SHERIFFDOM OF GRAMPIAN, HIGHLAND AND ISLANDS AT ABERDEEN

FATAL ACCIDENTS AND SUDDEN

DEATHS INQUIRY (SCOTLAND) ACT 1976

INQUIRY INTO THE DEATHS OF

SEAN SCOTT McCUE and KEITH SCOT MONCRIEFF

DETERMINATION BY THE SHERIFF

1. INTRODUCTION

This is an inquiry under the Fatal Accidents and Sudden Deaths Inquiry (Scotland) Act 1976 into the deaths on 11^th September 2003 of Sean Scott McCue and Keith Scot Moncrieff on board the Brent Bravo Offshore Platform situated in the United Kingdom sector of the North Sea. While Mr McCue and Mr Moncrieff were working at the 81 metre level within the utility shaft there was a release of liquid hydrocarbons from a temporary repair on the closed drain degasser rundown line. The released liquid evaporated forming vapour in the shaft and as a direct consequence of inhalation by the two men of the vapour, they died.

On 1 August, 2005 the Sheriff at Aberdeen, on the application of the Procurator Fiscal for the District of Aberdeen, made an order appointing the inquiry to commence on 31 October, 2005.

The scope of a fatal accident inquiry is limited by the terms of section 6 of the 1976 Act, which requires the Sheriff to:-

"make a determination setting out the following circumstances of the death so far as they have been established to his satisfaction:-

(a) where and when the death and any accident resulting in the death took place;

(b) the cause or causes of such death and any accident resulting in the death;

(c) the reasonable precautions, if any, whereby the death and any accident resulting in the death might have been avoided;

(d) the defects, if any, in a system of working which contributed to the death or any accident resulting in the death; and

(e) any other facts which are relevant to the circumstances of the death."

At the inquiry the Procurator Fiscal who appeared and adduced evidence regarding the circumstances of the deaths was Ernest Barbour, Esq. Also appearing were Stuart Gale, Esq, Queen's Counsel, who represented Shell U.K. Limited and adduced evidence on their behalf; Peter Gray, Esq, Queen's Counsel, who represented the Wood Group; Christine McCrossan, Solicitor, representing the interests of Jackie Ogilvy, the partner of the late Keith Moncrieff; Gary McAteer, Esq, Solicitor, who acted on behalf of two Offshore Installation Managers, namely Terry Stout and John McEwan, and who led evidence on their behalf; and David Sheldon, Esq, Advocate, who represented the Health and Safety Executive.

The inquiry sat on 38 days during which the evidence of 61 witnesses was taken, either orally or by way of affidavit and, following submissions on behalf of each of the parties represented at the inquiry, concluded on 25 January, 2006.

During the course of the inquiry it became apparent that evidence relating to the condition of certain valves on the platform might be relevant to the cause of the deaths of the two men, or have contributed to the incident which resulted in their deaths. However certain evidence, such as the possible consequences to the structure of the platform, and its crew, of the ignition of the vapour within the utility shaft, while of concern to some of the parties and no doubt of importance to the offshore oil industry and those who work in it, was, in my opinion, beyond the scope of the 1976 Act and more appropriate for consideration at an inquiry of a more general nature.

2. THE WITNESSES

(a) The witnesses who appeared and gave oral evidence.

1. KENNETH THOMSON (41) - a photographer employed by Grampian Police who, on 13 September, 2003, took a series of photographs, and a video, at the 81 metre level within the utility shaft of the Brent Bravo platform.

2. THOMAS WOTHERSPOON (47) - a maintenance scheduler employed by the Wood Group on the Brent Bravo platform who, on or about 17 November, 2002 in his capacity as mechanical lead technician, placed patch No. 86 on the closed drain degasser rundown line located within the utility shaft of the Brent Bravo platform.

3. IAN ALEXANDER SILK (41) - a logistics manager employed by Shell U.K. Limited who presented, by text and graphics, a general description of the Brent Bravo platform, the utility shaft, the relevant work area and its location, a brief introduction to the function of the main equipment and pipework systems within the utility shaft.

4. PAUL WILLIAM ADIE (35) - an operations technician employed by Shell U.K. Limited, who, on 11 September, 2003, was the control room operator on the Brent Bravo platform.

5. SYDNEY CECIL THOMSON (38) - a systems supervisor, process (S.S.P.) employed by Shell U.K. Limited on the Brent Bravo platform, who, on 11 September, 2003 was acting operations supervisor.

6. PETER LAYCOCK (45) - an electrical technician employed by the Wood Group on the Brent Bravo platform who, on 11 September, 2003 prior to 3.30 pm, while in the technicians station locker room was asked by Keith Moncrieff if there was any rubber in the switch room.

7. STEPHEN ALAN DEETH (26) - an operations technician employed by Shell U.K. Limited on the Brent Bravo platform and who, on 11 September, 2003 was a trainee involved in preparations for a pig launch.

8. ALISTAIR STUART HARCOMBE (38) - an operations technician employed by Shell U.K. Limited on the Brent Bravo platform who, during the annual shutdown in August, 2003 investigated with Scott Fraser a single gas head low level alarm at the 81 metre level in the utility shaft.

9. CLARK ANDERSON (27) - a productions operator who was employed by Shell U.K. Limited on the Brent Bravo platform and had during the shutdown in August, 2003 investigated with Paul Buchan a gas alarm at the 81 metre level in the utility shaft and had on or about 9 September, 2003 together with Alistair Harcombe checked Patch No. 86.

10. PAUL ARTHUR BUCHAN (28) - an operations technician employed by Shell U.K. Limited on the Brent Bravo platform who, a few months prior to the annual shutdown in August, 2003, looked at, and assessed the condition of Patch No. 86. On 11 September, 2003 he was involved in preparations for a pig launch.

11. JOHN DELANEY CAIRNEY (43) - an installation inspection engineer presently employed by the Salamis Group who was employed by Motherwell Bridge Inspection and has worked, from about 1997 on the Brent Bravo platform. He kept the patch register and monitored all temporary repairs during his monthly inspection.

12. TREVOR CHRISTOPHER ANCELL (51) - a chartered mechanical engineer who, in September, 2003 was employed by Shell U.K. Limited on shore as the principal technical authority (piping and static equipment), for all the Shell Expro installations including the Brent Bravo platform.

13. TERRY WILLIAM ANDERSON STOUT (38) - an offshore installation manager employed by Shell U.K. Limited who, on 11 September, 2003 was an operations supervisor but was acting as installation manager on the Brent Bravo platform.

14. MARK GALLAGHER (45) - a mechanical technician employed on the Brent Bravo platform by the Wood Group who, on 11 September, 2003 was asked by Keith Moncrieff if he would go down the utility shaft and replace a patch on a pipe.

15. DR ROBERT STRACHAN STEPHEN (56) - a doctor employed by Shell U.K. Limited who, in 2003 was based on the North Cormorant installation and attended the Brent Bravo platform on 11 September, 2003 and at about 19:55 pronounced Sean McCue and Keith Moncrieff dead.

16. DAVID ANTHONY CHAPMAN (51) - an operations technician employed by Shell U.K. Limited who on 11 September, 2003 was the responsible person electrical on the Brent Bravo platform and who, during the general platform alarm and emergency shutdown was dispatched to check, and manually start, the emergency generator, which had not started automatically, in order to restore lighting.

17. THOMAS MURPHY STELMACH (48) - an offshore medic employed by Universal Sodexho on behalf of Shell U.K. Limited and based on the Brent Bravo platform who on 11 September, 2003 at about 7.00 pm descended the utility shaft together with Iain Ayers and Billy Boyse and found Sean McCue and Keith Moncrieff lying at the 81 metre level.

18. GEOFFREY TALBOT (52) - an inspection team leader employed by Shell U.K. Limited for the central asset unit and who is based onshore.

19. FRANK MILLAR (56) - a shutdown co-ordinator employed by Wood Group Engineering (North Sea) Limited who was the integrated services contract team leader on 11 September, 2003 on the Brent Bravo platform and who, on 9 September, 2003 instructed Keith Moncrieff to contact the area technician and together they should look at Patch No. 86, which reportedly was leaking, and assess its condition and report back to him.

20. ANNE WILSON HART (41) - employed by Shell U.K. Limited onshore as the engineering and maintenance leader for the central asset and who as maintenance team leader was responsible in September, 2003 for the Brent Bravo platform. One of her teams was responsible for arranging the design and fabrication of replacement pipe spools.

21. CHRISTOPHER JAMES GRANT (31) - a campaign maintenance co-ordinator employed by Shell U.K. Limited at their Tullos office in Aberdeen who was, on 11 September, 2003 acting systems supervisor, process (S.S.P.) on the Brent Bravo platform.

22. JAMES ALEXANDER SMITH (37) - a pipeline engineer employed by Shell U.K. Limited who during the general platform alarm and emergency shutdown assisted Paul Buchan to attach a hose to the closed drain system in order to put water down the line and thereafter assisted Dave Chapman to start the emergency generator.

23. STEPHEN JOHN CLAYTON (54) - a senior control and automation engineer employed by Shell U.K. Limited at their Tullos office in Aberdeen as part of the technical authority.

24. WILLIAM JOHN BOYSE (39) - who in September, 2003 was employed by the Wood Group on the Brent Bravo platform as an instrument technician. On 11 September, 2003 was told by Keith Moncrieff that he was going down the utility shaft that day to change a bit of rubber and a couple of jubilee clips.

25. JOHN JAMES MACASKILL (26) - an electrical technician employed by the Wood Group on the Brent Bravo platform and who, on 11 September, 2003 was an apprentice and heard Keith Moncrieff, at the 3.00 pm tea break, ask Peter Laycock if he had any rubber.

26. IAIN AYERS (43) - an instrument technician employed by the Wood Group who, on 11 September 2003, while on board the Brent Bravo platform was asked by Keith Moncrieff, at the 3.00 pm teak break, to lend him a screwdriver, which he did.

27. SCOTT FRASER (37) - an operations technician employed by Shell U.K. Limited on the Brent Bravo platform who, on 17 August, 2003 together with Alistair Harcombe investigated a single gas head low level alarm at the 81 metre level in the utility shaft and whose role on 11 September, 2003 was technical custodian instruments.

28. JONATHAN ROBERT STATHAM (40) - a senior scientist employed by the Health and Safety Executive at their laboratory in Buxton, Derbyshire, who together with Christopher Parker and Dr Roy Parrott carried out tests on a number of items and prepared a report thereon.

29. CHRISTOPHER JOHN PARKER (31) - a scientific officer employed by the Health and Safety Executive at their laboratory in Buxton.

