Royal Dutch Shell Plc .com: Shell Brent Scandal: Evidence relevant to the Accident on Brent Bravo not heard by the Sheriff at the Fatal Accident Inquiry: 8 July 2006
Evidence relevant to the Accident on Brent Bravo not heard by the Sheriff at the FAI
The fatalities were caused by a substantial leakage of hydrocarbon gas into the utility shaft. This leakage was from a temporary patch which failed for whatever reason (this will have been determined at the FAI).
The evidence provided to HSE and PF Depute in May and November 2005 was that in September 2003 there was a significant number (33) of temporary repairs on hydrocarbon pipework. A number of these repairs were not approved and others that had been approved were still in place beyond their allocated ‘temporary’ life, which by implication makes them not approved.
Although this information was known to Shell immediately after the fatal accident, - output from a major Technical Integrity Review - it was not disclosed to the HSE who at the same time were conducting their own independent investigation along with the police. This failure to disclose information relevant to a fatality to an inspector would appear to be an offence under the provisions of the H&S at Work Act, Regulation 27.
Because the information was not disclosed in September 2003 it would not have been discussed at the proceedings held at Stonehaven Sheriff Court in April 2005 at which Shell were prosecuted. If it had, it would have opened up the scope both at the prosecution but more importantly in a wider terms of reference at the subsequent FAI.
The evidence by the audit team at this time also highlighted that essential controls in relation to the management of temporary repairs had broken down as early as September 1999. The auditors raised serious concerns about the rise in loss of containment from pipework due to corrosion and erosion causing the thinning of the pipe walls. In order to try and keep up with the rate of degradation on pipework Shell Expro had increased the use and application of temporary repairs as a reactive measure and this essentially had got out of control.
The OIM on Brent Bravo in 1999 was not aware of the number and nature of the temporary repairs on his installation (he was often not involved in the decision making process) and that a number of these repairs were not approved by a technical authority (a person deemed competent to approve such changes in advance of the change taking place, as per Shell Expro’s mandatory change control procedure).
There was no temporary repair list or register on the installation. This was coincidentally true for North Cormorant also it being the other platform sampled on this subject.
More generally, the audit noted concerns reference the lack of competent persons (corrosion engineers) and loss of corrosion and erosion data in Shell Expro. In the field generally their had been a significant down-manning as part of a cost reduction programme.
The Shell Expro Technical Integrity Review team recorded that there was an exponential rise in temporary repairs evident on the 15 Offshore Installations subject to review including Brent Bravo.
On these installations there were some 472 temporary repairs in early September 2003 of which 214 were not approved.
By late September this number rose by another 162 after the Production Director issued an instruction that the Operator’s on the installations ‘walk the lines’ to uncover any unknown temporary repairs. If the Production Director had no given that instruction these repairs may have gone undetected for many years, or until they failed..
A number of the unapproved temporary repairs when put forward to the technical authority for approval were condemned as being unsafe.
The Sheriff would have heard evidence about the specific failures of the specific pipe patch on Brent Bravo. However he would not have been aware that not only had management controls re that specific pipe patch failed but that there was at the time of the fatalities chronic weaknesses and deficiencies in the management of temporary repairs per se on the installation. This situation had persisted since September 1999.
----------------------------------------------------------------------------------------------
September 2003
At the time of the fatal accident a Drains Degasser vessels was being continually operated when its level control valve (LCV) was known by the Operator to be functionally impaired. There was gross leakage past the LCV the consequence of this being that if the liquid level in the vessel falls sufficiently then gas will pass directly into the downstream liquid process increasing the probability of gross loss of containment of gas into the atmosphere as the entrapped gas pressure could exceed maximum allowable working pressure of the pipework designed for liquids only.
On 11th September 2003 this operation as described above (in violation of Shell Expro codes of practice) contributed towards the amount of gas released into the enclosed space where the men were working.
All this would have been fully discussed at the FAI. However unknown to the Sheriff, the operation of hydrocarbon process vessels in this manner on Brent Bravo was not unique to the operation of the Drains Degasser.
September 1999
The auditors verified that the principal test separator vessel was being operated with a leaking LCV. This was not only in contravention of the various design codes but in violation of Shell Expro Codes of Practice for such matters.
This situation was known about and accepted by the Brent Bravo management team from the platform supervisors to the General Manager. The Oil Director of Shell Expro was made aware of this fact on 5th October 1999 and their internal audit team recommended that the test separator (being used continuously to augment production by circa 15%) should be taken out of operation immediately and repaired.
