The Shell Chairman accepts that the failure of his Directors to act contributed to offshore deaths in an accident that had the potential of Piper Alpha

Remembering Piper Alpha - how quickly we forget

By Bill Campbell - February 2015

Introduction

The evidence referred to in this article is related to emergency shutdown valves (ESDV) and their associated fire and gas detection systems. The evidence is held by the police and Shell accepts that this data is authentic. Shell has raised no objections to this publication on legal or other grounds.

-----------------------------------------------------------------------------------------------------------

Remembering Piper Alpha

Gas is the great killer and gas explosions specifically cause the significant majority of industrial deaths worldwide. On Piper Alpha human failure in the working of the permit to work system and the proper handover between shifts allowed the nightshift to start a gas compressor whose pipe flanges had not been secured. The gas cloud ignited resulting in a massive explosion. The situation however was recoverable if only the gas supply could have been isolated to restrict the heat energy from the burning gas. The Firewater pumps may for at least a short period have doused somewhat the smoke but the pumps were isolated.

This enormous heat energy quickly weakened the steel structure till it turned plastic and in this state was unable to maintain any load bearing. We have all seen the pictures of that night in July a quarter of a century ago, who can forget them. The gas could not be isolated from the incoming gas riser. Even if the sending end platform some miles away had shutdown its process to stop the gas flow to Piper immediately it would have made little difference. The entrapped volume of gas in the sub-sea pipeline, operating at many times atmospheric pressure, was more than sufficient to destroy the structure, with temperatures of around 2000 degrees Celsius as the gas accelerated unhindered towards the open ended pipe-work at Piper. So it was that a major offshore installation was destroyed in some 22 minutes with the loss of 167 lives.

So ESDV and their maintenance in good repair is vital, that was the appalling lesson from 25 years ago. This was the justification for introduction of prescriptive legislation.

Given this importance and before the Safety Cases were prepared, prescriptive legislation was brought forward to install ESDV on all incoming and outgoing oil and gas risers. So the importance of ESDV, and their maintenance in good order, can not be overemphasised. This was enacted under the Pipelines Safety Regulations supported by the Prevention of Fire and Explosion Regulations. The latter legislation was to ensure, by independent verification, that Fire and Gas detection systems were installed that could cause the automatic activation of ESDV. The law made it an offence to operate with ESDV or fire and gas detection systems that were not in a good state of repair.

But 15 years later the Brent Bravo accident was a potential Piper Alpha because ESDV were inoperable due to neglect

In Sept 2003 two men entered the enclosed column on Brent Bravo to repair a temporary clamp on a pipeline going from the oil and gas process into the massive concrete storage cells. The clamp was not approved and as the public inquiry determined was materially defective. They did not have a permit to work. The clamp failed when they were working on it. But instead of water escaping, water with minute quantities of oil of around 30 parts per million in solution, a massive quantity of gas escaped from the temporary clamp and flooded the enclosed space. It did not ignite, but caused death by creating a hydrocarbon rich and oxygen deficient atmosphere. It did not ignite because the gas escaped in such volumes that the atmosphere would have gone through the explosion range for methane/air mixtures in seconds. During those seconds no ignition source was present. ESDV installed to isolate the gas flow in an emergency failed to operate. In total the inquiry found that some 15 ESDV were known to be defective or degraded including the main riser ESDV prior to the accident.

The gas did not ignite so the potential of a look alike Piper Alpha was avoided, if a spark had been present many more casualties would have resulted as there was significant doubt that the cellar deck, the weak point, the transition zone, where steel meets the concrete column, could have withstood the instantaneous overpressure.

Concerned about this Sheriff Harris at the public inquiry recommended a more general inquiry into the failure of the ESDV on that day and the effects such failures could have had on the installation structure. No such inquiry was held without any explanation of why from the Crown Prosecution Service. The operational top weight (liquid filled vessels) of the huge Bravo was around 50 thousand tonnes and in the worst case scenario it may have fallen into the sea damaging the cellar structure with a capacity to hold 1 million barrels of crude. There were 156 persons on board.

In the prolonged period before the accident HSE were concerned about the follow up to Improvement Notices by Shell across the oilfield. These notices related to a failure to verify that Fire and Gas Detection systems across the field were functioning. A senior inspector at the Offshore Safety Division writes to Shell in October 2001 highlighting some installations had been out of compliance for 18 months or so. So Aberdeen Directors were again warned.

In 2003 failure of a number of ESDV on Brent Bravo contributed to the deaths according to the public Inquiry. In addition, the Brent Bravo riser ESDV was in the same degraded condition that it was found to be in 4 years earlier during a major internal audit.

Clearly, the implementation actions in 1999 were not completed and the behavioural aspects to allow this state of affairs remained unaltered. The inquiry specifically confirmed that the defects on the ESDV were known about prior to the accident, and before the installation started up after a shutdown in August that year.

In November 2003 the Production Director presented information on the status of ESDV across the field to the HSE in Aberdeen. This information was from the post fatalities technical review and is summarised below. The authenticity of this information is not contested by Shell. Despite this the platforms concerned continued in production, HSE officials deliberately failed to raise prohibition or improvement notices, if they had, offshore workers would have become aware of the enormity of the problem. HSE was motivated to cover up their failure to enforce improvement over a prolonged period.

On the Anasuria FPSO there had been repeated ESDV valve failures. The ESDV was purposefully inhibited from operation but production continued. In addition 60 fire and gas detection systems were in a fail to danger condition. In ordinary language this means that there was a significant probability they would not have operated on demand
On Fulmar there were failed ESDV with no follow up identified. In addition 434 fire and gas detection systems were also in a fail to danger condition.
On Brent Charlie ESDV failures were not being corrected when identified. In addition 30 fire and gas detection systems were also in a fail to danger condition.
On Brent Alpha ESDV had failed their leak-off tests but corrective maintenance work orders to rectify had been cancelled. In addition 20 fire and gas detection systems were also in a fail to danger condition
Brent Delta had a failed ESDV but corrective work orders had been cancelled. In addition 35 fire and gas detection systems were also in a fail to danger condition.
On Tern the fact that ESDV were not meeting the required standard was known about by the Asset Manager. In addition 18 fire and gas detection systems were also in a fail to danger condition.
On Gannet there had been repeated ESDV failures but this data had not been recorded. In addition 317 fire and gas detection systems were also in a fail to danger condition.
On Dunlin ESDV tests were being signed off as successful even when failure noted. In addition 6 fire and gas detection systems were also in a fail to danger condition.
On Cormorant Alpha sticking ESDV were identified during tests in 2002 but remedial actions not undertaken. In addition 10 fire and gas detection systems were also in a fail to danger condition.

Not surprisingly, the Shell Internal investigation which reported to the CEO in July 2005 into the conduct of Directors in 1999, found no evidence that the actions to reduce risks in 1999 had ever been undertaken. Rather, the criminal neglect of ESDV maintenance had worsened considerably. To operate knowingly with failed ESDV had become just the normal way of doing things.

On 14 offshore installations there were a total of 1278 unreliable fire and gas detection systems. These were serious breaches of prescriptive legislation enacted as a result of Piper Alpha. This was criminal neglect on an industrial scale.

Even if an ESDV is in good working order, and they seemed to be on some installations, the ESDV will not operate, doing nothing in an emergency, unless it receives a signal from the Fire and Gas detection system. But 1278 such systems, according to Shell data, were unreliable, with the probability that they would not have actuated the installation ESDV on detecting fire or gas.

Bill Campbell

Note

This evidence was placed in a Report by the House of Commons select committee related to workplace safety and health in 2007-8, with reference number HC 246-11