COMMONWEALTH DIRECTOR OF PUBLIC PROSECUTIONS -v- TECHNIP OCEANIA PTY LTD [2020] WASC 242 (29 June 2020)

(b) Second, on the basis of the evidence adduced at trial, the appellant could not establish beyond reasonable doubt that Technip was reckless.

1. Technip invokes the proviso in s 14(2) of the Criminal Appeals Act 2004 (WA) and submits the appeal should be dismissed on the ground that there has been no substantial miscarriage of justice. Alternatively, to the extent to which the matters it relies upon are not encompassed by the proviso, Technip submits this court is not required to set aside the decision to acquit because the evidence in substance supports the decision.[2]

1. NOPSEMA was established by s 645 and s 646 the Offshore Petroleum and Greenhouse Gas Storage Act 2006 (Cth) (the Act). Its functions include the promotion of the occupational health and safety of those engaged in offshore petroleum operations and the monitoring and enforcement of occupational health and safety obligations imposed by the Act, as well as other subsidiary legislation including the Regulations.
2. The objects of the Regulations include ensuring that facilities are operated in Commonwealth waters only in accordance with 'safety cases' that have been accepted by NOPSEMA.[3]
3. The Regulations provide for the operator of a facility to submit a safety case to NOPSEMA.[4]
4. The term 'safety case' is defined in the Regulations as: 'the document known as a safety case that is submitted to NOPSEMA under Part 2 of Chapter 2.'[5]
5. The term 'safety management system' is defined as follows:[6]

safety management system, for a facility, means a system for managing occupational health and safety at the facility.

1. Substance is given to these definitions by reg 2.5 which prescribes what is to be contained in a safety case as well as the nature and content of a safety management system. Relevantly, reg 2.5 provides a safety case must contain:

(a) a detailed description of the facility and the activities to be undertaken at the facility;[7]

(b) a detailed description of the 'formal safety assessment' for the facility being an assessment that:[8]

(i) identifies all hazards having the potential to cause a major accident event; and

(ii) is a detailed and systematic assessment of the risk associated with each of those hazards, including the likelihood and consequences of each potential major accident event; and

(iii) identifies the technical and other control measures that are necessary to reduce that risk to a level that is as low as reasonably practicable.[9]

(c) a detailed description of the safety management system that, among other matters, provides for the reduction to a level that is 'as low as reasonably practicable' of risks to health and safety of persons at or near the facility including, but not limited to risks arising during evacuation, escape and rescue in case of emergency.[10]

1. The term 'major accident event' (MAE) is defined as 'an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of persons at or near the facility'.[11]
2. The Regulations contemplate that a safety case submitted by an operator may be revised at NOPSEMA's request before it is accepted.[12]
3. Regulation 2.30(1) provides that an operator of a facility for which a safety case is in force must submit a revised safety case to NOPSEMA in specified circumstances, which include when an operator proposes 'to significantly change the safety management system'.[13] NOPSEMA must accept the revised safety case if the criteria specified in reg 2.34 are met. Those criteria include that the revised safety case complies with Subdivisions A, B and C of Division 1 of the Regulations for each stage of the life of a facility - reg 2.5 is part of Subdivision A of Division 1 of the Regulations.
4. If a revised safety case is not accepted by NOPSEMA, the safety case in force in relation to the facility immediately before the revised safety case was submitted remains in force as if the revised safety case had not been submitted.[14]
5. It is an offence to operate a facility within Commonwealth waters unless there is a safety case in force in relation to the facility,[15] and it is an offence do any work at a facility or part of the facility in Commonwealth waters in a manner that is contrary to the safety case in force for the facility.[16] A safety case is not in force unless it has been accepted by NOPSEMA.[17]

1. There was no material dispute about the primary facts. The following account is derived from those findings of the magistrate that are not challenged, the documentary exhibits and the uncontroversial evidence.

1. Chevron Australia Pty Ltd owned and operated the Wheatstone platform for the purposes of extracting liquefied natural gas. The Wheatstone platform was in Commonwealth waters 98 nautical miles north-west of Dampier in an area designated as the Wheatstone field.
2. Technip is a contractor in the oil and gas industry involved in installing subsea infrastructure for operators such as Chevron. Technip was contracted by Chevron to fabricate and install subsea structures and a pipeline for the purposes of piping gas from the Wheatstone field to the mainland - the Wheatstone project.
3. The work undertaken by Technip included diving from the vessel Wellservicer located in the Wheatstone field. Wellservicer was the 'facility' referred to in the charge. On 24 March 2015 Technip had been accepted as the operator of the Wellservicer by NOPSEMA.

1. On 24 July 2015 Technip submitted a safety case to NOPSEMA in relation to the Wellservicer pursuant to reg 2.24 and reg 2.44.[18] The safety case was assessed by NOPSEMA, and pursuant to reg 2.25, further information was sought from, and provided by, Technip. That further information was contained in a 'Safety Case Response Note', which pursuant to regs 2.25 and 2.26 of the Regulations then formed part of the safety case.[19]
2. On 7 October 2015 NOPSEMA accepted the safety case (the Safety Case) for the Wellservicer.[20]
3. In addition to the Safety Case, Technip submitted to NOPSEMA, and NOPSEMA approved, a Diving Project Plan[21] and a Hyperbaric Evacuation Plan.[22] The Hyperbaric Evacuation Plan was referred to in, and was to be read with, the Safety Case. Both plans were specific to the Wheatstone project.
4. The diving undertaken from the Wellservicer was saturation diving - a technique that requires divers to undergo saturation at the start of a rotation and then live and work in a hyperbaric environment for the duration of the rotation. In this case it was contemplated that the rotation would be for 21 days. When not diving, the divers lived in hyperbaric chambers within the Wellservicer and ordinarily only decompressed when the rotation was over.

1. The Safety Case is a substantial document extending to 275 pages, divided into several parts with 11 appendices of detailed provisions.[23] Much of the content of the Safety Case is drafted in technical language. To understand the magistrate's decision[24] and these reasons it has been necessary to reproduce the relevant parts of the Safety Case in some detail.
2. Before turning to the detail, however, it is helpful to outline the two features of the Safety Case with which this case is primarily concerned:

(a) Because the divers were living in a saturation environment the measures for their protection included a Self-Propelled Hyperbaric Lifeboat (SPHL) located on the deck of the Wellservicer. A SPHL is a lifeboat designed to keep divers in a saturation environment in the event that they are required to evacuate. Assuming proper functioning, the SPHL is capable of providing 'autonomous life support for a minimum period of 72 hours without outside assistance'.[25] The magistrate described the SPHL as a 'sophisticated vessel with back up capacities in the event of an equipment failure'.

(b) Additionally the Safety Case for the Wellservicer required that during a saturation diving operation there should be a hyperbaric support vessel (HSV),[26] and that this vessel be equipped with a Life Support Package (LSP) (described by the magistrate as a 'container like structure'). As will be seen, the purpose of the LSP was to provide life support to divers in the event of operational failure of the SPHL and to provide life support in the event that the SPHL was recovered onto the deck of the HSV.

1. In July 2015 Mr Adrian Seguela was Technip's Subsea Operations Manager. His role was to oversee all subsea projects and ensure company procedures and processes were followed.[27] Mr Seguela participated in the first risk identification session during the preparation of the Safety Case. The purpose of that first session was to identify all risks, 'especially the major accident events'.[28] He had a 'high level involvement' in the production of the Safety Case.[29] Mr Seguela was also involved in internal meetings and discussions to prepare the Safety Case Response Note to NOPSEMA.[30] The magistrate found, and it was and is common ground, that Mr Seguela was the controlling mind of Technip for the purposes of the events with which this case is concerned.
2. In the primary decision his Honour referred in some detail to the format and content of the Safety Case Response Note and to the manner in which it effected revisions to the safety case document as prepared by Technip as first submitted to NOPSEMA. For the purposes of these reasons it is sufficient to refer to the provisions of the Safety Case as they were after inclusion of the revisions made by the Safety Case Response Notice.

1. The Safety Case comprised four parts: Part A - Introduction, Part B ‑ Facility Description, Part C ‑ Safety Management System Description, and Part D ‑ Formal Safety Assessment. It is unnecessary to refer to parts A and B.