This recommendation was ignored and the vessel continued in operation.
The Shell investigation into the 1999 audit follow-up carried out in 2005 could find no evidence that any action had ever been taken to remove the test separator from service and repair the LCV.
Whilst the Sheriff would have taken evidence about the operation of the Degasser Vessel in a dangerous condition in 2003 he would not have been aware that to operate vessels in this manners had become custom and practice on the installation.
Both in 1999 and 2003 the motivation for operating process vessels in a dangerous condition was to maintain production, and are examples of a culture where production took precedence over safety.
----------------------------------------------------------------------------------------------
Emergency Shutdown Valves (ESDV’s)
At the time of the fatal accident an ESD valve on the HP Flare and Blowdown Vessel failed to operate. The contribution of this to the deaths would have been fully discussed at the FAI.
September 2003
Data from the Technical Integrity Review shows that principal ESD valves had failed their leak-off tests but had been allowed to continue in operation.
In certain cases the results of the tests were purposely falsified. Although this information was known to Shell by September 2003, immediately after the fatal accident, it was not disclosed to the HSE (this coincidentally may have been an offence under the provisions of the H&S at Work Act, Regulation 27). Because the information was not disclosed this evidence could not have been discussed at the proceedings held at Stonehaven Sheriff Court in April 2005 at which Shell were prosecuted.
September 1999
Essential controls in relation to the maintenance and testing of ESDV’s on Brent Bravo and other Brent installations were not in place in 1999.
On Brent Bravo a goal widening regime was observed, where the accepted leak-off requirement for ESDV’s had been increased to 20 times higher than the Company accepted standard with no reference to a technical authority.
The risks of so doing had not been assessed. Specifically on Brent Bravo, the Asset Manager and his Deputy, admitted under interview that the test results of ESDV’s had been falsified in order that the platform remain in production.
For example when the principal gas riser ESD valve failed its test, it was recorded in the equipment history file as ‘no fault found’.
Whilst the Sheriff would have taken evidence about the specific failures of the ESD valve on the HP Flare and Blowdown vessel he would not have been aware that in September 2003 there was chronic weaknesses and deficiencies in the management per se of ESDV’s on Brent Bravo. Co-incidentally, these weaknesses were apparent on all 15 offshore installations operated by Shell.
Both in 1999 and 2003 the motivation for the purposeful falsification of the tests on a number of the ESDV’s was to maintain production, and is another example of a culture where production took precedence over safety.
----------------------------------------------------------------------------------------------
September 2003
A significant failure in management controls at the time of the fatalities was that the men who went to repair the leak on the temporary patch did not raise a permit and entered the leg without full leg entry procedures being used.
This will have been fully covered at the FAI. However output from the major Technical Integrity Review in September 2003 was that the execution of work under the ‘operations umbrella’ instead of via the permit to work system had become ‘custom and practice’.
Although this information was known to Shell immediately after the fatal accident, it was not disclosed to the HSE (this coincidentally may have been an offence under the provisions of the Regulation 27). Because the information was not disclosed this evidence could not have been discussed at the proceedings held at Stonehaven Sheriff Court in April 2005 at which Shell were prosecuted.
As early as September 1999, it was observed that violation and deviation from the PTW was common. Examples of permit violations included not visiting the work-site, and issuing a number of permits simultaneously to one work-site supervisor. Across the Brent Field, Asset teams had markedly different interpretations of what could, or could not be done, within the permit system.
On Brent Bravo a lot of work was being done under operations rules to avoid raising a permit – a permit might after all get knocked back in the Touch F All climate.
Whilst the Sheriff would have taken evidence about the specific failures of permit to work and other procedures directly related to the incident he would not have been made aware that chronic weaknesses and deficiencies in the application of the permit to work system had been reported as early as September 1999. Deviation and violation of the permit system had become normalised behaviour over this prolonged period of time.
September 2003
The Technical Integrity Review team in 2003 made comment on the attitude, skills and behaviours of the offshore and onshore staff as witnessed during the review period.
The following comments are specifically related to Brent Bravo.
Behaviours
Why are offshore crewmembers afraid to flag problems they have with the hardware on the installation - have the leaders and managers ‘conditioned our crewmembers and staff not to challenge? Why are crewmembers and staff willing to continue to operate with systems in known to be in a potentially dangerous condition?