30. DR ROY PETER PARROTT (56) - a senior materials scientist employed by the Health and Safety Executive at their laboratory in Buxton.

31. RAVINDER KUMAR SHARMA (54) - a chartered mechanical engineer employed by the Health and Safety Executive as a specialist inspector who carried out an investigation into, and prepared a technical report on, the fitness for purpose of Patch No. 86, the condition of the non-return valve 9P097, the emergency shut-off valve EZV 44715 (including the actuator) and the level control valve 6600.

32. DR BERNARD EMERY (61) - an operations inspector employed by the Health and Safety Executive who specialises in control instrumentation and electrical engineering and investigated the gas detection systems used on board the Brent Bravo platform and who prepared a report thereon.

33. DAVID MICHAEL HARRIS (48) - an operations supervisor employed by Shell U.K. Limited on the Brent Bravo platform who in July, 2003 assisted Norman Lloyd to review outstanding work orders including 10449718.

34. JOHN ROBERT McEWAN (57) - an offshore installation manager employed by Shell U.K. Limited on board the Brent Bravo platform who was the O.I.M. on board when the platform started up on 22 August, 2003 following the annual shutdown.

35. MARTIN ALAN BREARLEY (57) - an inspector employed by the Health and Safety Executive specialising in fire and explosions who, together with Dr Venessa Forbes and V Karthigeyan, prepared a report on the potential consequences of ignition of the gas release in the utility shaft of the Brent Bravo platform.

36. PROF. GEOFFREY ALAN CHAMBERLAIN (57) - the manager of the major hazards management team within the health, safety and environment department of Shell Global Solutions who prepared the report "Brent Bravo Incident: Summary of the Dispersion and Explosion Analyses Performed by Shell Global Solutions".

37. V. KARTHIGEYAN (57) - an inspector with the Health and Safety Executive specialising in structural integrity of concrete, structural dynamics, earthquake engineering and vessel impact who co-authored the technical report on the potential consequences of ignition of the gas release in the Brent Bravo utility shaft.

38. DR. VENESSA JANE FORBES (35) - an inspector with the Health and Safety Executive specialising in structural integrity who was the report co-ordinator for the technical report on the potential consequences of ignition of the gas release in the Brent Bravo utility shaft.

39. ROBERT JOHN WHITE (46) - a principal inspector employed by the Health and Safety Executive specialising in structural integrity who prepared an addendum and update to the technical report on the potential consequences of ignition of the gas release in the Brent Bravo utility shaft.

40. TREVOR HODGSON (50) - a chartered engineering who acts as a chief consultant for Galbraith Consulting Limited and who prepared a report entitled "Explosion Loading in Utility Shaft".

41. ROBERT ERNEST GOWERS (52) - a specialist inspector employed by the Health and Safety Executive in their offshore safety division who, between 13 September, 2003 and 16 September, 2003 carried out an investigation on board the Brent Bravo platform into the incident on 11 September, 2003 and produced a report thereon.

42. DR JAMES HENDERSON KERR GREIVE (52) - a fellow of the Royal College of Pathologists employed in the Forensic Medicine Unit of the Department of Pathology at the University of Aberdeen who on 15 September, 2003 together with Dr Sameena Rashid carried out, and thereafter prepared a report on, the post-mortem examinations of Sean McCue and Keith Moncrieff.

43. DR VALERIE FLOOK (65) - a chartered physicist who is the principal of a company Unimed Scientific Limited and prepared a report dated 27 February, 2004 into the likely cause of death of Sean McCue and Keith Moncrieff.

44. ANILKUMAR CHOHAN (52) - a relief operations supervisor employed by Shell U.K. Limited and who was on board the Brent Bravo platform from 20 August, 2003 and was on board when the platform started up following the annual shutdown.

45. NORMAN LLOYD (56) - an electrical engineer employed by the Wood Group who, as integrated services team leader (I.S.C. team leader) in the Brent Field carried out with David Harris a review of outstanding work orders and cancelled work order 10449718 relating to the emergency shut-off valve EZV 44715.

46. DAVID RICHARD BEAN (59) - a mechanical technician employed by the Wood Group on board the Brent Bravo platform who worked on the emergency shut-off valve EZV 44715 during the annual shut down in 2002 and reported to his mechanical supervisor Peter O'Brien.

47. GEORGE ALEXANDER LANG (55) - employed by Shell U.K. Limited as the engineering and maintenance team leader for their cross border asset who in September, 2003 was based onshore as the asset leader for the four platforms in the Brent field.

48. RAYMOND WILLIAM PATERSON (59) - an inspector employed by the Health and Safety Executive who was a member of the team that went on board the Brent Bravo platform to investigate the incident which occurred on 11 September, 2003 and took a number of photographs with Phil Mullery and was party to the issuing of prohibition notices.

49. MARJORIE CHAMBERLAIN (33) - employed by Shell U.K. Limited as head of design for the Brent project group who in 2003 provided onshore mechanical maintenance support for the Brent asset and in August, 2003 considered the patch register and on 4 September, 2003 requested a new spool for 2"D-115-A1105 from the maintenance delivery team.

50. ROBERT MILLER NICOLL (53) - a senior control and automation engineer employed by Shell U.K. Limited who is the technical authority for their mature assets group.

51. JOHN CARDWELL (49) - an off-shore installation manager employed by Shell U.K. Limited who took timings, or caused timings to be taken relating to the time taken to descend from the DICS to the 81 metre level in the utility shaft.

52. JENNIFER TALBOT (28) - employed by Shell U.K. Limited as a styles and procedures co-ordinator at their Tullos office in Aberdeen who in 2004 drafted the operating code of practice (OCOP) document for leg entry.

53. JOHN HOLROYD (56) - an inspection team leader employed by Shell U.K. Limited who is in charge of the inspection and corrosion engineers within the Brent asset.

54. COLIN DAVID LEIGHTON (44) - a chartered mechanical engineer employed by Shell U.K. Limited at their Tullos office in Aberdeen and who is involved in the performance standards assurance programme.

55. BRIAN ROBERT TWADDLE (42) - an employee of Shell U.K. Limited and the project manager of MACH (minicell and column hydrocarbon project).

56. JOSEPH PRIEST (52) - a non-destructive tester on the Brent Bravo platform who was employed, in September 2003 by Motherwell Bridge Inspection.

(b) The witnesses who provided affidavits

57. JANICE FLINT - a personnel manager employed by Wood Group Engineering (North Sea) Limited who gave evidence relating to Keith Moncrieff's employment with the Group.

58. JOHN ARMSTRONG - a radio operator admin. employed by Universal Sodexho who was on board Brent Bravo on 11 September, 2003 and informed, by radio, Shell Log and the offshore standby vessel Havila Star of the situation and also apprised, by telephone, the coast-guard in Aberdeen of the situation on Brent Bravo.

59. HUGH MUIRHEAD McCUE - the father of Sean McCue.

60. DERK KAPPELLE - a director of Shell U.K. Limited, the owners of the Brent Bravo Offshore Platform who spoke to the location of the platform in the North Sea.

61. SIMON DAVID REID - a chartered mechanical engineer employed by Bureau Veritas as a senior verification engineer and was in 2003 the verification focal point for the Brent Field verification.

3. THE BRENT BRAVO OFFSHORE PLATFORM

(a) General Description

The Brent Bravo platform is a concrete platform structure built to the Condeep design and installed in the Brent field complex in the mid 1970s. The complex comprises four production platforms, namely Alpha, Bravo, Charlie and Delta. The Brent field is located in Quadrant 211, Block 29 of the United Kingdom sector of the North Sea. The platform sits in about 140 metres of water.

The oil produced by the Brent field is exported, via the Cormorant A platform, to Sullum Voe. The produced gas is exported via the Brent system to St Fergus.

The topside and process facilities of the platform are supported by a concrete gravity structure sitting on the seabed and comprises of nineteen compartments, or cells, three of which extend upwards as legs, or shafts, in order to support the topside structure. The three legs measure some 170 metres in height.

Sixteen of the compartments provide a storage and settlement system for the produced oil and liquids and hold 159,000 m³ of oil and water.

The two southern legs contain production well conductors and are filled with water to sea level. These two legs are not normally accessed.

The northern leg, or utility shaft, contains pipework and pumps for the oil storage and export system. The water level in the utility shaft is normally maintained at about 74.5 metres above the leg base. A minicell is located at the base of the utility shaft and is normally flooded but can be dewatered.

The concrete structure requires to remain in compression for structural stability and the cells are maintained full of liquid with oil on top, water below, with a settlement interface. The structure is subject to constant pressure from the internal column of water and a header tank.

The upper section of the utility shaft contains piping systems and pumps for (i) sea water cooling (service water), (ii) five pumps, (iii) produced water and (iv) crude oil export. Oil lines in the utility shaft transport produced oil and water to the storage cells. There is a platform at the 157.4 metre level,, a platform at the 101.2 metre level which supports the drawdown header tank and a platform at the 96.2 metre level which supports the storage water pumps.

The mid section of the utility shaft controls the production storage and distribution. The oil rundown lines enter the 24 inch manifold situated on the 81.2 metre level which also supports the oil booster pumps. The crude oil export lines terminate at the 81.2 metre level. A platform at the 76.7 metre level supports the storage manifold and below this the cell fill lines distribute stored production to the surrounding concrete cells.

The lower section of the utility shaft, the bilge, is normally filled with water to 74 metres and is not accessed. It contains a central circular structure known as the minicell. The storage water is routed through the minicell and out to the base of the concrete cells. In addition to the functional storage water lines a number of redundant lines associated with the platform installation remain in place and were cement filled after the platform base was grouted to the seabed.

The utility shaft may be accessed either by means of the lift, which terminates at the 81.2 metre level, or by 90 metres of stairs.

(b) The Power Sources

(i) Three main generators, Avon gas turbines, supply all the systems on the platform and are designed to automatically switch off when there is a general platform alarm and shutdown.

(ii) The back-up power supply is by means of two diesel fuelled Ruston submain generators which are inhibited from starting if there is a gas release on the platform.

(iii) Thirdly, there is an emergency diesel generator, which on sensing there is no power automatically, within a minute, runs up and closes on to the switchboard in order to supply power for essential systems such as light, radios etc. The running of the emergency generator will depend on the gas situation on board the platform.

(iv) Finally, there is a system known as the uninterrupted power supply (U.P.S.) which operates on batteries in the event of loss of A.C. power on the platform, and supplies communications and other systems in order to facilitate the emergency response and the resumption of main power generation.

(c) The Utility Shaft

(i) Pipework

The identifiable pipework systems contained within the utility shaft are, firstly, the three 8 inch oil rundown lines which transfer crude oil from the platform process system to the concrete storage cells at the base of the platform. The oil rundown lines enter the 24 inch manifold independently and are fitted with isolation and level control valves.

