TECHNIP OCEANIA PTY LTD -v- COMMONWEALTH DIRECTOR OF PUBLIC PROSECUTIONS [2021] WASCA 139 (11 August 2021)

4 The respondent, the Commonwealth Director of Public Prosecutions (the CDPP), appealed against the acquittal, contending that the magistrate had misdirected himself on the issue of recklessness, which was the relevant fault element of the offence. Before the primary judge, Technip accepted that the magistrate had so erred. However, Technip contended that the appeal should be dismissed because an acquittal was inevitable. Technip advanced its contention on two bases, only one of which remains relevant. Relevantly, Technip contended that, on the basis of the evidence adduced at trial, it was not open to find that the element of recklessness was established beyond reasonable doubt.

5 The primary judge rejected Technip's contention, concluding that it was reasonably open to the magistrate to have accepted the CDPP's submission as to Technip's state of mind.[1]

6 Technip now seeks leave to appeal the primary judge's decision, relying on its contention that an acquittal was inevitable because it was not open to the magistrate to have been satisfied beyond reasonable doubt that Technip was reckless.

7 For the reasons that follow, we accept Technip's contention and so would uphold the appeal, set aside the primary judge's orders and instead order that the CDPP's appeal against Technip's acquittal be dismissed.

8 For the purposes of outlining the regulatory regime and the facts, we have largely drawn upon the judge's clear and concise summaries, which were adopted by Technip in its submissions to this court.

9 The National Offshore Petroleum Safety and Environmental Management Authority (NOPSEMA) was established by s 645 and s 646 of the Offshore Petroleum and Greenhouse Gas Storage Act 2006 (Cth) (the Act). Its functions include the promotion of the occupational health and safety of those engaged in offshore petroleum operations and the monitoring and enforcement of occupational health and safety obligations imposed by the Act, as well as other subsidiary legislation including the Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) (the Regulations).

10 The objects of the Regulations include ensuring that facilities are operated in Commonwealth waters only in accordance with 'safety cases' that have been accepted by NOPSEMA.

11 The Regulations provide for the operator of a facility to submit a safety case to NOPSEMA.

12 The term 'safety case' is defined in the Regulations as: 'the document known as a safety case that is submitted to NOPSEMA under Part 2 of Chapter 2.' It may be seen that, under this definition, only a document submitted to NOPSEMA is, or can be, a 'safety case'.

13 The term 'safety management system' is defined as follows:

safety management system, for a facility, means a system for managing occupational health and safety at the facility.

14 Reg 2.5 prescribes what is to be contained in a safety case as well as the nature and content of a safety management system. Relevantly, reg 2.5 requires a safety case to contain:

(a) A detailed description of the facility and the activities to be undertaken at the facility.[2]

(b) A detailed description of the 'formal safety assessment' for the facility being an assessment that:[3]

(i) identifies all hazards having the potential to cause a major accident event; and

(ii) is a detailed and systematic assessment of the risk associated with each of those hazards, including the likelihood and consequences of each potential major accident event; and

(iii) identifies the technical and other control measures that are necessary to reduce that risk to a level that is as low as reasonably practicable.[4]

(c) A detailed description of the safety management system that must satisfy the requirements stipulated in pars (a) ‑ (i) of reg 2.5(3). One such requirement is that it provides for the reduction to a level that is 'as low as reasonably practicable' of risks to health and safety of persons at or near the facility including, but not limited to, risks arising during evacuation, escape and rescue in case of emergency.[5]

15 The term 'major accident event' (MAE) is defined as 'an event connected with a facility, including a natural event, having the potential to cause multiple fatalities of persons at or near the facility'.[6]

16 Thus, while all risks to health and safety must be reduced to as low as reasonably practicable, the identification of major accident events, and the prevention and mitigation of such events, is a central feature of the system of safety management prescribed under the Regulations.

17 NOPSEMA may request further written information about a safety case submitted by an operator. The information provided by the operator in response becomes part of the safety case.[7]

18 Reg 2.26 provides for NOPSEMA to accept or reject a safety case for a facility.

19 Reg 2.28 provides for NOPSEMA to consent to the conduct of an activity in a manner that is different from the safety case in force in relation to a facility.

20 Regs 2.30 - 2.36 provide for the submission of a revised safety case, which is required in certain circumstances, including:

(1) where the operator proposes to significantly change the safety management system (reg 2.30(1)(d));

Reg 2.34 provides for NOPSEMA to accept or reject a revised safety case.

21 If a revised safety case is not accepted by NOPSEMA, the safety case in force in relation to the facility immediately before the revised safety case was submitted remains in force as if the revised safety case had not been submitted.[8]

22 It is an offence to operate a facility within Commonwealth waters unless there is a safety case in force in relation to the facility.[9] A safety case is not in force unless it has been accepted by NOPSEMA.[10]

23 It is also an offence to do any work at a facility or part of the facility in Commonwealth waters in a manner that is contrary to the safety case in force for the facility.[11] Technip was charged with such an offence.

24 Chevron Australia Pty Ltd (Chevron) owned and operated the Wheatstone platform for the purposes of extracting liquefied natural gas. The Wheatstone platform was in Commonwealth waters 98 nautical miles north-west of Dampier in an area designated as the Wheatstone Field.

25 Technip is a contractor in the oil and gas industry involved in installing subsea infrastructure for operators such as Chevron. Technip was contracted by Chevron to fabricate and install subsea structures and a pipeline for the purposes of piping gas from the Wheatstone Field to the mainland - the Wheatstone project.

26 The work undertaken by Technip included conducting diving operations from the vessel the Wellservicer located in the Wheatstone Field. On 24 March 2015 Technip was accepted as the operator of the Wellservicer by NOPSEMA.

27 On 24 July 2015 Technip submitted a safety case to NOPSEMA in relation to the Wellservicer pursuant to reg 2.24 and reg 2.44. The safety case was assessed by NOPSEMA, and pursuant to reg 2.25, further information was sought from, and provided by, Technip. That further information was contained in a 'Safety Case Response Note', which pursuant to reg 2.25 and reg 2.26 of the Regulations then formed part of the safety case.

28 On 7 October 2015 NOPSEMA accepted the safety case (the Safety Case) for the Wellservicer.

29 The judge found that, in addition to the Safety Case, Technip submitted to NOPSEMA, and NOPSEMA approved, a Diving Project Plan and a Hyperbaric Evacuation Plan. On the evidence at trial, it is doubtful that the Hyperbaric Evacuation Plan was submitted to NOPSEMA, but for the purposes of this appeal it is sufficient to note that the Hyperbaric Evacuation Plan was referred to in, and was to be read with, the Safety Case. Both plans were specific to the Wheatstone project.

30 The diving undertaken from the Wellservicer was saturation diving - a technique that requires divers to undergo saturation at the start of a rotation and then live and work in a hyperbaric environment for the duration of the rotation. In this case it was contemplated that the rotation would be for 21 days. When not diving, the divers lived in hyperbaric chambers within the Wellservicer and ordinarily only decompressed when the rotation was over.

31 The judge identified the two features of the Safety Case with which the present case is primarily concerned:[12]

(a) Because the divers were living in a saturation environment the measures for their protection included a Self-Propelled Hyperbaric Lifeboat (SPHL) located on the deck of the Wellservicer. A SPHL is a lifeboat designed to keep divers in a saturation environment in the event that they are required to evacuate. Assuming proper functioning, the SPHL is capable of providing 'autonomous life support for a minimum period of 72 hours without outside assistance'. The magistrate described the SPHL as a 'sophisticated vessel with back up capacities in the event of an equipment failure'.

(b) Additionally, the Safety Case for the Wellservicer required that during a saturation diving operation there should be a hyperbaric support vessel (HSV),[13] and that this vessel be equipped with a Life Support Package (LSP) (described by the magistrate as a 'container like structure'). The purpose of the LSP was to provide life support to divers in the event of operational failure of the SPHL and to provide life support in the event that the SPHL was recovered onto the deck of the HSV.

32 In July 2015 Mr Seguela was Technip's subsea operations manager. His role was to oversee all subsea projects and ensure company procedures and processes were followed. Mr Seguela participated in the first risk identification session during the preparation of the Safety Case. The purpose of that first session was to identify risks and hazards, 'especially the major accident events'. He had a 'high level involvement' in the production of the Safety Case. Mr Seguela was also involved in internal meetings and discussions to prepare the Safety Case Response Note for NOPSEMA. The magistrate found, and it was and is common ground, that Mr Seguela was the controlling mind of Technip for the purposes of the events with which this case is concerned.

33 The Safety Case comprised four parts, two of which are relevant: Part C - Safety Management System Description, and Part D - Formal Safety Assessment.

34 Part C described the safety management systems used for the operation of the Wellservicer by reference to particular elements of occupational health and safety such as, 'Employee Selection', 'Training and Competency', 'Health and Hygiene', 'Emergency Preparedness' and 'Response'.

35 One element of the system described in Part C was 'Hazard Identification, Risk Evaluation and Management'. The purpose of this aspect of the system was described as follows:[14]

In accordance with the [Quality, Health, Safety and Environment] policy, Technip aims to provide a safe workplace and reduce the health impacts of its operations through effective control of risks. The purpose of the risk management process is to ensure that all foreseeable hazards are identified and adequately controlled and the associated risks reduced to ALARP.

Once a hazard is identified, the risk shall be assessed using the Technip HSE Criticality Matrix (Appendix G - Risk Matrix). The HSE Criticality Matrix consists of a Severity Table, Probability Table and 5x5 Risk Ranking Table. The assessed levels of severity and probability are cross-referenced on the Risk Ranking Table to assess the level of Risk - Low, Medium or High.

With respect to hazard control and mitigation, the principle of hierarchy of controls is applied. That is, the preferred, most effective option in descending order to least preferred, less effective. Hazard controls shall consider, in preferred order:

• Elimination - remove the hazard or risk;
• Substitution and minimisation of hazard by design (inherently safer design);
• Detection (transmission of information to control point);
• Control (limitation of scale, intensity and duration);
• Mitigation of consequences (protection from effects); and
• Emergency, evacuation and rescue.

36 Part C of the Safety Case contained a section dealing with 'Emergency Preparedness and Response'.[15] Relevantly, two revisions to this section of the Safety Case were introduced in the Safety Case Response Note as follows:

(a) The addition of a new performance standard to the 'Wellservicer Emergency System Performance Standards', which were set out in table 33.[16] The revision added a 'Target' of a 'timing' for 'SPHL to HSV and HRF'[17] as follows:[18]

- Time to muster divers into SPHL launch and recovery SPHL to HSV** 16 Management of Change

Change, whether small or larger, is inevitable, and may impact upon the safe operation of the work scope. Management of change (MOC) is carried out in accordance with TPO's Offshore/Site Management of Change and Off-Site Management of Change. These procedures provide the process to ensure that all changes are properly engineered, checked and risk assessed. Any new hazards are properly controlled and mitigated in accordance with risk reduction principles. The MOC process requires the authorisation of senior project and offshore management.

