5.1.1 The Closed Record

The pursuers’ case as pleaded is that the initial explosion and subsequent explosions and fires on the platform occurred as a result of a leakage of condensate from a blind flange assembly at the site of a pressure safety valve (hereinafter referred to as PSV 504) which was not leak tight. That pressure safety valve was normally connected to pipework in Module C of the installation. Module C was at the 84-foot level of the platform. PSV 504 serviced a pump known as pump A being one of two condensate-injection pumps situated at the 68-foot level of the installation . The other condensate-injection pump was situated close to pump A at the 68-foot level and was known as pump B. The two condensate-injection pumps were part of the production processing plant on the installation. On the date of the accident pump A had been taken out of service for maintenance and repair. Pump B was in operation. When taken out of service pump A and its associated pipework had been isolated and depressurised. Valves known as gas operated valves (hereinafter referred as GOV or GOVs) required for its operation had had their air supply disconnected. On the said date PSV 504 was removed by Alexander Rankin and Terence Sutton (now deceased), both employees of Score, then acting in the course of their employment. Terence Sutton died in the accident. PSV 504 was removed by the said Score employees for recalibration and re-certification. The intention was refit PSV504 to its site on the pipework that same day. Once PSV 504 had been removed it was the task of the said employees of Score to fit two blind flanges on to the pipework left open by the removal. In particular a class 900lb blind flange was to be fitted on the upstream side at the site of PS 504. On the said date two blind flanges were fitted to the pipework at the site of PSV by Terence Sutton although it is believed that he may have fitted a 1500lb blind flange to the upstream side. At the end of their working day (before 6pm) the re-calibration and re-certification work being carried out by said employees of Score on PSV 504 had been completed. They stopped work at about said time. The upstream blind flange remained in situ. PSV 504 was not replaced although the intention had been that it would be replaced during the working day. During the evening of said day pump B tripped. The running of the process plant on the installation at said time was under the control of Robert Vernon (now deceased) Lead Production Operator. Robert Vernon was then acting in the course of his employment with pursuers. Also directly involved in the running of the process plant at said time was Robert Richard (now deceased) the Phase 1 Operator. Both Robert Vernon and Robert Richard died in the accident. Robert Richard was also acting in the course of his employment with the pursuers. Following upon the tripping of pump B, Robert Vernon decided pump A should be brought back into service. To bring pump A into service, it was necessary, inter alia, to reconnect the air supply to the GOVs. It was then necessary to check that the air supply was correctly fitted and to begin re-pressurising pump A.

Re-pressurising was done by jagging open the GOV on the inlet side of the pump. Jagging was done by the operation of a push/pull button located near pump A. Said air supply was re-connected and said jagging took place. These operations allowed condensate to pass through pump A and to move through the line of pipework leading from the discharge side of pump A line to the upstream blind flange assembly at the site of PSV 504. Condensate thereafter escaped through an aperture or apertures between the pipework and the upstream blind flange, because the blind flange assembly was not leak- tight. The upstream blind flange had not been fitted securely to the pipework by the said employees of Score. After condensate escaped, it vaporised and ignited, causing the explosions and fires hereinbefore referred to. The initial explosion occurred at about 2200 hours on said date. At that time the wind direction was 164 degrees true and the wind speed was south south-east 3, 16.4 knots. The initial explosion was in Module C and it caused damage to said module and its firewall. Damage was also caused to the condensate line in Module B resulting in a release of condensate. Damage was also caused to Module B which resulted in a continuous release of oil.. Hereafter, a further major explosion occurred some twenty minutes after the initial explosion upon the failure of the Tartan Riser. This resulted in an even more substantial fire. A further major explosion occurred some 50 minutes after the initial explosion upon the failure of the MCP-01 Gas Riser. Other explosions also occurred and eventually there was a structural collapse of the installation. The pursuers tried to establish the foregoing version of the accident although they did not seem seriously concerned to prove that the wrong size of flange may have been fitted

The defenders replied in their pleadings by admitting that PSV 504 normally connected to the pipework in Module C which was at the 84-foot level, that the valve serviced one of the two condensate injection pumps at the 68-foot level, and that these pumps were part of the production processing plant. They further admitted that on the date of the accident pump A had been taken out of service for maintenance, that PSV 504 had been removed by Alexander Rankin and Terence Sutton (now deceased ) before they fitted the blind flange assembly, that these operatives were employees of Score acting in the course of their employment, and that the valve had been removed by these employees from the line of pipework leading from the discharge side of pump A for re-calibration and re-certification. It was admitted that once the pump had been removed it was Sutton’s task to fit blind flanges to the pipework left open by the removal, and that he had thus fitted them, that on the evening of the said day pump B tripped, that the running of the process plant was under the control of the Lead Production Operator, Robert Vernon, and that he was acting in the course of his employment with the pursuers. It was admitted that in order to bring pump A into operation it was necessary inter alia to re-connect the air supply to the GOVs and that there were a number of explosions on the installation beginning about 2200 hours on that date eventually leading to a structural collapse of the installation. Otherwise the pursuers’ averments as to the facts of the accident are denied. The defenders went on to aver that the pursuers’ hypothesis of the initial explosion in Module C is not consistent with noises heard on the platform shortly before the explosion, damage to the area of the dive skid, and the sequence of gas alarms which occurred immediately prior to the explosion, the first of which was a low level alarm. The damage to the platform was said to have been consistent with an explosion initiated in Module B and propagated through a breach in the wall between Modules B and C. The defenders further averred that immediately after the initial explosion fire was seen to have broken out in Module B and that after the tripping of condensate injection pump B, but before the explosion and immediately before the first gas alarms a centrifugal compressor tripped. This it was claimed was consistent with upset conditions in Module B in the process equipment located upstream of the compressors which would have brought about the discharge of flammable vapours. It was further claimed that there was a sudden and material drop in the flow of oil from Piper Alpha at least seven minutes before the initial explosion. The source of oil from the platform was the separation plant in Module B the module being open at the west and east ends to encourage a flow of air. At the time of the explosion air would have passed from west to east through the Module (a fact about which the parties were not in dispute). The suggestion averred is that gas and other vapours would have been discharged out of the open east end of Module B and thereafter ingested by the air intakes for the centrifugal compressors at the east end of Module C. The first low level gas alarms prior to the initial explosion were said to have been at the centrifugal compressor in Module C. The alarms which followed were said to have been at the east end of C and the high level alarm immediately preceding the initial explosion was at one of the centrifugal compressors. Moreover it was said that the status of fire and gas alarms in Module B at the time of the accident is not known and welding was being carried on in the Module on the day of the accident. This work was liable to set off fire or gas alarms which were not inhibited or isolated. It is averred that gas alarms in a particular zone may be inhibited during maintenance work by "pinning out" but this line of defence was not insisted upon at the proof.

The defenders further pleaded that planned maintenance of Fire and Gas Area B2 commenced on 29 June 1988. Blind flanges at the site of PSV 504 were fitted by Sutton. He was an experienced and conscientious worker. He would, as a matter of ordinary and usual practice, have tightened or "flogged up" the studs of the blind flanges. There was no reason for him not to have followed such ordinary and usual practice when fitting the blind flanges at the site of PSV 504. It is further averred that in any event an escape of condensate from the upstream blind flange assembly at the site of PSV504 would not have produced the vapour distribution for the initial explosion.

The pursuers for their part admit that the first gas alarm prior to the initial explosion was a low level alarm at the site of centrifugal compressor C and that after the tripping of pump B and before the explosion all three of the centrifugal compressors tripped. It is admitted that the further low level gas alarms which followed were at the east end of Module C although it is claimed that not all of the alarms related to the centrifugal compressor there. However it is admitted that the high level gas alarm immediately preceding the explosion was at one of the centrifugal compressors. The fact that Module B is open at the east end to encourage a flow of air is admitted as is the fact that at the time of the explosion the air flow would have been from west to east. It is also admitted that gas and other vapours discharged at the east end of Module B could have been discharged through the open end of the module. It is accepted that the air intakes of the centrifugal compressors in Module C were located at the east end of the module (although outside the module). There agreement in the pleadings on the relevant matters stops. However the pursuers go on to aver that any drop in the oil flow which occurred was as a result of the tripping of pump B and the actions consequently taken by the operators. The reciprocating compressors were unloaded and put on recycle, bringing a loss of gas lift and a reduction in production. It is said that no gas detectors or alarms in Module B would have required to be inhibited in order for welding work to be carried out and furthermore no maintenance work on the gas or fire detectors was being carried out on 6 July 1988. There were no Permits to Work relating to Module B extant on the installation at or about the time of the original explosion. No detection of gas or other flammable vapours was annunciated in Module B at or about the time of the original explosion. Any significant quantity of gas or other vapours discharged in Module B would have activated the gas detectors situated at high and low levels within the module and any such release would have been accompanied by a release of hydrocarbons. It is averred in addition that any major failure in process equipment located upstream of the centrifugal compressors in Module B which were liable to bring about a discharge of a sufficient quantity of flammable gas would have been annunciated in the control room or would have caused the plant or equipment concerned to trip. It is claimed that any significant quantity of gas or vapour in Module B that would have caused failure of the B/C firewall would also have caused failure of the A/B firewall. The said firewall is said not to have failed. As a separate matter it is averred by the pursuers that even if Module B had been completely filled with a stiochiometric mixture of gas and vapours resulting in an escape of gas from the east end of Module B so as to be ingested by the air intakes of the centrifugal compressors in Module C such a sequence of events would not have resulted in the pattern of gas alarms which in fact occurred in Module C. It is further said that any damage in the area of the Dive Skid was not inconsistent with an initial explosion in Module C. All the gas alarms which annunciated were related to the south-east part of Module C and were consistent with a leak of condensate in the said module. Nor was another gas alarm set-off in the installation in the period shortly prior to the explosion. The tripping of the centrifugal compressor is consistent with the tripping of condensate injection pump B especially in consequence of the actions taken to recycle and unload the former. In summation the pursuers aver that the general pattern of damage and lack of damage, the pattern of gas alarms , the double escape preceding the explosion, the actions of the process operators at or about the time of the initial explosion, the vapour and fireball seen from the 68-foot level immediately following the initial explosion, the blue flash seen at the initial explosion, the lack of hot gas or flame in the control room, the rush of cold air into the mechanical workshop immediately after the initial explosion and the damage to the condensate line in module B and resulting fireball, are all factors indicative of Module C being the location of a condensate leak and of the initial explosion.

Thus the parties set out their respective cases on causation and although the averments do not appear to be unduly expansive they proved to be capable of generating an immense volume of evidence. It should perhaps be observed that I was only informed shortly before the proof that the defenders by way of an amendment decided to challenge the pursuers’ hypothesis that the accident had resulted from a leak in Module C.

