reported to the Maintenance Superintendent and the Maintenance Controller. This was because the Maintenance Lead Technician would have no responsibility for supervising such work. However I think it could be expected that a reasonably careful Maintenance Supervisor would ensure that any information coming to him that would affect Maintenance, particularly in regard to safety, would be passed down the line to those who might require to know about it. On the other hand Maintenance does not itself have responsibility for the actual conduct of independent contractors’ work since it has no participation in the Permit procedures. His function is primarily that of contract control and he reports the state of matters to the beach. However Mr Clark himself refers to the fact that in addition to the continuing notes kept by the Lead Maintenance Technicians (and a diary which was also kept) he sometimes got notes from the Maintenance Superintendent. Thus the Maintenance Superintendent had the means of passing down significant information and at least occasionally did so.

In the case of the work done on PSV 504 which had been removed and not replaced on the evening of the accident, Mr Rankine, the witness who was an employee of Score and in immediate charge of the operation, indicated that he had not in fact passed the status of the valve at the end of the shift to Mr White the acting Maintenance Superintendent but had passed on the information to Mr Smith the day Lead Maintenance Technician. This was done, he said, in the accommodation recreation hall about 6.30pm which would be after any shift handover had been completed and at a time when Mr Smith would be off duty. Mr White for his part although he would have seen the permit to work application earlier in the day would not know if it had been approved or issued. Mr Clark claimed that he did not know that the PSV was off the pipe system although he was challenged on this in cross-examination. However Mr Clark was asked just before the accident to sign off tags so that electricity could be restored to the condensate injection pump and if it is true that he did not know about the valve maintenance work he must certainly have assumed that the electrical isolation was connected with the planned maintenance.

Mr Clark stated that he would at handover discuss with his back-to-back the work which was intended for the week and any problems this might entail. They might also discuss imminent work and priorities. A worklist was kept on a note-pad which was updated on a daily basis. The individual jobs would be highlighted on this as work progressed. The jobs to be completed would be taken from a Maintenance Department’s Print-out. This handover would also take 15 to 30 minutes.

The maintenance technicians who were acting as a performance authority would have to get their permits to work treated by the Lead Production Operators in the Control Room in the same way as would Production Operators.

4.3.4 The Sutherland Case

0n 7 September 1987 a Mr F Sutherland, who was at the time employed on Piper Alpha as a rigger, was killed in an accident while working in Module A. Because of this fatality the pursuers were prosecuted under section 3(1) and section 33 (1)(a) of the Health and Safety at Work Act 1974. As the defenders aver the Complaint to which the pursuers pled guilty on 17 March 1988 referred to failures in the Permit-to-Work system and to inadequate communication of information at handovers. The defenders claim that the Operators of the platform failed to improve their systems in respect of the matters raised by the criminal proceedings and that in any event failed to enforce any changes made. It is said by the defenders that the pursuers said failures were equivalent to wilful misconduct in terms of the indemnity contracts so the precise details of the Sutherland accident and prosecution assume some importance. The essence of the defenders’ position is that the platform’s Operators deliberately failed to take the measures which the Sutherland enquiry showed to be necessary. One sequel to the fatality was the issue by Mr J L McAllan, Occidental’s Production and Pipeline manager to all OIMs on 24 September 1987 in which he emphasised that persons filling out permits to work should be encouraged to be more specific in detailing the job description. The defenders’ case is that this advice was simply disregarded and no effective steps were taken by senior management to ensure its implementation. Mr McAllan worked on the beach and had a general responsibility for production on all the platforms. (The organisational structure of OPCAL is set out in the Organisational Chart which is number 13/62 of process). Another suggested failing on the part of the Operators was that following the Sutherland tragedy they issued instructions to rigging supervisors referring to the assessment of the job by rigging foremen and the raising of permits for certain categories of lift. The pursuers’ response is that the consequential measures adopted by the Operators was appropriate and sufficient.

In any survey of responsibility for the consequences of the Sutherland fatality some account must be taken of OPCAL’s management structure. At the top of the tree was the President and General Manager who until very shortly before the accident in July 1988 was Mr Snape. Immediately below were a series of vice-presidents. At the relevant time the Vice-President of operations was a Mr McReynolds and Mr McAllan reported to him. The Vice-President of Engineering was a Mr Grogan and below him there was a Mr Gordon who was the Loss Prevention Manager. Further below in the engineering structure was the Safety Superintendent, Mr Boden. He divided his time between the beach and the platform. Thus Safety was kept separate from Operations and in effect Engineering was divided into Facilities Engineering, Petroleum Engineering and Safety. The Safety Engineer onshore was a Mr Latham. The managerial hierarchy could be significant since questions arose in the case about the level of responsibility which could attract the application of the provisions about wilful misconduct in the Indemnities.

In my view it was clearly made out that Mr Sutherland was killed because he stood on a platform that was not safe for that purpose. He was a rigger and his accident took place on 7 September 1987. After the accident OPCAL carried out their own enquiry and a Mr Jenkins of the Health and Safety Inspectorate also investigated the matter. He gave evidence and his report was produced. It is plain that the accident to Mr Sutherland happened because the platform he was working on was not bolted and moreover was corroded. The task being performed by Mr Sutherland had been lifting a heavy motor and the men involved in this had among themselves changed the method by which the motor was to be lifted thus exposing the deceased to the danger which caused his death.