1. Part C described the safety management systems used for the operation of the Wellservicer by reference to particular elements of occupational health and safety such as, 'Employee Selection', Training and Competency', 'Health and Hygiene', 'Emergency Preparedness' and 'Response'.
2. One element of the system described in Part C was 'Hazard Identification, Risk Evaluation and Management'. The purpose of this aspect of the system was described as follows:[31]

In accordance with the [Quality Health and Safety] policy, Technip aims to provide a safe workplace and reduce the health impacts of its operations through effective control of risks. The purpose of the risk management process is to ensure that all foreseeable hazards are identified and adequately controlled and the associated risks reduced to ALARP.

Once a hazard is identified, the risk shall be assessed using the Technip HSE Criticality Matrix (Appendix G - Risk Matrix). The HSE Criticality Matrix consists of a Severity Table, Probability Table and 5x5 Risk Ranking Table. The assessed levels of severity and probability are cross-referenced on the Risk Ranking Table to assess the level of Risk - Low, Medium or High.

With respect to hazard control and mitigation, the principle of hierarchy of controls is applied. That is, the preferred, most effective option in descending order to least preferred, less effective. Hazard controls shall consider, in preferred order:

• Elimination - remove the hazard or risk;
• Substitution and minimisation of hazard by design (inherently safer design);
• Detection (transmission of information to control point);
• Control (limitation of scale, intensity and duration);
• Mitigation of consequences (protection from effects); and
• Emergency, evacuation and rescue.

1. Part C of the Safety Case contained a section dealing with 'Emergency Preparedness and Response'.[32] The magistrate referred to two revisions to this section of the Safety Case - the revisions were as follows:

(a) The addition of a new performance standard to the 'Wellservicer Emergency System Performance Standards', which were set out in table 33.[33] The revision added a 'Target' of a 'timing' for 'SPHL to HSV and HRF'[34] as follows:[35]

- Time to muster divers into SPHL launch and recovery SPHL to HSV** > Diving emergency - hyperbaric evacuation

The Hyperbaric Evacuation Plan also sets out details of the Life Support Package, Hyperbaric Support Vessel, and Hyperbaric Reception Facility.

In the event of an emergency that requires hyperbaric evacuation, the base case is that once the divers are safely secured in the SPHL, the SPHL, shall be launched.

The SPHL shall be joined by the Hyperbaric Support Vessel (HSV) that will be in the vicinity at all times of diving operations. Should the weather be favourable and it is deemed that a recovery lift shall not pose an unacceptable risk to the personnel in the SPHL, the SPHL shall be recovered to the HSV. Recovery shall only be conducted with the HSV Master's approval/discretion in consultation with the SPHL coxswain.

Should recovery to the HSV be considered an unacceptable risk to the personnel in the SPHL, the SPHL shall be taken under tow or escorted and manoeuvred under its own power to either a safe haven or direct to port.

Once safely alongside the port facility, the SPHL shall be lifted out of the water and taken to the Hyperbaric Reception Facility (HRF). The SPHL shall be mated to the HRF and diver safely decompressed. For further details of hyperbaric evacuation referred to the project specific Hyperbaric Evacuation Plan.

1. Part C of the Safety Case recognised that changes might be required to the Safety Case from time to time. This was addressed by the following provision:[37]
   1. Management of Change

Change, whether small or large is inevitable, and may impact upon the safe operation of the work scope. Management of change (MOC) is carried out in accordance with TPO's Offshore/Site Management of Change and Off-Site Management of Change. These procedures provide the process to ensure that all changes are properly engineered, checked and risk assessed. Any new hazards are properly controlled and mitigated in accordance with risk reduction principles. The MOC process requires the authorisation of senior project in offshore management.

The objective of the MOC process is to ensure that additional risks are not introduced by changes which could increase the risk of harm to personnel onboard.

The Technip MOC process applies to all marine and project activities.

1. Part D of the Safety Case was described as the 'Formal Safety Assessment' and dealt with the assessment of a number of specific safety risks. In the introduction to Part D, its purpose was described as follows:[38]

The purpose of the Formal Safety Assessment (FSA) is to demonstrate that, particularly in relation to potential Major Accident Events (MAEs), all reasonably practicable controls have been identified in order to ensure that risk is reduced to ALARP. The implementation and on-going management of these controls is covered by the Safety Management System...

The FSA has been performed in accordance with the OPGGSA, the OPGGSSR and the SMS requirements (refer to Part C). The FSA includes the activities listed in Table 40 below.

1. The activities listed in the Table 40 referred to in the extract above included 'Hazard Identification', 'MAE Assessment', 'Bowties', 'Escape, Evacuation and Rescue (EER) Assessment' and 'Quantitive Risk Assessment (QRA)'.
2. The process of Hazard Identification undertaken by Technip, and in which Mr Seguela participated, identified 'SPHL operation failure' as a major accident event - MAE 15.
3. The assessment of MAE 15 contained in the Safety Case was as follows:[39]

4.16 MAE 15: SPHL operation failure

4.16.1 Event Description

Once the saturation divers have evacuated into the SPHL and the hyperbaric lifeboat has been launched, there is a potential for a failure of the SPHL during its operation. This event has the potential for injuries or fatalities to divers. The potential causes for SPHL failure could be mechanical, chamber system including Life Support Package (LSP) failure, adverse weather or operator error.

4.16.2 Prevention and Mitigation Controls

The risk of injuries or fatalities to divers due to SPHL operation failure has been minimised by both engineering and procedural controls.

The vessel dive system, including the SPHL is subject to Dive System FMECA, annual Dive System audits by a third-party, in accordance with vessel assurance processes. In addition, the SPHL must be launched to meet Class requirements at a minimum of 3 monthly intervals, and also to demonstrate functionality and increase crew familiarisation.

In addition, the LSP package is designed to IMCA D024 Rev 2. A stricken SPHL would 'hook up' to the package and be provided continued, conditioned water for use with the hyperbaric conditioning units (HCU), gas by way of main supply, BIBS supply and oxygen make up supply. Electricity is also supplied by the LSP.

While the LSP provides these resources, it is not independent as it requires electrical power and HP stored gases. Support hoses, regulators and a purpose made 75 m umbilical are all provided as part of the LSP.

Once the divers are safely locked into the SPHL, they are required to wear PPE and seat belts inside the lifeboat. This is to prevent injuries from unforeseen lifeboat movement, heave during launch, transit and recovery.

A key mitigation for SPHL failure is the project specific hyperbaric evacuation procedure. The procedure, subject to HAZID processes, describes the planning, preparation, steps and trials associated with moving the SPHL safely from the Wellservicer to HRF, located in a nearby port location.

The base case for hyperbaric evacuation is that, should the weather conditions be acceptable and with, in consultation with the SPHL coxswain, the HSV Master's approval/discretion, the SPHL may be lifted onto a purpose-built cradle on the back deck of the HSV. Once the SPHL is safely out of the water and secured into the cradle on the vessel, the LSP is to be connected and systems confirmed, the HSV will transit to the HRF that will be located in a port. Diver's well-being and the SPHL system can be continuously monitored during the transit by the LSTs. Once the SPHL is confirmed locked on the HRS, the divers are transferred into the HRF chambers where decompression will commence.

As part of offshore readiness trials, the SPHL will be mated to the HRF prior to any diving operations commence. Refer to Part C SMS for further details of hyperbaric evacuation.

Other key prevention and mitigation measures include:

• Routine maintenance and inspections on the SPHL in accordance with the planned maintenance system;
• SPHL Operation Manual;
• Separated power supply for SPHL;
• Independent power systems launch on accumulators;
• Diver medical technician;
• Trained and competent emergency team and SPHL crew;
• Diver evacuation drills to SPHL prior to commencing diving operations;
• Diving emergency procedure; and
• Hyperbaric Support Vessel and hyperbaric evacuation.

The MAE Bowtie Diagram (Appendix 1 - MAE Bowtie diagrams) presents the potential causes and consequences of the event with all of the identified prevention and mitigation barriers/controls (Appendix H - Hazard Register). The bowtie diagram shows that sufficient barriers are in place.

