The Esso Longford

Gas Plant Accident

Report of the Longford Royal Commission

ryl Michael Dawson, AC KBE CB - Chairman

Mr Brian John Brooks, BE FIEAust FAIP FAIE FIE - Commissioner
 The Esso Longford Gas Plant Accident
Report of the Longford Royal Commission

The Honourable Sir Daryl Michael Dawson, AC KBE CB-Chairman

Mr Brian John Brooks, BE FIEAust FAIP FAIE FIE-Commissioner

ORDERED TO BE PRINTED

JUNE 1999

By Authority.

Government Printer for the State of Victoria

No. 61- Session 1998-99

 1

V'\ C

Cover: Photograph ofexplosion at 13:00:43 taken from the Longford

facility guardhouse camera
 Longford Royal Commission
The Hon Sir Daryl Dawson AC, KBE, CB, Chairman
Mr Brian Brooks BE, FIEAust, FAIP, FAIE, FIE, Commissioner

His Excellency, The Honourable Sir Jaroes Gobbo AC

Governor of the State of Victoria

Your Excellency

By letters patent dated 20 October 1998 you issued to us a Commission to inquire into and report upon
the causes of the explosion and fire which occurred at the gas production and processing facility operated
by Esso Australia Resources Ltd at Longford. A copy of the letters patent containing the Terms of
Reference of the Commission is attached hereto.

That Commission required us to furnish a report not later than 15 February 1999. The time for
furnishing the report was, on 9 February 1999, extended to 30 June 1999.

We have completed our inquiry and accordingly furnish you with our report.

Dated this 28th day ofJune 1999.

Daryl Dawson
Chairman

B.J. Brooks
Commissioner

Longford Royal G.P.O. Box 1232L Melbourne 3001 Telephone 9954 0100
Commission Level31, 360 Collins Street Facsimile 9642 5595
Melbourne Vie 3000
 ELIZABETH THE SECOND BY THE GRACE OF GOD
QUEEN OF AUSTRALIA AND HER OTHER REALMS AND TERRITORIES
QUEEN, HEAD OF THE COMMONWEALTH

To The Honourable Sir Daryl Michael Dawson, AC, KBE, CB.

Brian John Brooks BE, FIEAust, FAlP, FAlE, FIE

GREETINGS:

WHEREAS:

A. Gas extracted by Esso Australia Resources Ltd ("Esso") and BHP Petroleum (Bass Strait)
Pty Ltd ("BHP") is processed at gas production and processing facilities at Longford,
Victoria ("the Longford facilities") operated by Esso.

B. On Friday 25 September 1998 an explosion and fire occurred at the Longford facilities.

C. As a result of that explosion and fire two persons were killed, a number of persons were
injured and all gas supply from the Longford facilities ceased.

D. It appeared to the Governor in Council that the available supply of gas was or was likely
to become less than was sufficient for the reasonable requirements of the community and
accordingly the Governor in Council, acting under s.62F of the Gas Industry Act 1994
("the Act") by proclamation declared that Part 6A of the Act was to apply.

E. Following that proclamation, directions were given under Part 6A of the Act to effect the
cessation of all but essential gas usage in those parts of Victoria which rely upon the
supply of gas from the Longford facilities.

F. The Governor ofthe State of Victoria, in the Commonwealth of Australia by and with the
advice of the Executive Council has deemed it to be expedient that a Commission should
issue to you in the terms set out below.

NOW THEREFORE the Governor of the State of Victoria, in the Commonwealth of Australia,
by and with the advice of the Executive Council and acting pursuant to section 88B of the
Constitution Act 1975, appoints and constitutes you

The Honourable Sir Daryl Michael Dawson AC, KBE, CB

Brian John Brooks BE, FIEAust, FlAP FAlE, FIE

to be Our Commissioners
AND HEREBY APPOINTS The Honourable Sir Daryl Michael Dawson, AC, KBE, CB to
be Chairman of the Royal Commission.
FOR THE PURPOSE of inquiring into and reporting upon the following matters:

1. What were the causes of:

(a) the explosion and fire which occurred at the Longford facilities on Friday 25
September 1998;
(b) the failure of gas supply from the Longford facilities following that explosion and
fire.

2. Whether any of the following factors caused or contributed to the occurrence of that
explosion, fire and failure of gas supply, namely:

(a) the design of the Longford facilities including the interdependence of

(i) the plants and other components which comprise those facilities;
and
(ii) the Longford facilities and other facilities at, or upstream of, the Esso site at
Longford;
(b) operating standards, practices and policies;
(c) maintenance standards, practices and policies;
(d) asset management practices and policies;
(e) risk management procedures and emergency procedures in force at the time of that
occurrence;
(f) any relevant changes in the standards, practices and policies referred to in sub-
paragraphs (b), (c), (d) and (e) which has taken place before that occurrence;
(g) the hydrate incident at the Longford facilities which occurred in June 1998, and
any other previous incidents considered by the Board to be relevant;
(h) whether there was any breach of, or non-compliance with, the requirements of any
relevant statute or regulation by Esso or BHP.

3. What steps should be taken by Esso or BHP to prevent or lessen the risk of:

(a) a repetition of the incidents which occurred at the Longford facilities on 25

September 1998; or

(b) a further disruption of gas supply from those facilities;

AND WE direct you to make such recommendations arising out of your inquiry as you consider
appropriate, including recommendations regarding any legislative or administrative changes that
are necessary or desirable.

AND WE do by these presents give and grant you full power and authority to call before you
such person or persons as you shall judge likely to afford you any information upon the subject
of this Our Commission, and to inquire of and concerning, the premises by all other lawful ways
and means whatsoever.
AND WE declare that the powers of the Commission at the discretion of the Chairman may, at
any time, be exercised by one or more Commissioners.

AND WE will and command that this our Commission shall continue in full force and virtue
and that you shall and may from time to time and at every place or places proceed in the
execution thereof, and of every matter and thing therein contained although the same be not
continued from time to time by adjournment.

AND WE direct you to conduct you inquiry as expeditiously as possible and, not later than 15
February 1999 or such later date as WE may be pleased to fix, to furnish US a report of the
results of your inquiry and of your recommendations.

IN TESTIMONY WHERE OF WE have caused these Our Letters to be made Patent and the
Seal of our State to be hereunder affixed.

WITNESS His Excellency the

Honourable Sir James Augustine
Gobbo, Companion of the Order of
Australia, Governor of Victoria and its
dependencies in the Commonwealth of
Australia at Melbourne this 20th day of
October One thousand nine hundred
and ninety eight in the forty-seventh
year of Our reign.

JAMESGOBBO
By His Excellency's Command
J.G.KENNETT
Premier of Victoria

Entered on record by me in the register

of Patents Book No.41 Page No 166 on
the twentieth day of October 1998.
BILL SCALES
Secretary, Department of Premier and
Cabinet.
Contents
Chapter 1 Introduction - - - - - - - - - - - - - - - - - - - - - - - 1 1
Chapter 2 Longford __________________________________ l3
The Process ............................................................................................................................................. 13
Incoming Gas ....................................................................................................................................... 13
Absorbers ............................................................................................................................................. 17
ROD/ROF Area .................................................................................................................................... 19
Lean Oil Recycle .................................................................................................................................. 22
Condensate Treatment. ......................................................................................................................... 23
Plant Layout ......................................................................................................................................... 24
Instrumentation and Controls in Gas Plant! ........................................................................................... 27
The Control Room ................................................................................................................................ 27
The RODIROF Area Instrumentation ................................................................................................... 31
Organisation, Supervision and Manning ................................................................................................. 34
Management Structure ......................................................................................................................... 34
Longford Operations and Maintenance Organisation........................................................................... 36
Rosters at Longford .............................................................................................................................. 36
Maintenance Work Force ..................................................................................................................... 3 7
The Co-ordination of Production and Maintenance Activities ............................................................. 38
Shift Handover and Toolbox Meetings ................................................................................................ 38
Shift Supervisors' Duties and Supervision ........................................................................................... 39

Chapter3 The Accident 43

---------------------------
Introduction to the Events of 25 September ............................................................................................ 43
TRC3B and the Control of Absorber B ................................................................................................... 47
The Leak from GP922 and the Loss of Lean Oil Circulation.................................................................. 50
The Shutdown ofGPl and Subsequent Restart ofthe Lean Oil Pumps .................................................. 53

Chapter4 The Effect of the Explosion ____________________ 61

Kennedy's Account ................................................................................................................................. 61
Shepard's Account .................................................................................................................................. 62
Foster's Account ..................................................................................................................................... 62
Cum:ming's Account ............................................................................................................................... 62
Visser's Account ..................................................................................................................................... 64
Rawson's Account .................................................................................................................................. 66
Miller's Account ..................................................................................................................................... 66
Coleman's Account ................................................................................................................................. 67
Ward's Account ...................................................................................................................................... 68
ChapterS Technical Analysis _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 71
High Condensate Flows .......................................................................................................................... 71
Carryover from the ROD ......................................................................................................................... 76
GP1201 Pumps Shutdown ....................................................................................................................... 83
Heat Exchanger GP922 Leaks ................................................................................................................. 84
GP1202 Pump Shutdown ........................................................................................................................ 86
GP1201 Attempted Restarts .................................................................................................................... 87
Cool Down .............................................................................................................................................. 90
GP905 Failure ......................................................................................................................................... 92
Summary of Technical Findings ............................................................................................................. 96

7
Chapter6 The Metallurgical Analysis of GP905 _ _ _ _ _ _ _ _ _ _ _ _ _ 97
The GP905 Reboiler................................................................................................................................ 97
Forensic Study of the Fracture Surface ................................................................................................... 99
Failure Analysis .................................................................................................................................... 107
3D Modelling Cases ........................................................................................................................... 109
2D Modelling Cases ........................................................................................................................... 109
Metallurgical Inspections, Tests and Failure Analysis Conclusions ..................................................... 112
Chapter7 The Fire, the Explosions and the Response to the Emergency _____ 113
The Initial Vapour Cloud and its Ignition ............................................................................................. 113
The Emergency Response Plan ............................................................................................................. 114
The Events which Occurred Following the Accident.. .......................................................................... 116
26 September (Saturday) ....................................................................................................................... 133
27 September (Sunday) ......................................................................................................................... 136
Firefighting Systems ............................................................................................................................. 137
Injuries .................................................................................................................................................. 137
ChapterS The Loss of Gas Supply _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 139
The Shutting Down of all Gas Production Facilities ............................................................................. 139
The Relationship and Interconnection of Processing Facilities............................................................. 139
The Isolations Needed to Extinguish the Fire ....................................................................................... 144
Observations .......................................................................................................................................... 147
Chapter9 The Restart _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 151
Commencement of Task ........................................................................................................................ 151
Isolation from GP1 ................................................................................................................................ 151
Development of a Plan .......................................................................................................................... 153
Planned Restart Date ............................................................................................................................. 154
Continuation of Black Snake ................................................................................................................. 154
Review and Approval ............................................................................................................................ 154
The Restart ............................................................................................................................................ 156
Commencement of Gas Sales ................................................................................................................ 156
The Delay in Restoration of Gas to Customers after the Restart ........................................................... 159
Restoration of Supply from GPl for Winter 1999 ................................................................................ 160
Improvements to the Security of Gas Supply ........................................................................................ 161
The Phased Restoration of GP 1 ............................................................................................................ 162
Phase 1 ............................................................................................................................................... 162
Phase 2 ............................................................................................................................................... 162
Phase 3 ............................................................................................................................................... 163
Restoration oflnstrumentation, ESD System and Plant Services ......................................................... 165
Safety Assessments on the Modified GP1 ............................................................................................ 166
Operations, Training and Staffing ......................................................................................................... 167
Enhancement of Capacity and Flexibility of GP2 and GP3 .................................................................. 168
Capacity of Restored Plant .................................................................................................................... 170
Future Proposals .................................................................................................................................... 170
Chapter 10 The Supply of Ethane to the Petrochemical Industry _ _ _ _ _ _ _ 171

Chapter 11 The Hydrate Incident _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 175

Scope ..................................................................................................................................................... 175
Hydrate Formation and Prevention ....................................................................................................... 175
Chronology of the Incident ................................................................................................................... 177
Esso's Internal Investigation ................................................................................................................. 179
Observations on Esso's Hydrate Report ................................................................................................ 180
Corrective Measures taken by Esso ....................................................................................................... 182
Observations .......................................................................................................................................... 183

8
Chapter 12 The Cold Temperature Incident_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 185
The Event .............................................................................................................................................. 185
Observations .......................................................................................................................................... 186
Chapter 13 Management Systems 191
OIMS ..................................................................................................................................................... 191
Training .............................................................................................................................................. l92
Operating Instructions ........................................................................................................................ 194
Operator Knowledge .......................................................................................................................... 195
Inadequate Supervision ...................................................................................................................... 198
OIMS Self Assessments ..................................................................................................................... 198
Observations ....................................................................................................................................... 200
Risk Assessment and Management ....................................................................................................... 201
OIMS .................................................................................................................................................. 201
Hazard Identification .......................................................................................................................... 202
HAZOP Study of GP1 ........................................................................................................................ 203
The McNeil Report............................................................................................................................. 204
PRAs of GP 1 ...................................................................................................................................... 204
Observations ....................................................................................................................................... 205
Management of Change ........................................................................................................................ 206
Condensate Transfer from GP! to GP2 .............................................................................................. 207
Relocation of Plant Engineers from Longford to Melbourne ............................................................. 209
Changes to Role and Responsibilities of Operators and Supervisors at Longford ............................. 209
Reductions in the Numbers of Maintenance Personnel ...................................................................... 210
Communication Controls ...................................................................................................................... 210
GP1 Control Room Log and Shift Handovers .................................................................................... 211
Operation in Alarm Mode .................................................................................................................. 215
Monitoring of Operating Conditions .................................................................................................. 217
Incident Reporting ................................................................................................................................. 220
Operating Practice .............................................................................................................................. 221
Observations ....................................................................................................................................... 222
Chapter 14 The Regulatory Environment _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 223
Application to Extend the Terms of Reference ..................................................................................... 223
Compliance by Esso and BHP with Relevant Statutes and Regulations ............................................... 224
Legislative Background ...................................................................................................................... 226
Safety Case ......................................................................................................................................... 229
Observations ....................................................................................................................................... 230
Chapter 15 Conclusions and Recommendations
-------------------------------233
Terms ofReference Clause 1 ............................................................................................................. 233
The Immediate Causes ....................................................................................................................... 233
The Real Causes ................................................................................................................................. 234
Terms of Reference Clause 2 ............................................................................................................. 234
Terms of Reference- Clause 3 ............................................................................................................. 238
Recommendations ................................................................................................................................. 239
Appendix 1 The Functioning of the Commission _ _ _ _ _ _ _ _ _ _ _ _ _ _ 243
Premises ................................................................................................................................................ 243
Transcript .............................................................................................................................................. 245
Communications ................................................................................................................................... 245
The Coroner's Investigation .................................................................................................................. 246
The Commission's Investigation ........................................................................................................... 246
Applications for Leave to Appear ......................................................................................................... 247
Hearings ................................................................................................................................................ 248
Written Submissions ............................................................................................................................. 249
Document Management ........................................................................................................................ 250
Legal Professional Privilege .................................................................................................................. 250

9
Appendix 2 GPl Isolations to Gas Plant Process _ _ _ _ _ _ _ _ _ _ _ _ _ 259

Appendix 3 Process Flow Diagram for GPl and Interconnecting Units Fold Out

References 263

Glossary of Terms 265

List of Abbreviations 279

List of Figures 285

List of Tables 287

10
 Chapter 1
INTRODUCTION

1.1 At Longford in south-eastern Victoria, Esso Australia Resources Ltd (Esso) operates three
gas plants to process gas flowing from wells in Bass Strait. It also operates a Crude Oil
Stabilisation Plant (CSP) at Longford to process oil flowing from other wells in Bass Strait.
The gas plants are known as Gas Plant 1 (GPl ), Gas Plant 2 (GP2) and Gas Plant 3 (GP3).
They are numbered in the order in which they were built, starting with GP 1, which
commenced production in March, 1969.

1.2 Esso is a subsidiary of the Exxon Corporation (Exxon), which is incorporated in the United
States of America. Under an operating agreement, Esso operates the wells in Bass Strait and
the plants at Longford on behalf of a joint venture with BHP Petroleum (Bass Strait) Pty Ltd
(BHP). BHP is a subsidiary of The Broken Hill Proprietary Company Ltd. It takes no part
in the actual operation of the plants.

1.3 On Friday, 25 September 1998, at about 12.26 in the afternoon, a vessel in GPI fractured,
releasing hydrocarbon vapours and liquid. Explosions and a fire followed. Two Esso
employees, Peter Bubeck Wilson and John Francis Lowery, were killed. Eight others were
injured. Supplies of natural gas to domestic and industrial users were halted.

1.4 The vessel which failed was a heat exchanger, GP905. It was also known as a demethaniser
reboiler because it operated to heat rich oil at the bottom of a piece of equipment known as a
Rich Oil Demethaniser (ROD). Near GP905 was another heat exchanger, GP922, which
preheated rich oil flowing from the ROD on its way to the Rich Oil Fractionator (ROF).
GP922 had developed leaks at its flanges some time before the accident and attempts were
being made to repair them at the time GP905 failed.

t.s Immediately before its failure, the temperature of GP905 was well below its normal
operating temperature and may have been as low as -48°C. The normal operating
temperature was in the vicinity of 100°C. The low temperature of GP905 was due to the
loss oflean oil flow in GPl. Hot lean oil flowing through GP905 was the means by which it
was heated to its normal operating temperature.

11
1.6 The lean oil flow in GPI stopped when the pumps known as the GP1201 pumps tripped and
were not restarted. Notwithstanding the loss of lean oil flow, cold rich oil and,
subsequently, cold condensate continued to flow through GP905 causing its temperature to
drop.

1.7 The GP1201 pumps were out of operation for some hours. When they were eventually
restarted there was a flow of warm lean oil into GP905 for a short time. The higher
temperature of the lean oil flowing into the cold reboiler caused stress in the vessel. This
resulted in its brittle fracture at one end.

1.8 The rupture of GP905 released a large volume of hydrocarbons in the form of vapour. The
vapour subsequently ignited giving rise to a series of explosions and fire. The fire was not
fully extinguished until 27 September 1998.

1.9 Because of the explosions and fire, all three gas plants at Longford were shut in and supplies
of gas ceased. The final restoration of gas supply to all consumers took place by 14 October
1998.

1.10 The Commission is required by its Terms of Reference to inquire into and report upon the
causes of the explosion and fire and what steps should be taken by Esso or BHP to prevent
or lessen the risk of a repetition of the accident or a further disruption of gas supply from the
facilities at Longford. The means by which the Commission carried out its task and the
facilities which were required to enable it to do so are detailed in Appendix 1 to this report.

12
 Chapter 2
LONGFORD

THE PROCESS

2. 1 GPl was a refrigerated lean oil absorption plant. By using low temperatures and high
pressures, it employed lean oil to absorb hydrocarbon components from incoming gas. Lean
oil is a light oil similar to aviation kerosene. It does not contain methane, ethane, propane or
butane. When lean oil absorbed these hydrocarbons, it became rich oil. Using lower
pressures and higher temperatures, the rich oil was then distilled to release the methane,
which was returned to the gas stream, and a mixture of ethane, propane and butane for
further processing into different products. After releasing these products the rich oil became
lean oil once more and the process began again. A simplified flow chart showing the GPl
process and its interconnections with other plants at Longford is provided in Appendix 3.

Incoming Gas

2.2 Longford's inlet gas comes from three main fields offshore in Bass Strait: Marlin,
Barracouta and Snapper. The Marlin and Barracouta fields came on line in 1969 and the
Snapper field in 1981.

Gas
Natural Gas
Crude Oil Longford 1----------l~ (Victorian
Pipelines)
Barracouta

Raw Stabilised
LPG Crude Oil
Ethane
(Petrochemical
Marlin Feedstock)

Long Island LPG

Point !- - - - - - - - + (sales)

Snapper
Stabilised
' - - - - - - - - - - - •crude Oil
(To Refineries)

Oil platforms

Figure 2.1 Simplified diagram ofgas and oil flows from the platforms to end users

13
2.3 The gas and associated hydrocarbon condensate is delivered by pipeline to the onshore
processing facilities at Longford and Long Island Point (LIP). Those facilities are designed
to separate products with a commercial value from the inlet gas and condensate. Those
products are natural gas, which consists principally of methane; ethane, which is used in the
petrochemical industry; and liquefied petroleum gas (LPG), which consists principally of
propane and butane. The heavier hydrocarbons that are left are fed into the CSP adjacent to
the gas plants at Longford. Natural gas is sent by pipeline from Longford to domestic and
industrial users in Melbourne and elsewhere in Victoria. A mixture of ethane, propane and
butane (known as raw LPG) is sent by another pipeline to LIP outside Melbourne where the
ethane is separated from the LPG and piped to petrochemical plants operated respectively by
Huntsman Chemical Company Pty Ltd at Footscray and by the Kemcor group of companies
at Altona. The propane and butane are separated and both are exported or sold locally.

2.4 In 1969 when the facility at Longford was established, there was only one gas plant (GPl)
and a crude stabilisation plant The commissioning of GP2 in 1976 and GP3 in 1983
enhanced the site's capacity. GP2 and GP3 used newer technology to process the gas,
namely, a cryogenic process. This process does not use absorption oil. Instead, a series of
expansions and liquid separations followed by recompressions are used to remove the ethane
and heavier components. Some sections of this cryogenic process are designed to operate at
very low temperatures, well below those found in GPl.

2.5 As the raw gas is piped from offshore, it cools and its pressure is lowered. Under these
conditions both water and hydrocarbons condense to form quantities of liquid which
accumulate in the lower parts of the pipeline when gas flowrates are low. Some parts of the
pipeline are lower than others because the pipeline follows the contours of the sea bed on
which it rests. These aggregations of liquid are known as slugs and can weigh up to several
tonnes.

14
 Natural Gas
r
l
Gas Plant
Raw _. l
Gas

A I I
Gas Plant
2

'tt
...._ I
_.
Gas Plant
3 L Raw LPG

I
Crude
Crude Stabilised
Stabilisation
Oil Crude Oil
Plant

- Natural Gas - Crude Oil & Conde nsate - LPG

Figure 2.2 Overview ofprimary hydrocarbon flows to and from the Longford operating units

Gas Plant
No. 2

Figure 2.3 Gas pipelines and the Longford slugcatchers

15
2.6 At the plant's gas inlet there is a device known as a slugcatcher, which is employed to
dissipate the energy of the slugs as they arrive at Longford and to store the liquids prior to
processing. In fact, there are two slugcatchers at Longford, the Barracouta Slugcatcher and
the Marlin Slugcatcher, but they are operated as one. The names reflect the initial use of
one slugcatcher to serve the Barracouta platform and the other to serve the Marlin platform,
but they were no longer used in this manner on 25 September 1998. A slugcatcher consists
of a number of heavy walled pipes or barrels of large diameter into which the incoming gas
stream, containing liquid, is fed. (See Figure 2.3). The gas and liquids enter the slugcatcher
barrels through relatively small, curved pipes known as tusks, which accelerate the flow of
the mixture into the barrels. These barrels slope downward from the inlet to the discharge
end. The gas, which has a lower density than the liquids, is withdrawn through pipes at the
top of the slugcatcher while the liquid passes through the barrels where it decelerates, thus
removing the energy contained in any slugs. The liquid is stored in the lower end of the
barrels to await processing. Longford has eight slugcatcher barrels, each 265 metres long
and 1.07 metres in diameter, to provide the surge capacity for the incoming slugs.

2.7 Water is drained off the bottom of the slugcatchers and processed to recover glycol added
offshore. The remaining condensate, or condensed hydrocarbons, flows to the Crude De-
ethaniser in GP I or to the Feed Liquid Stripper in GP2. The gas taken from the top of the
slugcatchers to the three gas plants passes through an inlet separator in each plant, which
removes any free water and condensate. The gas then passes through molecular sieves in
each plant to remove water vapour and hydrogen sulphide. The GPl inlet gas was chilled
by means of two heat exchangers, GP901 and GP902, to prepare it for the absorption
process, which was better performed at cold temperatures. Figure 2.4 shows a simplified
overview of GPJ.

16
 Heavy Natural Gas
Gas Drying
Liquids Hydrocarbons
~ and Clean Up to Sales
~
Separation Absorbed from
Gas (Molecular
(Siugcatchers) Gas
Sieves) Rich ol
(Absorbe rs)

Circulating
Oil System ,
Absorbed
.J,.ean Oil
Hydrocarbons
Stripped Out of
~ Rich Oil (ROD
/ ROF)

, ..
Condensate
r---. Raw LPG
to LIP

Treannent Heavy
r r--+1 Hydrocarbons
l o CSP

- Natural Gas - Crude Oil - LPG - Absorption Oil - Condensate

Figure 2.4 Simplified overview of GP/ and its process sections

Absorbers

2.8 GP 1 was equipped with two identical r RESIDUE GAS

(lnlct ga.~ with most of
j--l"'~--- PRESATURATED
absorbers, designated A and B, which ethane. propane, bu1anc.
etc removed.) LEAN OIL

operated in parallel. The gas was fed into

the lower part of the absorbers at a
temperature of -25°C. An absorber is a
tower with a number of valve trays inside.
These allow gas to travel up and lean oil,
presaturated with methane, to travel down
the tower. Lean oil was fed into the top of
the tower at a temperature of -20°C. As the
lean oil dropped from tray to tray, it
INLET GAS
absorbed much of the ethane, propane and ( Mainl )' methane. wtth
I som.:. cthan.;. propane.
b utane etc.)

butane contained in the gas travelling up

CONDENSATE
through the valves in the trays. By this
process, the lean oil became rich oil (i.e.
saturated with heavier hydrocarbons: ethane,
propane and butane), which was taken from Figure 2.5 Schematic diagram of an absorber

the absorber when it reached the rich oil trap

tray (i.e. the second lowest tray).

17
 Central Downcomer

Valves

·de Downcomer

Figure 2.6 Schematic diagram of absorber trays

2.9 Gas entered the lower part of the absorbers carrying with it a quantity of condensate formed
during the chilling process. This condensate dropped to a separate tray at the bottom of each
absorber. From there it went to a re boiler to be heated in order to drive off as much methane
as possible. Ethane and some propane were also vaporised with the methane. This methane
and the other heavier gases joined the gas travelling up the absorber. The gas which was not
absorbed by the lean oi I flowing down the absorber was mostly methane and this was taken
off at the top of the absorber to be sold as natural gas. The remaining condensate was piped
from the base of the absorber to a flash tank, known as GP 11 OSA, after passing through a
heat exchanger known as GP919. A portion of the remaining condensate could also be
directed to a demethaniser in GP2 where more effective ethane recovery was possible.

2. 10 The heating of the condensate at the bottom of each of the absorbers was carried out by
means of heat exchangers known as reboilers (GP903A and B). Each reboiler was in the
form of a shell through which a number of tubes ran. Warm liquid propane was circulated
in the shell around the tubes. The condensate passing to the bottom of the absorber flowed
through the tubes and back to the absorber. In passing through the tubes it was wanned by
the propane surrounding the tubes in the shell. When the flow of warm propane was
increased, the temperature of the condensate also increased and more condensate was
vaporised. A small increase in temperature corresponded to a significant increase in
vaporisation. The condensate temperature was therefore adjusted by the operator to control
the proportion of condensate that was vaporised. If temperatures in the bottom of the
absorber were allowed to drop, there was less vaporisation and a corresponding increase in
the production of condensate in the absorber.

18
 RJCH on.

li..ET GAS

@ _ ______ - - ~_?~HC9B <GP9 19)

DRAIN

CONDF.NSATE
PROPANE
(11['-' TING FLUID)

COl\'DENSATE
TOGP2

Figure 2. 7 Fluid flows at the bottom of an absorber

2.11 Although the two absorbers each performed the same function, it is convenient to confine
this description for the most part to Absorber B, which played a major role in the events of
25 September 1998. The reboiler associated with Absorber B was GP903B. The
temperature of the condensate in the bottom of Absorber B was regulated by a temperature
control system, known as TRC3B, which, by means of an automatic valve, controlled the
flow of wann propane liquid to GP903B. By this means the temperature of the condensate
was held at a level set on the TRC3B controller in the control room. There was a valve
which could be manually operated by the area operators to bypass the automatic TRC3B
valve, when necessary, to control the amount of propane flowing into GP903B and hence
the temperature of the condensate in the bottom of Absorber B.

RODIROF Area

2.12 The rich oil leaving the absorbers was dropped in pressure through the level control valves
LC8A and LC8B and then flowed to a flash tank, known as the Rich Oil Flash Tank, or
GP1108, where some of the methane gas which had flashed off from the rich oil was
separated. This methane was compressed and most of it was recycled to the inlet of the
plant. Some, however, was taken off to be used as fuel in GPl.

19
2.13 The rich oil from GP1108 was taken in two streams to the ROD through a series of heat
exchangers known as GP904, GP924, GP925 and GP930. One stream (the rich oil cold
feed) was taken through GP924 and fed into the ROD at -30°C. The other stream (the rich
oil warm feed) passed through GP904, GP925 and GP930 and entered the ROD at 10°C.
The rich oil was fed into the centre part of the ROD tower. A diagram of the ROD and
associated equipment is shown in Figure 2.8. Heavier components moved to the bottom of
the tower and the lighter components rose to the top. At the bottom of the tower the rich oil
was heated by means of a reboiler known as GP905. This was the vessel that failed on
25 September 1998. The source of the heat was hot lean oil, which flowed through GP905
on the shell side. Rich oil from the ROD flowed through the tubes in GP905 and back to the
ROD. A stream of lean oil, known as reflux, was fed into the top of the ROD at a
temperature of -20°C. By the time the vapours caused by the heating of the rich oil reached
the top of the ROD, the temperature had dropped sufficiently so that only methane and a
little ethane was left. The heavier hydrocarbons had condensed and flowed to the bottom of
the tower as rich oil. The methane from the top of the ROD joined the lean oil stream
delivered by pumps GP\201A, Band C and flowed to the Oil Saturator Tank. (There were
three booster pumps known as GP120\A, Band C, of which two were normally operating,
with one on standby). The Oil Saturator Tank was known as GP 1110. From there any
methane not absorbed into the lean oil stream was separated, recompressed and delivered to
the inlet ofGPJ or GP2.

®®
_L 'j .
- - -""'-'-""""

~ ----------., a
~
'' ~
a:g ~

Q
GP'Il'Oo•/1/C
~
41'd=
1\N\3
<PIIO
4
-w
v..._\(" :
1

'
• ""'
~
.
w-". ..
v...,_vr,

'
1
ntQio~:tooo

- -- - -~--- -- - - -- - - -- ----- - ------ ~

Figure 2.8 The ROD and associated equipment

20
214 The rich oil from the bottom of the ROD flowed through the heat exchanger known as
GP922 on its way to the ROF. GP922 was the vessel that was leaking on the day of the
accident. It preheated the rich oil going to the ROF by means of hot lean oil on the shell
side of the vessel. The rich oil passed through the tubes inside GP922.

2. 15 There was a temperature control system, known as TRC4, which controlled the temperature
at the bottom of the ROD. It did so by regulating the flow of lean oil through GP905 and
GP922. If the maximum flow of lean oil through GP905 did not deliver the required
temperature in the bottom of the ROD, TRC4 would cause the lean oil to bypass GP922,
partially or wholly, so that the lean oil was hotter when it reached GP905.

2.16 The rich oil from the ROD was preheated by GP922 (if not bypassed) and entered the ROF
tower at 140°C. Some lighter components were vaporised at that stage with the remaining
oil passing down to the bottom of the tower, where it was heated to a temperature of 285°C
by means of gas-fired reboilers GPSO I A and B. These vaporised the remaining ethane,
propane and butane. What remained was lean oil. The oil was circulated through the
reboilers by pumps, known as GPI204A, B and C. From the delivery of these pumps a
stream of lean oil was also taken off and delivered back to the shell side of GP922. The
amount of lean oil that was taken off was governed by the rate of pumping from the Oil
Saturator Tank.

----- -- -------------l
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
TO PAOOOCT
I OE:BVTAHI'SIJ't

""'""""
CSI\29

ROF
_Lili',
, .\ V
REBOilER I

E&-- +fB
Lw
I
1
GP~l A./8 : ~

....
L[~'t-~01\.
TO GP922

~ F"U[t GAS
I

Figure 2.9 The ROF and associated equipment

21
2.17 The vapour at the top of the ROF was at a temperature of about 85°C and flowed to a fin-fan
cooler, which was an air-cooled heat exchanger. There it was condensed to a liquid form,
being essentially LPG. It then flowed to a reflux accumulator. Some of the liquid (reflux)
was returned to the top of the ROF at a temperature of about 55°C, but the bulk went to a
product debutaniser in the CSP.

Lean Oil Recycle

2.18 The lean oil flow, which flowed in the opposite direction to that of the rich oil, can now be
described. Lean oil was pumped by GP1204 from the bottom of the ROF, some flowing
through a fired reboiler and returning to the bottom of the ROF, with the remainder flowing
to GP922 and GP905. There it provided the heat to boil the rich oil in the bottom of the
ROD and to preheat the rich oil on its way to the ROF. The lean oil left GP905 at a
temperature of about 77°C and was further cooled by a fin-fan cooler, GP91 0. It was then
pumped by a booster pump known as GP1201 through GP904, GP924, GP925 and GP930.
By this means the lean oil was further cooled by the cold rich oil passing through the tubes
of those heat exchangers.

2.19 However, before the lean oil reached those heat exchangers, the methane from the top of the
ROD was injected into the stream so that the lean oil became saturated with methane. This
process was assisted by the low temperature to which the lean oil was chilled by the heat
exchangers through which it passed. The purpose of presaturating the lean oil with methane
was so that the lean oil would not absorb methane when it entered the top of the absorber
towers. The absorption process heated the oil, reducing its capacity to absorb heavier
components in the gas.

2.20 After the entry of the methane to the lean oil stream and cooling in the heat exchangers, the
lean oil went to the Oil Saturator Tank where any methane not absorbed by the lean oil was
flashed off to fuel gas or recompressed and fed to the incoming gas stream at the front of the
plant.

22
 ....,

uI '"""'
I
-»"C
J
V

I ~
1
~
"'""'
I """"
I """"
I ~
I
_.,.,
GP'I I04 A

_.,, I
I

Figure 2.10 Lean oil I rich oil circulation

2.21 The saturated lean oil was transferred from the Oil Saturator Tank by pumps GP1202A
and B. Most of this lean oil was sent to the absorbers via a heat exchanger, which was the
lean oil chiller known as GP911. This chiller used propane as a refrigerant. It dropped the
temperature of the lean oil to approximately -20°C. At this temperature it entered the
absorbers and the process began again. A smaller quantity of the lean oil taken from the Oil
Saturator Tank was pumped to the top of the ROD as reflux.

Condensate Treatment

2. 22 It is possible now to return to the condensate, which was taken to the Condensate Flash
Tank known as GP11 05A. Some methane having been flashed from it, the condensate then
passed through a heat exchanger known as GP921 . There it was heated to a temperature of
about 62°C by means of hot condensate coming from an item of equipment known as the
Condensate De-ethaniser tower (GP1106A). The hot condensate from GP1106A flowed
through the shell side of GP921 and the incoming condensate flowed through the tube side.
The heated incoming condensate then entered GP1106A and flowed to the bottom where it
was pumped to a gas fired reboiler. The methane and ethane components, which were
driven off by this process, flowed from the top of the tower and left as fuel for the gas plant,
or were recompressed and returned to the incoming gas stream at the front of GPI or GP2.
The remaining condensate from the bottom of the tower went to the Product Debutaniser in
the CSP.

23
 Plant Layout

2.23 Figure 2.11 is a photograph showing the layout of the Longford site. It can be seen that GP I
lies due south of the offices and between the CSP and GP2 and GP3. Figure 2.12 shows the
layout of equipment within GPI.

2.24 In GPI there were various pipes carrying process fluids as well as electrical cables and
instrument air lines. For the most part these pipes were elevated on a structure known as a
pipebridge or piperack. There was an intersection of the main north/south piperack with the
main east/west piperack adjacent to the location ofGP922 and GP905. Many of the pipes at
the intersection carried hydrocarbons. The intersection was known colloquia1ly as Kings
Cross.

24
 ]
.(~

- 0 o o o o
< IJ' 111 IJ!
~~."'~~?"""cc:::JI1:=i====:=:::=fi l=:-1
1 = 1

uo l '
.o L~ l_l:lj

O!J

= ~o

AREA OPERATOR ROOM

0
< Kings Cross
N 0
a:
....z

* ....
z
<
...J
a.
VI
<
Cl
• 0
20
Jl
0
1lil'li'2'il'li
~~ [[IQ]]]

AP~Olf
20
I
L N l AR S.C AIL
<0 00
I
I
<
...J
0..
w
z
~
<

00 \
::::s

Figure 2.12 Layout of GP/ showing the Kings Cross piperack intersection

26
 INSTRUMENTATION AND CONTROLS IN GAS PLANT 1

The Control Room

2.25 The instrumentation m the GP 1 control room was a mixture of pneumatic equipment
installed when the plant was built in 1969 and a computerised system known as the Bailey
system.

2.26 The pneumatic equipment and associated alarms were mounted on panels around the walls
of the control room. They can be seen in Figure 2.13 , a photograph taken after the accident
of 25 September 1998. The primary pneumatic instruments were controllers that enabled
the operators to set the value of the process variable that they wished to control. This was
done by moving a red pointer to the appropriate setpoint on the right-hand side of a vertical
scale (see Figure 2.14). When the controllers were in operation, a black pointer moved up
the left-hand side of the controller to indicate the actual value of the process variable being
controlled. When the process was being effectively controlled the black and red pointers
would be aligned, making it easy to see whether it was operating properly. An example of
this alignment may be seen in Figure 2.14.

Figure 2.13 Photograph ofGPJ Pneumatic Control Panel

(taken after the Bailey equipment was removed for examination)

27
 Black pointer ""'"'"'"o Red pointer sets the
the process variable's desired setpoint for
value the process variables
(Note that when the red and black
pointers arc lined up the variable is at
the desired value)

Figure 2.14 Photograph ofpneumatic controller

2.27 Information was recorded continuously on paper charts (called strip charts) by pneumatic
recorders. There were up to three coloured ink pens that recorded up to three separate
variables on the one chart. An example of these recorders can be seen in Figure 2.15 and an
example of a strip chart is shown in Figure 2. I 6. A number of strip charts are reproduced in
Chapter 5. Alarm panels were provided which gave visible and audible alarms should
process variables move out of a predetennined range. Typical examples of such panels are
shown in Figure 2.17. The audible alarm could be cancelled by pressing a button, but the
visible alarm would stay illuminated until the controlled variable returned to the normal
operating range and the operator manually reset the alarm.

Figure 2.15 A pneumatic recorder in GPI Figure 2.16 Example recorder strip chart

28
 SHUTDOWN ALARM PANEL ALARM PANEL

Figure 2.17 Photograph of GP1 alarm panels

2.28 The Bailey system used computer screens and keyboards to set and display the process
variables. Various displays on the screens, or pages, were used in GP! for different aspects
of the process. Each part of the process was generally represented by a flow diagram on at
least one of the displays. A typical Bailey workstation is shown in Figure 2.18, which is a
photograph of the CSP unit in the GPI/CSP control room. Associated alarm panels can be
seen to the left and right of the screen. The Bailey screen for the GP 1 absorbers is shown in
Figure 2.19. The system showed the setpoint and value of the process variable for each
process it controlled. It provided more information than a pneumatic system. It also offered
more sophisticated control and a higher speed of response than a pneumatic system so that
the process variables could be held within closer limits. However, unlike the pneumatic
system, it was necessary for the operator to call up a particular display page to check a
particular condition. The ultimate movement of control valves was still carried out
pneumatically with electrical/pneumatic converters, which converted the electronic signals
to pneumatic output at the valves. As with the original panels, audible alarms could be
cancelled by pressing a button. However, unlike the original panel, the visual alarm would
remain active until the controlled variable returned to normal operating range, whereupon it
would reset automatically.

29
I
Figure 2.18 Photograph of a typical Bailey workstation

Figure 2.19 The Bailey screen for the GP1 absorbers

30
2.29 The Bailey system also recorded information historically. In addition to the Bailey system
there was the Process Information Data Acquisition System (PIDAS). This system took the
information recorded in the Bailey system and stored it in a compressed form in a computer
server at Longford. This computer was connected to Esso's data communications network.
The information was thus available to personnel both in Melbourne and Longford. In this
way, PIDAS enabled the operation of the plant to be monitored remotely although, in the
case ofGPl, this was on a limited basis because only some 30% ofthe instrumentation was
on the Bailey system and hence accessible on PIDAS. Otherwise reliance for operating
history had to be placed on the ink charts. The only other chronological record of process
conditions in GPl, apart from the log books of operators and supervisors, was provided by
the Surveillance Information Database System (SIDS). This system required operators to
walk around the plant recording information from local instruments on a Portable Data
Terminal (PDT). Recordings were taken twice a shift (i.e. four times a day) for a set of
specified process variables. Records from the PDT were then downloaded into a computer
system, which was also linked to PIDAS.

The RODIROF Area Instrumentation

2.30 Controls were in place throughout GP I to regulate the levels, temperatures and pressures in
various vessels. Among these was TRC3B, which has already been mentioned. It
controlled the flow of warm propane to heat exchanger GP903B, which was associated with
Absorber B. By this means TRC3B controlled the temperature in the bottom of Absorber B.
There were also level controls for the condensate in the bottom of Absorber B and for the
rich oil in Absorber B. They were known respectively as LC9B and LC8B.

2.31 Figure 2.20 shows the equipment that controlled the flow of condensate leaving Absorbers
A and B. There were three alternate paths that the condensate could take for further
processing. These paths, shown in Figure 2.20 as red, blue and green lines, delivered
condensate to GP919, the Rich Oil Flash Tank and GP2 respectively.

31
 ABSORBER
GP-1104 B
-------~---------~------------------------------,
1 1 PRODUCT l
i :I DEBUT ANISER
~R~
1
I TO (~DENSA TE
CD : GP919 ! FLASH TANK
GP111JS A
I
_I

I
I
I
I
I
ABSORBER I
GP-1104 A I
I
------~--------~
I
I
I

Figure 2.20 Control instrumentation for absorber bottoms condensate

2.32 Before the condensate taking the red path from Absorber B reached the flash tank GP 1105,
it passed through a heat exchanger, GP919, where it was heated to a temperature of 1oc.
However, if the temperature of the condensate passing through GP919 fell below a set
temperature of -3 °C, a temperature controller, TC9B, overrode the operation of the level
controller, LC9B, reducing the flow of condensate through GP919, thus increasing the
temperature of the condensate leaving that vessel. The consequence, however, was that, so
long as the TC98 override was active, level control for condensate at the base of the
absorber was lost and condensate could build up to a level well above the setpoint.

2.33 The condensate following the green path was transferred to GP2 via flow controllers
FC650 1 and FC6502. A pressure control valve, PC190, in GP2 was used to isolate this flow
when condensate transfer was stopped. These valves were controlled by the Bailey system.
Condensate was not following this path on the day of the accident.

2.34 The blue path for condensate delivered it to the Rich Oil Flash Tank, GP1108, and allowed
cold condensate to be diverted temporarily to that vessel when transfer to GP2 was stopped.
The flow was controlled by FRC7 and the Rich Oil Flash Tank was protected against
excessively low temperatures by a low temperature shutdown switch LTSD2, which closed
the FRC7 control valve at temperatures below -43°C. The Bailey system was designed to
open FRC7 automatically when condensate transfer was terminated. Operators were

32
 required to close the valve manually when the absorber's condensate temperature was back
to normal (i.e. around -1 0°C). However in the months leading up to the accident on 25
September, condensate transfer was being controlled manually, hence this Bailey feature
which opened FRC7 automatically was not being used.

2.35 The level of rich oil in the Rich Oil Flash Tank was also regulated by a control known as
LRCl. This control operated a valve known as LCVI, which controlled the rate of
discharge of warm rich oil into the ROD.

2.36 Mention has also been made ofTRC4, which controlled the temperature in the bottom of the
ROD by partially or totally bypassing lean oil around GP922 if necessary. This resulted in
hotter lean oil flowing to the reboiler, GP905, in order to maintain the required temperature
in the bottom of the ROD.

2.37 The level of oil in the Oil Saturator Tank was controlled by LRC2, which operated a control
valve on the delivery side of the GP1201A, Band C booster pumps. In the event that LRC2
reduced the flow of lean oil below a preset rate, a low flow shutdown switch, LFSD8, was
activated, shutting down the GP1201 pumps.

2.38 It was the GP1201 booster pumps that delivered the lean oil from GP905 through heat
exchangers GP904, GP924, GP925 and GP930 to the Oil Saturator Tank. GP1204, which
commenced the circulation ofthe lean oil from the ROF, had to be running before a GP1201
pump could be started. Otherwise a low flow shutdown switch, LFSD7, at the discharge of
the GP1204 pumps would be activated to shut down the GP1201 and GP1204 pumps. From
the Oil Saturator Tank another pump, GP1202, delivered lean oil to the absorbers and also a
small stream of reflux back to the top of the ROD. This pump was protected from running
dry by a low level shutdown switch, LLSD2, on the Oil Saturator Tank. There was also a
low level alarm, LLA6, which gave early warning of a drop in level in the Oil Saturator
Tank.

33
 ORGANISATION, SUPERVISION AND MANNING

Management Structure

2.39 The part of Esso's management structure pertinent to this inquiry was that which was
responsible for the production function at Longford and the services which supported that
function. A diagram showing the sections of the management structure which directed or
supported the Longford operation appears in Figure 2.21.

Tedmital Production
Opentioolt Maoager
MW, Ma.ssey

Supenrisor
G.R.K.een

•PLAN-r~~~=VISOiiS: or£ ~~ • MEOIANICAL SUPERVISORS

~
D.L Anderson
RI. O'Shea P.J. Keady
R Wilson J. Kowal
W.G. Smolenaars J. l.Dwccy (Acting)
J.H Wijgcrs INST/EUD SUPERVISORS
lUiUEF SUIDVISORS

LLT. Kennedy
L J.J Kristelf
MD. lee
W.M. Visser 'PlA"iNERS
' PROD. COORD. CRUDE & I'OWER

L
Ml. Shepard
LJ.P.
tJ.R Smith
!'Onnc

PROD. CUORD GAS & LP(; RJ. Stothers

L
K.W. lh>ck
DAY SlJPERYISOR

L
G.H. Stephens
•l
iam<s

AS. FarreD
P.R.. Pummeroy
L Williams
Sm.v!CES & WASTE MGT SUP.

l..
WD. Lewis
IDN'IRACIS ADMINISTRATION

l D.T. Lee
nD'INJCIA.>;!j

L F.!. Henn%!
ll.M. Lobley

Figure 2.21 Line and support function management supervision for Longford operations

2.40 One feature of Esso's management structure was its depth of engineering expertise and
operational experience. Esso was governed by a board of directors. They were Messrs
Olsen, Silckel, Heath and McElvy, under the chairmanship of Robert Olsen who is, and was

34
 on 25 September 1998, also the managing director. Olsen is a mechanical engineer and has
held numerous engineering and managerial positions in the Exxon organisation. At the time
of the accident he had about 26 years of employment experience with Exxon and Esso.
Olsen gave evidence.

2.41 The exploration and production director was Mark Sikkel to whom the production
operations manager, Marty Massey, was responsible. John Dashwood, the technical
manager, whose department provided services to the Operations Department, also responded
to Sikkel. Sikkel gave evidence. He was the director ultimately responsible for operations
at the Longford plants. Sikkel was an industrial engineer who was first employed by Exxon
in 1975. Since then he has held senior production management positions. Sikkel held his
position as exploration and production director from 1993 until 1999 when he became vice
president, production, for the Exxon Company USA.

2.42 The operations manager, Peter Coleman, and the operations technical manager - onshore,
Bruce Page, each responded to Massey. Coleman had responsibility for all offshore and
onshore operations. Coleman trained as a civil engineer and has been employed by Esso
since 1984. Between December 1993 and October 1994 he was operations superintendent at
Longford. He took up his present position as operations manager in August 1996. Coleman
gave evidence. Page's responsibilities covered plant surveillance, inspection engineering
and maintenance and reliability, which were services provided to the Production
Department. Gordon Keen was the supervising engineer for the Plant Surveillance Group
and Phillip Sunderland was maintenance and reliability supervisor. Both Keen and
Sunderland gave evidence.

2.43 The production technology manager, Christopher Shinners, responded to Dashwood.

Shinners was responsible for the overall Risk Assessment and Management System. He was
a civil engineer and had been employed by Esso since 1981 in engineering and managerial
positions. Shinners gave evidence.

2.44 The Longford plants were managed by Will Harrison who reported to Coleman. Harrison
was a mechanical engineer who was first employed by Exxon in 1977. He had experience
as an operations superintendent and site manager for Exxon before his appointment as
Longford plants manager in June 1996. Harrison was responsible for overseeing all phases
ofEsso's operations at Longford. He gave evidence. On the day of the accident, Harrison
was at Long Island Point participating in a work safety presentation.

35
 Longford Operations and Maintenance Organisation

2.45 On 25 September 1998, Graeme Stephens was acting operations superintendent. The
position of operations superintendent was vacant at the time. On the day of the accident,
Stephens was on holidays and Mick Brack was appointed to act in Stephens' place.
However, Brack was also absent due to illness. Stephens' usual position at Longford was
day supervisor. The maintenance superintendent was Peter Wilson, who was killed when
GP905 ruptured.

2.46 Brack's usual position was that of production co-ordinator, gas and LPG. This was one of
two such positions answering to the operations superintendent, the other position being that
of production co-ordinator, crude and power generation. This position was held by Mike
Shepard. Shepard gave evidence. On 25 September, he was fulfilling the role of both co-
ordinators. The acting operations superintendent (Brack) and the plants manager (Harrison)
were absent at the time of the accident.

2.47 Reporting to the operations superintendent were seven plant supervisors. Five of these were
deployed to supervise the five shifts operating the plant. The other two supervisors were
available as relief personnel to cover sickness, holidays and long service leave.

2.48 Two day supervisors were also employed to assist with the supervision workload created by
maintenance activities in the plant. The day supervisors normally worked a five day week
and were not involved in the shift roster system.

2.49 The maintenance activities under the superintendence of Peter Wilson were supervised by
three mechanical supervisors and two instrument/electrical supervisors. Three planners and
three clerks planned the maintenance work and kept the necessary records.

2.50 Because of leave and sickness, there were several people in relief or acting positions on 25
September. Those involved in the lead up to the accident were Bill Visser who was
relieving Glenn Dyer as supervisor for No.4 Shift, Ian Kennedy, who was acting as day
supervisor in the absence ofStephens, John Lowery, who was acting mechanical supervisor,
and Shepard who was filling both co-ordinator roles. Lowery was killed when GP905
ruptured. In the absence of the Longford plant manager, Peter Wilson was the most senior
staff member on-site.

Rosters at Longford
2.51 The Longford process operations were continuous and therefore needed to be manned
24 hours per day every day of the year. This was achieved by five shift teams that rotated

36
 on a roster which was made up of two twelve-hour shifts per day. Day shift commenced at
7.00 am and night shift at 7.00 pm. Night shift preceded day shift on a particular day. Thus
night shift for 25 September commenced at 7.00 pm on 24 September and finished at
7.00 am on 25 September.

2.52 Shift teams consisted of either 13 or 14 men. There were 12 positions to be filled on each
shift so that there was one spare man on some shifts and two on others. This provided nine
spare men to cover holidays and sickness.

2.53 The roster for any one shift team consisted of a ten day cycle made up of two night shifts,
one full day off, two day shifts then six days off. Two twelve-hour periods included in the
time off were normal rest periods, which accounted for the complete cycle taking ten days
rather than eleven. Ten training days per year on what would otherwise be days off made up
the time needed to achieve a 35 hour week.

2.54 On 24 and 25 September, the two shifts on duty were Shift No. 5, supervised by Hans
Wijgers and Shift No. 4, supervised by Visser. Wayne Olsson on Shift No. 5 was the night
control room operator in GPl who handed over to Jim Ward on Shift No. 4 at 7.00 am on
25 September.

2.55 The other shift operators who were involved in events on 25 September included Steve
Bennett, Grant Cumming, David Delahunty, Martin Fahy, Bill Hector, Kurt Mielke, Robert
Miller, Ron Rawson and Steve Young.

2.56 Recently qualified operators Heath Brew, Greg Foster and John Wheeler, and trainee
operator Marty Jackson were also involved on 25 September. Andy Noble, the training
supervisor, was involved in the rescue operations after the rupture ofGP905.

Maintenance Work Force

2.57 The maintenance work force normally worked a five day week and there were no
maintenance personnel on shift. Failure of important process equipment occurring outside
normal working hours required the appropriate maintenance personnel to be called in.

2.58 The regular maintenance work force at Longford at the time of the accident consisted of
58 persons of whom three were contractors and 44 were qualified tradesman or technicians.
Contract labour was used to supplement this workforce from time to time.

2.59 In 1992, the maintenance group at Longford was re-organised to place more emphasis on
planning. An additional planning position was added, and more experienced operations and

37
 maintenance personnel were relocated to these positions. Then, in 1993, as part of the
implementation of the structural efficiency programme, the competencies required by
maintenance technicians at Longford were evaluated, and training and assessment
programmes implemented, to ensure that these competencies were met. The intention was
to reduce the reliance by maintenance technicians on their supervisors for technical support
(i.e. one job did not require two people to the extent previously). Four levels of technicians
were provided for under the new programme: base technician, technician 1, technician 2 and
senior technician. The senior technician position required higher levels of technical
competency than had previously been required by Esso at Longford.

2.60 Following these changes, the number of supervisors and associated staff at the Longford
plant fell from 25 in 1993 to 17 in 1998. Over the same period, there was also a reduction in
the number of maintenance staff from 67 to 58.

2.61 By the time of the accident, there were senior technicians engaged at Longford in the
mechanical, electrical and instrumentation disciplines. These technicians played an
important role in the implementation of safety and reliability improvements.

The Co-ordination of Production and Maintenance Activities

2.62 Maintenance work order requests could be originated by any Esso person. The originator
allocated a priority according to an accepted system designed to ensure that important work
was done first. This allocated priority was reviewed by a supervisor. All safety work
requests were reviewed at the morning production meeting and after discussion the original
priority could be changed. The work requests were then scheduled by planners and the draft
schedule for the following day was reviewed at the afternoon co-ordination meeting. The
work requests for the following day were then forwarded to the night shift supervisor for the
preparation of permits and equipment to enable the work to proceed. Before the work
commenced on the following day these permits required authorisation by the day shift
supervisor for hot work or by the appropriate operations technician for cold work.

2.63 The morning production meeting was attended by the plant manager, the superintendents,
co-ordinators and supervisors. The afternoon co-ordination meetings were chaired by the
maintenance superintendent and attended by maintenance supervisors, planners and
production co-ordinators.

Shift Handover and Tool box Meetings

2.64 With the aim of providing an effective handover procedure upon change of shift, the
Longford Work Management Manual (L WMM) laid down requirements for the verbal and

38
 written transfer between operators of information on the operation of the plant during the
previous shift and the process conditions prevailing at the time of the handover. These are
discussed further in Chapter 13.

2.65 Commencing at 7.15 am on day shifts and about 9.30 pm on night shifts, toolbox meetings
were held in the two plant control rooms. These were conducted by the shift supervisors
and were attended by all the operators and trainees working in each area. These meetings
were used to inform operators ofthe maintenance work planned in their area, of the Gascor
sales forecasts for the day and of accidents or process problems which had occurred on
previous shifts. A safety message was also included. On day shift, the work permits for the
jobs planned for that day were handed out to the appropriate operators.

2.66 Toolbox meetings for maintenance personnel were conducted in the workshop at 7.30 am.
First jobs for the day were handed out, and safety requirements and any special instructions
were given. Toolbox meetings ordinarily took 15 to 20 minutes.

Shift Supervisors' Duties and Supervision

2.67 Two structural changes to operations management occurred at Longford which were
relevant to the matters under investigation. These changes were the relocation of engineers
from Longford to Melbourne and the redefinition of the role and responsibilities of
supervisors and operators.

2.68 The circumstances surrounding the relocation of engineers from Sale to Melbourne, which
are further described in Chapter 13, occurred in 1992. Coleman said that the engineers at
Longford typically performed two roles. The first was that of surveillance which included
monitoring the process to ensure that operations were undertaken within safe operating
limits to maximise recovery. The second was a "project role", in which engineers were
responsible for the implementation of projects.

2.69 Coleman explained the relocation of engineers by suggesting that they were not typically
involved with daily process related problems "but rather were called in for equipment
design/recovery projects and process optimization tasks". He said that "the introduction of
PIDAS has provided engineering personnel with current and historical information about the
process since moving to Melbourne. In addition, Esso retained its fixed wing aircraft
service to ensure that its engineers could be on-site if required." Coleman went on to say
that other facilities operated efficiently and safely without ever having engineers located in
close proximity. He saw no relationship between the accident and the relocation of
engineers to Melbourne and said that in any event Harrison was an engineer. Sikkel said

39
 that in his experience it was unusual to have engineers on-site at gas plants and treating
facilities. He said that the operations personnel of a gas plant are in the best position to
respond to plant-operational upsets. Nevertheless plant surveillance, further discussed in
Chapter 13, assumed a new and significantly different function at Longford as a result of the
change.

2.10 The second structural change affecting Longford was that which occurred in mid-1993
involving the redefinition of the responsibility of operators and supervisors. This change is
also discussed in Chapter 13 in the context of Esso's management of change policies.
Coleman said that in mid-1993 there was a change in the philosophy behind manning and in
the operations organisation structure arising out of an agreement between the unions
representing operators and management. The restructuring involved operators assuming
greater responsibility for the operations of the plant thus relieving the supervisors of the
"leading hand" role. It was at this time and in these circumstances that operators elected to
become control panel operators or machinery operators acknowledging a certain degree of
specialisation between the two.

2.71 The restructuring also caused consequential changes in the number of supervisors present
during shifts. These numbers were reduced and, in addition, the supervisors' roles changed
in that they were not expected to be in the plants on a continuous basis. The supervisors
''were released from acting as backup operations technicians and allowed to assume a truly
supervisory role" with the support of new technology. Coleman said that the restructuring
process reflected the desire of Esso, with the support of its employees, to increase the degree
of ownership of the processes in the Longford plants at an operations technician level. He
acknowledged that the operating technicians assumed a greater responsibility for the day to
day operation of the plant, including troubleshooting to overcome process irregularities, but
they were remunerated accordingly.

2.12 Evidence from Visser indicated that the primary role of the shift supervisors had become
largely administrative, since, by agreement with the four unions represented at Longford, the
responsibility for effective plant operation had been transferred to the operators. Even if a
shift supervisor had no significant administrative responsibilities, it would have been
difficult for one person to provide effective process oversight on a plant as large and
complex as Longford.

2.73 On day shift on week days there were other experienced supervisors available on-site who
could be called on to assist with process problems if required, but during the remaining
130 hours or so each week this was not the case.

40
2.74 A further organisational change occurred in mid-1996, pursuant to an enterprise bargaining
agreement. The number of operating areas at the Longford plants was reduced from 14 to
12 and the offshore control room was consolidated into the GP3 control panel position.
Coleman observed that the object of these changes was to operate the plant safely, taking
advantage of efficiencies provided by the day crew and the increased competencies of the
operators. There were other consequences flowing from the enterprise bargain described by
Coleman. In the second quarter of 1997 a further restructuring occurred, designed to take
full account of the efficiencies gained through the introduction of new systems, such as
OIMS, and new technology such as PIDAS and the LAN.

2.75 The relevance of these structural changes to the accident is discussed in Chapter 13.

41
 Chapter 3
THE ACCIDENT

INTRODUCTION TO THE EVENTS OF 25 SEPTEMBER

3.1 It is now possible to describe briefly the events which preceded the explosion and fire on 25
September 1998.

3.2 On the night shift that preceded the day shift on 25 September, there was a strong flow of
liquids into the slugcatchers. The slugcatcher liquids were processed in the Crude
De-ethaniser GP1106B and the Feed Liquid Stripper, GTll02, in GP2. The lighter
components were fed back to the GPl gas inlet via compressors known as the KVR
compressors. This gas (together with gas from the CSP) was referred to as KVR gas. The
large volume of liquids being processed from the slugcatchers indicated that the volume of
KVR gas flowing to the absorbers would be higher than normal, resulting in a feed that was
rich in heavy hydrocarbons. This would have produced a large quantity of condensate as the
gas passed through GP90 l and GP902. This condensate would then have been separated in
the bottom section of the absorbers.

3.3 It is clear that there was a build up in the level of condensate in Absorber B during the night
shift. As there was no condensate transfer to GP2 taking place, the only available routes for
condensate from Absorber B were the line passing through GP919 to the Condensate Flash
Tank or, if condensate levels became high enough, the rich oil stream to the Rich Oil Flash
Tank. The volume of condensate leaving the absorbers was large enough and cold enough
to cause TC9B to override LC9B and significantly reduce the flow of condensate through
GP919. The result was a build-up in the level of condensate in Absorber B. Absorber A
was not similarly affected as it was fed with leaner gas containing less inlet and KVR gas.
Also, its reboiler, GP903A, was functioning automatically, enabling it to effect temperature
control of condensate so as to maintain a higher absorber bottom temperature. As a
consequence, it was producing less condensate and TC9B did not override the level
controller, LC9A.