Above the motor being lifted there was a canopy to prevent fluids dripping onto it. This canopy consisted of a number of panels. To obtain access to the motor it was necessary to remove a hatch and also to remove panels from the canopy. About 7.30am on the day of Mr Sutherland’s accident it was noted that the bearing on the motor was overheating and thereafter the pump, having been closed down and isolated, was handed over to the Maintenance Department for remedial work. Mr Thomson, OPCAL’s Lead Maintenance Technician, assigned the work to Mr Edwards a Maintenance Engineer but did not at the time visit the site himself. It was ultimately decided that the motor would require to be lifted and Mr Thomson obtained the assistance of riggers for this purpose. The riggers devised a method for hoisting out the motor. About 17.30 hours it became necessary for the day shift workers to hand over the said task to the night shift. Mr Thomson handed over to Mr Taylor the night shift Lead Maintenance Technician. The deceased was, a rigger, one of the crew of men who were working on the motor lift on night shift. As the night shift crew proceeded with their work Mr Brewer, a Maintenance Technician, who was one of the team decided that he was not happy with the method that was being used to lift the motor because he had previously had a bad experience with that method. The proposed change of method was not discussed with Mr Taylor. Thus the men on the site themselves decided to change the method that had been laid down by the day shift. The method they proposed to employ was contrary to standing instructions other than for vertical lifts. Taylor had in fact visited the site prior to the commencement of the night shift work but had not noticed that the bolts on the canopy were not in place. As a result of the change in lifting method Mr Sutherland went on to the canopy to attach clamps to eye beams and this brought about his accident when the canopy collapsed. As a result of this collapse he fell some distance to the deck below and suffered injuries from which he died. The change in the method of work had occurred because of failure of communication and supervision following upon a handover. The Lead Maintenance Technicians had effected their handover in one location whereas the men in the crew had carried out the handover in another place and without proper supervision. However on the evidence before me it was not clear how all those involved could carry out their handover in the one place so that at the root of the accident was a failure of the Lead Maintenance Technician to keep abreast of what was happening. Moreover he had not checked the site and thus not noticed an obvious danger.

The responsibility for OPCAL’s internal enquiry into the death of Mr Sutherland was left to Mr Grogan but he kept Mr Snape informed. Three investigators were appointed and one of these was a solicitor. I have certainly no evidence from which I could conclude other than that the investigators were competent to carry out the task entrusted to them. The initial report to Mr Snape was verbal because before the investigators issued their final written report they required to instruct certain technical investigations to be carried out by Robert Gordon’s Institute of Technology. Indeed because of this it took two months before the written report was available. When he discovered the results of the internal enquiry Mr Snape had a series of discussions with his senior managers with a view to deciding what could be done to avoid a similar accident in the future. I had no reason to distrust the evidence of Mr Snape that he personally was anxious to take such measures as were necessary to eliminate the kind of situation which had caused the accident. Mr Snape read the results of the Report as showing that the accident happened because of a failure in supervision and that OPCAL had platforms that were from time to time used as workplaces which were not designed for that use and therefore were not safe when used in that way. In fact it emerged that the said canopy had been used as a working platform over a period of about ten years. Accordingly a survey was instructed to ensure that there were no similar cases. Moreover an audit of supervision was instructed. The management requested that there should be more detail of the proper working method in permits to work and recommended tighter communications between the worker and his supervisor. The improvement of rigging procedures was also identified as an area for action. Consideration was to be given to the adequacy of the handover procedures to prevent such accidents. In an oblique way the accident also pointed to a failure in the operation of the permits to work in that the change to the working methods should have been added to the permit. However the Report saw the accident as really highlighting a supervision problem and the investigators did not recommend any change to the permit to work system. Mr Snape accepted that there were failures by the Company in relation to the Sutherland case. There had been a failure to supervise the work, to check the worksite, and also a failure in the job specification on the permit to work.

In answer to the defenders’ suggestion that the Operators had failed to learn and act upon the lessons of the Sutherland case the pursuers argued that the problems highlighted by that case related to the setting out and supervision of work procedures. OPCAL’s own Report concluded with relation to the cause of the accident that the incident occurred inter alia because of poor design and lack of maintenance and inspection of the canopy structure. The Report also concludes that the extension of the original work to the extent that it required the lifting of the motor did not alert the Supervisor to the additional measures that might have been taken to ensure the safe conduct of the new workscope. The Report makes recommendations for improving the system. Among other things it makes recommendations for the supervision by the Facilities Engineering Department of structural additions and alterations. Then there was a recommendation that the survey, that I have already referred to, be initiated. There was a recommendation that supervisors should be reminded of there responsibility to inspect sites before the commencement of work with particular emphasis on the access to and egress from areas involving work at height and also to remind their work force as to the specific requirements of each job and to the need for approval of any changes to these. There were also recommendations in respect of the rigging procedures. Although permits to work were not mentioned specifically the Company accepted that there was a need to improve the specification in these of working methods. The said Report made no recommendations in respect of the handover procedures. The issues arising from the Report bore no relationship to the problems in the present cases which relate to the transmission of information about the status of plant from one shift to the other. If there were deficiencies in the permit to work in the Sutherland case they were that the permit did not specify that riggers would be required. The pursuers also deny that the Operators’ response to the Sutherland case displays a cavalier approach to safety. It certainly seems to me that even if the handover had been perfect Mr Taylor would not have known that Mr Thomson’s working method was going to be changed without reference to him. Of course it could be said that if he had inspected and supervised the job the events leading to the accident could have been avoided. Even if OPCAL’s perception as to the problems that caused Mr Sutherland’s accident and the procedures needed to avoid a similar accident were wrong I could not conclude that their views were untenable and not genuinely held.