A SPHL failure with divers in saturation has the potential to delay evacuation of the SPHL to the HRF and for injuries and fatalities to saturation divers. An assessment of the escape, evacuation and rescue facilities is included in the EER Assessment (Part D, Section 5). An assessment of the survivability of Safety Critical Elements (SCE) is included in the ESSA (Part D, Section 6). The risks associated with this event are quantified in the QRA (Part D, Section 7).

1. As part of the Escape, Evacuation and Rescue Assessment (section 5.3.6 - as amended by the Safety Case Response Note) the 'base case' for hyperbaric evacuation using the SPHL was described as follows:[40]

Given acceptable weather conditions, and with, in consultation with the SPHL coxswain, the HSV Master's approval/discretion, the SPHL shall be lifted onto a purpose-built cradle on the back deck of the HSV.

Once the SPHL is out of the water, safely secured on the vessel, the LSP is to be connected and systems confirmed, the HSV will transit to the HRS that will be located in a nearby port.

If conditions are deemed as presenting an unacceptable risk, the HSV is to provide support to SPHL during transit to safe haven/port and HRF.

1. Mr Seguela explained that his understanding of the term 'base case' was that it suggested that there were options, other than the base case, available that could be used in the event of changing circumstances.[41]
2. Part D of the Safety Case contained a 'Quantitative Risk Assessment' of each MAE. In respect of MAE 15, par 7.4.15 of the Quantitative Risk Assessment commenced with the following observations:[42]

There is little historical data on SPHL operational failure incidents with divers in saturation. Technip QHSE database synergi has no records of such incidents and similarly IMCA records do not provide data of SPHL operational failures with divers on board SPHL.

The Wellservicer is Dive Systems [sic] is subject to annual 3rd Party audits to IMCA Guidelines, vessel assurance processes and extensive planned maintenance and inspections which include the SPHL. In addition, the LSP is designed to IMCA D 024. The SPHL is subject to (max) 3 monthly launch, testing and recovery trials. Should a hyperbaric evacuation incident occur it is assumed that the SPHL has successfully launched and the HSV is on station to provide immediate assistance. In addition, the fully functional LSP is on-board the HSV with sufficient time to render assistance to SPHL and any operational failure or problem. Given the engineering and procedural controls in place and checks, the assumption is that an incident when the SPHL operation failure results in a diver fatality is a very low likelihood.

1. The assessment gave a numerical value to the risk of operational failure of the SPHL having, for this purpose, first ascribed probabilities expressed in percentage terms to the relevant risk factors. It was assumed that 10% of SPHL operational incidents would result in injuries to divers and that 10% of such injuries would be fatal.
2. One of the tools used to assess Major Accident Events identified for the purposes of Part D of the Safety Case was 'Bowtie Diagrams'. These were explained at page 177 of the Safety Case as follows:[43]

Bowtie diagrams have been developed for the Wellservicer MAEs and are presented in appendix I - MAE Bowtie diagrams. The bowtie diagrams provide a visual demonstration of the way in which risks are managed, allowing understanding at all levels and giving personnel the opportunity to review the controls in place and identify any gaps and potential improvements.

The bowtie diagrams present typical cause scenarios on the pre-event side (left side) while credible consequences are presented on the post‑event side (right side). The pre-event and post-event control measures (prevention and mitigation barriers) are included as shown in the bowtie diagram schematic in figure 26.

1. The use of the word 'mitigation' in juxtaposition with 'prevention' makes it clear that mitigation barriers were designed as measures to contain the consequences of a MAE after it occurred whereas 'pre-event control measures' - 'prevention' barriers were designed to prevent a major accident event from occurring.
2. The bow-tie diagram in relation to MAE 15 identified typical cause scenarios including, 'adverse weather conditions', 'mechanical failure', 'chamber system failure', 'human error' and 'crane or towing failure'. Prevention barriers were identified for each of the cause scenarios.
3. Five 'mitigation controls' were identified in the circumstance of an SPHL failure, being:

(b) Remote Diving Doctor Emergency Medical Support;

(d) Hyperbaric Emergency Plan and Project Emergency Procedure & [illegible]; and

1. Part D of the Safety Case included a section entitled 'ALARP Demonstration'. In an introductory paragraph to this section it was recorded that:[44]

One of the main objectives of the [Regulations] is to ensure that the risks to Health and Safety of people at offshore facilities are reduced to a level that is ALARP.

The adopted control measures for any particular identified MAE must be shown to collectively eliminate, or reduce the risk to Health and Safety to a level that is ALARP. According to the Regulations, evidence of reduction of safety risks to ALARP is achieved by the steps shown in Table 71.

The format of table 71 was three columns. In the left column the text of the relevant regulation was reproduced. In the centre column the requirement of the regulation was stated and in the right column the place in the Safety Case where the requirement of the regulations was addressed was identified. Opposite the requirement of reg 2.5(3)(e), (the regulation which required a detailed description of the safety management system that provides evidence the system provides for the reduction to a level that is as low as reasonably practicable of risks to health and safety of persons at or near the facility including, but not limited to risks arising during evacuation, escape and rescue in case of emergency), the reference in the assessment column read 'This is covered in the EER Assessment (Part D, Section 5.5)'.

1. In his reasons the magistrate drew attention to the following provision in the Diving Project Plan:[45]

During the diving operations phase involving the Wellservicer the North Sea Atlantic will act as the Hyperbaric Rescue Vessel (HRV) and shall stay within the field during DSV operations at the WP. If due to operational or mechanical breakdown reasons, where the North Sea Atlantic cannot act as the HRV, then an infield tug will take receipt of the LSP and will act as the HRV at that time. Please refer to the Hyperbaric Evacuation Plan [16] for full details.

1. The purpose of the Hyperbaric Evacuation Plan was described in the introduction to that plan as follows:[46]

The purpose of this document is to detail the procedure to be followed by TPO in the event of a vessel emergency on board the Wellservicer which requires launch, transit and reception of the SPHL at the Hyperbaric Reception Facility. The process described within this plan aims to reduce risk to all personnel involved in the activities described to ALARP and to meet or exceed the requirements of IMCA D 052 Rev 2 and other codes/standards as described in the document. Any such response action can be divided into four main phases:

• Launch of the SPHL;
• Transit of the SPHL to Dampier;
• Quay side recovery of the SPHL and transport to the HRF; and
• Receipt, transfer and decompression at the HRF.

... The LSP will be transported, installed and commissioned on the HCV North Sea Atlantic or other suitable vessel nominated and approved by CVX as the attendant HRV for the Wellservicer.

1. Paragraph 3.3.3 of the Hyperbaric Evacuation Plan set out the specifications of the Hyperbaric Rescue Vessel as follows:[47]

The North Sea Atlantic (NSA) will act as the primary Hyperbaric Support Vessel (HRV) for the Wellservicer during diving operations on the project when she is also in field. The NSA will remain in the project field during diving operations when she is the nominated HRV. If due to operational reasons the NSA cannot act as the HRV (such as returning to port for interim mobilisation) then an infield tug will be identified and act in this capacity including carrying the LSP.

The Life Support Package (LSP) will be positioned and sea fastened on the HRV back deck. The LSP will be installed in a position close to power outlets to enable the system to be run. The area around the LSP shall be maintained and kept clear of congestion at all times.

The LSP will be connected to the NSA services and function tested when first loaded onto the NSA. The LSP will be operated by the LSS from the SPHL. If it needs to be used to supply servicers [sic] to the SPHL.

The HRV will remain within 4 hours transit time of the DSV when divers are in saturation where practical.

Emergencies on-board the HRV will be dealt with in accordance with HRV subcontractor procedures. However, if an emergency arises where the HRV must return to port, then the Wellservicer Master must be informed, upon which the divers will be recovered and arrangements to maintain the agreed transit limit will be established. Alternatively if possible the LSP and gas will be transferred to an alternative vessel which will then act as the HRV.