3.4 The level of condensate in Absorber B rose to a point where it was not possible to measure it
by the available instrumentation. In all probability, the level of condensate in Absorber B
was such that it carried up into the rich oil section of the absorber. That meant that

43
 condensate entered the rich oil stream causing that stream to flash more than usual on its
way to the Rich Oil Flash Tank, GP1108, and to drop in temperature. A number of unusual
events in the ROD/ROF area occurred after the condensate level in Absorber B became
high. These were directly related to the lower than normal temperature in GPll 08, and the
lighter than normal composition of its contents. The most probable reasons for these events
occurring are discussed later in Chapter 5. The first of these events was a rise in the level of
the Oil Saturator Tank GP 1110, which can be seen on the relevant strip chart (see
Figure3.1) from just after 7.00 am to about 8.19am when the level fell sharply. The
additional liquid flow causing this rise in level would appear to have come through the pipe
from the top of the ROD tower, which was the path normally taken by the methane used to
presaturate the lean oil flowing to the Oil Saturator Tank. The rise in level demonstrates
that there was an upset in the ROD at this time. (This is discussed in more detail in
Chapter 5.)

Figure 3.1 Strip chart showing the rise and sharp fall in the LRC2 Oil Saturator Tank level

3.5 A consequence of the rise in the level of the Oil Saturator Tank was that LRC2 closed the
valve regulating the flow from the GP 1201 pwnps. This reduction in flow would have
caused LFSD8 to shut down the GPI201 pwnps. With the shutdown of the GP1201 pwnps,
the level in the Oil Saturator Tank would have fallen rapidly as the GP1202 pwnp delivered
the contents to the absorbers and ROD reflux. GPI202 was protected against running dry by
a shutdown switch that was triggered by a low level in the Oil Saturator Tank. Following
the fall in the level of the Oil Saturator Tank, the strip chart shows that the level steadied out

44
 when the switch operated to shut down GP1202. Lean oil circulation stopped when the
GPI202 pump shut down.

3.6 Following the cessation of lean oil circulation, gas continued to enter GP I both from
offshore and via the KVR compressors. Some 40% of the continuing incoming gas was rich
KVR gas from the CSP and Condensate De-ethaniser which produced higher amounts of
condensate in the absorbers than gas from offshore. However, the offshore gas was
probably also quite rich in condensable components as preference was given to the
production of gas from the Marlin field. This was the richest of the three main gas fields.

3.7 As the inflow of gas continued, the production of condensate also continued. With the high
level of condensate in Absorber B, it is likely that a significant quantity of condensate
continued to be carried up into the rich oil section and to flow from there to the Rich Oil
Flash Tank. Within five minutes of loss of lean oil circulation, the flow would have ceased
to be a mixture of rich oil and condensate and would have become pure condensate.

3.8 Had the GP1201 and GP1202 pumps been restarted within a reasonable time after their shut
down, the subsequent failure of GP905 would have been averted. Whatever efforts were
made to restart the GP1201 pumps, they were unsuccessful, notwithstanding that the pumps
could normally be turned over by simply holding down the starter button. This would have
induced a flow, provided that the pumps were not vapour-locked. It was also possible to
override the low flow shutdown switch by placing the pumps in test mode. This involved
using a switch located in the switch room some distance away from the pump. Both of the
relevant shift operators say that they were not aware of how the low flow shutdown could be
bypassed. Once the GP1201 pumps ceased to operate, the GP1204 pumps, which delivered
hot lean oil from the ROF, were confined to recirculating lean oil through the fired reboiler,
GP501. Later in the morning at about 11.10 am GP501 was manually shut down, together
with the GP1204 pumps.

3.9 Following the cessation of lean oil flow, the condensate flowing from the absorbers through
the rich oil system was flashing at lower and lower temperatures with the result that there
was a drop in temperature in the Rich Oil Flash Tank and the ROD system. Indeed, the
absence of any lean oil flow to the heat exchangers GP904, GP924, GP925 and GP930
meant that the condensate flowing through the rich oil system was not warmed before it
reached the ROD, GP905 and GP922. Simulations indicate that the temperature reached as
low as -48°C in this section of the plant. This cold flow caused an upset on entering the
ROF. The ROF ceased to boil and there was a much reduced flow ofvapour from the top of
the ROF. This upset is clearly visible on the ROF strip charts. This in turn caused a

45
 reduction in level in the ROF Reflux Accumulator so that the panel operator thought that the
reflux pump, GP1203, had shut down. (See Figure 3.2). That pump delivered reflux back to
the top of the ROF. Attention was diverted from the attempts to restart the GP1201 pumps
when the area operator was asked to check the situation ofGP1203.

12:00 08:00

Figure 3.2 ROF strip chart showing upset

3.10 Because GP922 became cold in the manner described, its flanges became distorted causing
leakage at each end. This was compounded by the effect on the lean oil flow of broken
tubes subsequently found in the exchanger.

3.11 The temperature and condensate carryover problems were exacerbated by the failure, in the
absence of automatic temperature control by TRC3B, to manipulate effectively the bypass
around the temperature control valve. TRC3B had been malfunctioning for at least ten days,
having failed in the closed position due to a faulty positioner. During the morning of 25
September 1998, sporadic attempts were made to control the temperature in Absorber B by
operating the bypass, but the condensate temperatures were consistently below the setpoint
of -I 0°C, reaching -25°C at one stage.

3.12 Both GP905 and GP922 exhibited signs of extreme coldness by the formation of ice on the
uninsulated parts of their exteriors and on the pipework to and from them. A decision was
made to shut down GP! shortly after 11.00 am. This involved the transfer to GP2 of gas
coming from the CSP through the KVR compressors and stopping the inflow of offshore
gas.

46
3.13 Subsequently, a decision was made to recommence the flow of warm lean oil by restarting
the GP1201 and GP1204 pumps. This was done in order to warm GP922 in the belief that it
might solve the problem of the leaks. The fired re boiler associated with the ROF had been
shut down by this time and it was assumed that when the pumps were restarted the lean oil
flowing from GP1204 would be cooler than its normal temperature of 285°C. The pumps
were restarted and some lean oil reached GP905, creating a thermal shock and brittle
fracture of the reboiler.

TRC3B AND THE CONTROL OF ABSORBER B

3.14 The TRC3B valve had been giving trouble for some time before the accident on
25 September. It should be recalled that TRC3B was a control system designed to regulate
the temperature of condensate in the bottom of Absorber B (see Chapter 2). Work was
undertaken on TRC3B pursuant to a work order request dated 17 March 1998. On that
occasion the TRC3B valve was not closing fully. One of the block valves was also not
closing fully. Repairs were effected by injecting methanol into the process, apparently in
the belief that a hydrate was causing the problem. Whatever the cause, the injection of
methanol appeared solve the problem.

3.15 On 11 September 1998, the day shift experienced cold temperatures in Absorber B,
notwithstanding that the control panel indicated that that the TRC3B valve was fully open.
PIDAS records show that the valve was not responding to controller output signals. The
bypass was operated to bring the temperature back into normal range. The bypass valve was
not at that stage tagged to indicate any departure from normal operation.

3.16 On 12 September 1998, Brew made a work order request with respect to TRC3B. The
complaint was that the TRC3B control valve would not operate. The request was allocated a
priority two, which meant the work should be completed in 15 days. An instrument
technician, who was working on a job adjacent to TRC3B on 15 September, was approached
by an operator to look at the valve. He repaired the feedback arm, which had come adrift
from the valve positioner. Nevertheless the problem remained in that the valve opened only
slightly in response to an output signal. Apparently methanol was again used in an attempt
to cure the defect, but without success this time. The technician suggested to the
maintenance supervisor, Mark Lee, that there was an internal problem with the valve, which
could only be corrected by dismantling it. In fact, the valve had failed in the closed position
but Lee thought that it was merely sticking. Lee scheduled the repair of the valve for
1 October 1998 although, depending on the workload, it could have been repaired before
that. However, the events of 25 September 1998 supervened. Subsequent examination of

47
 the TRC3B control valve found that the diaphragm of the relay in the positioner was
ruptured.

3.17 On 14 September the night shift again experienced low temperatures in Absorber B. The
area operator, Peter Burley, observed that the bypass to TRC3B was still open, whereas the
bypass to TRC3A was fully closed. Wijgers, the shift supervisor, instructed him to place
TRC3B on the Temporary Defeats Board, which he did. The notice placed on the board said
"TRC3B U/S. Running on bypass valve" and "Valve seized up coupla days!" [sic].

3.18 The Temporary Defeats Board was intended to indicate which protective equipment, such as
fire pumps, heaters and some control valves, was not functioning properly. Whether TRC3B
should have been considered to be protective equipment is a question that was not raised at
the time. At the end of that night shift on 15 September the TRC3B bypass was still open.

3.19 The shift supervisor on the night shift commencing on 22 September 1998, Ray Wilson,
says that following a report of traces of lean oil carryover from Absorber B to fuel gas, he
asked the RODIROF operator, Norm Watts, to close the TRC3B bypass. Watts did so,
being under the impression that he was making adjustments to improve recoveries. Despite
the fact that TRC3B was the subject of a work order request and had been placed on the
Temporary Defeats Board, neither Wilson nor Watts appear to have known that it had failed.

3.20 During the day shift on 23 September 1988, Wilson was again the shift supervisor, Hogan
was the GP1 panel operator and Watts was again the RODIROF area operator. They
discovered that the TRC3B bypass had been opened again. Wilson told Watts to close the
bypass, which he did during the afternoon. Watts, although not requested by Wilson to do
so, placed a lock and chain on the bypass valve and tagged it with a tag saying "Do not open
this bypass per Ray Wilson" or words to that effect. Wilson says that he was unaware of
any history ofTRC3B's failure to function and for that reason did not submit a work order
request.

3.21 On the handover from the day shift on 24 September to the night shift, the outgoing control
panel operator, Hogan, briefed the incoming control panel operator, Olsson, about the high
level of condensate in the slugcatchers. Hogan also says that he briefed Olsson about a drop
in temperature in Absorber B to -40°C which had occurred at about 4.30 pm. Hogan says
that he then ordered Watts to open the TRC3B bypass valve. Watts, he says, did so, thereby
returning the temperature to its normal range. However, Olsson has no recollection of
having been told this and the process upset described by Hogan is quite inconsistent with all
the other evidence, including PIDAS data.

48
3.22 At the start of his shift, Olsson said he noticed that the temperature at the bottom of
Absorber B was too low. At a shift meeting at about 9.30 pm the status of TRC3B was
discussed. After the meeting, Olsson spoke to the shift supervisor, Wijgers, about the
tagging of the bypass. They were aware that TRC3B appeared on the Temporary Defeats
Board and that the control valve had been malfunctioning for some time. Olsson and
Wijgers looked in the supervisors' log book to find some reason for the bypass valve being
tagged but found no reference to it. It was normal practice to give some explanation in the
log book if there was a specific instruction not to operate something.

3.23 A decision was made by Olsson and Wijgers to remove the lock and tag and open the
TRC3B bypass to bring the temperature of Absorber B within normal operating range. The
bypass valve was given three turns at about ll.OO pm and the temperature in Absorber B
returned to a normal level within 15 minutes. At the end of the night shift Olsson asked his
area operator Noel Robinson to open the bypass further when he next went past the valve. It
is unclear from the evidence whether the valve was further opened by Robinson.

3.24 On the handover from the night shift to the day shift on 25 September 1998, Olsson told the
incoming control panel operator, Ward, of the decision made during the night shift to open
the TRC3B bypass in order to regulate the temperature in Absorber B. Olsson also told
Ward of high levels of condensate in the slugcatchers overnight and of the low ambient
temperatures resulting in high gas demands, but said that the plant was now operating
normally. No reference was made to the level of condensate in Absorber B. On the same
handover, the outgoing area operator, Robinson, told the incoming area operator, Rawson,
of the opening and closing of the TRC3B bypass valve, saying that there was a tug of war
between the two supervisors, Wilson and Wijgers. Wijgers wanted it open and Wilson
wanted it closed.

3.25 At the toolbox meeting in GPl on 25 September 1998, no matter of significance was raised
concerning the operation of the plant. At about 7.20 am, Ward, said that he noticed that the
temperature in Absorber B was within normal range at -l3°C. PIDAS data shows that it was
really at -l8°C. Ward asked Visser, whether he could have the TRC3B bypass closed.
Notwithstanding the conversation with Olsson at the handover, Ward says that he assumed
that the bypass valve had been chained and tagged in order to test the operation ofTRC3B.
Visser authorised Ward to operate the bypass valve as he saw fit. At 7.30 am Ward directed
the area operator, Rawson, to close the TRC3B bypass. At the time of giving this direction,
he was unaware that the level of condensate at the base of Absorber B was so high as to be
off-scale.

49
 THE LEAK FROM GP922 AND THE LOSS OF LEAN OIL CIRCULATION

3.26 At about 7.30 am the area operator, Rawson, closed the bypass on TRC3B on Ward's
instructions. Within half an hour the temperature in Absorber B had fallen from -l8°C to
-26°C. At about 8.22 am, Ward instructed Rawson to open the bypass valve again. Rawson
opened the valve to about 20% of its capacity.

3.27 At about 8.30 am, Rawson noticed that there was a leak at the western end of GP922. There
was a drip tray under the leak. Rawson says that he would have informed Visser, and
Ward's reco1lection is that Visser and Rawson left the control room to inspect the leak at
about this time. As will become apparent, Visser recollected a different inspection with
Rawson or, at least, an inspection at a different time.

3.28 There was a radio system operating at Longford to enable personnel to communicate with
one another. The communications were recorded together with the time at which they were
made. The times were recorded on a 24-hour basis and it is convenient to adhere to that
method when referring to them.

3.29 A radio transcript of the communications on 25 September reveals that at 8:29:43 Ward
contacted Rawson by radio and told him that the GP1201 lean oil booster pumps had shut
down. He asked Rawson to restart them. The call was apparently in response to an alarm in
the control room. Rawson said that he attempted to start the GP1201 pumps but was unable
to get them running. He returned to the control room and asked Ward if they had shut down

because of a low level in the Oil Saturator Tank, GPlll 0. A check revealed that there was a
low level in this tank and as a consequence, the GP1202 pump had shut down as well.
Rawson then left the control room and attempted to restart the GP1201 and GP1202 pumps
by pressing the starter buttons, but they would not start. Rawson said that all three GP1201
pumps failed to respond when he depressed the start buttons installed at the pumps.

3.30 At 8:38:14 Ward contacted Rawson by radio in response to an alarm indicating the
shutdown of the ROF reflux pumps, GP1203A and B, as a consequence of a low level in the
reflux drum. Rawson went to these pumps and found that one pump was still running and
achieving a small flow so he returned to continue his efforts to restart the GP1201 and
GP1202 pumps. At this time he noticed that GP922 had icing on the west end and GP905
had icing on the east end. He also noticed that the ROD had icing on the outlet to GP905
and GP904 and that the suction and discharge lines on the "very north pump" of the three
GP1201 pumps (the GP1201A pump) had icing on them as well.

so
3.31 At 9:05:34 Ward told Rawson on the radio that GP1202 had actually restarted for a while,
but that it had sucked the level straight out of the Oil Saturator Tank and that the level would
have to be built up again before it could be restarted. Rawson said that he had only got one
GP1202 pump started but that he could not get the GP1201 pumps started at all. Rawson
asked Ward what the level in the ROD was. He could see ice on the pipe coming out of the
bottom of the ROD to the GP922 exchanger and concluded that it had no level. Ward
replied that he could find no indication of a level in the control room. The only level
indicator was out in the field on the ROD itself. Rawson told Ward that he would inspect
the level visually. He attempted to do so through a sight glass but could not see any level.

3.32 At 9:16:02 Ward sought extra manpower from Visser, who was at the daily production
meeting. Ward was told that the day crew were all on training, but that they would be back
shortly. In the course of this radio conversation Ward did not tell Visser that the GP1201
and GP1202 pumps had shut down, nor did he tell Visser of the difficulties being
experienced in restarting them.

3.33 By this time, a gas-fired reboiler, GP502B, which was associated with the Crude
De-ethaniser tower, had also shut down. This appears to have been a matter of immediate
concern to Ward. At about 9.20 am Rawson went to GP502B, but did not relight it. A
sufficient level in the tower for the pumps to operate was necessary before the relighting of
GP502B could take place. At 9:25:53 Rawson asked Ward whether there was enough level
in the Crude De-ethaniser tower to start the pumps which fed the GP502 reboilers. Rawson
told Ward that he had started the pumps, but they had not continued to operate. At 9:26:41
Ward informed Rawson that the level had dropped out of the Crude De-ethaniser tower and
that the relighting ofGP502B would have to wait until it returned.

3.34 By 9:28:38, Rawson was at PRCI 0 which controlled the pressure at the top of the Product
Debutaniser tower in the CSP. He was there in response to a request from Hector at 9:26:48
to open the bypasses on PRClO. This request was apparently in response to an alarm on the
CSP control panel. Rawson opened the PRC 10 bypasses and, at about that time, asked
Ward whether there was sufficient level in the Crude De-ethaniser tower to start the pumps.
He told Ward that the pumps were not running but that they were still in test mode and that
he would go and start them up. Rawson says that at about this time he got one GP1201
pump running and then managed to get one GP1202 pump running. Charts show no
indication of a GP 1201 pump running but there are two spikes indicating two attempts to
start the GP1202 pumps.

51
3.35 Rawson then went to LC8B, which controlled the rich oil level in Absorber B, to look at
those levels. He thought that the icing on GP922 and GP905 may have indicated low levels
there. The visual check was again through a sight glass and a level was hard to see.
Rawson was not able to determine whether there was a level or not. He asked Ward's
permission to open the bypass valve to enable him to hear or feel any liquid or gas passing
through. Ward gave permission and Rawson concluded that there was liquid flowing
through. While Rawson was at LC8B, Ward contacted him and told him that the Longford
Liquid Recovery Plant (LLR) had shut down. Ward thought that Rawson was at GP502B,
which was close to the LLR, so that it would have been convenient for him to have restarted
it. Rawson informed Ward that he was at LC8B and Ward said that as soon as a day crew
was available he would get them to restart the LLR.

3.36 The time at which Visser first learnt of the loss of lean oil circulation was unclear from the
evidence. According to Rawson, Visser was with Rawson when Rawson inspected the sight
glass on the ROD at 9:06:29 to ascertain if there was any liquid level at its base. Visser, on
the other hand, said that he did not learn of the leak from GP922, or the loss of lean oil
circulation, until after the daily production meeting when he went across to GPl. He said
that he left the production meeting at about 9.30 am and returned to the control room. On
his return, he said he noticed on the control panel, that there was a high level of condensate
in Absorber B. He suspected that TC9B was overriding LC9, allowing the level of
condensate in Absorber B to rise. He left the control room to inspect the level visually but
could see nothing unusual and returned to the control room. On his way back he noticed
that there was frosting on the pipework to and from the ROD and thought that the high level
of condensate in Absorber B might be overflowing into the rich oil tray and into the rich oil
system. He formed the view that the TRC3B bypass should be opened, but, on going out
into the field again, observed that it was already open. He says that he opened it two more
turns and, on returning to the control room, pointed out that there was a leak from GP922. It
is then, according to Visser, that he and Rawson inspected GP922 and observed ice on the
pipework from the ROD to GP922.

3.37 On balance, it is unlikely that Visser was aware of the shutdown of the GP1201 pumps or
the loss of lean oil circulation before the conclusion of the daily production meeting, when
he returned to the GPl control room.

3.38 At 9:58:13 Rawson informed Ward that he had opened the LC9B bypass. LC9B controlled
the level of condensate in Absorber B. Rawson did this upon the instruction ofVisser, who
was with him at the time.

52
3.39 At 10:09:50 Visser called Rawson from the control room and told him that a level was
starting to come back in the flash tank. This was clarified by Visser as the Condensate Flash
Tank, GP1105A. Rawson understood this to mean the Rich Oil Flash Tank GP1108.
Rawson replied that he might even want to crack the bypass a bit more around LC9B.
Visser agreed.

3.40 Rawson then noticed that the GP1202 pump which he had started was hot and billowing
smoke. He tried to stop it by pressing the stop button, but it would not shut down. Rawson
asked Visser to come and look at the pump. Visser also tried unsuccessfully to stop it by
pressing the stop button. Visser says that he then went to the switch building and tripped the
breaker there, which stopped the pump. At 10:23:39 Rawson asked Visser whether he had
tripped GP1202 Band Visser told him that he had.

THE SHUTDOWN OF GPJ AND SUBSEQUENT RESTART OF THE

LEAN OIL PUMPS

3.41 Visser returned to the control room and spoke to Jim Kristeff, an electrical supervisor, about
the GP1202 pump. Shortly afterwards Rawson informed Visser that the leak from GP922
was getting worse. Both Rawson and Visser went out to look at GP922 and observed that
both ends of the vessel were leaking. It was then that Visser decided to shut down GP1.
This meant not only stopping the flow of inlet gas from offshore but also transferring to GP2
the gas coming from the CSP via the KVR compressors. The transfer involved opening and
closing valves in GP 1 and GP2 and usually took around half an hour to complete.

3.42 At 10:52:27 Visser contacted the control panel operator in GP2 and asked him to prepare the
plant to receive the KVR gas. At 11 :08:30, Visser informed Hector, who was answering on
behalf of Ward, that he was going to shut down the ROF fired re boilers, GP501A and B. He
then manually shut down the GP1204 pumps from the control room. Visser then went out
and isolated GP922 from the ROD by closing one of the two LC 10 block valves. At
11:11:21, Ward asked Rawson to block in the fuel gas block valves for the fired re boilers as
a safety precaution. Rawson did not do this straight away, attending first to the transfer of
the KVR gas to GP2.

3.43 Miller, the area operator for the KVRs, also attended to the redirection of the KVR gas to
GP2. It was not until about 11.20 am that the transfer was completed. At 11:13:40 Hector
observed that the GPl/CSP electrical tie had been lost due to the shutdown ofGPL Miller,
with Foster, went to the old generator building and restored the tie.

53
3.44 After the lean oil system and the inlet gas had been stopped, but before the steps necessary
for the transfer ofKVR gas to GP2 had been completed, Visser went to Kennedy's office to
seek assistance. He and Kennedy made their way to GPl via Peter Wilson's office. Visser
told Wilson what was going on. Visser and Kennedy proceeded to GP922. When they
arrived they observed a pool of liquid under and around the vessel and at both ends,
although at this time the leaking was less than it had been. The area of the spill was
estimated by Kennedy to be approximately 20 ft in length by 12 ft in width with a depth of
four inches. About half the liquid was in the stones underneath the vessel. Kennedy
estimated there to be some 1,300 I of liquid on the ground. Peter Wilson rang the plant
manager, Will Harrison to inform him of the GP922 leak. Harrison asked him to call Peter
Coleman in Melbourne and to get Mike Shepard to investigate the cause of the leak. Wilson
then rang Coleman. However, he was not available so Wilson left a message with
Coleman's secretary asking for Coleman to call back.

3.45 At 11:35:05 Ward asked Rawson whether the bypass on the level control valve, LC9B, on
Absorber B was open. Rawson said that he would have a look and asked whether Ward
wanted it open or shut. Ward's reply was that Rawson should close it and then "we're back
in control here". By this time, Hector was having trouble with the propane pressure in the
GP1 refrigeration system. The pressure was low and for that reason Ward asked Brew at
11:36:51 to shut down about half a dozen fans in the KVR area. At 11:38:04 Ward
informed Rawson that there was a low level shutdown on the Condensate De-ethaniser
Reboiler, GP502A, so that it needed blocking in. Rawson replied that he was at Absorber B
and that the LC9 valve was wide open and that he was blocking it in. Ward told Rawson to
let the level controller do its job and that it should be right so long as the bypass was shut.
Rawson said that he did not think that they had a level in there. Ward replied that they had
previously had over I05%, but that now they were controlling it at 56%. Rawson said he
would leave it.

3.46 At 11:40:24 Brew said that he had the propane fans "knocked off'. At 11 :49:06 there were
falling temperatures in Absorber B and Ward asked Rawson whether the TRC3B bypass
was open. Rawson replied that it was open a long way. Rawson then told Miller that he was
going to get some lunch as everything had been shut down and was under control. At
11:50:44 Rawson was asked by Visser where he was and he replied that he was in the
canteen.

3.47 The liquid which had leaked from GP922 was being collected in drip trays, but these had
overflowed. Visser and Kennedy asked Lowery, the maintenance supervisor, to arrange for
maintenance staff to retension the bolts on the leaking flanges of GP922 while operations

54
 personnel pumped the spilled liquid into the open drain system which is a pipework system
used for the safe disposal of liquids. Lowery arranged for Bruce Robinson, a mechanical
technician, to investigate the spill. Subsequently, he arranged for Shane Vandersteen, a
maintenance fitter from the CSP, and Andrew Knight, a fitter employed by an outside
contractor, to attend to the retensioning of the bolts. The operations technicians who were
pumping the liquid into the drain were Brew, Foster and Wheeler. They were part of the
day crew.

3.48 When Vandersteen arrived at GP922 with Knight, he estimated the spill at a bit over
1,000 litres, although Wilson told him that he thought it was about 3,000 litres. Visser
estimated the spill at 500 to 1,500 litres. Vandersteen and Knight checked the tensioning on
both ends of GP922 and found that it was within specification. Lowery also asked
Vandersteen to check the flange on one ofthe pipes on the top ofGP922. It was not leaking
at the time and was found to be tight. Vandersteen noticed that the east end of GP922 was
completely frosted up, as were some of the connecting pipes. The frost was half an inch
thick.

3.49 The production co-ordinator, Mike Shepard, arrived back at Longford, having been to Sale
to see a chiropractor. Shepard said he went through the gate at around 11.45 am. Ward on
the other hand, said that Shepard arrived at the control room about 11.30 am. Ward said that
by that time Wilson, Kennedy, Visser and Peter Hiskins, the construction site
superintendent, were also in the room and that there was a general conversation about what
was happening. There was then no gas flow or lean oil circulation, the temperature in
Absorber B was about -35°C, the Rich Oil Flash Tank had a low level (26% level on the
LRCI chart) and the ROF reboilers were shut down. The ROD and its reboiler would have
been at about -48°C.

3.50 The actual time of Shepard's arrival was recorded by the gate pass time clock. The gate
clock recorded Shepard arriving at 11.42 am. However, the clock was shown to be four
minutes fast. Accordingly, the correct time of his arrival on-site was 11.38 am.

3.51 Upon arriving at the plant, Shepard went to his office and at the door met Peter Wilson who
told him that there was a leak on the GP922 exchanger. Wilson wanted Shepard to
accompany him to GP922 to assess the volume that had been spilled in order to determine
whether there was a reportable incident. Regulations require that any hydrocarbon leak
greater than 200 kg is to be reported to the Country Fire Authority (CFA). Shepard says that
this was the only reason why he subsequently went to GP922.

55
3.52 Shepard then put on his safety gear and he and Wilson went separately to the GPl control
room. On his way to the GPl control room, Shepard noticed that the feed line to the ROD
was frozen. It was covered with white ice. The ice covered the whole length of the pipe
which ran from the piperack at the top of the control room area to the tower. Shepard says
that he arrived at the control room at about 11.55 am. Upon so doing, he learned that the
ROF reboilers were off line and that an attempt was being made to establish lean oil
circulation.

3.53 Shepard then went out to GP922. After a conversation there with Wilson and Lowery,
Shepard decided that the GP922 leak was not significant at that time.

3.54 He observed Kennedy and Visser opening the LC 10 block valve to allow rich oil to return to
GP922 and then back to the ROF. Shepard returned to the control room where Ward
pointed out that TRC3B recorded a temperature of -48°C and that the temperature was still
dropping.

3.55 In the meantime, Rawson had taken his lunch back to the GPl control room and was eating
it when Visser came in and asked him to help Shepard, who was out in Rawson's area.
Rawson agreed to do so. But he says that when he had finished his lunch, two electricians
came in and asked him to go to the switchgear building to pull out the GP1202A breaker.
Previously Visser had merely opened the breaker. Rawson's presence obviated the need for
a permit. Rawson says that they went out, pulled out the breaker and attached the
appropriate locks and tags. Rawson then sought out Shepard who was at GP922 with
Lowery, Kennedy, Brew, Foster and Wheeler. He asked Shepard what was going on. He
thought that, as he was the ROD/ROF area operator, he should have been made aware of
what was happening in his area and this had not been done.

3.56 Brew says that he went with Kennedy to help start a GP1204 pump. At 12:04:22 he
indicated to Ward by radio that he was going to start a GP1204 pump and Ward told him to
go ahead. This was necessary because the GP1201 pumps would not run unless a GP1204
pump was running. Brew says that he and Kennedy checked the valves on the suction side
of the GP1204 pumps to ensure that they were open and that he then started one of the
pumps by depressing the start button. He says that, although the pressure rose as if the
pump was pumping, there was no flow. Shepard was told by Kennedy that a GP1204 pump
was running, but Shepard observed in the control room that there was no flow.

3.57 At 12:09:01 Shepard instructed Kennedy by radio from the control room to put the FRCllA
and B flow control valves into bypass. That was the flow controller that regulated the flow

56
 of lean oil through the ROF reboilers, GP501A and B. A flow was established through the
reboilers and Shepard told Kennedy of this at 12:11:36. Starting at 12:12:55, there was a
conversation between Kennedy and Shepard as to whether a second GP 1204 pump should
be started. Shepard says that he wanted a flow in both the ROF reboilers, which had not
been re-lit, because they had a large radiant area in them which would drop the temperature
of the circulating lean oil. Putting a flow through both heaters would not have changed the
GP1204 discharge. At 12:13:16 Ward told Kennedy that there was a flow in both heaters
and that was the way they wanted it. The control room charts show that flow restarted at
12.11 pm.

3.58 Vandersteen and Knight, who had been retensioning the bolts on the GP922 flanges,
finished their work at about 12.15 pm without making any significant changes to the bolt
tensions or the rate of leakage. There appears to have been some difference of opinion as to
whether the leaks could have been stopped without replacing the flange gaskets and whether
GP922 should have been isolated and depressurised to allow this to proceed. In the end it
was apparently decided that the best method of stopping the leakage was to warm the vessel
slowly by restarting the flow of warm lean oil. The plan that evolved was to bring the lean
oil back into circulation, but to leave the GP 501 heaters off so that the oil would be
relatively cool. The GP501 heaters had been off for an hour by then and were not re-lit. The
intention was to circulate lean oil through them in the hope that their large surface area
would provide cooling for the lean oil and thereby reduce any thermal shock.

3.59 After Vandersteen and Knight had finished their work, Vandersteen saw Kennedy and Brew
walk away to the south. He then heard a pump start up after which Kennedy and Brew
returned. Vandersteen assumes that it was a GP1204 pump which was started. Vandersteen
said that GP1201C was then started up. Knight said that Visser and Brew were stopping and
starting the GP1201 pumps. Kennedy said that at that stage both the GP1204 and GP1201
pumps were started, but that, as there were a number of operators, he did not know who
started which pump. Vandersteen and Knight then observed Kennedy opening the LC 10
block valve allowing flow to GP922. This immediately caused the vessel to start leaking
again. Knight says that there was leakage at both ends of GP922 and that liquid was fanning
out four feet in a semi-circle from the bottom half of the heat exchanger head. Kennedy
agreed that a leak occurred when a small ROD bottoms flow was established and that this
was then shut off. At this stage Vandersteen and Knight felt the situation was dangerous
and they left the area.

3.60 Brew says that, after starting the GP1204 pump, he went with Kennedy to start a GP1201
pump and that, in the presence of Kennedy, he started one by depressing the start button.

57
 Kennedy then left the area of the pumps but Brew remained in the vicinity. At 12:14:26
Ward and Shepard looked at the charts in the control room and established that there was no
change in the level in the Oil Saturator Tank. Brew says that shortly thereafter they were
made aware by the control room that there was no flow through the GP1201 pump that had
been started. This appears to he a reference to a conversation recorded as being between
Brew and Ward, but which Brew believes was between Kennedy and Ward. During that
conversation Ward instructed either Brew or Kennedy at 12:14:41 to "just swap the booster
pumps over for us". Kennedy returned to the area and Brew says that he and Kennedy
observed that the pump which Brew had started had now stopped. Brew says that he
attempted to start another pump by depressing the start button, but there appeared to be no
flow. However, the pump continued to run and, although Brew has no recollection of it, the
radio transcript records someone saying to the control room at 12:17:23 that there was a
flow "and it's the flow through the level controller". It may have been Kennedy who said
this.

3.61 At about 12.10 pm, Visser left GPI and says that he went to the Administration Building to
see Peter Wilson. He says that he thought that Wilson had returned to his office and that he
wanted to see him about the gaskets on GP922. When Visser arrived at Wilson's office
there was no one there. Visser says that he headed back to GP 1 and on the way stopped to
have a smoke at the smoko shed. He says that he walked to Wilson's office without ringing
him first, because he wanted time to reflect. He was in the smoko shed when the explosion
occurred.

3.62 As mentioned earlier, before 12 noon Wilson had rung Peter Coleman, the operations
manager in Melbourne. He was not available and Wilson had left a message for him to call
back. Coleman says that his secretary informed him that Wilson had said something to the
effect that there was no problem, only a small spill, and that he was calling because they
were told Coleman needed to know. Coleman returned Wilson's call but Hiskins answered
the telephone. He said that Wilson was down at the plant. He told Coleman that the spill
was larger than had been relayed to him and that they were cleaning it up. Coleman told
Hiskins not to call Wilson out of the plant if he was working on the problem but to get him
to ring back when he was ready. At 12:08:52 Hiskins contacted Peter Wilson and told him
that Peter Coleman wanted to speak to him.

3.63 Subsequently, Wilson came into the control room and rang Coleman. The telephone records
show that this conversation took place at 12:20 pm and lasted about four minutes.

58
3.64 Coleman says that Wilson explained that Harrison, the plant manager, had asked him to
notifY Coleman that they had a lean oil leak on to the stones from the head of the GP922
heat exchanger, that they were tightening the head and that they were in the process of
cleaning the spill with pumps and absorbent materials. Wilson said that the situation was
under control and posed no danger at the time. Coleman says that he asked Wilson what had
caused the leak and that Wilson explained that the shift felt that there was a problem in the
absorbers, a potential block, possibly a hydrate, causing a loss of flow of rich oil in the
system. Wilson said that they were trying to find out more. He said that he had also called
to notifY him that GPl had been shut in and all the vapours had been redirected to GP2. He
added that gas sales would not be affected because the order was only 15 Mm3/d, and could
be met by GP2 and GP3. Coleman says that Wilson's voice showed that he was in a hurry
and that he did not detain him.

3.65 At some time after 12:16:56 Shepard left the control room and went back to GP905. He
looked at GP905 and saw ice on the areas where there was no insulation. He said he
realised that if the temperature got too low there was a danger that an impact could cause a
brittle fracture. By this time lean oil flow had, in all likelihood, been established.

3.66 Accordingly, Shepard sought to minimise the flow oflean oil through GP905. He looked at
the TRC4 Valve 1 and observed that it was closed. To obtain minimum lean oil flow
through the GP905, this valve had to be fully open. To achieve this, he asked Ward to close
TRC4 so as to open Valve 1. This instruction was given at 12:20:52. However, Ward
misheard the instruction. He thought Shepard said PRC4 not TRC4. PRC4 was the pressure
controller for the Rich Oil Flash Tank. As a consequence of this misunderstanding, Ward
made no adjustment to the TRC4 controller position and the controller output remained fully
open.

3.67 Shepard remained at TRC4 waiting to see TRC4 Valve I open, which he knew it should do
when Ward carried out his instruction. In fact nothing happened. The valve did not move.
Shepard was confused by the lack of response. His confusion was compounded, when, over
the radio, he heard Ward confirm that TRC4 was closed. In fact, in this radio exchange,
Ward had referred to PRC4 rather than TRC4, but Shepard did not pick this up.

3.68 In his evidence Shepard said that at some point he switched the mode of operation of TRC4
from demethanising to de-ethanising mode, using the HS4 switch. Although he felt that he
had made this change before his initial instruction to Ward to close TRC4 at 12:20:52, this
does not accord with the radio evidence and his stated objective.

59
3.69 At 12:25:31, he instructed Ward to "go for maximum output" on TRC4. It is likely that it
was at or around this time that Shepard operated the HS4 switch. His motivation in doing
so, was to try and get the TRC4 Valve 1 to open to minimise lean oil circulation through
GP905. It would appear, however, that he was not sure what the outcome of operating of
the switch would be. In all probability, it was only a moment or two after operating the HS4
switch that Shepard looked at TRC4 Valve 1 and observed the stem rising as the valve
began to open.

3.70 At around this time, Brew had decided to go to lunch. He was commencing to ride his
bicycle along the path at Kings Cross, when the GP905 ruptured.

60
 Chapter 4
THE EFFECT OF THE EXPLOSION

KENNEDY'S ACCOUNT

4.1 For five minutes before the initial explosion, Kennedy was examining GP905 to see why
there was no flow. He was at TRC4 when the explosion occurred. He was blasted into the
air, struck a solid object with his head and hit the ground with liquid, dirt and stones pelting
him at a high velocity. He felt as if he were being shot at by a machine gun. Wherever he
crawled he continued to be pelted. He smelt nothing because he held his breath. Eventually
he saw a glimmer of light and crawled in that direction. He must have come out from
behind something that was sheltering him, because he was rolled over and again exposed to
the blast. He had his eyes closed. He crawled into the clear and noticed two other
blackened persons crawling towards the control room. He now believes them to have been
Shepard and Foster. Kennedy then stood up but fell over. Blood was flowing from an
injured eye. Miller assisted him towards the control room. He glanced over his shoulder
and saw white vapour everywhere. GP905 had been skewed at an angle and there was still a
loud roar of vapour and liquid.

4.2 Kennedy was taken to the lunch room and then into the control room. He says that alarms
were going off everywhere and someone was trying to contact an ambulance. He could still
hear the roar of escaping gas and liquid. Then he heard a loud whooshing sound of gas
igniting, followed by two enormous bangs that shook the building on its foundations. The
control room lost all communications and the air conditioners shut down. Other injured
personnel were brought into the control room. Andy Noble escorted Kennedy to the first aid
room and on the way he heard another loud bang. Because the first aid room was crowded,
Kennedy suggested that he be taken to the canteen. He was continually passing out.
Kennedy heard another five or six explosions. He was taken to the Sale hospital by
ambulance, where he received stitches in his forehead. Later he was taken by ambulance to
the Melbourne Eye and Ear Hospital. Kennedy suffered a number of injuries, including
bruising to his head, damage to his right eye, chemical and cold burns and general bruising.
He recalls seeing Lowery and Peter Wilson about five minutes before the initial explosion.
He estimates that they were about five metres from where he was.

61
 SHEPARD'S ACCOUNT

4.3 Immediately before the explosion, Shepard looked at GP905 and saw that there was no
change in the level of icing. He looked around and observed the TRC4 valve opening as the
stem rose. There was no warning of the explosion. Shepard heard a boom and there was a
violent release of white vapour. The next thing that Shepard remembers is that he was on
his hands and knees totally surrounded by vapour. He could see the contents of GP905
roaring out. He crawled away from the noise towards the Emergency Shut Down box. On
the way, he bumped into either Foster or Kennedy and was grabbed by Steve Young, who
dragged him into the GP 1 control room.

4.4 Shepard then saw fire coming from a southerly direction. There had been no fire before
that. The fire enveloped the whole area around GP905 and GP922. Shepard was
disoriented. Young apparently walked him to the first aid room, but he has no recollection
of that. He only remembers sitting up in the first aid room. He was placed in an ambulance
and at this stage heard another large explosion. Shepard was taken to the Sale hospital, but
was not seriously injured.

FOSTER'S ACCOUNT

4.5 After assisting Miller to transfer the KVR gas to GP2 and to restore the electrical tie
between GP1 and GP2, Foster had gone to GP922 and had helped John Wheeler to dig
trenches to drain away the spillage. After lunch, Foster had returned to GP922 to dig some
more trenches. He was about to start when he heard a loud thundering noise. He was struck
by sand and gravel and found himself on his side, his vision obscured by a white vapour
cloud. Holding his breath he crawled between GP922 and GP905 and met Shepard who was
near the footpath. Foster had been able to stand up at that point and continue with Shepard
to the control room where he was helped in the west door by Bennett.

CUMMING'S ACCOUNT

4.6 Cumming, an operations technician in the CSP, had been having lunch in the lunch room of
the GP 1 control room with Rawson. After Rawson left to attend to the breaker for the
GP1202 pump, he heard a long rumbling sound like a thunderstorm in the distance. He got
up to leave when he heard another louder rumbling sound. Aware that there was a fixed fire
monitor north-east of the control room, he made his way to it. Outside there was a vapour
cloud surrounding the RODIROF area. Cumming says that it was high and wide like a thick
fog cloud rolling out. It was halfthe height of the ROD tower. There were no flames at that
stage. Cumming decided to attempt to disperse the cloud with the monitor.

62
4.7 Shortly before this, trainee operators Marty Jackson and Jason Watson had arrived in the
control room area. They had been having lunch in the canteen with their training supervisor,
Andy Noble. They had heard two explosions, the second being louder. Noble told them to
report to the control room and they made their way there. Cumming told them to get ground
monitors. He proceeded to hose down the vapour cloud in an arc with the monitor which he
was manning. The cloud moved slowly away from him, more because of a breeze than the
water. Cumming then moved to another fixed monitor and turned it on. By this time he
could see that the source of the vapour was near the ROD tower and that was where the
sound of a pressure release was coming from. He directed water towards the east end of
GP905. After adjusting the direction of the water stream several times, he heard a whoof
and saw orange flames in the location of the eastern end of GP905 and GP922. They
reached up into the overhead piperack. Cumming went and got a chemical fire extinguisher
which was on wheels and wheeled it near to the eastern end of GP922. There he unwound
the hose and activated the equipment, which sprayed out a large cloud of white powder. It
succeeded in putting out pools of fire on the ground, but as soon as it was directed to another
place, those pools would re-ignite. There was a large orange flame coming from the east
end of GP905 and extending up into the east/west piperack. Cumming observed that there
was a lot of damage to GP905. It was up in the air at the east end about three feet higher
than normal. The chemical fire extinguisher lasted about twenty seconds and Cumming
found himself in front of the fire in only his work overalls. His safety hat had fallen off
when he was running between monitors. He decided to get some firefighting gear from the
control room and made his way to the west door.

4.8 On the way out of the north door of the control room, Cumming passed Kennedy who was
being led to the control room and looked to be painted black. He was walking but
staggering. Outside the control room, Cumming met Rawson whom he advised to get
firefighting gear. Rawson went inside the control room to get the gear, but came out saying
that he could not breathe in there. Cumming went into the control room and smelt acrid
fumes which stung his throat. He grabbed a breathing apparatus which was one of three sets
in the control room and went outside to put it on. He re-entered the control room. He saw
Greg Foster on the floor. He was completely covered in a black paint-like substance and
had an oxygen mask over his nose and mouth.

4.9 Cumming decided that the oxygen mask which Foster was wearing was admitting some of
the fumes in the control room and that he should move out. He helped him to do so. Others
took Foster to the canteen and he was eventually conveyed by ambulance to the Gippsland
Base Hospital where he was treated for chemical burns, abrasions and broken ribs.

63
4.10 Cumming left the control room and went back to GP905 to assess the fire. Numbers four
and five monitors were not reaching the piperack upon which the fire from GP905 was
impinging. Curnming thought that some ground monitors closer to the fire were needed. He
managed to cart a ground monitor to the eastern end of GP922 and to direct water on to the
piperack. While he was positioning the monitor, some of the smaller pipes in the rack
ruptured and added to the fire. After adjusting the monitor, Curnming returned to the west
side of the control room and obtained another monitor in a wheel barrow to place beside
monitor ten. He placed it on the ground where it disappeared in a foot of foam. The Esso
fire truck had been set up and was spraying firefighting foam over the area covering
everything, including Curnming. He decided that it was too dangerous to be so close to the
fire and that he should attempt to isolate the fuel to the fire.

4.11 He then checked the Emergency Shut Down (ESD) box to make sure that it had been
activated for GP 1. It had. ESD is an automated system for shutting off the main flows of all
gasses and liquids in and out of the plant. Curnming swung all the other handles with the
exception of those for the generators. He then proceeded towards the GPl molecular sieves
to check that the inlet gas was shut in, but the pressure on his breathing apparatus gave out.
He obtained another breathing apparatus at the southern end of the Amine Switch Gear
Building and made his way to the GPl inlet station where he found that the inlet valves had
been shut in. He also found that the GP2 stripper overheads ESD valve to GPl had been
shut in, as had the GP2 debutaniser bottoms ESD valve. Curnming then thought that the
slugcatcher condensate might be feeding the fire, so he checked the hydrocyclones. The
control valves had shut, but to make sure, he attempted to close a block valve by hand. It
was too tight for him to do so without a valve key. At this time, Visser was calling for
additional operators to come to the fire shed. Before returning there, Cumming checked one
other possible source of fuel to the fire: the ROF lean oil make up. He found that it was off.

4.12 After returning to the fire shed, Cumming went to the CSP intending to shut in the CSP
vapours to GP 1. He found a valve key and started to lever the valve shut. The fire was
getting worse. He managed to get the valve within two inches of being closed when the
hand wheel fell off making the valve inoperative. At that time the last explosion occurred.
Cumming made for the main gate, meeting with others going in the same direction at the
canteen.

VISSER'SACCOUNT

4.13 Upon hearing the first explosion, Visser ran towards the control room. While he was
running he saw a ball of flame coming from the area of GP922. He says that he went into

64
 the control room and yelled out to shut dom1 GPl. Ward said that he had done this. Visser
instructed Ward to start the emergency response of phoning out all lists. He also instructed
Ward to hit ESDI and activate the emergency alarm. Visser went outside and saw a ball of
flame around the exchangers GP922 and GP905. Visser said he saw Cumming at the ESD
box activating the Emergency Shut Dom1 system. The emergency alarm was activated
simultaneously. Whilst outside, Visser put a monitor over the area of the fire in an attempt
to keep it cool. Other people activated other monitors. Visser went back towards the ESD
panel taking someone to the control room away from the flames on the way. He then
attended to the establishment of additional monitors and fire hoses. Cumming and Bennett
were in the vicinity. Visser was untangling some hoses when he came across Shepard and
Wheeler who had been injured. Visser also encountered Foster and gave instructions that he
be taken to safety under cover.

4.14 Visser went back to the monitor near the control room and redirected the monitor on to the
fire. As he was about to leave, he saw movement by the base of the fire. He dragged the
person by the collar away from the flames. It later turned out to be Heath Brew. Visser then
went and asked Jackson to help him with Brew, which Jackson did. They dragged him
alongside the switchgear building away from the heat. They then put him on a stretcher and
took him behind the control room. Jackson says that he could not recognise Brew at the
time. He was black, burnt and appeared to have no teeth because they were coated in
carbon. His overalls were off one leg, which appeared to have been cauterised.

4.15 Soon after this, the fire truck came and directed foam on to the fire. Visser had been trying
unsuccessfully to radio for first aid so he ran up the road to the old guard house where he
spoke to Delahunty, an operator from the offshore control room in GP3, and asked for a
head count. He was told that one had not been completed. The control room operators
informed Visser that they had been evacuated. Visser says that he went back into GP I and
there was a second and large explosion. He moved back to the road near the fire shed and
attempted to organise matters on the radio. Visser remembers calling for Peter Wilson
whom he was unable to reach. There was a third explosion and Hiskins conveyed by radio
his decision to evacuate the plant. Visser then moved outside the gate. He was still asking
for a head count to be done. This involved persons pressing the emergency button on their
radios. Each radio was issued by number to a person and there was a monitor which
indicated when its emergency button had been activated. Visser never obtained a completed
head count, but when he became aware that not everyone had been evacuated, he spoke with
Hiskins about it. It was apparent that at least two persons were still in the plant but it was
too dangerous in Visser' s view for anyone to go in. Visser went to the heliport, to which

65
 people had been evacuated from the administration section, and was told that he was to go to
hospital for the treatment of some minor burns.

RAWSON'SACCOUNT

4.16 Rawson was at the ROF reboilers at the time of the explosion. He heard a huge thump,
looked towards GP922 and saw a whitish cloud of vapour as high as the pipe racks moving
in a south, south-east direction. Rawson told Ward by radio to shut down all heaters lest
they provide a source of ignition. This was recorded at 12:26:01. As the cloud of vapour
was moving towards Rawson, he got on his bike and rode towards the LLR plant. He turned
west on South Road and at the intersection of that road and the Control Room Road looked
towards the heater area. There was a clear flame as high as the piperack in a ball-like
configuration moving back to GP905. Rawson rode west another 10 to 15 feet, looked back
and saw and heard a loud explosion. It was an angry red and black colour and was half as
high as the ROD tower. Rawson continued north on the Crude Centre Road, being
prevented from proceeding along the Control Room Road by the intensity of the blast in the
area of the GP1 control room.

4.17 On arriving at GPl, Rawson entered the control room by the north door. There he met
Grant Cumrning. Curnming was putting on a set of breathing apparatus and told Rawson to
grab a set and come with him into the GPl control room. On opening the door to the control
room, Rawson was struck with an acrid smell which prevented him from breathing. He
located a portable fire monitor outside and directed water towards the GP905 area. There
was another explosion as he did this. Rawson then went to the first aid room where he saw
Kennedy and Fahy, an operator from GP2. The latter was in a state of shock and was not
breathing properly. There was another explosion and someone asked Rawson to take Fahy
to the canteen, which he did. There was a further explosion and a call to evacuate the
canteen. Rawson and four others carried Fahy up to the main gate in a chair. He was placed
in an ambulance. Rawson then heard Visser on the radio calling for persons to come down
and help fight the fire, so he made his way back towards the canteen. He was nearly there
when there was another explosion and he felt it necessary for his own safety to return to the
main gate.

MILLER'S ACCOUNT

4.18 After finishing lunch, Miller left the GPl control room to look at the compressor, GP308.
He was about 30 metres from the north door of the control room when there was a roar. He
turned around and saw a huge, swirling cloud of stones, dirt and gas coming from the
vicinity of GP922. He could see the edge of the vapour cloud but could not see through it.

66
 It was spreading away from him towards the south. He saw Cumming run out of the north
door ofthe control room towards a monitor north of the Oil Saturator Tank. Miller turned
the water on and Cumming aimed it over the area of the gas release.

4.19 Miller saw a person who was black from head to toe standing at the western end of the
GP922 area. He ran down the eastern side of the control room to him. It was John
Wheeler. Miller grabbed him and told him to get out of the area. Miller looked around and
saw another person who was also black. It was Ian Kennedy. Miller grabbed him and took
him inside the control room by the north door. He asked Hector to keep an eye on Kennedy.

4.20 As he was about to leave the control room, Miller heard a very loud explosion. He went to
the north area and saw a huge fireball in the area of the GP905 and GP922 heat exchangers.
He realised that he had firefighting duties to perform when the fire horn sounded. He went
to the Utility Building 204 and started the diesel fire pump, putting the electric pump to
standby. He then went to a monitor on the east side ofthe fire, turned it on and directed it at
the flames. He believes that there may have been another explosion then and he left,
walking past the dehydrators where there were small spot fires.

4.21 Miller there met Gallagher, who helped him to put out the fires near the dehydrators. Miller
then made his way to the first aid room which was being evacuated. He gave assistance, but
heard Visser calling for any spare operators to go to the fire shed. Miller made his way there
and advised against turning on another ground monitor because it would only reduce
pressure to those already being used. As he started to move back up the road there was
another large explosion. He then went with McMahon to check on the pump on the south
pond and, having done that, made his way via the GP2 control room to join other
maintenance people at the turnstile. Subsequently, Miller checked the level in the GP3
water storage tank and the aeration bypass. When the decision was made to evacuate the
plant he left via the turnstile and ended up at the intersection of Garretts Road and Seaspray
Road.

COLEMAN'S ACCOUNT

4.22 Steve Elston, a vessels inspector at the Longford plant rang Coleman from the Longford
Emergency Response Procedure room (ERP) and told him of the explosion. He said that he
thought the explosion had been in the KVR building. He said that he, Angela Jones and
Mike Marshall were manning the ERP room. Coleman instructed Elston to remain there
until he was relieved. Coleman immediately initiated the call out of the Crisis Management
Team. This required the team to assemble in the conference room on the 1Oth floor of the
Melbourne building. There Coleman received another call telling him that there had been

67
 further explosions. Coleman spoke to Elston again and instructed him to evacuate the ERP
room to the heliport and establish an ERP room there. He inquired about the whereabouts of
Wilson and Hiskins. Elston said that he did not know where they were but that they were
currently conducting a head count on~site. Coleman subsequently received a call from
Hiskins asking why the ERP room should be evacuated. Coleman replied that he was
concerned about the potential for escalation and instructed him to complete the evacuation
to the heliport. He again asked about Wilson and was told that there were a number of
people unaccounted for and Wilson was one of them.

4.23 Shortly after forming the Crisis Management Team, Coleman discussed the crisis with the
directors of Esso and was requested to form a small response team to travel immediately to
Longford. He did so and they left the Melbourne office within thirty minutes. They flew in
the Esso plane to Sale and from there by helicopter to Longford.

WARD'S ACCOUNT

4.24 Upon hearing the first explosion, Ward shut in PRC4. Through the glass of the southern
control room door he could see a cloud of vapour travelling from east to west. Once the
cloud had gone, he saw Shepard and Foster travelling west on the footpath. They were both
burnt. Ward activated the fire alarm. From the door he saw flames impinging on the
pipework. He then went outside and activated ESD 1 on a panel adjacent to the control
room. He returned to the control room and advised the guard house that there had been an
explosion and fire. He asked for ambulances, fire trucks and a rescue vehicle at the control
room as soon as possible. He then initiated the emergency response on the telephone by
requesting a list one call out.

4.25 Someone had propped open the control room door with a fire extinguisher. Through the
doorway Ward could see what looked like GP922 well alight. There were explosions across
the walkway. Insulation was falling out of the piperack. Ward started to inhale acrid fumes,
which were invisible. They hurt his throat and lungs and made it difficult to breathe. He
took the fire extinguisher away and closed the southern control room door. He went to the
west control room door to get a breathing apparatus and was intercepted by Jackson
screaming for a stretcher. They obtained one from the storeroom and Ward helped Jackson
load Brew on to the stretcher under the direction of Visser.

4.26 Ward was having difficulty breathing despite having by then obtained a breathing apparatus.
There appeared to be no pressurisation in the control room and an electrician was called.
Pressurisation was restored. Through the southern door Ward could see that the fire had
escalated. He thought that he was in danger if he remained in the control room. The

68
 telephones and radio were dead. He checked the control room building to see if anyone
remained there and left through the north door.

4.27 There was then another explosion and Ward saw the fire crew withdrawing from the fire
truck which was parked at the north end of the control room. He went with Hector to the
ERP room to see if he could lend assistance. There Hiskins told him that everyone had been
instructed to evacuate to the heliport. Hiskins asked Ward to go to the canteen where the
injured were and tell them to evacuate. By the time Ward got to the canteen most of the
people there had gone. He went back to the ERP room, which was then empty. He met
Hiskins on the footpath and they joined the rest of the shift who were at the car park
adjacent to the canteen. From there they observed the fire escalate. The cladding on the
absorbers was on fire and the ROD tower was engulfed in flames and smoke. Visser was at
the fire shed and made a request over the radio for operators to go in and set up ground
monitors. A couple of operators told him that, as a crew, they were not prepared to do it.
Visser said that he could not force them to do anything. The biggest explosion to that time
then occurred. Ward had been coughing and wheezing for some time and began to feel
faint. He left the car park and obtained treatment with oxygen from an ambulance officer.
At 1.10 pm he was taken to the Sale Hospital where he was treated and discharged that
afternoon.

69
 Chapter 5
TECHNICAL ANALYSIS

5.1 From those records that are available, it has been possible to calculate process conditions not
directly observable. This has enabled conclusions to be reached about the operation of GP 1
in the hours leading up to the accident, otherwise than by reference to the direct evidence of
those working on the plant at the time. This process was crucial to detennining the
immediate causes of the accident. It allowed missing data to be reconstructed and the
systematic and scientific assessment of numerous hypotheses. These were rigorously
challenged, and most were rejected as implausible technically or because they were
inconsistent with the factual evidence. Only those that passed this scrutiny were retained.
This chapter presents the technical basis for the sequence of events that is considered, on the
balance of probabilities, to have caused the catastrophic failure of GP905. The analysis
follows the general course of events on the morning of25 September.

HIGH CONDENSATE FLOWS

5.2 The two absorbers were designed to remove condensate from the incoming gas. It is
convenient to use Absorber B as an example in the following description. Absorber A was
identical to Absorber B, except for the equipment numbering. The bottom section of the
absorber was designed to remove the liquid condensate contained in the chilled feed gas to
the absorber. However, not all condensate that entered with the feed gas was removed in the
bottom of the absorber. Calculations have shown that even under nonnal conditions,
between 10% and 15% of the incoming condensate was entrained in the gas travelling up to
the absorption section where it combined with the rich oil stream. Additionally, a portion of
the condensate that passed to the bottom of the absorber was revaporised through the action
of GP903B and TRC3B.

5.3 On the morning of the accident, the primary route for the removed condensate was via
exchanger GP919 to the Condensate De-ethaniser, GP1106A. When the condensate
temperature in the bottom of Absorber B was too low, more condensate was produced than
GP919 was capable of effectively heating. Upon this happening, controller TC9B restricted
the flow of condensate to GP919 and the level in the bottom of the absorber increased.
Eventually, this level increased to the point where excess condensate overflowed into the
rich oil stream. This overflow of condensate was not directly measurable or observable, but

71
 can be calculated based on knowledge of the physical processes occurring. A computer
simulation was therefore used to calculate the flowrate of condensate into the rich oil at
different times on the morning of25 September 1998.

5.4 During the night shift which commenced at 7.00 pm on 24 September, difficulty was
experienced in dealing with the volume of condensate arriving at the slugcatchers. The
slugcatcher known as the Barracouta Slugcatcher had been off line since 20 September, but
was brought back into service at 3.00 pm during the preceding day shift. This resulted in a
large slug of accumulated liquids, which peaked at about 11,500 kl/d and persisted until
shortly before the end of the night shift. The records do not reveal why the Barracouta
Slugcatcher had been out of service, but it was brought back into use because of a spell of
cold weather which gave rise to an increased demand for gas. By 6.00 am on 25 September
the ambient temperature at Longford had fallen to less than 1°C. At the shift handover at
7.00 am the rate of condensate flow from the Barracouta Slugcatcher had been reduced to a
moderate level, and the handling of condensate was thought to be under control.

5.5 The levels of condensate in the bottom of both absorbers in the week preceding
25 September are shown in Figure 5.1. For half the night shift commencing on
24 September, condensate levels in Absorber B were above the 100% level and were at that
level from 5.51 am until the end of the shift. After the shift change, the levels in Absorber B
stayed above 100% until 11.26 am by which time there had been no inlet gas feed to GPl
for about 15 minutes.

5.6 The condensate temperatures at the base of the absorbers are illustrated in Figure 5.2.
Condensate temperatures in Absorber A were automatically controlled close to -1 ooc during
the night shift. However, the temperature of the condensate in Absorber B at shift change
was about -18.5°C, having recovered from -20°C at about 5.30 am. It was the practice to set
the temperature in an absorber to -20°C when it was delivering condensate to GP2, but this
was not the case on 25 September. The appropriate setpoint was -1 ooc for both absorbers.

5.7 The constraint on the flow of condensate from the absorbers to the Condensate De-ethaniser
was the heating capacity of heat exchanger GP919. The temperature of condensate leaving
GP919 was controlled to 1oc in order to protect the Condensate Flash Tank, GP1105A,
which, according to the (P&IDs) had a low operating temperature limit of -1 °C. However,
the TC9B override limit was set at -2°C and the alarm was set at -3°C on 25 September.
When GPl was originally designed, normal carbon steel was considered by the design
standards of the day to be suitable for temperatures down to -27°C. Current design
standards vary the allowable temperature depending on the likely stress levels in the vessel.

72
 It appears that this -1 °C limit reflected these later standards. PIDAS data shows that at
7.00 am the temperature of the condensate leaving GP919 was -2.2°C and that it remained
below -2°C, reaching at one point -4.2°C, until 11.00 am, when incoming gas was isolated
from the absorbers.

5.8 Figure 5.3 shows that TC9B was overriding LC9B continuously for the first five and a half
hours of the night shift. The override then became intermittent. From 6.00 am onwards it
was continuous. In this situation, the level of condensate was not controlled and would have
varied depending on the balance between incoming and outgoing condensate. At certain
times during the night shift starting on 24 September, the flow of incoming condensate
exceeded the flow leaving, resulting in the condensate level rising rapidly until it was above
the level that could be measured. It was then impossible for the operator to observe the
actual level of condensate or any flow of condensate into the rich oil system.

5.9 As shown in Figure 5.1, at the shift change on 25 September, condensate levels in
Absorber B had been over l 00%, the highest recordable level, for 33 of the preceding
38 hours. This provided ample opportunity for condensate to carry up into the rich oil tray
in Absorber B and to dilute the rich oil progressively. As discussed in paragraph 5.2, the gas
entry in the bottom of the absorbers was conducive to such a carryover even when
condensate levels were significantly below the rich oil tray. This tendency must necessarily
have increased with high levels of condensate.