In setting out the steps that OPCAL took to respond to the problems thrown up by the Sutherland situation the pursuers relied on a number of reports and Minutes of meetings. However the defenders made the point that certain of these documents had not been spoken to as to their nature and that therefore I was precluded from looking at these. Indeed the defenders point out, and level it as a criticism, that nobody from the safety side of the defenders’ organisation was called as a witness. Not only could such witnesses have been examined as to OPCAL’s safety arrangements and their responses to problems but there were such witnesses who could have spoken to the unvouched documents. I think that technically the defenders are right in respect of their objection to documents unspoken to by any witness. Such a document is merely a piece of paper until its identity is established. As it happens I do not think that the point is very significant. Mr Snape spoke about his own knowledge of the Operators’ general approach to the safety situation and as far as his evidence went I think that it was reliable without being confirmed by documentation.

However the pursuers relied on the documents in question to establish the Operators’ concern and good faith in improving safety and in case I am wrong in rejecting the unvouched documents I set out the relevant import of the documents in question. In a memorandum to the OIMs on Piper and Claymore dated 24 September 1987 Mr McAllan made certain suggestions for the improvement of procedures (number 12/407 of process). In this in addition to other measures proposed the author recommended that the permits to work should give more detail about the job description. Moreover it was suggested that the designated authority should satisfy himself that all aspects of the job had been covered by asking questions at the time of the issue of the permit to work. It was claimed that there is no evidence in the terms of this memorandum of an indifference to security. In fact the memorandum purportedly had been sent before the formal Report of the investigators was available. The aim was to effect an immediate improvement. Moreover Mr McAllan’s memorandum had been sent after discussion with senior personnel.

A further memorandum was said to have been sent on 12 October 1987 by the Safety Supervisor to all departmental supervisors (number 12/410 of process). This followed upon a supervisors’ safety meeting on 4 October. This was designed to formalise procedures for identifying dangers such as the said canopy. The significance of this again is said to be that it shows that the Operators were not simply ignoring the lessons to be drawn from the accident. A further memorandum was said to have been sent on 21 October 1987 by the OIM on Piper to rigging personnel with a view to tightening up rigging procedures. This also provided that permits to work should be raised for certain categories of rigging work. If this instruction had been in place at the time of the Sutherland accident it would not have been possible to change the lifting work method without reference to a supervisor. Thus it was claimed that in changing the rigging procedures OPCAL were clearly addressing themselves to at least some of the implications of the accident. These steps were taken before the issue of the formal Report and indeed Mr Snape said that the Report told him nothing that he had not already discovered. Number 12/412 of process are said to be Minutes of a Supervisors Safety Meeting on Piper on 1 November 1987. This indicates that the meeting was chaired by the Piper OIM. Copies of these would go to Mr McAllan and Mr Boden but Mr Snape would not necessarily see them. These Minutes purport to show that following upon the accident improvements were needed to what was called the defects book and to rigging procedures. Number 12/417 of process are said to be Minutes of the Safety Co-ordination Committee dated 17 November 1987 which committee was a level above the Supervisors’ meetings and met monthly. There was also a Management Safety Committee which was often chaired by Mr Snape. This was the controlling safety group in OPCAL and would see the Minutes of the Safety Co-ordination Committee. The said Minutes showed that steps had been taking to inspect areas on Piper where access was not allowed and recorded that more details were by that time put on permits. These steps were said by the pursuers to have been taken in response to Mr McAllan’s earlier memorandum. Number 12/413 of process are said by the pursuers to be further Minutes of a meeting described as a Maintenance Safety Meeting and chaired by Mr Todd a Maintenance Supervisor. The date shown was 4 December 1987. Copies of this are sent to the beach. The chairman is shown to have asked all present to comment on any possible improvement to safe working practices and indicated that on no account should "chances" be taken. The fact that changes to rigging practices had been by that time put in place was discussed. Number 12/414 of process are said to be Minutes of a further meeting of the same committee on 9 January 1988. The chairman who was shown as the OIM and to have opened the meeting by indicating that it was an aim for 1988 to improve safety performance and he detailed how supervisors could help in this respect. Number 12/418 of process are the Minutes of the Management Safety Committee which met on 3 March 1988. Mr Snape attended that particular meeting. It is clear that Mr Snape raised the question of the points brought out in the Report and wanted a report prepared of actions that had been taken. In fact Mr Snape wanted to be sure that the action needed after the Sutherland accident had been carried out. Thus he had not lost sight of the fact that the report into the accident had revealed that certain action was required. The Committee met quarterly so that it next met on 21 May 1988 and number 12/419 of process are the Minutes. Reference was made to a follow up report by Mr Latham prepared following the questions raised at the meeting of 3 March. Mr Latham is said to have reported that there had been a satisfactory response by OPCAL to the recommendations in their Report although he was not happy about the steps which had been taken to inform the workforce of the situation. He detailed the steps that had been taken to bring the recommendations into effect. He raised queries about the generality of some of the instructions that had been issued. Even if Mr Latham’s report is accepted as an accurate account of the situation as seen by him it would appear that although improvements had been made since the Sutherland accident matters remained that required to be attended to.