1. Paragraphs 6.1 to 6.5 of the hyperbaric evacuation plan described the steps to be taken in each phase of a hyperbaric evacuation beginning with preparation and launch and ending with onshore medical support. Paragraph 6.2 described the procedure for 'SPHL Transit, Support & Recovery' as follows:[48]

6.2 Phase 2 - SPHL Transit, Support & Recovery

Once the SPHL is clear of the Wellservicer the hyperbaric emergency enters the second phrase - support of the SPHL and its occupants and its transit to the HRF for decompression. The launch of any SPHL would be considered a major incident and would immediately trigger the call out of the onshore Emergency Response Team (ERT) in accordance with Technip company procedures.

If they are in a position to do so, the Master and OCM will assist with this phase of the evacuation, however as the incident that results in the SPHL being launched may well incapacitate the Wellservicer, it is anticipated that the HRV, with support of the onshore ERT, will play a major role in facilitating the transit, support and recovery of the SPHL to the HRF.

This phase of the evacuation contains the most variables and therefore is the phase that will require the most attention during the execution. The following options in preference shall be considered:

If HRV equipped with suitable crane;

1. SPHL moves away from the Wellservicer. The SPHL is recovered via offshore lifting to the deck of the HRV if practical and seastate allows (at Master and Coxswain discretion). Once on deck the SPHL is connected to the LSP and the HRV transit at safe speed to the HRF.
2. SPHL moves away from the Wellservicer. The SPHL transits at safe speed (under own power to tow) to sheltered waters (Barrow Island) for lift onto HRV.

1. SPHL moves away from the Wellservicer. The SPHL transits at safe speed (under own power or tow) to the HRF with the HRV providing a lee from weather and support as requested by the Coxswain.

These options are detailed in the flow chart shown in figure 6-2 below.

(Flow chart not reproduced)

At all times the LSP will be held on the HRV such that if the SPHL requires gas, cooling or heating this can be supplied. Note that the Wellservicers SPHL has 72 hours endurance so the LSP is a back up and should not have to be used as a base case while the SPHL is in the water. As the distance from the field to Dampier is 98nm, at 5kts the journey time would be approximately 20 hours, or 28% of total endurance which is well within the requirements of IMCA D052. The LSP should only be connected in sheltered waters (if the SPHL is in the water) however if the SPHL is taken out of the water the LSP has to be connected such that cooling can be supplied.

Note - SPHL is fitted with a 75 m dynema tow line complete with spliced hard eye which is passed to the HRV if towing is required.

The SPHL shall have its own on-board navigation equipment. In the event of a breakdown of the engine of the SPHL, the HRV will attach a towline and tow the SPHL to the HRF port in Dampier.

The HRV will advise any other vessels which transit within 5nm, that a SPHL is being escorted to Dampier, and that all other vessels are required to maintain minimum 2nm clearance. The HRV will maintain radio contact with Dampier Port Authority (VHF 11) advising progress and ETA of the SPHL. The HRV will maintain contact with the TPO ERT, advising ETA of the SPHL in Dampier. The TPO ERT will advise the HRF Manager in Dampier and COMPANY ERT.

1. On 18 November 2015 there were discussions about changing the Safety Case because the North Sea Atlantic would be required to leave the Wheatstone field while diving was undertaken and there were concerns about the LSP being damaged in the process of being lifted from the North Sea Atlantic to the tug - the Mermaid Supporter. Mr Seguela described the participants in the discussions as 'all the management team on-board the vessel'[49] - this included Chevron's representative on board. This group included members of Technip's management who had been involved in the preparation of the Safety Case, as well as nine of the divers who were to undertake saturation diving, three diving supervisors and a diving superintendent.
2. The participants in the discussion agreed unanimously that the Safety Case be changed and confirmed their agreement to the proposed change either by signing a form to that effect or, in some instances, by confirmatory email. The change was recorded in a form entitled 'Site Change Request Form' dated 19 November 2015 reproduced in the appendix to these reasons. Mr Seguela signed the Site Change Request Form as Technip's senior officer.[50]
3. The effect of the proposed change to the Safety Case described in the Site Change Request Form was to remove the requirement that the HSV be in the vicinity of the Wellservicer while saturation diving work was undertaken, and an alternate safety plan - the Barrow Island Rendezvous Plan - was devised to replace it. The Site Change Request Form provided for the LSP to be kept on the North Sea Atlantic when it left the Wheatstone field rather than being transferred to the Mermaid Supporter (the vessel that was to remain in the Wheatstone field) which, even though it would not have the LSP on board, would then act as the HSV. In the event the SPHL was launched it would make its way to Barrow Island with assistance, if necessary, from the Mermaid Supporter, and rendezvous with the North Sea Atlantic at Barrow Island, 40 nautical miles from Wheatstone field, a distance that it was estimated it would take between approximately six and ten hours to cover, depending on the weather.
4. As explained by Mr Seguela in his evidence-in-chief, Technip's rationale for the change was that it reduced the 'unnecessary risk' of damage to the LSP inherent in transferring it from the deck of the North Sea Atlantic to the Mermaid Supporter whilst at sea and reduced the risk to the safety of personnel (technicians) who would also have to be transferred at sea from one vessel to the other.[51]
5. Technip did not submit a revised safety case to NOPSEMA incorporating the change described in the Site Change Request Form. Mr Seguela explained that it was appropriate (in his view) that the management of change process described in the Safety Case be used.[52]

1. Between 22 and 25 November 2015 saturation diving work was undertaken from the Wellservicer. While this work was taking place there was only one LSP attached to the Wheatstone project and it was on board the North Sea Atlantic which was travelling to or from, or was at, Dampier. It was not in the vicinity of the Wellservicer. The magistrate found that the North Sea Atlantic was 'well outside the zone where it could come to the "immediate" rescue of divers'.[53]

1. On 26 November 2015 a meeting was held between representatives of Technip and representatives of NOPSEMA at which the change described in the Site Change Request Form was discussed. The following day, 27 November 2015, Mr Ben Barnes of NOPSEMA sent an email to Mr Seguela in which he stated:[54]

In view of our discussion yesterday, I advise you that should the Hyperbaric Support Vessel 'The North Sea Atlantic' leave the close proximity of the DSV during diving operations, this would be considered a non-compliance of the Wellservicer Safety Case ...

Consequently, Technip Oceania Pty Ltd would not be compliant with OPGGS(S) 2009 Reg 2.45 (g).

Should Technip Oceania Pty Ltd wish to amend the Wellservicer safety case to provide for other emergency hyperbaric arrangements, a formal revision of the Wellservicer safety case would be required.

It was noted in the discussion that the proposed replacement HSV tug 'Shelf Supporter' does not provide the capabilities or safety critical equipment as described in the Wellservicer safety case.

...

1. Mr Seguela responded by email on 27 November 2015 as follows:[55]

Thanks for the below, it is noted. As discussed in yesterday's meeting, Technip have raised a Management of Change (attached to this email) to capture keeping the LSP on the NSA as an improvement in the ALARP condition described in the Rev 0 DPP and Hyperbaric Evacuation Plan while operating on the Wheatstone project.

Please note that the NSA is planned to conduct 1 x interim mobilisation while the Wellservicer is engaged in spool installation and diving operations. The duration of this mobilisation equals to less than 2% of the total duration of the offshore campaign.

The likelihood of an SPHL emergency during NSA mobilisation is remote and the level of risk to personnel (divers) is considered acceptable and ALARP as described in the attached MOC... Transferring and commissioning the LSP offshore from the North Sea Atlantic to the Mermaid Supporter during this interim mobilisation is considered to be introducing a new risk and unnecessary risk - potential damage to LSP.