5.1.2 The Parties’ Contentions

The pursuers’ principal contention on causation as has been seen is that the explosion was caused initially by an escape of condensate in Module C as a result of a blind flange being inadequately attached to the pipework to the upstream of PSV 504 which had been removed from its location for maintenance. The pursuers accepted that their case on causation was entirely circumstantial. To bring themselves within the indemnity provisions attached to the contracts with the contractors they clearly had to prove that an accident had occurred that justified them in paying damages to the claimants and I think they accepted that this involved requiring to prove what had caused the accident. The parties’ respective cases of course, and sadly, were handicapped by the fact that so many persons on the platform when the accident occurred, and who very likely could have given important evidence, had perished. Moreover most of the relevant records and equipment lay for practical purposes irrecoverable at the bottom of the sea. The pursuers emphasised that they were relying heavily on the incidence of the gas alarms to pinpoint that the explosion had happened in Module C. It is claimed that there was a fully effective system of gas alarms in both Module B and Module C so that the absence of any prior alarm in B strongly militates against the possibility that the explosion originated in B. The pursuers also argued that the evidence from witnesses who were in vessels standing off the platform and who observed certain features of the accident supports the view of the pursuers that the accident originated in Module C. In this regard particular weight was attached to the evidence of the witness Captain Clegg who said in evidence that as the first explosion occurred he saw a blue flash emanating from Module C. Mr Miller who took photographs from the support vessel Tharos almost immediately after the explosion was able to produce prints which showed light grey smoke coming from the west face of Module C. Other witnesses were off the east face of the platform at the time of the explosion. Captain Morton was thus placed on the Maersk Cutter and he saw a substance like smoke which he pinpointed to the east face of module C. Mr Flaws was also on the Tharos and has first observation after hearing the bang was to see dark smoke rising from the east face of the platform. He also saw a ball of flame in module C which could have been the residual burning after an explosion there. In relation to witnesses who were survivors from the platform it was claimed that the witnesses Mr Bollands and Mr Clark (both of whom had been in the control room in Module D when the accident occurred) had each been moved by the blast in such a way as to suggest that the C/D firewall had collapsed. Indeed it is significant that Mr Bollands described the effect of the explosion as being " the wall coming in". This it was argued was more consistent with an explosion in C than B. Similarly witnesses who had been having tea in the same maintenance unit in Module D had experienced the blast in a way which suggested that the C/D firewall was not intact. A Mr Elliot working on the west face of the platform at the 68-foot level almost directly below Module C had described how he had been " beaten to the ground" by the explosion. A Mr Young who had descended to the 68-foot level just before the explosion, after it occurred, experienced a rush of hot air from the direction of the stairs behind him leading to Module C. It was said that the damage to such equipment as was available to be observed immediately following upon the explosion also pointed to Module C as being the source of the explosion. Thus the witness Mr McGregor spoke to main oil line pump panels being damaged and these had been located in Module C. Likewise the Chanter Riser Gantry had been damaged in a manner consistent with the blast having come from C. There was other damage to the mechanical workshop doors, the instrument workshop door, and the divers’ decompression chamber door that at least were consistent with Module C having been the explosion point. With regard to the photographs taken by Mr Miller, these showed that the fire had spread to the north face of the platform and that could only be consistent with the failure of the C/D firewall. It was of course accepted that immediately following upon the initial explosion a substantial degree of fire was seen in Module B but this was ascribed to the effects of an explosion in C which caused the B/C firewall to collapse thus causing a fire to break out in B. One feature of the fire observed in Module B was said by the pursuers to have been a fireball. It was said that the experts had agreed that this fireball was consistent with a high pressure release of condensate into an existing fire-ground. If an explosion in Module C had caused the firewall between Modules C and B to fail then this would have generated enough energy to cause projectiles capable of rupturing the condensate line in Module C bringing a release of condensate sufficient to cause the fire phenomena observed in B. Senior Counsel for the pursuers accepted that if the explosion can be shown to have occurred in Module C he is left with the need to prove just what caused that particular explosion. As a preliminary to this, the determination of the location within Module C where the explosion originated would be important. The two contentions which the pursuers particularly sought to rely upon in this regard are the submission that the explosion was from a source that produced a release of heavier than air hydrocarbon gas and that the release created a flammable cloud near the eastern end of Module C. These requirements it was said can be satisfied if the gas concentration originated from a leak from the blind flange attached to the pipework of PSV 504. This hypothesis is supported by the evidence of Captain Clegg who deponed that the blue flash he saw was at a low level suggesting that the fuel was a heavier than air fuel. The witness

Mr Grieve had seen a ball of flame burning near the ceiling of the 68-foot level which suggested that it was caused by heavy fuel penetrating down from Module C above. Mr Bollands and Mr Clark in the Control Room which was situated at the mezzanine level of Module D did not experience the in-rush of any hot combustion gases whereas Mr Young at the 68-foot level had felt a rush of hot air at the stairs leading to the 84-foot level. It was said that the contention that the fuel which caused the initial explosion was a fuel of the character of condensate was vouched by the expert, Dr Davies, who had carried out certain wind-tunnel experiments. He is claimed to have established that only condensate could cause the pattern of gas alarms observed before the explosion. If the explosion had been towards the west side of the platform the fire and smoke observed by witnesses off the platform would have been different. Given that the gas must have first gathered at the east end of Module B then it was claimed that the evidence proved that the likeliest source of this gas was an escape of condensate under pressure from the said blind flange. The evidence most suggestive of this fact was to be found in the operative activity going on at the time of the accident in the vicinity of the condensate injection pumps. A decision had been taken to put pipe A back into operation to compensate for the pipe which had failed and this meant that the pump had to be repressurised by the process called jagging which was intended to lead to the gradual re-introduction of condensate to the pump. It was not disputed that it would not be in accordance with proper practice to run the pump at a time when PSV 504 was missing. It was contended that looking to the evidence of Dr. Richardson, in the process of jagging, condensate would have been able to pass quickly through the pump A and to the site of PSV 504. The introduction of gas during the jagging process would have produced a small leak which would have caused the first gas alarm which was observed. A continuation of the jagging process would have produced a larger escape of gas which would have produced the flurry of alarms immediately before the explosion and the explosion itself. It was contended that the noise that was observed just before the explosion was consistent with the escaping of condensate through a small aperture under pressure. The scientific evidence led by the pursuers was said to support the pursuers’ hypothesis. Moreover the defenders it was claimed had not led any evidence - particularly expert evidence - giving specific support to any contrary explanation of the explosion and in particular relating it to Module B. Indeed the fact that no gas alarms had been noted in Module B prior to the explosion discounted the possibility that it had been the location of that explosion. Moreover there had been no indication by way of process alarms or otherwise that there had been any process upset in Module B. Everything which happened after the initial explosion in Module C was clearly a consequence of that explosion . Furthermore the evidence (and in particular evidence of recordings taken at the Flotta terminal), it was said, did not show any reduction of oil flow prior to the explosion as the defenders contend. Moreover the off-shore observations contradict any possibility that the explosion originated in Module B. The witnesses confirm that the A/B firewall was intact after the explosion.

The defenders did not attempt to argue that any particular explanation for the accident alternative to the pursuers’ explanation had been proved. Indeed in cross-examining the various experts they did not seek to bring out that any particular alternative to the pursuers’ case had probably caused the accident. Essentially their approach was to attack the reliability of the evidence which the pursuers claimed substantiated their case and also the inferences that the pursuers seek to draw from such of the evidence as might be accepted. The defenders would be quite content if the determination was simply that the cause of the accident had not been proved. The starting point of the defenders’ case is that most unfortunately most of the critical witnesses had been killed in the accident. This included persons whose evidence would have been of major importance such as Mr Vernon, the Lead Production Operator who is partly blamed for the accident, Mr Sutton, the Valve Fitter also blamed for the accident and Mr Richard the operator working with Mr Vernon when the accident occurred. Other witnesses who are dead and whose evidence might have been of importance included Mr Grant the Phase 1 Operator who was present at least during some of the time, Mr Sutton was carrying out his flange fitting duties and Mr Flook the Lead Production Operator who had handed over to Mr Vernon. Mr Rutherford another possible witness to the flange fitting procedure carried out by Mr Sutton was too ill to give evidence. Moreover the platform’s equipment all ended up at the bottom of the sea so that none is available for analysis. Thus, it was contended, on the limited and inconclusive evidence which remains available any decision ascribing a specific cause to the accident is essentially speculative and thus unjustified. The defenders are correct to the extent that there is less evidence about the accident than the Court would like to have seen and that is an unfortunate but inevitable consequence of the catastrophic nature of what happened. However there is some evidence and the question is what can be taken from it when it is pieced together. If more evidence had been available then no doubt it would not have been necessary to spend almost four years on the proof.

The defenders submitted that the pursuers’ case is based on coincidence such as the fact that Mr Vernon made some observation about starting the decommissioned Condensate Injection Pump. However they claim that there were many other coincidental facts that the pursuers have ignored. One of these is that a few days before the accident OPCAL had switched from Phase 2 operation to Phase 1. This meant that instead of coping with the burning of about 2.5 million cubic feet of gas the production system had to cope with about 15 to 25 million cubic feet. The transfer to Phase 1 operation had been completed on 4 July 1988. The actual transfer operation would have involved the opening of some lines and the blanking off of others. The equipment was much older than it had been during the last period when it had been exposed to Phase 1 operation. It had been years since the equipment had been exposed to Phase 1 Operation. On the other hand Mr Bollands the Control Room Operator said that before the explosion the whole plant had been normal. The relief valves PCV 1000 A and B which had to release the surplus gas had the reputation for not being entirely reliable and they have a reputation for hunting which means that they tend to open too far. These valves are located quite close to PSV 504. The witness Mr Henderson said that when the reciprocal compressors were ever re-cycled PCV 1000A would take a massive thump and I have no reason not to accept this particular evidence. Some minutes before the accident Captain Clegg noticed a substantial increase in flaring which would in itself suggest that the relief valves were performing their function. Moreover if the relief valve had leaked as a result of the unloading of the reciprocal compressors the delay between the unloading and the accident may be difficult to explain. The witness Dr Davies was not asked about this. Just before the accident the centrifugal compressors had tripped. This would have had the effect of re-routing gas through a series of pipes at the east end of Module C. This means that valves that had previously been closed required to open. PCV 50 1 and 2 were located at the north-east corner of Module B and when the centrifugal compressors trip they are going to see a large quantity of gas. However if these particular valves leaked there is a question as to how a sufficient quantity of gas would get from Module B to Module C without triggering alarms in the former. Minutes before the accident a substantial increase in flaring occurred and for what it is worth I accept the evidence to that effect. On the other hand the only relevance of the defenders’ reference to the Phase 1 situation would be to suggest that there may be an alternative to the pursuers’ version of the cause of the accident. However the defenders did not ask Mr Wottge, the main engineer on the platform, if the switch to Phase 1 operation or the implications of re-cycling the compressors could have caused a leak. This must render their submissions about the matter somewhat speculative.

Another factor which the defenders used in an attempt to discredit the pursuers’ arguments on coincidence was that Module B was rated a higher risk zone for hazards than Module C. Module B was in part zoned Zone 1 which indicated that an explosive atmosphere was likely to occur in normal operations. In Zone 2 (the rating for Module C) an explosive atmosphere was not likely to occur in normal operations and if it did it would exist only for a short time. On the other hand I must observe that if the evidence generally points to the explosion having occurred in Module C then that fact would suggest that there had been an abnormality. However the defenders sought to counter this by pointing to the evidence of Mr Wottge that in 1986 further gas detectors were introduced to Module C because of OPCAL’s experience of gas leaks that were not being picked up by the preceding detection system. It has to be noted that Mr Wottge was not questioned about the significance of such leaks and as to whether they were of a scale as could cause the explosion which occurred. In fact were it the operators’ experience that Module C generated dangerous gas leaks the existing zoning would have been inappropriate. The detection system was of course designed to ensure that a leak would set off a low level alarm before the gas cloud reached explosive limits. Moreover according to the expert Dr Davies if there was a release of less than about 4 kgs a minute there would be no alarm at all. It is plain that from time to time small quantities of gas escaped and indeed witnesses such as Mr McLeod, Mr Almeira, Mr Ferguson, Mr Ballantyne, and Mr Henderson all spoke to occasions when they had smelt gas but below alarm levels and without apparent consequences.