73
 Level in
_,._ No Transfer

)
excess of
100%. 05·49 16 :13 16:53
specific to
level is ltd 9 OO;l &
<mkno~

100

t 80

~
.:1 60
.e
~
"< 40

20

-20
18-Sep-98 07:00 19-Sep-98 07:00 20-Sep-98 07:00 21-Sep-98 07:00 22-Sep-98 07:00 23-Sep-98 07:00 24-Scp-98 07:00 25-Sep-98 07:00

Figure 5.1 Absorber condensate levels 18 to 25 September 1998

30

20

10

Q
~

t
a -10
~
of
i -20

"
-30

TRCJB rt:achtd

-40 I rttord.bJ lo ~ IJnd.rr Rnlgt :st U :l611nd

12-"'R

-50 L---------------------------------------------------------------------------------------------~--~
18-Scp-98 07:00 19-Scp-98 07:00 20-Sep-98 07:00 21-Scp-98 07:00 22-Scp-98 07:00 23-Sep-98 07:00 24-Scp-98 07:00 25-Sep-98 07:00

Figure 5.2 Absorber condensate temperatures 18 to 25 September 1998

BOVERRWDO:
no•
Override }
ofLCJAIB

~ 100

e.
6 80 - - 6-Ab•orbcd£91\ Outrut
="
i 60
d
t 4()
..l
t
] 20
"

t\ ~ r l l 9t\
-20

-40 ~------------------------------------------------------------------------------------------------~
18-Sep-98 07:00 19-Scp-98 07:00 20-Scp-98 07:00 21-Scp-98 07:00 22-Sep-98 07:00 23-Scp-98 07:00 24-Scp-98 07:00 25-Scp-98 07:00

Figure 5.3 Absorber level overrides 18 to 25 September 1998

s.10 The flowrates of condensate entering the rich oil stream at different times between 11.00 pm
on 24 September and 8.00 am on 25 September were estimated using the computer
simulation (Figure 5.4). The bars in the figure show the flowrate of condensate leaving each
absorber via GP919 and the rich oil stream. The line graphs show the corresponding
absorber temperatures. It should be noted that these calculations show these conditions
assuming that stable operation was achieved at the input conditions prevailing at that time.
Time delays in the gas and liquid streams, and the complex dynamics of the various recycle
loops feeding the absorbers, have not been quantified. This simplified analysis indicates
that the flow of condensate into the rich oil stream peaked at 11.00 pm on 24 September and
again at about 8.00 am on 25 September. Although at 6.00 am the inlet gas flow was higher,
and the ambient temperature lower, the incoming condensate flow was also lower and it
does not appear that the conditions at that time were more severe than at 11.00 pm on
24 September.

60 0

50 -5

~
~ 40 - 10 ~
Cl.
e
~
- 15 "'
e
2
';
a:>
20 -20

10 -25

23:00 0:00 1:00 2:00 3:00 4:00 5:00 6:00 7:00 8:00
Time 24 lo 25 Seplember 1998

Figure 5.4 Estimated condensate flows 24 to 25 September 1998

s.11 As temperatures in the bottom of the absorbers were below -1 ooc for a continuous period of
38 hours, and below -20°C for much of it, the condensate produced during that period would
have been highly volatile, containing larger proportions of methane and ethane than
condensate formed at higher temperatures. As a consequence, a mixture of rich oil and this
volatile condensate would have produced a larger volume of vapour as it expanded through
the level control valve, LC8B, from 6,900 kPa to 4,500 kPa, the pressure in the Rich Oil
Flash Tank. The simulation shows that as this material flashed, its temperature would have

75
 dropped from -23°C in the absorbers to -33°C in the Rich Oil Flash Tarn<. These
temperatures were approximately I ooc warmer than the minimum design temperature for
the Rich Oil Flash Tank in the original Hudson design. However, they were not cold
enough to activate the low temperature alarm LTA2 on the rich oil line from Absorber B.
Nevertheless, these temperatures were colder than those during normal operation in which
condensate did not overflow.

CARRYOVER FROM THE ROD

s. 12 At the time of the shift change, the first visible signs of a process upset in the ROO/ROF
area started to appear on those chart recorders that were operational. Earlier indications may
have been visible to the operators. At 7.03 am the level started to rise on the Oil Saturator
Tank as shown by level recorder, LRC2, and by 7.30 am it was significantly above its
setpoint (Figure 5.5). Had all the installed chart recorders been operational, diagnosing the
cause of this rise would have been straightforward. Unfortunately, the chart recorders
measuring two of the important flows were not working. The cause of the level increase
would therefore not have been readily apparent to the operators on the day. It has been
necessary to deduce the cause of this rise in level from calculations based on those charts
that were available, and knowledge of the physical behaviour of the system.

Shift Change
-; 4Ml'ii\""JMPn · I
1

Red .= .PRC:S = Oil at. T!l'\ik Press~

o.r~en = qtC2 =.9-ll Sat. T~_!:ev~ \
~.-
I

Blue = PG 141-= ROD Tower Top 1>\\essu.re

"
.
- '
I

dn
111 111 111
04:0

Figure 5.5 Oil Saturator Tank level and pressure

5.13 The flows into and out of the Oil Saturator Tank are shown in Figure 5.6. The liquid flow
out of the Oil Saturator Tank remained steady at this time, as measured on three of the
operating chart recorders. The level increase must therefore have been due to an increase in
flow entering the tank. Unfortunately, neither of the two recorders on the incoming streams
(FR4 and FR I 0) were working, so the inlet flows had to be calculated. LRC2 controlled the
level in the tank by adjusting the lean oil flow into it, and had been operating effectively up
until that time. No fault was found with the LRC2 level transmitter, controller or recorder

76
 that could explain this level rise. It is therefore highly unlikely that the observed rise was
due to a controller malfunction.

5.14 A change in controller setpoint by the operator is also considered to be unlikely. The shape
of the curve is consistent with an uncontrolled change in level, rather than a move to a new
controlled value. The setpoint was found after the accident at 50%, consistent with it not
having been changed. Also, the security system records show that the bus conveying the
incoming control room operator, Ward, would have arrived at the control room at about
7.03 am, after leaving the gate at 7.01 am. Olsson joined the same bus after handing over to
Ward before the bus arrived back at the main gate at 7.10 am. Ward said that he did not
make this change, and there is little likelihood that either operator would have made a non-
essential controller adjustment at this time.

5.!5 The only other source of flow into the Oil Saturator Tank was the overhead line from the
ROD (Figure 5.6). It would appear that a higher than normal flow into the Oil Saturator
Tank from the top of the ROD must have occurred, which resulted in LRC2 reducing the
incoming flow of lean oiL Once LRC2 had closed its control valve as far as possible, it
could have done no more to hold the level steady. Continuation of the increased inflow
would have resulted in the level increasing above its setpoint, as observed at 7.03 am.

Vapour to recompression
2.4 kgis (calc.)

TOTAL OUT 24.1 kg/s

GP!l!O
OIL SATL'R.... TOR TANK

GPl202

Lean oil from

GPl20l pumps
Before 8.19 am: 13.4 kgis (calc.)
Afler 8.19 am: 0 kg/s

flow rate varies

Heat exchangers have been omittedfor clarily.
Legible charts were not available for recorders marked *.

Figure 5.6 Flows into and out of the Oil Saturator Tank

5.16 Calculations based on the observed rate of level increase show that the total flow from the
top of the ROD at this time was approximately 12 kg/s (equivalent to 840 1/min of
condensed liquid), assuming that the control valve for LRC2 was at its minimum position

77
 (Figure 5.7). The flow through the control valve was calculated from knowledge of its
measured minimum opening when tested, and the system pressures, pump curves and piping
configuration. The decreases in level on the same chart correspond to periods of normal
vapour flow from the top ofthe ROD. After the GPI201 pumps stopped at 8. 19 am, the rate
of decrease also corresponds to an inflow of around 12 kg/s. Therefore this trace is
consistent with intermittent hjgh flows o~ material from the top of the ROD. The observed
flowrate is approximately twice the normal vapour flow from the top of the ROD, calculated
as 5.3 kg/s. The flow of lean oil to the top of the ROD was measured by FRC8 as 4.7 kg/s.
The 12 kg/s overhead flow is therefore somewhat more than the sum of the normal vapour
flow and the reflux flow.

High ROD Overhead

Flow ( 12 kg/s)

r " - - --..' Nonnal ROD Overhead

Flow (5.3 kg/s)

Figure 5. 7 Enlargement of LRC2 trace

5.17 One possible mechanism to explain this is so called "flooding" of the top section of the
column. If the flow of vapour rising through a distillation column is excessive, the resulting
pressure can prevent liquid flowing freely down the column. This liquid then builds up and
will leave by the overhead vapour line, until the downward flow can again be restored. The
ROD column does not appear from the drawings to have been fitted with a mist eliminator,
which is designed to coalesce small liquid droplets and stop them leaving with the overhead
vapour. The outlet connection pointed upward (Figure 5.8) so as to minimise the possibility
of liquid slugs entering the vapour line. Although such a design would reduce the impact of
some types of liquid carryover, entrainment of small droplets or gross flooding of the top
trays could have still allowed liquid to enter the vapour product line.

78
 Vapour out to GP904 +--,---,-_ ___.-

Lean oil in from GP1202 ________.

-----------~
I
I
I

Figure 5.8 ROD vapour outlet connection

5.18 Direct evidence of flooding actually occurring on the morning of 25 September is not
available, as the chart recorder for the vapour flow (FR4) was not working. The drive motor
was not advancing the chart paper. The same chart (Figure 5.9) also recorded the
differential pressure across the ROD (DPR8), a useful indicator of flooding, and the ROD
bottoms temperature (TRC4). There is some indication of higher than normal vapour flows
and column pressure drops, but the timing of these catu1ot be determined. The TRC4 trace
is not visible. Clearly this chart is of limited use when investigating the events leading up to
the accident. A flooding column results in a highly distinctive chart trace, but is difficult to
detect from spot indicator readings alone. The poor state of such a critical recorder chart
would have made troubleshooting of the ROD column operation virtually impossible from
the time that the chart drive failed . As the paper had been wound on at various times, it
appears that the operators had used the chart, but the time at which it failed is unclear.

Location of tear in chart.

Later section atleli.

.
I I I I I I I I 1 1 1 l l .I I I I I I
.
I 1 I I I I 1 I I I I I I

Green ~ FR4 a ROD Overh•ad Vapour f low

Blue DPR8 = ROL> Colwnn Pressure Orop
Red ~ TRC4 RQD Bottom Temperature

Figure 5.9 Chart recording of ROD overhead flow (FR4), ROD differential pressure (DPR8) and
ROD bottom temperature (TRC4),for which no record is visible

5.19 According to Shepard, there had been several occasions in the past when the ROD tower had
carried over because of ''too much cold feed into the tower, particularly if the lean oil itself
is more like gasoline than lean oil". The conditions referred to by Shepard as "too much

79
 cold feed" and "lean oil more like gasoline" were most likely satisfied on the morning of
25 September. To quantity these effects, the computer simulation was used to calculate the
flows into the ROD. A separate detailed computer simulation of the ROD was then used to
calculate the internal flowrates and conditions that would have caused the ROD to flood.
The flooding calculations were performed using two alternative methods, one from the
Fractionation Research Institute (FRI) and the other from the tray manufacturer Glitsch.
The results were in general agreement and are summarised in Table 5 .1.

Table 5.1 Results of ROD flooding calculations

Feed Flowrate Approach to Flooding

Case (relative to Limit
demethanising
design case)
7.00 am 25m September 1998 77% 41%
Design Case Demethanising mode 100% 65%
Design Case De-ethanising mode 95% 76%
7.00 am 25th September plus 90% more Condensate 109% 89%
and -4.5°C feed temperature
7.00 am 25m September plus 40% more Condensate
and 40% more Lean Oil and -20°C feed 107% 80%
temperature

s.2o A 40% increase in the continued flow of condensate and rich oil plus a decrease in feed
temperature to -20°C was required to cause flooding, according to these calculations. The
steady state feed conditions on the morning of 25 September were not in themselves
sufficient to give rise to the extreme conditions required to cause flooding of the ROD.
There appear to be two reasons for this. The ROD was designed to remove ethane in
addition to the methane it was removing on 25 September. The vapour flowrates required
for demethanising alone are lower than those for de-ethanising, and are therefore further
away from the column's flooding limit. Secondly, as more cold feed entered the column,
the required heat input for vaporisation in GP905 increased. This heat came from the lean
oil. On 25 September the lean oil flowrate was set (on FRC6A and B) at 75% of the Hudson
design flowrate. This limited the amount of heat available to vaporise the incoming cold
condensate, and in turn limited the amount of vapour that could be generated to well below
that required to cause flooding. It therefore appears that some additional factor must have
been present to cause the ROD to carry over before 7.00 am on 25 September 1998.

80
5.21 Damage to the column internals is one such possibility. The column was inspected
internally following the accident, and the internals of the bottom section of the column were
found to have been badly damaged. However, this damage was consistent with rapid
depressurisation when GP905 failed. Pre-existing damage to the ROD internals would not
have been evident, and therefore remains a possible contributor to the ROD flooding.

5.22 A sudden change in the feed flowrate to the ROD ·could also have precipitated flooding.
One such potential change is a sudden decrease in the setpoint of LRC I. Indeed, the
setpoint was found to be at 57% after the accident, rather than the 50% expected if it had
been left unchanged. A sudden decrease in setpoint would have caused the control valve in
the warm feed line to the ROD to have opened rapidly. The level in the Rich Oil Flash Tank
did decrease rapidly starting at about 8.20 am (Figure 5.1 0). Clearly this was too late to be
the initiator ofthe disturbance observed in LRC2 at 7.03 am.

8:20 LRCl begins

to decrease

~ LR~lfall;i~~
sharply 25Yo~
to
I f

I I I I I I
16:00

Figure 5.10 Chart recording of Rich Oil Flash Tank level (LRCJ)

5.23 At first sight it appears possible that the drop in LRC 1 could have been caused by a change
in setpoint. However the panel operator Ward denies making such a change and there
appears to have been little reason for him to have done so. The shape of the trace is also
contrary to that expected from a change in setpoint, as indicated by the dynamic simulation
results shown in Figure 5.11. This simulation used the tested dynamic response of the
controller LRC 1. This response clearly differs from that observed and supports the view
that the level change was not due to a change in setpoint.

81
 Figure 5.11 Simulated LRCJ setpoint change

5.24 The initial decrease in level at about 8.20 am is thought to have been due to the ramp down
in ROD pressure when the GP\201 pumps tripped (Figure 5.5). Controller LRCI controlled
the warm feed to the ROD whereas the flowrate of the cold feed was fixed by flow
controller FRC9 (Figure 5. 12). The pressure drop across the control valve LRCI would
have increased as the ROD pressure dropped. The flow through the control valve would
then have increased too quickly for the LRC I controller to compensate, and the level would
have started to drop. Until 8.29 am, flows continued into and out of the Rich Oil Flash
Tanl<. When the GP1202 pumps tripped at 8.29 am, the flow of rich oil into the Rich Oil
Flash Tank ceased and the level dropped more rapidly. This drop in level was due to the
continuing flow of cold feed to the ROD through FRC9 and was suddenly arrested when the
low temperature shutdown switch, LTSD I, closed the FRC9 control valve in the cold feed
line. The calculated rate of heat input through the insulation from the surroundings
indicated that LTSDl would have reset after a time delay of between one and one and a half
hours. Some of the later disturbances in the trace are therefore thought to correspond to
alternate resetting and tripping of the cold feed trip L TSDl. Matching other features on the
chart to those on other charts gives confidence in the timing ascribed to the chart and is
consistent with this explanation.

5.25 Although a setpoint change to LRC I remains a possibility, on the evidence available it
appears less likely than the above explanation. Such a setpoint change would have resulted
in a significant upset to the ROD that could have resulted in carryover or flooding.
However, it would have occurred at least one hour after the initial signs of carryover were
observed, and so cannot explain the earlier rise indicated by LRC2.

82
 ~=::~~ ------@-----------~
Rich oil from
Absorber A - - - - - - - - 1

GPll08
RICH OIL FLASH TANK

Legible charts were not available

for recorders marked •.
GP904

Figure 5.12 Flows into and out of the Rich Oil Flash Tank

5.26 Another possible sudden change that could have influenced the ROD was the decision by
Ward at 7.30 am to close the TRC3B bypass valve. This would have resulted in a
significant increase in condensate flowrate into the rich oil stream. The simulation verified
this (Figure 5.4). However, the change in temperature, indicated by TRC3B, also occurred
too late to be the initiator of the disturbance in the level indicated by LRC2 which was first
seen at 7.03 am.

5.27 In the absence of reliable chart recordings, the precise cause of the high flowrate from the
top of the ROD remains unclear. Nevertheless, on the balance of probabilities it appears
that the ROD did carry over liquid (or condensable vapour), possibly due to internal
flooding. Liquid carryover occurred from some time before 7.03 am until after 8.19 am
when the GP1201 pumps stopped, depriving GP905 and the ROD of the heat required for
vaporisation.

GP1201 PUMPS SHUTDOWN

5.28 Prior to the level in the Oil Saturator Tank rising at 7.03 am, LRC2 would have
progressively closed the level control valve, thereby throttling the flow of lean oil.
However, the LRC2 control valve has been found to have remained partly open, even when
the signal from the controller was at 0%. It is unclear whether this was a deliberate
modification to avoid the shutdown of the GP1201 pumps, or was due to an error in
calibrating the control valve positioner. This explains the observed increase in level when

83
 the GP1202B pump was shut down on August 28. On that occasion, while the GP1201
pumps were still on, LRC2 was deliberately closed as far as possible, but the level in the Oil
Saturator Tank continued to rise. The resultant flowrate has been calculated to be about the
same as the low flow setpoint of LFSD8, which was activated from the same measurement
as FRlO. The lean oil flow remained above this value for some time, until a disturbance
caused the flowrate to dip below the LFSD8 setpoint. LFSD8 then switched off the two
operating lean oil booster pumps, GP1201A and B.

5.29 Another postulated cause of the GP1201 pumps shutting down was the failure of one of
eight tubes in GP922 (see below). The leak reduced the pressure in the line to the GP120ls.
This would have caused the GP 1201 pumps to work harder. If the reduction in pressure was
sufficient, it could have caused the pumps to trip out on thermal overload. However,
hydraulic calculations have shown that, due to the high capacity of the GP1204 pumps, the
leak would have resulted in a decrease in flow to the GP120ls of less than 2%. With two
GP1201 pumps in operation, there would have been more than sufficient power available to
perform the required duty without overload. Also, the metallurgical evidence is that the
leaks in GP922 had existed for some months, rather than occurring on 25 September 1998.
It is therefore unlikely that the tube failures in GP922 contributed to the stopping of the
GP1201 pumps.

5.30 Other possible explanations for the GP1201 pumps shutting down include a momentary
electrical fault or a blockage. Neither of these explains the increase in level observed in
LRC2 and, on the available evidence, both were considered to be much less probable than
the above explanation.

HEAT EXCHANGER GP922 LEAKS

5.31 At about 8.30 am it was noticed that the flange at the western end of exchanger GP922 was
leaking. A tray was already in place under the leak and a maintenance technician observed
it to be one quarter full. Calculations based on the observed leakage rate and the amount of
liquid in the tray suggest that GP922 started to leak at about the same time as the GP1201
pumps shut down. The coincidence of the leak of GP922 and the shutdown of the GP 120 1
pumps suggests that either they had the same cause or were initiated by the same event.

5.32 An upset of the ROD has been shown to have been capable of shutting down the GP1201
pumps (see above). Such an upset, in conjunction with the leaks later found in GP922's
tubes, could also have initiated the leak of the exchanger flange. GP922 was a floating head
exchanger with the rich oil entering and leaving the tube side from the eastern end (Figure
5.13). The outer cover on the western end was in contact with the lean oil on the shell side

84
 at a pressure of about 1,850 kPa. Eight tubes in GP922 failed at some time well before
25 September 1998, but after an internal inspection in October 1996. The tube failure was
caused by a combination of erosion and corrosion caused by localised boiling in the hottest
part of the top tubes. There was thus a direct path for hot lean oil to enter the rich oil feed to
the ROF. When TRC4 valve 2 was directing lean oil into GP922, a portion of the lean oil at
a temperature of 270°C was therefore passing directly to the rich oil immediately after
entering the shell of the exchanger. In this situation, since the lean oil cooled as it passed
through the exchanger, the temperature difference across the west end flange was relatively
small.

5.33 However, when the feed to the ROD became cold, the temperature at the base of the column
would have fallen. TRC4 would have responded by shutting off the lean oil flow to GP922,
and the lean oil would then have entered the shell via the outlet connection, and passed
through the broken tubes. In this condition, the west end flange would have encountered the
hot lean oil without prior cooling and the temperature difference across the western flange
would have been much greater. The combination of a fibre gasket and the detailed design of
the flange made it relatively intolerant to such thermal gradients and this change m
temperature difference appears to have been the initial cause of the flange leaking.

Floating Head
Floating Head Cover
Tubeshcct

WEST
RJCH on. END

T RC4
Valve 2
To GP905

Leaking
Tubes

t
RJ CH OIL
FROM
R.O.O

Figure 5.13 Heat exchanger GP922

5.34 The later leaks at the eastern end of the exchanger are considered to have been due to the
difference in temperature between the tube inlet and outlet when the flow through the tubes
was a small flow of cold condensate rather than the normal large flow of warm rich oil.
These leaks of lean oil did not set off the portable gas detectors used by the clean-up crew

85
 after 11.00 am. This implies that the leaking material was predominantly lean oil and it
therefore appears that the backflow from the ROD (discussed in detail in paragraphs 5.38 to
5.40) did not reach GP922 at that time. An alternative path for backflow to the ROF existed
via the GP1204 seal oil line, which had ample capacity to divert the calculated backflow
away from GP905 and GP922. It is also possible that there was insufficient backflow of
methane from the top of the ROD to break through the cold lean oil in GP905. This
unsaturated lean oil would have absorbed methane and effectively blocked the backflow past
that point. It is also possible that the non-return valve may have closed properly during one
of the restart attempts during the morning, halting the backflow.

5.35 In summary, the initial leak of GP922 at the western flange was probably due to the change
in thermal gradient when TRC4 bypassed the exchanger. Later leaks were caused by
vertical temperature gradients at the eastern end. Both types of leak were exacerbated by the
leaking tubes within the exchanger.

GP1202 PUMP SHUTDOWN

5.36 After the GP1201 pumps shut down, GP1202 was still pumping from the Oil Saturator Tank
to the two absorbers and to the top of the ROD tower. It quickly drew down the liquid in the
tank and was shut down by the low level shutdown switch on the tank, LLSD2, at
approximately 14%. This level was consistent with the tested setpoint ofLLSD2.

5.37 Without any lean oil feed from the GP1201 pumps, the level in the Oil Saturator Tank
increased slightly to 15% over twenty minutes from 8.30 am. Following recovery of
pressure in the ROD at 8.45 am, the vapour from the ROD displaced enough liquid from the
lean oil system (especially exchangers GP904, GP924, GP925 and GP930) to raise the level
to 25%. This was sufficient to re-close LLSD2 and allow Rawson to restart GP1202 at
about 9.05 am. The level in the Oil Saturator Tank then fell sharply to about 14%. The
GPI202 pump was again stopped by the low level shutdown switch and the level remained
steady until some ten minutes later when it fell to 9%. This last drop in level was caused by
a second attempt to restart GP1202. Despite the low level shutdown switch, the pump
continued to run, and presumably lost suction when the level fell too low. It appears that
there were some loose wires in the GP1202 motor control rack that prevented the circuit
breaker from actuating. The pump became very hot and Visser was eventually able to shut
it down by manually opening the circuit breaker shortly before 10.24 am.

86
 GP1201 ATTEMPTED RESTARTS

5.38 The GP1201 pumps tripped at 8.19 am. As already observed in Chapter 3, at 8.29 am the
area operator, Ron Rawson, was asked by Ward to restart them but was unable to do so.
Rawson stated that all three pumps failed to respond when he depressed the start buttons
installed at the pumps. He also observed ice on GP1201A at about 8.45 am. Rawson said
he made several more unsuccessful attempts to restart the pumps between 8.30 am and
10.30 am.

5.39 The ice seen on the discharge pipe of GP1201A at 8.45 am suggests that the contents of that
pump were much colder than normal. When the pump shut down at 8.19 am, the lean oil
temperature at the pump was about 28°C. Flashing of this material, if the pump
depressurised, would not cause the cooling observed. For the contents to cool below (]'C, a
flow of cold material must have occurred. This could not have come from the pump suction
line as the pressure gradient would not have allowed flow in that direction. The pressure at
the pump discharge, set by the pressure in the ROD (2700 kPa), was above the GP1204
discharge pressure (1850 kPa) which determined the GP1201 suction pressure. Once the
GP 1201 s had stopped, forward flow through them would therefore have been impossible.
However, if the non-return valve on the discharge of the GP 120 lA pump was stuck partially
open, reverse flow through that pump would have been possible. Cold material could then
have flowed from the top of the ROD, displacing the liquid in the pumps' discharge line and
lowering the temperature below 0°C. The flow of vapour calculated to be required to
displace the contents of the line by 8.45 am was 45 1/s. This flow is greater than would be
expected from the tested leakage rates of the non-return valves. A small granule of scale or
other solid material, as observed in the shells of both GP905 and GP922, could have been a
possible cause of the check valve not closing fully. It should be noted that ice was observed
on only one pump. This is consistent with an open flow path through that pump only, as
would be expected from a leaking non-return valve.

5.40 When the vapour passed through one pump, it would have passed into the suction line of all
three pumps. Any attempt to start them in this condition would have caused the pump motor
to rotate only while the start button was depressed. When the start button was released,
however, the pump motor would have been tripped by the low flow shutdown switch
LFSD8 and the pump would have slowly decreased in speed. This is not in accord with
Rawson's evidence as he stated that the pumps did not rotate when the start buttons were
pressed. It is possible that Rawson did not recall the manner in which GP1201 failed to
start. He may have confused it with his attempts to start GP1202later in the morning, when
the low level shutdown switch LLSD2 would have prevented their rotation.

87
5.41 In order to start a pump, sufficient liquid must flow into its suction to enable it to prime.
The GP1201 pumps were provided with bleed lines to enable small amounts of vapour to be
bled from the pump casing to help this. However, this would not have been sufficient if the
vapour backflow were continuing or most of the liquid had already been pushed out of the
suction line. Two-phase flow calculations showed that the calculated vapour backflow was
sufficient to displace all liquid from downward sloping piping. However, the vapour would
not have displaced the liquid from the vertical piping legs, but instead would have bubbled
through it. The lean oil piping contained many up and down legs (Figure 5.14). In
particular, the GP1201 pumps were at one low point in the line and the GP910 cooler was at
an adjacent high point. This means that when vapour flowed backwards through the
GP1201 pumps it would have displaced most liquid in the discharge line and in the pumps
themselves. On the suction side, however, the vapour flow would have supported liquid in
the vertical leg and in the GP910 cooler. If the vapour flow were interrupted, this liquid
would have fallen back into the pump suction and enabled the pump to start. If more
pockets of vapour were drawn into the pump, or through the LFSD8 flow sensor, the pump
would then have stopped again. The back flow of vapour could have been interrupted either
by closing a block valve on the GP1201A pump, or by the reseating of the check valve, for
example, during one of the restart attempts.

FromROD
I: (at 33.5 m)

16.5 m 13.1 m 13.3 m 4.1 m

7m
To , ,
GP904 D From
GPI204
5rn

3m

Im

(Vertical distances are to scale; horizontal distances are not)

Figure 5.14 Lean oil piping elevation

5.42 The evidence before the Commission did not support a finding that the maintenance of the
non-return valves was inadequate. A non-return valve is not normally relied upon as a
safety feature of a design and it is recognised that a sticking non-return valve is not an

88
 unusual occurrence. Thus the suggestion that the non-return valves were leaking or that one
was stuck partially open is not intended to indicate inadequate maintenance.

5.43 An alternative explanation for the difficulty in restarting the first GP1201 pump is that the
first pump was overloaded whilst starting. The normal procedure to restart a pump was just
to press the start button. Provided one pump was already running, this would have been all
that was required to start a second one. When the first pump was started, it would have been
delivering through a fully open control valve (LRC2). This would have meant that the pump
was delivering the maximum flowrate possible, which could have caused the motor to draw
more power than its rated 75 kW. In a short time the pump could then have tripped out on
overload. This pump would not have been able to have been restarted until the motor or
thermal overload cooled and the overload relay reset. Likewise the other two pumps could
have behaved in an identical fashion. In such circumstances it is necessary to partially close
the discharge valve in order to start the pump. In common with the vapour lock explanation,
this does not accord with Rawson's recollection that the pumps did not rotate. They would
have rotated at least briefly. It also does not explain the observed icing of the discharge
piping. On the balance of probabilities, the backflow explanation is the correct explanation
for what occurred.

5.44 An electrical failure affecting all three GP 1201 pumps has been postulated to have
prevented restart of the pumps as observed by Rawson. However, the only electrical
systems that were common to all three pumps were the trip circuits. These were wired in
such a way that they would stop each pump when it was running, but would not prevent the
pump from rotating whilst the start button was depressed. This theory is thus inconsistent
with Rawson's recollection. Also, all but one trip circuit (LFSD8) affected other equipment
that continued to run. The fault would therefore have to have been with the LFSD8 trip
circuit, and would also have to have cleared to enable restart after 12.00 noon. This does not
explain the observed icing, and is considered much less likely than the vapour lock
explanation.

5.45 A related scenario is electrical failure of one working pump, followed by the second
working pump overheating and tripping out on overload. This could have prevented two of
the three pumps from starting when Rawson made the initial attempt. However, the standby
pump would still have been able to rotate and it is likely that the thermister that tripped the
first pump would have reset during the ten minutes or so between the trip and the restart
attempt. Also, it should have become apparent during the subsequent restart attempts during
the morning that only one of the pumps was defective. This scenario is also considered to
be improbable.

89
5.46 A further possibility is that either the operator did not attempt to restart the pumps, or if he
did so, did not hold down the start button for sufficient time for the pump to prime. It is
highly unlikely that he did not attempt to restart the GP1201 pumps, as he would not have
observed the ice on the discharge line ofthe pumps if he had not been present at the pumps.
The need to restart them was clearly evident, even if the urgency to do so was not. The
need to start a GP1201 pump with no other GP1201 pump running was rare and normally
only occurred after a planned shutdown. When a spare pump was started whilst another was
already running, the start button needed only to have been pressed briefly, as the low flow
shutdown switch would already have been satisfied. When starting the first pump when all
were off, it would have been necessary to hold down the start button for a sufficiently long
time for the flow to build up and satisfy the low flow shutdown switch LFSD8. It is
possible that this was not done, particularly if some vapour pockets existed requiring the
button to be depressed for more than a second or two.

5.47 On the balance of probabilities, the most likely reason that the GP1201 pumps could not be
restarted was that they were vapour locked due to a flow of vapour back from the ROD
through a partially open non-return valve. Whatever the restart process followed by
Rawson, it was not successful in removing this vapour from the pumps and other parts ofthe
lean oil system.

COOL DOWN
5.48 Even though the lean oil flow ceased at 8.30 am, the flow from the absorbers through the
Rich Oil Flash Tank to the ROD continued for most of the morning until the gas flow into
the plant was cut off at about 11.00 am. The composition of the flow from the absorbers
through the leaking FRC7 valve was that of condensate. In the absence of lean oil, the
material flowing out of the rich oil trap tray to the Rich Oil Flash Tank via LC8A and LC8B
was entrained condensate that had been coalesced by the absorber trays. This would have
greatly increased the volatility of the fluid flowing to the ROD at the same time as the total
flowrate decreased. Simultaneously, the heat input to the ROD feed from the lean oil was
lost.

5.49 Before the shutdown of the GP1201 and GP1202 pumps, the temperature in the Rich Oil
Flash Tank was about -33°C. After the pumps stopped, the contents of the Rich Oil Flash
Tank cooled down rapidly to -42°C and both feeds to the ROD cooled to -48°C. The
dynamic modelling of the system shows that within half an hour the entire ROD, including
its feed piping, and GP905 were at -20°C and after an hour had cooled to -48°C (Figure
5.15). They remained at about this temperature for the rest of the morning.

90
5.50 The results in Figure 5.15 are conservative and assume that the high level in Absorber B was
not sufficient for the direct overflow of condensate into the rich oil trap tray. If the
condensate continued to overflow after 8.30 am, the times in Figure 5.15 could be as little as
half those indicated.

0 [\ \ \ \
-5l \ A-GP9040ut

\ \\
I \ \

\
B -GP905 In
C -GP9050ut J
":
-~'~ I \\ \
D RODBottom
l

G -2o~ \ \ \ \
""' I
~ -25
i
r'

~ -30 l-
:a I
~ -35 r-
~ -40r A \' -i
'

\ \,
! ,,
-50!-

-55!-
j
I
-60 .____ __;,_ ____.__ _ - ' - - - - - ' - - - - - ' - - - - ' - - - '
8:20 8:30 8:40 8:50 9:00 9:10 9:20
Time on 25 September 1998 (am)

Figure 5.15 Thermal response of GP904, GP905 and ROD following loss of lean oil

5.51 The exchanger GP905 was thus maintained at a temperature of -48°C from before 9.30 am.
The only possible flow of hot oil through this exchanger during the next two and a half
hours was the small flow of seal flush oil that recirculated from the GP1204s through GP922
and GP905 before branching off the main line and flowing back to the GP1204 seals. This
total flow was 121/min per pump or 36 1/min if the seal flow was active for all three pumps.
This flowrate has been calculated to be insufficient to change the temperature of GP905, or
cause sufficient stress at the weld to initiate failure. The continuing flow of cold condensate
down the ROD was more than sufficient to replace any condensate that was boiled off due to
the heat input from the seal oil. It is also possible that the reverse flow described above
could have prevented even this small flow of hot oil. In any event, the flow of seal oil
ceased when the GP1204 pumps were shut down by Visser at 11.10 am.

91
 GP905 FAILURE

5.52 As the morning progressed, the leakage at the flanges of GP922 was receiving attention
from more and more people. As already observed in Chapter 3, Vandersteen and Knight,
who had been retensioning the bolts on the GP922 flanges, finished their work at about
12.15 pm without making any significant changes to the bolt tensions or the rate of leakage.
It was at about this time that the decision was made to re-introduce lean oil flow into GP922
to try and stop the leak.

5.53 By then, GP905 was at -48°C with a small flow of condensate through the tube side. The
shell side was either full of cold lean oil or contained lean oil with some vapour above it.
There was no seal oil flow by this time, so that the shell side was essentially static. Clearly
GP905 had not failed due to low temperature alone during the preceding two and a half
hours. This is consistent with the metallurgical evidence (see Chapter 6) that additional
thermal stresses were required to initiate failure.

5.54 The GP1201 pumps could only be started if the GP1204 pumps were running, as the low
flow shut down switch LFSD7 in the oil line to the ROF heaters GP50 lA and B was also
wired into the starter circuits for the GP1201 pumps. Unless LFSD7 was closed by a flow
of oil from GP1204 through the heaters, the GP1201 pumps were unable to run. The
GP1204 pumps were eventually started successfully at 12.11 pm, after resetting some low
flow shutdowns on the flow control valves to the heaters. Heath Brew, directed by the day
supervisor Ian Kennedy, attempted to start a GP1201 pump at about this time. Although he
thought the attempt was successful, the pump did not generate flow observable in the control
room, and the pump was found to have stopped when he returned to it a few minutes later.
A second attempt was made to start a different GPl201 pump shortly after 12.15 pm and by
12.17 pm this was thought by those in the field to have been successful. However, no
change was observed in the Oil Saturator Tank level, LRC2 (Figure 5.5). It is likely that
vapour from the ROD had displaced liquid from the heat exchangers GP930, GP925, GP904
and GP924. The time required to refill these exchangers has been calculated at up to
15 minutes, depending on the flowrate, so that an immediate increase in level would not
have been apparent.

5.55 What followed has already been discussed in Chapter 3. At 12:20:52, following the attempt
to reintroduce lean oil circulation, the production co-ordinator, Shepard contacted Ward by
radio in the control room. He asked Ward to close TRC4. Ward mistakenly understood the
reference to be PRC4 rather than TRC4. Beside GP922, Shepard waited to see TRC4 Valve
1 open, but nothing happened. Ward then reported to him that the PRC4 controller had no

92
 output i.e., it was already closed. Shepard heard Ward to say that the TRC4 controller had
no output.

5.56 Shepard then asked Ward to open TRC4 to 100%. It was at about this time that Shepard
operated the HS4 switch changing the operating mode of TRC4 from demethanising mode
to de-ethanising mode.

5.57 With the very low temperatures in the bottom of the ROD tower at this time, the output of
the TRC4 controller would have been 100% (15 psi). In this condition, and with HS4 in its
normal position for demethaniser mode, the two control valves would have been set for the
flow path shown in Figure 5.16. Changing the switch to de-ethaniser mode would then have
changed the flow path to that shown in Figure 5.17. As a result, lean oil would have
bypassed both heat exchangers, although a small flow would still have passed through
GP905, provided that at least one GP1201 pump was operating.

---r3iJ=92_i __ ""'l lf-- ---- ------------~1

~
_____________ /
1r------- GP-90 5-- --_,1
1 ~-----------------_jl

CDQ1ITH~
,--- ------------------- ------- ------------------------------
1
1 VALVE
1 ------- ---~

TO GP- 1201
PUMPS

FROM GP-1204 OPEN

PUMPS
0\S(HARGE RE(YlLE TO
GP-1204 PUMPS

!
CLOSED
TRC-4
OUTPUT
IHEA T REQUIRED
VALVE 2 IN GP-905) VALVE 1 POSITION PRIOR
U - BYPASS - - - - - - - - - -- - 100 ~ 15 psi - -- - - -- - - - -- - - -----· - CLOSED - ~~~~~~'W~~~

I HAXIHUH HEATING

L - TO GP-922 - - ------- 50 ~ 9 psi CLOSED

- L - TO GP-922 - - -- -- - - -- 0 X 3 psi OPEN

NO HEATING

Figure 5.16 Flow path prior to changing HS4 from demethaniser mode

93
 MINIMAL FLOW

---GP~9-2-i-- ~l ~~-----------------~1
_____________ GP-905- -----jl
r-------
$
1
/
~--- ---- ----------~

[ljffijJ ~I RE
HS
4
,---
1
---- - ------- --- --- - - - --~---- -- - ------ - ----'
VALVE 2
TO uP-1201
PUHPS
(

FROM GP- 1204 OPEN

PUMPS 0
DISCHARGE RE[Y(L[ TO
GP- 1204 PUMPS

CLOSED
TRC-4
OUTPUT
IHEA T REQUIRED
VALVE 2 IN GP-905) VALVE 1
POSITION AFTER
- U - BYPASS -- - - -------- 100 ~ OPEN - [HANGING

I ",,., .,
MAXIMUM HEATING SWITCH HS-4

~ -- ~ ~ -- --- CLOSED

L - TO GP-922 ------ - --- 0 ~ 3 psi - -- - - - - -- - - - - ---- CLOSED

NO HEATING

Figure 5.17 Flow path after HS4 was changed to de-ethaniser mode

5.58 Shepard said that moments before the accident he observed the stem of TRC4 valve 1 rising
indicating that the valve was opening. It is not clear whether this was correct. However, if
TRC4 Valve 1 did begin to open as Shepard said it did, it would, as it opened, have reduced
rather than increased the flow of Jean oil through GP905. It would not, therefore, have
caused GP905 to fail.

5.59 In any event, almost immediately after Ward opened PRC4 to 100%, GP905 ruptured.

5.60 Ward then closed PRC4. This was the state in which it was found after the accident. PRC4
controlled the back pressure on the Rich Oil Flash Tank and would have had no effect on the
conditions in GP905 or on the TRC4 valves or any other equipment in the immediate ROD
area.

5.6 1 The metallurgical evidence concerning the failure ofGP905 shows that the exchanger would
not have failed solely due to reaching a temperature of -48°C (see Chapter 6). As discussed
above, GP905 reached -48°C by 9.30 am and yet it did not fail until 12.25 pm. There
needed to be an additional stress on the channel weld to cause it to fail. There was no
evidence of any mechanical impact in that area, which was, in any case, covered by
insulation. Finite element modelling of the stresses in the exchanger showed that a sudden
increase in the shell-side temperature, as would occur with re-establishing flow through a
GP120 I pump, would produce sufficient thermal stress to cause the exchanger to rupture.

94
 No other credible sources of additional stress were found. As the hot lean oil in the ROF
was the only source of heat which could be applied suddenly to GP905 and the process
personnel were attempting to re-establish this flow, it appears to have been the source of the
additional stress.

5.62 For a significant flow of lean oil to have entered GP905, a GP1201 pump must have been
restarted, and it appears highly likely that the second attempt at about 12.15 pm was at least
partially successful. As discussed above, to restart a pump that had been vapour locked,
some action must have occurred to fill the pump casing with liquid. This occurred either by
an operator closing a discharge valve on the GP 1201 A pump thereby stopping all reverse
flow, or by the non-return valve reseating, probably earlier in the morning. This would have
allowed the lean oil held up in GP91 0 to flow down the line to the pumps while the methane
flowed up the line to GP910 (see Figure 5.14). Once the liquid and gas settled out, the
pump would have been primed and could have been restarted. However, it is possible that
pockets of vapour remained in the piping, and it is quite plausible that once started, the
pump would have stopped again after a short while. There is evidence that the GP1201
pump started at about 12.12 pm but only ran for a minute or two, if at all. The time for
which the pump ran the second time just prior to 12.17 pm cannot be determined with any
precision. However, it is clear that it must have run for sufficient time to allow some hot
lean oil to enter GP905.

5.63 For a significant flow of lean oil to have entered GP905, a GP1201 pump must have started.
Once one GP1201 was started, any action taken with TRC4 or HS4 was too late. If the
strategy were to be effective in limiting the rate of temperature rise within GP905, these
valves should have been correctly aligned before starting a GP1201 pump. The action taken
by Ward in opening PRC4 for less than a minute could not have had any bearing on the
failure ofGP905. There was insufficient time for any resultant pressure decrease in the Rich
Oil Flash Tank to have any impact on conditions in the ROD and GP905. This is confirmed
by the strip chart showing the ROD pressure (Figure 5.5). GP905 did not fail immediately
the GP1201 was started because of the time required to heat the tubesheet in GP905.
Dynamic finite element stress analysis of the tube sheet has shown that the time required for
the stresses to reach the failure level was consistent with the observed delay. GP905 failed
because of the combination of low temperature due to the earlier loss of lean oil circulation
and the subsequent re-introduction of hot oil following restart of one GP1201 pump.

95
 SUMMARY OF TECHNICAL FINDINGS

5.64 The events overnight on 24 and 25 September and during the early morning of
25 September resulted in cold condensate overflowing from the bottom of Absorber B into
the rich oil stream to the Rich Oil Flash Tank. This resulted in a decrease in temperature in
the Rich Oil Flash Tank, but, provided lean oil circulation continued, did not present a major
problem. Some time prior to 7.00 am on 25 September, the ROD began to carry over
additional material into its vapour line. It is likely that this was entrained liquid. The cause
of this carryover has not been identified. It is known that in the past, excessively cold and
light feed to the ROD has caused flooding, but the mechanism by which this occurs is
unclear. Simulation shows that if the ROD internals were intact, the operating conditions on
the morning of25 September were a long way from the column's flooding limit. Although
the exact mechanism of carryover is unclear, it is highly likely that carryover was the cause
of the GP 1201 pumps shutting down.

5.65 Once the level controller on the Oil Saturator Tank could not close its control valve any
further, the level increased significantly. The discharge flowrate ofthe GP1201 pumps had
been reduced to near to the low flow shutdown point, and eventually dipped below this trip
point, causing the GP1201 pumps to shut down. The non-return valve on GP1201A stuck
partially open, allowing cold vapour to flow back through the pump into the lean oil circuit.
This vapour made restart of the pumps difficult until the flow from the ROD was interrupted
during one of the restart attempts. Liquid then flowed back through the line from the
elevated GP910 exchanger into the pump suction enabling the pump to be started. Residual
vapour in the line continued to interfere with reliable pump operation.

5.66 By 9.30 am the ROD and its reboiler, GP905, had cooled to about -48°C under the influence
of a continuing flow of cold, flashing condensate from the absorbers in the absence of
heating from the lean oiL When one GP1201 pump was eventually started around 12.17 pm,
some hot lean oil entered the shell of GP905 and started to supply heat. As the tubesheet
warmed up from its previous low temperature, the stress in the circumferential channe1-to-
tubesheet weld increased until at 12.25 pm the weld cracked and the exchanger failed
catastrophically.

96
 Chapter 6
THE METALLURGICAL ANALYSIS OF GP905

THE GP905 REBOILER

6.1 The GP905 reboiler was a single tube-pass shell and tube heat exchanger. See Figure 6.1.
Cold ROD tower liquid (demethanised rich oil) entered the channel at the west end and was
heated, by the hot lean oil on the shell side, as it passed through the tubes to the east end. It
left the east end channel as a mixture of warm liquid and vapour, and returned to the bottom
of the ROD. The hot lean oil entered the reboiler's shell at the east end and was cooled as it
flowed round the baffles to the west end. It flowed in the opposite direction to the liquid in
the tubes. The temperatures marked on Figure 6.1 were typical of those for normal plant
operations. They are not the temperatures existing on 25 September 1998.

Liquid and Hot Lean

Vapour Oil In
Out(IOO•Ct (230°C)

EAST
' WEST
END

END

•
I
.
t Liquid In
From ROD
Lean Otl ( 6ooq
Out
(l20oq

Figure 6.1 Schematic view of the GP905 Reboiler

6.2 The different parts of an exchanger have specific names. These are shown in Figure 6.2.

6.3 Figure 6.3 provides details of the welds that attached the reboiler's shell to its tubesheet and
its tubesheet to its channel. The figure also provides details the reboiler's nozzles.

97
 Shell (Inlet) Nozzle

Tubes

Baffie

Nuts and-----1~
Studs

Channel Flange Plate

Figure 6.2 Naming convention used for exchanger parts

Shell to Tubesheet Tubesheet to

Tubesheet Channel Weld
Weld

,, . ......
,""
I Nozzle
I
I
I

Figure 6.3 Details of tubesheet welds and nozzle attachments

98
 FORENSIC STUDY OF THE FRACTURE SURFACE

6.4 The ruptured portion of GP905 was subjected to a detailed examination and a number of
metallurgical tests. The aim of this work was to learn the mechanism of failure from
inspections of the failed surface and from mechanical tests on the metal of the vessel.

6.5 It was found that the origin of the failure was in a weld between the channel and tubesheet at
the east end of GP905. It was a brittle fracture, with localised ligament failures. The
indications were that the failure occurred at a low temperature that was well below the
normal operating temperature for the vessel.

6.6 An inspection and test programme was developed. As the work progressed, the programme
was modified and extended to encompass current findings. The programme included:

• A visual examination - to identify the extent of damage, type and mode of fracture, the
origin (or origins) of the fracture, and features which contributed to the fracture.

• Radiography, magnetic particle inspection and ultrasonic (non-destructive) tests- to

identify, for specific parts of the failure surface, the type and extent of flaws.

• Metallography inspection (optical microscopy of metal grain structures) - to identify

the crack's path, characteristics of the flaws and fracture's origin, and for material
verification.

• Scanning electron microscope inspection - to assess the microstructure of the failure

surface and to assist in establishing the fracture's origin.

• Fracture toughness testing - to determine how temperature affected the characteristics

of the fracture surface, the fracture mode and the metal's toughness.

• Chemical analysis, tensile testing and Charpy impact testing - for material
verification.

• Residual stress measurement - to determine the residual stress at the critical location
for input to the failure analysis.

6.7 Figure 6.4 is a photograph ofthe failed (east) end of the GP905 reboiler and Figure 6.5 is a
simple diagram showing the location of the crack. The origin of the fracture was at the
8 o'clock position in the reboiler's tubesheet to channel weld, when viewed from the east
end. It progressed in the weld (in two directions from its origin) until it reached the

99
 10 o'clock and 6 o'clock positions. There it broke into the metal plate of the channel. The
visual appearance of the fracture in the weld was essentially that of a brittle fracture.

6.8 At the 6 o'clock position the fracture changed direction and broke into the channel. There
were several smooth changes of direction before the fracture finally broke through the
channel flange just below the 3 o'clock position. At this stage 30 out of the 40 flange studs
broke and the channel plate peeled outwards in a clockwise direction. At 10 o'clock the
fracture also broke into the channel. It headed towards the outlet nozzle stopping when it
reached the nozzle's compensation pad.

6.9 The fracture surface for the main crack was generally flat with fine, almost parallel features,
and localised ligament tearing. These features indicate the direction of the crack
propagation. What the surface shows is explained in Figure 6.6.

100
 Figure 6.4 Photograph of the failed end ofGP905

SOUTH SIDE NORTH SIDE

Crack
... .. .... ./""'v
····· ··.
··..
8 o'clock crack
initiation area
rn Bottom of channel
peeled out clockwise
from crack on north
side of channel

Figure 6. 5 Schematic representation of the failure

101
 Fracture surface had
chevron marks, showing
the crack here travelled
The crack left the weld and travelled in a clockwise direction.
The crack terminated at the 11
into the channel plate at -I 0 o'clock.
to 12 o'clock position, near
At this point there was a feature due
the channel outlet nozzle.
to a lack of fusion at least 30 mm
long in the weld root.

The crack surface was contoured (not

smooth). There was no thinning I
necking at the surface. Ligament I tear
angle showed the crack travelled in a
clockwise direction. The indication
was that the crack propagation speed
was relatively slow. Hence the crack
appeared to be both brittle fracture and
ligament failure.

The CRACK INITIATION 1"\.n..J!<ft'

(8 o'clock), which was in the weld,
Fracture surface was mostly
showed brittle microstructural features.
smooth with relatively few
Some embedded slag, remaining from
shallow ligaments I tear
welding, was found here.
marks near the outer edge.
There was no thinning I
The crack surface was contoured (not smooth). necking at the surface. The
There was no thinning necking at the surface. The crack left the weld and fracture in the channel plate
Ligament I tear angle showed that the crack travelled into the channel plate was clearly a fast (speed of
here travelled in an anti-clockwise direction. at the 6 o'clock position. sound) brittle fracture.

Figure 6.6 Visible features of crack as viewed looking into the east end channel
6. 10 Near the 8 o'clock and 7 o'clock positions there are features on the surface that are several
millimetres in height. These can be seen in Figure 6.7 and Figure 6.8. These large features
are called ligaments and are indicative of localised tensile overload. The angle of these
ligaments and other surface markings indicate that the crack origin lay in the 7 o'clock and
8 o'clock region. The featured surface and ligaments indicate that the crack propagated
slowly while it was in the weld. It should be noted that the term "slowly" is used in a
relative sense, and is in contrast to a pure brittle fracture where the crack propagates at the
speed of sound (fast) leaving a smooth surface.

Figure 6. 7 Ligaments at the 7 o'clock position Figure 6.8 Ligament at the 8 o'clock position

6. 11 By contrast the failure surface in the channel plate (between 6 o'clock and just before
3 o'clock) is smoother, see Figure 6.9. It is flat and featureless on the inner surface, but has
noticeable markings on the outer surface. It can therefore be concluded that the crack's
propagation speed in the channel plate was faster than it was in the tubesheet to channel
weld. It is concluded that the failure in the channel was fast brittle fracture.

Flat featureless surface

Features on the outer part of the fracture surface

Figure 6.9 Close-up ofthe channel'sfracture surface (around 5 o'clock)

103
6.12 Inspection of the 8 o'clock position identified several features that could individually or
together have caused this location to be the crack's initiating point. These were:

• A weld root cavity.

• A flat region that could have been a pre-existing flaw.

• A large slag inclusion (within the flat region) creating a non-bonded area within the
tubesheet to channel weld.

• A slag inclusion creating a non-bonded area at the root of the tubesheet to channel weld.

6.13 The weld root cavity was about 230 mm long

Shell
and 2 mm deep. It was centred approximately
at the 8 o'clock position. It was identified when
Normal
I T ubesheet
Weld Weld Root Cavity
visually inspecting the failure surface with the Shape

naked eye. Figure 6.10 shows a schematic

drawing of the weld root cavity in cross section. Figure 6.10 Weld root cavity

6.14 The flat region is to the left of the ligament in Ligament Flat Region.
(possible flaw
Figure 6.8. This feature, although difficult to 18 mm long by

see in this photo, is noticeable when inspecting

------~,L
.... '
---
__
___
/
_j~-------
....
I
7 mm wide)

the surface with the naked eye. The flat region

is in a different plane to the neighbouring crack Figure 6.11 Side view offlat region
surface. The crack's surface primarily runs
along the middle of the weld.

104
6.15 This flat region is possibly a flaw that existed The cracking has originated
from a small region oflaek
before 25 September. Flaws of a similar size of fusion at the root of the
weld (bottom frame) and
were found in the tubesheet to channel weld at continued up the fusion line.
The cracking has then left
the west (non-failed) end of the reboiler. the fusion line and
progressed into the weld
Figure 6.12 shows a crack in the west end,
metal. The horizontal striped
producing a similar flaw. This crack originated region at the right is the
channel material. The more
from a small region of a lack of fusion at the random patterned region at
the left is the weld.
weld root.

6.16 The scannmg electron m1croscope revealed

non-metallic inclusions scattered within the
8 o'clock area. On detailed examination of the
surface, a large slag inclusion (measuring 5 mm
by 1 mm) can be seen in the middle of the flat The horizontal region is the
non-bonded area between the root
region. Figure 6.13 and Figure 6.14 are
weld and the channel material.
photographs of the surface at the 8 o'clock
position before and after cleaning. The slag Figure 6.12 Tubesheet to channel weld flaw

inclusion is clearly visible. X-ray analysis

confirmed the inclusion to be welding slag.

Figure 6.13 Close-up of the 8 o'clock position Figure 6.14 Close-up of the 8 o'clock
(before cleaning the surface) position (after cleaning the surface)

6. 17 Figure 6.15 shows a slag inclusion near the root

of the weld at the 8 o'clock position. This could
have been the initiating point for the possible
flaw as seen by the flat area discussed above.

Figure 6.15 Weld root slag inclusion at

8 o'clock position

!OS
6.18 In addition to the main failure, the event caused other cracks in GP905. These were found
in the tubesheet to channel weld between the 2 o'clock and 5 o'clock positions
(see Figure 6.16), and in the upper toes of the two east end nozzle compensation pads
(see Figure 6.17).

6.19 Both nozzles were found to be inclined away from their original vertical position. The
damage to the nozzles and the surrounding plate occurred when the GP905 was lifted off its
supporting pillars by the force of the gas and liquid escaping from the rupture, the nozzles
bending against the restraining force of the attached pipework.

NORTH SIDE

""' r--. . . . . ....... -- Intermittent

secondary cracking
I
~. Nozzle in upper weld toe
I
I 1/~econdcrack
I
;~
... in tubesheetto

····t·.... :
I
: channel weld
'
•. I I
I

·~

- I
Main crack
Figure 6.17 Location of the secondary cracks
Figure 6.16 Second crack in tubesheet to in the compensation pads
channel weld

6.20 It was confirmed by chemical analysis that the metal from which GP90S's channel plate and
tubesheet were made was low carbon killed steel with nominal compositions in line with the
metal grade specified for construction. The tensile tests showed that the tensile and yield
strengths of the metal were just less than the original test values at the time of construction,
but the difference was not of importance with regard to the mode of failure.

6.21 Residual stress measurements were made to help assess if stresses naturally occurring in the
vessel could have contributed to the failure. These measurements indicated that there were
residual compressive stresses in the tubesheet to channel weld, and their magnitude was less
on the inner surface than the outer surface. From these measurements it was concluded that
the residual stresses were only a minor contributor to the total stress required for failure, but
that they made the inner surface more critical than the outer.

6.22 The toughness tests were undertaken at a range of temperatures to determine "toughness
values" for the material for use in the failure analysis. The results showed that the metal

106
 (both the channel plate and the weld) behaved in a pure brittle fashion at -500C: the fracture
surface was smooth, there were no indications of plastic deformation, and the "load
deflection" curve was essentially linear. Upon testing, at -30°C, although giving
predominantly brittle results, the metal started to show limited plastic behaviour. The
fracture surface showed features (ridges). There was some thinning at the failure and the
"load deflection" curve showed limited elastic behaviour. As the test temperatures
increased, the fractured test specimens showed increased plastic failure characteristics.
However, even at 0°C there was still some brittleness.

6.23 By comparing the fracture surface revealed on 25 September 1998 with that of the test
specimens, the following conclusions can be drawn:

• For the tubesheet to channel weld fracture, the features on the 25 September surface are
like the -30°C and ooc test fracture surfaces. The metal was essentially brittle, but
showed some features (ligaments) indicating localised ductile behaviour. This indicates
that the temperature of the weld was in the region of these temperatures and was
definitely warmer than -50°C at the time of failure on 25 September.

• For the channel plate fracture (from the 6 o'clock location), the flatness on the inside of
the surface which appeared on 25 September is similar to the -50°C test fracture surface.
The ridges on the outer surface are more like the -30°C test fracture surface. This
indicates that the temperature in the channel was likely to be in this range at the time of
failure on 25 September, and that the outer surface was warmer than the inner surface.

• The tubesheet to channel weld was warmer than the channel plate at the time of failure
on 25 September.

6.24 Cumming's evidence was that he heard "a long rumbling sound like a thunderstorm in the
distance" followed by "another louder rumbling noise a couple of seconds later". This
supports the proposition that the failure was slow while in the weld, resulting in the initial
noise, and was fast in the channel giving the second louder rumbling noise.

FAILURE ANALYSIS

6.25 With the defects of the size found at the 8 o'clock position, GP905 would not have failed if
its internal pressure was the same as that of the ROD and the metal temperatures were at
-48°C. From this it was concluded that another source of stress was required. There was no
evidence of any external impact. For this reason, there must have been thermally induced

107
 stresses. A temperature difference of the order of 20°C would have been sufficient to result
in the failure on 25 September 1998.

6.26 The modelling method used was finite element analysis. The model calculated the stress in
the tubesheet to channel weld due to the stresses induced by the internal pressure and a
temperature differential between the channel and the shell. The residual stresses were
ignored, as they were small in comparison. The model accepted the shell side being
uniformly warmer than the channel of the reboiler, as shown in Figure 6.18. The
temperature difference would cause the shell side to expand to a larger diameter than the
channel, resulting in stress in the tubesheet to channel weld.

Colder

~
Thermal Stress on the
Tubesheet to Channel
We I

Figure 6.18 Finite element model for GP905 thermal stress calculations

6.27 The model calculated the axial stresses for the internal pressure and the 1°C temperature
difference in the tubesheet to channel weld. The initial model was enhanced to a 30 model
that evaluated the effects of the nozzles on the stress. The nozzles were found to have little
effect on the stresses in the tubesheet to channel weld.

6.28 Having determined the stress to temperature relationship, the next step taken was to assess
the temperature difference required for an initiating flaw to result in the failure of the vessel.

6.29 The cases modelled were based on the possible flaws identified by the investigation of the
failure surface at the 8 o'clock position. The set of cases developed for the modelling of
stress were:

108
 3D Modelling Cases

• A flaw the size of the flat region found at the 8 o'clock position (ignoring the weld root
cavity). This was modelled as a semi-elliptical flaw 18 mm long by 7 mm deep, using a
3D model.

• A combination of a flaw the size of the flat region and the weld root cavity. This was
modelled as a semi-elliptical flaw 120 mm long by 7 mm deep. The weld cavity was
230 mm long, so this flaw was conservative in length.

• A combination of a flaw the size of the flat region and the weld root cavity. This was
modelled as a semi-elliptical flaw 180 mm long by 7 mm deep. The weld cavity was
230 mm long so this flaw was a better, but still conservative, estimate of the length.

• A small flaw at the weld root cavity. This was modelled as a semi-elliptical flaw 70 mm
long by 3 mm and by 4 mm deep (2 cases). The weld cavity was 230 mm long, so this
flaw was a better, but still conservative, estimate of the length.

7 mm

'---' +--'t'--.~ 18 mm
7mm
z: : : : :::__~=-----=~~====--=::::::, ••-t'--+~120 mm; -- - - .
7mm
~===-~~~~===-----~=======----====~~~~4--~t__.~l80mm
3 mm

c============ ~~~~==~~~~==~====...-~t'--+•70mm --~~~==~

Figure 6.19 Flaw cases for 3D modelling

2D Modelling Cases

• Long rectangular flaws of depths 2 mm, 4 mm, 6 mm, 7 mm and 8 mm. The depths
were chosen to represent the range of depths of potential flaw from that to the weld root
cavity to the flat area.

6J O For each of these cases, the stress intensity factor was calculated and was compared to the
fracture toughness values obtained from the tests. This comparison enabled cases that could
result in failure to be identified.

631 The results of the failure analysis found the following:

109
 • At -48°C the vessel would not have failed due to the internal pressure alone for the flaw
sizes modelled. (-48°C is the temperature predicted by the process simulation.)

• For the temperature difference indicated by the investigation of the failure surfaces (i.e.
about 20°C) the following initiating flaws could have resulted in failure:

- A combination of a flaw the size of the flat region and the weld root cavity.

- A long shallow flaw of the order of 3 mm depth. Flaws of this type were found at
the non-failed end, but it was not possible to identifY if such a flaw pre-existed at the
8 o'clock position in the failed end due. This was due to the condition of the surface
after the event.

6.32 Also larger flaw sizes with smaller temperature differences or smaller flaw sizes with larger
temperature differences could have resulted in the reboiler's failure if it was at the cold
temperatures indicated by the characteristics of the failure surface.

6.33 It should be noted that at normal operating temperatures (including start-up and shutdown
temperatures), ambient and greater, the fracture toughness of the metal would be such that
the flaw sizes and temperature differences modelled would not have resulted in the
reboiler's failure.

6.34 Given the requirement for heating of the shell side of GP905 for failure, calculations were
undertaken to assist in determining the magnitude of the hot lean oil flow into the shell side
of the reboiler to result in a 20°C temperature difference across the tubesheet to channel
weld. These calculations were aimed at ascertaining generally the magnitude of flow
required, rather than accurately modelling a specific scenario. This was because the affect
of the evidence concerning the restarting of the GP1201 pumps was unclear.