Secondly, the storage manifold which is located at the 76.7 metre level and allows the flow from the oil rundown lines to be diverted to the selected cell storage system and individual cells. The storage manifold is also used to reverse the flow to the oil export lines.

Thirdly, the cell fill lines which route the flow from the utility shaft to selected external storage cells which are clustered around the three platform legs.

Fourthly, the oil export lines which allow, when required, the stored oil to be pumped to the export flowline.

Fifthly, the storage water lines which can be used to introduce water to, or draw water from, the cells so as to maintain the water levels within the storage cells.

Sixthly, an independent service water system which provides seawater for the required platform functions.

Seventhly, an independent fire water system which provides seawater for the platform fire and deluge systems.

Eighthly, the ballast lines which were designed for use during the installation operations and are now redundant and are grouted and isolated.

In addition to the three 8 inch oil rundown lines four other lines from services located on the platform topside, connect to the 24 inch manifold. Firstly, the redundant drain line from the Brent Alpha platform. Secondly, the closed drain line from the process drains degasser vessel located at the 158.2 metre level in the utility shaft. Connected to the closed drain degasser rundown line, by means of an equal 4 inch tee and a 6 inch by 4 inch reducer, is the open drain line from tanks located on the lower deck of the platform. Also connected to the closed drain degasser rundown line, with an isolation valve, is a line from the caisson pumps on the level below. The closed drain degasser rundown line is fitted with isolation valves, a level control valve and a non-return valve. Finally, the condensate line routed from the low pressure flare knock-out drum located on the south face of the platform connects to the 24 inch manifold but is split and enters the manifold at two points. Both branches of the condensate line are fitted with isolation valves and level control valves.

(ii) Gas and Fire Alarm Systems

Within the utility shaft is a fixed fire (both flame and smoke detection) system and a gas detection system.

There are twenty one fixed gas detectors placed throughout the utility shaft to identify situations where a gas hazard exists. There are six situated at the 76 metre level, including three in the heating, ventilation and air conditioning extract; three situated at the 81 metre level; three at the 96 metre level; three at the 101 metre level; and six situated at the 154 metre level. The gas detectors are arranged in voting groups. As pellistors are not infinitely reliable and in order to guard against a situation where one false indication could cause an emergency shutdown the gas detectors are arranged in groups of three so that at least two detectors require to sense gas before there is any executive action.

The devices intended for light gas fractions such as methane are calibrated to indicate 60% of the methane lower explosive limit with 2.5% methane, i.e. their sensitivity is set about 27% high in relation to methane and this allows for some deterioration in sensor performance. The lower explosive limit for methane is 5%.

Detectors intended for heavier gas fractions are calibrated to indicate 95% of the lower explosive limit with 2.5% methane. Accordingly, they indicate about twice the correct value if sensing methane but because pellistors are less sensitive to heavier fractions, their reading when sensing heavier fractions is lower and usually closer to a correct reading.

The calibration of gas detection heads is checked on a regular basis and was checked in July, 2003.

A gas reading of 20% of scale produces an alarm condition called "low gas" and a reading of 50% of scale is called "high gas". As the gas detectors in the same area are connected in voting blocks if two or more detectors in a given voting block register low gas this is a "confirmed low gas" condition. Similarly, if two or more detectors register high gas this is a "confirmed high gas" condition.

All gas alarm indications are available to the control room operator but a confirmed reading is required before any automatic executive action, such as a general platform alarm or shutdown, occurs.

The fire and gas system logs data which can be subsequently analysed.

(iii) C.C.T.V.

The various levels within the utility shaft can be monitored by the operations control room personnel by means of C.C.T.V. cameras. These cameras transmit black and white images to the operations control room. In September, 2003 the quality of the images was poor and lacked clarity, but were adequate to enable the personnel in the operations control room to locate on 11 September, 2003 the deceased lying at the 81 metre level within the utility shaft. One of the cameras sited at the 81 metre level did not, on 11 September, 2003 pan effectively.

(iv) Communications

On board the Brent Alpha platform there is a Tannoy public address system which allows information, and orders, to be announced throughout the platform, including the utility shaft. In addition, there is a telephone system with fixed telephones at each level within the shaft which enable two way communication between persons in the shaft and the operations control room.

(v) Emergency Lighting

Each emergency light fitting in the utility shaft has two fluorescent tubes which are powered by the emergency generator. In the event that the emergency generator does not start, emergency lighting in the utility shaft is powered by the batteries but only one tube in each emergency light fitting comes on thereby reducing the visibility in the shaft considerably.

(vi) Procedure in 2003 for entry to the Utility Shaft

The utility shaft of the Brent Bravo platform has a single point of access and egress and is thus subject to confined space safety procedures as though personnel were entering a vessel. Personnel who work in the shaft are all qualified as either leg competent or the higher qualification of leg authorised. In order to be leg competent an employee must have undergone training and be familiar with the position and function of the equipment within the shaft such as use of the lift, telephones, fire extinguishers, breathing apparatus and deluge sets in addition to being aware of the procedure in the event of an alarm and he must know his muster point. In order to qualify as leg authorised personnel, mostly Shell U.K. Limited technicians, must be trained in the processes which occur within the shaft in addition to being familiar with the requirements for leg competence. The names of those persons who are qualified as leg competent or leg authorised are entered onto the Authorised Persons Register together with the effective date of their authorisation and the date when that authorisation expires.

No person was permitted to enter the utility shaft alone or to work in the shaft alone, and only persons trained and competent in the use of breathing apparatus were allowed to enter the shaft. Unless there was breathing apparatus at every level in the leg, and in sufficient numbers for entry purposes, each person entering the shaft required to be issued with personal breathing apparatus.

The maximum number allowed to enter the utility shaft was determined and approved by the asset owner and each job in the shaft was assessed by the platform manager and the number of personnel involved in the task restricted accordingly.

At the point of entry to the utility shaft there was a notice board on which was displayed the basic leg entry procedure as well as a leg entry control board.

A permit to work, plus a leg entry certificate and leg sentry was required for all work in the shaft, including all categories of work and inspections not normally undertaken as part of watchkeeping duties. Prior to the issue of a leg entry certificate steps were taken to ensure that the shaft was safe to enter and that there was clear and safe access to and egress from the worksite. If it was considered unsafe to enter the shaft a notice to that effect required to be posted on the leg entry control board. A leg entry register was kept at the entrance to the shaft and used by the leg sentry to record all leg entries and exits.

A leg sentry required to be positioned at the entrance to the shaft, the control point, during the whole of the time personnel were working in the shaft. The duties of the leg sentry were to control entry, and he would refuse a person entry to the utility shaft if that person had no permit to work, to alert those in the shaft of any danger which may arise while they were in the shaft and to maintain telephone or radio contact with the working party and the control room. The leg sentry had authority to refuse entry to unauthorised persons and to order evacuation. The leg sentry required to warn those in the shaft of any danger outside which was likely to affect them and immediately instruct them to evacuate the shaft. The leg sentry required to be instructed in emergency procedures which applied on the platform and which may have been relevant to entry to the shaft.

When there was no requirement for a leg sentry (e.g. entry for operations first line maintenance, watchkeeping and safety checks by operations personnel, pre-entry checks, safety inspections by the platform manager or platform safety personnel, visual inspections by resident platform inspectors and accompanied visitors) the control point was the process control room and completions of the leg entry register required to be done by the process control room operator. However, the entry team must have included a person assessed as leg entry competent.

No person was allowed to enter the shaft until they, or the leg sentry acting on their behalf, had reported to the control room, and the control room personnel had confirmed that a current leg entry certificate was in force. The control room personnel could stop entry if there was reason to believe entry should not take place.

On entering the shaft the persons identity card required to be hung on the control board at the shaft entrance. Personnel could descend and ascend within the shaft by means of either the lift or the stairs. The lifts were used for the normal conveyance of personnel and the maximum allowable load could not be exceeded. The lifts required to be isolated under permit if work was ongoing in their immediate vicinity and presented a hazard to the work party. Tools and equipment required to be lowered to the worksite using either the platform crane or the winches provided.

Once the work party arrive at the worksite they required to establish contact with the leg sentry. All personnel entering the shaft had to be in possession of an approved safety torch, a gas monitor available to each work party and one member required to have a radio. An approved meter for monitoring oxygen deficiency and H₂S content must at all times have been located at the work place when personnel were in the shaft and a person trained in the use of the meter required to be present at all times and carried out atmosphere checks continuously until the men left the shaft. The person monitoring the atmosphere required to advise all personnel of any change in the condition of the atmosphere.

Communication with the control point had to be established immediately on entry into the shaft and the radio required to be checked on arrival at the worksite.

Sparging took place before entry to the shaft and not until H₂S was no longer detectable in the water. If sparging arrangements changed, all personnel had to leave the shaft and the atmosphere required to be re-tested prior to re-entry. Sparging could not be started when personnel were in the shaft. Oil accumulation on top of the water required to be removed, as much as was possible, prior to entry.

Deluge or sprinkler fire extinguishing systems required to be live throughout the period of work in the shaft and would activate automatically in the event of a fire.

If the utility shaft ventilation failed all work in the shaft required to stop and all personnel had to leave the shaft if imminent restart of the ventilation was not envisaged. The leg sentry had direct and immediate access to an approved breathing apparatus set.

On exiting the utility shaft the persons identity card required to be removed from the control board at the shaft entrance and his absence recorded in the leg entry register and reported to the control room.

In the event of a change of platform status personnel in the utility shaft required to stop all work and contact the leg sentry or the control room for instructions by radio or telephone. Personnel had to assemble at the stairway with breathing apparatus. Providing that evacuation did not entail moving up into an area of danger personnel had to evacuate the shaft via the stairway carrying breathing apparatus. One member of the working party had to monitor the atmosphere using the test equipment provided. On advice from the control room, or in the event of the instruments recording an abnormal atmosphere, breathing apparatus required to be donned. If possible, the work party had to vacate the shaft as a group. When the shaft had been evacuated the control room required to be informed. Immediately on leaving the shaft personnel had to report to their muster stations, leaving their breathing apparatus at the shaft entry point. If it was safe to do so the leg sentry had to return the leg entry register to the control room prior to him reporting to his muster station. If it was not possible to return the register the leg sentry required to contact the control room by telephone to report status.

If the leg sentry, or the control room, had not been contacted by the personnel in the shaft, following a change of platform status, then the control room had to take the initiative and attempt to make contact either by radio or by telephone. Once contact had been made with the personnel in the shaft the control room gave instructions either to remain at the worksite or to evacuate the shaft, depending on the reason for the alarm. If contact with the personnel in the shaft could not be made by the control room then the safety of the personnel in the shaft required to be established by physical entry following a full assessment of the risk of allowing additional personnel into the shaft.