The defenders submitted an argument that the source of the leak may have been the centrifugal compressor discharge scrubbers. But these were sited at the north side of Module C and it may be difficult to explain how a leak there could have triggered the first alarm at C3. Dr Davies certainly did not consider that the alarm patterns was consistent with a leak at that source. It was further said that at the changeover between the phases a certain amount of gas under pressure would have been trapped in the pipework. However any such exposed pipework would have been protected by spading and pressure tested flanges. They had served for 3 or so days after the changeover without any trouble and there was no expert evidence as to how such a situation could have caused a 2 stage gas release.

Of course the defenders also submit that there was no evidence that would justify a conclusion that shortly before the accident Mr Vernon had actually introduced condensate to pump A. Indeed a sound analysis of the evidence would, so it was claimed, point in the opposite direction. There was also, it was said, no evidence that the blind flange protecting PSV 504 had been improperly fitted. Certainly nobody actually witnessed gas escaping from the blind flange.

Moreover it was submitted that there was evidence that shortly before the accident the Prover Loop had been removed from its site for maintenance. It is correct to say that this is what the evidence established. The defenders pointed out that the Prover Loop was situated quite close to where there was a door between Modules B and C. With the Prover Loop out of commission use was made of a temporary Loop which was connected and disconnected as required. The defenders contended that the Prover Loop arrangement could have been a source of leak. Moreover as I have already indicated there was evidence that during the shift preceding the accident the door on the B/C firewall had been seen to be open. It was suggested that this could have admitted gas from an escape in B to Module C. Indeed Dr Davies had said that in certain circumstances gas coming through this door could trigger gas detectors in Module C.

It would be mistaken, as the pursuers were said to have done, to elevate a possibility to a probability. The pursuers, it was maintained, had failed to prove the primary facts from which they sought to draw inferences. In other words the necessary links in the chain had not been proved.

The defenders contended that because of the nature of the gas detection system a proper analysis of the evidence would show that an escape from PSV 504 could not have caused the particular alarm patterns that Mr Bollands, the Control Room Operator observed. The point was made that it is not possible to make a circumstantial case if there are elements in the chain of circumstances which are doubtful or even contradict the inference that the pursuers seek to draw.

5.2 Defenders submissions on Requirements of Proof

5.2.1 Standard of Proof

The starting point for the defenders’ submissions on this matter was the trite proposition that the onus is on the pursuers to prove their case on a balance of probabilities. It was said that it is not enough for the pursuers to claim that their hypothesis of the cause of the accident is the only possibility that has been established. Nor would it suffice for the pursuers to argue that their hypothesis is the most likely of the possibilities that have been considered. They must fulfil the complete responsibility of proof and show that the cause of the accident which they espouse is the probable cause. I was referred to Rhesa Shipping Company v Edmunds and Fenton Insurance Company (1985) 1 WLR 948. In this case a motor vessel had sunk rather mysteriously in calm seas. The Owners claimed to recover insurance under a policy that insured them against ‘Perils of the Sea’. At the trial the Plaintiffs’ explanation for the accident eventually resolved itself to being that the accident was caused by a collision with an unidentified, submerged submarine. The trial judge held that although he regarded the plaintiffs’ case as being inherently improbable that nevertheless the plaintiffs’ submarine hypothesis had to be accepted as established on the balance of probabilities. When the case was appealed the Court did not like this and held that something is only inherently improbable if it is not probable. The trial judge’s approach had been based on a position where after hearing 15 experts he was left with two explanations. One was perhaps improbable but the other was even less likely and could not be justified by the evidence. What he then did in effect was to conclude that the accident must have been caused by the least improbable circumstance. It was observed when the case came to the Court of Appeal that it is always possible even after a prolonged inquiry to conclude that the cause of a loss remains in doubt and that the plaintiff’s case has therefore not been established. It was also observed that the fact that the ship had sunk and that it was therefore not possible to examine it weakened the proof. The defenders of course sought to make a parallel with the facts of the present case. Indeed they went somewhat further and suggested that where the whole structure of the platform had been lost all theories as to the cause of the accident could at best be a possible hypothesis rather than a proven cause. If there were two hypotheses suggested namely the Module B hypothesis and the Module C hypothesis then it was not sufficient as the pursuers seemed to suggest that I should hold the most likely established. Simply because one is more probable than the other does not make it a probable cause.

Another observation in the Court of Appeal in Rhesa Shipping Company which the defenders relied on was that although it is open to defendants to advance explanations different to that advanced by a plaintiff yet there is no obligation for them to do. Even in the absence of competing explanations the pursuers have to prove their case. If there are only two explanations for an incident which emerge at a proof there is always the third possibility to be considered namely that the case has not been proved.

The defenders contended that simply because some scientific evidence in the present cases was to lead to the conclusion that a particular hypothesis was well within the bounds of scientific possibility does not elevate the point into a probability.

The defenders also referred to the case of McWilliams v Arrol 1962 SC(HL) 7. In that case a workman was killed when he fell from a lattice tower and the pursuers alleged that the accident had happened because the defenders had not supplied a safety belt. There was evidence that for years he had been provided with a belt and never worn one. Viscount Simons observed that in a claim against a dead man inferences unfavourable to him should not be drawn except on a strong balance of probability. However it has to be noted that his Lordship then goes on to observe that there has to be justice to the living as well as the dead. The defenders submitted that the point of the observations I have just discussed is that if the critical circumstances proved are not straightforward clear and cogent the court has to consider what the material witnesses might have told the Court. Lord Reid in McWilliams observed that the court would not readily infer that a person had acted unreasonably but that in the case before the Court there was in fact evidence that the deceased had persistently acted unreasonably. However the Court would begin its enquiry from the presumption that those concerned did what was reasonable and prudent. The party wanting to displace the presumption would have to prove that there is occasion to do so. The defenders argued in this case that there is no evidence that Mr Sutton did not follow the normal practice and tighten the flange properly. Thus there would have to be compelling circumstantial evidence that he did not do so. In fact in so far as there was relevant direct evidence.

Mr McDonald had seen Mr Rankin attach blind flanges on certain occasions and he said that he always flogged them or tightened them with combination spanners. This differed from McWilliams where the deceased was shown to have been inclined to ignore the proper practice.

The defenders did accept that a case could be proved when a critical witness who is blamed is dead. This could hardly be otherwise because cases concerning deceased persons are proved every day. All that was maintained was that when a party is deceased and could possibly have exonerated himself this is a factor which heightens the need for alternative proof which is strong enough to overcome the presumption that the deceased had acted properly. Of course in this case the alleged cause of the accident requires successive acts of negligence by two witnesses who are deceased, Mr Vernon and Mr Sutton.

The defenders also made reference to the case of Woods v Duncan. I shall later refer to this case fully in relation to res ipsa loquitur but the interest at the present juncture rests in the observation of Lord Simonds in the House of Lords that:

I doubt if that observation casts any new light on the law but it is not difficult to see why the present defenders seek to draw comfort from it. Thus the defenders say the fact that there are intrinsic difficulties in a situation does not lessen the burden on the pursuers.

The defenders made the further point that if one is going to make a case against an individual then it is necessary to put the case to him. The pursuers had claimed that Mr Rankin had failed to check the blind flange and that is probably so but they had not asked Mr Rankin if it was his duty to check the blind flange. This is the case so that I was left with no evidence which would enable me to conclude that Rankin had failed in his duties by not inspecting the blind flange. We were not even told what such an inspection would have consisted of. For example if the flange had not been tightened properly would this have been obvious to the naked eye or was some more stringent test required.

I do not really find any difficulty with the points the defenders have been making in regard to standard of proof. If the main witnesses are lost or important real evidence is unavailable the case is obviously going to be much harder for the pursuer to prove. In arriving at conclusions about a person’s conduct then if the person is dead and unable to defend himself upon any evaluation of evidence the court will find it requires more care before arriving at adverse conclusions. Simply because an investigation is extensive does not lessen the burden of proof and the court must always be alert to the possibility that the case has not been proved. Some complex situations simply cannot be resolved particularly if the best evidence is not available. The Court must be careful to avoid deciding the case simply on the most attractive hypothesis if this does not amount to a clear probability. The problem does not reside in identifying the correct approach in law but rather in applying the principles to a specific situation.

5.2.2 Circumstantial Cases

The defenders maintained that in order for a pursuer to prove a circumstantial case one has to prove incidental or probative facts which when taken together can be held as pointing as a matter of probability to the essential facts in the case. I was referred to Dickson on The Law of Evidence Part II paragraphs 63 and 64. The author points out that evidence may be regarded as direct or indirect. Direct evidence is that which is expressly affirmative or negative of the issue and the only question is whether the evidence is to be believed. In relation to indirect evidence on the other hand ( and this included circumstantial and presumptive) evidence consists of a factum probatus of one kind from which a different fact, the factum probandum, has to be inferred. Consequently there are two inquiries. The first is whether there is proof of the probative facts. The second is whether the fact in issue is deducible from them by inference sufficiently strong to found a verdict. The author also defined a presumptive fact as being "an inference as to the existence of one fact from a knowledge of the existence of some other fact, drawn only solely by virtue of previous experience of the ordinary connection between the known and inferred facts, and independently of any process of reason in the particular case. In the circumstantial situation an inference from circumstantial evidence is arrived at as a result of reason being applied to the facts or reason and experience conjoined".

The defenders relied on that analysis and I accept that its authority is beyond question. Counsel accepted that even if the evidence of one witness may not be reliable enough to establish a probative fact a combination of witnesses speaking to the same fact may restore confidence in the direction of the evidence. Each probative fact must be proved on a balance of probability. Once you have decided what probative facts have been established one had to decide what state of affairs is deducible from the probative material. The defenders maintained that in the present cases it was very difficult to identify the probative facts upon which the pursuers erect their cases.

The defenders say that Mr Vernon’s state of mind is a probative fact that is critical in the present case. The pursuers, so it is claimed, are in some confusion about this matter saying on the one hand that on the evidence Vernon ought to have known that the PSV was not in position and on the other that he would not have attempted to start the pump in the knowledge that the PSV was missing. Since the views of Mr Vernon are unfortunately not available the pursuers have to rely on what the defenders consider to be conjecture to arrive at the state of Mr Vernon’s knowledge at particular points of time. In any event it was claimed that there was no direct evidence of the state of mind of Vernon so that it needs to be proved by circumstantial evidence including evidence of the normal practices on the platform. The second important and necessary fact would be that Mr Vernon re-pressurised the pump. In this respect the defenders claim that there was a direct witness Mr Grieve, who states that Mr Vernon did not pressurise the pump so that the pursuers require to rely on indirect evidence in the face of direct evidence. The third required factual influence is that Mr Sutton left the blind flange finger-tight. The defenders complained that the pursuers do not set out in the presentation of their case the facta probata that they rely on for the inferences needed if their case is to be established. The pursuers attempted to found their case on a broad consistency but that it was argued was meaningless unless the probative facts that are supposed to provided that consistency are indicated. I found a certain difficulty in the approach the defenders urged upon me. I think this stems from the suggestion that the probability of each fact should be considered in isolation. Where the facts are interrelated it may be that a fact which may not be proved if the evidence concerning it is considered on its own can be taken as proved when it is seen how it fits in with other facts. Of course care has to be taken in this connection to avoid circularity of reasoning and the defenders are right that care has also to be taken to differentiate between the established facts and the inferences that these may permit.