On 1 July 1988 Mr Snape gave up his post in OPCAL and was transferred to South America. He was replaced by a Mr Schulz and of course this happened very shortly before the explosion on Piper. Before Mr Snape left OPCAL it would appear that he had remained interested to see any recommendations that had been made by his staff or by the Report put in place.

The defenders made a case that OPCAL had ignored the implications of the prosecution arising out of Mr Sutherland’s death that had been raised against them in the Spring of 1988. The terms of the Complaint are shown in number 12/406 of process. In the charge it is alleged inter alia "and you did fail to supervise said job in the following respects ( 1) there was an inadequate communication of information from the preceding day shift to the night shift during which said accident occurred" (the accident referred to was of course that involving Mr Sutherland). The information alleged to have been inadequately conveyed was not specified. The complaint went on to allege that "no new permit was taken out to cover the installation of the said lifting gear and other necessary work". That certainly seems to be true and indeed Mr Snape accepted that the proper course would have been to obtain a new permit. The complaint continues "the said deceased had been allowed to select his own method of performing the job without discussion with the Supervisor". This too seems to have been beyond dispute. Then it is said in the complaint that "suitable access to the working area had not been provided nor had safety equipment such as harness and lines and (5) said canopy had not been bolted down and was being used as a working platform". The charge then went on to allege a violation of the Health and Safety at Work Act. Mr Snape agrees that OPCAL had pled guilty to the complaint as it stood. The defenders take that fact as signifying that OPCAL had had their attention drawn to the fact that there were deficiencies in their permit-to-work system yet they allegedly took no steps to correct the position. However the plea of guilty needs to be viewed in the light of Mr Snape’s evidence. He claimed that he had pled guilty to the charge as it stood because he had been advised by his lawyer to do so. He maintained that his position was all along that he did not consider that any failure in the permit work system had caused the accident but rather a failure in supervision. He claimed that although he did not agree with certain elements in the charge (and in particular item (1)) he felt that a guilty plea should be entered because in a general sense the accident had been due to fault on part of OPCAL. As he said in evidence a man having died he thought that it would be unseemly to quibble about details of the charge. He also claimed that he did not see any problem about handover as having been a cause of the accident. I accept Mr Snape’s evidence about the matter under consideration. In the first place he seemed to me to be an honest witness. Moreover Mr Snape had the internal Report into the facts of the accident. This had been prepared by persons he considered well equipped to investigate the accident and they had not attributed any fault to the permit to work or handover system. Indeed Mr Snape indicated that following upon the accident he had discussed the question of handover with his staff and concluded that the transfer of information which is the point of a handover had effectively occurred. The change in the lifting method happened after the handover.

The defenders called in respect of this matter the witness Mr Jenkins. This witness was when he gave his evidence the Safety Manager with AOC International a company working in the petro-chemical industry. He held the degrees of BSc and MBA. From 1987 until 1991 he had worked as a Senior Inspector with the Safety Inspectorate. The evidence does not disclose what experience he had of Oil Platforms before 1987. He went to the platform on the day after the accident and he spoke to the Report and Addendum he issued thereafter namely numbers 14/43 and 14/44 of process. In this Report he confirms that in relation to the accident when the job scope had been increased a new permit should have been taken out and I do not think that anyone disputes this. Mr Jenkins reported that the tradesmen and the supervisors conducted their respective handovers at different places and that after the handovers had taken place the supervisor saw the tradesmen and allocated work to them. He observes that subsequent to the handovers Mr Taylor did not discuss the job with the men nor visit the site. I agree with Senior Counsel for the Pursuers that the facts reported by Mr Jenkins suggest a failure of supervision rather than of the handover. In his Supplementary Report Mr Jenkins observes that the handovers were badly co-ordinated in that the supervisors handed-over in one place and the Supervisors in another. However the defenders do not specify in their pleadings that a proper handover procedure would involve those concerned meeting together in the same place. Indeed I do not know if such a system would be practicable (the Lead Hands might require to see a lot of men) and witnesses were not asked about it. Mr Jenkins does agree that faulty supervision was an important cause of the accident. Mr Jenkins also makes the point which I have referred to before that a new permit should have been taken out when the job method changed. An important conclusion of Mr Jenkins was that the company had a number of safety precautions in place and a safety department but they were caught out because the task being done was done on an ad hoc basis and there was no established procedure for handling it. The core criticism appears to be that Mr Taylor did not do his job properly. It should be noted that there was no suggestion the Mr Jenkin’s Report had been handed over to OPCAL. However he did have a meeting with OPCAL at which his views were discussed. There was no suggestion from Mr Snape that any proposals from Mr Jenkins about handovers had ever been handed to him.

Mr Jenkins carried out a Routine Inspection of Piper Alpha in June 1988 and his Report is 14/45 of process. In fact he claims to have been told by Mr Clark that handovers had been "tidied up". In particular Mr Clark, who was the Maintenance Lead Technician, told him that the incoming Supervisor sat in on the tradesmen’s handovers but Mr Clark would have been referring to the maintenance department. Mr Jenkins also observes in his Report that OPCAL had adopted part of the International Loss Control System of working but that they looked as if they were about to burst at the seam with the effort involved. There was some question as to what this might involve but it can be said that there is this evidence that OPCAL were not totally indifferent to safety and were trying to improve their system.

