1
VOLUME 3
CHAPTER SIX - CAUSATION 2
6.1.Flotta recordings
6.1.1General
Various statistics reflecting oil production from time to time on the Piper Alpha platform were relayed to the Flotta terminal and recorded there as well as being noted by the operatives working at the terminal. One of these records was produced and witnesses spoke to what they had observed. The implications of this material was commented on by the parties at some length. It was principally the defenders who sought to place importance on this material. Thus the defenders averred that “there was a sudden and material drop in the flow of oil from Piper Alpha at least 7 minutes before the initial explosion”. The defenders sought to get support for this aspect of their case from what had been noted at Flotta at the time of the accident. However in argument they were content to modify the time span so as to argue that production at the platform had diminished substantially or ceased about 2 minutes before the explosion rather than seven. Their contentions in this respect are important since if there was a major process upset at the platform some minutes before the accident (particularly affecting the production of oil) this may afford an alternative explanation of the accident and indeed eliminate a leak of a relatively limited amount of hydrocarbon as being the cause of the explosion. In fact Senior Counsel for the pursuers accepted that if it were proved that there had been a sudden and material drop in oil production minutes before the explosion this could cause him difficulty. The pursuers accept that there was some loss of oil production minutes before the explosion but not the major upset suggested by the defenders and they say this is explicable as being caused by loss of production following upon the tripping of the condensate injection pump B. This brought about the need for the operators to unload and recycle the reciprocating compressors. This of course would cause a loss of gas lift which in turn would bring about a loss of production. Indeed in my view there is no doubt that a loss of gas lift would bring about a certain loss of oil production. Moreover if the reciprocating compressors were recycled gas which would otherwise have been available for gas lift would escape to flare. The operators had installed a system of alarms and process trips designed to alert the Control Room to any serious change in process conditions but in respect of most of these we were not told in evidence just at what levels of disturbance they had been set to respond. I think that the amount of hydrocarbon which could have possibly escaped from PSV 504 was restricted in relation to the very considerable quantities of condensate produced by the platform and therefore may not have had much effect on the systems for identifying process upsets (other than gas alarms). It is therefore unlikely that any phenomena at Flotta which indicated an upset equivalent to a shutdown could have been in consequence of the mere escape of condensate from a jagged condensate injection pump. On the other hand the process disturbance recorded at Flotta, had this been due to an escape of crude oil, must have been reflecting the loss of a substantial amount of oil. Certainly enough crude oil to have created a large explosion. The scale of the operations is illustrated by the fact that loss of gas lift alone could produce a production loss of about 25,000 barrels of oil per day and yet this loss would reflect nothing like a shut down. On the other hand one would have expected any escape of a large amount of oil sufficient to register a significant drop at Flotta (as distinct from a mere drop in production) would have triggered some of the various pressure and level drop alarms on the platform and the evidence was to the effect that this did not happen. The starting point for the pursuers’ submissions on this matter is that the reciprocating compressors were unloaded at least 10 minutes before the explosion and I agree that in fact that happened. MrVernon reported as much to Bollands the Control Room Operator. I further think that it has been established that the full effect of the loss of gas lift would have been noticed in about 10 minutes although some effect would be noticed after about 3 minutes.
6.1.2The Spectra-Tek System
Details of the operators’ metering and telemetry system was given by the witness Bruce Lawson. MrLawson seemed to me to be a reasonably reliable witness. He was a senior metering engineer and had been employed by OPCAL in 1988 as a metering engineer. He had detailed knowledge of OPCAL’s metering and telemetry systems in their offshore installations. OPCAL has a telemetry system. Insofar as this was based on the Claymore platform it was the system known as the Spectra-Tek system and MrLawson had been the project engineer responsible for the installation of this. This system involved the automatic transmission of information between the pursuers’ platforms and also from the platforms to the Flotta Terminal. The communication network used microwaves and tropospheric systems. The microwave system operated on line of sight and the other did not. In relation to Piper Alpha the transmission dishes required by these systems were situated at the north face of the platform. As was explained to me a communications system is one which can ferry information from point A to point B. Telemetry is the information that is carried along the communication system. There were two functions of the operators’ telemetry system. The first of these is the offshore function. The Operators offshore are concerned primarily with the operations which are current and the information which at any point of time may affect these. This information can affect their productive capacity. Thus for example the pressure at Claymore can affect the other platforms’ ability to export products. The onshore interest on the other hand is not so focused on immediate data as on overall trends. The system on Piper Alpha was not as modern as that on Claymore and was known as the Solartron system. The advantage of the Spectra-Tek system on Claymore was that it had a trending facility. The system on Piper was only a real-time system. It is perhaps important to note that the Solartron system on Piper was situated in the Control Room there. It had an alarm panel which would annunciate among other matters serious interruptions of the process flow. It could also annunciate what were regarded as minor alarms and this would include indications of low or high pressure. This alarm had not annunciated prior to the accident. The telemetry systems would also relay from one platform to another or to Flotta alarms relating to a communications failure or a shutdown. However Piper Alpha was at the hub of the system so that any communication from another platform to Flotta had to be relayed through Piper. This means that if Piper were blown up the alarm system at Flotta would indicate not only a loss of communication at Piper but a loss of communications with the other platforms and alarms at Flotta would show this.