(d) Operation of the Platform

(i) Produced vapour and liquid separation, and gas compression

In normal operation oil and gas is produced from the wells and flows up through the well conductors in the two southern legs of the platform and into the high pressure separator. The high pressure separator is a two-phase separator which separates the vapour from the liquids.

The high pressure gas, consisting of light hydrocarbons and water vapour, is sent to two stages of gas compression with pre-cooling and interstage cooling and is exported via the Brent system to St Fergus.

The liquids from the high pressure separator, which are a mixture of crude oil and produced water, flow to the low pressure separator. The mixture is predominantly water with some crude oil. The low pressure separator is a two phase separator and produces two streams, firstly, low pressure vapour and, secondly, a mixture of water and oil.

The low pressure vapour is sent to two stages of gas compression with pre-cooling and interstage cooling and this stream is blended with the gas from the high pressure separator for further compression, and export.

Liquids from the gas compressor knock-out drums are sent to the low pressure separator, with the exception of the low pressure compressor first stage knock-out drum liquids which are sent to the low pressure flare knock-out drum. The liquids from the low pressure separator, comprising a mixture of crude oil and produced water, are cooled in plate type heat exhangers. There are usually two parallel streams of crude oil coolers in use, with a spare stream available.

The crude oil is routed, normally via the three 8 inch oil rundown lines, within the utility shaft, to the 24 inch manifold and then to the storage cells at the base of the platform.

(ii) Product Storage

The amount of oil stored within the sixteen cells situated at the base of the platform varies depending on production schedules. To control the storage, settlement and export of the produced oil the sixteen storage cells are linked in four groups of four cells. At any one time one group of cells is being filled, one group is being emptied, and the remaining two groups are allowing the liquids contained therein to settle and separate.

The design of the platform substructure requires that the concrete cells remain in compression.

A ballast, or drawdown, system maintains the liquid levels for the cells within the design parameters. The internal level in the cell system is maintained by a static header tank. The level in the header tank is automatically adjusted by level control valves which pump produced water out to the top of the utility shaft for discharge, or allow seawater to enter the cells at an inlet point. The water is distributed to the storage cells below the oil/water interface through a manifold system within the minicell. All the storage cells contain sand ballast to a level of nineteen metres. The lines from the minicell manifold system penetrate the cells just above the sand ballast level and are used in conjunction with the drawdown system and level controls to maintain a permanent static head during oil import and export operations.

During normal production the produced liquids from the platform separation process are routed to the storage cells. Produced fluids currently comprise about 90% water and about 10% de-gassed crude oil. Produced fluids are transferred from the separation system in the platform topsides to the 82.7 metre level in the utility shaft through three 8 inch rundown lines. From the 24 inch manifold at the 82.7 metre level and a series of manifolds at the 77.2 metre level the co-mingled fluids free flow into the selected storage cell group through cell fill lines which extend from the utility shaft to the tope of the storage cells. When the required storage capacity has been reached the produced fluids are routed to another group of cells and the co-mingled fluids in the storage cell are left to separate out into their oil/water components.

The separated water is affected by the presence of naturally occurring sulphate reducing bacteria which generate hydrogen sulphide. This becomes dissolved in the water but will be released as a toxic gas if water is released into the atmosphere.

Settled oil is drawn out of the storage cell by booster pumps located at the 82.7 metre level. The positive pressure from the header tank drives the oil up to the booster pump suction, maintaining a positive pressure at the pump suction. The valves on the 77 metre level are reconfigured to allow oil to pass through the fill lines to the booster pump suctions. The produced oil is pumped up to the topsides where a further series of pumps, and an export pipeline transfer the oil to Brent Charlie.

The fluid level within the storage cells is maintained by the permanent static head tank located in the utility shaft at the 102.2 metre level. Large volumes of liquid pass into, and out of, and between, cells depending on export rate and production rate. The water drawdown system maintains the cell pressure at approximately 4 bar below the external sea pressure. The water level in the static head tank is maintained at approximately 105 metres. The sensitivity of the control system either calls for produced water to be discharged or sea water make-up to be introduced.

(iii) Utility shaft sea water level control

A level of sea water is maintained at the base of the utility shaft. The level is maintained at about 74.5 metres which is below the sea level which is about 140 metres. This situation ensures that the concrete walls of the shaft remain in compression. Normally there is no flow of fluids into the utility shaft but should the water level within the shaft rise, for any reason, the level is restored by operating the bilge or contingency pumps.

(v) Open drains and process drains

The open drains system collects rain water from the deck drains and also miscellaneous water effluent. The collected water flows into the open drains tank from where it is pumped on level control to the closed drain degasser rundown line. There is normally a continuous flow of discarded salt water from the potable water makers into the open drains tank and from there to the process drains tank and from there to the closed drain degasser rundown line. The process drains system is normally used to enable intrusive maintenance work to be done on process systems and is used to drain down vessels and pipework which have already been depressurised. Only residual hydrocarbon liquids are disposed of in this way but as some fluids may be volatile a process drains degasser vessel is provided to allow for vapour disengagement to the low pressure flare. The flushing of the vessels and pipework with service water usually follows drainage of residual hydrocarbon liquids in preparation for entry into the vessel. A network of drains from vessels and pipework feed into the process drains degasser vessel. The collected liquids are normally maintained at a prescribed level within the process drains degasser vessel by a control valve on the liquid outlet line. Excess liquid is fed into the closed drain degasser rundown line by opening the level control valve. This liquid then flows, via the manifolds, to the storage cells.

(vi) High Pressure and Low Pressure Flare Systems

The high and low pressure flare systems are part of the safety systems on the platform.

The high pressure flare system collects excess gas from high pressure vessels in order to preserve normal operating conditions. In the event of a process upset the system prevents over-pressurisation of individual vessels by the operation of pressure safety valves. In normal operation hydrocarbon liquids are vaporised to the high pressure flare by electric heaters.

Any heavy hydrocarbon liquid which may accumulate over time in the boot of the high pressure flare drum are pumped into the low pressure flare knock-out drum.

The operational design of the platform envisages that, during a surface process shutdown, process modules are segregated from each other by automatically closing isolation valves. A surface process shutdown initiated by the fire and gas detection system also entails a surface process blowdown. A surface process blowdown will result in automatic depressurisation of all the high pressure process plant with a few exceptions, into the high pressure flare knock-out drum sending vapour to the high pressure flare where it is burned in a controlled manner.

During a surface process blowdown the high pressure flare knock-out drum is segregated from the low pressure flare knock-out drum by the closing of an isolation valve at the inlet to the high pressure flare knock-out drum pumps. The high pressure flare knock-out drum collects entrained liquids from the hydrocarbon vapour. The liquids are chilled as a result of the sudden expansion of the hydrocarbon mixture.

4. THE TEMPORARY REPAIR ON LINE D-115-A1105

On or about 14 November, 2002 during routine watchkeeping duties an operations technician observed a leak, in the form of a drip, coming from a 1 mm hole in the closed drain degasser rundown line which runs from the process drains degasser vessel down to the 24 inch manifold in the utility shaft. The said hole perforated a section of the line consisting, in part, of a 4 x 2 inch eccentric pipework reducer situated at the 81 metre level within the utility shaft. The hole was seen to be leaking oily water. An absorbent cloth was placed beneath the hole to catch the drips. The leak did not cause the gas detection system to alarm.

Line D-115-A1105 is classified as a hydrocarbon line as it carries, when used for flushing, a quantity of hydrocarbons from the process drains degasser vessel. The said degasser vessel is not in constant use and is only required when hydrocarbon vessels and equipment on the platform are drained and flushed with seawater and nitrogen prior to maintenance or inspection. As the line carries hydrocarbons and passes through a confined space, namely the utility shaft, it is designated a safety critical line as a failure of the line could cause, or substantially contribute to, a major accident.

On or about 17 November, 2002, following consideration of the leak by Terry Stout, the operations supervisor, and Thomas Wotherspoon, the mechanical lead technician, a patch was applied to the closed drain degasser rundown line by Thomas Wotherspoon in an attempt to contain the leak. While the repair was being carried out John Cairney, the installation inspection engineer, Christian Hannah, an operations technician and Sean McCue were also present within the utility shaft.

The patch which was applied consisted of a piece of 5.08 mm thick neoprene measuring about 88.9 mm long by 50.8 mm wide, held in place by two jubilee clips. The position of the hole, being on the under side of a horizontal run of the line which ran close to the grating beneath it and also, close to a flange, made the application of a repair awkward. The repair was not carried out under a permit to work but was done as first line maintenance under the supervision of the operations supervisor.

The use of neoprene and jubilee clips to effect the temporary repair was not in compliance with the standards of Shell U.K. Limited. Approval from the technical authority was not obtained prior to the carrying out of the repair. Such approval would not have been given as neoprene is not considered to be an appropriate material to use on a hydrocarbon line as it would probably deteriorate when in contact with hydrocarbons and, in any event, neoprene is not designed to retain the pressure contained within the system.

John Cairney entered the temporary repair in the patch register as item number 86. Although John Cairney believes he informed the technical authority onshore of the temporary repair, and applied for a deviation to standard number, the technical authority have no record of having received any deviation request form from offshore relating to patch number 86. Accordingly the temporary repair was not entered into the deviation to standard register held onshore. The patch register was kept offshore and the technical authority onshore did not, in 2002, have electronic access to it, although a copy could be requested if required onshore. In these circumstances, no deviation to standard number was allocated, no approval for the temporary repair was obtained from the technical authority and no completion date for the replacement of the section of the line, or spool, was obtained.

John Cairney, as part of his duties as installation inspector, carried out monthly visual examinations of all the temporary repairs on the platform, including patch number 86, for signs of leakage, deterioration and general integrity. No concerns regarding the repair were noted by him.

In February, 2003 John Cairney reviewed the patch register and undertook a patch audit. As a result of his audit he noticed there was no deviation number for patch number 86. He corresponded with William Peacock, who was employed onshore and brought to his attention that he still awaited a response to the deviation to standard request form submitted by him.

In June, 2003 the section of the closed drain degasser rundown line which had been repaired with patch number 86 was surveyed in preparation for the fabrication of a replacement spool for that section of the line.

In July, 2003 Miss Marjorie Chamberlain, a member of the onshore mechanical maintenance support team, was instructed to consider all the Brent field patch registers, including that relating to the Brent Bravo platform, and to ensure that all requests for replacement items had been made.