Competence
There is apparently a shortage of competent human resources offshore and onshore and an observed lack of ability of staff in key positions to take a technical overview of systems.
----------------------------------------------------------------------------------------------
At September 1999 a significant concern in the audit findings was the behaviours observed in crewmembers and staff from the technician level offshore to the General Manager onshore. This is all well documented in information passed to the HSE in October 2003, and May and November 2005.
In 1999 Shell Expro appeared in the running of its Brent Assets to have lost any semblance of safety consciousness, in other words, a negative safety culture had developed driven by the need to maintain production against the punitive penalties of the gas nomination contract.
To operate purposefully in breach of the Offshore Installations Safety Case Regulations 1992 had become accepted custom. The behaviours of the staff offshore and onshore to accept this had become normalised.
The auditors first raised concerns about the operation of Brent Bravo before they left the installation on 5th September 1999. In a succession of interviews progressively going up the line through the Deputy Asset Manager, the Asset Manager, the General Manager and on 5th October the Oil Director these concerns were make clearly and without ambiguity. On 22nd October the concerns were raised with the enhanced leadership team of Shell Expro including the Oil and Gas Director.
Despite these concerns being raised, with findings delivered through its formal internal audit process, and reached through consensus and unanimously by its own audit team, Brent Bravo continued to operate in breach of its Safety Case requirements. The Shell investigation findings in 2005 found that there was no evidence that the immediate measures to reduce risks on Brent Bravo were ever undertaken.
Failure to correct this negative safety culture in 1999 allowed such a culture to develop and be sustained. As a direct result of this Brent Bravo throughout that period operated with risk levels in the intolerable region, which led inevitably to the fatalities on September 2003.
At the FAI
I am sure the Sheriff will have heard evidence re the behaviours and beliefs of the staff on Brent Bravo in September 2003 but he will not be aware that these behaviours and beliefs had germinated in 1999 and had been sustained until September 2003. Coincidentally the information given to the HSE/PF Depute in November 2005 indicates that the negative safety culture was now apparent across the 15 offshore installations listed in the technical data provided.
In 1999 the opinion of the internal audit team, an opinion reached by consensus and unanimously was that In the Brent Field Unit there were significant and entrenched weakness in management controls. The fundamental reason for this was not absence of structures and controls but rather the inappropriate attitude and behaviour that causes violation, non-compliance and deviation from these structures and controls. This inappropriate behaviour exists from the Brent GM downwards. We believed that key business drivers and messages from the corporate level in Shell Expro are fostering this undesirable behaviour.
This last statement is important because it was aimed directly at the Managing Director. It was he, his drive and enthusiasm with no appropriate regard to the risks, which had created an enhanced Expro organisation with insufficient checks and balances to manage business risks.
In this evolving process, a rapid instigation of change, without management of the known risks, these corporate checks and balances were functionally impaired.
On 25th July 2005 the Shell investigation team discussed its findings with the Chief Executive and Legal Counsel re the events in 1999 and as to whether its Managers and Directors had acted appropriately at that time. I was shown a copy of the findings and involved in a short meeting with the Chief Executive. In matters related to the above I summarise the situation as discussed.
In 1999 the Oil Director had made false and misleading statements to the media and the HSE re concerns that had been raised by the workforce in relation to the so-called touch F-all policy. The auditors raised this matter with him on three occasions asking him to correct the original statements made by him on behalf of Shell Expro. The opinion of the audit team was that not to revoke these statements was unethical, immoral and potentially illegal. He gave no indication that he would do so.
In 2005 information shown to me by the investigation team recorded that the Oil Director claimed that when he made the original statements on 9th September 1999 he acted in good faith assuming the information given to him was true.
When asked the question as to why he did not later refute these statements, as recommended by the Auditors in 1999, he appears to have failed to give an answer to the investigation team. Despite continuing to press this point with Shell, in later correspondence with the Group Chief Auditor, no answer is forthcoming.
In 1999, and because of the undesirable behaviours witnessed from the Brent Business Unit team, namely the General Manager, the Asset Manager and the Deputy Asset Manager, it was recommended to Expro Oil Director by me, at the meeting on 22nd October, that he consider the suspension from duty of these individuals pending an inquiry into their conduct. As stated above they had allowed the installation to continue to operate in a dangerous condition, with risk levels in the intolerable region (unacceptable to society) and had made no attempt to reduce these risks when recommended to do so by their own audit team.