Mr Snape gave evidence that until the Sutherland accident it was not perceived in the company that handover was a problem. On the evidence I think I can accept this. I can also accept Mr Snape’s evidence that after the accident some steps were taken to review the handover procedure. Thus Mr Todd, the Maintenance Superintendent was asked to look at the adequacy of the handover procedure. He claimed how he had discussed handovers with his OIM and they decided that not much could be done nor indeed was needed to improve that particular aspect of the safety procedures. This of course coincides with the view of OPCAL’s own internal inquiry. The complaint does not seem to have been that sometimes there were no handovers but rather that the handovers that did take place could have been improved. The defenders did not set out in their pleadings any specific standards or procedures for an effective handover system which the operators were neglecting. I am in the whole circumstances unable to conclude that there was any essential deficiency in the handover system as such. On the other hand the fatality may have highlighted problems over supervision and the operation of the permit to work system which required to be addressed. Whatever culpability OPCAL may have had in relation to the unfortunate accident to Mr Sutherland I do not see that this has much direct bearing on this case. If the Proof had been a general inquiry into the sufficiency of OPCAL’s safety systems then the Sutherland affair may be another adminicle showing deficiencies in these systems. However I must not lose sight of the fact that I am not here to evaluate the status of OPCAL’s safety arrangements except insofar as inadequacies in that system can be shown to have contributed to the present disaster.

4.3.5 Relationship of Accident to Handover Procedures

Just as the defenders attribute the accident (if it occurred as alleged) to intentional departures from the Permit to Work system they aver that the pursuers caused the accident by intentionally failing to enforce the handover system. Thus they aver that

Of course it has to be noted that at best for the defenders Mr Clark was talking about the handovers for Maintenance personnel. The defenders also aver

The defenders have not averred nor proved just what detailed arrangements for the regulation of handovers should have been in force. Moreover the defenders extend their case about the monitoring and auditing of the Permit to Work system to handovers. They also say that if by chance Mr Vernon did not know that the PSV had been removed he would have acquired this knowledge if the handover procedure had been properly implemented.

4.4.1 General

If the accident happened as the pursuers allege and if contrary to the defenders’ submissions Mr Vernon attempted to jag the pump without knowledge of the missing PSV then according to the defenders this resulted from OPCAL’s failure to monitor and audit their permit to work and handover systems. In a nutshell the defenders’ case on this point is that the enforcement of safety procedures was so slack that an environment accrued in which employees became careless about applying the safety procedures. There in my view can be no doubt that the supervision of the permit to work system was quite ineffectual. The divergence from the strict system was obviously not a rarity but occurred on a regular basis (at least in the weeks before the accident). At least most of these irregularities certainly would not have affected safety. However the purpose in having safety rules is to have clear guidance from management as to what is expected from employees and it is not for the latter to adapt the rules at their will. Even if many of the irregularities in the operation of the permit system were minor the employers should have been aware of them and if necessary considered changing the details of the system. At the lowest level of control if Lead Hands and Superintendents(that is to say the line managers) had from time to time investigated the day to day working of the permit system it would have become obvious from the permits they were handling that the completion of permits required some control (that of course is assuming that the permits recovered and relating to the last two weeks on the platform were fairly typical). Indeed the Lead Production Operators were themselves committing many of the irregularities. It is impossible to avoid the conclusion that at least in the period shortly before the accident the lower level of management colluded in a somewhat slack performance of the permit system particularly in regard to the filling-in of the permits (it should perhaps be noted that since permits were returned to the shore base had either party wanted to review a wider range of actual permits this may well have been possible). In any event I am not suggesting that any practice which was thought seriously to impinge upon safety would necessarily have gone unnoticed but even Mr Snape agreed that if you have a prescribed system relating to safety aboard an oil platform it is important to operate it strictly. Clearly OPCAL took a lot of trouble to set out the detail of the safety system and this could only have been in the expectation that the detail would be followed. The pursuers argued that even if their submissions as to the applicability of the good and prudent practice provisions are rejected (and I shall deal with this in another chapter) minor discrepancies in the completion of permits are not necessarily departures from such practice but I think it can be readily inferred that for employees deliberately to ignore the specific safety rules that their employers have laid down must be a departure from what generally would be referred to as good and prudent practice (unless perhaps it can be shown that it was totally impracticable to apply the rules rigorously; but that was not shown to be the case). In a case where experienced managers have evolved a safety system to me it seems obvious that it is a departure from good practice if the employees exercise their own judgment in deciding what parts of the system to follow. Counsel for the pursuers seemed to suggest that if immediate supervisors thought that departures from established system were perfectly safe then it cannot be said that such departures are contrary to good practice. That was not a view that Mr Snape could support. As he declared "the reason you have procedures is that they be followed". Nevertheless I shall have to consider the technical legal arguments which the parties advanced in relation to this aspect of their cases.

It must be noted that my comments relate to permits to work. Perhaps with the exception of the specification of the work to be done (the point that arose in the Sutherland case) there was really no evidence that the handover system was inadequately supervised or operated in a casual or routine manner. This of course does not mean that an operative could not make an error of judgment in deciding just what information to pass on but if clearer guidance for handovers was required just what such guidance should have consisted of was not seriously developed.