(a) the Safety Case required that the HSV - with the LSP on board - to be no less than two hours away from the Wellservicer while saturation diving was taking place;

(b) between 22 and 25 November 2015 saturation diving took place and the North Sea Atlantic with the LSP on board was more than two hours away from the Wellservicer;

(c) the Site Change Request Form did not effect a valid change to Safety Case, as the change proposed constituted a significant change to the safety management system, in that it entirely removed the control put in place to mitigate the risk identified in MAE 15 and the change had not been submitted to or accepted by NOPSEMA;

(d) thus the Barrow Island Rendezvous Plan described in the Site Change Request Form did not become part of the Safety Case in substitution for the requirement that the HSV be no less than two hours away from the Wellservicer; and

(e) the only rational inference was that Mr Seguela was aware that, by approving the Site Change Request Form knowing diving operations were going to be performed at the Wellservicer, there was a substantial risk that Technip would not be complying with the Safety Case during those diving operations because the effect of the change was to take the LSP away from the Wheatstone field - thus, Mr Seguela (and Technip) was reckless as to whether those operations were being conducted in a manner contrary to the approved Safety Case and it was unjustifiable for him to take the risk of undertaking the diving operations in contravention of the Safety Case.[56]

(a) the appellant had not established beyond reasonable doubt what constituted the safety management system;

(b) because the appellant had not established what constituted the safety management system it had not established beyond reasonable doubt - nor could it do so - that the Site Change Request Form significantly changed the safety management system;

(c) the Site Change Request Form effected a valid change to the safety management system and the Safety Case under the Management of Change process within the Safety Case with the result that the diving operations undertaken between 22 and 25 November 2015 were not undertaken in a manner contrary to the Safety Case;

(d) the appellant had failed to establish beyond reasonable doubt that Mr Seguela either knew that work was performed contrary to the Safety Case or that he was aware of a substantial risk that work would be undertaken contrary to the Safety Case, and that it was unjustifiable to take that risk.

1. The magistrate began his reasons with a summary of the factual background and the regulatory regime. In that context his Honour made preliminary observations to the effect that:

(a) In the event of operational failure of the SPHL during an evacuation from the Wellservicer recourse to the LSP was vital - his Honour observed:[57]

In the scenario where the SPHL has failed and is in the water the life-saving gas and other necessities to maintain the diver's saturation can be supplied directly to the SPHL by means of an umbilical pipe from the deck of a HSV to the SPHL. Alternatively the SPHL can be lifted by crane onto the deck of the HSV where it can be attached to the LSP.

(b) There 'need not be a nominated HSV in a Safety Case' but a vessel will not be a hyperbaric support vessel if it does not have an LSP on board.

1. The magistrate summarised the issues for determination and identified the central issue raised by Technip was 'whether the prosecution has been able to prove beyond reasonable doubt just what is to be regarded as the Safety Case'.
2. The magistrate proceeded to set out his findings about the events leading up to the commencement of diving operations on 22 November 2015 before giving consideration to whether the appellant had established the terms of the Safety Case. His Honour found that the Safety Case incorporated by reference the Hyperbaric Evacuation Plan and the Diving Project Plan.
3. The magistrate referred to those parts of the Safety Case that he considered to be critical. These were:

(b) the passage in the Quantitative Risk Assessment which recorded that should a hyperbaric evacuation incident occur it was assumed that 'the HSV is on station to provide immediate assistance';

(c) paragraph 4.16.2 of the Safety Case as revised by the Response Note; and,

(d) the 'SMS section 12.5.1' which introduced into the Safety Case the provision dealing with 'Diving Emergency - Hyperbaric Evacuation'.

I am therefore satisfied beyond a reasonable doubt that up until about 19 November 2015 NOPSEMA was reassured by the operators response that (HSV) 'will be in the vicinity at all times of diving operations'. I find this was at the time and remained an intrinsic part of the safety case. It is entirely inconsistent with an MAE that the HSV, in this case the NSA, would be up to 98 nautical miles away, clearly outside the Wheatstone Field zone.

What had been made clear from the responses of the operator was that the purpose-built cradle was no longer part of a base case but I find it could not be any clearer from the evidence that, in effect, it was 'non‑negotiable' that the HSV - and in that regard I'm referring to the only vessel with the LSP on board - must be in the vicinity of where the divers were working.

1. The magistrate reinforced his reasoning by referring to the revised table 33 and stated:[59]

I find beyond reasonable doubt that the safety case had eventually been settled and that this occurred on 6 October 2015. Ultimately I find that therefore, and as a result of the information provided to NOPSEMA and accepted, the meaning of the safety case did not alter in regard to the requirements under that safety case for the HSV to be in the vicinity of the work from the Wellservicer and ready to provide immediate assistance in the event of a MAE. If it wasn't in the vicinity it would, I find, have no likelihood at all of providing that turnaround from SPHL to HSV.

1. The magistrate then considered the effect of the Site Change Request Form. His Honour reproduced the form in the body of his reasons, set out the full text of reg 2.30, and then stated his conclusions on the effect of the Site Change Request Form as follows:[60]

The change made on 19 November 2015 was a significant departure from the safety case. Now there was every chance that in the event of an MAE the HSV would be well out of range of the SPHL leaving the SPHL with no access to the LSP. Instead the SPHL could find itself being towed into the lee of Barrow Island there to be at the mercy of the weather and time while waiting for the HSV to arrive with the LSP.

I have not overlooked the 72 hours capacity of the SPHL to maintain an appropriate saturation environment on board but I have found the plan set forth in the SCR to be a poor substitution for the immediacy that was previously settled and supported by the operator. On any view, I find, the immediate presence of an LSP at the site of an MAE was more than preferable but was essential to protect the divers from the exigencies likely to arise in such an event.

I am satisfied beyond reasonable doubt that the plan laid out in the SCRF was a significant change to the safety management system and therefore it was the operator's obligation to submit the change/revision to NOPSEMA.

1. The magistrate then dealt with the issue of recklessness. His Honour recorded his finding that Mr Seguela was the controlling mind of Technip and stated:[61]

I have had difficulty in regard to how one might approach the circumstances in this matter (the approval of a plan by a number of signatories including Mr Seguela that I have found was contrary to the Safety Case and contrary to r 2.30) from the perspective of then defining how that behaviour might be found, beyond reasonable doubt, to be reckless.

The element of awareness in the fault element of recklessness cannot be made out by the prosecution unless it is an awareness of a substantial risk. I find that there is insufficient evidence to support a conclusion that the implementation of the Barrow Island rendezvous plan created a substantial risk. I am conscious that my conclusions on that basis might be seen to be in conflict with my other findings in this matter but those findings are confined to the specific regulatory requirements and whether those regulatory requirements have been adhered to. Consideration of recklessness is altogether a separate and distinct element given the charge is not categorised by the Code as strict liability.

Not only was there insufficient evidence regarding substantial risk there was evidence of several back-ups on the SPHL to ensure cooling heating and access to gases, towing would be available from the Mermaid Supporter tug and time frames within which, while not consistent with the Safety Case, were likely to be adequate.

...

In terms of the degree of risk I find that the unanimous signing off on the SCRF gives some weight as to the foreseeable degree of risk. Nine of those signatories were divers and 3 others were involved in the diving on the project. The back-ups of the SPHL have also been referred to and the time frames and the availability of the Mermaid Supporter, at least, and the Wellservicer should towing be required. From the perspective of the evidence before me I would rate the degree of risk as low.

...

In so far as the practicability of eliminating risk; it was not impracticable to place a second LSP in the field so that the Safety Case could have been adhered to but a failure to do so would only support recklessness if the degree of risk was something higher than the low risk I have found.

The element of 'unjustifiable risk' is therefore not made out.

1. Recklessness is a fault element defined under the Criminal Code 1995 (Cth) (the Code) and it is the fault element for a physical element that is a 'circumstance'[62]. In the present case, the relevant physical element was that work was done contrary to the Safety Case - this being a 'circumstance' for the purposes of the Code.
2. Section 5.4(1) of the Code provides as follows:

(1) A person is reckless with respect to a circumstance if:

(a) he or she is aware of a substantial risk that the circumstance exists or will exist; and

(b) having regard to the circumstances known to him or her, it is unjustifiable to take the risk.

1. Section 5.4(4) further provides that, if recklessness is a fault element for a physical element of an offence, proof of intention, knowledge or recklessness will satisfy that fault element.

1. The appellant relies on one ground of appeal:
   1. The Learned Magistrate made an error of law in relation to the fault element of recklessness.

The fault element of recklessness was to be applied to the circumstance that constituted the third physical element of the charged offence, namely that Technip was reckless that work was being performed in a manner contrary to the Safety Case approved by NOPSEMA. The Learned Magistrate erred by directing himself that recklessness required consideration of whether the implementation of the Management of Change Plan by Technip increased the risk to workers substantially and was therefore reckless.