Regulation 10 of the Offshore Installation Safety Case Regulations requires a Duty Holder to insure that the installation is operated at all times in conformity with the submitted Safety Case. Failure to do so is a criminal offence.
As a minimum what action should have been taken, as recommended to Expro between 5th September and 22nd October is that
(a) the test separator should have been taken out of service with immediate effect
(b) the full bore crossover between the firewater main and the service water main should have been closed
(c) the drilling containers should have been lifted from over the explosion vent from the utility shaft
Then at that point, given the litany of other concerns, lack of maintenance, number of overrides, known deficiencies in ESDV’s, performance standards for safety critical equipment, deviations from PTW etc Shell Expro should have assessed the risks of continued operation and if these risks were considered unacceptable it should have shut down the facility.
If Shell Expro had adjudged that the risks of continued operation of Brent Bravo were acceptable it should have informed the HSE and its workforce about those risks immediately, and only continued in operation if those risks (still significantly above the as low as is reasonably practicable level) were considered also to be acceptable both by the workforce and the HSE.
As part of this process it should have informed the workforce and the HSE as to the remedial actions with timescale, it would take to remove the litany of defects in form of a remedial action plan. In addition, a copy of the audit findings should have been placed on the installation for general review and discussion specifically with the Safety Representatives.
All these requirements, which are required by Law, were not carried out by Shell between 5th September and 22nd October 1999 and there was no evidence uncovered by the investigation team in 2005 that they were ever carried out.
---------------------------------------------------------------------------------------------
In July 2005 the investigation team reported that the MD had only considered the suspension of the Asset Manager in 1999, not the General Manager nor the Deputy Asset Manager. The investigation team gave no rationale for the non-suspension of these individuals to me.
The investigation did reveal that the MD had considered the removal of the Asset Manager, The findings went on the state that the MD had not suspended the Asset Manager because he was concerned about his mental stability, and was fearful of the effect such a suspension would have on the Asset Manager!
I asked the investigation team their opinion on this decision and they replied that it was ‘inexplicable’. That is all they would say.
In review and critique of the MD’s decision is should be remembered that the Asset Manager at the time had a portfolio of the 4 major Brent installations, providing 30% of UK gas demand, and at anytime having 650 or so persons on board these installations.
These large installations, especially Brent B/C and D are operated, due to their complexity and size, with high residual risk levels which are only acceptable to Society if the Operator can demonstrate to society that he is, at all times, he is managing these risks to the ALARP levels recorded in their respective Safety Cases.
The Asset Manager had under interview in the presence of three independent auditors (transcripts of all such interviews being recorded in the form of audit notes) accepted quite openly and honestly that he had operated the Brent Bravo installation in the manner as listed below;
This included but is not limited to
· Operating plant and equipment in a dangerous condition
· Carrying out major modifications to the firewater system in breach of the PFEER regulations
· Making changes to the design of plant and equipment with no reference to a technical authority
· the coercion of an independent verification official to sign off paperwork in advance of work being carried out
· purposely falsifying ESDV test records and starting up the installation after ESDV’s had failed their leak-off test
· falsely reporting compliance with safety critical equipment
· having fire and gas detection equipment constantly inhibited
· accepting that violation and non-conformance with the PTW system was common
· accepting that of the 29 overrides in place on the 4th September that circa 8 of these, associated with the mal-operation of the test separator, were not entered on the Control, Room Log, and not approved by a technical authority. The independent inspector with a duty to monitor and report the level of such overrides and their justification was also unaware of the situation
· accepting that the disciplining of a member of staff offshore was ‘unsafe’ but refusing to revoke that disciplinary action for fear that he would have been observed by the workforce to have ‘made a mistake’
· etc, etc and ad nauseam
· there were also a number of very serious concerns on other Brent installations particularly Brent Delta
Note:
And the evidence for this supported by documentation such as photo-copies of control room logs, inhibit and override monitoring log books, hand-over notes CRO to CRO, Operations Supervisor to Operations Supervisor, OIM to OIM, WoodGroup Maintenance Supervisors to WoodGroup Maintenance Supervisors, signed statement by inspector as to the conditions prevailing re overrides in the Central Control room on 4th September 1999 etc. Plus evidence of the corruption of the verification process and falsification of maintenance records including ESDV’s.
In 1999 it was never made clear to the Audit team whether Expro had accepted their recommendations or not. These recommendations were that Expro should take immediate actions on Brent Bravo to reduce risks to persons on the installation and to instigate longer-term actions to reverse the negative safety culture including the suspension of the Brent management team.