The objective of the MOC process is to ensure that additional risks are not introduced by changes which could increase the risk of harm to personnel onboard. (emphasis added)

The Technip MOC process applies to all marine and project activities.

38 Part D of the Safety Case was described as the 'Formal Safety Assessment' and dealt with the assessment of a number of specific safety risks. In the introduction to Part D, its purpose was described as follows:[20]

The purpose of the Formal Safety Assessment (FSA) is to demonstrate that, particularly in relation to potential Major Accident Events (MAEs), all reasonably practicable controls have been identified in order to ensure that risk is reduced to ALARP. The implementation and on-going management of these controls is covered by the Safety Management System ...

The FSA has been performed in accordance with the OPGGSA, the OPGGSSR and the SMS requirements (refer to Part C). The FSA includes the activities listed in Table 40 below.

39 The activities listed in the Table 40 referred to in the extract above included 'Hazard Identification', 'MAE Assessment', 'Bowties', 'Escape, Evacuation and Rescue (EER) Assessment' and 'Quantitative Risk Assessment (QRA)'.

40 The process of hazard identification undertaken by Technip, and in which Mr Seguela participated, identified 'SPHL operation failure' as a major accident event - MAE 15.

41 The assessment of MAE 15 contained in the Safety Case was as follows, after its amendment by the Safety Case Response Note:[21]

4.16 MAE 15: SPHL operation failure

4.16.1 Event Description

Once the saturation divers have evacuated into the SPHL and the hyperbaric lifeboat has been launched, there is a potential for a failure of the SPHL during its operation. This event has the potential for injuries or fatalities to divers. The potential causes for SPHL failure could be mechanical, chamber system, including Life Support Package (LSP) failure, adverse weather or operator error.

4.16.2 Prevention and Mitigation Controls

The risk of injuries or fatalities to divers due to SPHL operation failure has been minimised by both engineering and procedural controls.

The vessel dive system, including the SPHL is subject to Dive System FMECA, annual Dive System audits by a third-party, in accordance with vessel assurance processes. In addition, the SPHL must be launched to meet Class requirements at a minimum of 3 monthly intervals, and also to demonstrate functionality and increase crew familiarisation.

In addition, the LSP package is designed to IMCA D024 Rev 2. A stricken SPHL would 'hook up' to the package and be provided continued, conditioned water for use with the hyperbaric conditioning units (HCU), gas by way of main supply, BIBS supply and oxygen make up supply. Electricity is also supplied by the LSP.

While the LSP provides these resources, it is not independent as it requires electrical power and HP stored gases. Support hoses, regulators and a purpose made 75 m umbilical are all provided as part of the LSP.

Once the divers are safely locked into the SPHL, they are required to wear PPE and seat belts inside the lifeboat. This is to prevent injuries from unforeseen lifeboat movement, heave during launch, transit and recovery.

A key mitigation for SPHL failure is the project specific hyperbaric evacuation procedure. The procedure, subject to HAZID processes, describes the planning, preparation, steps and trials associated with moving the SPHL safely from the Wellservicer to HRF, located in a nearby port location.

The base case for hyperbaric evacuation is that, should the weather conditions be acceptable and with, in consultation with the SPHL coxswain, the HSV Master's approval/discretion, the SPHL may be lifted onto a purpose-built cradle on the back deck of the HSV. Once the SPHL is safely out of the water and secured into the cradle on the vessel, the LSP is to be connected and systems confirmed, the HSV will transit to the HRF that will be located in a nearby port. Diver's well-being and the SPHL system can be continuously monitored during the transit by LSTs. Once the SPHL is confirmed locked on the HRF, the divers are transferred into the HRF chambers where decompression will commence.

As part of offshore readiness trials, the SPHL will be mated to the HRF prior to any diving operations commencing. Refer to Part C SMS for further details of hyperbaric evacuation.

Other key prevention and mitigation measures include:

• Routine maintenance and inspections on the SPHL in accordance with the planned maintenance system;
• SPHL Operation Manual;
• Separated power supply for SPHL;
• Independent power systems launch on accumulators;
• Diver medical technician;
• Trained and competent emergency team and SPHL crew;
• Diver evacuation drills to SPHL prior to commencing diving operations;
• Diving emergency procedure; and
• Hyperbaric Support Vessel and hyperbaric evacuation.

The MAE Bowtie Diagram (Appendix 1 - MAE Bowtie Diagrams) presents the potential causes and consequences of the event with all of the identified prevention and mitigation barriers/controls (Appendix H - Hazard Register). The bowtie diagram shows that sufficient barriers are in place.

A SPHL failure with divers in saturation has the potential to delay evacuation of the SPHL to the HRF and for injuries and fatalities to saturation divers. An assessment of the escape, evacuation and rescue facilities is included in the EER Assessment (Part D, Section 5). An assessment of the survivability of Safety Critical Elements (SCEs) is included in the ESSA (Part D, Section 6). The risks associated with this event are quantified in the QRA (Part D, Section 7).

42 As part of the Escape, Evacuation and Rescue Assessment (section 5.3.6 - as amended by the Safety Case Response Note) the 'base case' for hyperbaric evacuation using the SPHL was described as follows:[22]

Given acceptable weather conditions, and with, in consultation with the SPHL coxswain, the HSV Master's approval/discretion, the SPHL shall be lifted onto a purpose-built cradle on the back deck of the HSV.

Once the SPHL is out of the water, safely secured on the vessel, the LSP is to be connected and systems confirmed, the HSV will transit to the HRF that will be located in a nearby port.

If conditions are deemed as presenting an unacceptable risk, the HSV is to provide support to SPHL during transit to safe haven/port and HRF.

43 Part D of the Safety Case contained a 'Quantitative Risk Assessment' of each MAE. In respect of MAE 15, par 7.4.15 of the Quantitative Risk Assessment commenced with the following observations:[23]

There is little historical data on SPHL operational failure incidents with divers in saturation. Technip QHSE database synergi has no records of such incidents and similarly IMCA records do not provide data of SPHL operational failures with divers on board SPHL.

The Wellservicer is Dive Systems [sic] is subject to annual 3rd Party audits to IMCA Guidelines, vessel assurance processes and extensive planned maintenance and inspections which include the SPHL. In addition, the LSP is designed to IMCA D 024. The SPHL is subject to (max) 3 monthly launch, testing and recovery trials. Should a hyperbaric evacuation incident occur it is assumed the SPHL is successfully launched and the HSV is on station to provide immediate assistance. In addition, the fully functional LSP is onboard the HSV with sufficient time to render assistance to SPHL and any operational failure or problem. Given the engineering and procedural controls in place and checks, the assumption is that an incident where the SPHL operation failure results in a diver fatality is a very low likelihood. (emphasis added)

44 The assessment gave a numerical value to the risk of operational failure of the SPHL having, for this purpose, first ascribed probabilities expressed in percentage terms to the relevant risk factors. It was assumed that 10% of SPHL operational incidents would result in injuries to divers and that 10% of such injuries would be fatal.

45 One of the tools used to assess Major Accident Events identified for the purposes of Part D of the Safety Case was 'Bowtie Diagrams'. These were explained in the Safety Case as follows:[24]

Bowtie diagrams have been developed for the Wellservicer MAEs and are presented in Appendix I - MAE Bowtie Diagrams. The bowtie diagrams provide a visual demonstration of the way in which risks are managed, allowing understanding at all levels and giving personnel the opportunity to review the controls in place and identify any gaps and potential improvements.

The bowtie diagrams present typical cause scenarios on the pre-event side (left side) while credible consequences are presented on the post‑event side (right side). The pre-event and post-event control measures (prevention and mitigation barriers) are included as shown in the bowtie diagram schematic in figure 26.

46 As the primary judge observed,[25] the Safety Case, like the regulatory regime, draws a distinction between mitigation and prevention. Prevention barriers are designed to prevent a major accident event from occurring, while mitigation barriers are designed as measures to contain the consequences of a MAE after it had occurred.

47 The bow-tie diagram in relation to MAE 15 identified typical cause scenarios including, 'adverse weather conditions', 'mechanical failure', 'chamber system failure', 'human error' and 'crane or towing failure'. Prevention barriers were identified for each of the cause scenarios.

48 Five 'mitigation controls' were identified in the circumstance of an SPHL failure, being:

(b) Remote Diving Doctor Emergency Medical Support;

(d) Hyperbaric Emergency Plan and Project Emergency Procedure & drills; and

49 Part D of the Safety Case included a section entitled 'ALARP Demonstration'. In an introductory paragraph to this section it was recorded that:[26]

One of the main objectives of the [Regulations] is to ensure that the risks to Health and Safety of people at offshore facilities are reduced to a level that is ALARP.

The adopted control measures for any particular identified MAE must be shown to collectively eliminate, or reduce the risk to Health and Safety to a level that is ALARP. According to the Regulations, evidence of reduction of safety risks to ALARP is achieved by the steps shown in Table 71.

The format of table 71 was three columns. In the left column the text of the relevant regulation was reproduced. In the centre column the requirement of the regulation was stated and in the right column, the assessment column, the place in the Safety Case where the requirement of the regulations was addressed was identified. Opposite the requirement of reg 2.5(3)(e), (the regulation which required a detailed description of the safety management system that provides evidence the system provides for the reduction to a level that is as low as reasonably practicable of risks to health and safety of persons at or near the facility including, but not limited to risks arising during evacuation, escape and rescue in case of emergency), the reference in the assessment column read '[t]his is covered in the EER Assessment (Part D, Section 5.5)'.

50 The Diving Project Plan included the following provision:[27]

During the diving operations phase involving the Wellservicer the North Sea Atlantic will act as the Hyperbaric Rescue Vessel (HRV) and shall stay within the field during DSV operations at the WP. If due to operational or mechanical breakdown reasons, where the North Sea Atlantic cannot act as the HRV, then an infield tug will take receipt of the LSP and will act as the HRV at that time. Please refer to the Hyperbaric Evacuation Plan [16] for full details. (emphasis added)

51 The purpose of the Hyperbaric Evacuation Plan was described in the introduction to that plan as follows:[28]

The purpose of this document is to detail the procedure to be followed by [Technip] in the event of a vessel emergency on board the Wellservicer which requires launch, transit and reception of the SPHL at the Hyperbaric Reception Facility. The process described within this plan aims to reduce risk to all personnel involved in the activities described to ALARP and to meet or exceed the requirements of IMCA D 052 Rev 2 and other codes/standards as described in the document. Any such response action can be divided into four main phases:

• Launch of the SPHL;
• Transit of the SPHL to Dampier;
• Quay side recovery of the SPHL and transport to the HRF; and
• Receipt, transfer and decompression at the HRF.