1. It is apparent from the extract from the primary decision set out at [67] that his Honour misdirected himself in relation to the element of recklessness by considering whether the implementation of the Barrow Island Rendezvous Plan created a substantial risk of harm to divers and whether it was unjustifiable to take the risk rather than considering whether Technip was reckless as to whether the work was undertaken contrary to the Safety Case. As Technip accepted, the ground of appeal is made out. Leave to appeal should be granted on that basis.[63]

The safety management system issue An overview of the parties' submissions

1. Technip submitted the magistrate should have found the prosecution had failed to prove that the Site Change Request Form significantly changed the safety management system and that because Technip had acted in accordance with the Site Change Request Form, it had not carried out work in a manner contrary to the Safety Case.
2. Technip argued the prosecution had failed to establish beyond reasonable doubt what the safety management system was, and thus, it could not establish that the adoption of the Barrow Island Rendezvous Plan would 'significantly change' it.
3. Technip made a further point to the effect that the magistrate asked the wrong question and misdirected himself. Technip argued the magistrate had not referred to the definition of 'safety management system'. And, although in expressing his conclusion on the issue of the significance of the change described in the Site Change Request Form as a 'significant change to the safety management system',[64] in his reasoning for that conclusion he had characterised it as a 'significant departure from the safety case'.[65]
4. Technip contended the change proposed by the Site Change Request Form did not 'change significantly the safety management system' because:

(a) There was an 'extremely low likelihood' of a MAE 15 occurring. It would only occur if all preventative controls, 'design and manufacture', and 'maintenance and testing' controls had failed and the primary power source and two back up power sources had failed.

(b) The Barrow Island Rendezvous Plan would only be relied on when the North Sea Atlantic was away from the Wheatstone field for the purposes of interim mobilisation which was estimated to be less than 2% of the duration of the diving programme.

(c) The assessment made by Technip as to whether the change was a significant change was made in the context of a risk assessment that involved a 'balancing exercise' that took into account the risks of damaging the LSP if transferred by crane at sea from North Sea Atlantic to the Mermaid Supporter.

1. The appellant contended, in effect, that any part of the Safety Case that could be characterised as 'a system for managing occupational health and safety' at the Wellservicer formed part of the safety management system. Measures that are identified and prescribed by Technip for the purpose of managing and mitigating major accident events constitute part of the safety management system.
2. The appellant contended the effect of the Site Change Request Form was to 'significantly change the safety management systems' because it removed the only control that had the capacity to protect the lives of the divers in the event of a MAE 15. The appellant contended that the assumption implicit in the adoption of the Barrow Island Rendezvous Plan was that a MAE 15 would not occur while the North Sea Atlantic with the LSP on board was not within the Wheatstone field.

1. I do not accept it was not open to the magistrate to find the safety management system was established beyond reasonable doubt. The documents describing the safety management system were tendered at the trial. They were the Safety Case, the Response Note and those parts of the Hyperbaric Evacuation Plan to which reference was made in the Safety Case.[66]
2. In my view the appellant's contention is correct - any provision within the Safety Case that forms part of a system for managing occupational health and safety is part of the safety management system.[67] It was not a matter for the appellant to call evidence to establish which provisions within the Safety Case constituted the safety management system as that was a matter for the magistrate to determine having regard to the statutory definition of safety management system in reg 1.5 and was a matter of law.[68] Equally, though Technip did not contend otherwise, the headings used to denominate Parts C & D of the Safety Case - 'Safety Management System' and 'Formal Safety Assessment' respectively are not determinative of whether provisions falling within those sections of the Safety Case formed part of the Safety Management System.
3. In my view it was open to the magistrate to find the safety management system relevantly included:

(a) The Emergency System Performance Standards set out in Table 33 of the Safety Case - referred to in the primary decision at [64].

(b) The 'Diving Emergency - hyperbaric evacuation' section introduced into Part C of the Safety Case and the relevant provisions of the Hyperbaric Evacuation Plan - referred to in the primary decision at [60].

(c) The mitigation controls identified as a response to an MAE 15, in particular paragraph 4.16 of Part D of the Safety Case ‑ referred to in the primary decision at [56] and [58].

(d) The provisions of the Escape, Evacuation and Assessment section of Part D of the Safety Case, in particular par 5.3.6, which related to MAE 15 - referred to in the primary decision at [34].

(e) The Quantitive Risk Assessment, par 7.4.15 - referred to in the primary decision at [51].

1. Turning to the issue of whether it was open to the magistrate to find the Site Change Request Form 'significantly changed' the safety management system, in the light of Technip's submissions, it is helpful to start the analysis by revisiting the regulatory framework to understand how MAEs came to be included in the safety management system and the object of the mitigation controls.
2. Regulation 2.5(2) required Technip to include in the Safety Case a Formal Safety Assessment that was required to achieve these objects:

(1) identify hazards having the potential to cause major accident events;

(2) provide a detailed assessment of the risks associated with the hazards; and

(3) identify the control measures necessary to reduce that risk to a level as low as reasonably practicable.

1. Regulation 2.5(3) required Technip to include in the Safety Case a detailed description of the safety management system that provides for risks to health and safety to be reduced to a level that is as low as reasonably practicable.
2. Technip responded to these regulatory requirements by submitting the Safety Case (incorporating the amendments in the Safety Case Response Note) in which operational failure of the SPHL was identified as an event having the potential to cause multiple fatalities.
3. The provisions of the safety management system proposed by Technip to NOPSEMA, which addressed the risks inherent in an evacuation of divers from the Wellservicer using the SPHL, placed repeated emphasis on the Hyperbaric Support Vessel (with the LSP on board) being in the vicinity of the Wellservicer while diving operations were undertaken, see:

(a) Table 33 as amended - 'Time to muster divers into SPHL launch and recovery SPHL to HSV** < 2 hours' (** weather dependent ...);

(b) Diving Emergency - hyperbaric evacuation - '... The SPHL shall be joined by the Hyperbaric Support Vessel (HSV) that will be in the vicinity at all times of diving operations' (emphasis added);

(c) '4.16.2 Prevention and Mitigation Controls' - '... In addition, the LSP package is designed to IMCA D024 Rev 2. A stricken SPHL would 'hook up' to the package . ..';

(d) Quantitative Risk Assessment - '... Should a hyperbaric evacuation incident occur it is assumed that the SPHL has successfully launched and the HSV is on station to provide immediate assistance' (emphasis added); and,

(e) MAE 15 Bow-tie diagram - The inclusion of 'dedicated LSP on hyperbaric support vessel' as a mitigation control. In context, this must be understood as a reference to a dedicated LSP on a hyperbaric support vessel in the vicinity of the Wellservicer. Moreover, of the five mitigation controls identified in the Bow-tie diagram, this was the most important as, in the event of an operational failure of the SPHL, the immediate availability of the LSP was essential - none of the other mitigation controls were capable of preventing decompression of the divers.

1. It was open to the magistrate to find the inclusion of these measures in the safety management system necessarily implied that Technip considered that they were measures necessary to reduce the level of risk associated with the operational failure of the SPHL to as low as reasonably practicable.
2. It may be accepted, as Technip contended, that there were procedural and engineering controls in place to minimise the risk of an operational failure of the SPHL and that the effect of these was to reduce the risk of such a failure so that it could be characterised as an 'extremely low likelihood'. Assessed in context, however, the contention is of limited, if any, relevance in determining the issue of the significance of the change for two reasons:

(a) the controls referred to in Technip's submissions and in Mr Seguela's evidence were 'prevention controls' and not mitigation controls. In particular they were controls designed to prevent situations where the LSP would need to be utilised. In other words, they were not directed to the reduction of the risk to the safety of the divers if MAE 15 should occur - they were directed to the prevention of the occurrence of MAE 15. Having the LSP in the immediate vicinity of the diving operations did not reduce the risk of the SPHL failing completely - it was not a prevention control. Rather, requiring the LSP to be in the immediate vicinity of the diving operations was the measure put in place to mitigate or attenuate the risk to the lives of the divers in the event that the very low risk of a complete failure of the SPHL materialised.