6.35 An axisymmetric model of the heat transfer process and the resulting stress distribution was
prepared using Strand 7 Finite Element Method software. This model calculated the
temperature in the tubesheet to channel weld for different conditions in the shell and tube
(channel) sides of the reboiler.

6.36 In developing the cases to be modelled, consideration was given to the possible conditions
in GP905 before the attempts to restart lean oil flow on 25 September 1998. The process
simulation had calculated the temperature in GP905 as -48°C and, given the ongoing flow of
cold condensate via the FRC7 valve, the tube side ofGP905 would have been full ofliquid.

110
6.37 The flow of hot lean oil into the shell side would have evaporated the tube side liquid unless
there was a flow of liquid down the ROD that replaced the evaporated vapour. Assuming no
liquid make-up from the ROD, a simple heat balance calculation indicates a lean oil flow of
1000 1/min and 200°C would have boiled away the condensate in the tube side of GP905 in
about three and a half minutes. The 1000 1/min of lean oil flow is the set point for LFSD8.
Tt is therefore the. minimum flow through the GP1201 pumps. 200°C is a representative
value for the temperature of the lean oil on reaching GP905, based on PIDAS and chart
readings. In reality, the heat from the lean oil on the shell side would have produced
localised vaporisation from the upper tubes. Vapour leaving each end of these tubes would
have impaired proper circulation and decreased heat transfer. Hence the time required to
boil the tube side dry would have been longer than the three and a half minutes calculated,
which should be considered a minimum.

6.38 Two cases were modelled to give estimated times to failure, given a continuing lean oil
flow:

Case 1 - Channel being full of liquid.

Case 2- Channel being full ofvapour (i.e. empty of liquid).

6.39 Figure 6.20 and Figure 6.21 show the results for the two cases modelled. From the graphs it
can be seen that the time taken for the temperature of the tubesheet to channel weld to
increase to 20°C greater than the channel is of the order of three and a half to seven minutes.

00

-10.0

~-200

~ -30 0
~

-400/
V
-50.0
0 200 400 600 800 1000
"Time (s)

Figure 6.20 Temperature at tubesheet to Figure 6.21 Temperature at tubesheet to

channel weld for Case I channel weld for Case 2

6.40 The evidence indicates that there were two attempts to restart a GP1201 pump and that the
flow would have been through (not around) GP905. It is not possible to state with certainty
when the restart attempts took place, but based on the radio transcript, they were about
13 minutes and 9 minutes respectively before the time of the rupture. Also the evidence is

111
 that a GP1201 pump started on both occasions, but it is unclear ifthere was flow and ifthere
was, how long it lasted. The GP1201 pump certainly stopped after the first attempted
restart.

6.41 Given the requirement for a temperature differential and based on the times specified above,
it follows that the starting of the GP1201 pumps resulted in lean oil flow.

METALLURGICAL INSPECTIONS, TESTS AND FAILURE ANALYSIS

CONCLUSIONS

6.42 GP905 failed catastrophically due to brittle fracture with localised ligament failure. The
internal pressure alone was not sufficient to cause the failure of the reboiler, hence an
additional source of stress was required. On the balance of probabilities, the additional
stress required to cause the failure arose from the temperature differences between the
channel and shell. The higher temperature in the shell was due to the introduction of hot
lean oil resulting from the restart attempts of the GP1201 pumps.

112
 Chapter 7
THE FIRE, THE EXPLOSIONS AND THE RESPONSE TO
THE EMERGENCY

THE INITIAL VAPOUR CLOUD AND ITS IGNITION

1.1 From an engineering assessment made of the volumes and mass of the various flammable
hydrocarbons that were contained within GP1 at the time GP905 ruptured, it appears that
somewhere between 20,000 and 25,000 kilograms (20-25 tonnes) of sales gas, ethane,
condensate, and lean and rich oil were liable to escape from the rupture ofGP905.

1.2 Various witnesses described a thick white vapour cloud or fog forming in the vicinity of the
RODIROF area. The cloud almost immediately began to drift in a south to south-easterly
direction. The contents of the ROD were at a pressure of 2800kPa and provided the force
for the initial release. This pressure, when released, was sufficient to blow off their feet
those attending to the leak from the adjacent exchanger GP922. Further, the force of this
initial jet of gas and liquids dug a hole in the ground directly below GP905, which was later
measured to be approximately 1.5 metres in diameter and 1 metre deep. The gravel and dirt
from the hole was sprayed around by the gas jet, denting the light aluminium cladding
covering some of the adjacent vessels.

7.3 The south-south easterly drift of the vapour cloud from the RODIROF area was towards the
general direction of the gas-fired heaters, located approximately 170 metres away at the
southern boundary of the plant. It would have taken in the order of 30-60 seconds for the
cloud to drift this distance. During thls time, upwards of 10,000 kilograms (10 tonnes) of
flammable hydrocarbon gases, vapours and liquids were released from the ruptured reboiler
GP905.

7.4 The development of the cloud was modelled using a computer simulation code. This
modelling demonstrated that the front edge of the cloud would have contained a sufficient
mixture of flammable hydrocarbons and air for it to ignite once it found a suitable ignition
source. The burn pattern of the cloud, the eyewitness descriptions of the movement of the
flame front and the lack of any significant overpressure damage, all support the conclusion
that the front edge of the cloud ignited once it reached the fired heaters. It is probable that
the cloud was ignited by the hot oil heater AX501 or the regeneration gas heaters AX502A
and AX502B, all of which were still being fired.

113
7.5 The main area between the ROD/ROF section of the plant and the heaters into which the
cloud had dispersed was very open. Having ignited at its front edge, a flame front
developed and then burnt back through the vapour cloud, along the north/south piperack to
the source of the release, namely GP905. When it reached the exchanger the cloud erupted
into an 'angry red orange ball of fire'. While the term 'explosion' has been used to
characterise the ignition of the initial vapour cloud, the appropriate technical term to
describe this ignition is a 'flash fire' or 'deflagration'. However, it is convenient to use the
term "explosion", particularly as that term is used by the Terms ofReference.

7.6 Once the flame front of the vapour cloud reached the GP905 exchanger, it would have
ignited the continuing jet of gases and liquids escaping from the rupture site. As the initial
release consumed upwards of I 0 tonnes of hydrocarbon materials, this meant another 10-15
tonnes of materials were still contained within GP I. All of this material was available to
fuel the continuing fire emanating from GP905 and GP922 for a matter of hours and gave
rise to flames as high as three-quarters the height of the ROD. The flames emanating from
GP905 and GP922 impinged on the overhead piping in the east-west piperack. As the metal
walls of these pipes were heated to their failure temperatures, they began to rupture. The
smaller pipes first began to rupture in a matter of minutes, as described by Curnming, with
the larger pipes rupturing later as recorded on the security videos.

THE EMERGENCY RESPONSE PLAN

7.7 Under s.14 of the Country Fire Authority Act, 1958 (Vie), the control of the prevention and
suppression of fires in the country area of Victoria is vested in the Country Fire Authority
(CF A). Longford is within the country area of Victoria. Section 20AA (2) (a) of the Act
gives the CFA power to enter into agreements or arrangements for the provision of its
services. The CFA entered into such an agreement with Esso and on 25 September 1998,
the relationship between Esso and the CFA was governed by that agreement. It was known
as the Joint Emergency Management Agreement. Under this agreement, Esso had a duty to
report immediately to the CFA regional headquarters at Sale all fires and emergencies. It
was agreed that, based on the information contained in the initial report, the CFA would
activate the appropriate level of fire brigade response.

7.8 The agreement provided that upon arrival at the fire or emergency, the CFA officer in
charge was to consult with the Esso emergency co-ordinator and would then assume the
responsibility of incident controller at an appropriate location. The incident controller, in
full consultation with the Esso leader of operational response, would establish an
appropriate joint Esso/CFA Incident Management Team (IMT) and the IMT would maintain

114
 liaison with senior Esso managers throughout the emergency. The incident controller was to
develop emergency objectives and strategies in consultation with the IMT. However, the
Esso leader of operational response would retain the command of Esso personnel present at
the emergency and would, to the extent practicable, act in accordance with the instructions
of the incident controller.

7.9 Esso had three manuals dealing with response to an emergency. The first was the
Emergency Preparedness System Manual, which dealt with the management system in the
event of an emergency. The second was the Emergency Response Manual, which contained
information needed if an accident occurred. The third was the Emergency Response
Support Data Manual, which contained detailed emergency instructions and support
material. The Emergency Response Manual required the person in charge at the site of an
emergency to determine whether the emergency was level S - one that could be brought
under control with personnel and equipment at the site, or level 0 one that required
outside assistance. For level 0 emergencies, a category within which the accident at
Longford on 25 September I 998 clearly fell, the leader of the Crisis Management Team
(CMT) was to be responsible for the accident management with the advice of the leader of
operational response.

7.10 The CMT was situated in Esso House in Melbourne and was comprised of persons
possessing the training or skills necessary to deal with all aspects of an emergency. The
leader of the CMT on 25 September 1998 was Peter Coleman. The Emergency Response
Manual also envisaged forward controllers and field teams, presumably at the site of the
emergency, as part of the accident response. However, the manual observed that "the extent
to which we would use this structure in practice depends on the nature of the particular
emergency that may arise".

7.11 In fact, no classification of the emergency at Longford was made nor was there any practical
need for such a classification. Peter Wilson, who was the person in charge at the site, was
killed and Peter Hi skins, a construction supervisor, assumed the role of leader of operational
response. However, it appears that senior sergeant butler, who was stationed at the Sale
Police Station, rang the plant manager's secretary, Angela Jones, after learning of the
emergency and asked whether it was big enough to initiate DISPLAN. DISPLAN was the
original State disaster plan which had been replaced by the Emergency Management Manual
Victoria and no doubt, Senior Sergeant Butler was intending to refer to the latter. Jones
replied that the emergency was big enough, but it is clear that the modus operandi adopted
at Longford on 25 September 1998 was that contained in the agreement between Esso and
the CF A. Nevertheless, under the manual, Senior Sergeant Butler was the designated

115
 emergency services co-ordinator. He was present at Longford during the emergency and
carried out his duties in that capacity.

THE EVENTS WHICH OCCURRED FOLLOWING THE ACCIDENT

7.12 Although the agreement between Esso and the CFA required Esso to report explosions and
fires to the CF A regional headquarters at Sale, the CF A learned of the accident from the
police rather than Esso. Angela Jones was in her office in the administration building at
Longford when the first explosion occurred and rang security at the main entrance
guardhouse to find out what had happened. She then heard the second explosion and rang
the Sale police station where her husband, a policeman, was stationed. Jones spoke to
another police officer and told the officer that there had been an explosion and that
ambulance, fire brigade and police coverage was needed. The police at Sale, upon receiving
Jones' telephone call , notified the 024 communications centre in Morwell of the accident.
The operator there in turn notified the Morewell Urban Fire Brigade, which in turn notified
the Sale Urban Fire Brigade (the Sale Brigade) and the Longford Urban Fire Brigade (the
Longford Brigade) at 12.43 pm.

Figure 7.1 The first film of the fire, taken at 12:4/:55

116
7.13 Around this time (12:41 according to the video time stamp), the guards in the main entrance
guard house repositioned two of their security video cameras so as to video tape the fire.
The first video recorded picture of the fire (Figure 7.1) shows a red yellow flame with a
height of between 15 and 20 meters and a thick cloud of black smoke drifting in a south-
easterly direction. The relevant time stamp on this figure and subsequent figures depicting
photographs from the security video camera, is the one appearing at the very top of the
figure.

7.14 Jones went to the Emergency Response Procedure (ERP) room which was also located in
the administration building. Under Esso's emergency procedures, it was Peter Wilson's
responsibility to run the ERP room but Jones knew that there were no management
personnel about, so she undertook the task. She rang Peter Hiskins, who had just left for
Sale, and informed him of the situation at the Plant.

7.15 Upon returning to Longford a short time later, Hiskins went straight to the ERP room
expecting to see Peter Wilson in charge. He tried to contact Wilson by radio, but there was
no response. Hiskins then took charge of the situation as the Leader of the Operational
Response Team in accordance with Esso's emergency procedures. He organised a
headcount and confirmed that the ESD for GP l had been activated. He ordered all non-
essential personnel to evacuate the plant. Shortly after this, Peter Coleman rang Hiskins
from the CMT Centre in Melbourne. Coleman ordered the ERP room to be moved from the
administration building to the heliport across the road. Hiskins carried out the order and
then went to the canteen where injured personnel had been located, to arrange for such
persons to be removed. Hiskins' main concern at this time was to ensure that the deluge
system on the LPG accumulators was working. The system appeared to be working, but it
was not until later in the afternoon that an aerial inspection confirmed this to be so.

7.16 Upon the activation of ESDI, GP2 and GP3 switched to recycle mode. This kept those
plants operating but not producing sales gas. At about 12.45 pm, the GP2 and GP3 control
room operators, David Delahunty and Kurt Mielke, were instructed to evacuate the plant.
Before doing so they initiated a full shutdown ofGP2 and GP3.

7.17 Robert Langridge, a CFA operations officer, was in charge of Region 10 headquarters in
Sale. He first became aware of the accident at Longford at about 12.45 pm when a local
television station telephoned him to query what was going on. He was in the process of
contacting the police to clarifY the situation when he heard on the CF A radio that the pagers
carried by volunteer firefighters in the Sale Brigade had been activated and that the
Longford Brigade had responded to an accident at the Longford plant. He then received a

117
 telephone call from the Morwell Urban Fire Brigade to say that it had just deployed the Sale
and Longford Brigades. At about the same time he heard the Sale fire siren operating.

7.18 Langridge and Mark Jones, another CFA operations officer who was present at Region 10
headquarters at the time, then drove to the Longford plant which was about 18 kilometres
away. They arrived at 1.07 pm, ahead ofthe Sale and Longford Brigade tankers.

7. 19 At 1.00 pm, only minutes before their arrival, the security video cameras recorded a major
explosion from the site of the fires. A ball of flames approximately 40m in width and at
least 70m high erupted from ROD/ROF area. This explosion was a consequence of the
rupture of one of the large pipes in the east/west piperack in the King's Cross area and the
subsequent release of its contents to the atmosphere in the immediate vicinity of the seat of
the fire.

Figure 7.2 The first major release, at 13:00:40

118
Figure 7.3 The first major release, at 13:00:43

Figure 7.4 The first major release, at 13:00:46

119
1.20 At about 1.00 pm the Royal Australian Air Force (RAAF), which has an air base near
Longford at East Sale, and which has its own firefighting equipment and personnel, learned
of the explosion and fires. At about 1.10 pm the RAAF dispatched a Trident fire tender,
which is similar to a pumper, and three fire crew to the Longford plant. These were placed
on standby by the CF A. A further fire tender and a crew of three were dispatched to
Longford by the RAAF. The RAAF also supplied additional support facilities in the form of
a transport vehicle with a HAZMAT trailer containing equipment for fighting tires involving
hazardous materials and a crew of three. It also supplied maintenance fitters,
communications equipment, breathing apparatus, foam and bushfire pumps with a crew of
two. A RAAF relief crew was made available for the duration of the emergency.

1.21 Upon their arrival at Longford, Langridge and Jones observed a significant number of Esso
personnel, distinctive in their orange overalls, outside the plant on Garretts Road. From the
guard house Jones saw a fire with flames approximately three-quarters of the height of the
ROD tower in the vicinity of GP922 and GP905. There was thick black smoke drifting off
in a westerly direction.

1.22 Also upon arriving, Langridge assumed the role of incident controller and Mark Jones
assumed the role of Operations Officer. These roles are prescribed by the Australian Inter
Service Management System as part of the IMT. That system has been adopted by the CFA.
Two further CF A staff officers, Simon Bloink and Brian Smith, were included in the IMT as
Planning Officer and Logistics Officer respectively.

7.23 In the meantime, at 12.57 pm two members of the Sale Brigade left for Longford from the
Sale Fire Station in a CFA patrol vehicle. They were Murray Qui ne, who was the Captain
of the Sale Brigade, and Doug Brack, a volunteer member of the CFA and also an Esso
employee. The Sale pumper, which pumps water drawn at the site, was to follow. The Sale
tanker, which carries its own water, and other CFA firefighters were also to follow. Brack
and Quine arrived at the Longford guardhouse at 1.15 pm and met with Senior Sergeant
Butler.

7.24 Security personnel on contract from Chubb Security Australia Pty Ltd were present in the
guardhouse when Brack and Quine arrived. So too were some Esso employees, but there
were no Esso management personnel present. By this time, the Sale Brigade pumper and
tanker, having arrived at the radio tower about one kilometre from the plant, were awaiting
instructions.

120
7.25 At 1.19 pm a decision was made to allow CF A personnel and the Sale Brigade pumper into
the plant, but the Chubb security staff were reluctant to let them through the entrance gate.
The problem appears to have been that the security personnel regarded themselves as bound
by the plant entry procedures which required all persons entering the plant to be registered.
This meant that CF A fire fighters had to get out of their vehicle and register their personal
details before they were let in. After a protracted discussion between the CF A and the
security staff, it was agreed that the CF A would provide the numbers of the CF A personnel
entering the plant but that individuals would not be required to provide their personal
details. Another entry procedure, which required non-Esso personnel to be accompanied by
an Esso employee, was overcome when Quine sent Brack, an Esso employee as well as a
volunteer fire fighter, to escort the pumper into the plant. Nevertheless, the difficulty with
the security staff caused a 10 minute delay in the entry of the first firefighting unit to the
plant.

7.26 When the problem with the security staff was resolved, Langridge, in consultation with
Jones, decided that the CF A should not engage in fire fighting activities for the time being,
but should use water streams to cool the plant and equipment in the vicinity of the fire until
the substances feeding it were exhausted. There was also the problem of the explosions.
Jones set up a control point at the guardhouse and contacted units on their way to Longford
to advise them of the situation. He realised that radio and mobile telephone communications
were a problem because of the geographical features at Longford and he arranged for a
mobile communications van to come from Baimsdale. Until the van arrived,
communications took place through the CFA's Stradbroke sub-base, which monitors all
radio traffic for the Stradbroke group of fire brigades.

7.27 Langridge and Senior Sergeant Butler proceeded to the fire shed in the vicinity of the
ROD/ROF area ofGPl to assess the situation. At this time, which was about 1.20 pm, there
was a large fire in the piperack adjacent to the ROD, generating flames of between 20 and
30 metres in height and large volumes of black smoke. Three or four monitors were spraying
water on to the fire and two Esso personnel were present. The Esso Austral teleboom,
which had a remotely elevated monitor on a telescopic boom, was being used to spray water
on to the fire high up on the ROD tower.

7.28 Jones arrived at the fire shed shortly afterwards. It was at this time that there were two
small explosions within a minute of each other, the latter being the larger. As a
consequence, the intensity of the fire increased. Visser came up to the fire shed and told
Langridge that he was in charge of Esso personnel. He said that ground monitors had been
put in place and that one or two persons were missing.

121
7.29 After gaining entry, the Sale pumper was the first fire brigade appliance to reach the fire. It
took up position in the vicinity of the GP! control room. At about 1.26 pm, while the Sale
Brigade fire crew were positioning hose lines, there was a further explosion at the seat of
the fire which dramatically increased its size and intensity. One witness described it as an
explosion at the base of the fire and a large fireball erupting into the air. The security
. cameras recorded this explosion and fireball at 13:22:47.

Figure 7.5 The second major release, at 13:22:47

no The CFA drew heavily on its resources in places other than Sale and Longford to respond to
the emergency. At an early stage, senior CFA officers ordered hydraulic platforms, fire
tenders and tankers, fire pumpers, telebooms, breathing apparatus, a support mobile vehicle,
mobile foam tender modules, hose layers and aerial appliances . These were obtained from
various places in the State including Bairnsdale, Boronia, Traralgon, Morwell, Ferntree
Gully, Scoresby, Geelong, Chelsea, Noble Park and Dandenong. Most of these resources
were not used but were kept on standby outside the plant during the emergency.

7.31 Langridge was concerned that the fire might impinge on the LPG accumulators causing a
catastrophic boiling liquid expanding vapour explosion (BLEVE). Also, Visser advised that
he could not be sure that the plant was stable . Langridge ordered all persons in the vicinity
of the fire to withdraw to the fire shed and subsequently to the ERP room, which at this time

122
 had not been evacuated to the heliport and was being used as the Incident Control Centre for
the emergency services. The Sale pumper was left in position, playing water from the fire
mains system on to the fire. Langridge examined the options for extinguishing the fire with
Esso personnel in the ERP room. It was agreed that all fire crews should withdraw and
allow the fire to bum itself out. For this to happen it was necessary to shut off all fuel
supplies to the ROD/ROF area.

7.32 At about 1.35 pm the final and largest explosion occurred. The explosion was preceded by
an evident reduction in the noise level of escaping gas. At the time it occurred, Qui ne and
Brack were at the eastern end of the GPI combinaire. The force of the blast was sufficient to
knock them off balance. The blast was accompanied by intense heat. Quine and Brack
observed a large fireball rise into the air and saw the metal ladder on the ROD tower melt
rapidly.

7.33 The security cameras recorded this blast as occurring at 13:32 hours. As can be seen from
the pictures, the flame heights were in excess of I 00 meters high and 55 meters wide.

Figure 7.6 The third major release, at 13:32:31

123
Figure 7. 7 The third major release, at 13:32:34

Figure 7.8 The third major release, at 13:32:37

124
Figure 7.9 The third major release, at 13:32:41

Figure 7.10 The third major release, at 13:32:43

125
7.34 At 1.50 pm, Langridge ordered the removal of the Incident Control Centre from the ERP
room to the heliport. At 2.08 pm the police were asked to evacuate civilians within a five
kilometre radius of the plant and to evacuate all non-essential personnel from the heliport.
An air exclusion zone was imposed when a media helicopter arrived at the heliport.

7.35 At about 2.00 pm, a meeting was held at the heliport between Esso staff and the CF A. It
was confirmed that no attempt should be made to extinguish the fire until all fuel sources
had been isolated. Langridge sent Esso personnel into the plant for the purpose of isolating
further fuel sources to the fire. CF A personnel accompanied the Esso team and manned fire
hoses as a protection measure. Whilst this was being done, the Incident Control Centre was
relocated to the Esso fire shed. Monitors were redirected because of the change in wind
direction.

7.36 The isolation of fuel sources involved shutting valves in and around the ROD/ROF area.
This meant walking underneath the piperacks and following the line of the damaged pipes in
order to establish the appropriate isolation point. As the piperacks were raised above the
ground on concrete pillars, the Esso workers and the firefighters were standing underneath
the pipes looking into the fire above. Many of the pipes had become twisted and broken and
it was difficult to see where they led and to locate the isolation valves to shut them in. A
number of the isolation valves were heat damaged and, even when they were blocked off,
gas continued to escape from them. The piperack areas in GP1 were severely damaged,
leaving the cement pillars cracked and the steel reinforcing exposed. However, isolations
were effected and the severity and height of the fire were reduced.

7.37 Peter Burley, an Esso operator, says that he assisted Neale Burton, another Esso operator, to
compile a list of the lines in the piperacks to assist in the isolation procedure. He says that
they had to do this from memory and their own books because no documentation existed to
identifY the lines located in the Kings Cross area. In fact, Burton used a hand drawn map
that he had prepared in 1992, to identifY isolations which were effected.

7.38 Consideration was given to the use of further aerial appliances, such as telebooms, for
combating the fire. After discussions with two of his officers, Langridge decided that there
would be no advantage in deploying aerial appliances, because the monitors in place were
sufficient to achieve the cooling required. There was, in addition, concern about the
continuation of the water supply and, although no persons or equipment were in a position
of danger, a further explosion could not be discounted as Esso personnel were unsure of the
fuel sources to the fire.

126
739 At 2.12 pm Robert O'Shea, a plant supervisor, arrived at the plant to relieve Visser. He met
with Langridge and Jones. They determined that ground monitors needed to be redirected to
operate more efficiently and that the bore pumps needed to be checked.

740 By 2.25pm the flames in the vicinity of the GP905 exchanger had diminished. The fire as
recorded on the security video camera (at approximately 2.26 pm) consisted of a red-orange
flame approximately I 0-!Sm in height and a large plume of thick black smoke.

Figure 7.11 The fire at 14:26:02

7.41 At about 3.00 pm, the spray of water from the Esso teleboom needed to be redirected, there
having been a change in wind direction, but a hydraulic failure in that piece of equipment
made it ineffective. At about the same time, Jones observed that the hose line from the Sale
pumper had burst so he shut the pump down.

7.4 2 David Sherry, the CFA operations manager, arrived at the plant at 3.30 pm. He was then the
senior CFA officer on-site. On his arrival he was briefed by Langridge. He endorsed the
approach taken, which was to contain and isolate the fire. Sherry agreed that until all fuel
sources were isolated, there was a potential for the discharge of vapour and liquid to cause
an increase in the fire or further explosions.

127
7.43 By this time the flames in the fire area had died down to below 10 metres in height
accompanied by a large billowing cloud ofblack smoke.

Figure 7.12 The fire at 15:26:02

7.44 Langridge spoke with Hiskins at the heliport and at 3.57 pm ordered an aerial inspection of
the scene of the accident by Esso helicopter, not only to make a complete assessment, but
also to ensure that the LPG accumulators' deluge system was working efficiently. Quine,
Jones and Peter Ronalds, an Esso employee, conducted the aerial inspection. They
ascertained that the LPG deluge systems were working and that the flare system was
operating normally, which meant that there were no significant pressure changes in the plant
that might have led to a further explosion.

7.45 Sherry considered that Langridge was handling the situation appropriately and should
remain as incident controller on-site. Sherry regarded his own function as being to provide
assistance if required. He conferred with the police on the site and, after familiarising
himself with the details of the accident, briefed the media who were present. He remained
on site until 2.00 am the next morning, 26 September, before returning at 7.00 am to take
over the role of incident con toiler.

7.46 The plant manager, Will Harrison, had been at Long Island Point on 25 September giving a
lecture on safety. When informed of the accident at Longford, he returned there

l28
 immediately. On his return at about 3.30 pm, Harrison assumed the role of emergency co-
ordinator, carrying out his duties from the heliport.

7.47 When Coleman arrived at Longford, Harrison was already there. After receiving a briefing
from him, the technical team accompanying Coleman was instructed to devise plans for
isolating GPl from the CSP, GP2 and GP3 and to ensure that all remaining hydrocarbon
inventory was safely isolated.

7.48 At 4.27 pm there was a report to the Incident Control Centre that there were small fires
around the LPG booster pumps and the product debutaniser. It was also reported that there
were small fires on the flanges on the east side of the product debutaniser. The isolation of
the absorbers cut fuel supplies to the debutaniser and the fires were extinguished. The
security videos shows that at this time the top of the flames were just visible from the
entrance gate, over the roof of the building in the foreground. The smoke had also
lightened.

Figure 7.13 Thejireat 16:26:02

7.49 At about 5.00 pm on 25 September, Jones had become concerned about the supply of water
in the water storage tanks. These were the tanks that were supplied from three groundwater
bores. The water supply from the tanks represented a single system for the plant, using the
fire mains for distribution. At about 5.15 pm Chris Lyon, a CF A Lieutenant and an Esso

129
 employee, was directed to check the level of water in the water storage tanks. He found that
the gauge for one tank showed zero and the gauge for another showed a level which was
only 18% of its capacity. The electric pumps from the groundwater bores were not working.
It was then realised that when the ESD was activated it had shut down everything, including
the generators. It is possible that the damage to the GPl switch room may have caused the
electric pumps not to operate. In any event, Esso personnel managed to get two of the three
backup diesel pumps working within a short time, but the third diesel pump had been taken
out of service on the previous day for maintenance. This resulted in a reduced capacity to
fill the water storage tanks. The situation was reported to the Incident Control Centre and
arrangements were made for boosting water into the fire mains from the south pond. There
was no means provided to draw water from the pond so a means had to be devised. It was
decided to run a suction hose from the pond to a pumper to pump water from the pond into
the fire mains through the risers or hydrants which were located at various points along the
fire mains ring system. The water could then be withdrawn from the fire mains using fire
hoses. When this was attempted it was found that the fittings on the risers were not
compatible with the fittings on the CF A pumpers and it was necessary to use adapters.

7.50 Lyon recalled that Esso had previously advised the CFA that adapters were located in the
back of the Esso fire shed. Together with others, Lyon went to the fire shed but could not
find the adapters. Eventually Quine, Brack and Colin Skeen, a Lieutenant with the Sale
Brigade, broke into two or three cupboards in the fire shed with bolt cutters and located two
adapters. The pumper from Chelsea commenced drawing water from the pond. It was then
pumped to the Femtree Gully and Traralgon pumpers to increase the pressure. With the
additional pressure, the water was pumped into the fire mains ring. By this means, the CF A
established a water relay from the pond which ensured that the volume and pressure
remained constant. The water from the pond was sufficient to allow the two operating diesel
pumps to replenish the water storage tanks from the bores during the night

7.51 The problems with low levels in the water storage tanks and in locating the adapters delayed
firefighting operations for about an hour. It was necessary to withdraw Esso and CF A
personnel from the area of the fire and to reduce the number of water lines to the fire. It was
not until 7.15 pm that that the water relay was successfully established so that fire fighting
crews could move back into the plant to contain the fire and further attempts could be made
to isolate fuel sources.

7.52 The control objectives of the IMT were set out in a situation report prepared at 5.30 pm on
25 September. They were to continue cooling the fire area, to isolate all possible feeds to
the impact zone, taking care of possible pressurisation due to isolation, to apply water by the

130
 use of aerial appliances from behind the ROD to the pipework at the rear of the control
room, to set up foam teams in case fires started in the drains, to maintain a pumper relay
team on standby and, in the event that there were water supply problems, to cut back on the
water used in the deluge system for the LPG accumulators. That system was working well,
but was using a lot of water. At this time it was observed that it was likely that the fire was
being fuelled by liquid hydrocarbons rather than gas, which was more favourable from a
safety point ofview.

7.53 By around 5.30 pm the flame height in the vicinity of the seat of the fire had diminished
further. The flames were yellow-red in colour and approximately 10-15 metres in height.

Figure 7.14 The fire lll 17:26:02

7.54 At this time members of the fire team were able to move in close to the fires that continued
to emanate from the two exchangers GP905 and GP922. The picture depicted in Figure 7.1 5
was taken by one of the members of the team. The flames from GP905 depicted in the
photograph, were approximately three meters in length and one meter wide. The flames
from GP922 were fan shaped, emanating from various gaps between the end plate and the
exchanger body.

131
 Figure 7.15 The fire from behind the GP/201 pumps, at approximately 5.30 pm

7.55 At 5.45 pm on 25 September there was a meeting between Esso management and the CFA.
Harrison raised the question of the rescue of Wilson and Lowery. Langridge agreed that
Harrison should organise two Esso rescue teams with full safety clothing. Steve Bennett
and Peter McFarlane were to be one team and Ray Hutty and Brian Holt the other. A CF A
officer was to lead each team. Whilst the teams were within 50 metres of the fire preparing
for entry, a direction was given by a representative of the Coroner that, if the missing men
were found dead, the bodies were to be left where they were. At 5.55 pm, Langridge
postponed the use of the rescue teams for safety reasons and by 6.05 pm their use was
cancelled. Langridge indicated that the CF A would conduct a search as soon as possible.

7.56 At 7.13 pm, Brack from the CFA located the body of Lowery, although it could not be
identified until the following day. The body was against a concrete pillar on the south-east
corner of Kings Cross approximately 10 metres from the eastern end of GP922.
Arrangements were made to cover the body with blankets. Or Ian Nicholson, a clinical
forensic physician for the Victoria Police and a general practitioner at the Sale Hospital,
examined the body to confirm death. It was decided that it was unsafe to remove the body
and it was left where it was pending safe access.

132
7.57 At I 0.00 pm on 25 September there was a major changeover of personnel at the plant. CFA
regional officer Euan Ferguson took over from Langridge as incident controller. Graeme
Lay took over from Mark Jones as IMT operations officer. At this time there were about 12
fires still burning from pipes of various sizes, but they were contained. The strategy adopted
was to continue trying to contain the fires, to cool and protect the exposed plant and
equipment and put out the fire by isolating the fuel sources

26 SEPTEMBER (SATURDA l)

7.58 At 1.00 am on Saturday, 26 September, there were two teams ofEsso operators, ten persons
in all, working on the isolation of valves close to the fire. The isolations were carried out on
the basis of the operators' knowledge, by following lines where practicable, by reference to
the P&IDs and at the direction of the supervisor. The planning of the isolations was
apparently done under the supervision of Hiskins and O'Shea on a whiteboard in the ERP
room. No record was kept of any plan and this would confirm that the isolations were
carried out in an ad hoc manner.

7.59 The staging area was relocated to the Longford community hall and two telephone lines
were installed to provide adequate communications. Otherwise matters remained steady
throughout the night. The CFA continued to maintain a cooling screen of water by using
five to seven monitors directed at the fire. The deluge system was running constantly on the
LPG accumulators.

7.60 The CFA strategy remained the same, namely, to continue with the isolation of valves under
the protection of fog, that is, water from fire hoses. The area covered by the 12 or so fires
was approximately 20 square metres with flames varying in length from ten centimetres to
four metres coming from split and ruptured pipes in the ROD/ROF area.

7.61 At 7.00 am on Saturday, 26 September, Sherry returned to the plant and relieved Ferguson
as incident controller. Arthur Haynes, a CFA operations officer, relieved Lay as IMT
operations officer. Allan Smith became deputy operations officer. At this time the fires
were still burning, but with decreased intensity. By 6.30 am it was realised that, whilst the
fires would continue to bum out slowly, the process of effecting isolation of inventories
feeding the fires was going to take much longer than at first anticipated.

7.62 At 6.55 am on Saturday, 26 September, Peter Wilson's body was located. Graham Lay, an
operations officer with the CFA, discovered it directly under the pipework north of the
eastern end ofGP922 and about five metres north east of where Lowery's body was found.

133
 Because of the fire in the piperack above the body, it was not possible to cover it and it was
left where it was pending safe access.

7.63 At 9.00 am the CFA Structural Operations Performance Evaluation Report team and other
CFA personnel met and were briefed by CFA deputy chief Bill Mcintosh. The established
objectives were to extinguish the fires, cool exposures, stabilise the site and maintain
protection before restarting GP2 and GP3, but the CFA reviewed its strategies from time to
time. The main concern was the ongoing uncertainty that existed about the isolation of
inventories feeding the fire. Some gas from unidentified sources was still escaping, but the
IMT was satisfied that it was being dispersed through the continued application of water.

7.64 Geoff Evans, a CF A operations manager, was concerned about the ad hoc nature of the
isolation of fuel sources. At 2.30 pm on Saturday, 26 September, he had a discussion with
Mick Brack, an Esso acting operations superintendent. He asked Brack for a detailed plan
of the plant's pipework to assist the IMT in identifying which valves should be isolated to
stop the flow of fuel to the fires. Brack said that he did not have a plan available and that in
any event, the Longford plant was a hybrid, having had its original design modified on a
number of occasions, so that a plan, even if one could be located, might not have been of
much assistance.

7.65 By 3.00 pm, only a small flame was emanating from the GP905 heat exchanger itself and
there were fires at three locations in the piperack near the Kings Cross area.

7.66 At 3.30 pm on 26 September, an IMT meeting with Esso representatives was held. The
meeting was addressed by Visser, who said that Esso had isolated as many lines as they
could but the flare line could not be isolated because it was still burning from the CSP. He
said that one or two gas lines were split and burning. Other lines were being purged with
water, but it was obvious that there were further gas lines that needed isolating even though
it could not be ascertained exactly where the fuel was coming from. Visser's view was that,
even though the de-ethaniser line was closed at both ends and was soon to be flushed, there
was a possibility that the burning off of fuel could take days. The IMT strategy at this time
was to let the bottom lines to the ROD burn out however long it took.

134
 Figure 7.16 Photograph taken at approximately/4:45pm, 26 September, showing seats offire in
Kings Cross piperack

7.67 The IMT continued to review its strategy. At 4.00 pm on 26 September, it confirmed its
policy of containment and isolation. Esso personnel were continuing to identify pipes in an
effort to isolate individual fires and stabilise the situation before restarting GP2 and GP3.
The policy was confirmed at 5.00 pm, even though the fires had reduced considerably by
this time. By 9.45 pm there were four fires still burning and two monitors operating. At
10.00 pm there was another changeover of personnel. Lay replaced Haynes as IMT
operations officer and Langridge relieved Sherry as incident controller. The IMT continued
to implement the strategy of isolation and containment. The problem ofthe identification of
pipes for isolation was further discussed between IMT and Esso management, but the same
policy was continued.

7.68 The bodies of Wilson and Lowery were removed at 5.20 pm on Saturday, 26 September by
the CFA with police assistance. By this time, safe access to the bodies was possible.
Although the last fire was not extinguished until late in the afternoon on Sunday, 27
September, it was felt that the adverse psychological impact which the presence of the
bodies might have had on Esso personnel, warranted their removal. At 6.15 pm on 26
September, the bodies were taken to the mortuary at the Institute of Forensic Science in
South Melbourne.

135
 Figure 7.17 Photograph taken at approximately 15:00, 26 September, fire still burning from
GP905

27 SEPTEMBER (SUNDAY)

7.69 The use of a crimping tool to isolate fuel sources was first discussed by the IMT and Esso
management at a meeting which commenced at 8.24 am on Sunday, 27 September 1998. At
this time Jones had relieved Langridge as incident controller. Full isolation of the inventory
feeding the fire still had not been achieved. There was a small, slow- burning fire still
emanating from a 50 mm gas supply line in the piperack. Various options were discussed at
the meeting and an Esso employee suggested pipe crimping as one option. Jones adopted
this suggestion and gave approval for the work to be done. The necessary equipment was
not on site and Esso engaged a contractor to do the work.

7.70 The police offered to transport the crimping tool to Longford, but Esso advised that it had
arranged for its transportation by the contractor and that it would be on site by lunchtime. It
did not arrive until 4.10 pm that afternoon. By 5.30 pm the 50 mm pipe was crimped and
the last fire was extinguished. A 40 mm pipe was also crimped because it had a minor gas
leak. Gas detectors were placed around the ROD/ROF area to determine whether there any
residual leaks. By 8.10 pm it was established that all leaks had been stopped.

136
 FIREFIGHTING SYSTEMS

7.71 The emergency protective systems in place at Longford at the time of the accident which
were designed to control such an event included the Emergency Shut Down system (ESD-
system), the firewater system and passive fire protection of the supports to the overhead
piping. The ESD system is discussed in Chapter 8.

7.72 The water supply to the fire ring main at Longford consisted ofthree groundwater bores (or
wells) from which water was pumped to five storage tanks on the site. These tanks when
90% full had a capacity of 6,296 k:l. Bore pumps were used to fill the tanks. There were
three electric pumps and three backup diesel pumps. There was also a dam at the southern
end of the plant, known as the south pond, which could be used if necessary as an additional
source of water.

7.73 The water from the tanks was fed into a fire mains system which ran underground
throughout the entire Longford site. Bearing in mind that the various plants at the Longford
site were designed and constructed over a period of 14-15 years, the firewater system was
well integrated between the various plants at the site. The fire ring main was pressurised by
a total of eight pumps. Four pumps were electrically driven and four pumps were driven by
diesel motors as a backup should the electricity fail. The fire ring main supplied risers or
hydrants in the plant to which hoses could be attached to take water from the mains. In
addition, there were fixed and portable monitors with a 360 degree rotation that could be
used to direct water at a fire. The fire ring main also supplied the fixed water deluge system
on the LPG accumulators located within GPl. The fire mains system was designed with the
capacity to supply water to the deluge system on the LPG accumulators and to use five or
six monitors to fight a fire at the same time.

INJURIES

7.74 The explosions and fire at Longford not only caused two fatalities, but also injured eight
other workers who were in the vicinity of the accident. Heath Brew was the most severely
injured in the blast. He was admitted to the Alfred Hospital Bums Unit in Melbourne with
severe bums to his head, face, chest and legs. He also suffered a fractured femur. Ian
Kennedy was admitted to the Royal Eye and Ear Hospital with eye and ear injuries and
bums to the face. He was released on 28 September. Greg Foster suffered fractured ribs,
smoke inhalation, bums and abrasions and was released from Gippsland Base Hospital on
28 September. Mike Shepard and John Wheeler suffered bums and abrasions and were
released from hospital on 26 September. Jim Ward, Bill Visser and Marty Fahy were all
treated for distress and smoke inhalation and sent home on 26 September.

137
 Chapter 8
THE LOSS OF GAS SUPPLY

THE SHUTTING DOWN OF ALL GAS PRODUCTION FACILITIES

8.1 The explosion and fire in GPl at 12.26 pm and the subsequent activation ofESDl closed the
inlet gas valves to the slugcatchers, thus isolating the supply of gas to all three gas plants.
The offshore platforms were shut down automatically following the ESD activation.
Requests from the platform operators to go into bypass mode to allow them to keep the
machinery on line were refused because ofthe situation in GPl.

8.2 As stated in Chapter 7, at about 12.45 pm, the escalation of the fire in GPl brought about a
decision to withdraw all non-firefighting personnel from the Longford site, and GP2 and
GP3 were shut down.

THE RELATIONSHIP AND INTERCONNECTION OF PROCESSING

FACILITIES

8.3 To understand the problem of isolating the gas and liquid fuels which continued to feed the
fire in GPl for some 53 hours after the initial rupture of GP905, and the time needed to
isolate GP2 and GP3 effectively from GPl and the CSP before the undamaged gas plants
could be safely restarted, it is necessary to examine the relationship and interconnection of
all the processing facilities at Longford.

8.4 GPl and the CSP were constructed during 1968 and 1969, with GPl commissioned in
March 1969 and the CSP later in the same year. The design of GPl was commenced by
Hudson Engineering before the discovery of oil in Bass Strait. Before that design was
complete, Halibut Field was discovered and Hudson Engineering was then contracted to
integrate the design of the two processes. This was achieved in the following way. The gas
produced during the stabilisation of oil in the CSP was to be compressed and delivered to
GPl for processing. The gas liquids produced in GPl were to be stabilised in the Product
Debutanisers of the CSP prior to dispatch to Long Island Point. Separate but linked propane
systems, power gas systems, flare systems and electrical systems allowed one plant to back
up the other in the event of an outage of these services in any one plant. A single control
room housed the control systems for both plants.

139
8.5 The design ofGPl had to take account of the role of that plant as the sole supplier of natural
gas to Victoria at that time. Consequently, a good deal of duplication of vital equipment
was provided to ensure security of supply. This allowed pressure vessel inspection and
other maintenance tasks to be performed without shutdown of GP 1.

8.6 When GP2 was constructed between 1974 and 1976 it was located 275 metres (900 ft) to the
east of GP 1, thus providing security in the event of a major incident in either facility.

8.7 GP2 uses an expander process for cryogenic removal of liquids from the gas stream and
therefore is quite different to GPl in many respects. However, it also has a number of
common functions with GPl which were interconnected to enhance security of gas supply.

8.8 Both plants use molecular sieves for dehydrating and sweetening the inlet gas (i.e. removing
the sulphur compounds) and these were interconnected. These molecular sieves also have
similar regeneration circuits which are interconnected to provide back up to each other.

8.9 Both plants also have a section for processing the hydrocarbon liquid stream entering the
plant from the slugcatchers. The Crude De-ethaniser GP1106B in GPl and the Feed Liquid
Stripper GTll 02 in GP2 both serve this function and are cross connected to provide backup
for each other.

8.10 Similarly the Product Debutaniser GT1113 m GP2 and the two Product Debutanisers
CS1112A and B in the CSP (physically located in GPl) are interconnected for enhanced
operating security.

8.11 In addition, both GPl and GP2 require the CSP to be in operation to enable the bottom
product from the debutanisers to be blended into the main stream of stabilised crude oil from
the CSP and pumped to Long Island Point by the four crude shipping pumps.

8.12 GP2 is independent of GPl for all critical activities and services, but does rely on the KVR
compressors in GP 1 to compress the small quantity of low pressure gas from the overhead
ofthe Feed Liquid Stripper, GT1102. When this service is not available, this vapour stream
has to be flared, as was done after the restart of GP2 on 4 October 1998 until the
recompressors were brought back into service when the CSP was restarted in December
1998. All other facilities and services, including the control rooms of GPl and GP2, are
independent of each other to ensure reliability.

8.13 Because the expander process used in GP2 could more efficiently recover ethane from the
hydrocarbon condensate than the lean oil process in GP 1, a transfer line was installed in the

140
 early 1990s to enable the transfer of condensate from the GPl absorbers to the GP2
Demethaniser.

8.14 GP3 was constructed during the period 1980 to 1983 and commissioned in February 1983.
It is built adjacent to GP2 and shares the same control room. Like GP2, GP3 uses an
expander process for the cryogenic recovery of gas liquids.

8.15 The interconnections between GP2 and GP3 are limited to a shared regeneration gas system
(which is situated in GP3) and shared gas liquid processing facilities, the Feed Liquid
Stripper Gill 02 and Product Debutaniser GTll12, both of which are in GP2.

8.16 Thus, GP2 and GP3 have some interdependency but GP3 does not depend on GPl for any
services nor does GPl depend on GP3 for any services.

8.17 There are a number of other connections to common facilities and utilities which complicate
the complete isolation of any one gas plant quite considerably. These include:

Connections to the Slugcatchers. All three gas plants take their feed from the
common header at the northern end of the slugcatcher barrels. Valves enable
individual plants to be isolated for routine purposes, but extra isolation is required for
long term shutdown of a plant.

Connections to Slugcatcher Liquids. GPl and GP2 each have a connection to the
base of the slugcatchers to allow processing of hydrocarbon liquids from that source.
There is also a direct connection to the CSP which required isolation after the
accident.

Slugcatcher Water Phase and Other Separator Dumps. The water/glycol phase at
the base of the slugcatchers is at high pressure and discharges into GP1117 which is
at atmospheric pressure. This vessel is known as the "boot" and also receives small
quantities of liquid dumped from the Inlet Separators of all three gas plants and some
compressor suction scrubbers in all four process units.

GPl and GP3 Startup Line to GPl. This allows the off-specification gas produced
during the chill down period of a startup of these plants to be reprocessed through
GP 1 to avoid flaring.

Treated Gas Tie. This allows sweet dehydrated gas (without sulphur compounds)
from the molecular sieve sections of each gas plant to be distributed to any other gas
plant

141
 KVR Vapours to GP2 and GP3. GPl is the plant in which KVR gas is normally
processed but that stream can be diverted to GP2 or GP3 if necessary.

Utilities (Electricity, power gas for ESD valves, instrument air, water and
propane refrigerant). Each gas plant is self-sufficient in the provision of these
utilities, but for security of supply and efficient operation they are also
interconnected. Longford plant generates its own electric power and exports up to
lOMW to Eastern Energy. If the Longford generators shut down, power flow is
instantly reversed and the plant is supplied from Eastern Energy.

Flare System. GP2 and GP3 have independent process flare systems, neither of
which is connected to GPl or the CSP. They are also independently connected to the
Longford massive flare system which is capable of disposing of the total inlet gas
flow. They were disconnected after the accident in September.

Stabilised Crude Fraction to CSP. The bottom product from the Product
Debutaniser in GP2 (GT1113) has to be transferred to the CSP for blending with
stabilised crude oil. The line which carries this product was fire damaged and an
alternative line, the "black snake", was built at ground level to allow GP2 and GP3 to
restart. Testing of the damaged line indicated that it was still serviceable so there are
now two available routes for debutaniser bottom product from GP2 to the CSP.

8.18 Because GPI and the CSP were designed and constructed together, they are intimately
linked and share many interconnections and common systems. The principal ones are:

The Control Room. Although the process control instrumentation for the two plants
is separate, the control room services such as power supply, air conditioning, and
communication facilities are common.

Propane Refrigeration System. The two plants share a common propane

refrigeration system. If the KVR compressors, which provide refrigeration for GPl,
shut down, the turbo compressors of the CSP continue to supply some refrigeration to
GP 1, enabling it to produce specification gas.

Product Debutanisers. The Product Debutanisers CS1112A and B serve both

plants. The bottom product from the Condensate De-ethaniser GP1106A, and the
overhead product from the ROF are both fed to the debutanisers as are the bottom
streams from the two CSP De-ethanisers CS 1110 and CC 111 0. In addition, the GP2
and GP3 demethaniser bottom stream and GP2 Feed Liquid Stripper bottoms can be

142
directed to the Product Debutanisers, allowing the debutaniser in GP2 to be taken out
of service without shutting down those plants. Geographically, the Product
Debutanisers are located on the southern area of GP I.

Raw LPG Storage and Pumping. The LPG produced from the overhead of the CSP
Product Debutanisers is condensed in propane chillers and then transferred to raw
LPG storage vessels (LPG accumulators) before being pumped to Long Island Point.
These vessels are in the south-eastern sector of GPI, as are the LPG pumps which
deliver to Long Island Point. In an emergency situation, LPG can be re-injected into
the Barracouta gas reservoir using LPG injection pumps installed in GPI. A
dedicated line is available for this purpose. An interconnection is also provided
between the GP2 LPG accumulators, GPI and the CSP accumulators. This is to
enable LPG from GP2 and GP3 also to be directed to storage in the Barracouta field if
required.

Vapour Recompression Facilities. The stabilisation of crude oil in the CSP

produces a gas stream which contains a significant proportion of LPG and crude oil
fractions, as well as hydrogen sulphide and water vapour. This stream contains more
heavy hydrocarbon components than the raw inlet gas stream from offshore. Several
low pressure gas streams are produced in GPl and GP2 during the processing of
slugcatcher condensate (called crude) and raw gas. In GP I, these streams originate
from the Crude and Condensate De-ethanisers GPII 06A and B, Crude and
Condensate Flash Tanks GP1105A and B, Rich Oil Flash Tank, GPI108 and Oil
Saturator Tank GPlllO. In GP2, the Feed Liquid Stripper, GT1102, produces such
an overhead gas stream. All of these streams contain valuable LPG components and
some contain crude oil fractions as well as hydrogen sulphide and water vapour.
These low-pressure gas streams are combined as feed to the GPl vapour
recompressors, consisting of two large reciprocating compressors, one smaller
reciprocating compressor (KVSR) and two centrifugal compressors, all in parallel.
The two large reciprocating compressors GP30 1B and C are Ingersoll Rand KVR
units and give their name to the recompressed gas stream which is known at Longford
as KVR gas. KVR gas can be directed to GP2 and GP3, but it is preferably processed
in GPl because of its higher temperature and richer composition than raw inlet gas.
These characteristics are better suited to the lean oil absorption process than the
cryogenic process used in GP2 and GP3.

143
 Power, Utilities, Flare and Drain Systems. There are numerous interconnections
between GP 1 and the CSP with respect to electrical power, fuel gas, power gas, water
supply, instrument air and flare systems. The flare and draining systems have also
been interconnected.

8.19 GPl and the CSP can operate independently as illustrated by the restart of the CSP in
December 1998 with GPI remaining shut down. However, before the accident, a number of
the interconnections were being regularly used to enhance the reliability of the gas supply
and crude oil production.

8.20 The interconnections between the processing units at Longford together with the policy of
providing built-in spare equipment has proved successful in maintaining a secure supply of
sales gas for Victoria for almost 30 years. The ability to transfer services and intermediate
products between processing units has enabled gas production to be maintained despite
equipment failures and maintenance requirements.

8.21 Unfortunately, however, these features complicated the process of extinguishing the fire in
September 1998 and extended the time required to make the isolations necessary to allow
GP2 and GP3 to be safely restarted after the fire was extinguished.

THE ISOLATIONS NEEDED TO EXTINGUISH THE FIRE

8.22 The ESD system was designed to close a number of battery limit valves (known as ESD
valves) on the pipelines from the offshore platforms which fed the Longford plants as well
as on the Sales Gas line, the LPG line and crude oil line to Long Island Point. There were
various stations located in and around GPI from which the ESD system could be activated.
The most prominent station was outside the door of the GPl!CSP control room building.
Once activated, these valves prevented further gas or oil from entering the Longford plants.

8.23 The ESD system was designed to shut down certain equipment in GPI including the
GP502A and B reboiler heaters, the GPSOlA and B reboilers, the AXS02A and B
Regeneration Gas heaters, the GP1201 A, B and C pumps and the GP1204 A, B and C
pumps. It was also designed to close ESD valves on the regeneration gas inlet to AXS02A
and B and the ESD valves in the suction lines to Hot Oil Heater Pumps AX1201A and B,
and to shut off the fuel source to the hot oil heater, AXSO 1.

8.24 On 25 September the ESD system operated as designed. In this way, the activation of ESDI
immediately after the rupture of GP905, effectively isolated GPl from all major external
sources of fuel. This included the isolation of the slugcatchers from the offshore pipeline

144
 system and the isolation ofGPl from the slugcatchers themselves. It also isolated GPl from
the outgoing sales gas system ensuring no feedback of fuel from that source. ESD 1 also
closed the condensate line from the slugcatchers to the hydrocyclones, shutting off feed to
the crude de-ethaniser system. The overhead vapour from the Inlet Liquid Stripper in GP2
was also shut off.

8.25 Within GPl itself, all ofthe main process pumps were automatically shut down as were the
LPG Booster Pumps and the Gas Lift Compressor, which despatched processed gas to the
Perch/Dolphin wells to assist oil production. The Lean Oil Reclaimer and the equipment for
sweetening and drying the regeneration gas for the molecular sieves were isolated and their
pumping systems shutdown. The activation of ESD 1 automatically activated ESD2, which
tripped all the fired heaters, shutting off both fuel supply to the burners and the process flow
through the heaters. The associated process pumps were also tripped electrically.

8.26 ESD3 was also automatically activated by ESD 1, tripping the KVR compressors. The
suction and delivery valves on the compressors were automatically closed, both on the gas
lines and on the propane refrigerant lines. The KVR compressors compress both of these
gas streams.

8.27 At about 12.50 pm, the CSP was shut down by the activation of ESD-Sl. This also
activated ESD-S2 and ESD-S3, isolating all inlet and outlet streams from the CSP and
shutting down all fired heaters and electric motor drives within the plant.

8.28 In his evidence, Cumming said that he swung all the handles on the GPl ESD system with
the exception of the generators. This would have activated ESD-lA and ESD-lB, which
were not activated by Ward. The ESD-lA and lB system closed valves on the inlet and
outlet gas lines on the absorbers and opened a crossover from the treated gas line into the
residue gas line. If required, this would have allowed treated gas to be fed into the sales gas
line. It should be observed that the generators eventually shut down although the cause and
timing are unknown. One consequence was the failure of the electric fire pumps.

8.29 The isolations made by the ESD systems were generally effective, although there was
leakage through some valves which ultimately had to be sealed off by other means.
However, the inventory in the ROD!ROF system was not isolated within the major vessels
by any ESD valves and the contents of the ROF were ultimately fed back into the base ofthe
ROD and out to the fire, probably through the leaking tubes in GP922 and the LC10 valve.

8.30 The series of explosions which occurred in the first hour and a quarter following the rupture
of GP905 were caused by the failure of pipes on the piperack because of flame

145
 impingement. Even though many of these pipes were isolated at both ends by closed valves,
the inventory of gas or liquid trapped in the lines was discharged into the fire, increasing its
size and intensity. A reconnaissance of the fire area by Esso and CFA personnel at about
3.40 pm indicated that the fire was still out of control, but the size of the fire emanating from
the ruptured end ofGP905 showed that the bulk of the lean oil had by then been burnt.

8.31 Manual isolations of all the interconnections between the CSP and GPl were carried out,
commencing at 4.00 pm. The CSP gas off-take system to the KVR compressors and several
other liquid and vapour lines were closed off. Within 15 to 20 minutes, the fires reduced to
less than half their previous intensity.

8.32 At approximately 5.00 pm, the liquid dump lines from the KVR scrubbers were blocked in,
as was the LPG tie between GP2 and GPI which was thought to be leaking. Further
isolations were made on both absorber bottoms, Rich Oil Flash Tank vapours and Oil
Saturator Tank vapours, all of which were thought to be feeding the fire through failed
pipes.

8.33 At 6.40 pm a fresh team of shift members undertook the depressuring of the section of plant
upstream from the absorbers, which had gas trapped in it, by the closing of several ESD
valves when Cumming actuated ESD-lA and lB.

8.34 At 6.50 pm the gas valve on the tie between GPl and GP2 was manually closed, after which
all personnel were withdrawn from the fire scene back to the fire shed prior to shift change.

8.35 Isolation checks continued, using the night shift personnel who arrived at 7.00 pm. By this
time the fire was largely under control. The main concern was a fire on the level transmitter
on the Condensate Flash Tank, GP1105A, which was impinging on the vessel's pressure
control bypass line. It had started leaking. It was decided to flare the gas from both de~

ethaniser systems and the KVR suction line from them. This was completed without
incident and the depressuring resolved the problem of the fire on GP1105A.

8.36 Extinguishing the remaining fires involved identifying smaller damaged lines, sealing minor
leaks at isolating valves and isolating leaks from the ruptured flare system. The flare system
was not fitted with any valves because of its critical function in the disposal of vented gas.
It was ultimately the nuisance fires on the damaged flare lines which proved difficult to
isolate and these eventually had to be mechanically crimped to extinguish the fire
completely.

146
8.37 Damage to the GPl control room by acid fumes emanating from burnt pvc insulation
required the establishment of a new control room. This, together with other modifications
made necessary by the damage to services in the Kings Cross area, delayed the restart of the
CSP until early December with a consequent interruption to production of crude oil.

OBSERVATIONS

8.38 From the evidence set out in Chapter 7 and from the modelling undertaken by the
Commission's investigation team the following matters are apparent.

8.39 At the time GP905 failed, 22,000 kilograms (22 tonnes) of hydrocarbons were contained
within GP 1. Within a minute of the rupture of GP905, up to 10,000 kilograms (1 0 tonnes)
of hydrocarbons were released to atmosphere through the rupture area. Another 12,000
kilograms (12 tonnes) ofhydrocarbons were still contained within GPl.

8.40 Depending upon the rate at which inventory was being released through the aperture of
GP905, 12,000 kilograms of hydrocarbons was sufficient to fuel ajet fire from GP905 and
GP922 for up to two hours following the initial release, indicating that the fire was
ultimately fed from sources outside GP 1.

8.41 Within 30 minutes of the rupture of GP905, the jet fire emanating from that vessel and
GP922 had impinged sufficiently on the piping in the east/west piperack to cause some of
those pipes to fail. The failure of these pipes released new sources of inventory to
atmosphere. This increased both the number and location of fires that had to be contained,
complicating the task of those responding to the emergency.

8.42 The first of the major pipe ruptures in the east/west piperack occurred at about 1.00 pm and
resulted in the explosion recorded by the security video camera (see Figure 7.2 to Figure
7.4).

8.43 Further explosions occurred at about 1.26 pm and 1.35 pm. These explosions, also clearly
recorded by the security video camera (Figure 7.5 and Figure 7.6 to Figure 7.10
respectively), were the consequence of continuing ruptures of pipes in the east/west
piperack. The failure of these pipes provided further sources of fuel mainly from the CSP.

8.44 The dramatic increase in the size of the hydrocarbon-fuelled fires and the intensity of the
heat from those fires made the failure of further pipes inevitable, despite the efforts of
operations personnel to cool the pipemck by directing water from firefighting appliances
into the area.

147
8.45 The ESD system was activated by Ward immediately after the initial explosion. Cumming
also attempted to activate the ESD system. Once that had been done, the only feasible
option available to personnel fighting the fire, was to endeavour to isolate the fuel sources to
the fire and to use the available water from firefighting appliances to cool the pipes and
vessels most exposed to the flames and heat.

8.46 The immediate action taken by the operations personnel (Visser, Cumming and others) to set
up and direct ground monitors was therefore appropriate. The escalation of the fire that
subsequently occurred was not due to any failure by them to act in an appropriate manner
but rather to the design limitations of the ESD system in GPl.

8.47 Although there was no formal identification of the Incident Response Group designated by
the Esso Emergency Response Manual, those personnel available in GPl at the time of the
accident performed the functions of such a group. Their attempts to isolate the plant, rescue
the injured and initiate fire suppression measures were not only wholly appropriate but, in
view of the personal danger which they faced, also heroic.

8.48 The death of Peter Wilson temporarily left the Incident Response Group without leadership.
However, Hiskins quickly took over this role, with Visser in the role offorward controller.

8.49 There was an unnecessary delay between the occurrence of the fire and the time that the
CFA were first notified. Moreover, it appears that when the CFA did arrive at Longford,
security staff at the entrance gate were not sufficiently cognisant of the importance of
ensuring that CFA personnel were granted immediate access to the site. This lack of
understanding reflected a shortcoming in communications between Esso plant management
and security staff. It also highlighted a shortcoming in security staff training in emergency
response procedures. Most importantly, it contributed to an unnecessary, albeit temporary,
breakdown in communications between Esso personnel and CFA personnel. In a serious
accident, such as occurred on 25 September 1998, time lost can sometimes be measured in
lives or serious injuries. Fortunately, on that day, it appears that these matters did not
seriously hamper or delay the suppression of the fire.

&.so The ESD system in GP 1 was designed only to isolate the Longford plant from the major
offshore pipelines, and the feed to the gas transmission line. It did not activate any isolation
valves, apart from a valve on the dehydrators, within GP 1. The consequence was that the
entire volume of hydrocarbons contained within GPl vessels and interconnecting piping
existed as an uncontrolled source of fuel for the fires emanating from GP905 and GP922. In
particular, the large inventory oflean oil in the ROF was not isolated by the operation of the

148
 ESD system. There were automatic isolation valves on the suction lines to each of the
GP1204 pumps, but these were only activated by the failure of the pump seals and not by the
ESD system. This weakness was recognised by a 1994 Periodic Risk Assessment (PRA) of
GP1, but it appears that no action was taken to correct the situation.