... The LSP will be transported, installed and commissioned on the [Heavy Construction Vessel] North Sea Atlantic or other suitable vessel nominated and approved by [Chevron] as the attendant HRV for the Wellservicer.

52 Paragraph 3.3.3 of the Hyperbaric Evacuation Plan set out the specifications of the Hyperbaric Rescue Vessel as follows:[29]

The North Sea Atlantic (NSA) will act as the primary Hyperbaric Support Vessel (HRV) for the Wellservicer during diving operations on the project when she is also in field. The NSA will remain in the project field during diving operations when she is the nominated HRV. If due to operational reasons the NSA cannot act as the HRV (such as returning to port for interim mobilisation) then an infield tug will be identified and act in this capacity including carrying the LSP.

The Life Support Package (LSP) will be positioned and sea fastened on the HRV back deck. The LSP will be installed in a position close to power outlets to enable the system to be run. The area around the LSP shall be maintained and kept clear of congestion at all times.

The LSP will be connected to the NSA services and function tested when first loaded onto the NSA. The LSP will be operated by the LSS from the SPHL if it needs to be used to supply servicers [sic] to the SPHL.

The HRV will remain within 4 hours transit time of the DSV when divers are in saturation where practical.

Emergencies on-board the HRV will be dealt with in accordance with HRV subcontractor procedures. However, if an emergency arises where the HRV must return to port, then the Wellservicer Master must be informed, upon which the divers will be recovered and arrangements to maintain the agreed transit limit will be established. Alternatively if possible the LSP and gas will be transferred to an alternative vessel which will then act as the HRV. (emphasis added)

53 Paragraphs 6.1 to 6.5 of the Hyperbaric Evacuation Plan described the steps to be taken in each phase of a hyperbaric evacuation beginning with preparation and launch and ending with onshore medical support. Paragraph 6.2 described the procedure for 'SPHL Transit, Support & Recovery' as follows:[30]

6.2 Phase 2 - SPHL Transit, Support & Recovery

Once the SPHL is clear of the Wellservicer the hyperbaric emergency enters the second phrase - support of the SPHL and its occupants and its transit to the HRF for decompression. The launch of any SPHL would be considered a major incident and would immediately trigger the call out of the onshore Emergency Response Team (ERT) in accordance with Technip company procedures.

If they are in a position to do so, the Master and OCM will assist with this phase of the evacuation, however as the incident that results in the SPHL being launched may well incapacitate the Wellservicer, it is anticipated that the HRV, with support of the onshore ERT, will play a major role in facilitating the transit, support and recovery of the SPHL to the HRF.

This phase of the evacuation contains the most variables and therefore is the phase that will require the most attention during the execution. The following options in preference shall be considered:

If HRV equipped with suitable crane;

1. SPHL moves away from the Wellservicer. The SPHL is recovered via offshore lifting to the deck of the HRV if practical and seastate allows (at Master and Coxswain discretion). Once on deck the SPHL is connected to the LSP and the HRV transits at safe speed to the HRF.

2. SPHL moves away from the Wellservicer. The SPHL transits at safe speed (under own power to tow) to sheltered waters (Barrow Island) for lift onto HRV.

If HRV not equipped with crane;

1. SPHL moves away from the Wellservicer. The SPHL transits at safe speed (under own power or tow) to the HRF with the HRV providing a lee from weather and support as requested by the Coxswain.

These options are detailed in the flow chart shown in figure 6-2 below.

(Flow chart not reproduced)

At all times the LSP will be held on the HRV such that if the SPHL requires gas, cooling or heating this can be supplied. Note that the Wellservicer's SPHL has 72 hours endurance so the LSP is a backup and should not have to be used as a base case while the SPHL is in the water. As the distance from the field to Dampier is 98nm, at 5kts the journey time would be approximately 20 hours, or 28% of total endurance which is well within the requirements of IMCA D052. The LSP should only be connected in sheltered waters (if the SPHL is in the water) however if the SPHL is taken out of the water the LSP has to be connected such that cooling can be supplied.

Note - SPHL is fitted with a 75 m dynema tow line complete with spliced hard eye which is passed to the HRV if towing is required.

The SPHL shall have its own on-board navigation equipment. In the event of a breakdown of the engine of the SPHL, the HRV will attach a towline and tow the SPHL to the HRF port in Dampier.

The HRV will advise any other vessels which transit within 5nm, that a SPHL is being escorted to Dampier, and that all other vessels are required to maintain minimum 2nm clearance. The HRV will maintain radio contact with Dampier Port Authority (VHF 11) advising progress and ETA of the SPHL. The HRV will maintain contact with the [Technip] [Emergency Response Team], advising ETA of the SPHL in Dampier. The [Technip] [Emergency Response Team] will advise the HRF Manager in Dampier and [Chevron] [Emergency Response Team]. (emphasis added)

54 The flow chart in figure 6.2 provided estimates of the time involved in various steps, with towing of the SPHL by the HSV at a speed of 6 knots, and a speed of 5 knots for the SPHL proceeding under its own power.

55 On 18 November 2015 there were discussions about changing the Safety Case because the North Sea Atlantic would be required to leave the Wheatstone Field while diving was being undertaken and there were concerns about the LSP being damaged in the process of being lifted from the North Sea Atlantic to the tug - the Mermaid Supporter. Mr Seguela described the participants in the discussions as 'all the management team on-board the vessel'[31] - this included Chevron's representative on board. This group included members of Technip's management who had been involved in the preparation of the Safety Case, as well as the nine divers who were to undertake saturation diving, three diving supervisors and a diving superintendent.

56 The participants in the discussion agreed unanimously that the Safety Case be changed and confirmed their agreement to the proposed change either by signing a form to that effect or, in some instances, by confirmatory email. The change was recorded in a form entitled 'Site Change Request Form' dated 19 November 2015. Mr Seguela signed the Site Change Request Form as Technip's senior officer.[32]

57 The judge said that the effect of the proposed change to the Safety Case described in the Site Change Request Form was to remove the requirement that the HSV be in the vicinity of the Wellservicer while saturation diving work was being undertaken, and an alternate safety plan - the Barrow Island Rendezvous Plan - was devised to replace it. We would characterise the effect of the change somewhat differently - as removing the requirement that, when the tug the Mermaid Supporter was acting as HSV, the LSP be commissioned on it. The Site Change Request Form provided for the LSP to be kept on the North Sea Atlantic when it left the Wheatstone Field rather than being transferred to the Mermaid Supporter (the vessel that was to remain in the Wheatstone Field) which, even though it would not have the LSP on board, would then act as the HSV. In the event the SPHL was launched it would make its way to Barrow Island with assistance, if necessary, from the Mermaid Supporter, and rendezvous with the North Sea Atlantic at Barrow Island, 40 nautical miles from the Wheatstone Field, a distance that it was estimated would take between approximately six and ten hours to cover, depending on the weather.

58 The Site Change Request Form provided as follows:

59 Technip did not submit a revised safety case to NOPSEMA incorporating the change described in the Site Change Request Form. Mr Seguela explained that it was appropriate (in his view) that the management of change process described in the Safety Case be used.[33] Mr Seguela's evidence about the Site Change Request Form is significant for the issues on appeal and is detailed below in [107] - [111].

60 Between 22 and 25 November 2015 saturation diving work was undertaken from the Wellservicer. While this work was taking place there was only one LSP attached to the Wheatstone project and it was on board the North Sea Atlantic which was travelling to or from, or was at, Dampier. It was not in the vicinity of the Wellservicer. The magistrate found that the North Sea Atlantic was 'well outside the zone where it could come to the "immediate" rescue of divers'.[34]

61 On 26 November 2015 a meeting was held between representatives of Technip and representatives of NOPSEMA at which the change described in the Site Change Request Form was discussed. The following day, 27 November 2015, Mr Ben Barnes of NOPSEMA sent an email to Mr Seguela in which he stated:[35]

In view of our discussion yesterday, I advise you that should the Hyperbaric Support Vessel 'The North Sea Atlantic' leave the close proximity of the DSV during diving operations, this would be considered a non-compliance of the Wellservicer Safety Case ...

Consequently, Technip Oceania Pty Ltd would not be compliant with OPGGS(S) 2009 Reg 2.45 (g).

Should Technip Oceania Pty Ltd wish to amend the Wellservicer safety case to provide for other emergency hyperbaric arrangements, a formal revision of the Wellservicer safety case would be required.

It was noted in the discussion that the proposed replacement HSV the tug 'Shelf Supporter' does not provide the capabilities or safety critical equipment as described in the Wellservicer safety case.

62 Mr Seguela responded by email on 27 November 2015 as follows:[36]

Thanks for the below, it is noted. As discussed in yesterday's meeting, Technip have raised a Management of Change (attached to this email) to capture keeping the LSP on the NSA as an improvement in the ALARP condition described in the Rev 0 DPP and Hyperbaric Evacuation Plan while operating on the Wheatstone project.

Please note that the NSA is planned to conduct 1 x interim mobilisation while the Wellservicer is engaged in spool installation and diving operations. The duration of this mobilisation equals to less than 2% of the total duration of the offshore campaign.

The likelihood of an SPHL emergency during NSA mobilisation is remote and the level of risk to personnel (divers) is considered acceptable and ALARP as described in the attached MOC ... Transferring and commissioning the LSP offshore from the North Sea Atlantic to the Mermaid Supporter during this interim mobilisation is considered to be introducing a new risk and unnecessary risk - potential damage to LSP.

63 The charge alleged that, between 23 November 2015 and 25 November 2015, Technip did work at a facility, or part of a facility, in Commonwealth waters in a manner that was contrary to the Safety Case that was in force for that facility, contrary to reg 2.45(f) and reg 2.45(g) of the Regulations.

64 Under s 5.6(2) of the Criminal Code (Cth), recklessness is the fault element for a physical element that consists of a circumstance. Here the relevant circumstance is that that the work was done in a manner that was contrary to the Safety Case.

65 Under s 5.4(4) of the Code, if recklessness is a fault element for a physical element of an offence, proof of intention, knowledge or recklessness will satisfy that fault element. Under s 5.2(2) of the Code, a person has intention with respect to a circumstance if he or she believes that it exits or will exist. Under s 5.3 of the Code, a person has knowledge of a circumstances if he or she is aware that it exists or will exist in the ordinary course of events.