The defenders attack the pursuers’ approach to some of the expert evidence since the pursuers seem at times to say that a particular piece of evidence shows that the pursuers’ evidence is possible. If there was only evidence of such possibility then admittedly that would not be enough . However if there was general evidence that on its own pointed to a probability then it might be relevant for the pursuers to anticipate counter-attack by demonstrating that as far as the expert evidence goes it also shows that the inferences which the pursuers are relying upon are acceptable in scientific terms. Of course if the defenders in their extensive analysis were merely trying to say that if there are for example four facts essential to the pursuers’ case then the case cannot succeed unless each of these facts is proved on a balance of probability then of course I could not quarrel with that.

I was referred again to Dickson where at paragraph 108 (1) the learned author observes that "Every one of the circumstances essential to the conclusion should be established by its own independent proof; in other words, the superstructure of theory should only be raised on a foundation of undoubted facts". I can find nothing wrong with that. However Counsel for the defenders conceded that there could be circumstances in which one probative fact may not be enough but a series implying the same conclusion may be enough. As was pointed out Dickson also says " a circumstantial proof is like a chain, which cannot be stronger than its weakest link, and which becomes continually weaker as each new link is added until it breaks under its own weight". However there can be difficulties in the use of graphic analogies like the one used. Thus if there are an added number of strong links the chain may become stronger because the weight on it is better spread. However of course I accept that if a fact critical to the chain of reasoning is not established then the whole argument would fail. Thus taking the eyewitness evidence of Mr Grieve, which the defenders rely so heavily on, if I were satisfied that such evidence was totally reliable and necessarily excluded the possibility that Mr Vernon had jagged pump A then certainly that would eliminate any other circumstantial evidence that may have pointed to the fact that Mr Vernon completed the jagging operation.

Dickson also made other pertinent observations such as at sub-paragraph (7) where he says that " When the inconsistency between any of the probative facts and the hypothesis deductible from the rest of these facts is not absolute but probable, the conclusiveness of that hypothesis is diminished in proportion to the strength of the contrary probability".

5.2.3 Contradictory Witnesses

The defenders also argued that if two or more witnesses are led by the pursuers in support of a critical fact and they contradict one another then if the pursuer does not challenge any of them he is barred from seeking to rely on the witness whose account at the end of the day best serves his purposes.

I was referred to McGhee v The Glasgow Coal Company 1923 SC 293. This case came to the Inner House after a Jury Trial. The case was about an explosion at a pit and the widow of a victim sought to establish a case that there had been inadequate inspection. At the trial three witnesses were led to establish this case. Two of these witnesses said that they saw the fireman at the relevant location and that he failed to make an inspection. The third witness said that he saw the fireman go to the coalface for the purpose of making an inspection. It was held that the evidence as laid before the jury, being self -contradictory upon an essential part of the pursuers’ case was not such as to justify them in arriving at a verdict for the pursuer. Accordingly a new trial was granted. The Court categorised the case as being one where the inconsistency was not one of an accidental nature such as could be disregarded but rather a case of an irreconcilable and unexplained contradiction between witnesses adduced for no other purposes than to establish the point on which they contradict one another. To illustrate the point he was making Counsel referred to the discrepancies between the evidence of Mr Bollands and Mr Clark as to what happened in the Control Room in relation to the red tags. However it may be difficult in a case such as this for the pursuers to know just where the truth lay and they may be prepared to leave it to the Court to see which piece of evidence fits in best with other evidence. They may well have thought that each witness was doing his best to recall facts that occurred in circumstances which were at the end of the day very disturbing and that to suggest otherwise might not be justified. Essentially the pursuers at the end of the day would have to say that the specific evidence of these witnesses on the matters being considered could not be conclusive so that other evidence would have to be looked at to discover, if possible, where the truth lay. In any event the pursuers claimed that their case could be adapted to both versions. In a case such as this much of the evidence has to be decided not on impressions of the reliability of individual witnesses but upon analysis of how these impressions slot in with the weight of the evidence.

The defenders also referred to areas of the expert evidence where experts lead by the pursuers gave evidence which on important issues contradicted one another. This is certainly a difficulty for the pursuers which in specific instances may dilute the value of such evidence.

The defenders addressed me at length on the foregoing questions raised by this section of the chapter. The arguments were somewhat of a technical nature and cover material with which a judge is dealing day in, day out. On the other hand in a case as extraordinarily complex as this one I can understand why it was thought necessary to attempt to delineate the parameters governing my decision about the factual questions. However many of the cases and rules I was referred to are very general and really relevant to particular sets of facts. I find it easier to deal with any of these problems in the concrete as and when they arise.

5.2.4 Expert Evidence

As a preliminary to their detailed submissions on the facts the defenders also addressed me at length on the admissibility of expert evidence. The defenders submitted that it must be established that the witness is an expert and I think that again is pretty obvious. It was said however that questions arise because it is critical that the expert must be expert not only in a general sense but on the question he has been asked to address. It was said that if an expert is led by the pursuers and another expert is also led by the pursuers and he declares that the first expert is not a properly qualified expert at all then the Court is not in a position to know which of the experts to respect. Again I found this submission difficult to deal with in the abstract. It was suggested that Mr Cubbage and Dr Mitcheson were not experts in general engineering problems. However Dr Mitcheson was an engineer and both he and Mr Cubbage had many years of experience in investigating explosions. This would inevitably give them some general experience of the response of structures to an explosion. In relation to a specific issue their experience may not qualify them to express an opinion as well as it would in the case of a specialist structural engineer but this may resolve itself into a question of the weight to be accorded to their evidence. It would not follow automatically that their view necessarily had no value at all. Thus Dr Mitcheson may not have the detailed knowledge of structural engineering enjoyed by Dr Palmer but he could possibly have more direct experience of the response of structures to particular kind of explosion. As I say this kind of question is difficult to decide in the abstract. However the defenders made another point. The fire expert Dr Drysdale, while explaining the theory that the fireball he observed in Module B derived its fuel from a rupture of the 4-inch condensate line, was asked to explain why it had taken some seconds after the initial event before the fireball appeared. He gave a possible explanation by describing what might have happened to the condensate line after the explosion. It was contended that seeing that he was not a structural engineer he had no right to comment on mechanical evidence outside his expertise. Certainly it is true that on a question such as he answered he was at best expressing the opinion of a general fire engineer and his evidence on the matter in question would have to be considered under that caveat. It would also have to be considered that although the pursuers led a number of highly qualified structural engineers they did not ask them to address the issue about the pipe raised by Dr Drysdale. The defenders are right to suggest that the evidence of Dr Drysdale on the matter of what caused the delay in any rupture of the condensate pipe would have to be considered with special care.

The defenders made the second point that if expert evidence is to be admitted then the facts upon which the opinion is based must be made clear. This I think must be beyond dispute. However it was said that it is important that the expert should not be taking any account of an assumption not disclosed in the evidence or ignoring a fact without disclosing it in the evidence. If a witness does fail to disclose an important fact and it emerges in cross examination then one may wonder what weight if any can be placed on the rest of his examination in chief. Again I feel that one has to look at circumstances of particular cases before deciding such a question. Thus in a very complicated case it would not surprise me that cross-examination should throw up a consideration that the expert had not previously considered relevant or even thought about.

I was referred to Davie v the Magistrates of Edinburgh 1953 SC34. That case was decided in the First Division and the leading judgment was delivered by Lord President Cooper. The pursuer had led no expert evidence but the defenders had led three. Unfortunately for them their third expert contradicted the other two. The Lord Ordinary rejected the expert opinion evidence and the defenders reclaimed. They contended that as the pursuers had led no evidence to contradict their first expert his evidence should have been accepted. It was held inter alia that the court was not bound to accept the opinion of an expert even when uncontradicted. It was also held that the opinion of the Lord Ordinary should be affirmed. Lord Cooper observed that the value of expert evidence depends on the authority, experience and qualifications of the expert and above all upon the extent to which his evidence carries conviction. I am very happy to accept that. The Lord President held that the value of the first witnesses evidence would not have been affected if the contradicting third expert had not been led. Experts witnesses however skilled or eminent can give no more than evidence. They cannot usurp the function of the judge. They supply the necessary scientific criteria for testing the accuracy of their conclusion so as to enable the judge to form his own independent judgment by the application of these criteria to the facts proved in the evidence. If the scientific opinion evidence is intelligible, convincing and tested that would be an important factor for consideration. The Lord President points out that the issue in the case has been submitted to a judicial tribunal and not the oracular pronouncement of an expert. An observation which the defenders laid stress on was " if conflicting scientific expert evidence is adduced by a party, he cannot complain if on that account the whole of it is treated with more than suspicion". However in respect of the last point I do not take the Lord President to be laying down any inflexible rule nor to be contradicting the very helpful analysis of expert evidence which he had earlier given. As the Lord President had indicated the value of an expert must in the first instance be assessed in the light of the quality of what he has said. Of course if the experts contradict each other the judge may, depending on what is said, find it impossible to choose between the competing experts. The defenders argued that as a matter of public policy a party should not be in a position to lead expert after expert until he finds himself with one he considers may help his case. If this were done in my view it is unlikely that the opponent would allow the judge to ignore the earlier adverse evidence without there being a need to resort to notions of public policy. However as an illustration of the difficulties the Court can confront if faced with competing evidence the defenders referred to the witness Professor Fenner who had been asked by way of static analysis to calculate the over pressure for static failure pressure on the C/D firewall and he came up with a result of 0.011 bar. Professor Fenner had been led by the pursuers and they did not challenge his result. Later they led Dr Palmer and he calculated the same matter but came up with a result that was substantially greater than that of Professor Fenner namely 0.16 or 0.18 bar. The pursuers did not challenge that result either. The defenders suggested that both results would have to be ignored because it is impossible to adjudicate between them. However it has to be noted that these experts used a different methodology and obviously what they were trying to do posed an immensely difficult scientific problem. One expert arrived at his conclusion after a beam analysis whereas the other used plate theory. Thus for example it might be possible to say that the actual figure is likely to rest somewhere between their respective results or, as indeed I shall say, that one expert arrived at his conclusion by use of what was accepted to be a more refined method. On the other hand the evidence I mention has to be tested by reference to the evidence of Professor Reid who said that manual methods of calculating the matter in question are unreliable. Moreover the defenders make the point that rather than give Professor Fenner’s calculation to their witness Dr Bakke (who needed such material as a starting point for his own work) they led another witness Dr Palmer and arbitrarily gave his results to Dr Bakke because it brought out a better result for them. Certainly the defenders do not have difficulty in persuading me that the expert evidence in this case is extremely difficult to unravel.

The defenders argued that an expert who is privileged to address the court on matters of opinion has certain responsibilities. I was referred to The Ikarian Reefer (1993) 2 Lloyds Law Reports 68. This like the present case was an extensive proof (100 days in The Ikarian) and there were many experts adduced as witnesses. Lord Justice Cresswell made comments on the duties and responsibilities of expert witnesses. These he summarised as follows;

The analysis then deals with other matters of less relevance to these cases. There is no doubt that his Lordship’s formulation of an expert’s duties is helpful and correct. The question of expert evidence was also considered in John Pierce v Her Majesty’s Advocate 1981 SCLR 783. The case was not fully reported and the Opinion of the Court which was dated 19h June 1981 was made available to me. This was a case reviewed by the Court on a referral by the Secretary of State and the substance of the referral was the possible doubt about the evidence given at the trial by a forensic expert. The expert had made an assumption which was not a justified assumption and he had not disclosed the assumption to the Court. The Lord Justice General observed after considering the position that had arisen.

He concluded that the expert in question had been discredited not only as a scientist but as a witness upon the accuracy, fairness, and objectivity of whose evidence reliance could be placed. The defenders said that the two cases I have just quoted bear special relevancy to the position of Dr Mitcheson whose evidence I shall later consider.