8.51 Another of the areas of criticisms set out in the 1994 PRA conducted for GP 1, concerned the
general status of the ESD system. In particular, the PRA stated that the ESD system was not
well documented or disseminated and depended for its integrity almost entirely upon human
action. The PRA recommended that the ESD system be considered in the forthcoming
HAZOP for GP1 which was to take place in the following year (but which did not
eventuate). Moreover, during a 1995 HAZOP of the CSP, the HAZOP team experienced
difficulty in obtaining a clear understanding of the ESD system in that plant and made
criticisms of the ESD system similar to those made in the 1994 PRA of GP 1.

8.52 The design of the ESD reflected the standards of industry practice in the late 1960's and
early 1970's. However, an ESD system designed in accordance with common practice
today would have divided GP 1 into sections based upon major inventory groupings and
would have provided shut down valves for each of these sections. Even a modern ESD
system would not, however, have prevented the initial release of 10,000 kilograms of
hydrocarbons that immediately followed the rupture of the GP905 exchanger.

8.53 Modern design would almost certainly require a critical pipeline junction such as Kings
Cross, to be assessed and analysed for risk associated with fire and explosion damage to
pipes such as occurred in the ROD!ROF area. Isolation and depressurisation systems would
also be required to minimise the risk of an accident such as occurred on 25 September 1998.

8.54 Had the supply of flammable materials been isolated within minutes after GP905 ruptured, it
is unlikely that any of the pipes in the piperacks would have failed as they did. Once some
of the major pipes in the Kings Cross piperacks failed, additional sources of material were
available from outside GPI to fuel the fire. The availability ofthese further sources to fuel
the fire completely changed the dimension and scale of the accident. Apart from
complicating the task of making the necessary isolations, it generally increased the size and
intensity of the fire and thus the dangers to operations and firefighting personnel. It also
generally increased the likelihood of damage occurring which was serious enough to
threaten the integrity of GPl. Moreover, the location of the east/west piperack and the
nature of its pipeline inventories made it almost inevitable that damage which threatened
GP1 would also threaten interconnections between GP2, GP3 and the CSP thus threatening
the whole ofVictoria's supply of natural gas.

149
8.55 The lack of a pre-planned set of isolations for GP 1 meant that pipe and vessel isolations had
to be conducted on the run and then tested in a highly dangerous environment. The difficult
task of developing the necessary isolation plans took valuable time. It also took time to
verify the plans by testing them in the field, before isolations could be finally effected. The
time taken to carry out this work was the primary reason why it took days rather than hours
to extinguish the fire.

150
 Chapter 9
THE RESTART

COMMENCEMENT OF TASK

9.1 The task of restarting GP2 and GP3 commenced on Friday, 25 September 1998 with the
deployment of experienced personnel from Esso's Melbourne office to form a gas restart
team. This team was assigned the responsibility of developing plans for the restart of gas
supplies. A number of Longford personnel were added to the team together with other
experienced Esso engineering personnel who were requested to report to Longford on the
morning of Saturday, 26 September.

9.2 Esso senior management recognised that the resources needed for the gas restart activities
were beyond those available within Esso. Arrangements were made to recall experienced
former Esso personnel from overseas assignments and to obtain the assistance of
experienced employees from other Esso affiliates outside Australia. Most of these people
arrived in Australia within 3 days and were deployed to Longford.

ISOLATION FROM GPJ

9.3 By the early hours of Saturday 26 September, the gas restart team had concluded that the
isolation of the slugcatchers and GP2 and GP3 from GPl would provide the fastest method
of initiating a restart and had identified the steps needed to do this. These were:

• isolate GPl from the slugcatchers' flare relief system. Although the slugcatchers have a
separate pressure relief header from that of GPI, GP2 or GP3, it is normally connected
to the GP 1/CSP flare and burn pit system. As a consequence, the gas restart team
determined that valves would need to be manipulated to facilitate the segregation of the
slugcatchers' flare relief system from GPl. The GPl flare system needed to be directed
to the standby GPI high pressure flare stack. It was recognised that scaffolding would
be required to gain access to some valves.

• isolate GPl/CSP from the boot system. Many slugcatcher, GPI I CSP and GP2 and GP3
drains and/or separator and scrubber dumps discharge to the boot. As it was not known
whether the GP I lines entering the boot system had been damaged in the accident, plans
were established to isolate these lines from the boot.

151
 • re-establish GP2 and GP3 power gas supply. High-pressure power gas is required for
operation of the ESD valves in GP2, GP3 and the slugcatcher area. Following the total
gas plant shutdown of the Longford plants, power gas could be obtained by backflow
from the Transmission Pipelines Australia Pty Ltd (TPA) pipeline. As the pipeline
pressure had declined and could not be guaranteed at that time, work was initiated to
install a backup supply of high pressure power gas, using several nitrogen cylinders at
each valve.

• supplement electrical power supply to GP2. Although GP2 had enough electrical power
available from Eastern Energy to supply the control room, Longford was not supplied
from that source with sufficient power to operate an entire plant such as GP2. The GP2
generators would normally operate using plant fuel gas, and power supply from Eastern
Energy would not be required. However after a total plant shutdown fuel gas would
have to backflow from the TP A pipeline and this could not be assured. Therefore
additional power was required and approval from Eastern Energy to connect to its grid
was sought and gained late on Saturday evening.

9.4 The gas restart team set up an isolation team to identity all of the isolation points that would
be required to effect a safe restart. This was a complex task which involved an intimate
knowledge of the plant and a detailed examination of the P&IDs for all four production
units. Over a period of a week this resulted in the marking up of some 200 P&IDs showing
where isolations were needed. This information was also tabulated, with a description of the
service to be isolated, the valve involved, the type of isolation required and the person
required to check the isolation when complete. A tag number was used to identity each
isolation and this number was shown on both the relevant P&IDs and the tabulation. The
tabulation for GP1 isolations to GP2 and GP3, which is shown in Appendix 2, lists
93 valves, several of which were required to be reopened, having been shut during the initial
isolation of GP 1. This left 85 isolations to be completed in order to fully isolate GP 1.

Table 9.1 Summary oflsolations

Isolation Area Number of

Isolations
GP! Isolations to GP2 and GP3 85
CSP Fuel Gas and Power Gas Isolations 72
4
82
19
7
269

152
9.5 A number of electrical isolations were also needed, although most of the electrical circuits in
GP I could be isolated by opening circuit breakers on main distribution boards.

DEVELOPMENT OF A PLAN

9.6 By Saturday, 26 September, the gas restart team had proposed a preliminary plan to bring
back into service the molecular sieves and associated equipment in GP2. This would enable
rich gas (dehydrated and desulphurised, but still containing ethane, propane and heavier
components) to be delivered to Gascor to satisfy its request for the provision of rich gas as
soon as possible.

9.7 Under this proposal, the condensate arriving with the raw gas at the slugcatchers would be
dumped to the slugcatcher Condensate Vapour Disengagement Drum SC1103, from where
the vapour would be flared and the liquid sent to the burn pit. As this would result in the
production of an unacceptable amount of black smoke, the team was requested to investigate
other options.

9.8 By Saturday evening, the gas restart team had developed a plan for a full restart of GP2 and
GP3 to produce specification gas and to despatch both LPG and stabilised hydrocarbon
liquids to Long Island Point. Existing equipment enabled LPG to be pumped from GP2 to
Long Island Point, but the disposal of the stabilised liquid from the bottom of the
Debutaniser to the crude oil pipeline to Long Island Point required special attention.

9.9 The existing transfer line from GP2 to the CSP for the GP2 debutaniser bottoms stream
passed through the southern part ofGPl (not Kings Cross) and had been found to be at least
superficially damaged by the fire. As the integrity of this pipeline was in question, the black
snake was proposed. This has been referred to in Chapter 8. Design work commenced on
this black snake pipeline on Sunday 27 September. Materials and equipment were quickly
found and detailed design rapidly progressed. Arrangements were made to install on the
pipeline a pump purchased for an offshore project to boost the pressure and thus increase the
flow rate of debutanised liquid into the Long Island Point crude oil line. As an alternative,
work also began on the design of pipework to allow the CSP C-train de-ethaniser reflux
pumps to be used to boost the GP2 debutaniser bottoms product into the crude pipeline.

9.10 To reduce the amount of condensate to be handled at Longford, a decision was made to use
Barracouta gas in preference to Marlin gas. Of the three gas sources, that of Marlin is the
richest in heavier components and produces the most condensate. When Barracouta's
capacity was exceeded, Snapper gas was to be used. The predicted gas demand for October
would normally not require all three platforms to be producing.

153
9.11 In addition, approval was granted by the Department of Natural Resources and Energy to re-
inject separated gas liquids from the Snapper platform back into the reservoir. Facilities
exist on the platform to do this.

PLANNED RESTART DATE

9.12 On Monday, 28 September, a meeting was held between the Premier of Victoria and Esso's
chairman and managing director, Robert Olsen, together with senior government and Esso
officials. It was agreed at this meeting that disposal of condensate to the burn pits would not
be undertaken. It was also decided to plan a restart for Monday, 5 October to allow for any
unforeseen restart problems.

CONTINUATION OF BLACK SNAKE

9.13 Whilst the black snake was being constructed, work was undertaken to confirm the integrity
of the original debutaniser bottoms line. Plans were developed to pressure test the line with
water at a pressure of 1850 kPa. By this time the isolation team had identified that an
additional 82 isolations were required to isolate completely the line from the CSP I GPl
process areas.

9.14 It was also realised that prior to recommencing processing operations at Longford it was
necessary for the fire water system of GPl to be serviceable. Several fusible plugs which
activated the deluge system on the LPG accumulators had melted during the fire in
accordance with their design intent and had to be replaced.

9.15 By Tuesday 29 September, most isolations between GP2 and GPl were completed, although
those on the debutaniser bottoms line remained to be done. The completion of the black
snake was all that was required to allow GP2 to restart.

9.16 A surveillance plan was established for the Longford site during the initial pressurisation
and startup of GP2. This was to enable double-checking of all isolations between GPl, GP2
and GP3 and the allocation of staff to cover all interconnections.

9.17 The original debutaniser bottoms line was tested and no external leaks were observed, but a
confirmation test was planned for the following morning.

REVIEW AND APPROVAL

9.18 On Wednesday, 30 September, Gascor was notified of the planned introduction of gas to
GP2 for testing purposes. The Victorian WorkCover Authority (VWA) and the CFA
indicated that approval to restart GP2 and GP3 under s.33(2) of the Dangerous Goods Act

154
 would be subject to formal review under the Longford Gas Restart Plan which was
scheduled for that day.

9.19 The planned review took place as scheduled on Wednesday at Longford and a review was
also conducted by the Crisis Management Team in Melbourne. A letter was then forwarded
to VWA giving Esso's assurance that GP2 and GP3 were safe to operate and requesting
VWA approval for the restart.

9.20 Also on Wednesday, a programme of Critical Function Testing was established and testing
was initiated within GP2. The connection of the black snake into the debutaniser bottoms
line at the point where that line entered GP I was carried out during the day, but this required
the planned leak test on the debutaniser bottoms line to be deferred.

9.21 On Thursday, 1 October, notification was received from Gascor that the maximum amount
of off-specification gas that would be accepted into the sales gas pipeline at Longford was
3 Mm3• Consequently the GP2 cold section needed to be cooled down and producing
specification gas before Esso could begin producing significant quantities of sales gas.
Much of the off-specification gas produced during cool down of the plant would have to be
flared as the normal procedure of reprocessing this gas in GP 1 was, of course, not available.

9.22 The construction of the black snake continued on schedule and, in addition, bypass
pipework was installed around the Crude Shipping Pumps in the CSP to allow use of the
existing debutaniser bottoms line.

9.23 On Friday, 2 October, a minor setback occurred when non-destructive testing on the black
snake identified several welds that needed to be redone. However, this did not significantly
delay preparations for restart as a number of detailed plant and administrative matters
required finalisation.

9.24 The debutaniser bottoms line pressure safety valves (PSVs) were reset from 1467 kPa to
1850 kPa, the maximum allowable line rating, to allow the line to be operated at the higher
pressure necessary to enable liquid to flow to Long Island Point without any pumping.
Lower pressure-rated equipment connected to the line was also isolated.

9.25 A procedure for using Eastern Energy power to initiate the restart of GP2 prior to fuel gas
being available for its own power generator and a procedure for the restart of GP2 after the
total shutdown were approved by Longford management. Upon the final completion of the
items contained in the prestart up checklist, Esso management formally approved the
Longford Restart Plan.

155
 THE RESTART

9.26 The VWA gave its approval to restart GP2 and GP3 under s.33(2) ofthe Dangerous Goods
Act. A letter was also received from VENCorp formally asking for confirmation of the
reliability of gas supply before it commenced the reconnection of customers.

9.27 A letter from Esso was delivered to Gascor explaining the restart plans and requesting a
sales gas rate into the meter station at Longford of at least 3 Mm3/d. This was needed to
ensure that the demand for gas from the Victorian system be increased in step with the
deliveries of gas available from GP2 in order to achieve stable plant operating conditions.

9.28 With VWA and management approval for a restart having been given, it was decided to
undertake a test restart of GP2 to confirm its operability and verity its isolation from GPI I
CSP. Pressuring up began about 3.00 pm on Friday, 2 October and start-up proceeded
steadily until 7.00 pm when the GPl surveillance operator smelt gas in the area and thought
he observed electrical arcing from some exposed cables at Kings Cross. The test was
stopped by Longford management.

9.29 On Saturday, 3 October, an infra-red thermographic survey failed to find any evidence of
electric arcing or other electrical isolation problems. The gas smell was traced to a small
leak from a fire-damaged propane cylinder in the GP 1 analyser hut.

9.30 As the black snake was now complete, all the prerequisites for the restart of GP2 had been
met and the pressurisation of the plant was recommenced at 3.45 pm. The outlet to the TPA
line was opened and pressure equalised but no flow occurred at this stage. The cool down
progressed through the night ready for sales on Sunday, 4 October, with off-specification
gas being flared.

COMMENCEMENT OF GAS SALES

9.31 By 2.00 pm on Sunday, 4 October, GP2 was ready to supply specification-quality sales gas.
Gas sales commenced at around 2.45 pm. The Gascor sales gas chart for gas days 4 October
to 6 October 1998 is shown in Figure 9.1. The gas day starts and finishes at 9.00 am, which
is almost universal practice in the natural gas industry.

156
 12 ~--------------------------------------------------------------.

10

Tulal Dcm~nd

ulcotim

8 8 8 ~ 8 g g 8 8 8 8 ? 8 8 8 8 g 8 8 ~ 8 8 g 8
s ,;; Vi 00
N 8 8 8 g ,;; Vi 0.
N 8 8 8 s ,;; Vi 00 ;::; 8 ~ 8 g
4 Oclober 6 Oc1ober
I 5 Oc1ober

Gas Osys
I
Figure 9.1 Gas sales for 4 October to 6 October 1998

9.32 At the time that gas sales commenced, the pressure in the TPA pipeline was about
4,600 kPa. This is shown on Figure 9.2, which is a chart of the outlet pressure at the
Longford Plant for the period 27 September to 11 October 1998. It can be seen from that
figure, that the pressure rose quite rapidly following the restart at GP2, increasing to
6000 kPa by 10.00 am on 5 October and reaching a plateau of 6600 kPa by 9.00 am on
3
6 October. During that time, plant output peaked at 6.25 Mm /d but for most of the time
was around 5 Mm3/d.

!000 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ,

2000

1000

Figure 9.2 Pipeline pressure for 2 7 September to 11 October

157
9.33 The black snake was put into service when the plant restarted on Sunday, 4 October. The
line was operated in free flow using the pressure in the GP2 Product Debutaniser to deliver
liquid, without pumping, to Long Island Point. However, a pump together with a portable
generator was installed to enable the liquid to be pumped if higher flow rates required it.

9.34 Monday, 5 October was the day on which the CF A relinquished its control of the Longford
site and Esso resumed formal control. On this day, GP2 continued to operate without
problems with sales of gas for the day restricted to five million cubic metres by the high
inlet pressure of the TPA pipeline. GP3 was started up and tested but it could not be kept
running as the demand for gas was too low to allow both GP2 and GP3 to operate.

9.35 On Tuesday, 6 October gas sales from Longford fell to 4 Mm 3/d and GP3 remained off-line
for lack of demand. VENCorp issued a press release advising that all industries and
businesses that were not already supplied with gas could start reconnecting to the gas system
at 6.00 am Wednesday, 7 October.

9.36 As a result of the additional reconnections, gas demand on Wednesday, 7 October rose to
6 Mm 3/d and GP3 was brought on line. Gas sales increased still further on Thursday with
domestic customers being progressively connected over a two day period. Sales into the
TPA line rose to 9 Mm 3/d and reached ll Mm 3/d on Friday. Domestic customers were still
prohibited from using space heaters.

9.37 The two plants continued to operate without major problems through the weekend and early
part ofthe following week. On Tuesday, 13 October the Premier of Victoria announced that
space heaters could be restarted. This restored the gas demand to the normal level for that
time of the year and by 14 October 1998, the interruption to supply of gas was effectively
over.

9.38 The restart of GP2 and GP3 was well managed by Esso. The work of isolating and
restarting GP2 and GP3 was carried out under the requirements of the LWMM. Not only
did the isolations between production units have to meet certain standards of safety, e.g.
double block valves or double block and bleed, but all the changes to operations made
necessary by these isolations had to be sanctioned by the Field Change Approval system.
Sixty-seven such approvals were drafted and sanctioned. New startup procedures had to be
drafted for both GP2 and GP3 to take account of changes made and new procedures had to
be produced for the use of the two Debutaniser Bottoms lines (old and new). HAZOP
studies were also carried out for these two lines.

158
9.39 One-off operating procedures were also drafted for GP2 rich gas to sales and for condensate
handling prior to export to Long Island Point. A plan was also produced for the relighting of
the flares and bum pit to which a number of connections had been changed.

9.40 Risk assessments were carried out on GPl because of the open pipes, stored hydrocarbon
inventory, asbestos damage and exposed electrical wiring. Assessments of structural
damage to the towers in GPl were undertaken.

9.41 The CFA also prepared a Longford Incident Action Plan for the restart period.

9.42 The changes to operating procedures and numerous organisational matters connected with
the restart required a considerable number of training and briefing sessions. The scheduling
of these sessions to fit in with the multitude of tasks being performed in the week prior to
restart was in itself a major problem.

9.43 The Longford Restart Plan, a 280 page document, was reviewed by the VWA, CF A and
Victoria Police at a meeting with Longford Plant Management. Copies of the document
were distributed to the external parties on 1 October. Esso Management formally approved
the plan on Friday 2 October.

9.44 The trouble free restart of GP2 and GP3 reflects the thorough manner in which safety,
technical, organisational and administrative matters were addressed. In view of the
complexity and magnitude of the task, it would not be reasonable for a safe and reliable
restart to have been made in any shorter period.

THE DELAY IN RESTORATION OF GAS TO CUSTOMERS AFTER

THE RESTART

9.45 It is unfortunate that after a successful restart of the Longford facilities, the full restoration
of gas supply to consumers, particularly domestic consumers, took another five days.

9.46 The stream of correspondence between Esso/BHP and VENCorp/Gascor reveals the reason
for the slow reconnection. Esso, understandably, was not able to guarantee that there would
be no production problems when bringing back into service two cryogenic processing plants
that had been closed down for eight days. The cold sections of these plants operate at about
-80°C and the very large temperature changes which they undergo during a long shutdown
and subsequent restart can lead to flange leakages and mechanical equipment problems.
These plants also operate more stably at rates near their maximum designed output.

159
 Operating them at low rates can therefore contribute to operating problems and reduce the
availability of the plant.

9.47 VENCorp, on the other hand, was understandably reluctant to advise the government to
raise the restrictions on gas use until continuity of supply could be assured. The task of
restoring supply to 1.4 million domestic consumers needed the assistance of numerous gas
fitters as a number of those consumers would require help in turning on supply and
relighting appliances. This was obviously not to be undertaken if there was a risk of
repetition because of a subsequent failure in gas supply.

9.48 For additional security, VENCorp also chose to continue the purchase of gas through the
interconnection with New South Wales during the first few days of the restart. This was at a
very low rate of less than 20 TJ/d and did not significantly impair the flow from Longford
into the TPA pipeline.

9.49 As the days passed and the reliability of the plant was demonstrated, VENCorp
progressively allowed the reconnection of more customers, culminating in the restoration of
supply to domestic customers on Thursday 8 and Friday 9 October. By that time Esso was
claiming that a plant capacity of 16 Mm3/d was attainable but was still not prepared to give
an unqualified guarantee of its continuous availability.

9.50 No doubt the slow increase in sales volumes was a disappointment to the Esso personnel
who had worked very effectively under considerable pressure to restore supply. In
retrospect, however, it seems that reconnection of domestic customers could not have been
advanced by even one day without a considerable risk, as time was needed to demonstrate
the reliability of the two plants.

RESTORATION OF SUPPLY FROM GPJ FOR WINTER 1999

9.51 Since the restart of GP2 and GP3, Esso/BHP have met their contractual commitments for
gas supply. However, those two production units have insufficient capacity in their restarted
condition to meet the winter gas demand. Esso therefore implemented an extensive work
programme intended to restore sufficient gas sales capacity from Longford by the end of
May to meet the rising seasonal demand.

9.52 The strategy adopted by Esso was to provide two parallel and independent execution paths
for GP1, GP2 and GP3 so that meeting the 1999 winter peak could be assured by either
execution path.

160
9.53 The restart of GPl consisted of a phased approach to allow an early increase in plant
availability which would be enhanced as the three distinct phases were completed. GP I was
not restarted as a lean oil absorption plant for the winter of 1999 and no plans have been
developed for its reinstatement in that form in the future. Instead the cold section of GP I
has been reinstated as a cold separation system and this should provide the required sales
gas capacity. The ability of the Longford plant to produce the required volume of ethane for
the petrochemical industry has not, however, been restored. This is because the
temperatures that can be used in the chillers and absorber vessels are not low enough to
condense a major portion of the ethane from the gas stream being processed. Even during
the winter period when gas volumes being processed are at a peak, ethane production is not
expected to exceed 550 t/d compared to an historic demand of 650 t/d. The discrepancy in
supply will increase to about 300 t/d in mid-summer.

9.54 The objective of the plant modifications in GP2 and GP3 was to install additional back-up
equipment capable of providing flexibility in the event of equipment failure in any of the
three gas processing plants.

9.55 At the time ofwriting this report, Esso's immediate objective of securing the gas supply for
winter 1999 appears to be in doubt. This is because industrial trouble has slowed the
restoration projects. However, for the longer term, Esso has identified projects and allocated
resources to begin addressing the issues of the restoration of full liquids recovery and future
upstream supply.

IMPROVEMENTS TO THE SECURITY OF GAS SUPPLY

9.56 Until the restoration of GP I provided additional capacity to process both gas and gas
liquids, the ongoing supply of gas depended on the ability of the GP2 and GP3 to deal with
the liquids that arrived in the slugcatchers or were extracted during the processing of the gas.
The building of the black snake provided a secure means of despatching debutaniser bottom
products to Long Island Point. An existing system allowed the mixed LPG product from
GP2 and GP3 to be pumped to Long Island Point, but the processing of the hydrocarbon
liquids from the slugcatchers after the accident on 25 September was limited to the Feed
Liquid Stripper in GP2.

9.57 As a consequence, in the fourth quarter of 1998, piping and pumping facilities were installed
to allow up to 2.1 Ml/d of slugcatcher condensate to be pumped to the Barracouta platform
for re-injection into the Barracouta formation. This process used an existing pipeline which
had been installed to allow LPG to be re-injected into Barracouta if Long Island Point was
unable to accept it.

161
 THE PHASED RESTORATION OF GPJ

9.58 The restoration ofGPl was planned to take place in three phases.

Phase 1

9.59 Phase 1 provided for the restart of the GPI inlet treating section. The molecular sieves and
their ancillary equipment for purifying and drying their regeneration gas stream have been
restored so that they are now capable of supplying desulphurised and dehydrated gas. A
small quantity ofthis gas can be blended directly into the GP2 and GP3 sales gas stream to
increase the sales gas volume. This is possible because the sales gas from GP2 and GP3 is
well within the heating value and Wobbe Index specifications and a small stream of rich gas
which does not meet the specifications can be blended into the sales gas stream without
exceeding the specified limits.

9.60 A new tie line was built between GPl, GP2 and GP3 to enable treated gas from the
molecular sieves of each production unit to be transferred between plants. This was
available for use in the interim period before the completion of Phase 2. This
interconnection al1ows GPl treated rich gas to be fed to GP2 and GP3 even though the
remainder of GP 1 is out of service.

9.61 Phase 1 also recommissioned part of the GPl slugcatcher condensate handling system. This
involved the condensate heater GP921A using hot oil to warm the condensate before it was
delivered to the GPllOSB Flash Tank and then to the CSP for stabilisation via a new
connecting pipeline.

Phase 2

9.62 Phase 2 of the GPl restart recommissioned the gas chilling and separation section of GPl.
In this phase, GPl was modified to allow the absorbers to be used as cold separators with no
circulation of lean oil to assist recover of the heavy components from the gas stream. With
the completion of Phase 2, the Gas/Gas exchangers GP901A, B, C and D and the Gas
Chillers GP902A and B cool the inlet gas to -l5°C before it enters the Absorbers GP1104A
and B. Condensate is separated in the absorbers, the bottom sections of which have been
modified internally to allow the GP903A and B heat exchangers to be used to heat the
condensate as it leaves the absorbers. This differs from their operation as reboilers when
they recirculated the heated condensate back into the bottom of the absorbers. The warmed
condensate at about 0°C is transferred through an existing pipeline to the GP2 Demethaniser
for further processing. A new pipeline connection to GP3 was installed to allow condensate
to be transferred to the demethaniser in that plant.

162
9.63 The GPI propane refrigeration system was also brought back into service during Phase 2 to
provide the refrigerant to Gas Chillers 902A and B.

9.64 The Crude De-ethaniser, GPll06B, was returned to service in Phase 2, together with its
associated equipment. This restored the full capacity of the Longford plant to process
slugcatcher condensate.

Phase3

9.65 The work involved in Phase 3 is proceeding at the time of drafting this report. It was
originally scheduled for completion by the end of May 1999 but has been delayed as noted
in paragraph 9.55. The completion of Phase 3 will enable the Longford Plant to produce
specification sales gas at rates comparable with the plant's capacity prior to the September
accident.

9.66 In Phase 3, the absorber condensate processing system will be recommissioned with a
number of modifications and additions to its previous format.

9.67 The existing processing system consisting of the Condensate Heater, GP919, the Condensate
Flash Tank, GP1105A, the Condensate De-ethaniser Feed Heater, GP92IA, and the
Condensate De-ethaniser, GPll 06A, will be supplemented by a number of additional items
of equipment. A condensate separator downstream from each of the GP903A and B heaters
will return the separated vapour to their respective absorbers. The conversion of the existing
GP925 Rich Oil Exchanger to condensate warming service will provide additional heating
downstream from GP919. The heating medium for GP919 will revert to warm propane, and
the heating medium for GP925 will be reflux liquid from the CSP Product Debutaniser
which was used on GP919 before the September accident.

9.68 Two new Product Debutaniser reflux pumps dedicated to supplying GP925 are to be added,
together with two new Condensate De-ethaniser pumps dedicated to a new warm-up recycle
line connected to the condensate line from the absorbers to the Condensate Flash Tank,
GP1105A. When in operation, this equipment will enable the chilling of treated gas to
-32°C prior to separation of condensate liquids in the absorbers.

163
 d
0
§
e ~
ow
"'
~
.:::
=.....
ow
.:;.
s
i5
~

~
ow
£
8 "...l::l,
~

"""
~ ~
i ~

.L ~~
~
.
~
~ sow
~
~
~
~

:.:... I -riJ .
Q\
~
< ::s
"'~ .~
i?< ~
Q z
~
;:
0.
0

I I

'-
9.69 Figure 9.3 is a diagram of the modified process after completion of Phase 3. This process
will produce sales quality gas that will flow from the top of the absorbers. The condensate
leaving the bottom of the absorbers will be heated by GP903A and B to about -5°C. This
mixture of vapour and liquid will flow to the new separators for removal of the vapour
which will join the gas passing up through the absorber. The remaining condensate will be
flashed to 3100 kPa through the absorber level control valves LY9A and B and then
combined into one stream to be warmed by the two heat exchangers GP919 and GP925.
After separation of vapour and liquid in the Condensate Flash Drum, GP 11 05A, the liquids
will pass through the Condensate De-ethaniser Heater, GP921A, and enter the Condensate
De-ethaniser, GP1106A. The overhead vapours from the Condensate Flash Drum and the
De-ethaniser will be recompressed and returned to the inlet of GP 1. The bottom product
from the De-ethaniser will be fed to the Product Debutanisers in the CSP.

RESTORATION OF INSTRUMENTATION, ESD SYSTEM AND PLANT

SERVICES

9.70 The recornmissioning of the process units referred to above required the provision of a
number of supporting services and the repair or servicing of much of the existing equipment
in GPl.

9.71 The accident on 25 September 1998 resulted in severe damage to the pneumatic
instrumentation and control equipment in GP 1. In addition, as mentioned in Chapter 8, the
GPI control room suffered extensive damage because of the release into the room of
hydrochloric acid fumes produced by the decomposition of pvc cable insulation.

9.72 An early decision was made to relocate the CSP Bailey system from the existing control
room to the Offshore Support Group (OSG) building. This building is located about
250 metres from the centre of GPI and is well outside the area affected by the fire. This
allowed a faster restart of the CSP because the condition ofthe existing control room was no
longer a consideration. A logical extension of this decision was to relocate the GPl
instrumentation in the OSG building. This precluded the further use of the pneumatic
instrumentation previously used in GP1, because the distance from the plant would lead to
an unacceptably slow control response. This in turn led to the decision to replace the
pneumatic system with a Bailey Distributed Control System (DCS) using electronic field
transmitters.

9.73 The fire also badly damaged the pneumatically activated ESD system. In view of the
amount of work required to reinstate this system, a decision was made to replace it with an

165
 electrically operated system built to current international standards. A new ESD system in
GPl, including a Triconex programmable safety system, has been installed. Any system or
component failure will cause the system to go to its safest state. The system can be tested
without shutting down GPl. The Triconex system will also be used to provide the protective
system logic. This will manage the alarm and shutdown system which protects GPl against
operating conditions outside the set parameters.

9.74 The switch gear room, and the motor starters which it contained, were damaged by the fire
and the room was subsequently demolished. It has been replaced by a new building
containing new motor switch gear. All the electrical power and lighting facilities for the
GPl area have been repaired or replaced.

9.75 Extensive mechanical restoration was also needed to repair the fire and blast damage on a
multitude of equipment items. This included valve replacements, stripping and reinsulation
of vessels and pipework and the replacement of the east-west piperack adjacent to Kings
Cross. Extensive inspection of vessels and checking of pressure safety valves was also
needed. In the Kings Cross area it was also necessary to close off damaged lines for water,
oils and nitrogen. Numerous other maintenance jobs scheduled for the first available plant
turnaround were carried out as GPl was being prepared for restart.

SAFETY ASSESSMENTS ON mE MODIFIED GPJ

9.76 At the direction of the VWA and in accordance with requirements set out in its management
system, Esso has carried out three major safety evaluations of the GPl plant.

9.77 Because of the changes that were envisaged in GPl to meet the 1999 winter contractual
obligations for gas supply, plans for a HAZOP study were initiated in early October 1998.
This study was conducted in three parts, using the Exxon HAZOP technique. It was
undertaken by specialists from Esso, its overseas affiliates and Australian engineering
contractors.

9.78 The studies were carried out on:

• The GPl facilities that were to be reoperated as they were originally built;

• The modifications that were called for in GP 1; and

• The pre-start up conditions for the three phases.

166
9.79 These studies produced follow-up actions that required modifications to design, changes to
existing facilities, new operating procedures and the additional training of operating staff
Findings were ranked into A and B categories, with A category findings having to be
satisfactorily covered before the start up of the section of plant involved.

9.so International consultants have been engaged to undertake a Quantitative Risk Assessment
(QRA) of the Longford plants. The determined risk can then be compared with international
bench mark levels and, if necessary, additional sensitivity analysis can be undertaken to
calculate the impact of potential risk reduction measures. These studies require complex
mathematical modelling. They are scheduled to be completed in October 1999.

9.81 A fire safety study has also been initiated to assess whether the existing fire detection,
prevention and mitigation systems provide adequate protection. The study will involve a
review at the fire hazards within the Longford plants to determine credible fire scenarios.
These scenarios will be used to determine the effectiveness of fire controls and safeguards
and the physical facilities available for fire detection and firefighting.

9.82 The fire safety study is expected to be completed by June 1999.

9.83 Esso initiated a metallurgical study of all pressure vessels in the chilldown and absorber
sections of GP I. This was made necessary by its intention to operate these sections at a
somewhat lower temperature than was the case prior to the September accident. The studies
determined the Minimum Design Metal Temperature (MDMT) for each vessel using draft
design standard API 579, "Recommended Practice for Fitness for Service". The MDMT is a
metallurgically determined minimum safe working temperature at the vessel's maximum
design pressure. It is based on the steel used in the vessel, the wall thickness, and
knowledge of the vessel's manufacture including the type of welding, heat treatment and
material tests undertaken by the manufacturer. This work was expected to confirm that all
GP 1 vessels which were to be put back into service were suitable for the temperatures to
which they were to be exposed. Where necessary, low temperature protective devices
would be provided and appropriately calibrated.

OPERATIONS, TRAININGANDSTAFFING

9.84 Because of the changes made to GP I, it has been necessary to prepare new written operating
procedures and to update the Longford Operating Procedures Manual. In addition, the
critical operating parameters documented in that manual have been updated to reflect
process changes and actions to be taken to prevent critical parameters being exceeded.

167
9.85 Operating training modules have also been developed for all the changes and special
training is being provided to all operating personnel prior to their being required to operate
the revised GP1 facilities.

9.86 Additional staff have been provided to support the normal operating staff of GP I during
commissioning and start-up of the revised facilities. In addition, start-up and
commissioning engineers have been available on site to ensure full understanding of the
revised processes.

ENHANCEMENT OF CAPACITY AND FLEXIBILITY OF GP2 AND GP3

9.87 As the sales gas produced by GP2 and GP3 is well within the quality specification limits,
Esso has decided to install additional treating equipment and bypass lines within those two
plants to allow the use of treated or partly processed gas to supplement sales gas output
during times of operating difficulty in the gas plant.

9.88 This de-bottlenecking of capacity is il.lustrated in Figure 9.4 which shows the additional
facilities required and the expected output in thousands of cubic metres per day (km3/d).
GP2 is being fitted with a larger filter separator, a larger dust filter and a larger rich gas
bypass together with a new cold gas bypass. GP3 is receiving the filter separator and dust
separator removed from GP2 which will be installed in parallel with the existing units. Two
additional molecular sieves and a new cold gas bypass are being added.

GP3

8,000

4.000
8,000

9.000

• GP3 lnlct T""'ung Capacity Upgrude

• GP2!3 Ga. B) pass \Jpgra..le
Nonna l Text Ori ginal capacity i.n km 1/d
&Id Text Phase 3 Capac ity fo r GP2 or GP3
Italic Text Added Capacity of parallel streams
Mol Sieve Flow on Wet Gas Basis

Figure 9.4 De-bottlenecking block diagram

168
9.89 The rich gas bypass in GP2 feeds gas from the molecular sieves into the sales gas stream.
As this gas has not been cooled, it will still contain its heavy components and therefore will
have a high heating value and Wobbe Index number. This restricts the amount that can be
added to the sales gas without exceeding the sales gas specification.

9.90 Each of the cold gas bypasses takes gas downstream from the heat exchangers and
separators in each plant and feeds it into the sales gas stream. As this gas will have been
cooled to around -30°C, some of the propane and most of the butane will have been removed
and it will have a lower heating value and Wobbe Index number than rich gas.
Consequently, a larger proportion of cold gas can be mixed into the sales gas stream than
when rich gas is being bypassed.

9.91 The combined output of GP2 and GP3, with maximum allowable bypassing of cold gas to
produce gas within specified limits, is estimated at 27000 km3/d or 27 Mm3/d. This is more
than required to meet Gascor' s and other users' maximum demand quantity (MDQ) of
1007 TJ which amounts to only about 25.1 Mm3/d at a heating value of 40.1 MJ/m3• The
limitation on throughput is generally imposed by the Wobbe Index of the sales gas, but the
allowable temperature of -2°C for the mixture of gases entering the sales gas pipeline may
also become a limitation.

9.92 HAZOP studies have been conducted for the GP2 and GP3 bypasses and the additional
molecular sieves for GP3. These studies confirmed that the proposed additions and
modifications were feasible options and will provide a safe means of gaining peak capacity
from GP2 and GP3 to meet contingencies.

9.93 The HAZOP studies have been supplemented by a review of Critical Operating Parameters
(COPs) for GP2 and GP3. These are to ensure that there are clear and appropriate corrective
actions to be taken if operating parameter alarms are triggered. Where no control or
automatic shutdown exists to protect the plant from conditions outside the specified limits,
corrective action by operators is laid down and operator training programs have been
instituted to ensure an effective response.

9.94 The reliability of GP2 and GP3 has also been enhanced by increasing stock levels of spare
equipment for those plants and pre-testing spare control cards for the GP3 Solar Mars sales
gas compressors to facilitate rapid changeovers in the event of card failure. In addition, an
air compressor has been installed to back up the existing compressors supplying instrument
air.

169
 CAPACITY OF RESTORED PLANT

9.95 As indicated above, GP2 and GP3 can meet the winter peak under emergency conditions
without GPl in operation, provided the planned modifications are completed without delay.

9.96 With GP 1 restarted as a cold separation plant and all hydrocarbon liquid stabilising facilities
operating, the Longford Plant is estimated to have a maximum output of29 Mm3/d. This is
made up as follows:

Table 9.2 Longford plant capacity

Process Section

8
3
29

9.97 On most days in winter, with all three plants operational, the cold bypass will not be needed
as the normal processing capacity of 26 Mm3/d will be sufficient to meet the MDQ of
25.1 Mm3/d.

9.98 As the complexity of GPI has been reduced by leaving the lean oil system out of service,
and with the modifications made to the condensate handling and stabilisation system,
availability and operability should be improved in comparison with its pre-accident
condition.

FUTURE PROPOSALS

9.99 Esso has appointed a Long Term Gas Projects supervisor to study potential upstream
production enhancement, and is giving consideration to stand-alone gas supply alternatives.
These long term projects are outside the Terms of Reference of this Commission, but the
proposed study of means to enhance ethane recovery in GPl, GP2 and GP3 does fall within
the Commission's scope. This matter is dealt with in Chapter 10.

170
 Chapter 10
THE SUPPLY OF ETHANE TO THE PETROCHEMICAL
INDUSTRY

10.1 The restart ofGP1 as a cold separation plant without the use oflean oil absorption will limit
the production of ethane from the Longford plant. As stated in paragraph 9.53 the demand
for ethane at the time of the Longford accident was 650 tonnes per day, but production from
the restarted plant is not expected to exceed 550 tonnes per day in mid-winter and will fall to
about 300 tonnes per day in mid-summer in line with the reduced gas demand. This was a
matter of concern to the two customers for ethane: Huntsman Chemical Company Australia
Pty Ltd (Huntsman) situated at Footscray and Kemcor Olefins Pty Ltd and its affiliates
(Kemcor) situated at Altona. Esso has appointed a long term gas project team which has, as
one of its tasks, a study of the means to enhance ethane recovery at Longford. However, at
the time of preparation of this report, the Commission is not aware of any proposals to
achieve this objective.

10.2 Huntsman and Kemcor lost their supply of natural gas and ethane on 25 September 1998.
Kemcor also lost the supply of heavy gas oil which it used as another feed stock. This was
supplied by Mobil Refining Aust. Pty Ltd from its Altona Refinery, but the oil was from
Bass Strait and was initially processed through the Longford plant. Supplies of gas and a
limited supply of ethane were restored on 5 October 1998, but the supply of heavy gas oil
did not resume until early December.

10.3 The ethane, which was the major feedstock for both companies, was first converted to
ethylene in a steam cracker, ethylene being the building block for many other
petrochemicals. In the case of Huntsman, the ethylene was converted to styrene monomer.
This in turn was converted to polystyrene and other plastics, resins and gels. Some of this
styrene monomer was sold to other Australian manufacturers who converted it into a
multiplicity of plastics, resins and synthetic rubber compounds. Huntsman was, and is, the
sole manufacturer of styrene monomer in Australia.

10.4 The ethylene production process also produced some propylene and butadiene which was
used by Kemcor to make polypropylene and synthetic rubber respectively. Some of the
ethylene stream was converted to high density polyethylene (polythene) of which Kemcor
was the sole Australian manufacturer, supplying 75% of the Australian market for that

171
 product in 1997. High density polythene is used to produce plastic containers, pipes,
sheeting and moulded products.

1o.s Another portion of the ethylene stream was converted to low density polythene. This
material is used to make such items as plastic bags, soft moulded products, insulation for
electric cables and shrink wrap. In 1997, Kemcor' s share of the Australian market for low
density polythene was 21%. As another Australian supplier provided 56% of the Australian
market, it would be necessary to import 44% of Australia's needs ifKemcor were unable to
continue supply.

10.6 Kemcor's share of the 1997 Australian market for polypropylene and synthetic rubber was
15% and 97% respectively. Polypropylene is primarily used for making rigid plastic
products while synthetic rubber is used almost exclusively for manufacture of tyres.

10.1 These statistics indicate the importance of Huntsman and Kemcor as major Australian
producers of petrochemicals based on ethane as a feedstock. Their significance in the
Australian economy can be gauged from the plastics and chemical industry's contribution to
Australia's Gross Domestic Product (GDP) of$7.8 billion which was 1Y2% of the Australian
GDP for 1996/7. Approximately $3 billion of this GDP is attributable to the plastics and
chemical industry in Victoria.

10.8 There has been a rapid rise in the importation of plastics and chemicals to Australia. The
value of these imports has risen from $6.4 billion in 1990 to $12.8 billion in 1998. This
100% increase over 8 years has been partially offset by an increase in the value of exports of
plastics and chemicals from $1.6 billion in 1990 to $3.8 billion in 1998.

10.9 Kemcor employs some 900 people, with another 300 providing services under contract.
Huntsman employs 450 people, with another 500 providing services to it. A number ofthe
customers ofKemcor and Huntsman are reliant on raw materials and semi-finished products
from these producers. These cannot be readily replaced by imports. As a result of the
reduced ethane production at Longford these downstream manufacturing facilities are likely
to be adversely affected. Should that occur, the importation of finished products would
become necessary to replace those previously manufactured in Australia. The likely
reduction in employment in those events is evident.

10.10 Ethane is a bulk commodity which is not widely traded internationally. Almost all ethane
used as petrochemical feed stock is delivered by pipeline from the producer to the user's
plant where little if any storage facilities are provided. This is because liquid ethane can
only be stored at a relatively high pressure if at atmospheric temperature (about 5,600 kPa at

172
 20°C) or at -88°C if at atmospheric pressure. The prospect of an alternative supply of ethane
to the Victorian manufacturers is therefore unlikely as it requires not only a different source
of ethane but also a new and expensive pipeline to deliver it.

10.11 The Commission is of the view that Esso should strengthen its endeavours to find an
economical means of restoring the supply of ethane to its pre-September 1998 level in order
to ensure the viability of an important industry.

173
 Chapter 11
THE HYDRATE INCIDENT

SCOPE

11.1 In June 1998, hydrates formed in the slugcatchers which feed hydrocarbons to all three gas
plants. As a consequence, Esso was not able to meet gas demands placed by VENCorp on
10, 11 or 14 June 1998. The Commission has examined this incident as part of its obligation
to investigate and report upon whether the hydrate incident was a contributing factor to the
occurrence of the explosion, fire and failure of gas supply on 25 September 1998. As will
appear below, the Commission is of the view that the hydrate incident did not contribute to
the events which occurred on 25 September 1998. It has also examined the hydrate incident
as part of its obligation to consider what steps should be taken by Esso or BHP to prevent or
lessen the risk of a further disruption of gas supply from the Longford facilities, whatever
the cause.

HYDRATE FORMATION AND PREVENTION

11.2 The conditions giving rise to the formation of hydrates are well understood within the oil
and gas industry. Hydrates are solids with ice-like characteristics. They form under
conditions of low temperatures and high pressure when light hydrocarbon molecules are in
the presence of water.

11.3 The potential for hydrates to affect production operations was well known to Esso.
Following the commencement of gas production at Longford in 1969, Esso used methanol to
inhibit hydrate formation. In 1979 Esso adopted, and has maintained, the practice of
injecting glycol into the offshore pipelines in preference to methanol as a means of
preventing hydrates from forming. In 1982, an Esso employee, Peter Symes, presented a
paper to a conference on the benefits Esso achieved by changing from the injection of
methanol to monoethylene glycol, to inhibit hydrate formation. This paper was later
published in the proceedings of the conference.

11.4 Glycol is the same component as is contained in the anti-freeze solution used in a car
radiator. After injection offshore, a solution of water and glycol is recovered at the
Longford slugcatchers, concentrated to restore glycol content to at least 90% and sent by

175
 truck to Esso's Barry's Beach marine terminal from which it is shipped to the main gas
production platforms to be used again.

11.5 Storage facilities on the platforms ensure there are sufficient supplies of glycol to withstand
the failure of deliveries due to bad weather or for other reasons. In an emergency, supplies
can be flown out to the platforms by helicopters. The pumps used to inject the glycol into
the gas streams are electrical and there are stand-by facilities. The glycol metering facilities
and injection controls are designed to fail safe, that is, to fail in a position allowing a
maximum injection of glycol.

11.6 The rate at which glycol is injected into the gas streams is established from computer
spreadsheet tables based upon the pressure of the gas and liquid in the separators on the
platforms. A separator is a vessel designed to separate the liquid from the gas. Also taken
into account in the calculation is the "cold point" temperature and the assumed pressure in
the slugcatchers. The cold point temperature is the lowest temperature in the pipeline
between the platform and Longford. It changes position seasonally, principally because
there is a variation in sea temperature and gas rates, the latter resulting in loss of pressure
which in turn results in a lower temperature in the pipeline. The cold point temperature is
generally at the slugcatchers' inlet during winter and at Site 1, which is essentially the
landfall point of the Marlin gas pipeline, during summer.

11.1 The rate of injection of glycol is expressed in terms of the litres of glycol to be injected per
1000 cubic metres of gas leaving the platform. The ratio is calculated by the platform
operators every four hours, based upon the process conditions, and is entered into the Bailey
control system. That control system then alters the rate of glycol injection according to the
set ratio as the gas production varies. The Bailey system calculates the cumulative glycol
and gas flow ratio over specific time intervals. This allows the operators to check and
validate the measured amount of glycol injected, against the depletion of glycol in the
storage tanks.

11.8 Other means to prevent the formation ofhydrates are to remove the presence ofwater and its
vapour from the gas streams, to raise the temperature of the gas or to lower the operating
pressures of the gas system. The latter is impractical in a gas production system that is
required to operate under pressure. Each of the offshore platforms is fitted with separators
designed to remove the water from the gas streams prior to the gas entering the pipelines to
the shore. However, since 1995, Esso operated the Barracouta platform separator in
"flooded mode". Operating a separator in a flooded mode means that the liquid off-take

176
 valves on the separators are shut and all well fluids, condensate, water and gas leave the
separator via the gas pipeline to Longford. This defeats the design intent of the separator.

CHRONOLOGY OF THE INCIDENT

11.9 On 31 May 1998, a compressor on the Snapper platform developed an oil seal problem. As
a result, a decision was taken by Esso to run the Snapper platform with no vapour/liquid
separation and to direct all liquids to the gas pipeline. Three wells connected to the Snapper
platform have the capacity to produce large amounts of water. They are known as HI-GOR
wells. Two of these wells were known by Esso to be able to produce about seven times the
amount of water that was used as the basis of the calculation for the glycol required. That
did not matter when the platform was operated with the separator working normally, but
with the platform operating in a flooded mode all of this additional water would have
entered the gas pipeline, requiring the injection of additional glycol. On 3 and 4 June one of
the HI-GOR wells on the Snapper platform which had a higher yield of water, was in
production for most of the day.

11.10 Immediately before the Queen's birthday long weekend nominations for gas from Longford
peaked at around 20 Mm3/d. On Saturday, 6 June 1998, the first day of the long holiday
weekend the demand for sales gas from both industrial and residential customers dropped to
approximately 16 Mm3 /d. With the start-up of industry at the end of that weekend on
Tuesday, 9 June, and with residential consumers responding to cold ambient air
temperatures which reached as low as 3°C, the demand for sales gas increased to
approximately 21 Mm3/d.

11.11 In addition, on Tuesday 9 June, Kemcor advised Esso that, because of an unscheduled
shutdown in its plant, its ethane requirement would be reduced. This resulted in a reduction
of the total Bass Strait ethane requirement by 55%. With the decreased demand for ethane,
Esso decided to switch 5.0 Mm3/d of production from Marlin to the Snapper platform. Also
on 9 June, the Barracouta platform, which was not manned, was shut in because of the
activation of a safety alarm. As the platform was unmanned, it could not be restarted and
brought back into production until the following morning. Esso then decided to increase the
production from Snapper by another 5.0 Mm3/d. This meant increasing the production from
the HI-GOR wells known to produce substantial amounts of water. Despite these changes to
its production profile, Esso did not review the amount of glycol that should be injected to
account for increased water.

11.12 In addition to the changes in the production profile of the wells, the increased demand for
gas from the Snapper platform substantially increased the flow rates through the offshore

177
 pipelines. This meant any liquids (whether water or condensate) that had settled out in the
offshore pipelines during the period of low flows were 'swept' through to the Longford
slugcatchers with the higher gas flow rates.

11.13 On Wednesday, 10 June, nominations for sales gas were again high at approximately
21Mm3/d. At about 8.50 am on that day, the Barracouta Slugcatcher's liquid separator
barrels blocked suddenly. While the blockage allowed for a continued flow of gas through
the slugcatchers to the gas plants themselves, the blockage restricted the separation of
liquids from the gas. As a result, liquids from the slugcatchers carried over into GP2 and
GP3 inlet separators, causing them to shut down. After a period, the two plants were
successfully restarted. Methanol, which is used to clear hydrates, was injected into the
slugcatcher barrels and arrangements were made to radiograph the barrels to identify the
extent of the problem. The radiographs indicated a hydrate blockage in the Barracouta
slugcatcher. It was taken out of service and depressured in an attempt to dissociate the
hydrates. In addition, warm condensate was re-routed from the Marlin Slugcatcher into the
Barracouta Slugcatcher. High-current, industrial heating blankets, powered by portable
generators, were also applied to the barrels to provide warming as a further means of
removing the hydrates. VENCorp and Gascor were formally notified by Esso that the
request for gas supplies could not be met. At about 6.00 pm on I0 June, VENCorp began
vaporising liquefied natural gas stored at Dandenong to ensure that the gas pressure in the
distribution system was adequate for the following day's peak demand period.

11.14 During the early morning of 11 June, liquids from the Marlin slugcatchers carried over into
GP2 and GP3, again causing shutdowns. Initially Esso thought that the carryover was
caused by the high liquid rates in the offshore pipelines being fed into a single slugcatcher.
However, a hydrate formation was later found to be a contributing factor. Gas sales were
reduced to the maximum sustainable for continuous operation while methanol was injected
into the slugcatcher and heat blankets were put in place.

1 us During the early morning of 11 June, VENCorp notified major industrial consumers that it
was beginning to curtail gas supply to them. It also appealed to residential consumers to
reduce their usage of gas voluntarily. Esso was able to meet the requests for gas within
these constraints on 12 and 13 June.

tl.l6 On 14 June, during operations to sweep liquids from the pipeline system the Marlin
slugcatcher blocked suddenly, again restricting the throughput of gas. This led to an under-
delivery of the gas requested from Esso on 14 June while the blockage was cleared. It was

178
 cleared quickly later that same day, allowing delivery of the full gas request on Monday, 15
June 1998.

ESSO'S INTERNAL INVESTIGATION

11.11 Esso itself undertook a comprehensive investigation of the hydrate incident. It concluded
that a number of factors which were present before or during the incident gave rise to
conditions severe enough to cause the formation of the hydrates which blocked the
slugcatchers. These were:

• large increase in gas demand due to a public holiday long weekend followed by
significantly colder weather;

• changing gas production demands on individual facilities due to an ethane customer's

unplanned shutdown and the safety system shutdown of a remotely operated platform;

• significant increases in individual pipeline flowrates due to gas facility production

demand changes, causing liquids lying in the pipelines to be swept from the pipelines
into the slugcatchers;

• changes in offshore well producing characteristics and facility configurations (arising

from unplanned facility shutdowns) that may have allowed some under-inhibited liquids
to enter the gas system;

• waxy crude oil in the system possibly providing stable structures for hydrates to form
and subsequently hindering dissociation; and

• the high pipeline rate required to maintain gas supply following the initial blockage of
one slugcatcher that resulted in a lower onshore pipeline temperature.

11.18 The item "changes in offshore well producing characteristics and facility configurations"
appears to be an oblique reference to the fact that the Barracouta platform's separators were
operated in a flooded mode since 1995 and the Snapper platform's separators had to be
operated in a flooded mode between 30 May 1998 and 15 Junel998 due to the compressor
seal failure.

11.19 Figure 2.3 is a diagram showing the gas pipelines and Longford slugcatchers.

179
 OBSERVATIONS ON ESSO'S HYDRATE REPORT

11.20 In its investigation, Esso stressed the conservative nature of its calculations with respect to
the injection of glycol. This, it said, was to be seen in,

• the adoption of dissociation temperature for the hydrates as the cold point temperature
rather than temperature of formation, because the latter may be lower;

• a 1.7°C 'safety margin' built into the base calculation;

• the selection of the most conservative platform separator or slugcatcher variables where
possible;

• the rounding down of glycol concentration to the nearest 5% increment.

11.21 However, the difference between dissociation temperature and formation temperature of a
hydrate is inherently unpredictable so that the actual degree of conservatism adopted by
Esso cannot be established with any precision. Further, it is more accurate to describe the
1. 7°C factor as a means to compensate for inaccuracies in the mathematical models rather
than as a 'safety margin'.

11.22 Moreover, conservatism in the calculation of the required injection of glycol can be offset
by a number of variable factors. The most important of these is the time during which the
pipeline liquids, both condensate and water, settle out and remain in the low points of the
pipeline. The period of time these liquids remain in the pipes is longest in summer when gas
flow rates are low and shortest in winter when gas flow rates are high. In addition, water
being more dense than condensate, tends to gravitate to the bottom of any such pools of
liquid taking longer for it to traverse the system. The imperfect mixing of held-up water and
incoming water means that water within a pool will generally have been in the system for far
longer than any modelling would indicate. Field tests in winter 1998 indicated that a spike
in glycol injection took four days to appear at Longford. Water may take days or even
weeks to traverse the pipeline system when gas flow rates are low.

11.23 The result is that the Cold Point temperatures used to calculate the required rate of injection
of glycol when the gas and water leave the platform may have changed at the time the water
enters the slugcatchers. This is a systemic error, which will be non-conservative at the
transition from summer to winter as ambient and sea temperatures fall and gas flow rates
increase leading to a drop in the Cold Point temperature.

180
11.24 The major non-systemic factor offsetting the conservatism of the basic calculation for glycol
injection is the departure from normal operations on the platforms. Esso's calculations
assumed that the amount of water vapour leaving a platform was at equilibrium condition
for the temperature and pressure of the separators.

11.25 On the Barracouta and Marlin platforms there was an oil pipeline as well as a gas pipeline.
Liquid separated from the gas by the separator was sent to Longford in the oil pipeline.
When the oil system was shut down, as happened on the Barracouta and Marlin platforms,
the water was sent to Longford in the gas pipeline. It could not be dumped at sea for
environmental reasons. The valve on the separator which put the water into the oil system
was shut and the separator operated in a flooded mode in order to maintain gas production.
Under those conditions, the amount of water remaining in the gas was likely to be twice that
assumed when calculating the amount of glycol required.

11.26 Esso also noted that there was a further degree of conservatism in the actual operation of the
system. The Esso platform operators appear to have routinely injected more glycol than
required by the calculations. That practice was neither encouraged nor discouraged by
Esso. The level of over-injection may have been sufficient to offset the effect of operation
in flooded mode in otherwise normal conditions, e.g. stable gas demands and few changes in
well characteristics.

11.21 Because production from the Marlin platform was minimised on 9 June, there was no
significant injection of glycol from that platform to compensate for the additional water in
the gas stream from the Snapper platform. Also, the high rates of gas flow in the Snapper
pipeline system would have increased the rate at which any under-inhibited water, leading to
a potential hydrate, would have been swept through the system into the slugcatchers.

11.28 Thus, significant quantities of under-inhibited water entered the gas pipeline systems from
the Barracouta and Snapper platforms which were not included in the calculation of the
glycol required to be injected. The Barracouta water entered the system due to the flooded
mode of operation of the separators and could have counteracted most of the buffer effect of
the regular over-injection of glycol by operators. From past experience, it would seem that
this might not, of itself, have been sufficient to generate the hydrate problem on 10 June
1998. However the flooded mode of operation of the Snapper platform meant that all
liquids produced entered the pipeline for about ten days before the incident on 10 June,
including the potentially substantial amount of aquifer water arising from the operation of
some RI-GOR wells during that period. This produced a large deficit in the amount of
glycol required to inhibit the formation of hydrates.

181
11.29 The time taken for liquids to emerge from the pipeline system and the colder temperatures
of the gas near the slugcatchers, were also factors contributing to the likelihood of the
occurrence of hydrates. The increase in the Snapper gas flow rates would have had a
sweeping effect upon the water in the Snapper pipeline system. The combination of these
factors resulted in water passing through the system that was not sufficiently inhibited to
prevent the formation of hydrates. These hydrates commenced to form and stabilise into a
solid mass, initially at the inlet end of the Barracouta slugcatcher. The hydrate blockage in
the Marlin slugcatcher was an extension of the same problem, arising from further
significant drops in temperature as flows and conditions changed during the incident.

CORRECTIVE MEASURES TAKEN BY ESSO

1 uo As a result of its investigation of this incident, Esso developed a package of corrective

actions, which it called its Gas Management System, to prevent recurrence. A fixed target
ratio of glycol to gas flowrate has now been adopted for each platform, using a fixed and
conservative basis for the calculation of the required amount of glycol. The cold point
temperature adopted is now 6°C which compares with cold point temperatures measured at
the time of the incident of I ooc to 11 °C. These ratios are two to three times the target ratios
that would have applied at the time of the incident. The achievement of these ratios will
represent a considerable increase in the level of conservatism appJied in the injection of
glycol. The new ratios have applied since the incident on 10 June 1998.

11.31 Esso proposes to give increased attention to ascertaining any discrepancy between the actual
rate of glycol injection and the target rate and to report the results more widely. There is to
be a continued emphasis on ascertaining the metered rate of glycol injection and the changes
in tank inventory. All glycol injection on the platforms is to be measured by new coriolis
meters for improved accuracy and reliability. Esso proposes to increase its checks for glycol
impurity or degradation by additional platform measures, monitoring the regeneration plant
and analysing regeneration plant feed, plant product and glycol supply to the platforms.
Standards have been set and the action to be taken defined in the case of deviation from the
standards. Further, glycol inventory management on the platforms has been strengthened
and some additional glycol storage capacity is to be commissioned. A procedure has been
formalised for the supply of glycol to the platforms in emergencies. Finally, Esso proposes
to carry out additional monitoring of glycol in the water from the slugcatchers to forewarn
of possible problems.

11.32 The Barracouta platform, which was not staffed before the hydrate incident, is now manned
and regular attention is given to the levels of separator liquids. The platform is to remain

182
 staffed until reliable management of those liquids can be ensured as a remote operation from
the Snapper platform. The objective is that there be no regular entry of separator water into
the gas pipeline.

11.33 Additional facilities are being installed on the Snapper platform so that liquids from the
separators will have an outlet path other than to the gas pipeline. It will be possible to direct
condensate and water to the oil pipeline even during maintenance activity, such as required
the separators to be run in flooded mode in the period before the hydrate incident

11.34 An operating policy has been adopted precluding the flooded operation of offshore
separators. Any deviation from this policy will be treated as a change in management
process and will require specified procedures to be adopted. Any additional entry of water
to the gas pipeline systems will require specific additional injection of glycol and, where
necessary, wells in the Snapper Field producing high liquid levels will be shut in.

11.35 These measures, together with improved training, line pigging and sweeping facilities,
should minimise the risk of a repetition of a hydrate incident of the severity of that was
experienced on 10 June 1998.

OBSERVATIONS

11.36 The Commission has concluded that the hydrate incident on 10 June, 1998 did not
contribute to the explosion and fire on 25 September 1998. The physical connection
between the two incidents is tenuous. A physical connection that was drawn between the
two events concerned the presence of molecular sieve dust found in GP903B when it was
opened for inspection after the incident on 25 September. As noted in Symes' 1982 paper,
the compound used in the molecular sieves, or dehydrators, is damaged by contact with
methanol, large quantities of which were injected into the slugcatchers during the hydrate
incident. It would have entered the dehydrators as methanol vapour leading to a possible
breakdown of the molecular sieve particles and an accumulation of molecular sieve dust in
GP903. However, it is also known that the action of methanol on the molecular sieve
compound is to leave a carbon residue in the lattice structure during regeneration of the
sieve, thereby reducing its absorption capacity but not causing physical breakdown.