66 Recklessness is relevantly defined in s 5.4(1) of the Code, which provides that a person is reckless with respect to a circumstance if:

(a) he or she is aware of a substantial risk that the circumstance exists; and

(b) having regard to the circumstances known to him or her, it is unjustifiable to take the risk.

The requirement of awareness of a substantial risk that the circumstance exists directs attention to the actual, subjective knowledge of the accused.

67 The issue in this appeal is whether, on the evidence before the magistrate, it was open to be satisfied beyond reasonable doubt that Technip:

(a) knew that work would be undertaken in a manner that was contrary to the Safety Case; or

(b) was aware of a substantial risk that work would be so undertaken.

68 The prosecution's case at trial was summarised by the primary judge along the following lines:

(a) the Safety Case required that the HSV - with the LSP on board - be no less than two hours away from the Wellservicer while saturation diving was taking place;

(b) between 22 and 25 November 2015 saturation diving took place and the North Sea Atlantic with the LSP on board was more than two hours away from the Wellservicer;

(c) the Site Change Request Form did not effect a valid change to Safety Case, as the change proposed constituted a significant change to the safety management system, in that it entirely removed the control put in place to mitigate the risk identified in MAE 15 and the change had not been submitted to or accepted by NOPSEMA;

(d) thus the Barrow Island Rendezvous Plan described in the Site Change Request Form did not become part of the Safety Case in substitution for the requirement that the HSV be no less than two hours away from the Wellservicer;

(e) Mr Seguela approved the Site Change Request Form knowing that it would take away the only control that could save the divers in the event MAE 15 occurred; and

(f) the only rational inference was that Mr Seguela was aware that, by approving the Site Change Request Form knowing diving operations were going to be performed at the Wellservicer, there was a substantial risk that Technip would not be complying with the Safety Case during those diving operations because the effect of the change was to allow the LSP to be taken away from the Wheatstone Field - thus, Mr Seguela (and Technip) was reckless as to whether those operations were being conducted in a manner contrary to the approved Safety Case and it was unjustifiable for him to take the risk of undertaking the diving operations in contravention of the Safety Case.

69 As can be seen from par (c) above, the prosecution case was framed in terms of whether the Site Change Request Form effected a valid change to the Safety Case. Technip's case was similarly framed.[37]

70 It is not necessary to comprehensively outline Technip's case at trial which put in issue several elements of the charge. Relevantly, one aspect of Technip's case at trial was its contention that the CDPP had failed to established beyond reasonable doubt that Mr Seguela either knew that work was performed contrary to the Safety Case or that he was aware of a substantial risk that work would be so undertaken.

71 In considering the issue of recklessness, the magistrate found there was insufficient evidence to support a conclusion that the implementation of the Barrow Island Rendezous Plan created a substantial risk. It is not otherwise necessary to detail the magistrate's reasons.

72 It was common ground on the appeal to the primary judge that the learned magistrate misdirected himself in relation to the element of recklessness by considering whether the implementation of the Barrow Island Rendezvous Plan created a substantial risk of harm to divers and whether it was unjustifiable to take that risk, when the correct question was whether Technip was reckless as to whether the work was undertaken contrary to the Safety Case.[38]

73 As already noted, the CDPP appealed against the magistrate's decision on the ground that the magistrate erred in law in considering the element of recklessness. Technip conceded that error was made, but contended that the appeal should be dismissed because, on the evidence as a whole, an acquittal was inevitable.

74 Technip advanced two reasons why it said an acquittal was inevitable. The first was that the magistrate erred in finding that the change to the Safety Case was a significant change requiring NOPSEMA's approval. Consistently with the cases presented by the parties, the primary judge resolved this issue by reference to whether it was open to the magistrate to find that the Site Change Request Form significantly changed the safety management system.[39]

75 As will be seen, in our respectful view, on a proper construction of the Regulations, that does not reflect the true issue as to the physical element of the offence with which Technip was charged. While the issue in this appeal concerns the fault element of the offence with which Technip was charged, proper identification of the physical element informs the analysis as to the relevant fault element.

76 The second reason advanced by Technip mirrors its contention in this appeal - that in light of Mr Seguela's evidence, it was inevitable that the prosecution case would fail on the issue of recklessness.

77 The judge summarised Technip's submissions as to why the failure of the prosecution case on the issue of recklessness was inevitable in the following manner:[40]

More specifically, Technip contends the appellant failed to prove the only rational inference open on the evidence was that Mr Seguela, and through him Technip, was reckless. In support of this contention Technip argues that Mr Seguela's evidence as to his state of mind was unchallenged and, because the appellant relied on inferential reasoning to establish recklessness, the unchallenged evidence must give rise to a reasonable doubt.

Technip's senior counsel disclaimed reliance on the rule in Browne v Dunn, or principles of fairness or any requirement for a 'ritualistic putting' of propositions contradicting Mr Seguela's evidence. Senior counsel instead relied on the fact that the reasoning process that lay behind the ultimate submission that Mr Seguela's evidence should not be accepted was not put to him. In this respect there was a degree of ambivalence in Technip's senior counsel's disclaimer of reliance on the rule in Browne v Dunn as he argued that the proposition underlying the appellant's case was that Mr Seguela's evidence was not genuine and that this called for a 'direct frontal challenge on the honesty of Mr Seguela which did not occur'. In any event, Technip contended, as a consequence of the approach taken, the magistrate was deprived of the opportunity to make an assessment of Mr Seguela's honesty or genuineness.

Technip's senior counsel emphasised that the evidence of Mr Seguela's state of mind should not be assessed in isolation. He stressed the state of mind evidence should be considered in the context, first of Mr Seguela's evidence that the change to the safety management system came about as a result of discussions involving senior management and divers on board the Wellservicer - those directly affected by the change - and out of a concern about the risk of damaging the LSP in the course of transferring it from the North Sea Atlantic to the Mermaid Supporter. And, second, in the context of Mr Seguela's evidence about the safeguards in place that meant that the risk of an operational failure of the SPHL was extremely low. (footnotes omitted)

78 The judge summarised the CDPP's arguments as follows:

(a) MAE 15 was part of the Safety Case and the control required to mitigate the risk was for the hyperbaric support vessel with the LSP to be in the vicinity of the SPHL. Technip knew the only real control to save the divers if MAE 15 occurred was to connect the SPHL to the LSP from a hyperbaric support vessel capable of providing immediate assistance. This was the control the Safety Case specified, and Technip knew this control represented the form in which the Safety Case had been approved by NOPSEMA. In short, the change abandoned the control required to mitigate the risk of MAE 15.

(b) The change purported to have been effected by the Site Change Request Form was based on an assumption that MAE 15 would not occur and that assumption was contrary to the Safety Case.

(c) Technip, through Mr Seguela, must have known the proposed change to the Safety Case, which removed the mitigation control for MAE 15, was a significant one requiring a revision to be submitted to NOPSEMA.

(d) Technip knew, and intended, diving was to take place during a period where the North Sea Atlantic, and the LSP, were not in the vicinity of the divers.

79 Based on the reasoning outlined in the preceding paragraph the CDPP contended it was open to the magistrate to conclude that:

(a) Technip actually knew work would be performed contrary to the Safety Case; or alternatively

(b) Technip was aware of a substantial risk that work would be performed in a manner contrary to the Safety Case, and that it was unjustifiable for Technip to take that risk; and

(c) Mr Seguela's denials of awareness of such a risk should be rejected.

80 After summarising Mr Seguela's evidence, the judge concluded that it was reasonably open to the magistrate to find that Technip was reckless.[41] The judge referred to four matters which, taken in combination, contributed to that conclusion.

81 First, the judge referred to the following aspects of Mr Seguela's evidence and the objective circumstances that might have persuaded the magistrate that he should not have accepted Mr Seguela's evidence as to his state of mind:

(a) In effect, the magistrate found that Mr Seguela's subjective belief was substantially inconsistent with the objective facts as found by him, in that the magistrate found that the Site Change Request Form significantly changed the safety management system.

(b) Given that Mr Seguela's evidence was given three years after the relevant time, the magistrate was entitled to take into account 'the limitations of human memory and how subconscious reconstruction can affect recollection'.[42]

(c) It was open to the magistrate to take into account that the majority of questions asked in evidence‑in‑chief concerning Mr Seguela's state of mind were in the nature of 'Dorothy Dixers'.[43]

82 Secondly, in light of those matters, the judge observed that it was not necessary for the magistrate to have formed the view that Mr Seguela was untruthful in his evidence concerning his state of mind in order not to accept that evidence.

83 Thirdly, the fact that Mr Seguela's evidence as to his state of mind was not directly challenged did not require the magistrate to find that the evidence gave rise to a reasonable doubt. The judge observed that a robust challenge to the evidence was unlikely to have elicited anything more than short answers reaffirming his evidence‑in‑chief.

84 Fourthly, from the outset of the case it was clear to Technip that its state of mind was in issue. While Mr Seguela's evidence was not challenged by direct contradiction in the course of cross‑examination, in substance his evidence was nevertheless challenged. The judge described the CDPP's trial counsel's approach as undermining Mr Seguela's evidence about his state of mind by (i) drawing a concession from him that the management of change process took away the only control that would have reduced the risk of harm to the divers in the event that the SPHL failed completely and (ii) in effect insinuating that Mr Seguela must have been aware of the substantial risk that diving operations would be undertaken in contravention of the Safety Case.

85 For those reasons, the judge did not accept Technip's contention that an acquittal was inevitable and made orders allowing the appeal and ordering a retrial.

86 Technip's sole ground of appeal challenges the finding of the primary judge that it would have been reasonably open to the magistrate to conclude that Technip was reckless as to whether work was being performed contrary to the Safety Case.

87 Technip contends that, notwithstanding the finding of the primary judge that the magistrate erred in law in misdirecting himself as to the element of recklessness, it was not open to the magistrate to reject Mr Seguela's evidence. Therefore, Technip submits, an acquittal was inevitable because, in accordance with the Criminal Appeals Act 2004 (WA) s 14(2) and s 14(3), either no substantial miscarriage of justice was occasioned[44] or the evidence in substance supported the decision to acquit[45].