Since the Operators must anticipate the possibility that even their own supervisors may not enforce good practice sufficiently it is as a practical measure important to conduct audits. Monitoring can be done by line supervisors but auditing should involve some degree of independence. Again there is ample material in the evidence to show that OPCAL recognised that. Indeed Mr Snape acknowledged that auditing was a necessary procedure if he was to be kept aware of the state of the safety arrangements. Mr Snape agreed that a worthwhile audit of the permit to work system would have included someone looking at a selection of the permits to see that they were being used properly. I would hesitate to leave the impression that the Operators took no steps to check the efficacy of their safety arrangements. They held regular meetings at various levels of management devoted to safety matters. In fact they spent at least a fair bit of time considering safety on their plant and of course for practical reasons they probably could not scrutinise all safety aspects all the time. Certain audits took place in the year or so before the accident but no organised internal audit took place between 1985 and 1988. However I think it can be concluded that if anyone conducting any kind of reasonable audit of the permit system in the period approaching the summer of 1988 had looked at the way permits were being filled in it would have become readily obvious that there were deficiencies. If OPCAL did have a safety auditing system Mr Snape was unable to help us much as to how often it took place. Nevertheless it must be acknowledged that whereas monitoring could be an ongoing process auditing would be an exceptional event likely on practical grounds only to take place at intervals. Any failure to enforce adequate auditing standards would of course be a failure of the senior management. It is true as the pursuers contend that there were no pleadings or evidence relating to what period between audits would be consistent with good and prudent practice. However I think prima facie if there are no firm arrangements at all to ensure regular auditing such cannot be consistent with good and prudent practice. No one doubted (Mr Snape included) that in general auditing of safety procedures was necessary.

The defenders led one witness, Mr Fearon, in an attempt to establish what constituted good and prudent practice in relation to monitoring and audit. The pursuers objected to this evidence on the ground of "no record" and I allowed it under reservation. It has to be observed that what Mr Fearon spoke to was essentially his opinion rather than factual evidence about other procedures followed in practice in the industry. Indeed it was contended by the pursuers that Mr Fearon laid no proper foundation for the opinions he expressed. He was 57 years of age and was a self employed Technical Safety Consultant. He had a BSc in Chemical Engineering. He was a Chartered Engineer and a Fellow of the Institute of Chartered Engineers. He had worked for 26 years with British Petroleum. He accepted that he had had relatively little involvement with offshore work. He had been head of technical safety between 1976 and 1980 but it was not made clear whether his responsibility related only to hardware and not procedures. Until 1993 he worked with BP as a Safety Engineer but not in relation to offshore work. In 1989 he passed examinations and was accredited to the International Loss Control Institution. He had a certain amount of experience of safety audits. He certainly had from time to time assumed a monitoring function. I think it would also be fair to say that as from about 1986 he had a certain amount of experience in the initiation and implementation of permit to work procedures although in respect of the former experience he had merely issued guidelines. He had some experience in instructing personnel in the use of permits to work. The workers he was responsible for got a measure of formal training. He also had been a member of the Petroleum Industry Training Board with a view to overseeing the production of training packages in connection with permits to work. The pursuers made a number of points aimed at discounting Mr Fearon’s ability to speak with authority about permits to work but although he may have lacked concentrated experience in relation to offshore platforms it is obvious that he had wide experience of the nature and operation of permit to work systems generally. He had worked with various systems in various capacities. He also had experience of audit systems and indeed he had worked with two kinds of audit. The first were technical audits which were broad-brush audits of perhaps a whole refinery and theme audits which were more specific and would from time to time include permits to work. The witness accepted that this last category of audits were very time and resource consuming. His involvement with this kind of auditing dated from about 1988. He indicates in his evidence that in 1988 an auditing procedure would have been regarded as good practice but this generality leaves a number of questions unanswered. He defined an audit of a permit to work system as being an independent inspection or audit of what a particular organisation or site is doing. A structured review carried out against specific checklists and involving interviews and a number of spot checks. The central safety organisation of the Operator could provide the degree of independence that was critical to an audit or external consultants could be brought in. Even before 1988 BP carried out audits but they reviewed their auditing procedures extensively after the Cullen Inquiry. Mr Fearon obviously had some experience of auditing but had not himself carried out theme audits nor did he know what the general practice in relation to auditing was in the North Sea in 1988. The pursuers contended that Mr Fearon’s experience of auditing particularly in the period prior to 1988 was too particular to BP to be relevant to the questions in these cases.