11.37 Be that as it may, the accumulation of sieve dust in GP903 was not sufficient to prevent that
exchanger from performing its condensate heating function on the morning of 25 September
1998. That can be seen from the rapid response to the opening of the TRC3B bypass valve
at 8.22 am. This adjustment caused the condensate temperature to rise about 12°C in
28 minutes with an initial rise of 5°C in the first 5 minutes.

183
11.38 There are, however, a number of similarities or parallels between the deficiencies in Esso's
management systems that contributed to the hydrate incident occurring of 10 June and those
which contributed to the accident on 25 September.

• Most notable is that the potential for the formation of hydrates was well known to Esso
prior to the June incident just as the potential for cold temperatures to develop upon the
loss of lean oil was known prior to the September accident. As a part of Esso's own
investigation of the hydrate incident, it performed a review of control room logbooks
dating back to 1993 and PIDAS information dating back to 1994. Those reviews
identified a number of previous hydrate incidents, some of which resulted in significant
hydrate formations in the slugcatcher area. As part of its corrective actions, Esso has
now developed a series of operating practices, one of which addresses the rate at which
gas flows from the platforms should be increased to minimise sweeping large amounts
of liquids from the offshore pipelines into the slugcatchers. Whilst one of Esso's own
engineers had published a paper in 1978 on just this subject, that knowledge was
apparently lost over time and was not reflected in its operating procedures and practices
current in June 1998.

• The lack of a spare parts for the compressor on the Snapper platform meant operating in
an abnormal state (flooded) for a period of at least ten days before the incident without
developing and implementing temporary preventive measures. As indicated in Esso's
management system, such corrective measures could have taken the form of operating
instructions or revisions to the glycol injection rates. This approach was similar to that
taken with the TRC3B valve, which was out of service for upwards of two weeks
without temporary measures being implemented to address the problem.

• As part of its investigative and corrective process, Esso developed a number of risk
scenarios analysing the potential for hydrates to form and the consequences that could
arise should they form. No such scenarios were included in previous periodic risk
assessments undertaken by Esso. As discussed in Chapter 13, the same deficiency
existed in relation to cold temperature incidents occurring in GPI. No PRA scenario for
GP 1 ever addressed this issue.

184
 Chapter 12
THE COLD TEMPERATURE INCIDENT

12.1 On 28 August 1998, an incident occurred in GPI, which should have given warning of the
consequences of operating the plant without lean oil circulation to the absorbers.

THE EVENT

12.2 Some weeks before 28 August 1998, GP1202A, which was one of the two pumps delivering
lean oil from the Oil Saturator Tank, had been taken out of service for the fitting of new
mechanical seals. That left GP1202B operating without a spare pump. On the morning of
28 August 1998, GP1202B developed a leak from one of its seals and a decision was made
to shut it down and replace the seal on site. The GPI supervisor and operators (Wijgers,
Olsson and Hutty) met and discussed the steps to be taken to make the plant safe for the
repair of the pump. This necessitated the shut down of the lean oil system. The KVR gas
from the CSP was diverted to GP2, leaving only the inlet gas from offshore to flow to GP I.
The total flow of offshore gas was reduced to 3 Mm3 /day. GP1202B was then stopped,
although the GP1201 pumps pumping lean oil to the Oil Saturator Tank were left running.
It may have been expected that the level control valve LRC2 would have reduced lean oil
flow sufficiently to activate LFSD8 and thereby shut down the GP1201 pumps. This did not
occur because LRC2 did not achieve a tight shut off and the level in the Oil Saturator Tank
continued to rise. The GP1201 pumps were therefore manually shut down. The GP1204
pumps and the GP501 heaters were left online to facilitate a start up once GP1202B had
been repaired. The LC8A and B valves were closed to stop the flow of fluid from the rich
oil trays in the Absorbers to the Rich Oil Flash Tank.

12.3 The replacement of the faulty seal on GP1202B commenced at about 9.45 am and was
completed at about 3.30 pm. Wijgers, the shift supervisor, then returned to the ROD/ROF
area to supervise the re-start of the lean oil system. At about this time, a leak from GP922
was noticed. Wijgers could not recall whether the leak was from GP905 or GP922, but the
presence of a drip tray still under GP922 on 25 September 1998 and the recollection of the
area operator, Olsson, confirm that the leaking vessel was GP922.

12.4 Wijgers also noticed that the pipes between the ROD and GP922 and GP905 were coated
with ice and that the western end of GP905 also had a frosty appearance. Olsson recalls that

185
 the warm feed line from GP904 to the ROD was coated with ice, but he did not notice any
ice on the pipework in the area ofGP922 and GP905.

12.5 The re-start of the GP1202 and the GP1201 pumps was carried out without incident and, as
normal temperatures were restored, the ice melted. The gas flow through the absorbers was
increased and the KVR gas was returned to GP 1.

12.6 One puzzling aspect of the train of events is that, although the temperature recorded by
TRC4, which controls the temperature at the bottom of the ROD, initially fell from about
100°C to about 80°C, "hours later" it was found by Hutty, the control room operator, to have
risen to 160°C and to be "holding steady".

OBSERVATIONS

12.7 The most likely explanation for the coldness that was seen in the pipework is the leakage of
condensate through the valve FRC7 having the same effect as on 25 September. As stated
in the description of the 25 September accident, the evidence is that FRC7 leaked about 90
kl/day when shut. Additionally, there would have been the flow and expansion of gas
through the two rich oil level control valves, LC8A and LC8B, on the absorbers. The
operators said they fully closed the LC8 valves. Nevertheless the valves are likely to have
permitted a small leakage as there was a large pressure difference of 3,300 kPa between the
absorbers and the Rich Oil Flash Tank. Control valves typically do not shut off tightly. To
prevent gas passing through LC8A and LC8B and dropping in temperature as it expanded,
the 1975 Operating Instructions for Absorption-Oil System recommended that the manual
block valves to the control valves be closed when the lean oil flow had ceased and could not
be restored quickly. The reduction in temperature of gas as it expands is known as the
Joule-Thompson effect.

12.8 The temperature of the gas as it left the absorbers would have been about -30°C and the drop
in temperature by reason of the Joule-Thompson effect would have been in the order of
13°C. The temperature of the gas entering the Rich Oil Flash Tank would, therefore, have
been about -43 °C, only marginally above the design limit of -46°C for the Rich Oil Flash
Tank. The temperature of the condensate flowing through FRC7 would have depended on
its composition and initial temperature. A typical condensate, devoid of heavy KVR
components, would have flashed to -42°C on its way to the Rich Oil Flash Tank, as shown
by simulation analysis.

12.9 The very cold gas in the Rich Oil Flash Tank would have been discharged through pressure
control valve PRC4 to the KVR compressors unless the flow of condensate was insufficient

186
 to cover the bottom of the tank. In that event, gas and liquid would have been able to enter
the pipes feeding the ROD through the series of heat exchangers. One of those heat
exchangers was GP924 and the flow through it was controlled by FRC9 at about
6.5 litres/second. However, it is possible that the LTSD 1 valve closed, limiting the flow to
the extent that it achieved a tight shut off. The other heat exchangers were GP930, GP925
and GP904. The flow through these heat exchangers was controlled by control valve LRC 1,
which was likely to pass a significant, but unknown, volume ofliquid or gas or both, even in
the closed position. The ice seen on the line from the GP904 exchanger to the ROD shows
that the fluid in the line was cold.

12.10 The only flow ofliquids into the Rich Oil Flash Tank would have been the leakage through
FRC7 of 90 kl/d (1.04 1/s) before it flashed, with a consequent liquid flow reduction to less
than 1 litre per second. The Rich Oil Flash Tank would therefore have emptied itself by
discharging its contents of about 8, 100 litres into the ROD in less than half an hour unless
the low temperature shut down switch, LTSDI, on the cold feed to the ROD was activated.

12.11 After the Rich Oil Flash Tank was empty, a mixed stream of cold gas and condensate would
have passed through the heat exchangers and entered the ROD. This stream would have
cooled as it flashed and expanded from some 3,500 kPa in the Rich Oil Flash Tank to about
2,800 kPa in the ROD. The volume of liquid flowing to the ROD would have been reduced
to significantly less than one litre per second and its temperature in the absence of any
heating in the heat exchangers would theoretically have fallen to around -48°C. However, in
view of the very low flow rates and the large thermal mass of the system through which the
condensate would have been flowing, it is most unlikely that temperatures of that order
would have been reached in the bottom of the ROD.

12.12 The very small stream of liquid entering the ROD would have been directed into the tube
side of GP905 while the seal flushing flow for the GP1204 pumps would have been
circulating on the shell side. During the seal flushing process, the lean oil would have
passed through the seals and joined the mainstream of lean oil being pumped by the GP 1204
pumps. These pumps would have sent that lean oil back to GP905 where it would have
constituted the only flow of lean oil, as the GP1201 pumps had stopped. The pipework from
the ROD to GP905 would have been very cold, but the return line could have been quite
warm as the flow of seal flushing oil of about 36 litres/minute at a temperature of about
250°C would pass through the shell side ofGP905. This probably accounts for the reported
temperature of 160°C recorded by TRC4 late in the incident.

187
12.13 Although the level control valve at the bottom of the ROD, LClO, would have closed
because of the cessation of the flow of rich oil into the bottom of the ROD, it would not
have provided a tight shut off and would have allowed some liquid to pass from the bottom
of the ROD through GP922 on its way to the ROF. When the Rich Oil Flash Tank had been
emptied and any remaining liquid in the bottom of the ROD had passed out through this
route, it would have been replaced by cold gas. That would account for the ice on the
feedline from the ROD to GP922, which was also seen in the accident on 25 September
1998. In GP922, rich oil would normally have flowed through the tube side, but, because of
the process described, it would have become mostly, if not all, cold gas. Because of the
leakage in the tubes, the lean oil on the shell side (which would have been at a higher
pressure than the gas on the tube side) would have forced itself through the broken tubes and
joined the gas stream on the way to the ROF. Even if TRC4 was causing lean oil to bypass
GP922, the difference in pressures between the tube and the shell side of GP922 would
have forced lean oil into GP922 on the shell side through the normal outlet line and, thence
into the broken tubes. It will be recalled that the bypassing of GP922 occurred when extra
heat in the bottom of the ROD was required. If the temperature on the outlet of GP905
reached 160°C later in the day as suggested, TRC4 would have directed the flow of lean oil
(really seal flushing oil) through GP922 again.

12.14 Nevertheless, the leak from the flange on the western end ofGP922 would have been caused
by a similar abnormal temperature gradient as that to which the vessel was subjected during
the lean oil shut down on 25 September. But, as there was some flow of hot lean oil through
the vessel at all times (which was not the case on 25 September), no ice was seen to form on
the western end cover during this incident.

12.15 The similarity between this incident and that which occurred on 25 September 1998 is
readily apparent. The reason why the loss of lean oil flow did not on this occasion lead to
disaster, as it did on 25 September, is probably threefold. First, absorber condensate levels
were controlled and the gas flow through GP!, particularly that from the KVR compressors,
was reduced before lean oil circulation was shut down. This prevented the carryover of
significant quantities of condensate into the rich oil system and minimised the volume of
cold liquids available to chill the downstream equipment. Secondly, the GP1204 pumps and
the GP 501 heaters were left on for the whole period of the shut down. The limited amount
of heat that was available by reason of the seal flushing oil circulation through GP905 and
the leaks in the tubes in GP922 would have counteracted the small flow of cold fluids
through the tube sides ofthose two vessels. It may well have been that on 28 August neither
of those vessels reached a temperature low enough for them to have been vulnerable to cold

188
embrittlement (i.e. below -27°C). Thirdly, because of the orderly shut down, the apparent
lack of upset in either the ROD or ROF and the leaving of the Oil Saturator Tank and the
lean oil system full, there was no vapour locking of pumps, no icing of pump pipework and
no difficulty in re-starting the equipment.

189
 Chapter 13
MANAGEMENT SYSTEMS

OIMS

13.1 Following an oil spill from the oil tanker Exxon Valdez in 1989 and against the background
of a number of other disasters arising from the hazardous activities of companies other than
the Exxon Corporation and its affiliates, Exxon developed a framework for the safe and
environmentally sound operation of its various undertakings. The framework was called
Operations Integrity Management Framework (OIMF). Within this framework, Exxon
Company International (ECI) developed a series of expectations and guidelines (the ECI
Guidelines) which included the ECI Upstream OIMS Guidelines (the ECI Upstream
Guidelines). The ECI Upstream Guidelines contained eleven primary elements with
associated expectations, and a series of guidelines for the achievement of these expectations.
ECI intended that its affiliates, including Esso, should develop a management system in
which all the expectations outlined in OIMF and contained in the ECI Guidelines, were met.

13.2 The eleven elements referred to in the Guidelines were:

Element 1 - Management leadership, commitment and accountability;

Element 2 Risk assessment and management;

Element 3 - Facilities design and construction;

Element 4 - Information/documentation;

Element 5 Personnel and training;

Element 6- Operations and maintenance;

Element 7 - Management of change;

Element 8 Third party services;

Element 9 - Incident investigation and analysis;

Element 10 - Community awareness and emergency preparedness;

Element 11 Operations integrity assessment and improvement.

191
13.3 Utilising OIMF and the ECI Guidelines, Esso developed its Operations Integrity
Management System (OIMS). This management system was outlined within a manual
known as the OIMS Systems Manual and was detailed in a series of supplementary manuals,
charts and other "controlled" documents. A controlled document was one subject to
regulation by document management guidelines. The OIMS Systems Manual was the
centrepiece of OIMS. It set out the scope and objectives of each of the 11 elements and
identified each system owner, as well as the manuals and other documents falling within
each system or sub-system. The owner of a system was the person responsible and
accountable to ensure that the overall system was working and achieving its objectives in an
efficient manner.

13.4 It would lie outside the scope of this inquiry to attempt any evaluation of the ECI Guidelines
as the framework for Esso's management system. Such an inquiry would invite an
excursion into modem management theory as well as a detailed review of the systems'
antecedents. The Terms ofReference confine the Commission to a consideration ofEsso's
management systems as a possible cause of the explosion and fire at Longford on 25
September 1998 and the associated failure of gas supply.

13.5 The ECI Upstream Guidelines required the development and maintenance of procedures to
ensure the safe operation of the facility, to ensure that procedures were accessible to all
personnel required to use them, to ensure that deficiencies were identified and
improvements made, to deal with the safety of critical equipment, with the temporary defeat
of critical equipment and with the transmission of information between shifts. These
expectations (and the others contained in Element 6 ofthe ECI Upstream Guidelines) were
reflected in the OIMS Systems Manual. However, in many respects, there were
shortcomings in the way in which Esso implemented its OIMS system at Longford and thus,
in the way in which it implemented the ECI Upstream Guidelines.

Training

13.6 The ECI Upstream Guidelines called for the careful selection, placement, ongoing
assessment and proper training of employees. They also required Esso to maintain a
management system which ensured that the necessary levels of individual and collective
experience and knowledge were maintained. Further, they required Esso to provide for
ongoing refresher training and also to understand and apply the proper protective measures
to deal with safety, health and environmental hazards.

13.7 The system of training at Longford changed in 1993 from a "supervisor based" format to a
"competency based" format. The evidence was that a competency based training

192
 programme required trainees to demonstrate a knowledge of plant operations, to apply
acquired skills and to have an appropriate attitude to safety issues in respect of fellow
employees, equipment and the environment. It was unnecessary for the Commission to
undertake a detailed investigation of Esso's training programme or its particular training
techniques. This was because the accident on 25 September itself demonstrated the primary
deficiency in Esso's training. That deficiency lay in the failure of its training programmes,
however implemented, to impart or refresh the knowledge required to operate GP 1 safely in
the conditions which existed on the day. This is discussed further below.

13.8 At no relevant time did any programme include training with respect to the hazards
associated with the loss oflean oil flow, the hazards associated with the uncontrolled flow of
condensate into the rich oil stream from the absorbers, the critical operating temperatures for
GP922 and GP905, the circumstances in which brittle fracture might occur or the procedures
for the shutdown or start up of GP 1.

13.9 Workbooks were maintained by trainees in which they recorded answers to questions
forming part of their training and assessment programme. Whilst it is true that question 12
(Q12), forming part of the Technician 1 competency standard, referred to the loss of lean oil
flow, the "correct" answer, which was provided, ignored the real hazards associated with
such an upset:

Q 12 On the loss of the lean oil circulation pumps state what immediate action
should be taken.

A12 Investigate and rectify the problem and restart the system. If unable to restart
the system consider transferring the gas to other plants and ensure that main
gas chillers at optimum operation.

13.10 There was no reference to the existence of the 1975 Operating Instructions for Absorption-
Oil System nor was the relevant information contained in that document, adopted as part of
the correct answer. That work, published by Esso in 1975 (referred to in Chapter 12), was
known colloquially as "the Red Book." It was not a controlled document.

13.11 The Red Book contained a section headed "Loss ofLean Oil Circulation" and described the
circumstances in which a loss of lean oil flow would occur. It stated: "The loss of
circulation will cause an immediate and large increase in the WI; it will also cause a severe
upset in the ROF and a less severe upset in the ROD". The reference to "WI" is a reference
to the Wobbe Index, an index used in maintaining the production of gas in accordance with
given specifications. The Red Book contemplated a sudden loss of lean oil flow and

193
 detailed the action to be taken if the loss continued for more than five minutes. That action
included reducing gas flow and, in effect, isolating the absorbers.

13.12 Upon the failure to restart the GP1201 pumps and restore lean oil circulation, the source of
gas to the absorbers should have been shut-in or diverted. With evidence of excessively
cold temperatures in the ROD/ROF area, the absorbers should have been isolated, GP922
should have been depressured and the flanges inspected and repaired. GP905 should have
been isolated and allowed to thaw. No attempt should have been made to introduce warm
oil into an abnormally cold vessel.

13.13 The instructions given by the Red Book were in terms directed only to the maintenance of
gas production within specification. The hazards associated with the loss of lean oil flow
were not mentioned. In any event, the evidence was that the Red Book was not used in
order to operate the plant; the procedures contained in it were recognised by operators to be
out of date and, insofar as it was employed in training, it was for its process description.

13.14 The Red Book was said to be available to operators in GPI, but the only evidence of its
availability was that it was located in the training room adjoining the control room. It was
not to be found among the operating procedures available in the control room. The evidence
was that it was not consulted on 25 September 1998.

Operating Instructions

13.15 The ECI Guidelines provided in Element 6:

"Operation of facilities within established parameters and regulations is essential.

This requires effective procedures, structured inspection and maintenance systems,
reliable safety and control facilities and qualified personnel who consistently execute
these procedures and practices".

13.16 An example ofEsso's failure to implement OIMS is apparent from the state of the Longford
Plant Operating Procedures Manual which contained the operating procedures for GPI and
was located in the GPI control room. It was a controlled document and was identified by the
OIMS Systems Manual as part of OIMS. The manual did not comply with the guidelines in
critical respects. It did not contain any reference to the loss of lean oil flow and contained
no procedures to deal with such an event. Nor did it contain any reference to GPl shutdown
or start up procedures or the safe operating temperatures for GP905 and GP922. There was
no mention of the Red Book in OIMS, whether as part of the operating procedures, as a
training aid or otherwise.

194
13.17 It is difficult to understand why operating procedures dealing with a lean oil absorption plant
did not include any reference to the importance of maintaining lean oil flow in the operation
of the plant. Plainly that was something which was fundamental.

Operator Knowledge

13.18 The deficiencies in operator training and operating procedures were reflected in the evidence
of what the operators and supervisors actually did on 25 September 1998. The problem in
the ROD/ROF area of GP 1 which attracted the attention of plant operators and supervisors
was a leak in the flanges of GP922. The steps taken around mid-day to restart the lean oil
pumps were undertaken in an effort to restore heat in GP922 in order to reduce the
temperature differential across the flanges. This was thought to be responsible for the leaks.
The collective experience of those present at GP922 on 25 September 1998 was more than
200 years at Longford and yet no one recognised the hazards associated with the plant
conditions which culminated in the explosion and fire.

13.19 Jim Ward was the GPl control room operator on the day of the incident. He had been
employed by Esso for 18 years with 11 years experience as an operator. He said he did not
appreciate the seriousness of a loss of lean oil flow at the time. His understanding was that
if the lean oil system did not operate, the plant would produce off-specification gas. His
evidence demonstrated a less than adequate understanding of the lean oil absorption process
and, in particular, the consequences of process excursions or upsets.

n.20 Greg Foster was a recently qualified technician 1 operator on duty in GP 1 on the day of the
accident. He had had only two years experience at Longford. His training had commenced
in 1996. He said he was not taught the temperatures at which relevant equipment was
designed to operate. Nor was he made aware of low temperature protection devices or
alarms. He said that there was no training to warn of the risk of equipment failure at low
temperatures. He had no idea of the consequences of metal becoming brittle.

13.21 Ron Rawson was on duty on the day of the accident. He was an area operator with 18 years
experience. He said that his concern about the loss of lean oil was in relation to the leak in
GP922. He did not appreciate that there might have been a serious risk to equipment or to
safety if the heating medium was not restored within a fairly short period of time after it
ceased to flow. He was not aware that the cessation oflean oil circulation for more than 10
to 15 minutes was a very serious matter. He thought the only consequence would be that
gas would be "off-spec".

195
13.22 lan Kennedy was a relief day supervisor on duty on the day of the incident. He had 27 years
of experience, first as an operator, then as shift supervisor, maintenance planner and
maintenance supervisor. His understanding of the consequence of a loss of lean oil flow
was that it "puts your Wobbe index off-spec." He was not aware of the risk of brittle
fracture. He said that he and Shepard were trying to warm up GP922 to see if the gasket
was still going to hold. They were acting on the assumption that they had a small flow of
lean oil.

13.23 Mike Shepard was production co-ordinator, crude and power generation, at Longford with
28 years experience as an operator, supervisor and training co-ordinator. He was on duty on
the day of the accident and was asked for assistance between 11.40 am and mid-day on
25 September 1998. The lean oil system was his special interest. He said he was aware that
"brittle fracture could easily be had if we didn't make sure that we didn't apply thermal
shock to those vessels (GP905 and GP922)". Shepard participated in the restart of the
GP1204 and GP1201 pumps at about mid-day. He and others "were trying to get lean oil
flow through the 905 and 922 exchangers". When seeking to manipulate the TRC4 valve he
knew that "lean oil may already be progressing through the system". He said that when he
looked at GP905, "I felt that it couldn't be left as cold as it was".

13.24 Shepard also said, somewhat inconsistently, that he wanted the lean oil to bypass the
exchangers. This was, he said, because of his awareness of the risk of brittle fracture and
thermal shock. Even so, he made no attempt to stop the GP1204 or GP1201 pumps once
operating or to interfere with the attempts to restart the GP1201 pumps.

13.25 Had Shepard truly understood the potential danger he would have stopped the GP1204
pumps and cleared the site rather than engage in the steps which he described in evidence.
At the very least, he would have ensured that the steps he took to minimise lean oil
circulation through the exchangers, were taken before the GP1201 pumps were restarted.
Shepard concentrated his attention on the leak from the flanges of GP922 without any real
appreciation of the dangers arising from the condition ofGP905. The solution to the leak, as
far as Shepard was concerned, involved the elimination of the temperature differential in
GP922 by the re-introduction of warm lean oil.

13.26 Bill Visser was a plant supervisor on duty at Longford on the day of the incident. He had 18
years of experience. He thought that the only consequence of the loss of lean oil flow in
GPl was its effect on the quality of gas produced. His decision to shut down the flow of
inlet gas was made to avoid the production of off-specification gas. He said that he did not
know of any danger involved in the loss of lean oil flow. Visser was unaware of the cold

196
 temperature rating of vessels. He did not understand, nor did his training permit him to
understand, any danger associated with cold brittle fracture.

13.27 Had the operators, supervisors and superintendents dealing with the problems in GP1 on 25
September 1998 had the opportunity to enlist the advice and assistance of the plant manager
or the operations manager, it would not have helped. Will Harrison, an engineer and
Longford plant manager, was unaware of the critical operating temperatures of GP905 and
GP922. He did not know that the loss oflean oil circulation would result in the plant getting
colder, nor did he know of the dangers of cold metal embrittlement. The fact that lean oil
flow had stopped for some hours would not have "rung a specific alarm bell". In any event,
on the day of the accident, Harrison was attending a meeting at Long Island Point.

13.28 Peter Coleman was operations manager at Esso. His responsibilities included management
of operations at the Longford plants. Harrison reported directly to Coleman. Coleman was
an engineer. He had been operations superintendent at Longford between December 1993
and October 1994. Coleman agreed that the instruction given to operators "failed in arming
them to recognise the significance of cold temperatures ... there was clearly a lack of
knowledge or understanding of cold temperatures." He said he had no idea, before the
accident, that a loss oflean oil flow for any length of time would be a hazard.

13.29 Esso challenged the evidence of the operators and, in particular, that given by Ward. It
relied upon OIMS, its operator training programmes, the Red Book and expert evidence
from witnesses such as Kenneth Baker. Baker said that the loss of lean oil circulation was a
fundamental issue to be addressed in GPl. He said that operators failed to do things on the
day of the accident "that are so basic in a lean oil plant ....and so standard in the industry and
in a plant of that type ..... ". He said that the hazards associated with the loss oflean oil flow
were well known.

13.30 Esso also relied upon the evidence of Luke Mus grave, the Longford gas restoration project
manager, to support its contention that operators were adequately trained in appropriate
responses to the loss of lean oil circulation. In 1994, Musgrave had been appointed plant
manager at Longford and he·held that position until 1996 when Harrison took over. He gave
evidence that he had knowledge of the consequences of the loss of lean oil flow and said
that he acquired that knowledge from discussions with operators, reading the Red Book and
from some courses which he attended. The discussions to which Musgrave referred were
said to be with Ray Wilson, Peter Wilson (who died in the accident) Shepard and Brack.
Musgrave said that as a result of those discussions he concluded that "They were aware of
consequences associated with the loss of lean oil and in my training communicated some of

197
 those consequences to me." Evidence to that effect was not elicited from Ray Wilson or
Shepard when they were in the witness box and the events of 25 September 1998 belie the
knowledge which Musgrave said those witnesses had. Moreover, ifMusgrave acquired the
knowledge which he said he did, he did nothing as plant manager to ensure that the written
operating procedures contained instructions to be followed in the event of loss of lean oil
circulation.

13.31 The Commission concludes that the evidence of the operators and supervisors on the day of
the incident best describes the state of their knowledge. Even if some aspects of that
evidence can be criticised, the actual events which occurred on 25 September 1998 are a
sure indication of a deficiency in the knowledge required to operate GPl safely.

Inadequate Supervision

13.32 Quite apart from the adequacy of knowledge, the events leading up to the accident disclosed
a number of instances where operators failed to adhere to basic operating practices. Some of
these practices were written, for example, those relating to shift handover and operator log
entries. These are discussed later in this chapter. Others would seem to be matters of
common sense and include monitoring plant conditions, responding appropriately to alarms,
reporting process upsets to supervisors and undertaking appropriate checks before making
adjustments to process variables.

13.33 These failures were not confined to operators or to any one shift. Indeed, the evidence
suggests that some of the failings were so prevalent as to have become almost standard
operating practice. These practices could not have developed or survived had there been
adequate supervision of day to day operations by Esso management. The change in
supervisor responsibilities, discussed later in this chapter, may have contributed by leaving
operators without properly structured supervision. Monthly visits to Longford by senior
management failed to detect these shortcomings and were therefore no substitute for
essential on-site supervision.

OIMS SelfAssessments

13.34 Element 11 of the ECI Guidelines, which were translated into Esso's OIMS Systems
Manual, required a "process that measures the degree to which expectations are met" and
regarded that requirement as essential "to improve operations integrity and maintain
accountability". That meant that Esso's OIMS were required to include a system to ensure
that these guidelines were met and, in particular, that Esso's operations were assessed at
predetermined frequencies to establish the degree of compliance.

198
13.35 An external assessment was carried out by a team under the leadership of Wayne Achee in
March and April 1998. A report of the assessment was prepared and sent to Sikkel. The
report acknowledged that the assessment was required by element 11 of the ECI Guidelines
to determine the extent to which Esso was meeting the guidelines and the requirements of its
individual management systems. The report noted that the assessment team had concluded
that Esso had successfully applied OIMS and had a high level of management involvement
and participation, presumably in that process.

13.36 The report further noted the following achievements:

• There was a common set of operating manuals, references and records which were
identified and in place at all sites.

• There was an extensive set of operations and maintenance procedures which were
updated at specified intervals as changes occurred.

• There was a good understanding of and high discipline in safe work routines and
procedures.

• There was a structured and disciplined process in place for shift handover for offshore
and onshore operating sites.

• There was a comprehensive incident reporting, investigation and analysis system which
was well understood throughout the organisation. Esso personnel were well disciplined
in following their procedures.

• Near miss reporting was actively encouraged by management and supported by Esso
personnel.

13.37 These (and other) observations of the assessment team appear inconsistent with the
Commission's findings concerning the failure of Esso to implement its own systems,
particularly in relation to risk identification, analysis and management, training, operating
procedures, documentation, data and communications. The Commission can only conclude
that the methodology employed by the assessment team was flawed in that the team failed to
identifY significant deficiencies in the extent to which "individual EAL Management
Systems" conformed to the guidelines, particularly in relation to GP 1, and were
implemented.

199
 Observations

13.38 Evidence was given that OIMS was a world class system and complied with world's best
practice. Whilst this may be true of the expectations and guidelines upon which the system
was based, the same cannot be said of the operation ofthe system in practice. Even the best
management system is defective if it is not effectively implemented. The system must be
capable of being understood by those expected to implement it.

13.39 Esso's OIMS, together with all the supporting manuals, comprised a complex management
system. It was repetitive, circular, and contained unnecessary cross referencing. Much of
its language was impenetrable. These characteristics made the system difficult to
comprehend both by management and by operations personnel.

13.40 The Commission gained the distinct impression that there was a tendency for the
administration of OIMS to take on a life of its own, divorced from operations in the field.
Indeed, it seemed that in some respects, concentration upon the development and
maintenance of the system diverted attention from what was actually happening in the
practical functioning of the plants at Longford.

13.41 However, the fundamental shortcoming was in the implementation of OIMS, as seen in the
inadequate state of knowledge of Esso personnel of the hazards associated with loss of lean
oil circulation in GP 1 and of the actions which could be taken to mitigate such hazards. As
a consequence of this lack of knowledge, practices adopted by operations personnel fell far
short of good operating practice and were inimical to the safe operation of the plant on that
day. Mark Sikkel, a director of Esso and the person responsible for exploration and
production, accepted that the manner in which operators carried out their work was "an
immediate and potent indicator of the success of management systems." Dr Raymond
Stickles, an expert called by Esso, agreed.

13.42 Reliance placed by Esso on its OIMS for the safe operation of the plant was misplaced. The
accident on 25 September 1998 demonstrated in itself, that important components ofEsso's
system of management were either defective or not implemented. If the implementation of
OIMS by Esso was to be measured by the adequacy of its operating procedures, they were
deficient and failed to conform with the ECI Upstream Guidelines or with the OIMS
Systems Manual. If it was to be measured by reference to the actions and decisions of those
persons who were attempting to resolve the process upsets on 25 September 1998, they were
also deficient. The deficiencies were in the manner in which Esso dealt with the acquisition
and retention of knowledge. This involved its training system, its operating procedures, its
documentation and data system, and its communication system.

200
 RISK ASSESSMENT AND MANAGEMENT

OIMS

13.43 The central importance of co-ordinated and planned hazard identification, assessment and
control to the safe and efficient operation of a processing facility, is well recognised
throughout the processing industr;y. Almost all modem processing operations have some
form of risk management system designed to identify, evaluate and assess risks and to create
systems for their control.

13.44 Element 2 of Esso's OIMS identified the risk assessment and management system. Esso's
own expectations in relation to risk assessment and management were set out in the
introduction to Element 2, where it was stated:

"The identification, assessment, mitigation and control of risks is a necessary part of

oil and gas operations. This system is intended to ensure these activities are
undertaken."

"The objective of the risk assessment and management system is to ensure hazards
are identified and risks evaluated throughout the life cycle of the operation from
initial field survey to eventual facility de-commissioning. We recognise that
comprehensive risk assessment can reduce risk and mitigate the consequences of
safety, health, and environmental incidents by providing essential information for
decision making."

13.45 The methods by which risk assessment and management were to be carried out were
detailed in the Risk Assessment Manual (RAMS). RAMS set out a systematic programme
of risk assessment at three levels: "structured risk assessment", "operational management"
and "field risk control''. Each level applied different but related risk assessment techniques
to different levels of Esso's operations, ranging from day-to-day operation of the plant by
operations personnel to formal or structured risk assessment conducted by the Production
Technology Department.

13.46 The highest level required planned hazard identification and risk assessment to take place in
various circumstances. These assessments embraced Periodic Risk Assessments (PRAs)
which were to take place at intervals specified by RAMS; Quantitative Risk Assessments
(QRAs) which were detailed risk studies carried out as needed to assess specific major
hazard risks; and triggered risk assessments which were scenario-based assessments
prompted by the happening of particular events.

201
13.47 At the next level there were hazard identification techniques to be used by employees and
management in the course of operations. These included the use of check lists, analyses
based upon the question "what if?" and hazard and operability (HAZOP) studies, either
prospective or retrospective, conducted when the need appeared to identifY particular
hazards involved in the operation of the plants.

13.48 At the lowest level there were hazard identification "tools" to be used by operators to
identifY hazards and mitigate risk on a daily basis. These tools, or techniques, primarily
comprised "step back 5x5" (stepping back 5 paces and pausing for five minutes to reflect
upon likely hazards) and task analysis.

Hazard Identification

13.49 The core ingredient of effective risk assessment and management is hazard identification. In
the text "Loss Prevention in the Process Industries", Professor F. P. Lees, a recognised
expert on loss prevention, states:

"The identification of areas of vulnerability and of specific hazards is of fundamental

importance in loss prevention. Once these [hazards] have been identified, the battle is
more than half won."

13.50 The crucial significance of hazard identification to effective risk assessment and
management, was recognised by Esso and its parent, Exxon, in the Exxon Process Hazard
and Operability Review, 1993:

"To prevent the undesirable consequences of accidents, one must first identifY the
hazards which can lead to accidents. Once the hazards have been identified, a major
stumbling block to loss or accident prevention has been overcome."

13.51 This point was illustrated by the Exxon model shown in Figure 13.1 of that Review. Put
simply, hazard identification creates knowledge.

202
 INCIDENT INVESTIGATION OPERATIONS INTEGRITY MANAGEMENT SYSTEM
AND ANALYSIS TlliRD PARTY SERVICES

HAZARD CONTROL SAFETY

IIIGHILOW VALVE
LEVEL WORK PERMIT
HAZARD EVAL ATION OVER·
SYSTEM
SHUTDOWN
PERSONNEL "-'-
(Wl
_lA_T _CAl"
_ · GO_W_I_W_N_G); _ _ _ - , PRE SURE
AND
TRAINING HAZARD IDENTIFICATION
PRESSURE
WEUl m(PI.OSIVE MANAGEMENT
INSPECTION AI.ARM
OEfEl"fS OI'CHANGE

OXIDIZ.ER

COMMUNITY
TOXIC TEMPERATURE
AWARENESS
RISK INDICATOR
_ _ . - - - - - - - - - - - " SHUT- IN AND
ASSESSMENT
PU i'tl' EMERGENCY
AND EMERGENCY RUNAWAY
PREPAREDNESS
MAI"AGEMEl\'T PROCEDURES RE l"fiON
L-------------------------------~
RUPTURE OPERATING MA~TENANCE
DISC PROCEDURES PROCEDURES

PROCESS AND CRITICAL SYSTEM CO)ITROL OVER PROCEDURE

FACH.ITIES TESTING / PM CRITICAL SAFETY SYSTEM
DOCUMENTATION DEVICE DEACTIV/\TIOI"

Figure 13.1 Exxon Hazard Management Process

HAZOP Study ofGPJ

13 .5 2 With the introduction of OIMS in the early 1990's, there was a requirement for the carrying
out of HAZOP studies as part of the design process for new plant. OIMS also contained
provision for retrospective HAZOP studies on existing plant, should they be called for. GPI
was constructed well before the introduction of OIMS and, indeed, before the use of
HAZOP studies became common practice in the process industry. Following the
introduction of OIMS, Esso recognised the need to undertake retrospective HAZOP studies
of all its major facilities. Retrospective HAZOP studies were conducted for GP2 in
September 1994, for GP3 in November 1994 and for the CSP in December 1995.

13.53 Esso recognised the particular significance of a HAZOP study for GP I, given the age of the
plant, the modifications made to its initial design and the changes to design standards since
the plant was built. These reasons grew stronger with the passage of time. Indeed, a
HAZOP study for GP I was planned to take place in 1995 and the cost of such a study was
included by Esso in successive budgets during the years 1995 to 1998.

13 .54 The HAZOP study planned for GPl never took place. Various explanations were given for
this failure. It was said that it would have taken a long time to complete and would have
picked up too many little items. It was also said that Esso wanted to evaluate the HAZOP
process more fully before undertaking such a study for GPI. Further, it was suggested that
the resources required for a HAZOP study of GPl could be more usefully allocated to
higher priority areas such as the risks identified in a 1994 PRA. In the end, no satisfactory
reason was given in evidence for its deferral or abandonment.

203
13.55 A HAZOP study of GP! in accordance with Esso's methodology would have sought to
identifY "any significant route to a process upset, operating problem or hazardous incident".
To achieve this objective, the study would have systematically described and questioned
each part of the GP I process to identifY what deviations from design intention could
conceivably occur. It would also have evaluated the causes and consequences of such
deviations. It would have considered items of operability as well as safety. Not only that,
but the direction of the investigation would have been dictated by reference to guide words
which included the phrases "high level", "low temperatures" and "no flow". Given this
systematic approach, it is inconceivable that a HAZOP study of GP I would not have
revealed factors which contributed to the accident which occurred on 25 September 1998. It
would, for example have revealed the consequences associated with loss of lean oil flow and
would have identified the procedures to be adopted in order to avoid dangerously low
temperatures.

The McNeil Report

13.56 Esso's own investigation, which resulted in the McNeil Report, involved the production of a
document which was apparently a draft to be used in the compilation of the final report. The
draft document was seized by the Coroner shortly after the explosion and fire. It contained
the unequivocal statement: "The lack of a detailed HAZOP for GPI is considered a
contributing factor to this incident". That statement did not appear in the McNeil Report in
its final form, but there was no evidence to explain its exclusion. All the members of the
investigating team were from overseas and were no longer in Australia and available to the
Commission at the time of its hearings. Esso did not seek to call any member of the
investigating team to give evidence. In the circumstances, the Commission concludes that
the omission of the statement from the final report does not in any way detract from its
force.

PRAsofGPJ

13.57 Until October 1996, RAMS required that PRAs be carried out for existing production and
processing facilities at intervals specified in a table contained in the manual. Sites were
given priority so as to ensure that higher risk sites were more frequently re-assessed. Re-
assessment intervals ranged from three years (Priority 1) to five years (Priority 3). GP I was
given the highest priority for the conduct of PRAs.

13.58 Notwithstanding the failure to carry out the HAZOP study planned for GP!, a PRA of GPI
was carried out in 1990 and again in 1994. The latter was in accordance with the existing
RAMS timetable. In October 1996, however, a "rationalisation" of risk assessment under

204
 OIMS was carried out. This resulted in the replacement of priorities for PRAs by a flat five
year interval between PRAs for all onshore and offshore facilities.

13.59 There was little evidence of the nature ofthe 1990 PRA, although certain scenarios which it
used were also used in the 1994 PRA. The 1994 PRA was, however, limited in scope
because a HAZOP study for GPl was then proposed for the following year. The 1994 PRA
expressed this limitation as follows:

"The assessment targeted higher level risks, and was designed to complement
forthcoming other more detailed studies, such as HAZOP, and QRA. It is understood
that a detailed HAZOP study of Gas Plant 1 is proposed for mid-1995. Therefore the
focus of this assessment was on analysing and identifying areas of risk not previously
identified, or those not likely to be covered in the detailed HAZOP analysis"
(emphasis added).

13.60 Accordingly, the 1994 PRA was directed away from process-related hazards and
concentrated on hazards caused by mechanical equipment failure and operator error.
Scenarios addressing the consequences of "low temperatures", "high level" and "no flow"
were not used. Indeed, no scenario was used which included any of the process upsets
which occurred in GPl on 25 September 1998.

13.61 Before the OIMS rationalisation in October 1996, a PRA of GP 1 was planned to take place
in 1997. As a consequence of the rationalisation and the introduction of a five year interval
between PRAs, the PRA planned for GP 1 in 1997 was postponed to 1999.

Observations

13.62 The combined affect of the failure to conduct a HAZOP study ofGP1, the limitation placed
upon the scope ofthe 1994 PRA and the postponement of the PRA planned for 1997 meant
that there was no identification of major hazards in GP 1 and, in particular, no identification
of the hazards which revealed themselves on 25 September 1998. Notwithstanding the high
aims of OIMS, no formal hazard identification or structured risk assessment of any kind
took place in GP 1 after 1994.

13.63 Despite the efforts of the Commission to ascertain whose decision resulted in the deferral or
abandonment of a HAZOP study for GPl, no one would accept responsibility for the
decision. However, the decision to defer the 1997 PRA was a decision of an executive
committee of Esso's Board of Directors. That decision must have been made with the

205
 knowledge that the scope of the 1994 PRA was curtailed because of a planned HAZOP
study which never took place.

13.64 Whatever the reason for failing to carry out a HAZOP study for GPl, the failure to do so
carried with it the risk that hazards would remain unidentified and uncontrolled. The events
of 25 September 1998 demonstrated the existence of such hazards. Had a HAZOP study of
GPl been conducted, as Esso initially believed it should, Esso would have acquired
knowledge of those hazards which, as it transpired, were critical. In due course, that
knowledge would have been disseminated by way of training, the development and use of
procedures and the adoption of protective control systems. In short, the failure to conduct a
HAZOP study of GPI contributed to the disaster which occurred on 25 September 1998.

MANAGEMENT OF CHANGE

13.65 Attached to and forming part ofElement 7 was Esso's Management of Change Philosophy
dated August 1993 (the philosophy). In the philosophy, Esso recognised that change was
"necessary and desirable" as part of the operation of a facility but also recognised that
"changes potentially invalidate prior risk assessments and can create new risks, if not
managed diligently".

13.66 The philosophy contained management of change procedures to be followed in undertaking,

amongst other things, any modification or addition to an existing facility. These procedures
required any permanent change to an existing facility to be accompanied by a risk
assessment of the change, consistent with the procedures in OIMS Element 2, "Risk
assessment and management". The primary purpose of such an assessment was to
determine the impact of the proposed change on the safe operation ofthe facility.

13.67 However, OIMS Element 2 did not identify any procedures for risk assessment associated
with management of change. The only reference to this topic was in the following terms:

"Production Technology operate within a management of change procedure which is

consistent with the EAL management of change philosophy."

13.68 Moreover, neither OIMS Element 7 (Management of change) nor OIMS Element 2 (Risk
assessment and management) made any attempt to define the breadth or scope of any risk
assessment study to be undertaken to comply with management of change procedures.

206
 Condensate Transfer from GPJ to GP2

13.69 Before 1992, all condensate produced in the lower section of the absorbers in GPl was
processed within GP 1 by directing the flow of the condensate from the absorbers to the
Condensate De-ethaniser, GPll06. In 1992, a modification was made to the absorbers to
create an additional flow path for condensate from the lower section of the GPl absorbers to
the GP2 Demethaniser. The modification enabled the more efficient recovery of ethane,
using the cryogenic processes within GP2, than was possible within GP 1.

13.70 The condensate transfer line to GP2 was installed in late 1992, based on a design by a
company called Restech Consultants. At the time of design, the modification was subject to
a hazard identification study which applied the HAZOP guide word "technique". However,
the review differed from a full HAZOP study as defined in Esso's HAZOP methodology.
The scope of the study was confined to a consideration of the impact of the 1992
modification on the pipeline connecting the two vessels involved in the transfer process,
namely the GPl absorbers and the GP2 Demethaniser. The study made no attempt to
identify hazards associated with, or to evaluate the impact of, the proposed modifications on
other parts ofGPl, particularly the vessels downstream from the absorbers in the ROD/ROF
area.

13.71 Importantly, in considering the impact of the modification on the transfer pipeline, the 1992
study identified condensate carryover into the absorption oil system as a potential outcome
of high levels of condensate in the absorbers. It did not, however, examine the effect of
condensate carryover on vessels downstream from the absorbers in GPl. This was because
of a conclusion reached by those involved in the study, that condensate carryover was "not a
new phenomenon" and that it should " ... be handled in the same way as it is handled now".
The study noted that no follow-up action was required.

13.72 Between 1993 and 1996, further modifications were made to the condensate transfer system
to overcome operational problems. Unlike the 1992 modifications, these further
modifications were not subjected to any hazard identification study before implementation.
Further modifications to the process were implemented in 1997 in accordance with design
modifications proposed by consultants, Shedden Uhde. These modifications were to
overcome flow meter measurement problems occurring in the condensate transfer line.

13.73 A hazard identification study of similar scope to the 1992 study was undertaken to assess the
impact of the Shedden Uhde modifications. Again, this study identified the potential for
process upsets to cause carryover of condensate from the absorbers into the rich oil stream

207
 but again, the study did not examine the potential impact of this carryover on existing
vessels in GPl. Instead, the study dismissed this phenomenon as not significant.

13.74 The Shedden Uhde modifications were introduced into operation but did not work as
planned. As a consequence, revised operating practices evolved to cope with these
difficulties. These practices involved automatic valve adjustments (required to initiate and
to terminate condensate transfer) being abandoned in favour of manual manipulation of
valves by operators. These revised practices invalidated the previous risk studies
undertaken, yet were not themselves the subject of any management of change risk
assessment.

13.75 The end result was that by 1998, operators at Longford were regularly transferring
condensate to the GP2 Demethaniser using a transfer system that had never been the subject
of a comprehensive management of change risk assessment. Between 1992 and 1998, this
system had been substantially modified from the original design in a way which invalidated
the limited hazard identification studies undertaken in 1992 and 1997. As a consequence,
for some time before the accident on 25 September 1998, operators were transferring
condensate to GP2 for product recoveries without a full understanding of the potential
hazards associated with the process.

13.76 As is now apparent, the cold temperatures resulting from the carryover of condensate from
the absorbers into the rich oil stream was a central feature of the accident which occurred on
25 September 1998. Whilst condensate transfer was not taking place at the time of the
accident, it was taking place between 3.20 pm on 23 September and 3.26 pm on 24
September. During this period, the cold temperature of the condensate passing from
Absorber A to the Condensate De-ethaniser in GP 1 contributed to an increase in the TC9B
override oflevel control in Absorber B.

13.77 Moreover, although transfer ceased around 3.26 pm on 24 September, the setpoint
adjustment required to increase the temperature of Absorber B (from -20°C to -10°C) was
not made until the night shift on 25 September when two separate adjustments were made.
Thus, unnecessarily low condensate temperatures in Absorber A continued to contribute to
override problems until well into the night shift leading up to the accident.

13.78 The need, during periods of condensate transfer, to operate the GP1 absorber bottoms at a
lower transfer temperature than its design operating temperature, resulted in more frequent
TC9B override of absorber level control and higher levels of condensate in the absorber
bottoms. This in turn led to increased frequency of TC9B alarms and high level alarms for

208
 the absorbers. As explained under the heading "Operation in alarm mode", over time this
led to a tolerance by operators of alarm conditions in the absorbers. The effect is to be seen
in the operators' failure to respond to absorber high level alarms and TC9B alarms in the
days leading up to the accident.

Relocation of Plant Engineers from Longford to Melbourne

13.79 Until 1991, engineers were stationed at Sale and worked at the Longford plant daily. In
doing so, they had a close involvement with the ongoing operation of the plant and constant
interaction with operations personnel. This placed them in an ideal position to monitor the
plant operating conditions and operator practices.

13.80 In 1992, Esso relocated all its plant engineers to Melbourne as part of a restructuring of the
company. This relocation has been discussed in Chapter 2 and is further mentioned in
relation to the role of plant surveillance discussed later in this Chapter.

13.81 The change appears to have had a lasting impact on operational practices at the Longford
plant. The physical isolation of engineers from the plant deprived operations personnel of
engineering expertise and knowledge which previously they gained through interaction and
involvement with engineers on site. Moreover, the engineers themselves no longer gained
an intimate knowledge of plant activities. The ability to telephone engineers if necessary, or
to speak with them during site visits, did not provide the same opportunities for informal
exchanges between the two groups, which are often the means of transfer of vital
information.

13.82 The relocation of engineers qualified as a permanent change to operating practices requiring
risk assessment and evaluation before implementation in conformity with Esso's
management of change philosophy. Yet such relocation was implemented without any such
assessment ever taking place.

13.83 There were no experienced engineers on site at the time of the accident on 25 September
1998. Expert knowledge from that source, of plant operating parameters, of the
metallurgical limits of equipment and vessels in GP1 and of the consequences of cold
temperatures resulting from loss of lean oil circulation in the ROD/ROF area, were absent.

Changes to Role and Responsibilities of Operators and Supervisors at Longford

13.84 In mid-1993, changes were made to the respective roles and responsibilities of operators and
supervisors at Longford. Further changes were made in 1996 and 1997 with the
consequence that operators assumed a greater responsibility for the day to day operation of

209
 the plant, including troubleshooting to overcome process irregularities. There was also a
reduction in the number of plant supervisors and a reduction in the number of plant
operating areas. These changes are more fully explained in Chapter 2.

13.85 These structural changes were clearly intended to alter operating and supervisory practices
at the plant and thus required management of change risk assessment and evaluation
pursuant to Esso's management of change philosophy. Again, no such assessment was
carried out. Though the existence of a link between this failure and the occurrence of the
accident is hard to evaluate, appropriate management of change risk assessment may have
exposed important and relevant weaknesses in the level of operator knowledge, in training
programmes, in communication systems, in operating procedures and in other aspects of
Esso' s management system.

Reductions in the Numbers of Maintenance Personnel

13.86 Reductions in the numbers of maintenance personnel at the Longford plant occurred
between 1993 and 1998. These are discussed in Chapter 2. The evidence did not indicate
that the changes to maintenance operations contributed to the occurrence of the accident on
25 September 1998. However, none of the changes were subject to any management of
change risk assessment as required by OIMS.

COMMUNICATION CONTROLS

13.87 The safe and efficient operation of a processing facility depends to a significant extent upon
the dissemination of information and knowledge amongst those involved in the operation of
the plant. OIMS, as applied at Longford, required certain channels of communication in
order to facilitate the exchange of information. For example, it was a requirement that
operators use the handover at the end of each shift for this purpose. Apart from OIMS, there
were other protective systems, such as alarms, to ensure that essential information about the
process came to the attention of plant operators.

13.88 Also important in the operation of a processing facility is the existence of some means
whereby the operation of the plant and the practices of operators are systematically
monitored to eliminate unsafe or inefficient operations. There was no evidence that any
system existed at Longford for the regular monitoring of operating conditions or operator
practices.

210
 GPJ Control Room Log and Shift Handovers

13.89 To facilitate the communication of process information and knowledge amongst operations
personnel, the Longford Work Management Manual procedure LWMM 070-012, required
operators and supervisors:

• to conduct verbal handover communications at the start and finish of each operating
shift; and

• to complete log entries in a designated log book at the conclusion of each shift.

13.90 The LWMM referred to is that reissued in October 1997. There was evidence of a draft
Esso Work Management Manual, apparently issued in July 1998, which also listed the
requirements for handover. However, it is unclear to what extent this document remained a
draft on 25 September 1998. In any event, its requirements appear to have been more
stringent than those of the LWMM and it is convenient therefore to proceed upon the basis
that the LWMM contained the applicable instructions.

Shift handovers
13.91 The shift handover requirement can be stated simply. It required panel operators, at the
conclusion of each shift, to " ... meet with their relief in the Control Room to hand over the
operation oftheir area and to discuss the content of the ... log".

13.92 A number of operations personnel were asked about the form and content of handover
communications. On the whole, the evidence revealed that verbal discussions between
operators usually did accompany shift change, but often without any real effort to convey
process problems or to discuss the content of log entries. The length of the discussions
tended to depend on the discretion of the operator and they predominantly concerned
product issues, such as VENCorp gas demands or gas rates.

13.93 The evidence disclosed particular shortcomings in the handover discussions that took place
for the shifts immediately before the accident on 25 September 1998.

13.94 Most significant was the content of the handover discussion at the commencement of the
critical day shift on 25 September. There were shortcomings in the exchange of information
that took place between the night shift operator, Olsson, and his relieving panel operator,
Ward. Olsson identified problems which he had experienced during the night with the rate
of condensate coming into the slugcatchers from offshore. He also made reference to cold
condensate temperatures which he had experienced in Absorber B and to problems which he

211
 had experienced in controlling the temperature of this absorber throughout the shift. He
made no reference, however, to the off-scale, high condensate levels in Absorber B, or to the
frequent occurrence of TC9B interference with level control, both of which he had
experienced during the night. Nor did he make any reference to the frequent incidence of
alarm warnings acknowledged by him during his shift. These warnings had accompanied
the high condensate levels and the TC9B override. Nor did he convey to Ward the fact that
the alarms for high Absorber B condensate levels and TC9B interference were still active at
the change of shift, indicating not only that the levels were still high, but that level control
had still not been regained hy the time of the change.

13.95 Because the alarms associated with high condensate levels in Absorber B and TC9B
override had been acknowledged well before the conclusion of his shift, Ward was not
presented with any audible alarm signal for these alarms at the time he relieved Olsson. As
a consequence, the active state of these alarms would not have been immediately apparent to
him and would not have become apparent unless he looked at the status of those alarms on
the Bailey alarm page.

Control room and shift supervisors' logs

13.96 The other method of communication upon handover was through the control room log. This
log was kept on the control room desk. Panel operators were required to record in it "the
activities that have taken place in their operating areas, during the shift". Those activities
included changes made during the shift to key process parameters and the results of such
changes, any process or machinery problems encountered, any safety systems or devices
defeated (including bypasses in the outside areas) and any controllers that were being
operated in manual and the reason why.

13.97 In practice, however, operators did not keep control room logs in accordance with the stated
requirements. An examination of the GPI control room log revealed that entries were
usually short and often contained only limited process information. There was
inconsistency in the way entries were made and in their subject matter. Process issues, if
referred to, often received only scant attention. Standing on their own, log entries were
often confusing and incomplete. On frequent occasions, panel operators made no log book
entry at all at the conclusion of a shift.

13.98 The log book entries made by the GP 1 panel operators leading up to the accident on 25
September 1998, did not contain any reference to the abnormal process conditions occurring
in Absorber B. These conditions had been occurring almost constantly from the afternoon
of 23 September until the accident.

212
13.99 The log book entries made by Olsson for the night shift preceding the critical shift suffered
from the same defects. His entries made no reference to the high condensate levels in
Absorber B, to the interference with absorber level control caused by the TC9B override, to
the fact that the TRC3B bypass valve was being operated manually or to the difficulties he
had experienced in controlling the temperature of condensate at the base of Absorber B in
the absence of automatic temperature control.

Observations
13.100 It was against this background of uninformative handover communications and log book
entries that the loss of lean oil circulation, which preceded the accident on 25 September
1998, took place.

13.101 At the commencement of the day shift on 25 September 1998, the outgoing GPI panel
operator had an obligation to tell the relieving operator, not only about the cold temperatures
in Absorber B, but about the off-scale levels of condensate in that vessel. Both of these
conditions had existed for some time. Olsson should at least have told Ward about the
almost constant occurrence of the Absorber B high level alarm and the TC9B alarm and the
fact that such alarms were still active at changeover. Indeed, the purpose of the handover
procedure as a communication tool was to ensure that important process information was
passed on. In the same way, Olsson's log book entries at the conclusion of his shift could
have been, and should have been, more informative. They should also have made reference
to these matters.

13.102 At 7.30 am, Ward gave Rawson a direction to close the TRC3B bypass valve. As discussed
in Chapters 3 and 5, this caused the temperature of condensate in the base of the absorber to
plummet and exacerbated the conditions which brought about the shutdown of the GP1201
pumps at 8.19 am. In his evidence, Ward said that at the time of directing Rawson to close
the TRC3B bypass, he was not aware of the high condensate levels in the base of Absorber
B, nor of the very cold temperatures of the condensate. He said he had not been told about
the high levels by Olsson. Whilst he did conduct his own Bailey checks following
handover, he said he did not detect the off-scale, high levels in Absorber B. As a
consequence he made the direction to Rawson without appreciating that it was
inappropriate.

13.103 Had Ward's attention been directed to these matters he may well have taken steps to see that
the temperature and level of condensate in Absorber B were more appropriately managed.
He would not have directed Rawson to close the TRC3B bypass, as he did at 7.30 am. On

213
 the contrary, it is likely that he would have given Rawson a direction to open rather than
close it.

13.104 Had the shift handover communications been in accordance with the requirements laid out
in the L WMM, reference would certainly have been made to the abnormal conditions in
Absorber B and to the fact that the level of condensate in that absorber was still out of
controL Similarly, had the control room log book been entered in a proper way, it would
have made reference to these matters.

13.105 It may also be observed that the process difficulties experienced during the night shift were
also known to the night shift supervisor, Wijgers. He had, during the course of the night
shift, spent time with Olsson in the GPl control room endeavouring to deal with the high
levels of condensate in the slugcatchers. However, at the change of shift Wijgers made no
mention of the abnormal conditions of Absorber B to the relieving supervisor, Visser.

13.106 As shift supervisors were not primarily responsible for process matters, their obligation to
pass on at handover information regarding process upsets was different from that of
operators. However, given the degree of Wijgers' personal involvement with the process
difficulties experienced on the preceding night shift and his knowledge of the abnormal
conditions in Absorber B, he should have passed on this information to the incoming
supervisor, Visser. Whether or not Visser would have communicated such matters to Ward
is not apparent, but it is reasonable to assume that he would have done so at the toolbox
meeting immediately following the change of shift.

13.107 Shift handovers and log book entries were used ineffectively in the lead up to the accident
on 25 September 1998. Moreover, laxity in the implementation of the handover
requirements seems to have escaped scrutiny by management.

13.108 Log book entries were not subjected to any examination either by Longford plant
management or by management in Melbourne. They do not appear to have been used by
management as a means of monitoring process conditions at the plant nor were they passed
on to any person or group in Melbourne for plant surveillance purposes. This is discussed in
more detail later.

13.109 The shift supervisors' log was available to management personnel both at Longford and in
Melbourne. Process upsets were not, however, generally included in that document. This
was understandable, given the particular responsibilities of plant supervisors. It meant,
however, that the keeping of the shift supervisors' log was not a substitute for a properly
maintained control room log.

214
13.110 A field operators' log for the RODIROF area was located in the ROD/ROF hut. This log
was destroyed in the fire that occurred following the accident on 25 September 1998 and
was not available in evidence.

Operation in Alarm Mode

13.111 Many of the instrumentation control loops within GPl had alarms. The purpose of the
alarms was to facilitate safe and efficient plant operation by warning operators when process
conditions within vessels or equipment strayed outside normal operating parameters.
Normal operating parameters were defined by alarm range settings.

13.112 Instrumentation alarms were linked to a display in the control room. Each alarm had a loud
audible signal as well as a visual display which would light up either on the alarm panel (if
part ofthe original system) or on the Bailey panel (if part of that system).

13.113 Once activated, an alarm had to be acknowledged by a person in the control room, usually
the panel operator. Acknowledgement was effected by pressing a button to silence the
audible alarm. In the case of Bailey alarms, the visual alarm signal then remained active
until the process condition monitored by the alarm was brought back within normal
operating parameters. The alarm then reset automatically. In the case of the original alarm
panels, the operator was required to reset the alarm manually after process conditions
returned within alarm range settings.

13.114 There was evidence that in the GPl control room it was common for a large number of
alarms to be active at any one time. Many of these alarms were nuisance alarms activated
because the process variable monitored by the alarm was operated at the upper or lower end
of its operating range and was constantly moving in and out of alarm range. This caused
frequent repetitive alarms. In his evidence, Wijgers said that nuisance alarms had the
capacity to distract operators and frequently did. They could be very repetitive and could
result in more important alarms not being picked up or noticed because their warning signals
were lost amongst numerous other alarms.

13.115 In 1992, condensate transfer from GPl to GP2 was introduced in order to recover ethane
more efficiently. For this purpose, it was necessary to operate the absorber from which the
transfer was taking place at a lower temperature than its normal operating temperature
(i.e.·20°C to ·25°C instead of ·10°C). This practice caused TC9B to override the absorber
level controls more frequently and consequently, raise the levels of condensate in the base of
the absorbers. Accompanying these conditions were increases in the frequency of warning

215
 alarms for TC9B and high absorber condensate levels. These alarm conditions were
tolerated.

13.116 In his evidence, Cumming said that recently, the occurrence of high level alarms in the
absorbers had become very regular. He said that at the time of the accident, it was common
for condensate levels in the absorbers to be in alarm. However, he felt that the absorbers
operated quite adequately with condensate levels moving in and out of alarm range,
although this meant the high level alarms occurred frequently. These alarms had to be
monitored, but response by manual adjustment was not necessarily required. However, if
the alarm indicated that the condensate level had gone off-scale, then Cumming agreed that
a process adjustment was required.