88 Technip challenges the finding of the primary judge that it was reasonably open to the magistrate to find that Technip was reckless and therefore that an acquittal was not inevitable.[46] It submits that it was not open to the magistrate to conclude that there was no reasonable possibility that Mr Seguela's evidence as to his state of mind was honest and reliable.[47]

89 In summary, in support of this proposition, Technip submits that:

(1) Mr Seguela gave direct oral evidence that he believed that there was no risk that Technip would be acting contrary to the Safety Case.[48]

(2) There was no challenge, at least no direct challenge, to that evidence in cross‑examination.[49]

(3) There was no evidence, or suggestion in cross‑examination or closing submissions, that Mr Seguela's memory had been affected by the passage of time or had been infected by reconstruction.[50]

(4) There was no basis on which to otherwise conclude that Mr Seguela's evidence was unreliable - 'certainly' not so as to be capable of rationally excluding the reasonable possibility that his evidence was reliable.[51]

(5) Documentary evidence, not referred to by the judge, supported Mr Seguela's evidence as to his state of mind.[52]

90 Technip supports its argument by addressing the four matters referred to by the primary judge as being matters which led to his Honour's conclusion.

Mr Seguela's evidence and the objective circumstances

91 Technip submits that, contrary to the observations of the primary judge, Mr Seguela's evidence as to his state of mind was not inconsistent with the objective circumstances of the effect of the change in the Site Change Request Form.[53] This is because, Technip submits, Mr Seguela believed that the Site Change Request Form effected a valid change to the Safety Case, and therefore he believed that Technip was acting in accordance with the Safety Case. Even if there were an inconsistency between Mr Seguela's evidence and the objective circumstances, it would need to be such that it required a finding that there was no reasonable possibility that his evidence was honest and reliable in order to find that Technip was reckless.[54]

92 Technip next addresses the primary judge's remarks that the magistrate would have been able to take into account the limitations of human memory and subconscious reconstruction in assessing the weight to be given to Mr Seguela's evidence. Technip submits that there was no evidence to this effect, and that it would have been unfair to Mr Seguela if the magistrate had taken this into account, as he had not had the opportunity to respond to the suggestion that his memory had been affected by the passage of time, as well as being unfair to Technip in not being able to make submissions about the issue at trial.[55]

93 Technip submits that the nature of the questioning in examination-in-chief as to Mr Seguela's state of mind, characterised by the primary judge as being primarily closed questions, could not affect the weight to be given to his evidence.[56]

94 Technip also refers to other evidence that supported Mr Seguela's evidence as to his state of mind, which was not referred to by the primary judge. This includes evidence:[57]

(1) that the Site Change Request Form was completed in accordance with the management of change procedures in the Safety Case;

(2) that after the offence Mr Seguela indicated that he believed that the change in the Site Change Request Form reduced risk; and

(3) that there were options in the Safety Case available to Technip in circumstances where the North Sea Atlantic was required to leave the field of diving operations.

Unnecessary to form view that Mr Seguela was dishonest

95 Technip refers to the primary judge's reference, at par 99(c), to the prosecution's argument that Mr Seguela 'must have' known that the change proposed by the Site Change Request Form was significant, thereby requiring approval from NOPSEMA. Technip submits that, given Mr Seguela's honesty is not, and was not, challenged by the CDPP, it is difficult to see how the magistrate could have rationally concluded that despite his evidence as to his state of mind, he nevertheless must have had the necessary knowledge.[58]

96 Technip submits that the CDPP's approach not to directly challenge Mr Seguela as to his state of mind was not, as a matter of logic, capable of contributing to the primary judge's conclusion that the finding of recklessness was reasonably open to the magistrate.[59]

97 Technip refers to the primary judge's finding that Mr Seguela's evidence as to his state of mind was challenged through the CDPP insinuating that, given his concession regarding the mitigation control for MAE 15 being removed by the Site Change Request Form, he 'must have been aware' of a substantial risk that Technip was not complying with its Safety Case. Technip submits that, in circumstances where Mr Seguela's honesty was not challenged, and there was no evidence that his evidence was unreliable and no other reason to so conclude, the magistrate could not properly have rejected Mr Seguela's evidence as to his state of mind and accepted that the only rational inference open was that he, and therefore Technip, was reckless.[60]

98 The CDPP's position is that Technip cannot demonstrate that the judge erred in finding that an acquittal was not inevitable, and therefore cannot rely on s 14(2) of the Criminal Appeals Act.

99 The CDPP argues that the cross-examination of Mr Seguela, and the evidence and the prosecution's conduct of the case as a whole, supports or leaves open the finding, despite Mr Seguela's evidence to the contrary, that the only rational inference on the evidence was that Mr Seguela was aware of a substantial risk that, while the North Sea Atlantic with the LSP was mobilised out of the vicinity of the Wellservicer, work would be undertaken contrary to the Safety Case.[61]

100 In support of this argument, the CDPP first relies on a number of findings it submits were open to the magistrate to make. It then submits that two conclusions were thereby open to the magistrate, which in turn lead to the conclusion that Technip was reckless.[62]

101 The findings that were open to the magistrate to have made at the conclusion of the evidence include that Mr Seguela, and therefore Technip:

(1) knew the content of the MAEs, having been involved in the production of the Safety Case;[63]

(2) had identified operational failure of the SPHL as a major accident event, requiring the mitigation of risk to as low as reasonably practicable;[64]

(3) knew the risk of MAE 15 occurring was low, but the consequences were potentially catastrophic, involving multiple loss of divers' lives;[65]

(4) knew that connecting the LSP to the SPHL from a HSV capable of providing immediate assistance was the only mitigation control if MAE 15 occurred;[66]

(5) knew that this was the control specified in the Safety Case and the control represented the form in which the Safety Case had been approved;[67]

(6) knew that Technip made a commitment in the Safety Case to having a HSV with a LSP on board able to provide immediate assistance as a mitigation control for MAE 15;[68]

(7) given that the Hyperbaric Evacuation Plan provided for the transfer of the LSP to the Mermaid Supporter, Mr Seguela was aware that the Safety Case required a HSV with a LSP to be in the vicinity of the Wellservicer at all times;[69]

(8) it must have been apparent to Mr Seguela that the Site Change Request Form abandoned this commitment in the Safety Case;[70] and

(9) the assumption underlying the Site Change Request Form was that MAE 15 would not occur,[71] and this assumption was contrary to the Safety Case at all times. While there remained a possibility that MAE 15 could occur, the control required by the Safety Case to mitigate the risk was for the HSV with the LSP to be in the vicinity of the Wellservicer to provide immediate assistance.

102 The CDPP submits that given that these findings were open to the magistrate, his Honour could have concluded that Mr Seguela must have known, or been aware of a substantial risk, that to remove the only mitigation control for MAE 15 represented a significant increase in the risk to personnel in the event that there was a complete failure in the SPHL's operational systems.[72]

103 The CDPP submits that given this conclusion was open to the magistrate, it would have been open to the magistrate to also conclude that Mr Seguela knew, or was reckless as to the fact, that the Management of Change process could not be relied on to authorise the change.[73]

104 The CDPP says that these two conclusions could have allowed the magistrate to conclude, beyond reasonable doubt, that Mr Seguela, and therefore Technip, knew, or was reckless as to the fact, that work was being performed contrary to the Safety Case.[74]

105 The day after the court had reserved its decision, the court requested further oral submissions from the parties, primarily from the CDPP, on various factual and evidentiary matters that had not been the subject of submissions. The further submissions were provided in a hearing on 30 July 2021. We will refer to those submissions in explaining our disposition of the appeal.

106 In light of the competing submissions, set out above, we will outline Mr Seguela's evidence in some detail.

107 Mr Seguela's evidence-in-chief included the following:

(a) He had a high level of involvement in the production of the safety case.[75]

(b) In the event of the SPHL's primary generator failing, it had a backup generator, called a 'Whisper Generator', which would provide essential services to the divers. The SPHL also had batteries in case the backup generator failed, which would also provide essential services to the divers. Neither the backup generator nor the batteries could support the SPHL being propelled.[76] The SPHL could provide life support for 72 hours without outside assistance.

(c) The chance of MAE 15 occurring was statistically assessed by Technip as being 'very low'.[77]

(d) He was aware that the Safety Case stated that a key mitigation for MAE 15 was the Hyperbaric Evacuation Plan.[78] The Safety Case Response Note specifically referred to and incorporated the Hyperbaric Evacuation Plan.[79] The purpose of the plan was to detail the procedures to be followed by Technip in the event of an emergency requiring the launch of the SPHL from the Wellservicer.[80]

(e) He was aware that the 'base case' for hyperbaric evacuation was for the SPHL to be lifted onto a cradle on the back deck of the HSV.[81] He said that his understanding of the term 'base case' was that 'we would have time to do that if we can' and that it also means that 'we've got other options ... available to us'.[82] In the response note submitted by Technip to NOPSEMA to amend the Safety Case, the Hyperbaric Evacuation Plan was clarified to include in the base case the other options of the SPHL being towed or escorted by the HSV.[83] He explained that the response note provided that, once the SPHL was out of the water, the LSP would be connected because, without the LSP, it would not be possible to provide the essential life support services to the divers.[84]

(f) The term HSV refers to 'a vessel that needs to be in the vicinity to support in case of an hyperbaric evacuation' and that it can be 'any vessel that can support'.[85]

(g) In providing for the LSP to provide backup power for the SPHL, the Hyperbaric Evacuation Plan was referring to further backup, given the layers of power backup in the SPHL itself (see (b) above). He was aware that the Hyperbaric Evacuation Plan stated that the LSP shall be placed on the HSV at all times.[86] If the primary HSV needed to leave the field during diving operations, then an in-field tug would act as the HSV.[87] This would involve transferring the LSP from the primary HSV to the in-field tug.[88] In providing that there should be no more than four hours transit time, the Hyperbaric Evacuation Plan was inconsistent with the statement in the Safety Case Response Note that the transit time would be two hours where practicable, and should have provided for two hours.[89]

(h) The Hyperbaric Evacuation Plan stated that where the HSV was equipped with a suitable crane, such as the North Sea Atlantic, the SPHL would be lifted onto the deck of the HSV where practicable, where the LSP would be connected to the SPHL.[90] If the sea state did not allow the SPHL to be lifted, the SPHL would travel on its own power or be towed to sheltered waters where it would be lifted onto the HSV. Where the HSV was not fitted with a crane, the SPHL would also travel on its own power or be towed to sheltered waters.[91] Mr Seguela gave evidence that under the second and third options above, it was not envisaged that the LSP would be connected to the SPHL because it was not envisaged that it would be connected while the SPHL was in the water, until the SPHL was in sheltered waters.[92] He stated that the SPHL 'has got so many backups' that it would be 'very, very unlikely that we would need the LSP in those circumstances'.[93]