A final point which the defenders made about expert evidence is by their own concession a trite one and is that where an expert opinion is based upon a particular version of the facts or on assumptions then the opinion is only going to be of value if these facts or assumptions are proved. Thus the expert in the course of his evidence should make clear the facts or assumptions central to his opinion. Further these facts or assumptions have each to be proved on a balance of probabilities. I think it has to be recognised that the proof which parties required to conduct was most exceptional. The proof lasted a number of years, the disaster on any view was exceptionally difficult to explore, there were many witnesses expert and non-expert, and the technical material was difficult and protracted. It was quite obvious that because of the scale of the proof, the parties’ cases were to a degree developing as the evidence itself developed. Thus is do not find it the least surprising that certain points may not have assumed the importance at the time when evidence was led that they assumed later. I do not think that Counsel are to be criticised if on occasions they omitted to ask a question which at a late stage of the case they may wish that they had asked. Moreover if a party is not expecting a particular matter to emerge this may be less important if many months of proof lie ahead during which the point may be investigated. Thus within the limits of the technical restraints I was generally inclined in this case to give considerable weight to the considerations of fairness to parties and risk of prejudice rather than any mechanical application of more specific principle. Moreover, again subject to the limits of fairness and technical restraints, considering all the effort that has gone into the case I think it is important that the case should be decided after as wide an exploration of issues as is necessary. It would be unfortunate if the factual issues in this case required to be determined on the basis of an artificial reality.

The accident happened at 22.00 hours on 6 July 1988. At the time the weather was good and visibility was clear. There was a wind speed of 16.4 knots and this was from a direction of 164.4 degrees true. The wind speed is confirmed by a print-out taken on the Artemis system of dynamic positioning on the Lowland Cavalier. This was taken at 22.00 hours on the night of the accident. The platform itself was 43 degrees counter clockwise from true north so that in relation to the platform the wind was blowing at 207 degrees in relation to platform north. The Artemis system also records that it failed at 22.01 hours and 10 or 16 seconds the inference being that the system failed because of the explosion. The Tharos log spoken to by Mr Kondol records that the explosion and the procedures that were then put in train occurred at 22.02 hours. Given that the record is not only of the explosion but of consequential actions taken the log puts the time of the explosion as very close to 22.00 hours. The eyewitnesses put the accident at times which vary marginally but generally can be said to be about 22.00 hours and indeed there is no dispute about this time.

At the time of the accident there were a number of vessels in the vicinity of the Piper Alpha platform. One of these was MVS Tharos and as a result evidence was given by Mr. Flaws, Mr Murray and Mr Miller who were on that vessel at the relevant time and can speak to various observations connected with the accident The weight of the oral evidence is to the effect that Tharos was about 550 metres from the platform and its stern was facing the west face of the platform. That distance is consistent with entries in the log of Tharos. At the time of the accident Mr Flaws and Mr Murray were on the helideck lounge of Tharos. Mr Miller was on the helideck itself, towards the starboard side of the heli-reception and when the accident occurred he was about to take photographs for a school project. He was thus in a position to take photographs of the platform almost immediately after the accident occurred and this he did. His photographs were produced and clearly provide valuable and relatively reliable evidence of how the platform appeared to those on Tharos immediately following the accident. After he had photographed for about 15 seconds he changed his position and thereafter took photographs from the starboard side of the vessel before returning to his original position and taking further photographs. Quite detailed evidence was given of Mr Miller’s precise position as he was photographing but I doubt if anything turns on that. At the time of the accident the witness Mr Kondol was asleep in the upper deck of the accommodation beneath the helideck and his window looked out to the west face of the platform.

Another vessel off the platform was the Lowland Cavalier which had been engaged in trenching a pipeline under the seabed. There were three of the witnesses aboard this vessel namely Captain, Mr McDonald and Mr Ritchie. At the time of the accident the stern of Lowland Cavalier was about 25 metres from the west face of the platform. Captain Clegg and Mr McDonald concurred on this measurement. The boat was positioned between the legs of the platform B1 and B2 which are at the south-west corner of Piper Alpha. The photographs, number of process 12/358, give some additional confirmation of the position of the vessel and it was about 85 metres long and 17 metres wide. The aft bridge was 50 metres from the stern and Captain Clegg was on the aft- facing control room on the bridge when the accident occurred. This would have placed him at about 56 feet above sea level as compared with the height of 84 feet of the production modules. Captain Clegg’s own position when the accident happened was about 75 metres from the south-west corner of the platform and his line of vision would have been about 25 feet below the mouth of the Modules. He was accordingly well positioned to see the west face of the platform.

There was one witness from the Maersk Cutter and that was Captain Morton, the master. The vessel at the time of the accident was on standby one mile north-east of the platform. It was sitting side-on to the platform facing in a north-westerly direction. Captain Morton was on the bridge which had a 360 degree vision. He was looking out of the port side at the forward end of the vessel and his bridge was about 30 feet above sea level. Another vessel was the Maersk Leader. Mr Anderson was the witness from that ship and he produced a video which he had taken at the time of the accident The Maersk Leader was on standby for anchor handling and the vessel was two miles from the platform in a southerly direction away from the tip of the east flare boom. After the explosion the ship moved and ultimately ended up at the west side of the platform behind Tharos.

The position of the Silver Pit is perhaps the only ship whose position caused a degree of controversy. This is because the position of the ship had only become material when the defenders led the witness Mr Haffey who had been aboard that ship . In these circumstances the pursuers themselves had led no evidence on the matter such as log books. Mr Haffey was a deck hand on his first trip and had been on board the ship for two or three weeks. However he had had experience in the Royal Navy. As he was going to bed in his cabin shortly before the accident he had heard a double bang and after perhaps thirty seconds he looked out of his cabin window ( which was a starboard hatch ) at the platform. When he thus looked he claims to have seen what looked like a cloud of dirty white smoke emanating from the heat shield in the area between the two flare booms. That would have placed the smoke coming from the south side of the platform at an area which runs alongside Module A. He placed the Silver Pit off the south-west corner of the platform although he felt unable to venture a distance. However he did eventually say that he was within a mile of the platform. There was no other evidence to give his view support and because of the stage at which his evidence emerged it was not put to the pursuers’ experts. His placing of his vessel was not very confident and in cross-examination he accepted that Silver Pit could possibly have been off the north-west corner of the platform. The photographs number 12/358 of process 19 and 20 seem to place the Silver Pit in that vicinity. Mr Haffey identified the ship himself. He remembered seeing Tharos, the Maersk Cutter, possibly the Lowland Cavalier and other supply ships. His most confident recollection is of seeing the Tharos and the Maersk Cutter and this would be achievable if he were at the north-west corner which would place him between these two vessels. When asked he could not recollect where Tharos had been in relation to Silver Pit (although the former is a large vessel). If the Silver Pit had been off the south-west corner of the platform as the witness originally opined this would have placed it quite close to Tharos . He does not claim to have seen anything along the west face which is at variance with other witnesses and with photographs taken by Mr Ritchie from the Lowland Cavalier and by Mr Miller from the Tharos . Indeed in these photographs there does not appear to be any sight of Silver Pit in the area where Mr Haffey first claimed it to be. However photographs show it to be in a position consistent with it being at the North West corner of the platform (and with its bow facing south). The upshot of his evidence was that it became clear that Mr Haffey had an unclear memory of events and I would be hesitant to place much reliance on his evidence on matters of detail. Moreover he personally was involved in operations on a rescue craft, no doubt bravely, and this may have rendered his recollection of events more confused than in the case of others. Of course the Silver Pit may have moved position in the course of the evening but this is perhaps unlikely in the case of a ship acting as base for a rescue craft.

5.4.1 The Detectors

The pursuers rely heavily for their explanation of the accident on the pattern of gas detection alarms observed just before the accident so that an understanding of the alarm system is important.

The pursuers’ witnesses who dealt with the matter were mainly Mr Wottge, Mr Scothern and Mr Tea. Mr Wottge was I have said the pursuers’ Facilities Engineering Manager with knowledge and experience of the construction details of the platform over an 11 years period. Mr Scothern was aged 56 when he gave his evidence and now teaches and consults on fire and gas systems. He had started off his career as a mechanical technician in the Fleet Air Arm. In 1977 he was employed by the Wood Group as a Fire and Gas Technician and after completing a course with alarm manufacturers went offshore as a Product Engineer. In this capacity he commissioned a number of systems including the Piper system. In 1977 he was employed by OPCAL on Piper Alpha as a Instrument Technician but he was in practice the fire and gas technician. He left the employment of OPCAL about August 1987. When he left Piper he was replaced by Mr Wakefield who died during the disaster. After leaving Piper Mr Scothern transferred to Claymore but he made it his business to keep in touch with what was happening on the former because he was hopeful of returning there. The witness Mr Tea was employed on Piper at the date of the accident although fortunately he was off the platform at the time. At the time of the proof he was 47 years of age. His position was that of Instrument Technician and he was Mr Scothern’s back to back and worked under his wing. His job was to keep the gas and fire detection system in a good state of repair. The defenders urged me to regard Mr Tea as a much more reliable witness than Mr Scothern. This was not necessarily my impression at the time in respect of all evidence. Both witnesses were trying their best to remember matters of detail. Mr Scothern had been longer removed from a position on Piper Alpha than Tea. However he had at least some knowledge of developments in the alarm system after he left because he had kept in close contact with his successor Mr Wakefield. However both witnesses were speaking to events and situations that when they gave their evidence were some years in the past. It is a further point that just before the accident Mr Scothern had worked for almost a year on Claymore and this being similar to Piper Alpha there may have been some room for a confused recollection. Certainly I am prepared to accept that Mr Scothern maintained a genuine interest in the gas detection system on Piper Alpha until the accident. There was a dispute between Mr Scothern and Mr Tea as to whether the detector 103/1 faced upwards or down. In this respect Mr Tea may have had some advantage since he had been working on that particular detector shortly before the accident.

Detectors generally were placed in areas where it was thought that escapes were most likely to occur and also where the airflows were most likely to direct gas. The low placed detectors were aimed at detecting the heavier gases and the high placed detectors the lighter gases

With regard to Module C the location of the gas detectors is as shown in the drawing which is 12/112 of process (and 12/109 which is to scale). All the detectors pointed downwards. The areas where detectors were placed were zoned into areas C1, C2 , and C3 moving to the east from the west. Module C has 5 zones in all. C1 was west Module C, C2 was east module C, whereas C3, C4, and C5 were related to the centrifugal compressor compartments. Each zone would have a number of alarms common to that zone. There were audible and visual alarms for particular zones in particular Modules so that the Control Room Operator could identify the zone in which the alarm had annunciated. There was also a visual indication in the Control Room as to what was the cause of the alarm i.e. fire, gas, etc. Once the Control Room Operator had identified the zone where trouble appeared to be present he would communicate with the operator responsible for the zone so that the matter could be investigated. Thus there is a system to pinpoint the source of a possible difficulty. Moreover if there was an alarm certain beacons lit up in the Module itself to warn operators that there was a pending alert.