In his evidence Mr Fearon referred to a document entitled "A Guide to the Principles and Operation of Permits to Work as Applied in the UK Petroleum Industry" (number 15/2 of process). It was prepared by the Oil Industry Advisory Committee Group of the Health and Safety Commission. The document was directed at the petroleum industry and was dated 1986. However Mr Snape did not appear to have been aware of its contents until after the accident. OPCAL’s formal permit to work system mirrors closely the recommendations in the Report. In any event Mr Snape agreed that the recommendations in the report represented sound practice and I think it can be said that the Report represented what could be said to be generally recognised practice in the industry in relation to permits to work. The Report emphasises the importance of a sound permit to work system if accidents in this highly dangerous industry are to be avoided. Moreover one main purpose of the system is that persons directing operations should be aware what is going on at any time. Since none of the personnel in OPCAL’s Safety Department gave evidence their knowledge or response, if any, in relation to it in 1988 was not explored. The general requirements set out in the document are declared as having to be read in conjunction with the specific guidance produced by individual petroleum companies in relation to their own operations and activities. The publication is only introducing Guidelines which require to be adapted to the specific requirements of the organisations using them. However it refers to a need to monitor a permit to work system and I doubt if the pursuers required to labour that point because Mr Snape accepts that any permit to work system would require to be monitored. The Report suggests that there should be spot checks. The Guidelines indicate that an objective of a permit to work system should include "Ensuring that the person in direct charge of a unit, plant or installation is aware of all the work being done there". Mr Snape did not demur from that. However I accept that this objective would be achieved if the system makes adequate provision for the line manager having the information of the range of work being done. However the objective could only be realised in a general sense since obviously it would be difficult to ensure that a manager knew the detail of all the work going on at any moment. Mr Snape agrees with the Guidelines in that satisfactory arrangements, including training, should exist for implementing the procedures on a day to day basis. Then the guidelines set out that it is a responsibility of employers and occupiers to ensure "that the operation of the procedure is monitored to ensure that it is correctly applied" and "that the procedures are reviewed regularly, and amended or updated as necessary". To this point I doubt if Mr Fearon’s evidence, admissible or not, takes the cases very far for it was clear from Mr Snape’s own evidence and the Operators’ Minutes that were produced that OPCAL accepted the responsibilities I have mentioned. Indeed OPCAL had in place a comprehensive safety structure both onshore and offshore. So far as offshore is concerned there would normally be eight safety personnel on the platform at any time. Whether this system always worked to best effect is another matter. The safety hierarchy is illustrated in the organisation charts numbers 12/209 and 13/62 of process. The structure contained arrangements for some safety management which was independent of Operations management. Thus the safety personnel were able to report to senior management without going through Operations. Mr Snape considered that it was the role of the Safety staff on the platform to monitor safety on the platform and I would accept that there was a system in place but whether the reasonable operation of the system was itself monitored is another question. However one regards OPCAL’s monitoring system the fact remains that regular albeit possibly minor infringements of the safety system were occurring without anyone picking them up or responding to them.

Mr Snape was also referred to a document produced by the Health and Safety authorities entitled "Statement of Policy on Health and Safety at Work with related implementation responsibilities and the system for monitoring and control" (number 13/60 of process). This is dated July 1987. This provides that the platform operators should carry out routine and ad hoc reviews and technical safety audits of facilities equipment, systems and procedures. Mr Snape thought that these were important provisions. It also provided that the Loss Prevention Department had the duty to monitor the effectiveness of company policies and procedures. There is a further responsibility on the Department to ensure professional co-ordination of the in-house technical safety audits.

Now Mr Snape indicated that the company had a scheme of inspection to be carried out both internally and by people who were external to audit their operations. In general it was the Loss Prevention Department’s function to keep control of the implementation of safety measures. In fact they submitted regular reports to management and these purported to show that there were regular inspections of facilities and procedures. I think all this means is that the defenders do not need Mr Fearon to establish that monitoring and auditing were good practice. OPCAL were experienced platform operators and in the absence of contrary indications I think that it must be inferred that they were aware of what was good and prudent practice for the operation of an oil platform. Were this not so they should not be in the business. If they had gone to the trouble to install a safety practice it can be assumed that they did so because they thought it to be significant. If they were to contest that a practice is required then what other operators did may be of some importance but OPCAL do not dispute that monitoring and audit were advisable. In any event for an operator to depart from the prescribed safety rules without special reason must in itself be a departure form good and prudent practice. It would be most surprising if the industry were to tolerate the practice of workers taking it upon themselves to deviate from the prescribed rules for safety that their employers have no doubt devised after careful consideration. Moreover in the broad sense it is obvious that there is no point in having a system if you do not take steps to check that it is working. It must also be noted that Mr Snape was not so much challenged on the detailed structure of OPCAL’s system as to how well it worked. The defenders place weight in the fact that the pursuers did not bring any witnesses directly involved in the safety system to speak to its efficiency or otherwise. The pursuers’ answer to that of course was that in relation to wilful misconduct the onus of proof was on the defenders.

It was not disputed that Mr Snape had an overall responsibility to see not only that a work system was provided but that it was maintained. Line managers and line supervisors had a duty to ensure that formal procedures, standing instructions and safety standards are complied with at all time.

Mr Fearon was asked if the mechanisms required to ensure that a permit to work system is implemented would include training, monitoring, and auditing and he agreed. This does not take us much further for the reasons I have already discussed. Mr Fearon indicated that the frequency of monitoring once a day would not be an unreasonable frequency. Now I think in respect of that evidence the pursuers are correct to say that they got no notice that the defenders were to develop an attack on the frequency of monitoring permits. Indeed if there was any deficiency in the exercise by line managers and supervisors of their supervision of the permits it may well be that they were willing to tolerate departures from the strict procedures rather than that they were not exercising their supervisory function frequently enough. In fact the various witnesses of the pursuers who had experience of line supervision were not asked about frequency of the scrutiny of permits.

On no view can it be claimed that OPCAL were totally indifferent to monitoring since it is clear from the Loss Prevention Annual Report for 1987 that at least certain routine checks were carried out on permits and the safety of work sites.

According to Mr Fearon he would expect auditing to be done annually. Here once again the defenders’ evidence falls foul of pleading rules for there is nothing in their case to alert the pursuers that they are alleged to have failed to audit according to specific standards as to interval of audit. But nevertheless the evidence seemed to show (and this is irrespective of Mr Fearon) that OPCAL had no effective system at all for audits of the permits to work to be conducted at prescribed intervals.