108 Mr Seguela explained the background to the Site Change Request Form as follows:

(a) After it became apparent on 18 November 2015 that the North Sea Atlantic would need to leave the diving area and the Mermaid Supporter would become the HSV, there was a discussion on board the Wellservicer about the 'unnecessary risk' of damaging the LSP in transferring it from the North Sea Atlantic to the Mermaid Supporter, given that, since the Mermaid Supporter did not have a crane, there would be 'no need' for the LSP.[94] Damaging the LSP could mean it was no longer available for use as a backup.[95] Mr Seguela said that there was also a discussion about a further risk of damage to the LSP in transferring it again as, if the Mermaid Supporter had the LSP on board, it would still be preferable for the North Sea Atlantic to meet the Mermaid Supporter and the SPHL in sheltered waters and then transfer the LSP back onto the North Sea Atlantic, so that the SPHL could be lifted onto the deck of the North Sea Atlantic and connected to the LSP.[96]

(b) The discussions resulted in the production of the Site Change Request Form on 19 November 2015.[97] The Site Change Request Form was a document that detailed and explained the change to the approved Hyperbaric Evacuation Plan.[98] The Site Change Request Form was approved by 21 people, including Mr Seguela, who was the most senior officer of Technip who signed the form, and all the divers on board the Wellservicer.[99]

(c) It was appropriate to use the management of change process, which was referred to in the Safety Case, in the way in which it was proposed.[100]

(d) The Site Change Request Form stated that given the risk of damaging the LSP in transferring it to and from the Mermaid Supporter, where the North Sea Atlantic was required to leave the field, the solution that had the least risk overall, termed the ALARP solution, was to keep the LSP on the North Sea Atlantic with the Mermaid Supporter remaining in the field of diving operations without the LSP.[101]

(e) In the Site Change Request Form, the risk assessment of 'low' was ticked and in the categorisation of change 'major' was ticked.[102] In the categorisation of change the highest level of 'critical' was to be selected if there was the potential for contravening laws or regulations and it was not ticked.[103]

109 Mr Seguela then gave the following evidence:[104]

All right. Now, having signed off on that form, did you believe that Technip was doing anything wrong?‑‑‑No.

Did you believe that Technip was breaching its Safety Case?‑‑‑No.

What did you think about the Safety Case in relation to the management of change procedure?‑‑‑I thought the Safety Case was the overarching document and we were working within our safety management system which was detailed in the Safety Case and we were just making a change to the hyperbaric evacuation plan document and we were capturing that change and making sure the risk was assessed - the risk of the change was assessed.

Well, did you think there was any risk that if Technip continued to allow saturation diving occurring from the Wellservicer that - sorry, did you think there was any risk that if Technip allowed the divers to continue saturation diving while the NSA was in Dampier with the LSP, that Technip would be doing work in a manner that was contrary to the Safety Case?‑‑‑No.

Why?‑‑‑Because we working within our safety management system, our procedure. We did follow them and we were still working under the umbrella of the Safety Case which included those management - that management system and those tools we had to be able to implement some changes when those changes didn't increase the level of risk. It was the opposite. We were actually reducing the risks.

So by signing off on the form you knew that the diving would continue?‑‑‑Yes.

And you did not think or were not aware of any risk that if that were to continue that Technip would be acting in some way contrary to its Safety Case?‑‑‑No.

Would you have signed the exhibit 10, the site change request form, if you had thought that there was a risk that Technip would then be in breach of its Safety Case?‑‑‑No, I wouldn't have signed if the - if I had thought there was any risk by that.

110 On 26 November 2015, Mr Seguela and others met with members of NOPSEMA at Technip's offices, during the course of which the subject of the Site Change Request Form came up.[105] The next day on 27 November 2015, Mr Seguela sent a copy of the Site Change Request Form to Mr Barnes, a representative of NOPSEMA, and provided some explanation for the management of change process. Mr Seguela stated that the North Sea Atlantic would be mobilised away from the area of diving operations for less than two per cent of the total duration which Technip was going to conduct diving activities.[106]

111 Mr Seguela's evidence in cross‑examination included the following:

(a) A risk can be a MAE even if its risk of occurring is low due to the serious consequences if it eventuated.[107] For MAEs, controls are put in place to reduce the risk to as low as reasonably practicable.[108] The Safety Case identified MAE 15 as the failure of the SPHL. It contemplated a variety of causes of such failure, including mechanical, adverse weather or operator error.[109]

(b) If the life support systems and secondary power and battery backup systems on board the SPHL failed, then the only effective remedy to prevent loss of life would be to connect the SPHL to the LSP on board the HSV.[110] Mr Seguela accepted that while the risk of this occurring may be low, it nevertheless could occur.[111] In that scenario, the mitigation control in the Safety Case was to have a LSP in close proximity to the SPHL.[112]

(c) Mr Seguela accepted that the Site Change Request Form did not address MAE 15 and the circumstances where there was a complete failure of the systems on board the SPHL.[113] He accepted that the changes in the Site Change Request Form relied on the SPHL being able to provide the necessary gases and the heating and cooling to support the divers.[114] He stated that this '[had] been considered in the Site Change Request Form'.[115]

(d) Mr Seguela accepted that another option would have been to have a LSP on both the tug Mermaid Supporter and the North Sea Atlantic.[116]

(e) Mr Seguela stated that the 'primary concern' and the 'real risk' that was foreseen was not the complete failure of the SPHL's systems but the failure of the primary generator, which would result in the SPHL not being able to propel itself to a sheltered location.[117]

(f) He accepted that the proposal, in the event that the primary generator failed, that the Mermaid Supporter assist the SPHL in getting to sheltered waters, depended on the SPHL's systems being able to provide the necessary gasses and heating and cooling to the divers.[118] He also accepted that the Safety Case was the only document that specifically dealt with the scenario that the SPHL is completely inoperable.[119]

(g) When it was put to Mr Seguela that the Site Change Request Form removed the mitigation control for complete failure of the SPHL's systems, he, in effect, accepted this, but said that the change 'mitigated another risk', namely, the risks associated with transferring the LSP between vessels.[120]

(h) The LSP could only be connected to the SPHL out of the water.[121] Given this, the Site Change Request Form's change to the Hyperbaric Evacuation Plan, in the event of the SPHL's engine failing, was for the Mermaid Supporter to escort the SPHL to sheltered waters, where the North Sea Atlantic could lift the vessel on board to connect it to the LSP.[122]

(i) When asked about the purpose of transferring the LSP from the North Sea Atlantic to the Mermaid Supporter as being a mitigation control in the event of complete failure of the SPHL, Mr Seguela answered that 'that was not the reasoning' and that both Technip and NOPSEMA contemplated that the LSP was only 'really required' if the SPHL was lifted out of the water. In answer to a similar question about transferring the LSP, he stated that 'the reason for the LSP was really for the case of the SPHL being lifted out of the water'.[123] In re-examination, Mr Seguela said that if there was a complete systems failure of the SPHL and it was in the water 'you would attempt to connect it in the water anyway'.[124]

(j) When asked why, in the Hyperbaric Evacuation Plan, the LSP was to be moved from the North Sea Atlantic to the Mermaid Supporter, Mr Seguela answered 'because that was a commitment from the safety case. And we were trying to - we are complying with the safety case'.[125]

The proviso under s 14(2) of the Criminal Appeals Act

112 Technip relies upon the proviso under s 14 of the Criminal Appeals Act. We begin with an outline of principles relevant to the application of that provision.

113 In The State of Western Australia v Le,[126] Buss P (with whom Mazza JA & Hall J agreed) enunciated some fundamental propositions concerning the proviso under s 33(2a) of the Criminal Appeals Act, which applies to a prosecution appeal against an acquittal of an indictable offence. Those propositions apply with equal force to the proviso under s 14(2). Transposed into that latter context, they are as follows:

(1) This court must determine whether to apply the proviso on the basis of the statutory language and not on the basis of other formulated rules or tests or by reference to secondary materials.

(2) This court must itself decide whether a substantial miscarriage of justice has occurred.

(3) That task is objective in character and, subject to the court's powers to admit additional evidence, is to be undertaken by reference to the trial record.

(4) No single universal description of what constitutes no substantial miscarriage of justice can be articulated.

114 In Wark v The State of Western Australia,[127] Beech JA outlined some principles applicable when applying the proviso under s 30(4) of the Criminal Appeals Act as follows:

(1) The appellate court must undertake an independent assessment of the whole of the record of the trial. That examination requires account to be taken of the guilty verdict.

(2) It is a necessary, although not sufficient, condition of the application of the proviso that the appellate court is persuaded that the evidence properly admitted at trial proved the accused's guilt beyond reasonable doubt. That is because the conviction of a person whose guilt has not been proved beyond reasonable doubt will always be a substantial miscarriage of justice.

(3) Consideration of the application of the proviso requires identification of, and consideration of the nature and effect of, the error(s) made at trial. Some errors will prevent the appellate court from being able to assess whether guilt was proved beyond reasonable doubt.

(4) There are natural limitations on the appellate court's ability to determine, based on the record, whether guilt was proved beyond reasonable doubt, particularly in cases in which the credibility of witnesses is of importance. In such cases, because the appellate court has not seen and heard the witnesses give their evidence, the court may be precluded from concluding that guilt was proved beyond reasonable doubt.

(5) In some cases, the appellate court may rely on the guilty verdict in a manner that enables those limitations to be overcome. However, the appellate court will not be able to rely on the verdict where the verdict may have been affected by the error(s).

(6) In some extreme cases, which are likely to be rare, the appellate court may be able to rely on its own conclusion, based on the record, that oral evidence contrary to the prosecution case is obviously false. ...

(7) Some errors are so fundamental or breach the fundamental presuppositions of the trial so as to be beyond the reach of the proviso regardless of whether, in the eyes of the appellate court, the evidence at trial proved guilt beyond reasonable doubt. This is not a case of that kind.

115 Wark involved an appeal from a trial by judge alone, so the proviso was to be applied in a context where the trial judge had delivered written reasons for decision.

116 The outline of principles in Wark was applied by this court to the application of the proviso in s 14(2) of the Criminal Appeals Act in an appeal against conviction in Parfenova v Diss.[128]

117 As Mitchell J explained in WAS v Gardin,[129] there are differences in the statutory context of s 14(2) and s 30(4). Among others, we mention the following two. First, the available grounds of appeal from a decision of a court of summary jurisdiction (see s 8 of the Criminal Appeals Act) differ from those under s 30(3), which follow the common form criminal appeal statute. Secondly, s 8 and s 14 encompass appeals against a substantially broader range of decisions than s 30, which only applies to appeals against conviction.

