HOW A NEGATIVE SAFETY CULTURE IS DRIVEN FROM THE TOP DOWN 

BY BILL CAMPBELL - FEBRUARY 2015

Undesirable behaviour – how production concerns, versus safety of employees, caused offshore deaths 

The Shell Chairman and his Legal Counsel accepts that the evidence held by police that offshore staff were afraid to raise permits and had been conditioned by onshore managers to ignore safety procedures over a prolonged period is authentic 

This story is about behaviour, bad behaviour.  It is about how offshore workers were bullied, coerced, harassed by onshore management to keep oil and gas production going at all costs and over a prolonged period of time.  It’s about how operators will do what is expected of them if they are put under unreasonable pressure.  It’s about how under these conditions deviation, or bending of rules, leads to breaking rules, and eventually to ignoring rules altogether.  Ignoring rules, despite the consequences, became just the normal way of doing things in the Brent oilfield. 

It was in this hostile environment that two relatively young men with the rest of their life in front of them were asked by their supervisor to have a look see at a temporary repair, a neoprene bandage held down by jubilee clips, that had been placed some weeks earlier to prevent leakage from a hydrocarbon pipe running down into the storage cells from an oil/gas separator vessel.  Just go and sort it out, no permit mind you, if the plant shuts down because you were fiddling with this repair, and the pipe leaked activating the gas alarms, then without the permit with its signatory boxes complete, the bosses on the beach couldn’t identify who to punish.  So for years the use of permits was avoided for this reason. Fear of retribution motivated this almost constant violation of the permit to work system. 

As a consequence of all this on 11^th September 2003, less than 4 years after a major audit had highlighted these concerns, and as predicted in the presentation to the complete leadership team in Aberdeen in October 1999, the inevitable happened.  

In 1999 Directors were made aware that the behaviours verified would lead inevitably to a major accident, it’s just a matter of time, they needed to take action but they failed to do so.  What Managers and Directors had failed to demonstrate, to the 1000’s of staff at risk offshore, was that they had a personal commitment to health and safety.  On 22 October 1999, the author was acting as a Lead Auditor from Shell International in the Hague and told the large audience of the Shell Expro Management team, including the Oil and Gas Directors, that with regards to the Brent General Manager, and his Asset Managers,  they should be suspended, pending an investigation into their unacceptable conduct.  That didn’t happen, Brent Bravo specifically was operating with intolerable risk levels  which undoubtedly contributed to the offshore deaths 4 years later, the surprise is that Shell Expro rode their luck for so long. 

In 1999 in the daily operation of the Brent facilities, the cardinal rule was to do nothing, and attempt nothing, if there was even a faint possibility that production could be interrupted, even if this meant ignoring outstanding tests and inspections on safety critical systems. This was formalised by the notorious Touch F-All policy issued by the Brent Asset Manager which appeared on many of the maintenance procedures for safety critical equipment as the TFA mode.  Equipment on that list was not to be maintained or inspected, because in doing so, the hydrocarbon process may be accidentally tripped. 

With this pervasive negative safety culture, the operators quickly learned that to maintain production despite the consequences was good behaviour; they would be rewarded for that.  But conversely, causing the process to trip was bad, whatever the justification; they would be punished for that.  

What was the root cause of the accident, or what a Fatal Accident Inquiry in Scotland terms the underlying cause? 

The separators level control system was functionally degraded such that it was in a failed state.  So was the downstream emergency shutdown valve which was partially closed to try and retain some semblance of level control on the vessel with its LCV eroded by reservoir sand. The innards of the emergency shutdown and other valves around the process had been sand blasted over the years when the wells were beaned up much too quickly to get the process up and running thus exceeding the critical velocity of the gas which caused carry over of reservoir sands which then flowed flow up the wells to pollute the internals of process equipment.  The separator vessel ESDV was just one of many emergency valves in a similar condition. 

So why were the men asked to repair the leaking bandage?  