On 17 August, 2003, during the annual shutdown, a single gas head went into low level alarm at the 81 metre level in the utility shaft. At the time the platform was flushing and purging the hydrocarbon process with seawater and nitrogen and the closed drain degasser rundown line was being used to drain fluid from the separators to the storage cells, The drain valve was closed and Alistair Harcombe and Scott Fraser descended the utility shaft to investigate. They found the gas head, immediately below patch number 86, soaked in water with a slight trace of crude oil. The portable gas meters carried by the men did not register the presence of gas. The men asked the control room to re-open the drain valve and to flush water down the line. On that being done they observed water spraying from the area of patch number 86 onto the inside of the utility shaft wall, a distance of some two or three feet. The control room decided to finish the flush, as it was almost complete, and to deal with the leak later.

On 21 August, 2003, when the platform crew changed, the operations supervisor's written handover noted that the:-

"temporary repair on the degasser line, immediately downstream of the L.C.V. failed and is leaking badly, trying to track down details for replacement spool."

The same information was passed in the operations supervisor's written handover when the crew changed on 3 September, 2003.

On 4 September, 2003 Miss Chamberlain completed a maintenance delivery work request which puts in motion the procedure for the maintenance delivery team to have fabricated a new replacement spool for that section of the line which had been temporarily repaired with patch number 86 and also to follow up the issue of a deviation with the technical authority. A ranking of 1 was given to the matter, the highest ranking, as the view was taken that the replacement spool was urgently required and a time scale of "within one month" was requested.

Following the incident on 11 September, 2003 the jubilee clip nearest the adjacent flange was seen to be loose while the other jubilee clip was tight. Thereafter, the relevant spool was removed to the Health and Safety Executive laboratories where the temporary repair patch number 86 was removed revealing a hole in the pipe measuring some 23.2 mm by 28 mm, an approximate area of 310mm² of missing material.

Radiographic examination of the pipe at the laboratory showed extensive corrosion damage around the hole. Corrosion was initiated by the loss of protection which would have otherwise been provided by the internal protective coating. The loss of this coating allowed contact by flowing sea water containing oxygen and solid particles, such as sand, with the internal unprotected surface of the pipe.

5. THE NON-RETURN VALVE 9 P097

The non-return valve situated on the closed drain degasser rundown line is a 4 inch swing check valve designed to permit forward flow and to prevent reverse flow. The swing check valve closure mechanism incorporates a disk which swings freely on a hinge. The main function of such a valve is to prevent or restrict backflow. This function is achieved through linear or rotary motion of the closure member which is kept open by the flowing fluid. When the flow is reduced towards zero, or reversed, the closure member is moved against its seat by gravity, supplementary springs and back pressure. Such a valve may prevent any appreciable backflow but cannot be relied upon to effect a complete seal stopping all flow from going through as the valve relies on either the pressure differential, which in this application is relatively low, or is dependent upon the weight of the valve keeping it closed.

Subsequent to the incident on 11 September, 2003 valve 9 P097 was visually inspected at the Health and Safety Executive laboratories on 8 October, 2993. The valve disc, complete with arm fixing nut and split pin were found lying unattached in the body of the valve. The valve shaft was in place but there was no lever arm present.

As at 11 September, 2003 the condition of the non-return valve on the closed drain degasser rundown line was such that it could not function as intended.

6. LEVEL CONTROL VALVE 6600

The level control valve on the closed drain degasser rundown line is a 2 inch V valve with integral actuator. The valve is a trunnion mounted ball valve. In such a valve the ball is firmly held in position and supported at the top by a shaft in a bearing housing and at the bottom by a trunnion. The main function of the valve is to maintain the liquid level in the process drains degasser vessel. This is achieved by opening and closing and modulate on demand so as to block the flow sufficiently to maintain, as required, the liquid levels in the process drains degasser vessel. The valve is designed to fail close. Thus on failure of the actuator, for any reason, the valve will close and remain closed.

Prior to the incident on 11 September, 2003 it was known that LCV 6600 could not maintain the liquid level in the process drains degasser vessel.

On 8 October, 2003 LCV 6600 was inspected at the Health and Safety Executive laboratories and found to be in the closed position in the absence of air pressure on the actuator. During pressure testing on 11 November, 2003 it was found that the valve, albeit in the closed position, was leaking appreciably in both directions. The actuator was functioning as designed to open and close the valve but the valve was not blocking the liquid flow in either direction.

On 10 December, 2003 the valve was opened in the laboratory and it was found that the seats located between the ball and the valve body were missing. Accordingly there was no effective sealing of the valve.

A trunnion mounted ball valve cannot be relied upon to provide a tight shut off as, in operation, the opening and shutting of the valve causes wear to the constituent parts and therefore it is likely to leak to some extent and in particular is likely to leak in the reverse direction.

7. EMERGENCY SHUTDOWN VALVE EZV 44715

Emergency shutdown valve EZV 4415 is a 76.2 mm B.S. stainless steel floating ball valve located at the outlet of the High Pressure Flare Knockout Drum on the Brent Bravo platform. The assembly comprises a valve body (ball valve), link section, actuator and control panel.

The closing mechanism is a ball which is not fixed tightly in position but is free to float, to a limited extent, in the body of the valve. The ball moves in the axial direction of the valve as a result of any pressure differential across the ball when closed. The ball is not fixed at the bottom of the body and the stub shaft is not rigidly fixed to the top of the ball. The stub shaft drops into a clearance slot in the top of the ball, thus the ball is free to float.

The actuator consists of a pneumatic cylinder with a spring return mechanism. When air pressure is supplied to the pneumatic cylinder the valve opens and when the pressure is released the spring closes the valve. The actuator has an indicator on top of the body which indicates whether the valve is open or closed.

During normal operations on the platform this valve remains open and when utilised its main function is to block flow from the High Pressure Flare Knockout Drum by closing on demand, during a surface process shutdown or blowdown, and in an emergency, it should automatically default to the closed position on removal of air/hydraulic pressure on the actuator.

The High Pressure Flare Knockout Drum is designed to handle very low temperature liquids arising from a surface process blowdown. There is sufficient pressure generated in the High Pressure Flare Knockout Drum during a blowdown to push liquids through the High Pressure Flare Knockout Drum pumps, even though they are not running, into the Low Pressure Flare Knockout Drum. The low temperature fluids will flash to the operating pressure of the Low Pressure Flare Knockout Drum, approximately atmospheric pressure, resulting in very low temperatures. The Low Pressure Flare Knockout Drum and associated pipework, including the rundown line from the Low Pressure Flare Knockout Drum, is not designed for very low temperatures. At very low temperatures carbon steel becomes brittle and may crack or fracture causing a sudden loss of containment of the process fluids.

In addition the closing of the valve prevents liquids, from either of the Knockout Drums going up to flare which can result in the liquid spraying out the top of the flare, igniting, and falling back on to the platform as burning rain.

Valve EZ 44715 had a history of failures for some three years prior to the incident on 11 September, 2003. A number of work orders were raised so that the valve could be attended to. In September, 2002 the valve was checked and found to be working but there was a problem/fault with the actuator. On 22 September, 2002 as a result of a planned maintenance routine test it was reported that:-

"valve failed, note on history 'previously known to fail, awaiting materials on work order 1044918'."

On 3 July, 2003 in the course of a review of outstanding work orders, work order 10448718 was cancelled as the valve, as opposed to the actuator, was said to be in working order. During the annual maintenance shutdown in August, 2003 valve EZV 44715, together with a number of other valves, failed to close during routine testing.

After the incident on 11 September, 2003 the valve was removed from the platform and examined at the Health and Safety Executive laboratories and was found to have seized in an open condition and could not close automatically as intended. The cause of the seizure was located in the actuator where there was corrosion between the actuator output shaft, the actuator housing and the top sealing arrangement.

8. AUER CHEMICAL OXYGEN SELF-RESCUERS

Each person entering the utility shaft must have available to them breathing apparatus. Unless there is breathing apparatus at every level in the shaft in sufficient numbers for the party, each person entering the shaft must be issued with personal breathing apparatus. The breathing apparatus used on the Brent Bravo platform was the AUER chemical oxygen self-rescuer. The device is carried in a yellow pouch with a webbing harness and is worn over the chest like a bib.

When worn they can impede the work an individual is engaged in. Accordingly, the self-rescuer sets must accompany the person, so as to enable escape in a hazardous atmosphere, but need not be worn at all times.

Within the pouch is a metal protective case containing the self-rescuer. A shoulder strap is attached to the case and there is a label on the case containing the instructions for use of the self-rescuer.

If utilised the self-rescuer set provides oxygen for approximately half-an-hour, but will depend on how strenuously a person requires to breath.

Following the incident on 11 September, 2003 two self-rescuer sets were recovered from the 81 metre level in the utility shaft. The sets were examined and tested at the Health and Safety Executive laboratories. Both sets were intact with seals on the closure mechanisms. The seals would have been broken had the canisters been opened.

When the carrying case lids were removed the contents were found to be correctly stowed but the breathing tubes on both sets were partially collapsed and had areas of their inner surfaces stuck together. Stretching and manipulation of the tubes alleviated this.

The closed circuit breathing simulator tests produced satisfactory results with both sets performing within their design criteria.

The examination and testing of the two self-rescuer sets established that neither man used his self-rescuer set although both sets were capable of operating satisfactorily.

9. CROWCON TRIPLE PLUS GAS METER

Every working party, being at least two in number, entering the utility shaft must have with in it an approved gas monitor. The Crowcon Triple Plus gas meter is an approved gas monitor.

The meter has three sensing heads installed, an oxygen sensor, a methane sensor and a hydrogen sulphide sensor. It has a data logging function that records the levels detected by the three sensors. The meter is battery powered and can be carried by means of a shoulder strap. There is a display and a read-out and there are audible alarms for all three sensors. If a problem is detected a light flashes and an alarm sounds.

The meters are calibrated for methane and the alarm will sound at ten per cent of the lower explosive limit of the gas and again at twenty per cent of the lower explosive limit. The lower explosive limit is the lowest concentration of methane in the atmosphere that, if ignited, would explode. A concentration of methane above the higher explosive limit would not explode even if there were an ignition source. With methane the lower explosive limit is five per cent and the upper explosive limit is fifteen per cent. Accordingly, the first alarm on the Crowcon meter would sound at ten per cent of the lower explosive limit, being point five of a per cent concentration of methane in the atmosphere.

Notwithstanding that the Crowcon meter is calibrated for methane it will detect any saturated hydrocarbons in the atmosphere and alarm within a safe margin in the presence of the whole alkane series, such as ethane, propane, pentane, hexane etc.