118 It is not necessary to attempt to address the significance of those differences in a comprehensive fashion. As Parfenova v Diss illustrates, the principles summarised in Wark will often be of assistance in applying the proviso in s 14(2) to an appeal against conviction. The same is true, in our opinion, in an appeal against acquittal, although naturally some modification of these principles is required by the fact that the verdict under appeal is an acquittal.

119 As we have said, Technip's central contention is that, on the evidence before the magistrate, an acquittal was inevitable. That contention is, in effect, a contention that, had the magistrate entered a verdict of conviction, the verdict would have been liable to be set aside on the ground that it was unreasonable or could not be supported having regard to the evidence. At the hearing of the appeal, counsel for Technip accepted that this was so. That is consistent with the approach of Hall J in Morgan v Cramer[130].

120 Technip's invocation of the proviso - founded upon its contention that the evidence was incapable of proving guilt beyond reasonable doubt - involves the converse of proposition (2) in the summary in Wark above. In that context, in our view the natural limitations referred to in, and relevant to, propositions (4) ‑ (6) apply with equal force.

121 That is consistent with, and reflects, the approach of an appellate court in evaluating whether a verdict is unreasonable and cannot be supported having regard to the evidence. In that context, the authorities emphasise the importance of giving full weight to the consideration that a trial court has the advantage of having seen and heard the witnesses. See, for example, the outline of principles in MEN v The State of Western Australia.[131]

122 A trial court's advantages are not limited to matters going to credibility, but include matters going to the reliability of a witness. See, for example, Lee v Lee;[132] Joyce v Anderson.[133]

123 We turn to the identification of the physical element of the offence alleged to have been committed by Technip. That involves consideration of the proper construction of the Regulations. As already noted, although the physical element is not in issue on appeal, its proper identification informs the substance of what the prosecution had to prove to establish the fault element of the offence.

124 As we have mentioned, the cases at trial and at first instance were framed in terms of whether the Site Change Request Form effected a valid change to the Safety Case. This was seen to depend on whether the change proposed constituted a 'significant change' to the safety management system. Consistently with the parties' cases, the primary judge resolved the issue by reference to whether it was open to the magistrate to find that the Site Change Request Form 'significantly changed' the safety management system.

125 Thus, in the proceedings to date, the courts and parties have proceeded on the premise that a safety case may be altered without submitting the revised safety case to NOPSEMA by changing the safety management system in a manner which is not 'significant'.

126 As we construe the Regulations, this premise is, with respect, not correct. A safety case, as defined in reg 1.5, is a document which has been submitted to NOPSEMA. A safety case is only 'in force' within the meaning of reg 1.5 if it has been accepted by NOPSEMA and the acceptance has not been withdrawn. So understood, this concept of a safety case is inconsistent with the capacity of an operator to amend a safety case without (i) submitting a revised safety case to NOPSEMA and (ii) having that revised safety case accepted by NOPSEMA.

127 The safety management system for a facility must be described in, but is distinct from, a safety case. Regulation 2.30(1)(d) requires the operator of a facility to submit a revised safety case to NOPSEMA where it proposes to significantly change the safety management system. This provision creates an obligation to submit a revised safety case. It does not authorise an operator to change a safety case without submitting a revised safety case to NOPSEMA.

128 The primary judge found that the Site Change Request Form was never submitted to NOPSEMA. Therefore, the Site Change Request Form could not have effected a change to the Safety Case.

129 In this case, the vessel the Wellservicer was the facility operated by Technip. The safety case submitted for the facility required the HSV, carrying a LSP, to be in the vicinity of the Wellservicer at all times during diving operations, so it could support the SPHL in the event of an evacuation.

130 It was common ground that the North Sea Atlantic, on which the LSP was commissioned, was not in the vicinity of the Wellservicer during diving operations in November 2015 and the Mermaid Supporter did not have a LSP.

131 On that basis work (diving operations) on the facility (the Wellservicer) was conducted other than in accordance with the safety case in force for the facility, unless the change to the safety management system effected by the Site Change Request Form was contemplated and authorised by the Safety Case.

132 If, as here, a safety case, as submitted to and approved by NOPSEMA, contemplates and authorises changes to the safety management system described in it in certain circumstances or under certain conditions, and if the safety management system is so changed, in acting in accordance with the changed safety management system the operator is not conducting diving other than in accordance with the safety case.

133 Section 16 of the Safety Case referred to a 'management of change' procedure by which changes could be authorised. The express objective of the management of change process was 'to ensure that additional risks are not introduced by changes which could increase the risk of harm to personnel onboard'.

134 It is not in contest in the appeal that the physical element - a circumstance - was proven. This involves an implicit acceptance, for the purposes of this appeal, that the change to the safety management system effected by the Site Charge Request Form (which we will refer to as the Change) was not a change authorised or contemplated by section 16 of the Safety Case. Counsel for Technip accepted that this was so.[134] Therefore, the diving operations carried out in November 2015 when an HSV with the LSP was not in the vicinity of the Wellservicer, involved doing work at the facility in a manner that was contrary to the Safety Case in force for the facility. That is on the basis that work was conducted other than in accordance with the safety management system described in the Safety Case when that system had not been changed in a manner authorised or contemplated by the Safety Case.

135 Nevertheless, analysis of the evidence as to what, precisely, the Change entailed - involving comparison of the position before the Change with the position after it - is of assistance in informing whether the prosecution proved the fault element beyond reasonable doubt. That is because such analysis sheds light on the objective facts and circumstances against which Mr Seguela's evidence as to his subjective understanding and belief as to the Change is to be evaluated, and from which the prosecution invited the court to draw inferences as to his intention and awareness.

136 As already explained, the relevant physical element of the charge - whether diving was conducted in a manner that was contrary to the Safety Case - directs attention to whether the Change was authorised by section 16 of part C of the Safety Case. As explained below, the fault element of the charge directs attention to Mr Seguela's belief as to that question. In both cases, a comparison is required between the position before the Change and the position after it. We begin analysis by considering the position before the Change.

137 In a case where hyperbaric evacuation of the divers to the SPHL is necessary, the overarching goal of Technip's safety management system as described in the Safety Case was for the SPHL to be safely moved, with the divers in it, to the Hyperbaric Reception Facility (often referred to as the HRF) at Dampier, where the divers would then be safely and gradually decompressed over several days. To get to the HRF, the SPHL would either be carried on the deck of the HSV, towed by the HSV or proceed under its own power while being supported by the HSV.

138 MAE 15 is concerned with failure of the SPHL. Broadly speaking, failure of the SPHL may affect (i) the SPHL's ability to propel itself or (ii) its hyperbaric protection of and ability to provide life support for the recovered divers. MAE 15 encompasses, but is not limited to, total failure of the SPHL.

139 The Safety Case contemplated that, during saturation diving, there would be a HSV equipped with a LSP in the vicinity. The primary judge highlighted the following features of the Safety Case:

(a) Table 33 as amended - 'Time to muster divers into SPHL launch and recovery SPHL to HSV** I thought the Safety Case was the overarching document and we were working within our safety management system which was detailed in the Safety Case and we were just making a change to the hyperbaric evacuation plan document and we were capturing that change and making sure the risk was assessed - the risk of the change was assessed. (emphasis added)

162 Mr Seguela gave the following explanation as to why he did not think that there was any risk that allowing diving to continue while the North Sea Atlantic was in Dampier would be doing work in a manner that was contrary to the Safety Case:[136]

Because we working within our safety management system, our procedure. We did follow them and we were still working under the umbrella of the Safety Case which included those management - that management system and those tools we had to be able to implement some changes when those changes didn't increase the level of risk. It was the opposite. We were actually reducing the risks. (emphasis added)

163 Mr Seguela's evidence expresses a belief that the change to the safety management system would be authorised by the Safety Case if conducted in accordance with the management of change procedure. It also expresses a belief that the management of change procedure authorised changes which did not increase the level of risk to personnel on the facility.

164 On this evidence, Mr Seguela in effect understood the management of change clause in accordance with the broad construction identified at [155] above. He was not cross examined, at all, as to his evidence concerning his understanding of the clause. There is nothing inherently implausible about that understanding of the clause. In those circumstances, there is no basis for rejecting his unchallenged evidence as to that understanding and it was not op[137]to do so.137

165 On Mr Seguela's understanding, whether the clause authorised the Change depended upon whether the overall effect of the Change was to increase the risk of harm to personnel on board. On that unchallenged understanding of the changes to the safety management system which were authorised by the Safety Case, the fault element cannot be established unless it is proved that Mr Seguela knew that the Change increased the risk of harm to personnel on the Wellservicer or was subjectively aware of a substantial risk that it would do so. The critical issue in the appeal is whether it was open to the magistrate to conclude that the only reasonable inference, on the evidence considered as a whole, was that Mr Seguela had that knowledge or awareness.

166 In our opinion, bearing in mind (i) what is said in [136] ‑ [154] above, and (ii) the objective fact that the Change was unanimously supported by the divers and by the relevant management team, it was not open to infer that Mr Seguela knew that the Change increased the overall risk of harm or that he knew that there was a substantial risk of that being so. In short, the objective facts, which are to be understood in the manner explained at [136] ‑ [154] above, fall well short of providing a sufficient basis for rejecting Mr Seguela's evidence that he believed that the Change reduced the risk to personnel and was authorised by section 16 of the Safety Case.

167 Indeed, the evidence at trial does not satisfy us, on the balance of probabilities, that the Change increased the overall risk of harm to personnel. In so concluding, we give weight to the objective fact that the change was unanimously supported by the divers and by the relevant management team and we adopt the reasoning set out in [136] ‑ [154] above.

168 It follows from the conclusions in [165] and [166] above that it was not open to be satisfied beyond reasonable doubt as to the fault element.

169 In the end, only the last step in the above analysis - reflected in [166] - was resisted by the CDPP.

(1) Mr Seguela's acceptance in cross‑examination, in this passage, that the Change did not address the risk of complete failure of the SPHL and that it was assumed that such a risk would not eventuate should be taken as reflecting his understanding and thinking, at the time of the Change, as to the effect of the Change.

(2) The effect of Mr Seguela's evidence was that he did not weigh the relative risks to personnel of the two scenarios, before and after the Change. Rather, in supporting the Change, his only focus was on the risk of damage to the LSP in the course of its transfer from one vessel to another.

171 In support of these submissions, the CDPP points to Mr Seguela's evidence in cross‑examination at ts 194 ‑ 196. For convenience, we set out that evidence in full, together with some preceding evidence to provide context:[139]

Now, these changes in this site change request form, they all assume that the self-propelled hyperbaric lifeboat is operational, don't they?‑‑‑Yes.

They all rely on it to be able to provide the gases and the heating and cooling needed for the divers to survive, doesn't it?---Yes.