13.117 Wayne Olsson, the night panel operator for the night shift preceding the critical shift, also
said that it was a relatively common practice for the absorbers to be operated with
condensate levels in alarm. When giving his evidence, Olsson was shown the alarm log for
the period from 7.00 pm on 24 September to the accident. He conceded that there had been
a considerable number of Absorber B high level alarms, but said that this was not unusual.
Moreover, he said that it was not unusual for the absorbers to be run with condensate levels
in excess of 100%. Indeed, in his view, an absorber could run at such a high level for hours
and did so on occasions. On the night shift preceding the accident, he operated the
absorbers in this way and said that he saw no danger associated with the practice. He also
said that it was quite common for the TC9B override alarm to be active for periods during a
shift and for the plant to be run with TC9B in alarm.

13.118 Olsson conceded, when faced with PIDAS data and alarm records, that, whilst he did
acknowledge active alarms during his shift, he did not make process adjustments in response
to high condensate level alarms for Absorber B, nor in response to frequent TC9B alarms.
In explaining this inaction, Olsson said that he did not react to these alarms because he saw
them as a normal situation and he was not aware that such high levels could be dangerous.

13.119 The practice of operating the absorbers in alarm occurred not only through the preceding
night shift, but over a number of shifts in the days leading up to the accident on
25 September 1998. This was readily apparent from the PIDAS records (see Figure 5.1) and
from the alarm log data.

13.120 Indeed, it is evident that well before the accident, panel operators had become accustomed to
the frequent occurrence of alarm conditions at the base of the absorbers. TC9B alarms and
high level alarms for Absorber B had become frequent enough for such alarms to be

216
 regarded as a nuisance rather than a warning of process upsets requiring attention. This goes
some way in explaining the insensitivity of operators to such alarms in the lead up to the
accident. It may also explain why Olsson did not mention to Ward either the frequent
occurrence of these alarms during his shift or the fact that they were still active at handover.

13.121 The practice of operating the absorbers in alarm had a bearing upon the loss of lean oil
circulation. Excessive condensate carryover could not have occurred if operators had
responded appropriately to the alarm warnings in the GPI control room in the period leading
up to the accident on 25 September 1998.

13.122 Operators would, no doubt, have reacted more appropriately to high levels in the absorbers
had they appreciated the potential for condensate carryover and the dangers associated with
cold temperatures. But even without this understanding, operators did know that operation
of the plant for any length of time in alarm generally carried risks with it.

13.123 There was no evidence of any system to give priority to important alarms. Good operating
practice would have dictated that critical alarms be identified and given priority over other
alarms. It would also have dictated that operators be informed of the correct way to respond
to process upsets identified by the occurrence of critical alarms.

13.124 The lack of any system of priority for critical alarms may explain why Ward failed to
respond promptly or adequately to the activation of the LFSD8 alarm at 8.20 am on the
morning of the accident. This alarm, which warned of a low flow shut down of the GP1201
pumps, was critical because it warned the operator of loss of the protective lean oil
circulation system. Yet it was apparently ignored by Ward. Moreover, there were no
procedures to assist the operator to respond to such loss of flow. This, however, is discussed
elsewhere.

Monitoring of Operating Conditions

13.125 Within each plant control room at the Longford facility, the performance of process
instrumentation and control systems was recorded. Some 70% of the instrumentation
control loops in GPl were operated and made records using the original pneumatic control
system. That is, air pressure signals were used as a vehicle for the transfer of process
information from the plant to the control room. This information was recorded in the control
room by pen and ink on paper charts. These charts continuously recorded temperatures,
pressures and flows associated with the operation of equipment in the plant.

217
13.126 The remaining 30% ofthe instrumentation in GPl was electronically operated. The process
data was recorded by the Bailey system and also stored in the PIDAS database. Like ink
and paper charts, PIDAS provided a continuous record of process information.

13.127 As is apparent from the technical investigation into the cause of the accident, process charts
and the Bailey system records were a potentially valuable source of process information
concerning the status of any part ofthe plant at a given time (for example at the time ofthe
accident on 25 September). They could also be used to analyse process trends or patterns of
operation over an extended period of time and so assist in the identification of potentially
unsafe conditions.

13.128 However, the evidence before the Commission indicates that such records were not used as
effectively as they might have been in GP I. Indeed it is possible that their ineffective use
played a part in the occurrence of the accident on 25 September 1998.

Use made of chart recordings

13.129 A number of control room operators said they used charts, and to a lesser extent PIDAS
records, to assist them to understand plant conditions during the course of their shift. They
did not, however, appear to use such records as a means of monitoring the performance of
the plant over an extended time. Panel operators did not, as a general practice, resort to
charts or PIDAS records as a means of evaluating longer term process trends or longer term
performance of particular items of equipment. They did, of course, evaluate the process
from time to time by reference to the indicators on the controllers.

13.130 As with plant operators, plant supervisors had access to charts in the GP I control room.
They also had access to PIDAS information through a computer terminal located on the
plant supervisor's desk. When in the control room, supervisors used charts and computer
records to understand and assess the workings of the plant during their shift and, to a lesser
extent, in undertaking plant surveillance through the course of the shift. There was,
however, no evidence to suggest that supervisors analysed charts or used PIDAS recordings
to monitor patterns in process variables or to conduct other forms of trend analysis. If
supervisors did undertake such work, they did so only rarely, rather than as a matter of
course. From 1997, plant supervisors were not expected to carry out this type of
surveillance, nor was it their responsibility to monitor process operations in detail.

The plant surveillance group

13.131 In the 1970's Esso employed plant engineers on site at Longford. One such engineer who
gave evidence to the Commission was Luke Musgrave. He was first employed by Esso as a

218
 GPl surveillance engineer in 1979. In this role his responsibilities involved monitoring
recovery performances of the plant, assisting in the resolution of operating problems and
maintaining a liaison between Esso and design engineers in relation to specific projects. He
said that in carrying out these responsibilities, he regularly visited the GPl control room
where he perused charts and log books. He said that he had a lot of contact with both
operations personnel and with the plant itself. He frequently assisted operators to resolve
process problems including recurring problems. It is apparent that, as a surveillance
engineer for GP1, Musgrave was actively engaged in plant operations and plant surveillance
activities.

13.132 As observed in Chapter 2, on-site engineers were relocated to Melbourne in 1992. This
relocation was followed by the creation of a new department within Esso management.
Within this department a group was established known as the Plants Engineering Group. In
1995, this group was renamed Plants Surveillance Group. The functions of this group were
outlined by Musgrave and were the subject of evidence by Harrison and Keen. All said that
the group did not undertake off-site monitoring or surveillance of ongoing process
conditions, nor was it part of the group's function to undertake these activities. Rather, the
functions of the group were limited to work on specific engineering projects, although they
were available for assistance with particular problems if requested. Typically, engineering
projects related to the enhancement of product recovery.

13.133 Following the relocation, plant engineers based in Melbourne made frequent visits to the
Longford plant so that some opportunity for surveillance activities existed. However, these
occasions were obviously more limited than the opportunity presented by the constant
exposure of onsite engineers to plant operations and to operations personnel. Off-site
engineers do not have the same opportunities for day to day close contact as did onsite
engineers.

13.134 The consequence of the relocation of plant engineers to Melbourne was that the important
task of continuous monitoring of process conditions within the Longford facility was
diminished. Moreover, what was done was no longer carried out by plant engineers.
Instead, it was undertaken almost exclusively by operators and plant supervisors whose
surveillance work was focused on immediate production requirements rather than trend
analysis or the analysis of recurring process problems.

13.135 The lack of plant surveillance activity in GPl was demonstrated by the lack of use made of
process information. Electronically generated process information was automatically
retained in the PIDAS database. However, it would seem that it was rarely, if ever, looked

219
 at, let alone subjected to any trend analysis. The remaining 70% of process information for
GPl was to be found on chart recordings and was also not subjected to any trend analysis.
This is apparent because there was no system in place for preserving such records either for
surveillance purposes or for accident investigation and analysis. The evidence was that
charts, once used, were discarded by operators. They were not stored or retained. Thus
historical process information covering some 70% ofGPl operations was never reviewed by
engineers for surveillance purposes, but simply thrown away. Charts were not even date
stamped at their beginning and end to make analysis easier.

Observations
13.136 Monitoring ofPIDAS records for GPl in the weeks and months prior to the accident would
have identified consistent deviations from normal operation in the absorbers in the form of
high condensate levels and TC9B interference with level control. It would also have
identified the operator practice of operating the absorbers in alarm. Had there been
surveillance by qualified engineers, there would have been an opportunity to detect and
correct the operating practices which led to the accident on 25 September 1998.

13.137 In the Commission's view, the failure to undertake ongoing analysis and evaluation of
process trends within GPl, diminished the likelihood that upsets such as those which
contributed to the accident on 25 September 1998 (operating conditions in the absorbers or
condensate carryover) would be detected and avoided by appropriate responsive action. Had
regular surveillance of operating conditions in GPI been undertaken by qualified engineers,
warning signals relevant to the accident (low absorber operating temperatures, high
condensate levels, frequent TC9B interference with level control, the occurrence of
condensate carryover, operation "in alarm") would, in all likelihood, have been identified.
This could have led to changes in operating practice for the absorbers. It could also have led
to more rigorous monitoring of conditions in GPl. Also, in the Commission's view, the
absence of regular monitoring of process operations by senior personnel in a high pressure
hydrocarbon processing plant, which was not equipped with protective devices to make it
completely fail-safe, exposed that plant to an unacceptable risk.

INCIDENT REPORTING

13.138 Element 9 of the ECI Guidelines contained an incident reporting procedure. This procedure
was taken up by Esso as Element 9 in the OIMS Manual. At the commencement of OIMS
Element 9, Esso recognised the utility of effective incident reporting in these terms:

220
 "Effective incident investigation, reporting and follow-up are necessary to achieve
operations integrity. They provide the opportunity to learn from incidents and to use
the information to take corrective action to prevent recurrence".

13.139 The actual procedure for the reporting ofincidents was set out in another Esso manual called
the Safety Management Manual (SMM). In its introductory paragraph, the SMM (SMM-
150-1 00, p.5) stated:

"All incidents, no matter how minor, are to be reported immediately to the worksite
supervisor. All incidents are to be recorded on the hard copy Esso Incident Form,
regardless of whether the Profs reporting system is used".

13.140 The SMM explained an "Incident" as an unplanned event that caused, or could have caused,
injury or damage to personnel, property or the environment which, in the case of injury,
involved an Esso employee or contractor, and in the case of damage to property, occurred at
a place controlled by Esso or involved Esso property.

13.141 The SMM also included (SMM-150-302) a definition of"near miss" as:

" ... an unintended or unwanted event or circumstance which under slightly different
conditions would have resulted in an incident".

13.142 So defined, a "near miss" would clearly qualifY as a "incident" for the purpose of SMM
incident reporting requirements.

13.143 The SMM also contained a classification system for the ranking of incidents according to
their seriousness or potential seriousness. This was to ensure that appropriate resources
were directed to investigation and follow-up. Incidents which were classified as serious had
to be accompanied by a critical evaluation of all related OIMS systems and critical
equipment, to detect weaknesses in such systems or equipment and to ensure preventative
action was taken.

Operating Practice

13.144 The SMM definitions of "incident" and "near miss" were clearly wide enough to require
operations personnel to report as an incident any serious process upset that occurred during
the operation of the Longford plant. In practice, however, the obligation to report incidents
was construed narrowly both by Esso management and by operations personnel. Process
upsets were rarely, if ever, the subject of an incident report, unless they were accompanied
by injury to persons or damage to property.

221
13.145 The consequence of this practice was that process upsets which may well have signified to
qualified and experienced personnel, defective equipment, or inappropriate operating
conditions or unsafe operating practices, were not brought to their attention. Thus, valuable
opportunities to learn from process upsets were lost.

13.146 A pertinent example of such a lost opportunity was the failure of operations personnel to
report the cold temperature incident which occurred on 28 August 1998. This incident is
examined in detail in Chapter 12.

Observations

13.147 Those that gave evidence concerning the 28 August incident (the plant supervisor, Wijgers,
and panel operator, Olsson) conceded that it had a number of unusual features which, with
the benefit of hindsight, warranted its being reported. These features included the fact that a
critical spare GP1202 pump was unavailable (due to maintenance), with the consequence
that the seal failure on the remaining pump required the shutdown of GP 1 to effect repairs;
the fact that such shutdown and subsequent restart had to be undertaken without the
assistance of appropriate operating procedures; the fact that the incident involved a leak at
GP922; and most importantly, the fact that, during the course of the incident, clear evidence
emerged in the form of ice on piping and vessels that unusually cold temperatures were
being experienced in vessels which usually operated hot, raising concerns about brittle
fracture.

13.148 Had the incident on 28 August 1998 been reported as it should have been, the danger of
equipment becoming subject to dangerously low temperatures upon the loss of lean oil flow
for any length of time would, in all probability, have become known as would the steps
available to avert the danger. The failure to report this incident thus stands as another
example of a failure in Esso's implementation of its management systems. In the case of the
incident on 28 August, such failure deprived operations personnel of process information
vital to the prevention of the incident on 25 September 1998.

222
 Chapter 14
THE REGULATORY ENVIRONMENT

APPLICATION TO EXTEND THE TERMS OF REFERENCE

14.1 The Commission's Terms of Reference require it to inquire into and report upon the causes
of the explosion and fire at Longford on 25 September 1998 and the failure of the gas supply
from the Longford facilities. By cl.2 of the Terms, the Commission is also required to
consider whether certain matters caused or contributed to the occurrence of the accident or
the failure of gas supply. Clause 3 requires the Commission to identifY the steps that should
be taken by Esso or BHP to prevent a repetition of those occurrences. Finally, the
Commission is directed to make such recommendations as it considers appropriate,
including recommendations regarding legislative or administrative changes.

14.2 On 27 January 1999 an application was made on behalf of the Victorian Trades Hall Council
(VTHC) for the Commission to recommend to the Victorian Government that it amend the
Terms of Reference to include in cl.2, a paragraph (i) in the following terms:

"The regulation of Esso and BHP's Longford operations by the Government of

Victoria, its agencies and departments."

and to insert the words "the Government of Victoria, its agencies and departments" in cl.3
before the words "Esso and BHP".

14.3 This application was supported by counsel for Esso and counsel for the Leader of the
Opposition and Shadow Ministers. It was opposed by counsel assisting the Commission,
counsel for the State of Victoria and counsel for the Insurance Council of Australia.

14.4 The Commission took the view that the Terms of Reference were a matter for government
and that, in the absence of special circumstances, such as an inability to pursue its inquiry by
reason of the scope of the Terms of Reference, it ought not to take the course suggested by
the VTHC. As no special circumstances were seen to exist, the application was refused.

14.5 Subsequently, on 30 March 1999, counsel for Esso sought to tender in evidence a bundle of
documents dealing with the supply of gas from sources outside the facilities at Longford.
The basis for doing so was that the Commission could not recommend steps to be taken by

223
 Esso or BHP to prevent or lessen the risk of a further disruption of supply from those
facilities without receiving evidence of what others, including the Victorian Government,
could or should have done to ensure alternative supplies. Esso further submitted that, for
similar reasons, the Commission could not make recommendations regarding legislative or
administrative changes in the absence of evidence of the kind it sought to tender.

14.6 The Commission ruled that cl.3 of the Terms of Reference restricted it to a consideration of
the facilities at Longford and the steps which ought to be taken there by Esso or BHP to
prevent a recurrence of the events of 25 September or a further disruption of the gas supply
from those facilities. It took the view that the Terms of Reference did not warrant it
embarking on a more general inquiry into gas supply in Victoria: an inquiry which would be
expensive and time consuming. Further, it considered that the direction in the Terms of
Reference, requiring the Commission to make recommendations arising out of its inquiry,
was circumscribed by the ambit of the inquiry it was required to make. On this basis it ruled
that the documents that Esso sought to tender were not relevant.

COMPLIANCE BY ESSO AND BHP WITH RELEVANT STATUTES

AND REGULATIONS

14.7 In considering whether certain factors caused or contributed to the occurrence of the
incident and failure of gas supply, the Commission is required by paragraph 2(h) of the
Terms of Reference, to consider "any breach of, or non-compliance with, the requirements
of any relevant statute or regulation by Esso or BHP".

14.8 Apart from a failure on the part of Esso to comply with the obligations imposed by s.21 of
the Occupational Health and Safety Act 1985 (Vie) it was not submitted that there was a
breach of, or non-compliance with, any other legislation which caused or contributed to the
accident. Other offences were referred to, but without any suggestion of a causal connection
between them and the accident on 25 September 1998. Rather, emphasis was placed upon
the failure of the regulatory regime which governed Esso on 25 September 1998 to prevent
the accident. That is a matter which is dealt with later in this chapter.

14.9 Section 21 of the Occupational Health and Safety Act 1985, so far as is relevant, provides:

( 1) "An employer shall provide and maintain so far as is practicable for

employees a working environment that is safe and without risks to health.

224
 (2) Without in any way limiting the generality of sub-section (1 ), an employer
contravenes that sub-section if the employer fails

(a) to provide and maintain plant and systems of work that are so far as is
practicable safe and without risks to health;

(b) to make arrangements for ensuring so far as is practicable safety and absence
of risks to health in connection with the use, handling, storage and transport
of plant and substances;

(c) to maintain so far as is practicable any workplace under the control and
management of the employer in a condition that is safe and without risks to
health.

(d) ........... .

(e) to provide such information, instruction, training and supervision to

employees as are necessary to enable the employees to perform their work in
a manner that is safe and without risks to health."

14.10 Under s.47 of the Act, failure to comply with any of its provisions constitutes an offence
against the Act.

14.11 The conditions prevailing in GPI on 25 September 1998 clearly did not constitute a working
environment that was safe and without risks to health. The relevant plant and system of
work was not safe and without risks to health. The arrangements for the handling of
hydrocarbons in GPl on 25 September did not ensure safety and the absence of risks. The
workplace in GPl on that day was not in a condition that was safe and without risks to
health. And Esso had not on that day provided such information, instruction, training and
supervision to its employees as was necessary to enable them to perform their work in a
manner that was safe and without risks to health.

14.12 Save for paragraphs (d) and (e) of s.21, the obligations imposed by that section are not
absolute, but extend only so far as it is practicable to comply with them. However, the
failure of Esso to provide a safe working environment in GPl on 25 September 1998 was
the result of its having failed to take measures which were plainly practicable. In order to
provide a safe working environment there could and should have been appropriate operating
procedures to deal with the loss oflean oil circulation, cold temperatures and the shutdown
and start up of the plant. Furthermore, the operators and supervisors could and should have

225
 known of and understood the real hazards confronting them on the day. These matters are
discussed in other Chapters of this report.

14.13 Whilst there may have been breaches by Esso of other legislative provisions, such breaches
must, if causally related to the occurrence of the accident, be encompassed by s.21 of the
Occupational Health and Safety Act. That provision covers all the significant factors
contributing to the accident and it would be otiose to pursue the question whether there were
other offences committed by Esso and, if so, whether they contributed to the events of
25 September 1998.

14.14 For example, it would appear that on 25 September 1998, Esso's license under the
Dangerous Goods Act 1985 (Vie) had expired. It was required to hold a license to keep
dangerous goods under the Dangerous Goods (Storage and Handling) Regulations 1989.
Failure to hold such a license was an offence under s.21 (2) of the Dangerous Goods Act.
The license held by Esso expired on 26 August 1998. In April 1998 it had initiated an
application for the renewal of the license. Following site inspections on 31 July 1998, Esso
wrote to the Victorian WorkCover Authority (VWA), which administered the Act, and
formally applied for a renewal. On 14 August Esso wrote to VWA and provided it with an
amended manifest and site plan to replace those initially provided. It enclosed a cheque for
$6,962.00 being the fee for the new license. VWA received the letter on 18 August 1998.
Late in the afternoon of25 September 1998 VWA realised that Esso's license had not been
formally renewed. It appears that, save for a computer problem in relation to the generation
of the license, it would have been granted by then. On 28 September 1998, after additional
data was entered, VWA's computer system generated a license for the Longford site.

14.15 Whatever else may be said of its failure to hold a valid licence on 25 September 1998, it is
clear that, if Esso were at fault, it was only in the most technical sense and that this
circumstance did not cause or contribute to the events of25 September 1998. The Terms of
Reference do not authorise an inquiry into the reasons for the delay on the part of VWA in
furnishing Esso with a license.

Legislative Background

14.16 Until 1985, the legislative scheme in Victoria dealing with occupational health and safety
was prescriptive. That is to say, it laid down specific requirements, compliance with which
was supervised by government agencies. For example, there was legislation dealing
separately with disparate matters such as pressure vessels, hazardous substances, scaffolding
and lifts and cranes. Following the 1972 Robens Report in the United Kingdom, a decision
was made to change, at least in part, from a prescriptive system to one that was performance

226
 based, that is to say, one which enunciated the basic and over-riding responsibilities of
employers and employees. The report (Paragraph 130) explained that system as follows:

"A positive declaration of the over-riding duties, carrying the stamp of parliamentary
approval, would establish clearly in the minds of all concerned that the preservation
of safety and health at work is a continuous legal and social responsibility of all those
who have control over the conditions and circumstances under which work is
performed. It would make clear that this is an all-embracing responsibility, covering
all workpeople and working circumstances unless specifically excluded."

14.17 The result in Victoria was the enactment in 1985 of the Occupational Health and Safety Act
and the Dangerous Goods Act. Section 21 of the Occupational Health and Safety Act,
which is set out above, is one of the two sections (the other being s.22) which imposed the
primary obligation upon an employer to provide and maintain a safe workplace and working
environment, leaving it to the employer to identify the specific steps required for the
carrying out of that obligation. On the other hand, the Dangerous Goods Act controlled the
handling of dangerous goods through regulations which set out detailed safety prescription
and imposed a system of licensing with respect to premises upon which dangerous goods are
stored, such as Esso's premises at Longford.

14.18 From 1986, the Department of Labour was responsible for the administration of both Acts.
The Department of Labour had previously been known as the Department of Employment
and Industrial Affairs which had earlier taken over the responsibilities of the Department of
Labour and Industry. That Department ceased to exist.

14.19 Even after 1985, the Department of Labour had responsibility for the inspection and
approval of pressure vessels (and later the Department of Business and Employment) under
the Boiler and Pressure Vessels Act 1970 (Vie). Notwithstanding the intended change from
a prescriptive to a performance based system under the Occupational Health and Safety Act,
the change took time. Inspection and approval of pressure vessels by government agency
inspectors continued until 1996.

14.20 In 1991, the Occupational Health and Safety Authority was established under the
Department of Labour with responsibility for the administration of the Occupational Health
and Safety Act, the Dangerous Goods Act, the Boiler and Pressure Vessels Act and other
enactments and regulations applicable to Esso's operations at Longford. Until the creation
of the Occupational Health and Safety Authority those enactments and regulations had been
administered by the Occupational Health and Safety Division of the Department of Labour.

227
14.21 The Occupational Health and Safety Authority is not to be confused with the Occupational
Health and Safety Commission, established under the Occupational Health and Safety Act in
1985, being a body responsible for policy development.

14.22 In 1992, responsibility for the administration of occupational health and safety legislation in
Victoria was transferred from the Department of Labour to the Department of Business and
Employment. The Occupational Health and Safety Authority administered two divisions
within the Department of Business and Employment. One division was concerned with
health and safety and the other with chemicals and operating plant. In the same year, the
Accident Compensation (WorkCover) Act 1992 established the VWA and abolished the
Occupational Health and Safety Commission.

14.23 In 1995, the Occupational Health and Safety Authority was renamed the Health and Safety
Organisation. In 1996 the Health and Safety Organisation was merged with the VWA
which, until that time, had been responsible for the administration of the workers
compensation schemes under the Accident Compensation Act 1985.

14.24 The Accident Compensation (Occupational Health and Safety) Act 1996 (Vie) effectively
transferred to the VWA the powers and functions previously exercised by the Department of
Business and Employment (and before that the Department of Labour) in relation to
occupational health and safety.

14.25 In July 1995, the Occupational Health and Safety (Plant) Regulations came into operation
revoking regulations previously made under the Boiler and Pressure Vessels Act and some
earlier regulations made under the Occupational Health and Safety Act. The Boiler and
Pressure Vesssels Act was also repealed by proclamation made pursuant to s.2 of the
Occupational Health and Safety Act. Under the new plant regulations a duty was imposed
upon employers, such as Esso, to ensure that all hazards associated with the operation of its
plant were identified. However, governmental inspection of pressure vessels continued until
1996. See Occupational Health and Safety (Plant) Regulations 1995, Regulations 702, 703,
704. Those regulations had the effect of shifting the obligation to inspect boilers and
pressure vessels from a government agency to the employer.

14.26 Pursuant to its obligations under the new plant regulations, Esso developed a system for the
inspection of pressure vessels at Longford and for keeping records of those inspections. It
has not been suggested, nor does the Commission find, that there was any deficiency in that
system or its implementation which caused or contributed to the accident on 25 September
1998.

228
 Safety Case

14.27 In 1995, the National Occupational Health and Safety Commission was established under
the National Health and Safety Commission Act 1995 (Cth). In 1996, it published a
National Standard for the Control of Major Hazard Facilities and a National Code of
Practice for the Control of Major Hazard Facilities. The code of practice is a document
prepared for the purpose of advising employers and workers of acceptable ways of
achieving the national standard. The standard and code were prepared in the expectation (on
the part of the Commission and the Commonwealth Government) that they would be given
legislative force in the States and Territories.

14.28 The standard, which of itself has no legislative force, creates a framework for those
managing major hazard facilities (MHFs), within which to identifY and assess hazards and to
control those hazards when identified. Compliance with the standard remains voluntary in
Victoria.

14.29 Thus, both the national standard and the Occupational Health and Safety (Plant)
Regulations require the identification and control of hazards. However, the national
standard differs from the regulations in that it requires the operator of a MHF to forward a
safety report to the relevant public authority with the responsibility of controlling MHFs.
Such a report must constitute a written presentation of the technical, management and
operational information covering the hazards and risks of the facility and their control, and
provide justification of the adequacy of the measures taken to ensure the safe operation of
the facility.

14.30 The requirement of a safety report (or safety case as it is sometimes described) has for some
time been recognised as one of the most effective means of risk management where reliance
is placed upon self-regulation. The safety case method of risk management emerged in
Europe after the occurrence of disasters involving the release of flanunab1e chemicals at
Flixbrough in the United Kingdom in 1974 and of toxic chemicals at Seveso in Italy in
1976. A directive of the European Commission, knowr1 as the Seveso Directive, published
in 1982, required member states to develop and implement regulations directed to the safety
of major hazard sites. The directive did not extend to offshore facilities. After a series of
catastrophic explosions and fires on an offshore platform, knowr1 as Piper Alpha, in 1988, an
inquiry, chaired by Lord Cull en, focused attention upon the safety case method by
recommending the extension of its application to offshore facilities. Esso has adopted the
safety case model for its offshore facilities but not for its onshore facilities. This may be
explained by the absence of any obligation requiring it to do so.

229
14.31 Regulations promulgated under the Commonwealth Petroleum (Submerged Lands) Act 1967
(Cth) require the consent of the Designated Authority to construct or install a facility and to
use a facility offshore. Obtaining consent entails the submission and acceptance of a safety
case. In the case of Victoria, the Designated Authority is the Minister for Agriculture and
Resources. The Designated Authority must accept the safety case if it is satisfied that it is
appropriate to the facility and complies with the regulations. The safety case must be
revised at least every five years and also in the event of relevant developments in technical
knowledge, proposed modifications or changes to, or the decommissioning of, the facility.
The regulations are the Petroleum (Submerged Lands) Management of Safety on Offshore
Facilities Regulations 1996. Once accepted the safety case becomes the standard against
which safety performance is assessed.

14.32 Not only is a safety case required for installations offshore, but the requirement to submit a
safety case was recently introduced by regulations under the Gas Safety Act 1997 (Vie). The
Gas Safety Act and the Gas Safety (Safety Case) Regulations 1999 require a gas company to
submit a safety case to the Office of Gas Safety. The safety case must be in writing and
comply with the regulations. The Office may require the safety case to be independently
validated. The Office must accept a safety case if it is satisfied that it is appropriate for the
facility to which it applies and complies with the Act and regulations. As may be expected,
there is considerable uniformity in the safety case regimes of the Commonwealth and State.
Neither applies by force of law to Esso's operations at Longford.

Observations

14.33 The regulatory regime covering Esso's operations at Longford was thus less stringent than
for its facilities upstream from Longford and now for the gas transmission and distribution
facilities downstream from Longford. Had Esso been required to submit a safety case with
respect to its facilities at Longford before 25 September 1998, it is likely that it would have
identified the very hazards which were in evidence on that day, hazards which a proper
HAZOP study of GP1 would also have identified.

14.34 The Commission notes that the Dangerous Goods (Storage & Handling) Regulations 1989
were amended in 1997 to enable operators of MHFs to obtain exemptions from certain
prescriptive provisions contained in the regulations if they could demonstrate compliance
with the national standard. There is no evidence that Esso ever sought such an exemption.

14.35 In a report prepared for the VWA by Det Norske Veritas and AON Pacific Risk Consultants
in March 1999, the VWA was advised, among other things, to establish a centralised major
hazards unit (MHU), reporting directly to the Director of Field Services. The report noted

230
 that in order for the Unit to be effective, it would have to be made up of highly skilled and
experienced individuals. It would also have to establish credibility within industry.

14.36 The authors of the report proposed that the MHU personnel be skilled in process
engineering, software, safety systems, risk analysis, emergency planning and auditing. A
team approach was contemplated in recognition of the reality that, while members would
have certain general skills, they would also have an area of specialist knowledge.

14.37 The report proposed the regulation of MHFs by the MHU, including a requirement for
compliance with the national standard. Systematic audits were proposed. However, the
report correctly included an expression of uncertainty about the VWA's ability to implement
the safety report regime in the absence of enabling legislation or regulations. It was
acknowledged that the national standard otherwise provided a good foundation for this
regime.

14.38 It may be argued that the existing law in Victoria authorised the VWA to require Esso to
prepare and submit a safety case or safety report of the kind required under the Petroleum
(Submerged Lands) (Management of Safety on Offshore Facilities) Regulations or in
conformity with the national standard. There is certainly scope under the Occupational
Health and Safety Act, the Dangerous Goods Act and the regulations made thereunder for
inspectors to impose conditions or give directions or notices in certain circumstances.
However, the use of such powers to introduce a new and important risk management regime
would be inappropriate. The conditions, directions and notices are, for the most part, open
to appeal. There is no statutory procedure dealing with the VWA's response to the
preparation and submission of a safety case. Moreover, the legal foundation for such a
course is doubtful.

14.39 In April 1999, the VWA proposed to the Victorian Government that compliance with the
national standard should be compulsory for operators of MHFs. Western Australia is the
only state to have given legal affect to the national standard. The VWA also recommended
to the Victorian Government that it should make new regulations designed to enforce the
national standard. It proposes that those standards should be enforced at Longford and at
otherMHFs.

14.40 The Commission is required by its Terms of Reference to make such recommendations
arising out of its inquiry as it considers appropriate, including recommendations regarding
any legislative or administrative changes that are necessary or desirable. It has reached the
conclusion that one legislative change which is both necessary and desirable is legislation

231
 requiring the operation of an MHF such as Esso's Longford facility, to conform to a safety
case or safety report procedure. The Petroleum (Submerged Lands) (Management of Safety
on Offshore Facilities) Regulations provide a sound model, as does the Gas Safety Act and
the regulations made under that Act. It is anomalous that Longford should be exempt from
such a procedure, in contrast to facilities connected with the Longford plants both upstream
and downstream. But far more importantly, the imposition of a safety case or safety report
procedure at Longford would go a long way towards avoiding a repetition of the accident at
Longford on 25 September 1998.

14.41 It has been suggested that there is a conflict between the role of the VWA with respect to
accident compensation and its role as the supervisor of workplace safety regimes. The
Commission is in no position to reach a conclusion whether such a conflict exists, but it is
clear that if there is to be a MHU within the VWA, it should be given the independence
necessary to ensure that any conflict is eliminated.

232
 Chapter 15
CONCLUSIONS AND RECOMMENDATIONS

TERMS OF REFERENCE- CLAUSE 1

15.1 The primary task of the Commission has been to inquire into and report upon the causes of
the explosion and fire which occurred at Longford on 25 September 1998 and the failure of
gas supply from those facilities following the explosion and fire.

The Immediate Causes

15.2 The immediate causes of the explosion and fire may be summarised in simple terms. A loss
of lean oil circulation in GPl occurred when the GP1201 pumps stopped. There was a
failure to restart these pumps and they remained inoperative for some hours. The
consequence was that a number of vessels were deprived of a flow of hot lean oil which, if
the plant had been operating normally, would have served to heat them. The purpose of
those vessels was to exchange heat with cold rich oil flowing from the absorbers.

15.3 The absence of hot lean oil allowed the cold liquid from the absorbers to chill those vessels
to a temperature in the vicinity of -48°C. One of the vessels involved was GP905. The
reduction in temperature of that vessel caused the embrittlement of its steel shell. When hot
lean oil was re-introduced into the vessel it ruptured by way of brittle fracture at its eastern
end, releasing a volume of hydrocarbon vapour which travelled towards the area of the fired
heaters where it ignited, causing an explosion and fire. There followed further explosions as
the initial fire impinged on the piperack at Kings Cross and caused pipes to fail.

15.4 The explosions and fire led to the three gas plants at Longford being shut down with a
consequent failure of gas supply from those facilities. The resumption of gas supply
commenced on 4 October 1998 and was completed by 14 October 1998. The time taken to
commence the restoration of the gas supply was due to the need to extinguish the fires in
GPl and to ensure the complete isolation ofGPl and the CSP from GP2 and GP3.

15.5 More than one factor contributed to the tripping of the GPI201 pumps. That is dealt with in
Chapter 10. It is sufficient to say here that high levels of condensate in Absorber B led to
condensate entering the rich oil stream. This in turn led to an upset in the ROD which
resulted in a heavy carry over of liquid and vapour from that vessel into the lean oil stream.

233
 As a consequence, the level in the Oil Saturator Tank was raised and the level controller for
that vessel closed a level control valve to restrict the flow from the GP1201 pumps. This
caused a low flow shut down switch in the lean oil system to shut down those pumps.

The Real Causes

15.6 Notwithstanding the matters mentioned above, the conclusion is inevitable that the accident
which occurred on 25 September 1998 would not have occurred had appropriate steps been
taken following the tripping of the GP1201 pumps. When efforts to restart those pumps
proved unsuccessful, it should have been realised immediately that cold temperatures would
ensue downstream from the absorbers and render vessels not designed to operate at low
temperatures dangerous. Had this been realised, steps could and should have been taken to
isolate the outlets of both rich oil and condensate from the absorbers in order to prevent
those cold temperatures from developing in the ROD/ROF area. Those who were operating
GPl on 25 September 1998 did not have knowledge of the dangers associated with loss of
lean oil flow and did not take the steps necessary to avert those dangers. Nor did those
charged with the supervision of the operations have the necessary knowledge and the steps
taken by them were inappropriate. The lack of knowledge on the part of both operators and
supervisors was directly attributable to a deficiency in their initial or subsequent training.
Not only was their training inadequate, but there were no current operating procedures to
guide them in dealing with the problem which they encountered on 25 September 1998.

TERMS OF REFERENCE- CLAUSE 2

15.7 The Commission is required to inquire into and report upon whether a number of specified
factors caused or contributed to the explosion, fire and failure of gas supply. It is convenient
to deal with each of these factors in turn.

• The design of the Longford facilities, including the interdependence of (i) the plants
and other components which comprise these facilities, and (ii) the Longford
facilities at or upstream of the Esso site at Longford.

The build up in the level of condensate in Absorber B on 25 September 1998 was the
result of the level control being overridden by TC9B. The effect was to reduce the flow
of condensate through heat exchanger GP919 and to increase condensate levels in the
absorber. TC9B was intended to protect the Condensate Flash Tank from low
temperatures. This was particularly important when condensate was being transferred
from GP 1 to GP2 because transfer required the temperature of the condensate to be

234
 reduced to -20°C compared with -1 ooc under normal operating conditions. The control
system had been changed when the condensate transfer equipment was installed.

The design of the override as a protection against low temperature in the Condensate
Flash Tank was inappropriate in circumstances where it was impossible for operators to
discern the level of condensate in the absorbers when levels rose above the point at
which they could be monitored. The attempt to protect the Condensate Flash Tank
caused a serious problem in the absorbers. Whilst this aspect of the design of GP1
cannot be said to have been an ultimate cause of the explosion and fire, it exacerbated
the circumstances which led to the tripping of the GP1201 pumps and the loss oflean oil
flow. It undoubtedly accelerated the cool down of the plant following loss oflean oiL

In addition, the design of the ESD system in GP1 did not allow the isolation of the
inventory of flammable liquid and vapour within the major vessels in the ROD/ROF
area. In particular, the large inventory of lean oil in the ROF was not isolated upon the
operation of the ESD system. This shortcoming contributed to the explosion and fire by
allowing a significantly large quantity of fuel to escape from the ruptured vessel.

Lack of isolation between the CSP and GP 1 and the contents of the pipework passing
through the Kings Cross intersection also contributed to the fire in that a number of
sources of fuel from the CSP had to be manually isolated during the afternoon of
25 September to reduce the size of the fire. Had the ESD system ofGP1 and the CSP
automatically isolated these sources of fuel, the consequence ofthe conflagration would
have been less severe. Even if reliance had been placed upon manual isolation, there
was no real plan or philosophy to guide such an operation.

The Commission does not consider that the design of the facilities at, or upstream from,
the Esso site at Longford otherwise caused or contributed to the occurrence on
25 September 1998.

• Operating standards, practices and policies

Had a HAZOP study for GP 1 been carried out as planned, the operators and supervisors
in that plant on 25 September 1998 would not have remained ignorant of the hazards
associated with a loss of lean oil flow and consequent low temperatures. They would
have been instructed in the appropriate procedures to deal with the situation which arose
on that day. The failure to conduct a HAZOP study or to carry out any other adequate
procedures for the identification of hazards in GP 1 contributed to the occurrence of the
explosion and fire.

235
 The training of its personnel to opemte or supervise a potentially hazardous process was
the responsibility of Esso and it failed to discharge that responsibility effectively.
Whilst criticism can otherwise be made of certain aspects of the plant, its design and
operation, the ultimate cause of the accident on 25 September was the failure of Esso to
equip its employees with appropriate knowledge to deal with the events which occurred.
Not only did Esso fail to impart that knowledge to its employees, but it failed to make
the necessary information available in the form of appropriate operating procedures.
The lack of operating procedures to deal with the loss of lean oil circulation, low
temperatures and the shutdown and start up of GPl combined with the inadequate
training of personnel meant that the response to the situation which arose on
25 September 1998 was inappropriate and led to the occurrence of the explosion and
fire. The lack of proper operating procedures contributed, therefore, to the occurrence.

Appropriate supervision of operators to ensure adherence to basic operating practices

was also a responsibility of Esso management. The investigation of the events leading
up to the accident revealed a number of occasions when operators failed to adhere to
rudimentary operating practices. These included failures to monitor plant conditions,
respond appropriately to alarms, report process upsets to supervisors and undertake
appropriate checks before adjusting process variables. Had operating practices been
more closely monitored and supervised by Esso management, these departures from
appropriate operating practices would have been detected and remedied.

The reduction of supervision at Longford, including the transfer of engineers to

Melbourne, necessarily meant a reduction in the amount and quality of the supervision
of operations there. There was a correspondingly greater reliance by Esso on the skill
and knowledge of operators. Whilst it is not possible to discern any direct connection
between the level of supervision and the accident on 25 September 1998, the
Commission considers that it was probably a contributing factor.

• Maintenance standards, practices and policies

Whilst criticism has been directed at Esso's reduction of its maintenance staff at
Longford and its allocation of priority to work order requests, the Commission finds that
Esso's standards, practices and procedures with regard to theses matters did not cause or
contribute to the occurrence of the explosion, fire or failure of gas supply.

The functions performed by TRC3B and the problems experienced with it are dealt with
in Chapter 3. There can be no doubt that, as events transpired, the failure in the closed

236
 position of the TRC3B temperature control valve contributed to the low temperatures
and consequent high levels of condensate in Absorber B. This was not inevitable
because appropriate manipulation of the bypass valve around the TRC3B control valve
would have achieved effective temperature control in the bottom of Absorber B.
However, the bypass valve was not appropriately manipulated during the period
preceding the rupture ofGP905. It is only in this indirect way that the failure to repair
the TRC3B valve can be said to have contributed to the explosion and fire. In the
circumstances, the priority given to the repair of the valve does not amount to evidence
of a standard, practice or policy which caused or contributed to the accident.

On 25 September 1998 a number of paper charts in the control room of GP l were not
effectively recording the information which they were designed to record, either through
lack of ink in the pens or through defective mechanism in their drive. In particular, the
overhead flow from the ROD and the lean oil flow from GP1201 were not being
recorded. In addition, the temperatures in the RODIROF area were not being recorded
by temperature recorder TRI. Had the information which should have been, but was
not, recorded, been available in the control room on 25 September 1998, it would have
assisted in the analysis of the problem which arose on that day. Whether use would
have been made of the information if it had been available does not appear from the
evidence. It is, therefore, not possible to say whether the departure from proper
maintenance standards, practices or policies with respect to these matters caused or
contributed to the explosion, fire or failure of gas supply.

• Asset management practices and policies

Insofar as the failure to conduct the HAZOP study for GPI and the reduction of
supervision at Longford, including the transfer of engineers to Melbourne, were a result
of Esso's desire to control its operating costs, asset management practices or policies
may have been a contributing factor to the explosion, fire and failure of gas supply.
However, it is not possible to establish any more direct causal link.

• Risk management procedures and emergency procedures in force at tbe time of the
occurrence

The failure to conduct a HAZOP study for GPl or to carry out any other adequate
procedures for the identification of hazards in that plant has already been recognised as
a contributing cause of the accident on 25 September 1998.

237
 So far as emergency procedures are concerned, the emergency response on
25 September 1998 was, in all the circumstances, appropriate and effective.
Shortcomings were identified but they were minor and did not affect the ultimate
outcomes.

• Any relevant changes in the standards, practices, and policies referred to in sub-
paragraphs (b), (c), (d) and (e), which had taken place before the occurrence.

As observed above, the reduction of supervision at Longford, including the transfer of

engineers to Melbourne, may have contributed to the accident but it is not possible to
establish a direct causal link.

• The hydrate incident at the Longford facilities which occurred in June 1998, and
any other previous incidents considered by the Commission to be relevant.

The formation of hydrates in the slugcatchers in June 1998 was not a cause of, nor did it
contribute to, the events which occurred in GPI on 25 September 1998. However, the
formation ofhydrates has the potential to disrupt gas supply. This is dealt with below.

The cold temperature incident which occurred on 28 August 1998 made no direct
contribution to the explosion, fire or failure of gas supply on 25 September 1998.
However, the failure to report the incident deprived Esso of an opportunity to alert its
employees to the effect of loss of lean oil flow and to instruct them in the proper
procedures to be adopted in the event of such a loss. Had the incident been reported and
appropriate action been taken after the report, the events of 25 September 1998 could
have been averted.

• Whether there was any breach of, or non-compliance with, the requirements of any
relevant statute or regulation by Esso or BHP

The causes of the accident on 25 September 1998 amounted to a failure to provide and
maintain so far as was practicable a working environment that was safe and without
risks to health. This constituted a breach or breaches ofs.21 ofthe Occupational Health
and Safety Act 1985 (Vie).

TERMS OF REFERENCE- CLAUSE 3

15.8 Clause 3 of the Terms of Reference asks what steps should be taken by Esso or BHP to
prevent or lessen the risk of: (a) a repetition of the incidents which occurred at the Longford

238
 facilities on 25 September 1998; or (b) a further disruption of gas supply from those
facilities.

15.9 GPl does not now employ a lean oil absorption process as a means of producing sales gas.
Whilst that situation continues, there can be no repetition ofthe events which occurred on 25
September 1998. However, were Esso to re-instate that process, all equipment used should
be adequately protected against low temperature as a consequence of loss of lean oil
circulation, either by the use of steels suitable for low temperatures or by adequate warning
devices and shutdown systems. In addition, appropriate risk assessment procedures should
be rigorously applied to any such re-instatement. With the plant operating as it does at the
moment, there remains a need to review all ESD systems against current good engineering
practice to ensure the effective isolation of the three gas plants from each other and the CSP.
Esso should take that step.

15.10 The disruption to the supply of ethane continues and Esso should take steps to restore it to
its pre-September 1998 level.

15.11 Otherwise, the steps to be taken by Esso are those involved in obtaining approval of a safety
case or safety report. These are dealt with below under the heading "Recommendations."

15.12 BHP has no responsibilities, except in a financial sense, for the actual operation of the plants
at Longford. The Commission does not, therefore, recommend any steps to be taken by
BHP.

RECOMMENDATIONS

15.13 Apart from the specific steps above which the Commission considers that Esso should take,
more general questions remain as to the future operation of Esso's facility at Longford, not
only with regard to safety, but also with regard to the continuity of gas supply.

15.14 It is apparent that reliance upon OIMS to achieve a safe working environment in GPl on 25
September 1998 was misplaced. The Commission is of the view that external obligations of
a detailed and comprehensive kind (albeit identified by Esso itself) should be imposed upon
Esso in order to avoid the repetition of an accident such as occurred on that day. Those
obligations must be monitored to ensure that they are met and that aims similar to those
expressed in OIMS are achieved in practice.

15.15 To this end, Esso should be required to evaluate the design of critical areas of its facility at
Longford with a view to minimising the risk of a serious accident occurring. It should be
required to develop an isolation philosophy and to examine its ESD system in order to

239
 determine whether modifications, such as provision for the isolation of inventory within
particular areas of each plant or the capacity to depressurise isolated sections of a plant,
would avoid consequences of the kind experienced on 25 September 1998. Esso should be
required to assess the safety limits of the metal used in vessels and pipes having regard to
the possibility of operating temperatures above or below design limits.

15.16 Esso should also be required to demonstrate that its operating standards, practices and
policies are periodically reviewed and that the documentation of each identified procedure
includes an explanation of the potential hazards associated with the procedure. The critical
procedures include start up, controlled shutdown, emergency shutdown and any deviation
from normal operating conditions.

15.17 Of central importance is the training by Esso of its employees. An obligation should be
imposed upon Esso to demonstrate that its training programmes and techniques impart
knowledge of all identifiable hazards and the procedures required to deal with them. Not
only should Esso be required to demonstrate that the necessary knowledge is imparted, but
also that it is retained for use in an emergency. Esso should be required to show that written
procedures are readily available to operators to enable them to respond to deviations from
normal process conditions and that its management systems are expressed in a readily
understandable form. Esso should also have to identify an incident reporting procedure, not
only for injury to personnel or damage to plant, but for process upsets of a significant kind.

15.18 Finally, Esso should be required to show that plant operations are monitored and operating
practices are overseen at an appropriate level. This would require an assurance that access
to sufficient engineering, operating and maintenance skills would be available on site at all
times and that there would be regular and comprehensive surveillance of operating practices,
using properly kept records as well as day to day observations.

15.19 The means by which these and other requirements to ensure the safe operation of the facility
at Longford might be met is to be found in the safety case or safety report procedure already
referred to in Chapter 14. Under that procedure a safety case or report prepared by the
operator of a major hazard facility, such as Esso, must be accepted by the relevant authority
as a prerequisite to the operation of the facility. Failure to comply with the safety case
would be an offence.

15.20 A safety case of the type suggested would contain an identification of all hazards having the
potential to cause a serious accident, a detailed and systematic assessment of risk, a
specification of the steps taken to minimise the likelihood of an accident and a description of

240
 the design and layout of equipment, including the use of protective devices to ensure the
reduction of risk so far as is reasonably practicable. The identification of hazards would be
required to be continual and the safety case would specifY the requisite inspection,
maintenance and testing programmes.

15.21 The safety case would identifY systems for monitoring, auditing and reviewing the
implementation of its safety policies, procedures and performance standards and would
identifY all standards, Australian and international, to be applied in the design, construction,
installation and operation of the facility or plant used in connection with the facility.

15.22 A safety case would also specifY an office within the facility, the occupant of which would,
while on duty, be responsible for the safe operation of the facility. It would require each
employee working in the facility to be competent and to have the necessary skills, training
and ability to undertake in both normal and abnormal conditions, including emergency
conditions and during changes to the facility, the tasks allocated to that employee and to
respond to conditions appropriately.

15.23 A fire risk analysis would be contained in a safety case, together with a response plan for
possible emergencies. The safety case would specifY adequate procedures for shutting down
or isolating, in the event of an emergency, each pipeline connected to or within the facility
to stop the flow of hazardous materials through the pipeline. It would require the reporting
of significant accidents and incidents.

15.24 An adequate safety case for Esso's facility at Longford would deal with the particular
requirements of that facility and would address the problems disclosed by the events of
25 September 1998 and this inquiry.

15.25 Esso's facility at Longford is, however, not the only major hazard facility in Victoria and it
would be inappropriate to confine the safety case procedure to a single onshore major hazard
facility. A government authority would be required to administer such a procedure and its
powers should extend to all major hazard facilities within the State.

15.26 For these reasons, the Commission recommends that a safety case or safety report procedure
of the kind identified be extended by legislation to all major hazard facilities within the State
and that a specialist agency, sufficiently independent of the VWA to avoid any conflict of
interest, be established to administer that procedure

15.27 The safety case or safety report procedure deals with matters of safety. In so doing, it deals
co-incidentally with most of the circumstances which would give rise to a failure of gas

241
supply. There are, however, some circumstances, such as those of the hydrate incident in
June 1998, which do not pose a threat to safety but do pose a threat to supply. The
Commission has given consideration to a means whereby an obligation might be imposed
upon Esso to maintain the supply of gas, in the same way as an obligation may be imposed
upon it to maintain safety standards. However, in a situation where Esso is virtually the sole
supplier of gas to Victoria, the imposition of such an external obligation would serve little
practical purpose. Esso is aware of its responsibility to those who are dependant upon it for
gas supplies. It is clearly within Esso's own interests, commercial and otherwise, to ensure
the maintenance of supply. Moreover, the steps which have been, and are being, undertaken
by Esso following the events of 25 September 1998 should, together with the
implementation of the Gas Management System, be sufficient to enable it to maintain
supply, provided those steps can be completed without delay.

242
 Appendix 1
THE FUNCTIONING OF THE COMMISSION

A.t On 12 October 1998 the Victorian Government announced its intention to establish a Royal
Commission of Inquiry into the explosion and fire at Longford on 25 September 1998.
Letters Patent were issued by His Excellency, the Governor of Victoria, on 20 October 1998
appointing the Honourable Sir Daryl Michael Dawson AC, KBE, CB and Mr Brian John
Brooks BE, FIEAust, FAIP, FAIE, FIE as Commissioners and appointing Sir Daryl Dawson
as Chairman. The Terms of Reference of the Commission are attached to the letter to His
Excellency, the Governor, accompanying this Report. Attachment 1 to this Appendix lists
significant dates in relation to the Commission.

A.2 From the outset, the Victorian Government Solicitor made available a team headed by Mr
Jonathan Smithers to provide legal services to the Commission and, by the time of its formal
establishment, counsel to assist the Commission had already been engaged. They were Mr
James Judd QC, Mr Simon Marks and Mr Ron Gipp. Mr Martin Grinberg was subsequently
added as counsel assisting. Miss J ane Kennedy was appointed Secretary to the Commission
and administrative support services were provided by the Department of Justice.

PREMISES

A.3 It was apparent that a number of parties would be seeking leave to appear before the
Commission and that premises large enough to accommodate them and their legal
representatives would be required for the public hearings of the Commission. After
consideration of a number of sites, two levels in the building at 360 Collins Street were
selected and leased by the Department of Justice. The total space leased was 2,039m2
2
comprising 1241m2 on level29 and 798m on level31. The location ofthe pillars on level
29 allowed for the speedy and simple construction of a hearing room with four entry points
from the lift lobby. It was desirable from the point of view of security that the
administration of the Commission be located on a different level from the hearing room and
the space on level 31 enabled such an arrangement to be made. Very little adaptation on
level 31 was required to make it suitable for the Commission's purposes.

A.4 The premises at 360 Collins Street were selected on 27 October and by 14 December 1998
the necessary works had been completed to enable the Commission to commence

243
 continuous public hearings. Tradesmen and technicians worked a considerable amount of
overtime making alterations and installing cabling and equipment to enable the early
commencement of hearings.

A.s The Supreme Court of Victoria had previously developed a purpose-built court room to
accommodate a large trial known as the Estate Mortgage triaL After the completion of that
trial the court room had been dismantled and the joinery work stored. The Supreme Court
allowed the judge's bench, the associate's workstation and the witness box to be
reassembled in the Commission's new premises, saving both expense and time.

A.6 Adequate public seating was made available in both the hearing room and the open area
adjoining the hearing room where proceedings could be viewed by means of closed circuit
television. Representatives of the media, in particular, used this area which allowed them to
move in and out more freely than they could from the hearing room. Three different views
of the hearing room were taken by cameras in fixed positions in the hearing room and
displayed on three monitors in this area.

A.7 Large video monitors were installed at various locations in the hearing room to project
documents referred to in the questioning of witnesses. A document camera in the witness
box enabled the witness to point to a particular aspect of a document and, where necessary,
to zoom in upon that aspect for a closer view. This proved to be of great use having regard
to the many drawings and diagrams referred to during the Commission's hearings.

A.8 Cabling was installed in the hearing room to enable the viewing of real time transcript. The
parties provided their own monitors. Telephone lines and modems were also installed in the
hearing room to enable the parties and their legal representatives to telephone or fax their
offices. Usage of these phone lines was at the expense of the parties.

A.9 The major parties were each allocated a meeting room on level 29. They were able to install
such equipment as they required at their own expense. Accommodation was also allocated
to the Victorian Government Reporting Service (VGRS).

A.IO Office furniture and equipment was purchased, generally second-hand, in order to minimise
the cost. Some items of equipment were leased for the duration of the Commission.

A.ll At the conclusion of the public hearings on 15 April 1999, level 29 was no longer required
by the Commission. However, the Supreme Court required a large court room for the
hearings in the case of Edinbay Pty Ltd & Ors -v- Aroni Coleman and the Commission was
able to make its hearing room available to the Court for that purpose, thus enabling a further

244
 use to be made of these facilities with a consequent saving in cost. Arrangements were
made for the Department of Justice to take over certain furniture and equipment used by the
Commission upon the completion of the inquiry.

TRANSCRIPT

A.l2 Transcription services were provided by the VGRS and real time transcript was available to
the Commission and those parties who chose to avail themselves of it. No charge was made
for this service. Transcripts of the Commission's public hearings were also available
through the VGRS's internet site. At the time of the Commission's Report, the number of
hits upon the internet site was in excess of 20,000, indicating a significant interest in the
Commission's hearings. The internet transcripts were viewed in locations as diverse as the
USA, Norway, Singapore, Vietnam and New Zealand. A mechanism was installed to enable
the internet feed to be switched off in the event that proceedings were required to be in
camera. While no order was made for in camera proceedings, witnesses were ordered out of
the hearing room. This order was deprived of much of its effectiveness when witnesses read
the transcript of the proceedings, as some of them did, on the internet.

A.IJ At the end of each day the final and corrected version of the transcript for that day was
entered on the internet. The day's proceedings could be downloaded on to personal
computers and hard copies could be made.

A.l4 A computer programme known as Transcript Analyser was used by the Commission and
counsel assisting the Commission. Co-ordinated by Ms Radhika Kanhai of the Victorian
Government Solicitor's Office, it proved a useful tool in the locating and collation of the
evidence contained in the 6,569 pages of transcript which the Commission's hearings
generated.

COMMUNICATIONS

A.l5 A local computer network was installed for the Commission's use on and between levels 29
and 31. Existing cabling left by previous tenants was employed for the purpose. An internal
electronic mail system was also created.

A.J6 The Commission's staff were assisted by the creation of an audio facility which enabled the
proceedings in the hearing room on level 29 to be heard through computers in the
Commission's offices on level 31. It enabled the lawyers and engineering experts to remain
aware of what was occurring in the hearing room while continuing with their tasks upstairs.

245
 THE CORONER'S INVESTIGATION

A.l7 The Victoria Fire Investigation Policy and Procedures, published by the Department of
Justice in March 1998, established policies and procedures for the co-ordination of the
various agencies with obligations or interests relating to the investigation of fires. The
agencies were the Victoria Police, the Department of Conservation and Natural Resources,
the Country Fire Authority, the Metropolitan Fire Brigade, the State Forensic Science
Laboratories and, more recently, the Victorian Workcover Authority. There is a steering
committee chaired by the State Coroner. Immediately following the explosion and fire at
Longford on 25 September 1998, the Coroner established a task force to investigate the
incident. Those involved were the Arson Squad from the Victoria Police, the Country Fire
Authority and the Victorian Workcover Authority. The Arson Squad took the lead and the
investigation was co-ordinated by Detective Senior Sergeant Hughes. Forensic experts were
engaged, in particular, Professor Rhys Jones from the Department of Chemical Engineering
at Monash University and Mr Robert Weiss from Orica Engineering Pty Ltd. Their roles
were co-ordinated by Inspector Willis of the Victorian Forensic Science Centre. lt was
anticipated that the Coronia) inquiry would take some six months before it was completed.

A.I8 The Coroner acted under his statutory powers to seize certain documents and critical
equipment and to preserve the integrity of the site of the incident at Longford, including the
control room ofGPl.

THE COMMISSION'S INVESTIGATION

A.I9 Upon the establishment of the Commission, the Coroner suspended his investigation. The
persons engaged in that investigation, including members of the Arson Squad, Professor
Rhys Jones, Mr Robert Weiss and Mr Michael Connell from the Victorian Workcover
Authority, joined the Commission's inquiry. There was a need for further expert advice
concerning the gas production process and associated management issues and to meet that
need the services of Det Norske Veritas (USA) Inc. (DNV) were engaged. DNV made
available a number of experts led by Dr Gary Kenney and Mr Mark Boult to advise the
Commission during the course of its proceedings and in relation to its report. Dr Kenney
had performed a similar role in inquiries in the United Kingdom, notably the Kings Cross
inquiry and the Piper Alpha inquiry. The DNV team included Dr Robert Hutchison, Mr
Stephen Robertson, Mr Michael Clarke, Mr Peter Tellesson, Mr Henk Herfst and Ms Megan
Brown. The Orica team assisting Mr Weiss included Mr Andrew Stewart, Mr Govind
Mudaliar, Mr John Heath and Mr Peter McGowan. Amongst others engaged by the
Victorian Government Solicitor were Professor Graham Richardson and Dr Graham Saville

246
 of the Imperial College, London, to advise in relation to process simulation, Mr Rod
Sylvester-Evans in relation to process issues, Professor Joe Matthews of Monash University
in relation to fluid testing and vessel inspection, Metlabs, Amec Engineering Pty Ltd, the
Commonwealth Defence Science and Technology Organisation in relation to metallurgical
testing and Holmes Fire and Safety Pty Ltd together with Tyco Aust. Pty Ltd to advise in
relation to fire-fighting systems. Additional engineers, Dr Luke Chippindall, Dr Belinda
Mathers and Ms Mary Tomsic, were engaged by the Victorian Government Solicitor to
provide technical assistance.

A.2o Materials in the possession of the Coroner's task force, including witness statements and
seized documents, were handed over by the Coroner to the Commission. Although the
handover was made pursuant to a summons issued to the Coroner, it was facilitated by an
amendment to the Evidence Act 1958 (Vie) which added s.l9A. That section removed any
impediment to the handover. At the same time another amendment was made to the
Evidence Act by the addition of s.l9D which provided that a witness should not be excused
from answering a question or from producing a document upon the ground of legal
professional privilege.

APPLICATIONS FOR LEAVE TO APPEAR

A.2I Notices were placed in various newspapers on 4 November 1998 inviting applications for
leave to appear before the Commission and announcing a preliminary hearing on 12
November 1998 to consider these applications. The Commission's premises at 360 Collins
Street were not completed by 12 November and the preliminary hearing was held in Court
Room 12 in the Supreme Court building. The Commission is indebted to the Supreme Court
for its making the court room available. It was already fitted out for real time transcript and
had a closed circuit television facility in an adjoining area so that proceedings could be
relayed for the benefit of those who could not be fitted in the court room.

A.22 17 applications for leave to appear were received by the Commission. Of these, three were
not pursued on 12 November and were not granted. Of the 14 which were pursued on 12
November, one application was refused. The remainder were granted. The application
which was refused was that of the Industrial Deaths Support and Advocacy group. Its
interests fell outside the Terms of Reference. Attachment 2 is a list of the applications for
leave to appear received by the Commission, indicating those applications which were
granted.

247
 HEARINGS

A.23 The Commission's hearings were held over a period of four months and occupied 53 sitting
days. The continuous hearings commenced on 14 December 1998 and continued until
23 December 1998 when they were adjourned for the Christmas break. It was intended that
the hearings should resume on 4 January 1999, but the resumption date was adjourned to
11 January 1999 to allow the parties time to assimilate an initial core bundle of evidentiary
material. The Commission sat continuously until 24 February 1999 when it adjourned to
allow a review of the evidence and the preparation of further evidence. Hearings
recommenced on 9 March 1999 and continued until 9 April 1999. On 15 April 1999 a final
hearing took place to enable counsel assisting the Commission to make their final
submissions. The parties were given until 26 April 1999 to file written final submissions.
Esso was given until 3 May 1999 to file a written response to the other parties' final
submissions.

A.24 The Commission generally sat from 10.15 am to 12.45 pm and from 2.15 pm to 4.15 pm
However, during the later stages of the hearings, the hours were extended in order to hasten
the conclusion of the proceedings. Initially, the Commission did not sit on Fridays in order
to give time to counsel assisting the Commission to marshall the evidence to be adduced.

A.25 Approximately 70 persons were in daily attendance before the Commission during the
hearings. These included the parties, their legal representatives (including counsel assisting)
and those instructing them. Attachment 3 contains a list of the thirteen parties appearing and
their legal representatives.