(b) The Quantitative Risk Assessment of a MAE 15 recognised the risk was extremely low but nevertheless it is implicit in the Safety Case that Technip considered that the presence of the Hyperbaric Support Vessel with the LSP on board in the vicinity of the Wellservicer at all times was necessary to reduce the risk to as low a level as reasonably practicable. This is understandable given that the Safety Case identified the failure of the SPHL as an event having the potential to cause multiple fatalities to divers.

1. It is to be noted that mechanical failure and chamber systems failure were only two of the six cause events identified in the MAE 15 Bow-tie diagram. Operator error and adverse weather conditions were also identified as potential causes for failures of the SPHL.
2. It may also be accepted that there was a risk involved in transferring the LSP (and the relevant technicians) from the North Sea Atlantic to the Mermaid Supporter at sea. This was a risk inherent in the implementation of an essential aspect of the mitigation control specified in the safety management system in the event that the North Sea Atlantic left the Wheatstone field.
3. The effect of the change proposed by Technip to remove the risk of damage to the LSP in the course of it being transferred from one vessel to another was, however, to allow the LSP to be removed from the Wheatstone field thus removing the mitigation control, which it was open to the magistrate to find, was essential for the preservation of the health and safety of the divers in the event of operational failure of the SPHL.
4. It was open to the magistrate to conclude that removing the LSP from the immediate vicinity of diving operations took away the immediate availability of this essential MAE 15 mitigation control for which there was no substitute. The Barrow Island Rendezvous Plan could not protect the lives of divers if an MAE 15 occurred when the North Sea Atlantic was not in the immediate vicinity of the Wellservicer.
5. For the reasons set out above I am satisfied it was open to the magistrate to find the change proposed by the Site Change Request Form 'significantly changed the safety management system'.
6. Finally, reading the relevant paragraphs of the magistrate's reasons as a whole, I do not accept that the magistrate misdirected himself by considering whether the Site Change Request Form 'significantly changed' the Safety Case as opposed to the safety management system.

The recklessness issue An overview of the parties' submissions

1. One of Technip's primary propositions was that the appellant had failed to establish, beyond reasonable doubt, that Mr Seguela, and thus Technip, had the state of mind required to establish recklessness.
2. More specifically, Technip contends the appellant failed to prove the only rational inference open on the evidence was that Mr Seguela, and through him Technip, was reckless. In support of this contention Technip argues that Mr Seguela's evidence as to his state of mind was unchallenged and, because the appellant relied on inferential reasoning to establish recklessness, the unchallenged evidence must give rise to a reasonable doubt.
3. Technip's senior counsel disclaimed reliance on the rule in Browne v Dunn,[69] or principles of fairness or any requirement for a 'ritualistic putting' of propositions contradicting Mr Seguela's evidence. Senior counsel instead relied on the fact that the reasoning process that lay behind the ultimate submission that Mr Seguela's evidence should not be accepted was not put to him. In this respect there was a degree of ambivalence in Technip's senior counsel's disclaimer of reliance on the rule in Browne v Dunn as he argued that the proposition underlying the appellant's case was that Mr Seguela's evidence was not genuine and that this called for a 'direct frontal challenge on the honesty of Mr Seguela which did not occur'.[70] In any event, Technip contended, as a consequence of the approach taken, the magistrate was deprived of the opportunity to make an assessment of Mr Seguela's honesty or genuineness.
4. Technip's senior counsel emphasised that the evidence of Mr Seguela's state of mind should not be assessed in isolation. He stressed the state of mind evidence should be considered in the context, first of Mr Seguela's evidence that the change to the safety management system came about as a result of discussions involving senior management and divers on board the Wellservicer - those directly affected by the change - and out of a concern about the risk of damaging the LSP in the course of transferring it from the North Sea Atlantic to the Mermaid Supporter. And, second, in the context of Mr Seguela's evidence about the safeguards in place that meant that the risk of an operational failure of the SPHL was extremely low.[71]
5. The appellant submitted the chance of a conviction was open on the evidence. The principal strands of its argument were as follows:[72]

(a) MAE 15 was part of the Safety Case and the control required to mitigate the risk was for the hyperbaric support vessel with the LSP to be in the vicinity of the SPHL. Technip knew the only real control to save the divers if MAE 15 occurred was to connect the SPHL to the LSP from a hyperbaric support vessel capable of providing immediate assistance. This was the control the Safety Case specified, and Technip knew this control represented the form in which the Safety Case had been approved by NOPSEMA. In short, the change abandoned the control required to mitigate the risk of MAE 15.

(b) The change purported to have been effected by the Site Request Change Form was based on an assumption that MAE 15 would not occur and the assumption was contrary to the Safety Case.

(c) Technip, through Mr Seguela, must have known the proposed change to the Safety Case, removing all control for an MAE 15, was a significant one requiring a revision to be submitted to NOPSEMA.

(d) Technip knew, and intended, diving was to take place during in a period where the North Sea Atlantic, and its LSP, were not in the vicinity of divers.

1. Based on the reasoning outlined in the preceding paragraph the appellant contended it was open to the magistrate to conclude that:

(1) Technip actually knew work was performed contrary to the Safety Case; or alternatively

(2) Technip was at least aware of a substantial risk work was being performed in a manner contrary to the approved Safety Case, and that it was unjustifiable for Technip to take the risk;

(3) Mr Seguela's denials of awareness of such a risk should be rejected.

1. Senior counsel for the appellant submitted that in circumstances where Technip was aware that its state of mind was in issue and Mr Seguela had given evidence about his state of mind, prosecuting counsel was not required to put 'formulaic contradictory questions' challenging Mr Seguela's evidence of his state of mind and that, in any event, putting such questions would have been unlikely to elicit anything more than a reaffirmation of Mr Seguela's evidence in a manner unlikely to have been of assistance to the magistrate.[73] It was also submitted it was not part of the appellant's case that Mr Seguela had given evidence dishonestly.[74]

1. In the course of setting out the facts I have referred to aspects of Mr Seguela's evidence. In his evidence-in-chief he gave the following further relevant evidence:

(a) The SPHL had backup systems designed to keep it functioning. There was a backup generator, the Whisper generator, and if that failed there were batteries. The purpose of the batteries was not to propel the SPHL but to provide the essential services to the divers.[75]

(b) The risk of MAE 15 occurring was statistically assessed as being very low.[76]

(c) The 'critical' box on the Site Change Request Form was supposed to be ticked in circumstances where there was a potential for contravening laws or regulations in a management of change procedure. The 'critical' box was not ticked on the Site Change Request Form.[77]

(d) Mr Seguela thought Technip was working within its safety management system, making sure the risk of the change was assessed, and the changes made were actually reducing risk.[78]

(e) Having signed off on the Site Change Request Form Mr Seguela did not believe the respondent was 'doing anything wrong', and did not believe it was breaching the Safety Case.[79]

(f) Mr Seguela did not think if Technip allowed the divers to continue saturation diving while the North Sea Atlantic while the LSP was in Dampier there was any risk that it would be doing work in a manner that was contrary to the Safety Case.[80]

(g) Mr Seguela would not have signed the Site Change Request Form if he had thought there was a risk that the respondent would then be in breach of the Safety Case.[81]

1. Relevantly, Mr Seguela's evidence in cross-examination was as follows:

(a) He has significant experience in offshore operations, and was very familiar with the risks of saturation diving activities. He explained that divers in saturation cannot evacuate in a standard lifeboat, as they must be maintained at pressure, and there is a risk they will die if they are not decompressed properly.[82]

(b) The MAEs in the Safety Case had been identified by Technip in its risk assessment process.[83]

(c) He agreed an event with a low probability of occurring could be an MAE because of its serious consequences, which is the reason why controls were to be put in place to reduce the risk to as low as reasonably practicable.[84]

(d) Whilst there was a low risk of a complete failure of the SPHL, it could happen.[85]

(e) The only effective remedy (to prevent loss of life) in the event of operational failure of the SPHL was to connect it to the LSP on board the hyperbaric support vessel.[86]