And nothing in this site change request form deals with the scenario of if the self-propelled hyperbaric lifeboat is not operating at all, does it?‑‑‑It's something that, no, I wouldn't say so. Because it has been considered in that site change request form. Otherwise the location of the LSP would not be addressed in that instance. So that has been considered in the site change request.

It says in this site change request, in the fourth paragraph:

The SPHL has 72 hours life support onboard.

?---Yes.

Do you see that?---Yes.

I suggest to you that that is the assumption upon which this change document relies?---What I mean is that people knew on the vessel and people were raising that change knew that SPHL has two backup system. So they know that the only - - -

Yes?---Real risk that is foreseen is not so much the risk of not being able to provide the essential services to the divers but if the primary diesel generator fails, that the vessel would not be able to make its own way to a safe haven. And that's why there is always that vessel to be able to provide (indistinct) the SPHL to a shelter location. Because that's the primary concern.

Yes. But that still assumes that the self-propelled hyperbaric lifeboat is able to provide the gases and the heating and cooling to the divers onboard, correct?---Yes. It does, based on the fact that the SPHL is (indistinct) maintain that.

Yes?---Yes.

So whilst there may be a small risk of the lifeboat completely failing, that risk is not addressed in this change, is there?---Not specifically, no.

So the only document that specifically deals with the scenario that the self-propelled hyperbaric lifeboat is completely inoperable is the safety case, correct?---Yes. And the safety case has got - as one of the control has got the hyperbaric evacuation plan as one of the control as well. Yes.

Now, I'm talking about - whilst it might be unlikely. But it's still possible that there is a complete failure of the self-propelled hyperbaric lifeboat's systems to provide the gas and cooling to the divers. In that scenario, the controls to deal with that is to have a life support package on a hyperbaric support vessel in very close proximity to the self-propelled hyperbaric lifeboat, isn't that correct?---Yes. In that scenario, yes.

And it's correct, isn't it, that this management of change document took away those controls to that scenario?---To that scenario. But it mitigated another risk of - what we're missing here is the fact that transferring that life support package from one vessel to the other introduces risks. And at the time as well, to get the life support package commission onto the North Sea Atlantic when we want to recover that SPHL. So we (indistinct) because we had used the lift of the LSP. And we ultimately make sure that we're not adding any other risk of commissioning that LSP again on another vessel. And during that time, we have got potentially divers in a lifeboat waiting.

Yes. But our question was allowing the North Sea Atlantic to go to Dampier with the life support package onboard removed the only controls that would have reasonably reduced the risk of harm to divers onboard the self‑propelled hyperbaric lifeboat in the event that it completely failed. And that's correct, isn't it?---I mean, I would not say it's correct because the controls for the failure of the SPHL are the design of the SPHL itself, the way it's maintained, the way it's designed. They are the controls - the first controls - - -

You're talking - - -?---We have in place. Yes.

You're talking about matters - - -

VANDONGEN, MR: Well, come on. No. The witness should be allowed to finish it because the witness is telling your Honour what controls are in place to deal with the risk that our learned friend is putting to him, which is the failure of the SPHL altogether. So the first control he has mentioned is maintenance and the structure of the hyperbaric lifeboat. He ought to be able to tell you the rest of the controls.

HIS HONOUR: Well, if he's describing the SPHL, he can do that, I guess.

OLIVER, MS: Yes, your Honour. He will finish. I will - - -

HIS HONOUR: Yes. So you - - -

OLIVER, MS: If you want to finish - - -?---Yes. So, I mean - - -

- - - your answer?---I was saying the controls are the design of the SPHL itself, then the - which includes those backup systems to be able to take over in case of a failure of one system, and to provide the essential services. The fact that we've got regular maintenance of the system and the fact that we make sure that there is still a vessel nearby that is able to provide (indistinct) or tow the SPHL to a sheltered location or to port, which was the case with that change.

Are the things that you've spoken about then - so the program for servicing and the like, those are steps designed to prevent, perhaps, a major accident emergency occurring. I'm talking about controls in the event that the major accident event does occur. And in that scenario, it's the case, isn't it, that the controls are to have a life support package on a hyperbaric support vessel in very close proximity to the hyperbaric - the self-propelled hyperbaric lifeboat?---If you look at the mitigation you have in case of complete failure of the entire system, yes.

Yes?---You have.

172 We do not accept the CDPP's submissions summarised in [170] above.

173 We begin with the first submission. Mr Seguela's evidence must be understood as a whole and in light of the objective facts as outlined in [136] ‑ [154] above. When that is done, insofar as Mr Seguela accepted that the system in place after the Change did not adequately mitigate against the risk of a complete failure of the SPHL, the effect of his evidence was that the same was true of the system before the Change in the scenario where the HSV was a tug. At the least, Mr Seguela did not give evidence that, before the Change, he understood or believed that the system adequately mitigated the risk of total failure of the SPHL in that scenario. For the reasons given in [136] ‑ [154] above, the evidence led by the prosecution did not establish that as a fact.

174 In any event, we do not accept the CDPP's second submission. The only reasonable conclusion from Mr Seguela's evidence as a whole, in the context of the objectively established facts and circumstances, is that he supported the Change because, having considered its effect on risk to the relevant personnel, namely the divers, he considered that the Change reduced the overall risk. That is the effect of Mr Seguela's detailed evidence in explaining the Site Change Request Form.[140] Further, in the passages extracted at [161] and [162] above, Mr Seguela said, in terms, that he, and others, assessed the risk and concluded that the Change did not increase the level of risk. That is consistent with, and supported by, the terms of the Site Change Request Form itself. After referring to a risk to personnel and to equipment, the form identified the reason for the change as being that, after review, those involved in the project considered that the Change produced a safer outcome for personnel, equipment and overall operation or conditions, resulting in an improvement in the ALARP outcome. As already noted, the 'ALARP outcome' is a shorthand reference to the requirement to reduce the risks to the health and safety of persons at or near the facility to a level that is 'as low as reasonably practicable'. Thus, an evaluation of risk to personnel was at the heart of what, on the face of the Site Change Request Form, led to the proposal for, and adoption of, the Change.

175 Moreover, even the passage upon which the CDPP relied indicates that Mr Seguela's thinking was not focused solely on the risk of damage to the LSP. In explaining the Change, Mr Seguela said that the Change was to 'ultimately make sure that we're not adding any other risk of commissioning that LSP again on another vessel. And during that time, we have got potentially divers in a lifeboat waiting'.[141] Consistently with all the features of his evidence referred to in [174] above, this shows that Mr Seguela was considering risks to personnel in deciding to support the Change.

176 For these reasons, in our view, it was not open to infer that Mr Seguela knew that the Change increased the overall risk of harm to personnel or that he was aware of a substantial risk that it would do so. In the circumstances of this case it was therefore not open to infer that Mr Seguela, and therefore Technip, knew that the Change was not authorised by the Safety Case, or was aware of a substantial risk that the Change was not authorised by the Safety Case. Consequently, it was not open to the magistrate to be satisfied beyond reasonable doubt that Technip either knew that work would be conducted contrary to the Safety Case or was aware of a substantial risk that this would be so. The evidence therefore required the magistrate to have a reasonable doubt as to the relevant fault element. It follows that there was no substantial miscarriage of justice in the magistrate's decision to acquit, notwithstanding his Honour's erroneous reasoning in so deciding. Thus, the appeal to this court must be upheld.

177 For the above reasons, the appeal must be upheld and the primary judge's order for a retrial set aside.

(3) The orders of the primary judge made 29 June 2020 are set aside and, in substitution, the following orders made:

I certify that the preceding paragraph(s) comprise the reasons for decision of the Supreme Court of Western Australia.

[1] Commonwealth Director of Public Prosecutions v Technip Oceania Pty Ltd [2020] WASC 242 (primary reasons).

[2] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.5(1).

[3] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.5(2).

[4] The acronym ALARP is used to refer to the concept of 'as low as reasonably practicable'.

[5] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.5(3).

[6]Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[7] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.25.

[8] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.36.

[9] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.44.

[10] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 1.5.

[11] Offshore Petroleum and Greenhouse Gas Storage (Safety) Regulations 2009 (Cth) reg 2.45.

[13] Referred to interchangeably as the Hyperbaric Rescue Vessel - the HRV.

[17] 'HRF' was the acronym for 'Hyperbaric Reception Facility'.

[21] Trial exhibit P3, 201 - 202, incorporating the amendment made by the Safety Case Response Note (exhibit P4, 14).

[34] Commonwealth of Australia v Technip Oceania Pty Ltd (Unreported, Magistrates Court of Western Australia, Case No PE21352/2017, 12 April 2019) [43].

[44] Criminal Appeals Act 2004 (WA) s 14(2).

[45] Criminal Appeals Act 2004 (WA) s 14(3).

[48] Appellant's submissions [10], [22], [27].

[49] Appellant's submissions [22], [43].

[50] Appellant's submissions [11], [31], [46].

[51] Appellant's submissions [36], [45], [46].

[52] Appellant's submissions [37], referring to the Management of Change clause in the Safety Case, exhibit 9, and a passage in the Safety Case Response Note.

[58] Appellant's submissions [39] - [40].

[59] Appellant's submissions [41] - [42].

[60] Appellant's submissions [43] - [46].

[61] Respondent's submissions [41] - [44].

[62] Respondent's submissions [46] - [49].

[70] ts 186, 194 - 196; primary reasons [108].

[126] The State of Western Australia v Le [2017] WASCA 144 [92].

[127] Wark v The State of Western Australia [2020] WASCA 19 [689] (footnotes omitted).

[128] Parfenova v Diss [2021] WASCA 50 [62].

[129] WAS v Gardin [2015] WASC 97; (2015) 48 WAR 494 [219] - [242]. Some aspects of what is there said may be overtaken by the approach in Kalbasi v State of Western Australia [2018] HCA 7; (2018) 264 CLR 62 and other subsequent decisions of the High Court.

[130] Morgan v Cramer [2019] WASC 68 [49] - [50].

[131] MEN v The State of Western Australia [2020] WASCA 118 [403] ‑ [410].

[132] Lee v Lee [2019] HCA 28; (2019) 266 CLR 129 [55].

[133] Joyce v Anderson [2020] WASCA 48; (2020) 91 MVR 334 [205] ‑ [213].

[137] Kuhl v Zurich Financial Services Australia Ltd [2011] HCA 11; (2011) 243 CLR 361 [72] - [75]; RCR Tomlinson Ltd v Russell [2015] WASCA 154 [71].

[140] ts 160 - 162, 171, summarised in [108(a)] and [108(d)] above.