A.26 Sixty three witnesses were called to give evidence before the Commission. Some of these
were recalled from time to time. A list of the witnesses appears in Attachment 4. Five
hundred and ninety exhibits were tendered by the parties as indicated in the table below.
One hundred of these were tendered subject to an order under s.19B(2) of the Evidence Act
1958, restricting publication to the parties and their legal representatives and then for the
purposes of the Commission only.

248
 Exhibits tendered by parties

Counsel assisting the Commission 368

Esso 201
Gascor/State ofVictoria 10
Four unions 4
Trades Hall Council 4
Country Fire Authority 2
Workcover I
• Total 590

A.27 222 persons were interviewed by members of the Victoria Police assisting the Commission.
Some of these had already been interviewed by the police or the Victorian Workcover
Authority when the Commission commenced its investigation.

A.28 The Commission issued 92 summonses to produce documents, 74 of which were directed to
Esso. It also issued a number of summonses to give evidence and produce documents. In
response, the Commission received some 175,000 pages of documents, approximately
120,000 of which came from Esso. The documents filled approximately 650 lever arch files
occupying 13 five-shelf storage cabinets.

A.29 Esso did not produce a list of relevant documents enabling the Commission to identifY
precisely the material which it sought. This meant that the Commission had to seek a mass
of documentation by summons in order to determine what was relevant. It often took some
weeks for documents to be produced in response to summonses and when the material was
produced it often did not contain the information sought.

A.3o As a result, a series of informal document meetings was instituted on 2 February 1999. At
these meetings, experts from Esso and the Commission, in the presence of lawyers from
both sides, discussed and explained the requests for documents and other information.
These meetings did enable some documents with a high priority to be identified and
obtained more quickly.

WRITTEN SUBMISSIONS

A.3I Twenty-six written submissions were received by the Commission from the public. A
number of those submissions were from people who had worked in gas plants or similar
industries while others were from people making suggestions or expressing their views
about the inquiry and matters pertaining to the terms of reference. These submissions are
listed in Attachment 5.

249
 DOCUMENT MANAGEMENT

A.32 In November 1998, the Victorian Government Solicitor co-ordinated discussions amongst
solicitors for the major parties participating in the Commission's proceedings about the use
of an electronic document management system. A document management protocol was
agreed, based upon a common document numbering ("barcode") system. This was managed
by Ms Beth Allatt of the Victorian Government Solicitor's Office. The system was also
designed to allow the use of electronic images of documents. Images were provided
promptly by BHP and the State of Victoria. Ultimately, Esso also produced over 90% of its
documents in electronic form. Unfortunately, this was not done in sufficient time for them
to be used in that form to any significant degree. The first batch of electronic information
was produced by Esso on 18 January 1999, 11 weeks after the first hard copies had been
produced. The provision of electronic information never caught up with the provision of
hard copy so that hard copy was used throughout the hearings. Nor was the technological
capacity to distribute exhibits in electronic form used so as to avoid the need for
photocopying. Generally, documents which were tendered had to be photocopied hurriedly
by the Commission's staff and distributed to enable cross examination to take place without
delay. Thus, the Commission's hearings were "paper", rather than electronic hearings, and
did not make the best use of technology to reduce the volume of paper employed.

LEGAL PROFESSIONAL PRIVILEGE

A.33 On 21 December 1998, counsel for Esso sought to raise legal professional privilege in
objecting to a question asked by counsel assisting the Commission of a witness who was in
the witness box. The witness was legal counsel employed by Esso. Counsel assisting the
Commission placed reliance upon s.l9D of the Evidence Act in answering the objection.
Counsel for Esso then indicated that Esso wished to test the validity of s.19D in the Federal
Court of Australia. The witness was stood down to enable Esso to take that course.
Proceedings (VG733 of 1998) were commenced in the Federal Court on 23 December 1998
against the Commissioners and the State of Victoria. A case was stated for the consideration
of a full court raising the question whether s.19D was a valid law of the Victorian
Parliament. The matter was argued on 10 February 1999 and judgment was delivered on 1
April 1999. The Court (Black CJ, Sundberg and Finkelstein JJ) upheld the validity of
s.19D. Esso commenced proceedings in the High Court of Australia seeking special leave to
appeal against the judgment of the Federal Court.

A.34 In the meantime the Commission's hearings were nearing completion and the question
which had raised the issue of the validity of s.19D no longer required an answer for the

250
Commission to be able to conclude its inquiry. Had Esso not sought to test the validity of
s.l9D, the Commission's proceedings may have been shortened to some extent, but, in the
end, it was not necessary to pursue the question which gave rise to the Federal Court
proceedings.

251
 Attachment 1. Chronology of significant dates

25 September An explosion and fire occurred at the Longford Plant, killing Peter Wilson
1998 and John Lowery, injuring eight people and resulting in the cessation of all
gas supply from the Longford facilities.
I 12 October 1998 A Royal Commission was announced to inquire into the fire and explosion
at the Longford Plant.
20 October 1998 Terms of reference of the Royal Commission were entered in the Register of
Patents Book No.41 Page 166.
Terms ofReference of the Commission were published in a special edition
of the Victoria Government Gazette.
27 October 1998 Suitable accommodation for the Commission was selected.
4 November 1999 A notice appeared in various newspapers to:
announce the date of the Commission's preliminary hearing;
outline the procedure for lodging written applications for leave to appear
before the Commission; and
invite general written submissions.
6 November 1998 The first subpoena was issued by the Commission for the production of
documents.
12 November A preliminary hearing was conducted to consider applications for leave to
1998 appear (venue: Court 12 of the Supreme Court of Victoria)
ovember I ~a~~:;r of Commission staff moved in to 31/360 Collins Street (all initial
8 moved in by 14 December).
14 December Continuous hearings commenced in the Commission's hearing room located
1998 at 29/360 Collins Street.
23 December The Commission's continuous hearings were adjourned for Christmas.
1998
23 December Federal Court action: Esso commenced proceedings in the Federal Court of
1998 Australia to challenge the validity ofS19D of the Evidence Act 1958 (Vie)
(which gives a Royal Commission power to override legal professional
privilege).
11 January 1999 Continuous hearings resumed.
27 January 1999 Application was made by the Trades Hall Council to extend the terms of
reference of the Commission.
~ 1 February 1998 Application by the Trades Hall Council to extend the terms of reference was
refused.
9 February 1999 The date for completion of the Commission's report was extended to 30
June 1999 by order of the Governor. This order was entered in the Register
of Patents Book No.41 Page 183.
10 February 1999 Federal Court action: Hearing conducted. Judgement reserved.
24 February 1999 Continuous hearings were adjourned to a date to be fixed to enable the
preparation of expert testimony and for the parties to review material.
9 March 1999 Continuous hearings were resumed.
1 April 1999 Federal Court action: Decision handed down- validity of s.l9D was
upheld.
1 April1999 Federal Court action: Esso lodged an application for special leave to appeal
to the High Court.
9 Aprill999 Continuous hearings were completed.
15 April1999 Final submissions by counsel assisting the Commission.
26 April 1999 Final written submissions received from parties.
3 May 1999 Replies submitted by some parties.

252
 Attachment 2. Applications for leave to appear

Date ..
Annlication by: I On Behalf of: Notes
received
9111/98 Mallesons BHP Application
Stephen Jaques granted
10/11/98 Middletons Esso Application
Moore & Bevins granted
10/11/98 Arnold Bloch Victoria W orkcover Authority Application
Leibler granted
10/11/98 Gavan J. Bums Executrix and family of Peter Wilson Application
and the executrix of John Lowery (the granted
persons killed in the explosion).
10/11/98 Sullivan Braham The daughters of John Lowery (killed Application
Pty in the explosion) granted
I 0/11/98 Maurice Four unions which represent the entire Application
Blackburn & Co workforce at Longford whose members granted
where killed or injured (Australian
Workers Union; Australian
Manufacturing Workers Union; the
Communications, Electrical, Electronic
Machinery, Postal, Plumbing and
Allied Services Union of Australia and
the Australian Services Union).
10/11/98 David Grace Q.C. Industrial Deaths Support & Advocacy Application
refused
10/11/98 Free hill The State of Victoria (including Application
Hollingdale & relevant departments, agencies or granted
Page authorities); and Gascor (including
respective subsidiary and/or associated
companies as applicable)
10/11/98 Huntsman Huntsman Chemical Company Application
Australia Ltd granted
10/11!98 Cornwall Stodart Kemcor Olefins PIL & Subsidiaries Application
granted
10/11/98 Victorian Trades Affiliated union organisations: United Application
Hall Council Firefighters Union & Community and granted
Public Sector Union, and Building
Industry Group ofUnions
10/11/98 Maddock Lonie & Country Fire Authority Application
Chisholm granted
10/11/98 Howie & Maher Leader of opposition in the State of Application
Victoria - Mr John Brumby granted
Shadow Minister for Workcover-
Mr Theo Theophanis
Shadow Minister for Minerals &
Energy - Mr Peter Loney
10/11/98 Phillips Fox Insurance Council of Australia Ltd Application
granted
10/11/98 Australian Society Australian Society ofCPAs No appearance
ofCPAs
10/11/98 Shayne Keenan Shayne Keenan No appearance
11111198 Diane Anderson Tooronga ALP No appearance

253
 Attachment 3. Parties with leave to appear before the Commission

Partv Solicitor Counsel

Counsel assisting the Commission Victorian Government Solicitor's James Judd QC
Office SimonMarks
Ron Gipp
Martin Grinberg
BHP Mallesons Stephen Jaques Neil Young QC
Charles Scerri QC
Nemeer Mukhtar
Esso Middletons Moore & Bevins John Middleton QC
Malcolm Titshall QC
Michael Hennessy
Tony Kelly
Peter Booth
Tim Walker
Greg Harris
The Victorian Workcover Arnold Bloch Leibler Robert Richter QC
Authority Neil Clelland
Executrix and Family of Peter Robert Smart & Assoc Pty Ltd Gavan J. Bums
Wilson and the executrix of John
Lowery
Daughters of John Lowery Sullivan Braham Pty David O'Doherty

A~,AM~,CEPU,ASU Maurice Blackbum & Co Paul Scanlon

(Workforce unions at Longford
facilities)
State of Victoria and Gascor Freehill Hollingdale & Page Alan Archibald QC
Geoffrey Nettle QC Jonathan
B.R. Beach
Stewart Anderson
Huntsman Chemical Company Norton Smith and Co Paul Anastassiou
Australia Pty Ltd
Kemcor Olefins PIL & Cornwall Stodart Peter Bick QC
Subsidiaries
Affiliated union organisations Stary George & Myall Mark E. Dean
United Firefighters Union & Rachel Doyle
Community and Public Sector
Union
Victorian Trades Hall Council
Hub bard)
Country Fire Authority Maddock Lonie & Chisholm Andrew Kirkham QC
Mark Henry
Brian Waiters
Leader of opposition in the State Howie & Maher Stuart Morris QC
of Victoria - Mr John Brumby Greg Wicks
Shadow Minister for Workcover Mark Dreyfus
Mr Theo Theophanis Damien Murphy
Shadow Minister for Minerals & Gregory Meese
Energy- Mr Peter Loney
Insurance Council of Australia Phillips Fox Ross H. Gillies QC
Ltd Geoff G. McArthur

254
 Attachmen/4. Sequential list of witnesses called

No. Witness Position Date

Examined
1 OLSEN Robert Chairman & Managing Director Esso 16 Dec 98
Courtney Australia Ltd
2 VANDERSTEEN Maintenance Fitter, Longford Plant 16 Dec 98
Shane
3 MILLER Robert Operations Technician 2, Longford Plant 17 Dec 98
4 WATSON Jason Trainee Operations Technician, Longford 17 Dec 98
Plant
5 GALLAGHER Process Technician 2, Longford Plant 17 Dec 98
I Martin
6 SHERRY David Operations Manager, CFA 17 Dec 98
7 HARRISON Longford Winter 1999 Gas Projects Manager, 21 Dec 98
William Longford Plant (Engineer)
8 WORRALL Denis Counsel for Esso 21 Dec 98
9 JONES Mark Officer ofthe CFA 22 Dec 98
10 JOYCE Laurence Acting General Manager, Worley ABB 22 Dec 98
11 BENNETT Stephen Process Technician 2, Longford Plant 22 Dec 98
12 CUMMING Grant Operator in the Control Room Rotation, 23 Dec 98
Longford Plant
13 FOSTER Gregory Technician 1 Operator, Longford Plant 12 Jan 99
14 BORTHWICK Sheet metal worker, Longford Plant 12 Jan 99
Darren (contractor)
15 DELAHUNTY Control Room Operator, Longford Plant 13 Jan 99
David
16 ANDERSON Operations Technician 2, Longford Plant 13 Jan 99
Robert
17 KNIGHT Andrew Mechanical Fitter with Workhire 13 Jan 99
(contractor)
18 RICKERBY Robin Control Room Operator, Longford Plant 13 Jan 99
19 JACKSON Martin Trainee Operations Technician, Longford 13 Jan 99
11
Plant
20 ELLIOT Robert Technician 2 Panel Operator, Longford Plant 13 Jan 99
21 NOBLE Andrew Plant Supervisor, Longford Plant 18 Jan 99
22 GIBBS Michael Control Room Operator, Longford Plant 18 Jan 99
23 SMITHDavid Tech 2 Operator Technician, Longford Plant 19 Jan 99
24 NADEBAUM Process Technician Level Two, Longford 19 Jan 99
Richard Plant
25 WEISS Robert Senior Consultant, Orica Engineering Pty Ltd 19Jan99&
21 Jan 99
26 MUNNRodney Operations Integrity Group Safety Co- 21 Jan 99
ordinator, Longford Plant
27 YOUNG Peter Training Officer employed by South East 21 Jan 99
Australian Training Services (division of the
East Gippsland Institute ofTAFE)
28 OWEN Richard Manager responsible for engineering for Gas 21 Jan 99
Plant I restart, (previously Technicial Director
-Offshore)
29 TOBENPaul Offshore Operations Superintendant 21 Jan 99
See 19 Jan ISS Robert Senior Consultant, Orica Engineering Pty Ltd 27 Jan 99
30 BURLEY Peter Operations Technician 2, Longford Plant 27 Jan 99
31 JONES Professor Professor of Mechanical Engineering at 27 Jan 99
Rhys Monash University
32 HOGANPeter Operations Technician Level2, Longford 28 Jan 99
Plant

255
 No. Witness Position Date
Examined
33 WATTSDavid Plant Operator Esso .:.o .I<Ul 99
See 19 Jan SS Robert Senior Consultant, Orica Engineering Pty Ltd 28 Jan 99
34 ILSON Ray Plant Supervisor, Longford Plant 1 Feb 99
35 ROBINSON Noel Operation Technician, Compressor Rotation, 2 Feb 99
Longford Plant
36 McFARLANE Process Technician 2, Longford Plant 3 Feb 99
Peter
37 OLSSON Wayne Control Room Operator, Longford Plant 3 Feb 99
38 WIJGERS Plant Supervisor, Longford Plant 3 Feb 99
Johannes
RA WSON Ronald
Operations Technician Level 2, Longford 4 Feb 99
Plant
40 SHEPARD ' ~uction Co-ordinato,, Crude and Powcr I ".,.,_,_ 99
neration, Longford Plant
41 WARD James Control Room Operator, Longford Plant 11 Feb 99
42 ROBINSON Bru Mechanical Technician 2, Longford Plant 16 Feb 99

43 KENNEDYian Relief Plant Supervisor, Longford Plant 16 Feb 99

!
44 VISSER William Plant Supervisor, Longford Plant 17 Feb 99
I_ 45 HECTOR William Technician Two Operator, Longford Plant 22 Feb 99
46 LEE Mark Maintenance Supervisor, Longford Plant 24 Feb99
47 KEADY Patrick Mechanical Maintenance Supervisor, 24 Feb99
Longford Plant
11 48 SARGENT Glenn Project Manager, Infrastructure Development, 9 Mar 99
VWA
49 SUNDERLAND Maintenance and Reliability Supervisor for 9 Mar 99
Phillip Esso Norge A/S (Norway) on assignment
from Esso Australia Ltd
50 LEA David Executive Director Minerals and Petroleum 10 Mar99
Division, Department ofNatural Resources
and Environment
51 COLEMAN Peter Operations Manager, Esso Australia 10 Mar99
52 SHINNERS Production Technology Manager, Esso 16 Mar99
Christopher Australia
See 17 Dec SHERRY David Operations Manager- CFA 17 Mar 99

53 MUSGRAVE Luke Gas Plant Restart Manager, Longford Plant 22 Mar 99

54 DASHWOOD John Special Projects Manager, Longford Plant 24Mar 99
11 See 21 Dec HARRISON Longford Winter 1999 Gas Projects Manager, 24Mar99
William Longford Plant
55 SIKKELMark Director ofEsso Australia Ltd (EAL) and 25 Mar 99
Esso Australia Resources Ltd (EARL)
See 16 Dec OLSEN Robert Chairman and Managing Director of Esso 26 Mar 99
Australia Ltd (EAL) and Esso Australia
Resources Ltd (EARL)
See 21 Jan YOUNG Peter Training Officer employed by South East 29 Mar99
Australian Training Services (a division of the
East Gippsland Institute ofTAFE)
56 KENNEY Dr Gary President, Det Norske Veritas -USA, Inc 29M
57 SYMES Peter Gas Management System Implementation 30 Mar99
~ T eader, Esso Australia Ltd.
I See 27 Jan 1.'\.TII ~-JONES Professor of Mechanical Engineering, 30 Mar 99
Professor Monash University
See 29 KENNEY Dr Gary President, Det Norske Veritas -USA, Inc 30 Mar 99
Mar
See 19 Jan WEISS Robert Senior Consultant, Orica Engineering Pty Ltd 30 Mar99

256
! No. Witness Position Date
Examined
58 KEENGordon Supervisor, Recovery Enhancement Projects 31 Mar99
Robert Group, Esso Australia Ltd
59 REINTEN Ronald Planning Supervisor for Esso Australia Ltd 6 Apr99
(EAL)
See 29 KENNEY Dr Gary President, Det Norske Veritas -USA, Inc 6 Apr 99
Mar
60 HOPKINSDr Senior Lecturer in Sociology, the Australian 7 Apr99
Andrew National University I

8~~
61 BAKER Kenneth Vice President of Baker & O'Brien, Inc
62 COLLINS Charles President, Barnes and Click, Inc 9A
63 STICKLES Dr Principal specialising in Process Safety and 9 Apr 99
Raymond Risk Management consulting

257
 Attachment 5. General submissions received by the Commission

No. Date received From

1 6/11/98 John Clark
Former Group General Manager ofBHP Engineering (1989-1995).
2 9/11198 L.S. Black
3 10/11/98 Austhenn Pty Ltd
4 10/11/98 Peter Horan
5 10/11/98 Diane Anderson Tooronga Branch ofALP
6 I 0/11/98 A. Jamieson
Woodside Energy Ltd (NWSV)
7 11/11/98 MervWilson
RAWDEEAL (Residents Against Waarre Development Endangering
Environment And Landuse)
8 13/11/98 John Shaw
Former General Manager of Gas & Fuel Corp 1981 -1988
9 17/11/98 David Healy
Ex employee of Esso-BHP offihore oil facilities
9A 25/11/98 John King
Retired chemical engineer
10 1/12/98 Shayne Keenan
11 1/12/98 GeoffPeverell
Ex employee of Gas & Fuel Corp.
12 4112/98 Bob Douglas
13 8/12/98 Anonymous Esso employee
14 21/12/98 John King
Retired chemical engineer
15 24/12/98 John Bottomley
Urban Ministry Network
16 13/1/99 John King
Retired chemical engineer
17 2111/99 Dr Wayne Chamley
Ex-employee ofDepartment of Natural Resources and Environment
18 25/1/99 A1ex Morozow
Offihore Safety Section, Petroleum Division, Department of Industry,
Science and Resources
19 25/1/99 Howie & Maher
On behalf qf the state opposition
20 17/2/99 A.G Hopkins
21 21112/98 Richard Casey !

22 25/2/99 Dr Kenneth Byrne

Australian Institute of Forensic Psychology

23 10/3/99 A.GHopkins
24 22/3/99 John King
"' ' mica/ engineer
25 19/4/99 Kelvin Thompson
Federal Member for Wills, Shadow Assistant Treasurer (former Victorian
Shadow Minister for Energy & Minerals)
26 10/5/99 John King
Retired chemical engineer

258
Appendix 2
GPl ISOLATIONS TO GAS PLANT PROCESS

P&ID Description Valve Service Comments

250-12692 GPI Propane Isolate valve to Propane to Chiller GP902A Liquid Isolate low press
Refrigerant Isolate valve to Propane to Chiller GP902B Isolated low press
Accwn. Isolate the makeup Propane to GP2 Regeneration System Isolated -low press
250-12682 Vapour from Isolate UV H109located at GPI Inlet Station Vapour Isolated
GP2 Feed
Liquid Strip
Isolate block valve to SNA depress line Vapour Isolated
250-12625 GP! to GP2 Hot Isolate from GP2 hot oil surge drwn GTI118 Hot Oil Isolated
Oil from
Storage
250-12593 GP11GP2 Isolate inlet/outlet from GP1102D Gas Isolated
Regeneration Treated Gas from GP! MOL Sieve- block valve dls FVGI07 & bypass Gas Isolated
Tie Line
250-12512 GP I Inlet MLA SIC isolation valve inlet to GPIIOl Gas Isolated
Separator BTA S/C isolation inlet to GP I! 01 Gas Isolated
GPIIOl -Inlet Isolate GP! emergency fuel gas makeup Gas Isolated
lsolations Isolate regen. gas comp. GP305NB/C from inlet to GPIIOl Gas Isolated
250-12584 Regen. Gas to Isolate block valve from GP! regen. gas scrubbers Gas Isolated
GPI/GP2 Tie
250-12570 Isolate GPI Isolate u/s ofFY !53 and bypass LPG Isolated
LPG Shipping Isolate u/s ofFY 152 and bypass LPG Isolated
Pwnp Discharge Isolate block valve u/s ofFT G152 LPG Not reqd. second block further u/s 205-
Header Isolate block valve u/s of FT G !53 LPG 12571
Isolate block valve to LPG booster pwnps LPG Not reqd. second block further u/s - 205-
12572
Not reqd. second block further u/s- 205-
12573
250-12510 GPI Inlet Isolate ESD 502.2 MLA Slugcatcher Inlet Gas Isolated
Control Valves Isolate ESD 502.l__!!_l'ft-. Slugcatcher Inlet Gas Isolated
 P&ID Description Valve Service Comments
Residue Gas from GP2 Sales Gas Header-
- MLA Inlet to GPI Gas Isolated
- BTA Inlet to GPI Gas Isolated
204-12508 GP! -Block valve upstream ofFIC 715 and bypass Liquid Isolated - no bleed reqd. HP system
Condensate - ESD 160 and 161 Liquid Valve not shut ESD failed- startup team
fromMLA -Block Valve upstream of LV LIC 705.B and bypass Liquid req this to open
Slugcatcher -Block valve u/s ofFCV 714 and bypass Liquid Isolated - no bleed reqd. HP system
- ESD 703A and ESD 703B Liquid Isolated - no bleed reqd. HP system
Isolated - no bleed reqd. HP system
204-12509 GP! BTNSNA Isolate valve from K.O. drum pump GT1222 Liquid Isolated needs to be reopened
Glycol Water
Line
204-12535 GPIIGP2 Inst. Isolate valve from GP! recirc. system Air Isolated
Air Tie
255-12502 Water Dump -Block valves up/down ofLVI05 Liquid Isolated needs to be reopened-boot GP2
GP2 Inlet Sep to Plus two bypass block valves Liquid Isolated needs to be reopened-boot GP2
Boot -Block Valve downstream of LV Hl03B Liquid Isolated needs to be reopened-boot GP2
Plus isolation to Boot (Block Valve) Liquid Isolated needs to be reopened-boot GP2

255-12503 GP2 S/C Filter -Two Outlets from GT1407 downstream ofLV HI06A and LV HI06B Liquid Isolated needs to be reopened-boot GP2
Sep Water Liquid Isolated needs to be reopened-boot GP2
Dump GT1407
255-12516 Isolate Inlet to - Isolate LVLC9 upstream and bypass Liquid Isolated- no bleed reqd. PSV protection
GP2 Demeth. - Isolate block valve LVLC9 and feed from GP2 expander Liquid Isolated- no bleed reqd. PSV protection
GT-1112
255-12518 Bypass to GP! - Isolate upstream of L VH 131, bypass to GP I Product Debut. Liquid Isolated and depressurised
Product Debut.
255-12523 Startup Gas - Isolate line from sales gas Fuel Gas Isolated
from GP! to - Isolate line from gas to knockout drum Fuel Gas Isolated
GT928 (Fuel - Check CSC valve Fuel Gas Isolated
Gas Header)
255-12524 Residue Gas - Isolate UV HI 05 Gas Isolated
from GP2 to - Isolate UV HI05 and bypass Gas Isolated
GP!
255-12525 GP2 Tie Line to - Close UV I 08B Gas Isolated
Recycle Gas - Block valves up/down FVH104 and bypass Gas Isolated
from GP!
Recompressors
255-12533 Outlet of Isolate PV H128A (Block Valve) downstream and Block Valve Dia. 150 to Flare Gas Isolated
GT1102 to GPI Gas Isolated
Recompression
 ------

P&ID Description Valve Service Comments

255-12534 Liquid Stripper LVHI22 Downstream Isolation to GP1 Product Debut. Gas Isolated
GT924 Isolate bypass to GPI Gas Isolated
255-12539 Isolate LPG Isolate UV-128 from makeup line (GPII I8A & B) Gas Isolated
Condensers
GT917
Isolate bleed to GTII28 uls UV Hl28 Gas Isolated
255-12542 GP2 andGP3 Isolate ESD UV H124 Liquid Isolated (bleeddown from 258-12518)
Tie Line to Isolate inlet line from GP3 demeth. bottoms Liquid Isolated (bleeddown from 258-12518)
Product Debut. Isolate block valve to debut. feed preheatcr Liquid Isolated and at low press
Isolate block valve from LPG product rerun pump 1213 Liquid Isolated and at low press
Isolate uls and d/s of FY H161 and bypass Liquid Isolated and at low press
255-12560 Isolate Fuel Gas Isolate block uls of FE H174 Fuel Gas Isolated
Heaters GT928
255-12577 Flare K.O. -Downstream Block Valve ofGTI222 (not reqd. for GPI isolation) Liquid Isolated -need to be reopened for boot
Drum Transfer -Block valve from returns ofGNI222 (not reqd. for GPI isolation) Liquid Isolated -need to be reopened for boot
Pump PU1TIP driver needs to be re-instated
250-12571 LPG Shipping Isolate ROV Gl78 LPG Isolated
Pumps to LPG
Pipeline
250-12527 GPI Residue Isolate ESD 6 Gas Isolated
Gas Scrubber to Block valve from fuel gas makeup to CSP Gas Isolated
Residue Gas Isolate block valve to meter run bypass Gas Isolated
Sales
204-12515 GPl Residue ESD6A Gas Isolated
Gas Scrubber to Isolate block valve to emergency bypass from S/C and emergency fuel gas to Gas Isolated
Residue Gas CSP
Sales
255-12530 Isolate Isolate block valve d/s TEH 504 Water/Glycol Isolated
Overflow from
Dewatering
Hydrocyclones
250-12633 Isolate Isolate block valve uls PCB Gl35A going to GP2 feed liq stripper GT1102 Water/Glycol Isolated
Condensate Isolate block valve from secondary dewatering hydrocyclone to GP2 feed liq. Water/Glycol Isolated
Overflow from stripper
Dewatering
Hydrocyclones
258-12518 GP3 Demeth. Isolate block valves uls and d/s ofFV L294 and bypass Liquid Isolated - scaffold reqd. to bleed liq
Reboiler Outlet locked line not critic
Products to CSP
viaGP2
255-12535 GP2 debut. feed Isolate UV H 127
------
Liquid Isolated
 P&ID Description Valve Service Comments
bottoms to CSP Isolate block d/s ofLVH 133 Liquid Isolated
204-12512 GPl inlet Isolate block valve on liquid overflow outlet Liquid Isolated- normally isolated
seperator Isolate block valves u/s and d/s ofLCV 502 and bypass Liquid Isolated- normally isolated
GP1126 Isolate block valves u/s and d/s ofLICV 502 A and bypass Liquid Isolated- normally isolated
discharge Isolate block valves u/s and d/s of LI CV 502 B and bypass Liquid Isolated- normally isolated
isolations Isolate block valve from gas offiake to KVR suction scrubbers Gas Isolated
Isolate block valve from gas offiake to MLA inlet valve station Gas Isolated
Isolate block valve on gas takeoff to emergency bypass to GFC p/line Gas Isolated
Isolate block valve on gas takeoff to fuel gas to C-926 and CSP Gas Isolated

250-12630 GPI water/ Isolate 2 off block valves on outlet from vessel Liquid Isolated- normally isolated
condensate sep Isolate block valves u/s and d/s ofLCV 501B and bypass Liquid Isolated - normally isolated
GP1125 Isolate block valves u/s ofLCV501C and bypass Liquid Isolated- normally isolated
Isolate block valves u/s and d/s of LCV 50 lA and bypass Liquid Isolated- normally isolated
Isolate block valves u/s and d/s ofPCVG 210 and bypass Liquid Isolated- normally isolated
250-12744 Isolate methanol Isolate block valves on 50 mm line from methanol storage tank CS 1306 Methanol Isolated- thermal relief available
transfer system
from GPI
References

Cun1iffe, R. S., "Prediction of Condensate Flow Rates in Large Diameter High Pressure Wet
Gas Pipelines", The APEA Journal (1978)

Esso Australia Ltd., "Emergency Response Manual", Esso Australia Ltd., Southbank,
Australia ( 1997)

Esso Australia Ltd., "Emergency Response Support Data", Third Revision, Esso Australia
Ltd., Southbank, Australia (1998)

Esso Australia Ltd., "Longford Work Management Manual", Esso Australia Ltd.,
Southbank, Australia (1995)

Esso Australia Ltd., "OIMS Systems Manual", Third Revision, Esso Australia Ltd.,
Southbank, Australia (1997)

Esso Australia Ltd., "Operating Instructions for Absorption-Oil System", Engineering

Documentation Pty. Ltd, Australia (1975)

Esso Australia Ltd., "Plant Operating Procedures", Esso Australia Ltd., Southbank,
Australia ( 1996)

Esso Australia Ltd., "Risk Assessment & Management System Manual", Esso Australia
Ltd., Southbank, Australia (1996)

Esso Australia Ltd., "Safety Management Manual", Esso Australia Ltd., Southbank,
Australia (1995)

Lees, F. P., "Loss Prevention in the Process Industries", 2nd Edition, Butterworth-
Heinemann, Oxford, UK (1996)

Lord Robens (chair), "Safety and Health at Work", HMSO, London, UK (1972)

McNeil, J.B., "Longford Incident Investigation Team Report", Esso Australia Ltd.,
Southbank, Australia (1998)

Symes, P. E., "Benefits from Change in Pipeline Hydrate Inhibitor", Aus.LM.M Conference,
Melbourne, Australia (1982)
Glossary of Terms
Term Description

Absorber A tower where the absorption process takes place. GPl has two
absorbers (A and B) which are equipped with valve cap trays that
allow direct contact between inlet gas and absorption oil.

Absorption A process whereby one or more components are removed from a gas
by bringing the gas into contact with a liquid that has an affinity for
the components to be removed.

Absorption Oil See "Lean Oil".

Accumulators A vessel that receives and temporarily stores a liquid.

Actuator The part of a control valve that moves the valve plug. May be
pneumatic, electric, hydraulic or gas powered.

Alarm A warning device that advises the operator of an abnormal process

condition, usually by sounding a horn and flashing a warning light.

Amine Switch The building in GP I that contained the electrical switching

Gear Building equipment for the amine treating facilities.

Bailey system The modem computer-based control system used to control the CSP,
GP2 and GP3, as well as parts of GP I.

Barracouta Referring to the Barracouta Gas Field, or related plant including the
slugcatcher which primarily services the Barracouta field.

Battery Limits The boundary limits of a defined plant unit - eg. the effective
boundaries ofGPl within the Longford complex.

Block Valve A valve used to isolate one section of a plant from another. A block
valve is usually either fully open or fully closed and is not used to
regulate flow.
Term Description

Boiling Liquid Commonly referred to as a BLEVE, this phenomenon occurs when a

Expanding pressure vessel ruptures within a fire, and the released contents
Vapour Explosion simultaneously vapourise and combust. The resultant explosion has
enormous force.

Bottoms Material removed from the bottom of a distillation column as a

product stream.

Brittle Fracture A brittle fracture is defined as one that occurs without ductility or
deformation. Characteristic features of a brittle fracture are:

Fracture straight across the component section.

Retention of original dimensions if a broken component is

reassembled. An example is broken glass.

Microscopic fracture features include cleavage (of metal grains) or an

intergranular fracture path. In steels, a scanning electron microscope
(SEM) is required to view such microscopic features.

Tends to occur at lower temperatures, where deformation is inhibited

or prevented.

Tends to occur if component is restrained from moving or deforming

under a load, i.e. a condition of high restraint. Typically, a well-
braced, large or solid structure has more restraint.

Tends to occur at higher strain rates, which do not allow the material
time to deform. An extreme example of higher strain rate loading is
impact loading, for example the impact of a hammer on an item.

Less energy is required to fracture. Hence, where conditions are such

that a component tends to fracture in a brittle manner, fracture tends
to be more likely (easier) than if it were ductile.

Butane See Hydrocarbon

266
Term Description

Bypass A pipe connection around a valve, regulator, or filter, which is

opened to permit the passage of fluids while repairs or adjustments
are being made to the valve, regulator, or filter.

A pipe connection around a vessel that is partially ro fully opened to

control the amount of fluid that passes through the vessel.

Cable Ladders Support structures that carry cables around the plant.

Carry Over The unintended flow of liquid through the vapour outlet of a
processing vessel - eg. from the top of a distillation column.

Centrifugal Pump A type of pump or compressor that uses a rotating impeller to

I Compressor increase the pressure of a liquid or gas by centrifugal force.

Chiller A heat exchanger which cools a fluid using a refrigerant (see

refrigerant).

Condensate A light hydrocarbon liquid that is obtained by the condensation of

hydrocarbon vapours. Condensate consists of varying amounts of
propane, butane, pentane and heavier hydrocarbon fractions. It
contains little if any methane or ethane, unless it is produced by
chilling of the hydrocarbon vapour.

Any vapour that has condensed into a liquid (e.g. steam condensate).

Condenser A heat exchanger in which the heat of vapours is transferred to a flow

of air or other fluid, thereby causing all or a portion of the vapour to
condense into a liquid. In the absorption system, a condenser is used
to condense a large portion of the overhead vapours from the ROF.

Control Loop A group of instruments that together control, indicate or record one
process variable.

Control Valve A valve that can be controlled automatically to regulate the flow
through a pipe.

267
Term Description

Controller An instrument that maintains a process variable at a desired value

known as the "setpoint".

Cryogenic A process or item of equipment which operates at very low

temperatures (generally below -150°C). Now commonly applied to
processes operating at temperatures well below 0°C.

CSP The crude stabilisation plant at Longford, where liquids from the
Bass Strait Oil Fields are initially processed before passing to the
Long Island Point plant.

De-ethaniser See demethanisation

Dehydration A process whereby water vapour is removed from a gas. In a

refrigerated absorption plant, inlet gas must be dehydrated before it
can be processed. Otherwise, water vapour in the gas can freeze or
form hydrates before the gas is cooled to the processing temperature
of the absorber. Ice or hydrates can block trays and small diameter
flow lines and cause hazardous pressures.

Dehydrator An item of equipment designed to remove water from a stream.

Demethanisation The process of removing methane from a process stream

(demethanising). Similar processes to remove ethane and butane
respectively are called de-ethanising I de-ethanisation and
debutanising I debutanisation. Equipment items used for these
processes are demethaniser I de-ethaniser and debutaniser.

Design Pressure, These are the maximum pressure and temperature that a piece of
Design process equipment is designed to withstand during operation.
Temperature

Differential The difference between two fluid pressures, such as would exist
Pressure between two separate processes, or two parts of the same process (eg.
the inlet and outlet of a heat exchanger).

268
Term Description

Distillation A heat dependent process that is used to separate one or more

components (sometimes called fractions) from a substance that
contains these components. In a lean oil absorption system,
distillation is used to reject methane as well as recover heavier
hydrocarbons from rich oil.

Distillation A vertical pressure vessel used to separate the components of a fluid

Column based on their boiling points.

Double block and A method of ensuring the complete isolation of vessels or pipework,
bleed using two block valves with a bleed valve open to atmosphere
between them, thus ensuring that any leakage through either block
valve is drained away.

Drum A horizontal pressure vessel.

Ductility A property of a material that allows it to undergo deformation

without breaking.

Ductile Failure A ductile failure is defined as one that occurs with ductility or
deformation. Characteristic features of a ductile failure are:

Fracture at an angle to the component section, i.e. slanted or shear

fracture.

Original dimensions are irreversibly changed at the fracture. An

example is chewing gum, stretched until it breaks.

Microscopic fracture features include "dimples", each dimple

appearing like a miniature volcano containing a crater.

Tends to occur at higher temperatures, where deformation is easier.

269
Term Description

Tends to occur if a component is not restrained from moving under a

load, i.e. a condition of low restraint. Typically a component that is
unbraced, small or of thin section has less restraint. Hence, as a
fracture proceeds across a component section, there may be a
tendency for the fracture features to change from brittle to ductile, as
the remaining thickness of unbroken material diminishes. Whether it
does or not depends on factors such as the material involved,
temperature etc.

Tends to occur at lower strain rates, which allow the material time to
deform. Extreme examples oflower strain rate loading are "creep", or
sagging of a component over time.

More energy is required to fracture. This can partly be understood as

the creation of more fracture surface area, which requires more
energy.

Entrainment Carrying of small particles, droplets etc. in a flow of gas, particularly

in relation to distillation.

ESD System Emergency shutdown system a system that allows operators to

safely and rapidly shut down the plant in the event of an emergency.

ESDvalve Emergency shutdown valve a fast operating valve (commonly of

the gate type) which closes without allowing any leakage and is used
to isolate equipment in emergency situations.

Ethane See Hydrocarbon

Feed Liquid A distillation column in Gas Plant 2 that strips methane and ethane
Stripper out of condensate from the slugcatchers. Vapour from the Stripper
flows to the KVR compressors in Gas Plant I.

Feedback Arm A lever connected to the stem of a control valve used to confirm the
position of the stem (eg whether the stem is 3 5% open or 40% open).

270
Term Description

Fin-fan Air cooled heat exchangers where heat transfer is increased using
condenser/cooler fans to increase air circulation across tubes with fins to increase
surface area.

Fireball A fire, burning sufficiently rapidly for the burning mass to rise in the
air as a cloud or ball.

Flash Flashing is a crude distillation type separation used to provide a

coarse separation of light and heavy components in a feed, often
before feed to a distillation column.

Flash Tank A two or three phase separator that operates at a lower pressure than
upstream equipment. The resulting pressure drop that occurs as
process liquids enter the flash tank causes lighter material in the
liquid to vaporise or "flash" out of the liquid. In a lean oil absorption
system, one or more flash tanks are used to recover methane vapours
from rich oil.

Flooding If there is excessive entrainment of liquids through trays or liquid

back-up in the downcomers, a liquid level can build up above a
distillation column tray. This is known as flooding and significantly
reduces the effectiveness of the tower. This can also result in liquid
and vapour leaving the column via the vapour discharge pipe.

Fluid Any substance that can flow. This includes both liquids and gases
but excludes solids.

Glycol A liquid used to absorb moisture from natural gas and inhibit the
formation of hydrates. (TEG, Triethylene glycol, MEG, mono
ethylene glycol).

Handover The process of information transfer between a staff member who has
just completed a shift and the staff member taking over from him/her.

Heat Balance Calculation to check the flow of heat energy into and out of a system.

271
Term Description

Heat Exchanger Equipment used to transfer heat between two streams via indirect
contact (e.g. transfer of heat through a tube wall). Parts of a shell and
tube type heat exchanger are the tube bundle (the surface through
which heat exchange occurs), the channel (the section through which
tube side material enters the tubes), the tubesheet (a plate separating
the shell and tube sides). Material that passes through the tubes is
said to be on the tubeside, while material outside the tubes but within
the shell are on the shellside. Heat exchangers can be cocurrent
(with material passing through both sides in the same direction) or
countercurrent (with material passing through the sides in opposing
directions).

Heavy/s Higher molecular weight hydrocarbons (i.e. those containing a larger

number of carbon atoms.

HI-GOR well A well with a high ratio of gas to oil production. The HI-GOR wells
in the Snapper field also produced large quantities of water, but this
is not an inherent feature of a HI-GOR well.

Hydrate A crystalline hydrocarbon and water compound, which forms under

certain temperature and pressure conditions in gas processing and
transmission facilities. Hydrates can accumulate in process
equipment, thereby impeding fluid flow and causing hazardous
pressure conditions.

Hydrocarbon Any compound whose molecules are comprised solely of hydrogen

(H) and carbon (C) atoms. Oil and natural gas are hydrocarbons.
Common hydrocarbons found in natural gas include methane (CH4),
ethane (C2H6), propane (C3Hs), butane (C4Hw), pentane (CsH12) and
hexane (C6H14).

Hydrocyclone A device used to separate liquids and gases, liquids and solids or
liquids of differing densities using centrifugal force.

Hydrogen A substance present in natural gas which must be removed before

Sulphide (H2S) sale because of its toxic and other undesirable properties.
Term Description

Jet fire The combustion of material emerging with significant momentum

from an orifice.

Kings Cross A rack containing pipes transferring fluids between various

Piperack equipment items throughout the Longford site which was located
near GP922 and was affected by fire on the day of the incident.

KVRs Compressors GP30 1B/C that are used to compress flash gas and send
it back to the start of the process.

Lean Oil Also called absorption oil.

A hydrocarbon liquid, similar to aviation kerosene, that is used as an

absorbant to remove product-type hydrocarbons from natural gas.

Absorption oil that is essentially free of product-type hydrocarbons.

Light/s Lower molecular weight hydrocarbons (i.e. those containing a small

number of carbon atoms.

LPG Liquefied Petroleum Gas, a hydrocarbon mixture consisting mostly

of propane and butane. The raw LPG produced at Longford has a
significant ethane fraction.

Marlin Referring to the Marlin Gas Field, or related plant including the
slugcatcher which primarily services the Marlin field.

McNeil Report An internal Exxon report into the events on the 25th September.

Methane See Hydrocarbon

Molecular Sieve A material containing very fine channels or cavities which "capture"
a specific component, hence separating it out of a mixture of gases or
liquids.

Monitor A fixed position fire fighting nozzle used to spray water or foam on
to a fire.

OIMS Operations Integrity Management System

Term Description

Open drain A system of pipework operating at atmospheric pressure for the safe
system disposal of liquids spilled or drained in the plant.

Overheads Vapour flow off the top of a column.

Overheads Material removed from the top of a distillation column as a product.

Overpressure The pressure developed above atmospheric pressure at any stage or

location in a pressure pulse (blast wave).

Pass A valve "passes" when it does not close fully and some material
flows through it when it is shut.

PDT Portable Data Terminal, a handheld unit which is used in the field for
recording information about plant operation before being downloaded
to the SIDS computer system.

PIDAS (Process Information Data Acquisition System) A computer based

data system that collects and stores data from the Bailey system.

Pipe bridge A piperack that passes over a road or other passageway.

Piperack The support on which a large number of pipes are carried through the
plant.

Platform Offshore Oil/Gas platform, where crude oil and/or natural gas are
removed from sub-sea reservoirs and initial processing may take
place.

Pneumatic Control equipment which is operated by compressed air.

Equipment/
Recorders

Pool fire The combustion of material evaporating from a layer of liquid at the
base of the fire.

Positioner A part of a control valve that amplifies the signal from a controller
and causes the valve to move to a desired position.

274
Term Description

Presaturated The process of saturating lean oil with methane before using it in the
absorbers. This is done to prevent the heating of the lean oil in the
absorbers because of the absorption of methane.

Pressure Vessel A tank designed to withstand pressure. Must comply with specific
regulations.

Profs Esso Australia's internal electronic mail system.

Propane See Hydrocarbon

Raw Gas Unprocessed natural gas.

Re boiler A vessel, which uses direct (fired) or indirect heat exchange to add
heat to process materials. In a lean oil absorption system, reboilers
are used in rich oil demethanisation and lean oil distillation.

Reclaimer An item of equipment similar to a distillation column, which is used

at the Longford plant for removal of heavy components from lean oil
before recycle to the lean oil system.

Recorder An instrument that records the value of one or more process variables
(typically two or three) as a graph on a paper chart.

Reflux Liquid returned to a distillation column to improve the efficiency of

separation of the feed components.

Refrigerant A liquid, such as propane or freon, that boils at a very low

temperature. Refrigerant is used to carry away heat that has been
transferred to it by indirect contact with warmer process fluids in a
shell and tube type heat exchanger called a chiller.

Refrigerated Plant A type of plant which tends to operate at low temperature, typically
-20 to -50 deg C. GPl was a refrigerated lean oil absorption plant.

Release The discharge of energy or of a hazardous substance from its

containment system.
Term Description

Residue Gas Gas which has been stripped of heavier hydrocarbons or contaminant
(Sales Gas) gases. The term is often used to describe the top product from an
absorber or rich oil demethaniser. Residue gas is also called sales gas
when it is metered for sales.

Rich Oil Absorption oil that contains absorbed hydrocarbons.

Rich Oil A distillation tower that is used to remove ethane or methane

Deethaniser (depending on the mode of operation) from rich absorption oil while
(ROD) retaining heavier hydrocarbons for later recovery.

Rich Oil A distillation tower that is used to remove all of the absorbed light
Fractionator hydrocarbons remaining in the rich oil leaving the bottom of the
(ROF) ROD.

Rich Oil Trap One of the bottom trays in an absorber. All rich oil flowing down the
Tray absorber is "trapped" on this tray before leaving the absorber.

Roots Colloquial term for the units on an indicator or recorder measuring

flow using a square root scale.

Saturated Containing the greatest amount possible of another substance.

Scrubber A separator that is used to remove small amounts of liquid from a

flowing gas stream. Scrubbers are installed downstream of absorbers
to recover liquids that may be accidentally carried overhead along
with residue gas. Scrubbers are also used to protect gas compressors
from the hazardous effects of :free liquids in inlet gas.

Seal Flush, Seal In order to optimise centrifugal pump operation, a mechanical seal
Oil can be used. Seal oil is used as a seal flush to lubricate and remove
heat from the rotating mechanical seal.

Separator Item of process equipment used to separate gas and liquid fractions.

Setpoint The desired value of a process variable set by the operator on a

controller.

276
Term Description

Shell See Heat Exchanger

SIDS Surveillance Information Database System - the computer system

used for manually collected data about plant operation.

Sight glass A piece of equipment that allows visual observation of the level in a
vessel

Slug A large body of liquid that can accumulate in pipelines carrying both
gas and liquids. These slugs periodically carry forward with the gas
stream creating problems in handling the volume of liquid arriving at
the delivery point. Slugcatchers, such as those at Longford, serve to
'smooth out' these slugs for a more constant flow into the plant.

Slugcatcher A piece of equipment that has the purpose of receiving gas,

condensate and water from pipelines, smoothing out the arrival of
slugs, performing initial separations, and storing the liquids before
they are processed.

Snapper Referring to the Snapper Gas Field, or related plant.

Surge Tank A vessel through which liquids or gases are passed to reduce flow or
pressure surges.

Sweetening Removing hydrogen sulphide and other sulphur compounds from

natural gas.

Tag Number The number given to a control loop.

Temporary A board located in the Control room for the recording of protective
Defeats Board devices which have been removed/bypassed, or which have failed.

Terms of The scope of the Royal Commission and its authority to make
Reference (ToR) conclusions and recommendations

Thermal Shock Exposure to a sudden large change in temperature.

Term Description

Toolbox Meeting A meeting held at the beginning of each shift with operators and Shift
supervisors in order to discuss work to be carried out during the shift
and other matters.

Trap Tray See Rich Oil Trap Tray

Trip To automatically switch off as a result of operating conditions.

Tusks Part of Longford's slugcatchers. The inlet gas and liquids enter the
slug catcher barrels through relatively small, curved pipes known as
tusks, which accelerate the mixture into the barrels.

Upset A disturbance or abrupt change in the operating conditions of a vessel

or column that results in unstable operation, the production of off-
specification product or carry over ofliquid.

Valve Positioner See positioner

Valve Tray A type of internal fitting used in process columns that can be
operated at very low gas rates because of the ability of the valves to
be closed.

Wobbelndex An index of natural gas quality that defines its suitability for
combustion in industrial and domestic equipment.

Work Order A written request for maintenance or other work to be carried out on
Request a piece of equipment.
List of Abbreviations
Abbreviation Description

A Alarm

API American Petroleum Institute

AR Analyser Recorder

BHP BHP Petroleum (Bass Strait) Pty. Ltd.

Degrees Celsius

CFA Country Fire Authority

CFT Critical Function Test

CMT Crisis Management Team

COP Critical Operating Parameter

CSP Crude Stabilisation Plant

CV Control Valve

d Day

DCS Distributed Control System

DP Differential Pressure

DPAH Differential Pressure Alarm High

DPR Differential Pressure Recorder

EAL Esso Australia Limited

ECI Exxon Company International

ERP Emergency Response Procedure

279
Abbreviation Description

ESD Emergency Shutdown

F Flow

FC Flow Controller

FCA Field Change Approval

FI Flow Indicator

FIC Flow Indicator and Controller

FR Flow Recorder

FRC Flow Recorder and Controller

ft Foot

G Giga, prefix to units for 109

GDP Gross Domestic Product

GPl Gas Plant 1

GP2 Gas Plant2

GP3 Gas Plant 3

HAZOP Hazard and Operability Study

HFA High Flow Alarm

HFSD High Flow Shutdown

HLA High Level Alarm

HLSD High Level Shutdown

HPA High Pressure Alarm

HPSD High Pressure Shutdown

280
Abbreviation Description

hr Hour

HS Hand switch

HTA High Temperature Alarm

HTSD High Temperature Shutdown

I Indicator

IC Incident Controller

ICC Incident Control Centre

IMT Incident Management Team

J Joules

k Kilo, prefix to units for 103

k:Pa Kilopascal

KVR Compressors GP301B/C that are used to compress flash gas and
send it back to the start of the process.

L Level

Litre

LAN Local Area Network

LC Level Controller

LCV Level Control Valve

LFA Low Flow Alarm

LFSD Low Flow Shutdown

LI Level Indicator

281
Abbreviation Description

LIC Level Indicator Controller

LIP Long Island Point

LLA Low Level Alarm

LLR Longford Liquid Recovery plant

LLSD Low Level Shutdown

LPG Liquefied Petroleum Gas

LR Level Recorder

LRC Level Recorder and Controller

LTA Low Temperature Alarm

LTSD Low Temperature Shutdown

LWMM Longford Work Management Manual

M Mega, prefix to units for I 06

m Metre

Cubic Metre

MDMT Minimum Design Metal Temperature

MDQ Maximum Demand Quantity

MHF Major Hazard Facilities

MHU Major Hazards Unit

NC Normally Closed

NNF Normally No Flow

Degrees Fahrenheit

282
Abbreviation Description

OIMS Operations Integrity Management System

OSG Offshore Support Group

p Pressure

P&ID Piping and Instrumentation Diagram

PC Pressure Controller

PDT Portable Data Terminal

PIDAS Process Information Data Acquisition System

PRA Periodic Risk Assessment

PRC Pressure Recorder and Controller

psi Pounds per Square Inch

PSV Pressure Safety Valve

QRA Quantitative Risk Assessment

RAAF Royal Australian Air Force

RAMS Risk Assessment and Management System manual

RC Recorder and Controller

ROD Rich Oil Demethaniser (or Rich Oil De-ethaniser), Column

GP1109 in GPl

ROF Rich Oil Fractionator, Column GPlllO in GPl

sec Second

SIDS Surveillance Information Database System

SMM Safety Management Manual

283
Abbreviation Description

T Temperature

T Tera, prefix to units for 1012 •

t Tonne

TC Temperature Controller

TIC Temperature Indicator and Controller

TPA Transmission Pipelines Australia

TR Temperature Recorder

TRC Temperature Recorder and Controller

uv Multipurpose Valve

VWA Victorian WorkCover Authority

284
List of Figt1res
Figure 2.1 Simplified diagram of gas and oil flows from the platforms to end users 13
Figure 2.2 Overview of primary hydrocarbon flows to and from the Longford operating units 15
Figure 2.3 Gas pipelines and the Longford slugcatchers 15
Figure 2.4 Simplified overview of GP 1 and its process sections 17
Figure 2.5 Schematic diagram of an absorber 17
Figure 2.6 Schematic diagram of absorber trays 18
Figure 2.7 Fluid flows at the bottom of an absorber 19
Figure 2.8 The ROD and associated equipment 20
Figure 2.9 The ROF and associated equipment 21
Figure 2.10 Lean oil/ rich oil circulation 23
Figure 2.11 Aerial photograph of the Longford facility 25
Figure 2.12 Layout of GPI showing the Kings Cross piperack intersection 26
Figure 2.13 Photograph of GP1 Pneumatic Control Panel (taken after the Bailey equipment was
removed for examination) 27
Figure 2.14 Photograph of pneumatic controller 28
Figure 2.15 A pneumatic recorder in GP 1 28
Figure 2.16 Example recorder strip chart 28
Figure 2.17 Photograph ofGP1 alarm panels 29
Figure 2.18 Photograph of a typical Bailey workstation 30
Figure 2.19 The Bailey screen for the GP1 absorbers 30
Figure 2.20 Control instrumentation for absorber bottoms condensate 32
Figure 2.21 Line and support function management supervision for Longford operations 34
Figure 3.1 Strip chart showing the rise and sharp fall in the LRC2 Oil Saturator Tank level 44
Figure 3.2 ROF strip chart showing upset 46
Figure 5.1 Absorber condensate levels 18 to 25 September 1998 74
Figure 5.2 Absorber condensate temperatures 18 to 25 September 1998 74
Figure 5.3 Absorber level overrides 18 to 25 September 1998 74
Figure 5.4 Estimated condensate flows 24 to 25 September 1998 75
Figure 5.5 Oil Saturator Tank level and pressure 76
Figure 5.6 Flows into and out of the Oil Saturator Tank 77
Figure 5.7 Enlargement of LRC2 trace 78
Figure 5.8 ROD vapour outlet connection 79
Figure 5.9 Chart recording of ROD overhead flow (FR4), ROD differential pressure (DPR8) and
ROD bottom temperature (TRC4), for which no record is visible 79
Figure 5.10 Chart recording of Rich Oil Flash Tank level (LRCI) 81
Figure 5.11 Simulated LRCl setpoint change 82
Figure 5.12 Flows into and out of the Rich Oil Flash Tank 83
Figure 5.13 Heat exchanger GP922 85
Figure 5.14 Lean oil piping elevation 88
Figure 5.15 Thermal response ofGP904, GP905 and ROD following loss oflean oil 91
Figure 5.16 Flow path prior to changing HS4 from demethaniser mode 93
Figure 5.17 Flow path after HS4 was changed to de-ethaniser mode 94
Figure 6.1 Schematic view of the GP90 5 Re boiler 97
Figure 6.2 Naming convention used for exchanger parts 98
Figure 6.3 Details of tube sheet welds and nozzle attachments 98
Figure 6.4 Photograph ofthe failed end ofGP905 101
Figure 6.5 Schematic representation of the failure 101
Figure 6.6 Visible features of crack as viewed looking into the east end channel 102
Figure 6.7 Ligaments at the 7 o'clock position 103
Figure 6.8 Ligament at the 8 o'clock position 103
Figure 6.9 Close-up of the channel's fracture surface (around 5 o'clock) 103
Figure 6.10 Weld root cavity 104
Figure 6.11 Side view of flat region I 04
Figure 6.12 Tubesheet to channel weld flaw 105
Figure 6.13 Close-up of the 8 o'clock position (before cleaning the surface) 105
Figure 6.14 Close-up of the 8 o'clock position (after cleaning the surface) 105
Figure 6.15 Weld root slag inclusion at 8 o'clock position 105
Figure 6.16 Second crack in tubesheet to channel weld 106
Figure 6.17 Location of the secondary cracks in the compensation pads I 06
Figure 6.18 Finite element model for GP905 thermal stress calculations 108
Figure 6.19 Flaw cases for 3D modelling 109
Figure 6.20 Temperature at tubesheet to channel weld for Case 1 111
Figure 6.21 Temperature at tubesheet to channel weld for Case 2 111
Figure 7.1 The first film of the fire, taken at 12:41:55 116
Figure 7.2 The first major release, at 13:00:40 118
Figure 7.3 The first major release, at 13:00:43 119
Figure 7.4 The first major release, at 13:00:46 119
Figure 7.5 The second major release, at 13:22:47 122
Figure 7.6 The third major release, at 13:32:31 123
Figure 7.7 Thethirdmajorrelease,at 13:32:34 124
Figure 7.8 The third major release, at 13:32:37 124
Figure 7.9 The third major release, at 13:32:41 125
Figure 7.10 The third major release, at 13:32:43 125
Figure 7.11 The fire at 14:26:02 127
Figure 7.12 The fire at 15:26:02 128
Figure 7.13 The fire at 16:26:02 129
Figure 7.14 The fire at 17:26:02 131
Figure 7.15 The fire from behind the GP1201 pumps, at approximately 5.30 pm 132
Figure 7.16 Photograph taken at approximately 14:45 pm, 26 September, showing seats of fire in
Kings Cross piperack 135
Figure 7.17 Photograph taken at approximately 15:00, 26 September, fire still burning from
GP905 136
Figure 9.1 Gas sales for 4 October to 6 October 1998 157
Figure 9.2 Pipeline pressure for 27 September to 11 October 157
Figure 9.3 Modified GPl process after Phase 3 164
Figure 9.4 De-bottlenecking block diagram 168
Figure 13.1 Exxon Hazard Management Process 203

286
List of Tables
Table 5.1 Results of ROD flooding calculations 80
Table 9.1 Summary oflso1ations 152
Table 9.2 Longford plant capacity 170

287
 LEGEND

INSTRUMENTS: ACRONYMS:

0 FIB.D MOUNTED
LEVEL: TEMPERATURE:

8 PANB.. MOUNTED u Level I ndicalor T1 Temparalln I ndicalor

a DISTRIBUTED CONTROL
SYSTEM (Computsrlsed)
LC

LR
Level Controller

Level Recorder
TC

TR
Temperature Controller

Temparalln Recorder

EQUIPMENT: uc Level I ndicalor Conlroller TIC Temperature Indicator Conlrolar

LRC Level Recorder Controller TRC Temperature Recon:lar Controler

NON RE11JRN VAlVE
HLA H91 Level Alarm HTA High Tarnperature Alarm
OPEN VAlVE
LLA Low Lavel Alarm LTA Low T 8ITij)8ll!llw8 Alarm

HLSD H 91 Level Shu1down HTSD H 91 Temperature Shutdown

CLOSED VALVE
LLSD Low Level Shutlown LTSD Low Temperalln Shutdown
CONTROL VAlVE (VariBble position)

CONTROL VAlVE (Open/Close) PRESSURE: FLOW:

PI Pressure I ncllcamr A Flow I ndlcator
USES LOWEST INPUT
SIGNAL AS OUTPUT PC Pressure Conlrolar FC Flow Controlar

-@- HEAT EXCHANGER

PR

PlC
Pressure Racorder

Pressure I ndicator Controller

FR

FIC
Flow Recorder

Flow I ndlcator Controller

PRC Pressure Recorder Controler FRC Flow Recorder Conlrollar

SINGLE STAGE
CENTRIFUGAL PUMP
HPA High Pressure Alann HFA High Flow Alarm

HPSO High Pressure Shutdown LFA Low Flow Alarm

MULTI STAGE w Mu ~rpose VBlve HFSD H lgh Flow StUdown

CENTRIFUGAL PUMP
DPAH Difrer8nCial Pressure Alarm High LFSD Law Flow Shutdown

DPR Dilfenlnlial Pressure Recorder

AIR COOLED
HEAT EXCHANGER OTHERS: STREAM COLOUR CODE:
AR Analytical Recorder
NATURAl GAS
* VALVES CLOSED ON GP2 SHUT OO'NN ESD Emergency Shuldown

t TYPICALLY FLOW TO EITHER GP919 OR TO GP2. NO Normally Open CONDENSATE

NC Normally Closed
RICH OIL
NNF Normally No Flow

ROV Ramote Operata Valve LEAN OIL

HS Hand SWitch
LPG
 Appendix 3
r--
1
I PROCESS FLOW DIAGRAM
I
I FOR GAS PLANT l
I
I & INTERCONNECTING UNITS
I
I
I
I
I
I
I
r -4-K
@! I

: ~,

L
' cPtOI ... :
®--DE
__,:,:._____1J
:
:

®--.
!;P'J12 ......

-~~our
"'l: SII lli!Al(li
rr
~I,Lt.HO..
"L_____,
----------------l
I
I
I
I

I
I
I
I
I
I
I
I
I
I
I
X I
I
I
I
I
I I
I
I
I I
I
I
I
I
I
I
I
I
""", iJ!-®
I
I
'
.!,.
I
I
I
I
I
I
I I
I
I
: ""' I
~ --§]
L------

s
I

~-~
I ~~
\L7
r---_j

xa--el I
i

~
t

-----t -GJ
I
I
I -::•= ~
I L------------~-~