The gas monitor taken by the two men down the utility shaft on 11 September, 2003 was Crowcon gas meter serial number 2560016499.

The meter was recovered from the utility shaft and examined at the Health and Safety Executive laboratories on 7 October, 2003. The data recorded by the meter at the time of the incident was transferred from the meter to a laptop computer. A calibration check was carried out which showed that the meter functioned with acceptable accuracy except for the methane sensor which did not respond. The methane sensor appeared to have worked for a period of time on 11 September, 2003 but then failed. The failure was probably due to prolonged exposure to high levels of methane. This can be expected when this type of sensor, a pellistor, becomes saturated as it operates by burning the gas in the atmosphere.

10. CONTROL OF WORK ACTIVITIES

(a) Permit to Work System

The permit to work system is applicable to all Shell Expo locations, including the Brent Bravo Offshore platform, and is mandatory. A permit to work is required for all work in the Brent Bravo utility shaft which is not normally undertaken as part of watchkeeping duties.

The permit to work system is based on hazard management and is necessary to safeguard persons doing the work, personnel on board the platform, the platform itself and to comply with the relevant legislation. The work must be controlled and co-ordinated in a manner that meets all these requirements.

The permit is the means of providing written instructions, and authorisation, to the personnel carrying out the job, or a defined job in a hazardous environment, or both. The permit to work system is a key element in ensuring that all necessary steps are taken to ensure the safety of personnel and the platform.

All personnel connected with a job, those that authorise the job, those that supervise the job and those that carry out the job must understand the work content and how it will be carried out, the potential hazards and the precautions that are required, the work environment and the problems caused and the precautions needed. They must know the emergency actions that may be necessary should problems arise and they must be aware of their own responsibilities. Personnel must then comply fully with the requirements of the permit to work system and with the precautions and other requirements written on a particular permit.

The permit documents require to be signed, firstly, by an authorised permit signatory. His role is to agree work content, lay down precautions and overall timescales for a job, declare a worksite safe at the start of a job and accept a job as complete. The signature of an authorised permit signatory is required to issue a permit. Secondly, the permit documents must be signed by an endorser who, on a shift by shift basis, confirms that it is safe for a job to be carried out. Thirdly, the permit documents require to be signed by the person in charge of a worksite, to whom the permit is issued and he has the responsibility of ensuring that personnel covered by the permit are aware of, and comply with, its requirements. Finally, the permit documents must be signed by the originator who is the person with overall supervisory authority over the work and who appoints the person in charge of a worksite and will declare the work complete for approval by an authorised permit signatory.

The aim of the permit to work system is to identify, and to take steps to guard against, any potential hazards which might be associated with a particular job and also creates a paper record of the job which can be referred to at a later stage, if necessary.

(b) Work Orders

Where work is defined on a routine System, Applications and Products System work order (a S.A.P. work order) the work order itself may, at the discretion of the Asset operator, be used for authorisation of work without a covering permit to work provided the category of work, and associated procedures, have been risk assessed and approved for control by work order. The categories of work approved for control by work orders are:-

(i) minor maintenance and repair work on safety and emergency systems such as routine tests and checks which do not require isolation or inhibit any part of the system.

(ii) minor work and checks which do not effect the integrity of the system;

(iii) non-intrusive work on equipment which is already operationally shut down.

(iv) opening live electrical junction boxes in non-hazardous zones to carry out switching, testing, to prove dead, fault finding or other operations;

(v) opening, but not working on, live electrical junction boxes in hazardous zones which only contain IS circuits;

(vi) hand painting, except where the paint, or area to be painted requires the use of an air-fed mask; and

(vii) working at height on certified scaffolding or scaffolding work at height under the authorisation of an S.A.C. by qualified scaffolders.

(c) Routine Tasks

Certain tasks may normally be undertaken without a permit to work or work order provided that the activity has been subjected to a risk assessment, the area authority is informed before work starts to ensure that there are no conflicting activities, and the work is performed by a competent person. These tasks are:-

(i) routine production plant operations, crane and deck crew operations, drilling operations, helideck and hotel/administration activities carried out in accordance with platform procedures;

(ii) operation of equipment for approved training purposes and other low risk routine operations, activities or checks;

(iii) use of tools and or equipment inside the accommodation area, workshops, control room and other non-hazardous modules protected by fire and gas detection equipment;

(iv) visual inspection of areas (except in confined spaces);

(v) normal rigging operations by authorised riggers; and

(vi) manriding activities that have been specifically excluded from permit control by the O.I.M. when he is satisfied that the platform's drilling procedures include adequate instructions and safety precautions.

(d) Operations Umbrella

The term operations umbrella, sometimes referred to as the Shell umbrella, is not an official term and there exists no written specification of the work covered by the term. It has been described as the basic running of the platform, which operations technicians do. It covers work that the operations technicians do in line with their procedures for operating the process in the plant. One witness described the term as covering normal daily activities.

Many of the witnesses spoke of the operations umbrella but it emerged that there were varying views as to the scope of work covered by the term. It was said that one person's interpretation of what the term covers would differ from someone else's interpretation. Another witness described it as a grey area.

What was clear was that the term covered tasks carried out under the supervision, or at least in the presence of, an operations technician outwith the permit to work system or control by work order. These tasks were said to include, effecting a quick repair, first line maintenance, minor repairs or adjustments, plant checks, monitoring equipment, sampling, nipping a weeping gland or freeing a stuck valve.

It was said that the term did not cover intrusive work, electrical work or work covered under the platform operations procedures manuals and operations codes of practice.

11. START-UP IN AUGUST, 2003

At approximately yearly intervals the Brent Bravo platform is shutdown for the routine 8,000 hour servicing of the RB211s which drive the gas turbines. Personnel from Rolls Royce visit the platform to carry out the servicing. During these annual six day shutdowns the opportunity is taken to carry out a number of other activities listed in a shutdown plan.

A master isolation is put in place under the permit to work system. All activities during these routine shutdowns are carried out under these isolations. The jobs are listed and permits to work are raised against the master shutdown isolation.

When all the activities have been completed, and the paperwork has been signed off, the master isolation can be removed and the process integrity check carried out. If there is pressure testing to be done that is carried out in order to prove the integrity of the pressure envelope. Once the integrity of the pressure envelope has been proved the process operations technicians walk the lines against the piping and instrumentation diagrams in order to ascertain that everything is aligned correctly.

The activities carried out during a routine shutdown of the platform are covered by process start-up documents which are signed by the operations technicians, the operations supervisor and the nightshift system supervisor (process), to ensure that all the activities have been completed, that all the related paperwork has been signed off, that the isolations have been removed and that the platform is ready for start-up.

Throughout the platform shutdown the O.I.M. speaks to the onshore support team at regular morning conference calls and discusses the ongoing work. When the operations supervisor informs the O.I.M. that the platform is ready to start-up the O.I.M. obtains approval from either the asset leader or the onshore support team leader to start-up.

When the shutdown of the platform is not routine, for instance where there have been interventions into the process during the shutdown, or a major modification to the platform has been carried out, there would be a check sheet, known as a traffic light document, created. The traffic light document lists all the items which require to be checked before the platform is allowed to start-up. The items on the list start in red and as they are checked they are changed from red to amber and finally, when completed, they are changed to green. When all the items on the traffic light document are in green there is agreement that the platform can start-up.

The traffic light document is generated offshore and sent to the onshore support team who, throughout the shutdown go through the document and make enquiries of the O.I.M. and check that items on the document have been done. The traffic light document does not contain risk assessments covering any modifications but is just a check list.

The platform shutdown in August, 2003 was a routine annual shutdown and no traffic light document was created to cover the activities carried out during that shutdown.

During the August, 2003 shutdown of the platform the temporary repair, patch number 86, on the closed drain degasser rundown line, was seen to be leaking but no steps were taken to remedy the situation during the shutdown. In addition, during the said shutdown some fifteen valves, including emergency shutdown valve EZV 44715, failed to operate within specification. During the shutdown some of these valves were found, on subsequent testing, to operate, but not valve EZV 44715.

When the decision was made to start-up the platform on 22 August, 2003 the O.I.M. was not aware that temporary repair patch number 86 had leaked on 17 August, 2003. The last information he had regarding that patch was that which he had obtained from the installation inspector's August, 2003 report which stated that patch number 86, together with a number of other temporary repairs, was "in good condition with no signs of leakage or loss of integrity". The O.I.M. was aware, prior to the start-up of the platform on 22 August, 2003, that emergency shutdown valve EZV 44715, when tested during the routine platform shutdown, had failed to close. He checked the instrument performance function classification of the valve. The instrument performance function classification indicates the criticality of the valve in the system. The O.I.M. ascertained that the said valve was a component of an I.P.F. loop with a classification of III. Such a classification requires that the valve, if malfunctioning, be repaired as soon as reasonably practicable, planning a process or equipment shutdown as required. During this period arrangements require to be put in place to protect the integrity of the plant or equipment for the duration of the outage. All such decisions must be supported by a robust risk assessment.

The O.I.M. considered that the failure of valve EZV 44715 did not prevent the start-up of the platform given the I.P.F. classification was III. No written risk assessment was carried out in support of that decision.

The platform started-up on 22 August, 2003 and continued in production until the incident on 11 September, 2003.

12. EVENTS OF 11 SEPTEMBER, 2003

On Thursday 11 September, 2003 the Brent Bravo offshore platform was in production. Keith Moncrieff, a mechanical technician employed by the Wood Group, who was leg competent, and Sean McCue, a trainee operations technician employed by Shell U.K. Limited, who was leg authorised, were working the day shift from 7 am to 7 pm on the Brent Bravo platform.

On or about Monday 8 September, 2003 Stephen Deeth, a trainee operations technician employed by Shell U.K. Limited and Sean McCue had been sent, by Sydney Thomson, a systems supervisor (process) employed by Shell U.K. Limited, to examine the condition of the temporary repair entered as number 86 in the patch register, on the closed drain degasser rundown line. They observed that the temporary repair was dripping dirty water but their gas meter did not detect any gas. The next day, Tuesday 9 September, 2003, at the daily morning meeting Stephen Deeth reported his findings to Sydney Thomson.

Thereafter, Keith Moncrieff was instructed by Frank Millar, the integrated services contract team leader employed by the Wood Group, to get hold of an area technician and together they were to enter the utility shaft and look at the temporary repair at the 81 metre level which had been reported to be leaking. The intention was that Keith Moncrieff would carry out a visual inspection of the temporary repair in order that he could assess its condition and report back thereon. This inspection would be carried out while the area technician was present and carrying out his daily checks, and taking oil and water samples, in the utility shaft. Keith Moncrieff was instructed to carry out his inspection at the earliest opportunity but no timescale was set.