It should have been for safety reasons since some weeks earlier the same repair had leaked and gas, not produced water with parts per million of oil, but gas, had been released into the column setting off the gas alarms.  So everyone accountable for operations onshore and offshore knew that the possibility of flooding the column with gas existed. The columns are enclosed spaces; escape is by climbing vertical ladders, taking 10 or 15 minutes to get to safety. 

Prior to the shutdown a permanent repair of the pipe was given the highest priority, but simply ignored, not enough time, so start up took place.  

The public inquiry determined the deceased were asked to repair the leak over concerns about production not safety.  Safety it appears was the last thing to be considered.   A pig was to be launched into the export gas line and if the platform shutdown the pig might get stuck. So the risk assessment prior to the pig launch was entirely focussed not on safety but on maintaining production at all costs. So the instruction was sort out the repair guys, ensure it doesn’t leak during pigging.  So they died because of concerns about production. 

What happened when the bandage leaked? 

When the bandage gave way there were two routes for the gas to go, the as-designed route to the flare but also the illegitimate route directly via a clear pathway into the enclosed space through the hole in the pipe.  The volume entering the enclosed space was estimated, from a mass balance, and as specified at the Inquiry, to be over 6 thousand cubic metres of rich hydrocarbons. In this oxygen starved atmosphere the men died. 

The gas did not ignite, the volume of gas was such that the mixture would have gone through the lowest to the highest explosive limit very quickly, seconds rather than minutes, and a source of ignition was not present during these seconds.    If it had ignited, then you may not be reading this.  No amount of cover-up by Shell and the HSE would have kept all his from public scrutiny.   The instantaneous over pressure from the explosion if it had occurred could have caused severe structural damage at the weak point where the concrete column is mated to the steel cellar deck. 

• If it was methane alone in the 6000 cubic metres that filled the column, and if ignited, it would produce an instantaneous overpressure circa 50 lbs per square inch. But the Brent gas mixture is a homogeneous blend, a mixture of methane with lower quantities of ethanes, propane’s, butanes et al which increases the overpressure limit. 

• There is also the phenomenon know to occur from my coal mine experience called pressure piling, this is simply the pressure wave front travelling up the large area of the column into the smaller cellar deck module.  When this happened in flameproof switchboxes underground the smaller area box still with the 50 lbs per square inch rating is simply blown apart. 

• Methane air mixture is explosive from 4.8% to 15% by volume in air and you may be lucky on the day to get a lean or a rich mixture when it ignited if the overpressure may be reduced because there is a sub optimum mixture at the point of ignition. The point of inflexion when the gas air mixture will produce the maximum overpressure is around 12% from memory. There are other variables like the complexity of equipment layout causing turbulence but the point 

So in looking at this complex subject the Shell scientists at Thornton Research Centre can get a whole range of pressure curves, so it’s difficult to say what the pressure will be on the day, or what it would have been on 11th September if there had been a source of ignition.  But is it theoretically possible that the explosion may cause total or partial collapse. Yes, but there is one installed safeguard. On the deck above the cellar is a large heavy steel lid like the top on a jar connected to the deck with a safety chain, an anchor chain, the sort you see when a vessel is tied up in Aberdeen harbour.  It will lift if unobstructed to relieve pressure in the critical area of the cellar deck.  It acts in principal like a pressure relief valve on the process.

But in 1999 the lid on Brent Bravo was covered by double stacked shipping containers full of Drill equipment, estimated weight 40 tonne.  The tool pusher had nowhere else for it to go, there was so much going on, and stopping was not an option.  This was an everyday occurrence. On Cormorant Alpha there is a similar arrangement, in 1989 after the platform had been shutdown for 4 hours there was a gas explosion in the C4 column, it was thought to be a lean mixture. The lid, a bit like a cork in a champagne bottle but weighing over a ton, was found some 20 feet away with a perfect break in a chain link at the weld. 

But its all back to the underlying cause, undesirable behaviour.  The tool pusher wasn’t behaving badly; he was like any good officer following orders.  He was under great pressure to get on with the job.   