(f) He accepted the Site Change Request Form took away that control[87] and he had relied on the SPHL's back-up systems.[88]

(g) He agreed the proposal in the Site Change Request Form assumed that the SPHL would be able to provide life support to divers (whilst on route to Barrow Island), and that the risk of its not being able to do so was not addressed in the proposal.[89]

(h) He knew diving had to comply with the Safety Case.[90]

(i) He said the reason the Hyperbaric Evacuation Plan had provided for the LSP to be transferred to the Mermaid Supporter if the North Sea Atlantic had to leave the field, was 'Because that was a commitment from the Safety Case. And we were trying to - we are complying with the Safety Case'.[91]

1. I have concluded it was reasonably open to the magistrate to find that Technip was reckless. There are several matters that taken in combination contribute to this conclusion - they are as follows.
2. First, there were aspects of Mr Seguela's evidence and the objective circumstances that required the magistrate to consider Mr Seguela's evidence carefully and which, depending on the view taken by the magistrate, might have persuaded the magistrate that he should not have accepted Mr Seguela's evidence as to his state of mind. Those matters were as follows:

(a) The magistrate found the Site Change Request Form significantly changed the safety management system. Indeed, his Honour expressed his view that this was so in trenchant terms, referring to the change as a 'poor substitute' and being 'miles outside what was contemplated by the Safety Case'. The magistrate was presented with a situation in which Mr Seguela's subjective belief was substantially inconsistent with the objective fact as his Honour had found it to be. It would have been open to the magistrate to have formed the view that the inconsistency undermined the weight to be attached to Mr Seguela's evidence of his subjective belief and, on that basis, to have accepted the appellant's submission as to Mr Seguela's state of mind.

(b) Mr Seguela was giving evidence in December 2018 about his subjective understanding of the safety management system and the effect of the change to it as it was three years earlier in November 2015. In assessing the weight to be attached to Mr Seguela's evidence the magistrate would have been entitled to take into account the limitations of human memory and how subconscious reconstruction can affect recollection.

(c) In assessing the weight to be attached to Mr Seguela's evidence of his state of mind it would have been open to the magistrate to take into account that the majority of the questions asked to elicit Mr Seguela's evidence-in-chief about his state of mind were, as senior counsel for the appellant described them 'Dorothy Dixers', that is, closed questions that permitted 'yes or no' answers. The relevant passage in the evidence-in-chief was as follows:[92]

All right. Now, having signed off on [the Site Change Request Form], did you believe that Technip was doing anything wrong?---No.

Did you believe that Technip was breaching its Safety Case?

What did you think about the Safety Case in relation to the management of change procedure?---I thought the Safety Case was the overarching document and we were working within our safety management system which was detailed in the Safety Case and we were just making a change to the hyperbaric evacuation plan document and we were capturing that change and making sure the risk was assessed - the risk of the change was assessed.

Well, did you think there was any risk that if Technip continued to allow saturation diving occurring from the Wellservicer that - sorry, did you think there was any risk that if Technip allowed the divers to continue saturation diving while the NSA was in Dampier with the LSP, that Technip would be doing work in a manner that was contrary to the Safety Case?---No.

Why?---Because we working within our safety management system, our procedure. We did follow them and we were still working under the umbrella of the Safety Case which included those management - that management system and those tools we had to be able to implement some changes when those changes didn't increase the level of risk. It was the opposite. We were actually reducing the risks.

So by signing off on the form you knew that the diving would continue?---Yes.

And you did not think or were not aware of any risk that if that were to continue that Technip would be acting in some way contrary to its Safety Case?---No.

Would you have signed the exhibit 10, the site change request form, if you had thought that there was a risk that Technip would then be in breach of its Safety Case?---No, I wouldn't have signed if the - if I had thought there was any risk by that.

1. Second, for the reasons set out above, it was not necessary for the magistrate to have formed the view that Mr Seguela was untruthful when he gave his evidence about his state of mind in order for his Honour not to have accepted Mr Seguela's evidence about his state of mind.
2. Third, that Mr Seguela's evidence was not the subject of a 'full‑frontal assault' - to use Technip's senior counsel's expression - was not a reason why the magistrate should accept Mr Seguela's evidence as having given rise to a reasonable doubt. In part this flows from my view it was not necessary for the magistrate to have formed the view that Mr Seguela was untruthful in his evidence for his Honour not to have accepted it, and in part because a robust challenge to that evidence is unlikely to have elicited anything more than short answers re‑affirming the evidence-in-chief. Cross-examination of this nature would have provided the magistrate with no more assistance than a 'ritualistic putting' of contradictory propositions. In making this assessment I have had regard to the passages in Mr Seguela's evidence‑in-chief reproduced above.
3. Fourth, at the outset of the case it was clear to Technip its state of mind was in issue. And, while Mr Seguela's evidence was not the subject of challenge by direct contradiction, it is not correct to say the evidence was not challenged. the appellant's trial counsel's approach to Mr Seguela's evidence about his state of mind was to undermine it by drawing from Mr Seguela a concession that the management of change process took away the only control that would have reduced the risk of harm to the divers in the event the SPHL failed completely and, in effect, to insinuate that, in those circumstances, Mr Seguela must have been aware of a substantial risk that diving operations would be undertaken in contravention of the Safety Case. It was an approach that relied on the objective circumstance that the change to the safety management system removed the MAE 15 mitigation control to do the work of undermining Mr Seguela's evidence. Having regard to Mr Seguela's evidence-in-chief about his state of mind I do not consider it was necessary for the appellant's trial counsel to have developed the cross-examination further, though, some may consider it would have been desirable for her to have done so.
4. Nothing in the preceding paragraphs should be taken as implicitly suggesting that Mr Seguela's evidence should not have been accepted. Rather, these reasons should be read only as holding that it was reasonably open to the magistrate to accept the submissions of the appellant concerning the state of mind of Technip. If the magistrate had not accepted Mr Seguela's evidence of his state of mind then it would have been open for his Honour to conclude that the only rational inference open on the evidence was that Mr Seguela, and thus Technip, was reckless.

1. The appellant's ground of appeal is made out and, as indicated earlier, I will grant leave to appeal.
2. For the reasons given I do not accept Technip's contentions as to why an acquittal was inevitable. Accordingly I will allow the appeal.
3. I will hear the parties as to the terms of the orders to be made consequent upon the publication of these reasons.

I certify that the preceding paragraph(s) comprise the reasons for decision of the Supreme Court of Western Australia.

[2] Criminal Appeals Act 2004 (WA) s 14(3).

[3] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.4(1).

[4] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.24.

[5] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[6] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[7] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.5(1).

[8] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.5(2).

[9] The acronym ALARP is used to refer to the concept of 'as low as reasonably practical'.

[10] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.5(3).

[11]Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[12] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.25.

[13] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.30(1)(d).

[14] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.36.

[15] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.44.

[16] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.45.

[17] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[24] Commonwealth of Australia v Technip Oceania Pty Ltd (Unreported, Magistrates Court of Western Australia, Case No PE 21352/2017, 12 April 2019) (Primary Decision).

[26] Referred to interchangeably as the Hyperbaric Rescue Vessel - the HRV.

[34] 'HRF' was the acronym for 'Hyperbaric Reception Facility'.

[36] The magistrate considered that the reference to 'SMS Section 12.5.1' was 'an obvious tabulation error' but found, in effect, that the section was included in the Safety Case, Primary Decision [61] - a finding not challenged on appeal. I am not persuaded that there was a tabulation error as the subject matter of the section introduced by the revision is an aspect of 'Emergency Preparedness & Response'.

[39] Trial exhibit P3, 201 - 202. The italicised portion indicates the amendment made by the Safety Case Response Note.

[61] Primary Decision [89] - [91], [95], [98] - [99].

[62] Criminal Code 1995 (Cth), s 5.6(2).

[63] Criminal Appeals Act 2004 (WA) s 9(1).

[66] Trial exhibits 3, 4, 10 and 11 respectively.

[67] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[68] Hope v Bathurst City Council [1980] HCA 16; (1980) 144 CLR 1, 7 (Mason J).

[72] Appellant's outline of written submissions, 31 October 2018, [50].