In July 2005 the investigation team reported that the Oil Director had in fact reluctantly accepted the recommendations in his words to ‘avoid the continuing bun fight between the Brent Management and the Internal Audit team’.
In July 2005 the investigation team reported that they could find no evidence that the immediate short-term actions to reduce risks on Brent Bravo in 1999 had ever been undertaken by Shell.
As far as the recommendations to change behaviours was concerned, they reported that by August 2000 this project had been truncated and at that time only 20% of the behavioural recommendations had been implemented. Thereafter they could find no evidence that the remaining 80% of outstanding actions had ever been implemented.
In 1999 the Managing Director essentially dismissed the Shell International lead auditor. This was after the presentation on the 22nd October 1999 at which the Audit Team recommendations were heard by the Expro Management team including the Oil and the Gas Director.
There is no precedent for this in Shell. Such action just does not take place in fact to obstruct an Auditor in the course of his duties is taken by Shell International as a serious matter and is clearly in breach of its ethics code and its statement of general business principles.
In July 2005 the investigation team reported that the then MD in 1999 had removed the Lead Auditor because ‘the Shell Expro team who would have to implement the audit findings would not be perceptive to the Audit Leader’.
In their consideration the investigation team stated that the MD should not have done this and at least he should have discussed his reasoning with the Lead Auditor.
Meeting with Shell International CEO 25/7/05
In July 2005 and in the presence of the investigation team members team, the Shell CEO and Legal Counsel, I indicated that if anything, the findings of the internal investigation had increased my concerns that failure to react appropriately to the situation in 1999 had led inexorably to the deaths of the individuals in September 2003.
The only comment the CEO made to this statement was that ‘Directors did not sign permits’ which I took to mean that he accepted that there was causal linkage between 1999 and 2003 but the blame for this should not be directed towards the then Oil and Managing Director. Needless to say I did not agree with this assessment.
Shell International Legal counsel commented that although there may be indirect links (or natural causation) between 1999 and 2003 direct linkage between the failures in 1999 and 2003 would be difficult to prove.
I do not necessarily disagree with the Legal Counsel, after all he is a Lawyer and I am not.
The point I make on this as a technical expert was explained in the letter to the HSE/PF Depute in May 2005 in that
‘A legal moot point may be that the specific circumstances causing the deaths of the specific individuals in that specific location at that specific time on Brent Bravo could not have been foreseen. That could be argued but that argument I suggest is irrelevant. As explained in the comparative analysis, if the Duty Holder operates his facilities at a dangerously high level of residual risk, and in breach of his duties and obligations under the Safety Case, he is in fact gambling with the lives of all persons on that facility. In gambling there are winners and losers. Someone along the way was going to suffer. The poor and unfortunate victims were only in the wrong place at the wrong time’
To then submit, as Shell Legal Counsel apparently did at the prosecution proceedings at Stonehaven Sheriff Court in April 2005, that the circumstances of September 2003 could not be foreseen, would be an argument with no substance or credibility after the fact.
I am sure the Sheriff will have heard evidence re the negative safety culture that was apparent on Brent Bravo in September 2003 and this would have been highlighted from the HSE investigation that led to the April prosecution.
What the Sheriff will not have heard is of the failure to revoke the false and misleading statements made by the Oil Director to the HSE and to Society in general via press and TV coverage in 1999 (the Touch FA policy etc).
This was compounded by the failure by the Oil Director and the Managing Director of Expro to react appropriately to the findings of their own audit team to reduce the risks on Brent Bravo specifically, and the Brent Field generally.
He will not have heard of the recommendation to suspend from duty the managers who were the prime drivers of the negative culture but were allowed to stay in position by the MD.
He will not have heard that a Manager, who had freely admitted his culpability in operating Brent Bravo in a criminally negligent fashion, and whose mental stability was in question, was allowed to continue to operate Brent Bravo in the condition witnessed in September 1999, with no recorder improvement.
These failures gave sustenance to the negative safety culture allowing it to continue on Brent Bravo and to thrive unabated until the fatal accident in 2003.
END OF BILL CAMPBELL DOCUMENT
(Please note (1)all of the blue highlighting above is by ShellNews.net - not by Mr. Campbell; (2) the MD of Shell Expro in 1999 was Malcolm Brinded, the current Executive Director of Shell Exploration and Production)
Bill Campbell
Click here to return to www.royaldutchshellplc.com
Click here to return to www.tellshell.net