A point of some interest is that OPCAL themselves had put permits to work on their programme for internal audit. This had been done in 1985 (as one of a number of audit programmes for that year) but by 1988 the audit had still not been carried out. The audit was certainly not carried out in 1985 and we were told that this was because there were no resources (there is an indication that this may have related to lack of manpower and physical resources). However the defenders were over the period interested in their permit to work system and indeed reviewed it in 1987. A review is of course different from an audit. A review is concerned with the content of the safety arrangements whereas an audit is concerned with the effectiveness of implementation. Moreover in 1988 one of the Participants, Texaco, carried out an audit of safety procedures. This was certainly some check but Mr Snape accepted that internal audits were also necessary and indeed he appears not personally to have seen the Report of the Texaco audit. Such an audit by Participants tended to occur every few years. The Department of Energy had carried out what was described as an audit not long before the accident but Mr Snape accepted that this was more of an inspection and would not be as comprehensive as an internal audit, Mr Fearon complained that the failure to carry out the audit proposed for 1985 represented non-compliance with good and prudent practice. Nevertheless it can be said that OPCAL themselves thought in 1985 that an audit was desirable of permits to work but they had not given substance to their hopes even by 1988. In any event Mr Snape indicated that the headquarters of the Oxy Group centred in Los Angeles audited in a general sense once a year and on that occasion all aspects of safety would be examined. The associated company Oil and Gas Corporation carried out an audit once a year which was specifically directed at Health, Safety and Environmental matters. The Texaco audit reported in March 1987 that "The safety and environmental programmes on the platforms and Tharos are well established and well managed" (13/5 of process). Certainly as far as Claymore was concerned they looked at permits to work and indeed found some irregularities. One of their remits was to verify that permits were being prepared in detail according to instructions. OPCAL’s insurers and the health and safety authorities also carried out periodic audits, the former once a year. The 1986 audit covered hot work permits. Mr Barnes who was an OIM was allowed time away from his normal function to carry out a review of the permit to work system. This began in 1984 and took until about 1887 to follow through. It is not clear to what extent OPCAL’s failure to carry out the 1985 proposal for an audit after that year was affected to any degree by the fact that subsequent alternative audits had taken place. Thus OPCAL do not seem to have had a very reliable practice for auditing but it would not be fair to say that they were totally regardless of such safety checks. However not to have a reliable audit procedure would be a departure from good and prudent practice. I think it is clear that Mr Snape recognised this. If the pursuers did have an effective auditing system then their position in this respect would have been more convincing if they had led someone from their Loss Prevention Department since that Department was responsible for internal auditing. Many of the documents which they produced purportedly from the Loss Prevention Department were not spoken to by witnesses qualified to speak to them and thus were evidentially worthless.

4.4.2 Mr Fearon’s Evidence about Handovers

The witness Mr Fearon claimed that the training, monitoring and auditing requirements that he had discussed in relation to permits to work were equally applicable to OPCAL’s handover system. Of course as I have mentioned his evidence was taken under reservation because the pursuers objected to it. The witness expressed the view that it would not be in accordance with good and prudent practice if there had been no monitoring and auditing system in relation to handovers. If it is merely being suggested that it would not be good and proper practice to have an important matter such as handover neither supervised nor independently checked from time to time then I think I could form a view on that without reference to Mr Fearon. As is obvious the transfer of information between shifts is critical to the safe function of the platform operations and I do not think that the pursuers would dispute that there ought to be some degree of supervision and checking so that management can rest satisfied that the system is working. However the next point Mr Fearon makes is more contentious for he is asked if it would be good practice to leave it to individual lead operators to decide at their discretion what particular information should be communicated at handover. He indicates that in his opinion this would not be good practice. However his explanation for his answer may not help the defenders for he says that if there was a discretion left with Lead Operators to decide what information should be passed over there would be no mechanism for the transmission of information. He did not like a system of notes being handed over which might then be disposed of since this could mean that the incoming man might forget some important information. This would suggest that in Mr Fearon’s experience it is not at all surprising if the incoming person may from time to time allow a piece of information to slip his mind. Moreover in fact the notes handed over at the Piper handovers were noted in a notebook (called a log) and there is no indication that this was destroyed or thrown away during the new shift. In any event OPCAL’s system did embrace a number of written records as to what was happening on the platform including as well as the Lead Operator’s log the Control Room Operator’s log, the Operators’ logs and the permit to work system. There were other documents as well like computer worklists. Above all if the defenders were going to seek to prove that a particular detailed procedure is required in accordance with good practice they should certainly have laid a foundation for this in their pleadings. The defenders’ specific complaint in the pleadings is in fact extremely general and is to the effect that OPCAL left it to individual Lead Operators to decide what to pass on.

However well or badly the monitoring of handovers worked there was evidence that at least there was some degree of supervision of the process. Thus Mr Todd, a Maintenance Superintendent, attended the morning handovers involving Lead Maintenance Hands and indeed participated in them. He also attended some of the evening handovers before going to the OMI’s meeting.

He had discussed with the Maintenance Lead Hands what ought to go into the log.

It should be noted in regard to safety matters generally that the 1976 Offshore Installations Regulations only apply to work that gives rise to a source of ignition - that is to say to Hot Permit Work. However although it was not a statutory requirement the Health and Safety Commission in production number 15/2 of process recommended that the permit to work procedure should apply to cold work as well as hot work. The reason for that is obvious when one considers the circumstances of this accident.