The pursuers argued strongly that if prior to the explosion a serious loss of oil pressure had occurred this would have registered on the alarms in the Piper Control Room, including the Solartron alarms. The defenders contended on the other hand that in the absence of evidence about the levels at which alarms were set there could be no conclusion arrived at as to what was required to set-off an alarm. In my view this can only be so within relatively fine limits. For example there was a substantial volume of hydrocarbon circulating through the process system at any point of time. It certainly cannot be assumed that the operators would want to be alerted to every variation in the process flow. An oil-well might be withdrawn from production causing some diminution in production but it may be that this would not give rise to a flurry of alarms. However one must pay some regard to the purpose in having an alarm system. It would be most surprising if the alarm system was not set to register any change in the process gross enough to require urgent action and in particular one which might signify the development of a serious danger. I think that it is clear that any change in the process approximating to an involuntary shutdown would be in that category and I find it difficult to believe that there could be a loss of flow equivalent to such a shutdown without alarms annunciating in the Control Room. If this could happen the elaborate alarm and control system would be relatively pointless.
The computer graphic number 56/2A of process illustrates the lay out of the Control Room on the Piper Alpha platform. A person sitting at the Control Room operator’s desk could see the alarm annunciator and in any event would hear the audible alarm. Number 42/1 of process illustrates the Control Room at Flotta. If there were to be a communication fault at Piper Alpha there would be flashing lights and an audible alarm at the control panel at Flotta and the alarm could be converted into a solid state light by operating the acceptance button.
The Spectra-Tek system on Claymore in the first instance recorded local data from the metering skid on Claymore itself and this data would include the flow from the Scapa Field which converged on Claymore. The said data is collected by what is known as a multi-drop loop. This means that to collect data from each of the nine microflow computers it takes 3 seconds. Thus to go round the whole loop takes 27 seconds. Therefore if a particular piece of data just misses its place on this chain it may take approximately 30 seconds before that data can be displayed. The computer is able to set out trends in the data it collects and indeed the data for the nine streams is amalgamated. The data collected for each stream would include readings for a number of matters such as pressure differentials between say Claymore and Flotta. The data used for this purpose is collected on a 1 minute basis. This means that if a particular value is shown on the output documentation at a specified time it is possible that such refers to data actually recorded 59 seconds earlier. The gathering of data by the Spectra-Tek system from sources external to Claymore, such as Piper, does not require to go through the multi-drop loop and thus the input is much faster, perhaps by a second or two. Only the trending data is recorded. In making comparisons between the different kinds of data allowance has to be made for the time skew caused by the multi-drop system. Eighteen different trends were configured. The trending data was also collected on a hard disk at Flotta. This meant that after the accident information was available of the trending records relating to Piper and in this respect two trends 1 and 4 were particularly relevant. The trending data is timed according to the system’s own clock and this is not synchronised with any other clock. After the accident the hard disk containing the Spectra-Tek data was brought to MrLewis, a software engineer, (and a witness in the case) and he produced the document setting out the data which is number 41/15 of process.
Trend 1 relates to the differential pressure between Piper and Flotta. Trend 4 relates to the flow rate from Piper to the Tee junction on the MOL where the Piper flow meets the Claymore flow. Thus the oil flow leaving Piper was relayed to Spectra-Tek and recorded there at minute intervals. Trend 5 was the flow rate from Claymore to the said junction. Piper had an indirect input into this trend because the data from the Tartan platform went through the telemetry system on Piper. Trend 18 relates to the main oil line pressure as measured at Claymore.