The alarms G100/1 and G100/2 are to the west of the module and would have gone off had there been a gas cloud in that area. As to the heights of these particular alarms there is some minor disagreement on that issue between Mr Scothern and MrTea but I do not regard this as significant. Indeed the assumptions as to the heights of alarms which were given to the pursuers’ expert Dr Davies were as is set out in the flip-chart 44/117 or process. The next detectors moving west to east are G22, G23, G24, and G25. Mr Scothern places these in the roof space at a height of between 20 and 24 feet and there was no conflict about this. I think that such alarms as were attached to roof beams were likely to be at a height of at least 20 feet. Those attached to angle irons would be some feet lower. Thus for example G101/3 was attached to an angle iron and was said to be at a height of about 15 feet. The detectors I have described so far were in zone C1. The next group of detectors were in zone C2, that is more towards the east of the module. Detector G101/1 is the first detector encountered to the east of the reciprocating compressors. There was some discrepancies in the evidence as to the height of this detector. Mr Scothern places this in the roof space at a height of about 20 feet whereas Mr Tea gives three figures varying between 15 and 20 feet. On this matter I preferred Mr Scothern because Mr Tea was rather uncertain in his recollection and it is also not clear how that detector would be attached at a height of 15 feet. Going again to the east and rather to the north the next detector is G 101/2. Mr Scothern had this located at a height of about 20 feet but Mr Tea had a clear recollection the he had relocated this device at a height of about two to three feet above deck level. Mr Tea seemed to be clear about this particular matter and gave detail which has prompted me to accept him on the question. One point worth noting is that if such condensate as flashes or gas which may escape at the relevant location tend to be lighter gas why was it thought necessary to relocate the detector at a lower level?. The detector G101/3 in zone C2 was above centrifugal compressor B and was at a height of 15 to 20 feet. Again there is a discrepancy between the witnesses but Mr Tea is in a position to be more specific with regard to his estimate of 15 feet. He claimed that he could get access to this detector by standing on the compressor. However there is an element of imprecision about the heights of the higher detectors.

Zones C3, C4, and C5 covered the detectors associated with the centrifugal compressors and in particular detectors G28, G31, and G34. C3 was at C centrifugal compressor, C4 at B, and C5 at A. G 103/1 is between compressors C and B, G103 /2 is between B and A and G103/3 is on the north side of A. These particular compressors monitor the fuel gas valve enclosures. The detectors G26, G29, and G32, all monitor the compartment ventilation air intakesand thus can monitor air coming from the exterior. They are located outside the module. Thus G26 is inside the air vent to the turbine compressor compartment. That is to say that the air taken in at that point ventilates the turbine compartment as distinct from the turbine machine. Then it exhausts from the louvre in Module C. The louvre however can only exhaust air not ingest it. In general it seems unlikely that G26 would detect gas from within the module. The defenders maintained however that the detector could detect gas coming from Module B. The defenders maintained that Dr Davies was proceeding on the false assumption that each compartment had two louvres. G27, G30, and G33 are located at the turbine compartments of the compressors. G27 had originally been located inside the cabinet but had been moved outside by Mr Scothern and connected inside by a tube. Thus it was capable of detecting gas inside the compartment itself. There was some controversy as to whether it was capable of detecting gas from outside the compartment. However Dr Davies eventually gave the considered view that if there was a relatively large cloud of gas outside the compartment it could find its way to G27. This was because of gas diffusion. On the other hand the cloud of gas would have to be relatively substantial to survive the effect of dilution by air. I think this view must be respected. On the other hand Dr Davies’ view was expressed on the basis that the compressor was running He accepted that the position might still be favourable to gas detection if the compressor was not running although he had not quantified that possibility. Later Mr Tea had also moved G30 and G33 outside their related compartments. These detectors were at a height of about 3 feet above the grating and all faced downwards. G28, G31, and G34 are each located at the west end of the respective compressor compartments and within them. It was not suggested that they could sense gas from outside the compartment itself. G1O2/1, G102/2, G102/3 and G102/4 are at the combustion air intakes for the gas turbines. The approximate arrangement of gas detectors within each compressor compartment is shown in the schematic 12/128 which relates to compressor C. In particular the approximate positions of detectors G103/1, G26, G27, G 28 and G102/2 are shown. G 02/2 was one of the common alarms (zone C3 and zone C4) and was about 8 feet up in the intake ducting . Another detector G102/1 is equivalent to G102/ 2 but on the opposite side of the compressor. This detector is linked only to C3. It has to be noted that detectors G102/3 and 102/3 are located in turbine intake compartments common to two machines. Each compressor took its air from two intakes and the ones in the middle of the series were covered by the same canopy. Thus if gas was detected by G 102/2 this could refer to both zone C3 and C4. On the other hand if a common detector goes off it will signal at two zones. But the existence of a common detector could explain why Mr Bollands saw gas alarms annunciating at zones C4 and C5 at the same time. In relation to compressor B there is G102/3 and G102/4. The detector G103/1 monitoring the fuel gas valve enclosure in compressor C was located below the walkway grating and was connected by a tube to the box arrangement around the fuel valve although the actual detector was outside the box. It could sense gas outside the box. The defenders contended that any gas which dropped below the walkway grating within the Module and then arrived at G103/1 would be within the upward airstream being drawn into turbine air intake. Since the Compressor did not trip until after the first gas alarm the air intake would still be operative when the detector would see gas It was claimed that there would have to be a considerable quantity of gas to withstand the dilution effect of the air. Dr Davies on the other hand thought that the matter was finely balanced and depended on the exact structuring of the relative walkway, the location of any solid plate gratings and the position of the actual head of the detector. When Dr Davies did his modelling exercises the relevant probe was outside the module. In general he seemed to consider that the plans and drawings leave some degree of doubt as to the exact location of the detector. Certainly since there had been various changes to the detectors from time to time it is difficult to locate the actual detector head precisely with confidence although if it was not actually outside the confines of the module it was close to being so. Moreover it was slightly to the east of the combustion intakes. During his cross-examination he was asked to assume that the quantity of air at the combustion intake was 1 to 2 metres per second. He was also asked to assume that the air being drawn up for combustion purposes flows past the detector head. The defenders never proved these assumptions. There were similar arrangements for G103/2 and 3. These detectors had originally faced upwards but not long before the accident had been altered to face downwards.

The point emphasised by the defenders is that since about 80% to 90% of the compressor air intake is drawn from the atmosphere and only about 10% to 20% from within the module then there was a possibility that the alarms were triggered by gas originating in Module B. The ventilation air intakes were substantially higher than the combustion air intakes. The ventilation air intakes in a general sense point south while the combustion air intakes point downwards.

In relation to Module B there was some controversy with regard to G99/4. Otherwise the general layout of the detectors is shown on the drawing 41/1 of process. In Module B we have zones B1 and B2 being approximately the west and east half of the module respectively. Detectors in B1, namely G13 through to G18 were located in the roof space. G13 and G14 were the furthest west. G15 was above the Prover Loop and this may be important since the defenders regarded the loop area as a possible source of the explosion. G16 was to the west of the MOL booster pumps. G17 was located close to the pig launcher. G17 was on the south side above the manifold. In relation to zone B2, G19, G20, and G21 were all at ceiling level as shown in 41/1 of process. G99/1, G99/2 , G99/3 and G99/4 were all in the area of the separators. These had been added sometime after the initial construction of the platform and were all placed in low positions just above the floor. Mr Scothern had a clear recollection of the height of these detectors. Mr Tea perhaps placed the detectors a little higher than Mr Scothern but the latter in this matter appeared to have a much more crisp memory of them and got a measure of support from the witness Henderson. Moreover these detectors had not been moved after Mr Scothern left the platform. The defenders had claimed in their pleadings that at the time of the accident the gas detectors in Module B may not have been operative because they were "pinned out" but they indicated during submissions that they were not insisting on this point.

The detectors at the 68 - foot level were as shown in the drawings 12/121 and 12/119 of process. There was again a measure of difference between Mr Tea and Mr Scothern with regard to the respective heights of G127, G128, and G129 but these are not material. What is material is that there were detectors at the open east end of the level beneath Modules B and C.

5. 4.2 The Gas Alarms

The gas detectors were linked to the Seiger 1400 series control modules within the Control Room by cabling via one or more junction boxes. These control modules were in racks behind the fire and gas panels If there had been any interruption of this connection it would have triggered off a fault panel on the alarm panel in the control room. Moreover if a gas detector failed or a fuse blew or if there was failure of power at the alarm, a light and buzzer alarm would go off in the Control Room. However a mere fault in the sensitivity of the detector would not register. If a detector were to register gas a signal was transmitted to the Control Room and the operator could identify the particular alarm which was registering (as distinct from the group of alarms) by recourse to the control modules. This would enable the relevant operator to be contacted and asked to inspect the situation at the alarm which has registered. The Control Room operator sits in front of the panels which register various alarms throughout the platform including the gas alarms.

The alarm panel was located between the production mimic and the fire and gas matrix and mimic. These arrangements are illustrated in the productions 12/203 (a photograph of the Control Room), 12/188, and 14/9 of process. The alarm panel provides an immediate signal in the event of a fault in the detection system or the triggering of a gas detector. Each alarm signal is by way of a flashing light and very loud buzzer. If a buzzer annunciates the operator having noticed it presses the mute button on the panel which silences the buzzer and converts the light to steady state. To acknowledge the visual indication of an alarm (which is by way of a light) the operator would press an accept button. On the alarm matrix panel itself the operator would only be shown the zoning of the alarm which had annunciated but not the precise alarm which is only shown at the control module. The alarm panel is the panel directly below the red rectangle to the right of the major board (the production process mimic) in the centre of the said photograph. The production 14/9 is a representation of the alarm panel. LED lights at the top of the panel shine continuously and will indicate that the electric supply is on. A back-up system provided power should the normal alarm supply fail. The fire and gas panel

(on which the flashing lights are situated) is on the right of the alarm panel. The Production Process Mimic mimics the production plant and alarms relating to specific pieces of production equipment (such as for example the compressors and condensate injection pumps) are specifically indicated. At the bottom of the panels are series of special switches such as the emergency shutdown buttons. At the very top is an alarm panel showing the lights for common alarms relating to the process system. That is where the high level alarm from the JT flash drum would enunciate. On the lower panel there was a button with test lamps and this would be pressed daily to make sure that all the lamps on the panel were working. The alarm panel system also incorporates other alarm systems which I am not concerned with.

The overall position is that the Control Room operator received an immediate indication of any alarms which went off indicating low or high levels of gas concentration and although he would not know before consulting the control module just what precise alarm had annunciated he could immediately ascribe it to a particular zone in a particular module. The drawing 12/202 of process gives the layout for the fire and gas matrix and mimic. In that drawing the production deck section shows the various zones represented and these include all the fire and gas zones in the A and B modules and each has a LED light which would indicate if one of the gas alarms went off. This would enable the operator to know in which zone the detector had detected gas. If an alarm had shown a certain level of gas in a certain zone then once it had been accepted and returned to a steady state it would flash again if a further detector in the same zone detected gas. Once a particular detector has given a signal it can not show again until it has been reset by an operator at the control module but an adjacent alarm could signal. At one point the defenders suggested that there may not have been an alarm to cover zone C2. However the possible discrepancies in the drawing were explained to my satisfaction and I am satisfied by reference to all the drawings as explained by the witnesses that there was at the time of the accident an alarm covering C2.

5.4.3 Gas and Equipment Alarms Annunciating at Accident

The only alarms which annunciated in the Control Room shortly before the accident related to detectors at the east end on Module C. The critical evidence of the alarm pattern before the accident came from Mr Bollands who was acting as the Control Room Operator at the time of the accident Mr Bollands was an experienced production operator who rotated through various duties as a production operator but he was working in the Control Room on the evening of the accident having begun his shift just before 6pm. The events immediately leading up to the explosion not only directly involved him but obviously produced a powerful impression on his mind. Insofar as he was talking about his experience at the control board I think his recollection is likely to be accurate. He also indicated that he was repeating the information which he had imparted shortly after the accident in 1988. In very broad outline he gets support in respect of certain events from Mr Clark (the Maintenance Lead Hand on duty at the time of the accident) who was also in the Control Room when it occurred.