Concerned about this, what effects an explosion may have on the structure Sheriff Harris recommended in his Fatal Accident report that a separate Inquiry be considered on this point alone, but this was ignored.  

What did the Shell post fatalities review completed by November just weeks after the deaths, what did it say about witnessed behaviour? 

Related to competence there was a shortage of competent resource both onshore and offshore.  But that was exactly the finding in 4 years previously. The Inquiry found that hundreds of unapproved temporary repairs, including the repair that initiated the fatal accident, had developed because there was a shortage of competent persons to keep up with the backlog of such repairs. Related to competence and attitude there was a lack of ability of staff in key positions both onshore and offshore to take technical overview of systems for which they had a responsibility. My opinion is that, yes a proportion of it could be claimed to be lack of competence, but to me, it was as much a lack of focus, the eye was certainly not on the safety ball, the operators thought process was how can I avoid getting into hot water with this trip and avoid managers shouting down the telephone trying to find the guilty party. 

When attempting to understand why across the field 1500 or so breaches of safety regulations had developed over the period from the audit in 1999 they concluded that offshore crewmembers were apparently afraid to “FLAG” problems they have with the hardware on their offshore installations and posed the open question why are crewmembers and staff willing to continue to operate with systems in a potentially dangerous condition? Again straight out of the 1999 audit findings 4 years previously, the important word, the word that captures and encapsulates all that is explained in this article, is the word afraid. 

Have the leaders and managers “conditioned” our crewmembers and staff not to challenge? 

With regards to the permit system, the review team found that a key similarity between 1999 and 2003 was violation across the board of the permit system.  The most damming evidence comes in correspondence between the leader of the post fatalities review team, and the author of this article, who in 2005 was retained as a Group Auditor for the Shell upstream Group of Companies. 

For those interested in the public Inquiry report you can observe the Sheriff struggle to understand why the deceased had not used a permit before entering the column. Both counsel for Shell and the HSE, could have helped the Sheriff out over this point, but purposefully withheld the known position from the Sheriff.  The Shell position was clearly understood in that one item that was most certainly a carryover from the 1999 audit was the execution of work under the Operations Umbrella rather than via the permit to work.  This it was stated had become custom and practice. 

To understand that you have to understand the Shell Permit System, world class procedure like the majority of other Shell standards plagiarized by other operators who remove the Shell icon and replace it with theirs.  The Permit system is quite clear, operators are allowed and restricted to doing routine tasks, watch keeping, sampling, monitoring the information on display panels etc, and there are only a small number of operators as a proportion of the offshore population.  Maintenance and inspection staff however carry out non routine work, just think of them like car mechanics, opening things up, repairing, and welding, looking into switchgear, painting you name it all sorts of jobs for which they must have a permit. For them to carry out work without a permit is verboten, and it’s been that way since I went offshore in the 70’s. So why did the deceased enter the column to do work that clearly should require a permit.  Because of the TFA mode, without their signature on the permit the wrath of the onshore managers could not be directed at them. They were a band of brothers, working undercover, since 1999 they had operated like that under what was called the operations umbrella.  Shell knew that, hundreds of the guys offshore knew that, so when the BBC published its articles suggesting the deceased had contributed to their own demise, there was a not so quiet revolution, within days the Production Director Greg Hill had issued an apology.  

So what was the principal opinion of the 1999 audit, the opinion owned by Shell Expro and unanimously agreed to by the Audit Team? 

The 1999 Audit found that quote the sampling process of the organisation has verified that there are significant weaknesses in essential controls. In our opinion the fundamental reason for this is not the absence of structures, systems and processes but rather that inappropriate attitude and behaviour causes non-compliance or deviation from, these control processes.

We believe that the key business drivers and messages from corporate level are fostering undesirable behaviour in some parts of the organisation. 

By corporate level they meant the Managing Director Malcolm Brinded, by some parts of the organisation they meant the Brent Management Team ensconced in Seafield House. 

Bill Campbell

Note:

Parts of this evidence are placed in a Report by the House of Commons select committee related to workplace safety and health in 2007- 8, with reference number HC 246-11