If there was a failure of the telemetry system on Piper certain trends would be lost and the data for any such trend would become invalid. For example because of the inter-relationship of the data affecting the various trends, trends 1, 2, 3, and 4 would all become invalid if telemetry at Piper were to fail. If the equipment in the Control Room at Piper were damaged by the effects of an explosion then failure of the telemetry system could result either by disconnection of cables or disconnection of energy supplies.
If there was a problem with the telemetry system on Piper then there would be a short delay before this registered on the Spectra-Tek system because of what the witness Lawson referred to as the “handshake”. This is in effect attempts made by the stations under the system to establish contact with one another before an alarm is annunciated. This process could take as little as 20seconds but could also take longer.
On the day of the accident in relation to the recording of trend 1 at 2200hours there is a pressure value of 43.4 bar brought out but at 2202 there is a value of 42.30 and that value thereafter continues to be repeated. The freezing of values indicates that telemetry is no longer working. Although it is not impossible that the system would record the same value on successive readings this is unlikely. Thus subject to adjustments on the time scale the time when the telemetry on Piper failed can be worked out. In relation to trend 1 the telemetry at Piper failed no earlier than 2202hours as printed although failure a minute or so later is just possible. However the trend information also shows that there was a gradual reduction in oil flow after about 2156hours and this could be attributable to the loss of gas lift. Certainly in my view the trend information would not justify a finding of a sudden and material drop in oil production 7 minutes before the explosion. Trend 4 also shows a gradual loss of production from about 2158hours followed by a constant value after 2202hours. A particular value may in normal circumstances repeat 2 or 3 times but given that the values being discussed continued to repeat in my view it is likely that the beginning of this repetition marked the loss of telemetry. Indeed the values at 2201hours could also have been a sign of the loss of telemetry since they show a reduction in pressure.
At the time of the accident there were about 15 wells in production and the effects of a loss of gas lift would have begun to be felt after about 3 to 5minutes with the full effect happening after about 10 minutes. The effect of the loss of gas lift would vary from one well to another. The wells which required gas lift would have suffered a loss of production of about 50%. Thus given that the recycling and unloading of the reciprocating compressors occurred between say 2145 and 2150hours there should have been a notable loss of pressure about 2200hours or slightly earlier. It takes about 40 seconds for the pressure pulse to travel from Piper to Claymore so that the latter platform would see the change of pressure after that interval. A further important consideration is that it takes about 3 minutes for the pressure pulse to travel from Piper to Flotta so that a pressure drop at Piper would not be noted in the pressure measuring equipment at Flotta until about 3 minutes after it had occurred. The loss of pressure at Piper would result in a pressure drop in the MOL and this would affect the production at Claymore since the oil from that platform would meet a different pressure as it traversed the line. The production at Claymore was in fact recorded in trend 18. The pressure at Flotta would not drop below about 230 psi because there were pressure control valves (PSV 90 A and B) at Flotta designed to maintain the MOL pressure at that value. The graphs in number 41/16A and B of process show the recordings of trend 18 and a loss of Claymore pressure some minutes before 2200hours to be followed by a sudden drop of pressure at 2202hours. The advantage that trend 18 has over trend 2 is that the material in the latter contains a combination of locally and remotely derived data which causes a certain degree of time skewing. The graphs relating to trend 1 (the pressure differential between Piper and Flotta) also show the commencement of a gradual drop in pressure about 2156hours to be followed by a drastic drop between about 2201hours and 2202hours. The loss of pressure due to the cessation of gas lift would be compounded slightly by the loss of condensate production when the condensate injection pump system failed.
6.1.3Process at Flotta
The flow into Flotta first went through the feed preheater the function of which was to heat up the fluid. The flow of hot oil was controlled by temperature control valves (TCVs). If the flow coming into Flotta were to diminish the temperature of the oil flow would increase because the oil was itself heated by hot oil and the amount of this heating oil would not diminish. Thus a reduction of oil coming into Flotta would require process adjustment by an operator because otherwise the TCVs would automatically close if the pre-set pressures were exceeded. Such closure would cause alarms to annunciate in the Control Room. Alarms of this sort were not in themselves an unusual occurrence. After it was heated the oil flow went through a separator and then a desalter. The flow emerging from the desalter was split into 2 streams. One representing 40% of the fluid (called the cold stream) went directly to the stabiliser while the remaining 60% (called the hot stream) went through a vessel called the feed bottom exchanger before then going into the stabiliser. These 2streams had first to pass flow elements which measured the flow going into the stabilisers and these measurements were recorded in a series of pen charts in the Control Room.