On Wednesday morning, 10 September, 2003 Keith Moncrieff was reminded by Frank Millar that he was to look at the temporary repair at the 81 metre level in the utility shaft.

On Thursday 11 September, 2003 preparations were being made for a pig launching operation. A pig is a cylindrical device that fits into the oil export pipeline and the flow of the oil being exported forces the pig through the pipeline and cleans the inner bore of the pipe. As part of the preparations for the pig launching operation a T.R.I.C. (toolbox talk risk identification card) was completed by Stephen Deeth. Present at the talk were the talk leader, namely Stephen Deeth, Paul Buchan, an operations technician employed by Shell U.K. Limited and Morgan Lewis, the area authority. A potential hazard associated with the pig launching operation was identified as a "hydrocarbon release from the degasser outlet leak". This was a reference to the temporary repair on the closed drain degasser rundown line which Stephen Deeth had observed leaking three days earlier. The control, which was noted on the T.R.I.C., to prevent this potential hazard occurring was, "repair leak prior to starting the job". The responsibility for taking action rested with Stephen Deeth and Paul Buchan.

At or about lunchtime on 11 September, 2003 Keith Moncrieff happened to meet Frank Millar and informed him that he had made arrangements to go down the utility shaft that afternoon to look at the temporary repair at the 81 metre level.

At or about 1.05 pm in the technical library on Brent Bravo Keith Moncrieff asked Mark Gallagher, a mechanical technician employed by the Wood Group, if he would go down the utility shaft and replace a patch, on a pipe with new rubber and two clips. Mark Gallagher felt unable to carry out this task due to his inexperience of the pipework within the utility shaft.

At the afternoon tea break, usually between 3.00 pm and 3.30 pm the whole shift was present in the technicians station, namely Stephen Deeth, Sean McCue, Paul Buchan, Sidney Thomson and Morgan Lewis, when it was agreed that it would be best to get the leak on the closed drain degasser rundown line repaired before starting the pig launching operation. Stephen Deeth asked Sean McCue when he was going to repair the leak. Sean McCue immediately tannoyed Keith Moncrieff and they arranged to go down the utility shaft together after the tea break. As the tea break was concluding Keith Moncrieff entered the technicians station looking for rubber. There was no rubber there and Keith Moncrieff and Sean McCue left together. As they left the technicians station William Boyse, an instrument technician employed by the Wood Group, asked Keith Moncrieff how long he would be down the utility shaft as William Boyse had a job to do in the shaft after Keith Moncrieff and Sean McCue exited it. Keith Moncrieff said he would be 15 to 20 minutes as he was going down to change a rubber seal and a couple of jubilee clips.

At about 3.30 pm Keith Moncrieff approached Peter Laycock, an electrical technician employed by the Wood Group, who was in the locker room, and asked him if there was any rubber in the switch room. Peter Laycock did not know but said Keith Moncrieff could have a look. The electricians on the platform use rubber and left over pieces are kept in a metal container in the switch room. Keith Moncrieff did not say what he wanted the rubber for but told Peter Laycock that he was going down the utility shaft with Sean McCue. Joseph Priest offered to act as a leg sentry but Keith Moncrieff told him that he did not have a permit so he could not have a leg sentry and that they were going down to have a look at a leak in a pipe through the control room. While in the locker room Keith Moncrieff asked Iain Ayers, an instrument technician employed by the Wood Group, if he could borrow a screwdriver. Iain Ayers got a screwdriver from his locker and handed it to Keith Moncrieff.

Keith Moncrieff and Sean McCue entered the utility shaft shortly after 3.30 pm. No permit to work had been raised and no leg sentry controlled their entry. The process control room operator, namely Paul Adie, acted as the control point for their entry. The two men took a Crowcon Triple Plus gas meter with them and each man head an AVER Chemical Oxygen Self-rescuer. They also had radios.

At about 3.38 pm the fire and gas detection system raised two alarms in the control room. The gas detectors indicated low and high gas levels at the 81 metre level within the utility shaft. The control room advised Sean McCue, by radio, of the gas alarms and he reported that fluid was spraying out from the closed drain degasser rundown line and striking the inside of the utility shaft wall. Sean McCue asked what liquid level in the process drains degasser vessel was indicated on the control room instruments. He was informed that the instruments were indicating a zero liquid level in the vessel. Paul Adie asked Sean McCue if it was possible to locally isolate the leak. Shortly after Sean McCue phoned the control room and reported that the isolation valve on the closed drain degasser rundown line, down stream of the non-return valve 9P097, was locked open by mechanical key interlock. Attempts were made to obtain the key required to close the isolation valve. All the keys were numbered and kept in the key safe in the control room. The relevant drawings required to be consulted to find the number of the key needed.

Some minutes later further alarms were raised in the control room indicating low level gas at the 76 metre level and in the extract air duct at that level. The acting operations supervisor, namely Sidney Thomson, was tannoyed and requested to attend the control room, which he did together with Scott Fraser, an operations technician.

At about 3.44 pm the general platform alarm automatically sounded as another gas detector confirmed low level gas at the 76 metre level in the utility shaft. An announcement was made over the tannoy informing the platform personnel that low levels of gas had been detected in the utility shaft. Moments later two gas detectors in the extract duct at the 76 metre level of the utility shaft confirmed low level gas.

Personnel responded to the general platform alarm by proceeding to their muster points. The attempts to obtain the key required to close the isolation valve on the closed drain degasser rundown line were abandoned on the sounding of the general platform alarm as personnel required to proceed to their muster points and no one was permitted to enter the utility shaft, in order to take the key down to the 81 mete level, unless it could be ascertained that there was no risk to that person.

At about 3.46 pm the fire and gas detection system raised two alarms in the control room indicating high gas levels in the extract duct at the 76 metre level of the utility shaft, which resulted in a surface process shutdown and an automatic surface process blowdown. The main power generators tripped and the utility shaft supply and extract ventilation fans stopped and the air intake and exhaust louvers closed. Power to the normal lighting system ceased and battery powered emergency lighting was provided throughout the platform, including the utility shaft.

The emergency diesel generator did not run up and close on to the switchboard automatically and required to be started manually. It took about 10 to 15 minutes to get the emergency diesel generator started. The uninterrupted power supply, which inter alia supplies the power to the hand held radios failed and for a short time communications by radio was not available. The telephone and tannoy systems continued to operate. Once the emergency diesel generator had been started normal lighting in the temporary refuge and the control room was restored.

At about 3.50 pm the gas detectors confirmed high level gas at the 81 metre level in the utility shaft and a high liquid level in the sea water header tank was indicated.

At this time the control room operator tried to contact Sean McCue by radio but received no response. The operator then called Sean McCue over the tannoy system and Sean McCue contacted the control room by phone. The control room operator told Sean McCue that they should leave the utility shaft.

At about 4.00 pm and again at about 4.28 pm a smoke detector activated at the 154 metre level in the utility shaft. It is not clear why smoke detectors were triggered as there was no fire.

By about 4.05 pm emergency power had been restored. Sean McCue and Keith Moncrieff had not exited the utility shaft and the C.C.T.V. cameras were used to search the utility shaft for the two men. As a result of this search a person was located lying face down at the 81 metre level.

At about 4.33 pm an oil mist detector indicated oil mist at the 81 metre level in the utility shaft and at about 4.58 pm oil mist was detected at the 76 metre level.

From about 5.24 pm until about 7.50 pm service water was introduced, by means of a hose, into the closed drain system in an attempt to replace the flow of hydrocarbons into the utility shaft by a flow of seawater. During this operation the C.C.T.V. appeared to show water emerging from the temporary repair patch at the 81 metre level in the utility shaft.

At about 5.33 pm one of the main generators was brought back on line and the storage cells were isolated. At this time main lighting was restored in the utility shaft.

At about 5.50 pm one of the 100% utility shaft extract fans was started, and the damper was opened, and by 5.54 pm gas levels at the 154 metre level were reducing. At about 6.11 pm one of the 50% utility shaft air supply fans was started and by 6.17 pm gas levels at the 76 and 81 metre levels were dropping. The fire and gas detection system in the utility shaft continued to raise alarms until about 7.02 pm when low level gas detectors at the 154 metre level were reset and remained healthy.

A three man emergency response team, including a medic, prepared to enter the utility shaft wearing breathing apparatus. At about 7.10 pm it was confirmed that the air in the utility shaft was suitable for entry and the emergency response team entered. Keith Moncrieff and Sean McCue were recovered from the 81 metre level of the utility shaft and pronounced dead by Dr Robert Stephen at about 7.55 pm.

At about 8.26 pm all personnel on the Brent Bravo platform were stood down from muster.

Following the incident the Crowcon Triple Plus gas meter, which had been taken down the utility shaft by the two men, was recovered from the floor at the 81 metre level and the data recorded therein, analysed. The information obtained was that the meter was switched on at about 3.34 pm, at or immediately prior, to the men entering the utility shaft. The meter detected small amounts of hydrogen sulphide. At about 3.39 pm the meter log indicated the presence of flammable hydrocarbons. At about 3.43 pm the meter recorded having alarmed at the low flammable hydrocarbon gas level. The oxygen level was logged at 20.9 vol %, which is the normal oxygen level. At about 3.47 pm the meter recorded having alarmed at the high flammable hydrocarbon gas level. At this time the oxygen level was logged at 20.6 vol %. At about 3.55 pm the meter reading was off-scale for flammable hydrocarbon gas level. From about 4.15 pm the meter no longer indicated any hydrogen sulphide gas. At about 4.26 pm the meter recorded having alarmed at the low vol % oxygen level having logged the oxygen level at 18.8 vol %. The meter logged a steady fall in the oxygen vol % from 3.47 pm. At about 4.31 pm the meter was no longer reliable for the measurement of flammable hydrocarbon gas levels, and at about 4.53 pm the meter stopped logging any data. At this time the oxygen level was logged at 17.6 vol %.

During the subsequent investigation of the incident a piece of rubber was found lying close to the temporary repair on the closed drain degasser rundown line at the 81 metre level of the utility shaft. It was observed that one of the jubilee clips which had been used to hold the neoprene patch to the line was not secure but appeared to have been loosened. Two AUER Chemical Oxygen Self-rescuers, neither of which had been used, and the screwdriver borrowed by Keith Moncrieff, were found on the floor at the 81 metre level within the utility shaft.