The first untoward event that Mr Bollands noticed was that an alarm signalled that the condensate injection pump had tripped. This occurred shortly before 9.45pm. The time of the tripping can to an extent be derived from the fact that Mr Bollands left the control room to telephone his wife about 9.30pm. and then returned to the control room about 9.40pm.. I think the condensate pump must have tripped no later than about 9.40 because it was only after Mr Vernon’s return to the control room after a visit to the 68-foot level that he contacted Mr Clark. Mr Vernon was the Lead Production Operator who was on duty and in immediate control of production at the time Mr Clark said that he had received Mr Vernon’s message at 9.45pm and I think that is a time that is likely to be reasonably accurate because Mr Clark had looked at his watch when the message came. Mr Clark, as is perhaps understandable, seemed very anxious to deny any knowledge of the status of PSV 504 at the time of the accident but he would have no interest in distorting the time when he got a message to call Mr Vernon and his evidence on this gives a reliable point of reference. Mr Vernon certainly did not contact him until some minutes after the pump trip alarm had annunciated. Mr Vernon was in the Control Room at the time the alarm went off. Mr Bollands shouted over his radio to Mr Richard, who was the Phase 1 Operator on duty, to tell him that the pump had tripped and at the same time Mr Vernon left the Control Room to go and investigate the situation. Before this the alarm which had sounded had been accepted so as to mute the audible alarm and convert the lamp from a flashing state to a steady state. At this time Mr Clark was in the Maintenance Office. After Mr Vernon’s departure the next thing Mr Bollands was aware of was that the JCP panel alarm relating to the 68-foot level went off. He accepted it and told Mr Richard that there had been this alarm and that it probably related to the high level in the JT Flash Drum. In relation to the JCP panel alarms to know precisely which particular alarm had sounded as distinct from knowing the equipment area to which it related it was necessary (as with the gas alarms) to consult the control modules which were situated at the rear of the control panels and it was often not practicable to do this until the emergency signalled by an alarm had been dealt with. However with the condensate injection pump tripped it was expected that the level in the JT Flash Drum would rise since the pump would stop pumping away condensate coming from the production process. The matter of identifying an alarm with precision (as follows from what I have said earlier) also arises in relation to gas alarms since a particular alarm as I have explained above will only indicate the level of alarm and the gas zone in a particular Module which has triggered it. To identify the detector in the Zone which has responded to gas it would be necessary to consult the control modules. This factor gives rise to certain problems in this case because in relation to gas alarms which were triggered before the accident it is at best a matter of inference just what detectors in a zone caused the alarm to go off. Mr Bollands thought that the JCP panel alarm had sounded about 3 to 4 minutes after the injection pump had tripped. The witness Mr Grieve when he came to the 68-foot level three minutes or so before the explosion in fact noted that the liquid level of the JT Flash Drum was relatively high. When Mr Bollands contacted Mr Richard about the JCP alarm he asked him if he had unloaded the reciprocating compressors. To recycle and unload the reciprocating compressors would stop gas going forward into the JT valve and the consequent reduced production of condensate would limit the inflow to the JT Flash Drum. Accordingly he would have expected Mr Richard as the operator on duty to have unloaded the reciprocating compressors but he could not remember how Richard had responded to his query. However Bollands describes how Mr Vernon had returned to the control room about 5 minutes before the explosion . Given that Mr Vernon sent Mr Clark a message from the Control Room at about 9.45pm it seems likely that he returned to the Control Room rather earlier that Mr Bollands remembers. The estimates of times given by the witnesses are essentially approximate but if Mr Vernon had first left the Control Room about 9.40p.m. he must have been away at least 5 minutes if his return to the Control Room was at about 9.45pm. It is clear that the explosion occurred close to10pm. When Mr Vernon returned to the Control Room he told Mr Bollands categorically that he had unloaded the reciprocating compressors. This information would be consistent with the observations of other witnesses who had noted an increase in flaring shortly before the explosion. The unloading process would have caused an increase in the gas going to flare. We do not know whether it was Mr Richard or Mr Vernon personally who completed the unloading procedure (which would have just taken a minute or so) but Mr Vernon on proceeding from the Control Room to the 68-foot level (and also on returning there) would have passed through Module C close to the reciprocating compressors and may have taken advantage of the opportunity to unload them. It can be inferred that upon entering Module C Mr Vernon neither saw gas vapour nor smelt any unusual degree of gas. In any event since the condensate injection pump had first tripped at least 5 minutes or so had passed and at that stage no gas alarms had been noted.

The next event of significance in the Control Room was that there was a low gas alarm at the zone C3 (which is the zone attributed to the centrifugal compressor C). The pursuers accept in their pleading that there was such an alarm. First Mr Bollands heard the buzzer and then identified that the alarm came from zone C3. He describes this C3 alarm as occurring about two to three minutes before the explosion. The pursuers contend that this first gas alarm must have been due to an attempt by Mr Vernon to start condensate injection pump A by jagging it for the purpose of re-introducing pressure to it. It may be significant that Mr Grieve who was at the 68-foot level when the explosion occurred arrived there from the Phase 2 Gas Conservation Module some minutes before the explosion. When Mr Bollands heard the first gas alarm he silenced it by accepting it and then he contacted Mr Richard. I would have expected that he did this fairly quickly after the event. Mr Richards thereafter left the 68-foot level to investigate the gas leak as would be expected. The point is that Mr Grieve was present at the 68- foot level when Mr Richard went off to see about the leak although he himself did not know why Richard had left the 68-foot level at that time. In order to get from the Phase 2 Module to the 68-foot level Mr Grieve had descended stairs which are just outside Modules B and C at the point where they meet. He claims that he had noticed nothing unusual as he passed this point which would suggest that there was no massive flow of gas between the Modules just before the first gas alarm noted by Mr Bollands. Mr Vernon when he had returned to the Control Room had told Mr Bollands that his attempts to restart Pump B had failed and he expressed the intention of attempting to recover Pump A from maintenance and to start it. Apart from any other significance this information may have had it reinforces the view that Mr Vernon’s first visit to the 68-foot level must have lasted quite a few minutes. He would have required some time to get down to the 68-foot level and back while presumably any serious attempt to restart pump B would have taken at least a few minutes. Nor does it seem likely that he would have on the occasion of his first departure from the Control Room have begun to restart pump A. This is because pump A could not have been started without being electrically de-isolated and indeed it was to see if he could achieve this that Mr Vernon had contacted Mr Clark. Since Mr Vernon had contacted Mr Clark at 9.45pm he must have returned to the Control Room about that time. There is some division in the evidence as to what happened after Mr Vernon contacted Mr Clark. Mr Clark thought that after he got a Tannoy message to contact the Control Room he had telephoned there and presumably he did not waste any time in doing so. He is somewhat tentative as to what happened after he made the necessary call. He certainly claims that there was communication with Mr Vernon about the status of pump A and Mr Vernon’s intention to restart that pump were it practicable to do so. Mr Vernon wanted Mr Clark to sign the portions of the red tags which had originally been prepared to warrant the electrical isolation of the pump and which required to be signed by the designated and performing authorities so that the pump could be de-isolated. However he could not recollect if he had spoken directly to Mr Vernon or communicated through Mr Bollands as an intermediary. Mr Clark claims that he then descended to the Control Room to sign these tags. When he arrived there he claims that Mr Vernon had left the tags for him but was no longer present in the Control Room. Mr Bollands on the other hand said that Mr Vernon was still present in the Control Room when Mr Clark arrived. I find it difficult to come to a concluded view about this particular discrepancy in the evidence although Mr Clark might be supposed to have a better memory as to whether or not he had spoken to and seen Mr Vernon. However Mr Clark may have difficulty in accepting that he actually saw Mr Vernon to shield himself from any suggestion that he had discussed the position about the PSVs. In any event it is clear that he arrived in the Control Room only a few minutes before the explosion. Mr Bollands himself confirms this. After receiving Mr Vernon’s communication Mr Clark had required time to descend to the Control Room, to sign off the tags, and to seek to obtain an electrician . His first attempt to secure an electrician were not very successful since the electricians first contacted had gone off duty. All this happened before the explosion and the time needed would probably be consistent with Mr Clark’s assertion that he received the original message about 9 .45pm. He must have taken a few minutes. It seems clear that Mr Vernon had left the Control Room before the first low level alarm went off and the fact that Mr Vernon was present at the 68-foot level when Mr Grieve saw Mr Richard get the message about the gas alarm not only confirms this but suggests that Mr Vernon must have left the Control Room some minutes at least before the first gas alarm. Indeed given the time required to contact Mr Clark and communicate with him it would be surprising if Mr Vernon left the Control Room for a second time much before about 9.50pm. Mr Bollands thought that it had been about 9.55. Thus at best Mr Vernon had about 10 minutes for his return to the 68-foot level before the explosion and quite possibly less. If as the witnesses seem to agree there was a gap of about two to three minutes between the first gas alarm and the explosion Mr Vernon possibly had at best up to 7 minute or so between leaving the Control Room on the second occasion and the first gas alarm. Some of this time would have been spent in getting back to the pumps.. The pursuers suggest that Mr Vernon must have jagged condensate injection pump A at least once before Mr Grieve arrived at the 68-foot level and he would in fact have had time to do that even allowing for the fact that the air supply to the GOV system would have required reconnection and vents on the pump would have required adjustment. Indeed it would have been possible for Mr Richard to have performed some of the preparation work while Mr Vernon was returning to the Control Room. However Mr Vernon must have taken say a minute to get from the Control Room to the 68-foot level and Mr Grieve was present there for at least about a minute before the gas alarm during which time he did not see Mr Vernon jag pump A . It follows that the time available to Mr Vernon to jag the pump must have been a very narrow slot of about 5 minutes at the most. That of course would have been enough for the operation or operations being considered. In this chapter I am principally concerned about the sequence of alarms that was noted by Mr Bollands but the timing of these is finely related to what activities may have been taking place at the time of the explosion.

When gas alarms went off on the night of the accident Mr Bollands could have discovered which particular detector was alarming by referring to the control modules behind the alarm panels but he explained that such was the development of events that he did not have an opportunity to do this. The function of the control module is to amplify the signal so that it shows up on the alarm panels. To resort to the control module would take the Control Room Operator about 2 minutes. The implication of not going to the control module is that the same detector cannot send a second signal of the same type to the Mimic until it has been reset at the control module. There can only be one light for each zone on the Mimic until the zone light has been reset. However this not preclude a second audible alarm.

Mr Bollands describes how just after (perhaps a minute) the first gas alarm annunciated either centrifugal compressor A or C tripped . Shortly after that a further centrifugal compressor tripped and immediately before the explosion the third such compressor tripped. Thus by the explosion all three compressors had tripped. Mr Bollands then described how about two minutes or so before the explosion he got the detectors at A and B centrifugal compressors showing low level alarms (zones C4 and C5) and as fast as he would accept an alarm another would annunciate. He also got a low level gas alarm from zone C2. Thus C2 ,C3, C4, and C5 had all annunciated and he distinctly remembers an unbroken line of lights for these four alarms on the matrix. However he could not remember the precise sequence of this final flurry of low level alarms so that C2 may have annunciated before the compressor alarms. Eventually he received a high level gas alarm and the pursuers admit on the closed record what Mr Bollands confirmed namely that this alarm was in respect of a detector at one of the centrifugal compressors. The defenders argued that this admission bound the pursuers and that it does not fit into Dr Davies’ evidence. I think the defenders are perhaps trying to make rather much of this pleading point. The pursuers’ admission is in answer to an averment by the defenders that the high level alarm was "at" a centrifugal compressor. This is not quite the same as saying it was "within" or "on" such a compressor. Some of the C2 alarms were quite close to the compressors. However the point may not matter for Mr Bollands himself asserted that the high level alarm came off one of the compressors. This cluster of alarms were annunciating just seconds before the explosion and the high level alarm came immediately before the explosion. Mr Bollands related the high level alarm to one of the reciprocal compressors but he could not say which. The high level alarm had come in and Mr Bollands was trying to talk on the radio when the explosion occurred and blew him off his feet. The blast which toppled him came from his right. There were no alarms from Module B or the 68-foot level.