A reasonable inference to draw from the evidence is that the two men entered the utility shaft with the intention of replacing the leaking temporary repair patch on the closed drain degasser rundown line with another piece of rubber. That is what Keith Moncrieff had asked Mark Gallagher to do and that is what he had told William Boyse he would be doing. Keith Moncrieff looked for, and found, a piece of rubber, and borrowed a screwdriver. The piece of rubber and the screwdriver were found after the incident at the 81 metre level within the utility shaft. One of the two jubilee clips which held the neoprene patch appeared to have been loosened. Tests carried out by the Health and Safety Executive established that the temporary repair, with the loosened jubilee clip, could not contain a flow of water put through that section of the pipe.

The evidence established that the work of removing the existing neoprene patch and replacing it with another piece of rubber was work which required to be carried out under the permit to work system. Had a permit to work been raised it would have required an isolation and drain down of that section of the closed drain degasser rundown line prior to work commencing. Although the platform was in production on 11 September, 2003 an isolation could have been applied to the closed drain degasser rundown line while production continued. It was a line which was not in constant use. Normal operations required cleaning of the crude oil coolers about once a week, when the line would have been used.

The consequences of loosening one of the jubilee clips holding the neoprene patch, without an isolation and drain down having been applied to the line, allowed any residual fluid in the closed drain system to be released, under pressure, through the hole in the closed drain degasser rundown line into the confined space of the utility shaft.

Normally the only source of process fluids to the site of the temporary repair on the closed drain degasser rundown line was the process drains degasser vessel, but during the incident there was no drain down, or flushing of process plant, being carried out The open drain tank was isolated from the closed drain degasser rundown line by the insertion of a spade. The potable water maker was not in operation at the time of the incident. The tie-in from the caisson pump to the closed drain degasser rundown line had been disconnected and the end of the incoming pipework blanked off. In addition, following the surface process shutdown at about 4.36 pm the emergency shutdown valve XEV 65020 closed preventing any flow of liquids directly from the process drains degasser vessel to the site of the hole.

Accordingly, it is unlikely that the process drains degasser vessel was the source of the fluids which emerged from the hole in the closed drain degasser rundown line. Also, the open drain tank was physically isolated at the time of the incident, the caisson pump was disconnected and the Brent Alpha pipeline was isolated from the 24 inch manifold. In these circumstances the source of the fluids which emerged into the utility shaft through the hole in the closed drain degasser rundown line was probably backflow from the 24 inch manifold situated at the 81 metre level. The said manifold would have been fed initially with fluids from the High Pressure Flare Knockout Drum to the Low Pressure Knockout Drum and thence to the said manifold. After these fluids had been exhausted crude oil would have flowed from the top of the storage cells into the said manifold and through the said hole into the utility shaft.

Tests carried out, after the incident, on level control valve 6600 situated on the closed drain degasser rundown line showed that even when fully closed a pressure differential in the opposite sense to normal allowed an appreciable backflow. The non-return valve 9P097, situated downstream from level control valve 6600 was examined after the incident and it was discovered that the flap had come free from the pivot thus allowing fluids to pass through the valve in the opposite direction to normal flow.

The fluid released into the utility shaft through the hole in the closed drain degasser rundown line was volatile and a proportion of it would have flashed to vapour. This vapour would have been rich in pentane and hexane and would also include methane, ethane, propane, butane and heptane and traces of other heavy hydrocarbons. The flow of hydrocarbon fluids into the utility shaft continued, and accumulated at the base of the shaft, until service water was introduced into the closed drain system, some 98 minutes after the surface process shutdown and the automatic surface process blowdown.

The total amount of hydrocarbon fluid released into the utility shaft during the period between the surface process shutdown and the introduction of service water into the closed drain system was approximately 19.4 te. and the peak size of the cloud of heavy hydrocarbon vapour was about 6280m³. A significant factor which contributed to the extent of the vapour cloud in the utility shaft was the failure of emergency shutdown valve EZV 44715 to close following the surface process shutdown thereby allowing the fluids from the High Pressure Flare Knockout Drum to displace the volatile fluids in the Low Pressure Flare Knockout Drum into the 24 inch manifold and ultimately through the hole in the closed drain degasser rundown line into the utility shaft.

The atmosphere in the utility shaft was rendered hazardous by virtue of the presence of these heavy hydrocarbon vapours which, when inhaled, have a narcotic effect. The vapour cloud would have enveloped the 81 metre level in the utility shaft, where the two men were during the incident, for about 20 minutes.

13. THE NARCOTIC EFFECTS OF HYDROCARBONS

Several volatile hydrocarbons cause narcosis, a process by which the ability of the central nervous system to function properly is severely depressed. The effect of volatile narcotics on brain function begins at levels well below those required to produce surgical anaesthesia and will impair judgement and cognitive function and reduce the ability of an individual to take care for his own safety.

Thus well before unconsciousness occurs an individual may fail to respond to verbal communication. The effects of inhaling hydrocarbon vapours occurs rapidly but can be reversed rapidly provided the vapours are removed from the breathing gas at an early stage. However, the earliest effects of inhalation result in the individual being no longer able to think and act rationally to protect himself.

On 11 September, 2003 the two deceased had sufficient oxygen within the utility shaft to sustain life but were inhaling rising levels of hydrocarbon vapours sufficient to produce narcotic effects. At no stage did they make use of the self-rescuer sets available to them.

Within some 15 to 30 minutes of the release of hydrocarbons a point would have been reached where they would have been unable to think for themselves, to use any judgment to protect themselves, or respond appropriately to instructions from the control room. By continuing to inhale volatile hydrocarbons they would have lost consciousness and thereafter progressed to death. It is not possible to say with any certainty the precise mechanism which led from unconsciousness to death.

14. CHANGES SINCE 11 SEPTEMBER, 2003

As a consequence of the incident on 11 September, 2003 Shell U.K. Limited have developed a tighter regime governing temporary repairs to the pipework across their facilities so as to ensure the integrity of any repaired piping system, prior to its return to service.

Responsibility for maintaining the repair register now rests with the operations supervisor and not with the platform inspector, as was the position at the time of the incident. The operations supervisor's responsibility includes the raising of the deviation request form and the materials corrosion damage report and ensuring that the relevant approvals are obtained from the technical authority. In addition, his responsibilities cover reinstatement and testing of the repaired system, the maintenance of the records of the repair and ensuring that as-built drawings are updated.

In a situation similar to that which occurred on 17 November, 2002, namely the discovery of the hole in the closed drain degasser rundown line in the utility shaft, a local isolation and drain down of the line would be effected, technical authority would be obtained before any form of temporary repair was put in place, the temporary repair would be fully engineered and a repair involving a patch of neoprene and jubilee clips would not now be tolerated. Also strict conditions as to the duration and inspection of the repair would be in place.

Since the incident on 11 September, 2003 Shell U.K. Limited have revised the procedures regarding entry into the utility shaft and work carried on therein. The most significant development is the Integrated Safe System of Work scheme (I.S.S.O.W.) which went live on the Brent Bravo platform in February, 2004. The I.S.S.O.W. scheme is effectively an electronic permit to work system.

With two exceptions all entries into the utility shaft are now controlled by the I.S.S.O.W. scheme which carries with it the risk assessment process. In particular, all entries require a work control certificate, confined space entry. The two exceptions which allow personnel to enter the utility shaft without an issued certificate or permit are:-

(a)....... to carry out the primary safety checks necessary before a confined space entry certificate is issued, and

(b)....... routine operations covered by approved procedures and performed by competent persons and includes production sampling, the completion of log sheets, daily checks by area technicians, and routine start-up and shutdown of equipment. These routine operations specifically exclude first line maintenance.

All personnel involved in work in the utility shaft require to wear breathing apparatus and if wearing the apparatus is impractical because of the nature, or duration, of the work, the apparatus must be kept within arms length. In addition, the working party has the support of a person who is a dedicated gas monitor and who can, in the event of a deleterious change in the atmosphere, advise the members of the working party to immediately don and use the breathing apparatus. If there is any doubt about the atmosphere breathing apparatus should be donned immediately.

One member of each working party in the utility shaft must now carry a radio and checks of the radio's function must be carried out. Radio dead spots have been mapped and additional radio aerials have been installed to improve radio communication. Also standardisation of radio channels has been completed.

The C.C.T.V. system in the utility shaft has been upgraded.

The closed drain degasser rundown line which runs from the process drains degasser vessel has been completely replaced with corrosion resistant material. There is also an engineering project underway to reroute the rundown lines, which carry crude oil to the storage cells, outwith the utility shaft.

15. DETERMINATION

In terms of Section 6(1) of the Fatal Accidents and Sudden Deaths Inquiry (Scotland) Act 1976 I find as follows:-

(a)....... Sean Scott McCue, born 2 August, 1981, who resided at Springbank Cottage, Hallfields Court, Kennoway, and Keith Scot Moncrieff, born 20 December, 1957, who resided at 108 Main Street, Invergowrie, Tayside, both died sometime between 15.30 hours and 19.55 hours on 11 September, 2003 on the Brent Bravo offshore platform situated in Quadrant 211, Block 29 at Latitude 61 degrees 03 minutes 21.031 seconds North, Longitude 01 degrees 42 minutes 47.155 seconds East in the United Kingdom sector of the North Sea Continental Shelf.

(b)(i)... The cause of death of both Sean Scott McCue and Keith Scot Moncrieff was inhalation of hydrocarbon vapours;

(ii)... The cause of the accident which resulted in the deaths of both men was the release, and vaporation, of liquid hydrocarbons through a hole, caused by corrosion, in the closed drain degasser rundown line within the utility shaft of the Brent Bravo offshore platform.

(c)....... The accident which resulted in the deaths of Sean Scott McCue and Keith Scot Moncrieff might reasonably have been prevented if:-

(i)........ an appropriate temporary repair had been applied to the hole on the closed drain degasser rundown line such as a fully engineered repair and not a repair using a neoprene patch and jubilee clips;

(ii)....... the temporary repair had been appropriately managed in order that a replacement spool could have been fitted within a reasonable time on a section of a safety critical line which was known to be corroding;

(iii)...... the permit to work system had been followed which would have involved a risk assessment resulting in an isolation and drain down of that section of the closed drain degasser rundown line prior to any attempt to remove the neoprene patch.

(d)....... Defects in the system of working which contributed to the accident which resulted in the deaths were:-

(i)........ a failure to clearly set out the limits which applied to the work which could be carried out, in the utility shaft, under the operations umbrella, and a failure to ensure that personnel on board the Brent Bravo offshore platform clearly understood those limits;

(ii)....... a failure to carry out a robust risk assessment of the possible consequences of starting up the platform on 22 August, 2003 in the knowledge that emergency shutdown valve EZV 44715 had failed to operate within specification when tested during the annual platform shutdown.

Sheriff of Grampian, Highland & Islands at Aberdeen.

ABERDEEN, July, 2006.