The alarm first noted by Mr Bollands was activated by one of G28, G27, or G103 /1 or 103/2. The alarm from the C2 zone could have been triggered by G101 /1, G101/2 or G101/3. These alarms are independent of the compressor enclosures although the other alarms which annunciated were associated with the centrifugal compressor area. However if the cloud of gas which triggered the alarm came from within Module C then the detector most likely to have triggered it was G103/1. PSV 504 which the pursuers nominate as the source of escaped gas is to the west of the detectors responsible for the said alarms and rather to the south of reciprocating compressor A. Thus an escape of gas from the PSV can readily be aligned with centrifugal compressor C. Because of the wind direction the air flow at the time of the accident was from west to east. If the escaped gas had entered Module C at the east end then this would probably only have been possible if gas had been sucked in through the compressor equipment and thus the alarms associated directly with the compressors might have been expected to annunciate first.

Taken at its broadest the defenders argued that it was odd that the pursuers postulated a leak from about the middle of the module but apart from one low level alarm at C2 the bulk of the alarms that annunciated were located at the centrifugal compressors at the east end of Module C.

5.4.4. Detector Types

The detectors on the platform at the time of the accident were manufactured by Messrs Sieger. However these manufacturers produced a number of different models of detectors and since these had different structures and capabilities it is important to know which models were on the relevant production modules at the time of the accident. I am satisfied that the model 910 was the model that was almost exclusively employed in modules A and B when the accident occurred. This model was a development from models 780 and 770 which had previously been used. Mr Tea had been the witness with the most up-to-date experience of the detector system on the platform . Certainly the records show that by 1986 or earlier if a detector was replaced it was replaced with a 910 model. Both Mr Scothern and Mr Tea gave evidence that for some time before the accident Mr Wakefield has been engaged in a programme of replacing on a routine basis older detectors with the 910 model. This was partly because the older type of detector was no longer available but also because the new detectors were easier to maintain. However Mr Scothern accepted that when he left the platform about 9 months before the accident some of the lower G numbers in Module C had still been older models. But he had kept in touch with Mr Wakefield and expressed the view that in all probability the detectors in Module B had been replaced by new models although his evidence on this aspect of matters was somewhat uncertain. Mr Tea whose direct knowledge was more up-to-date was more certain about the replacements. At best for the defenders it is clear that by the time of the accident there were a good number of the new detectors both in Module B and Module C. Indeed Mr Tea indicated that about a week prior to the accident new 910 detectors were installed in Module C in the positions associated with the fuel gas pumps

The witness Dr Balfour gave evidence as to how the detectors worked. He was 60 when he gave evidence and was a director and scientific consultant with Sieger Ltd. He held a B.Sc. with first class honours and also a Ph.D. I have no doubt that he was widely experienced in the technical aspects of his company’s products. He had also considerable experience of research, university teaching, and the production of technical literature. He held himself out as an expert in the design and operation of gas detectors and this claim was well justified. The pursuers produced a Report from Dr Balfour which was prepared in 1992 and was 13/65 of process.

The purpose of a gas detector system is to monitor gas concentrations by the deployment of a number of detectors at significant locations and these contain sensors which give an output signal if a pre-set level of gas concentration arises. The Seiger detectors I am concerned with are all what are known as catalytic detectors, that is the sensors contain a particular configuration of materials which will enable combustible gases to combine with oxygen and give rise to a signal that is proportional to the amount of combustible gas present. The catalyst substances themselves are rare earth materials such as platinum and iridium. A catalyst is a material which alters the rate at which a chemical reaction occurs but which is itself unchanged at the end of the process. The core part of the detector is a bead made up of a porous ceramic material, alumina. A further material is thoria ,a finely powdered catalytic ceramic material which is made up as a slurry and then spread over the bead and dried so as to provide an outer crust. For the combustible gases to react with oxygen the catalyst thus sits on the surface. However since the reaction requires a minimum temperature a current is passed through a wire to the bead to produce a temperature of about 450 degrees. The enclosure of the bead requires to be constructed so that the enclosure itself does not heat to become a source of ignition. When the combustible gas reacts with oxygen as a result of the catalyst heat is generated and this heat is the source of the measurement of gas concentration. Two beads (or elements) are positioned together, one with the catalyst (the sensitive element and one without (the compensating element). Comparison of the differences in the respective reactions of these two elements provides a basis for measurement. An electric circuit is created by means of what is known as a Wheatstone Bridge and of course the strength of this circuit is related to the gas concentration.

At Figure 2 of Dr Balfour’s report the 780 sensor is shown in schematic form. The feature there described as the sinter is in effect a sinterised element whose purpose is to prevent the combustion which takes place within the chamber from going outside of the sinter. Some filters are designed to prevent particles of material entering and clogging the sensor. The catalysts are vulnerable to certain elements known as poisons and these include sulphur, lead, chlorine, and silicon. The 780 type of detector can be fitted with filters which will react with and absorb these poisons so as to give a degree of protection. Another type of filter is hydrophobic and is designed for situations where the detector may be exposed to water. Dr Balfour indicated that there was much concern about the poison failures of earlier 780 models on Piper Alpha and as a result they would have been fitted with filters to remove the poisons. However because of vulnerability to poisons and other contaminants detectors should be checked and calibrated at three to four months intervals. Figure 3 of the report shows a schematic of the 910 type of detector. This model was not fitted with a filter since the construction was designed to have a bead which itself offered greater resistance to poisons. This was accomplished by spreading the catalyst not only over the surface but throughout the bead. Moreover in this model the detector could be dismantled and the bead replaced. The 780 detector which was supplied after about 1985 and thus was supplied in the period between the withdrawal of the 770 and introduction of the 910 models also contained the poison resistant bead.

The detectors take a certain finite time to respond to an increased concentration of combustible gas. The response time is the time it takes from the first concentration of gas at a particular level of concentration to be presented until the alarm signals. These times are set out in Dr Balfour’ report. Thus if a 780 sensor type is exposed to the lower explosive limit (LEL) of methane (namely 5% methane in air) the response time will be 19 seconds whereas with the 910 detector the response time is 22 seconds. With the LEL of butane the response times would be 24 and 27 seconds respectively. These times are within the accepted standard response time which is 30 seconds. The alarms are set to respond to set levels of concentration. Thus the alarms on Piper Alpha were set to respond as low level alarms if 15% of the LEL is presented and as high level alarms if 75 % of the LEL is reached. Methane was taken as the standard. Thus the LEL of methane if mixed with air requires a mixture of 5% methane in air. In his report number 13/65 of process Dr Balfour calculates the LEL for different gases. With information in Table 3 of that production and knowledge of the LEL of different constituents obtained from published literature the LEL of mixtures can be deduced. The results he obtains are not challenged. There is a degree of artificiality about his results because to obtain them he has to assume that the whole mixture is in vapour form. This assumption he claimed gave the worst case scenario. The detectors are more sensitive to the lighter ends than to the heavier. Thus if the detector is calibrated to give a LEL alarm at 15% of methane it would need a concentration of 23% of the vaporised mixture from the condensate line to give the same alarm. Likewise a low alarm set at 75% of methane requires 115% for the condensate mixture. If the sensor was exposed to a high concentration of gas then the low level alarm would go off very quickly. Indeed if the alarms are exposed to critical gas levels response times are to be measured in seconds. If the sensor is exposed to a gas cloud for a period of time which exceeds the short response times of the sensor then the sensor will react to it. This however means that the sensor could miss a very rapid transient exposure to gas. Nevertheless a 15 % LEL concentration level alarm could be triggered by a gas pulse of 100% LEL methane of 1.5 seconds duration and for higher concentrations by pulses of even shorter duration. However even when a 15% LEL alarm has been triggered a pulse of methane of concentration just exceeding 100% LEL could last for 12 seconds without generating an alarm at 75% LEL. It follows that the response of the detector is governed not only by the level of concentration of combustible gas but by the period of the exposure. Relating the position to the facts of the accident it does not necessarily follow that because the first alarm noted by Mr Bollands was a low level alarm that the gas concentration was not much higher than that level provided that the exposure time was sufficiently short. A higher alarm takes longer and may be say about 15 seconds.

A difference between response time and time to alarm must be noted. Response time is the time taken for a detector to give a valid indication of the concentration of gas to which it is suddenly exposed. It is commonly regarded as the time taken for the sensor signal to reach 90% of its equilibrium value after the sensor has been exposed suddenly to a fixed proportion of gas. It is essentially independent of the gas concentration and characterises the temporal behaviour of the sensor. Time to alarm is the time from exposure of the sensor to a sudden fixed concentration of gas to the activation of the alarm indicating a pre-determined level of gas concentration has been reached. In his Report at Table 1 Dr Balfour states the response times and times to alarm for 100% methane and 100% butane for 910 and 780 type sensors. The response times for the higher level alarms are more significant since they are longer. If only one high level alarm annunciated then the size of gas cloud and time of exposure would have to be within confined parameters.

If the gas which triggered the alarms in Module C originated in Module B and particularly at the west end of that module it would dilute by mixing with air as it travelled towards the mouths of B and C so that it is difficult to see how it could have avoided triggering alarms in B unless the alarms there were not functioning properly.

Because of the constituents of the condensate that would have been in the line of PSV 504 if a leak occurred at that point a higher concentration of gas would have been required to set-off the low level alarm than would have been the case with methane.

5.4.5 Maintenance

At the time of the accident there was no maintenance work in progress in relation to the detectors in Modules B or C. If there had been such work in progress Mr Bollands who was in charge of the alarm panels would have expected to have been told about it at handover. Generally the system was that detectors were maintained on a 4-monthly basis. The document 12/204 of process is dated 18 January 1989 and is material taken from the computer system of OPCAL relating to the planned maintenance of detectors in Module C. On the basis of these records the planned maintenance intervals were sometimes exceeded but Mr Todd (who was a Maintenance Superintendent with OPCAL and generally seemed quite a reliable witness) explained this not as a failure in maintenance but as a failure in keeping the computer records up-to-date. He indicated that there had been reporting failures identified after the accident due to some of the points mentioned in the actual logs being misinterpreted by maintenance controller. The computer records purport to show that a four-months planned maintenance was completed on 23 January 1988. However it is also recorded that a twelve- months planned maintenance (which would have incorporated calibration of detectors normally included in a four-months maintenance) was completed on 8 February 1988 and this gives some support to the view that the computer records were not entirely accurate. Moreover Mr Tea gave evidence that he had been replacing detectors during his last stint on the platform shortly before the accident and he describes this as being part of planned maintenance. He stated that the replaced detectors had in fact been in good condition but had been replaced because it was wanted to replace the cables. Mr Tea also said that Lloyds inspectors had inspected certain detectors some weeks before the accident. This inspection would not cover all the detectors on the platform but merely a selected area but the inspectors had not complained about the detectors although they had wanted some cabling replaced. Mr Tea gets further support from 15/6 (a schedule of unscheduled maintenance prepared by Mr Todd in conjunction with Department of Energy inspectors for an inquiry) and this shows that maintenance of detectors was proceeding in June