Select Committee on Work and Pensions Written Evidence


Memorandum submitted by Bill Campbell

BACKGROUND

  This document relates to the enforcement regime of the Offshore Safety Division (OSD) of the HSE in Aberdeen as applied to the oil and gas industry and Shell UK in particular who operated circa 30% of the offshore installations in UK territorial waters

  This document uses data provided (prior to late 2001) by Ian Whewell who is currently the Head of OSD and after 2001 by information made available to the public on the HSE enforcement web-site and from information provided to me by the HSE under the Freedom of Information Act.

  This document also uses data from a post Fatalities Technical Integrity Review completed by Shell immediately after a double fatality event on Brent Bravo on 11 September 2003. This information was presented to OSD officials in November that year only weeks after the fatalities. This data is summarised in Tables provided as an Appendix and highlights an appalling state of affairs indicating a collapse in essential controls from 1999 to 2003 resulting in the conditions highlighted in the Tables.

  The document also provides data that rather than forcing improvement, post the fatalities there has been a continual decline in standards offshore as witnessed by a significant increase in enforcement actions a number of which are still outstanding. There has also been an increase in high potential incidents. It would appear that the negative safety culture witnessed in Shell operations from 1999 till 2003, a factor in the unlawful deaths in September 2003, still persists. Despite the increased efforts and vigilance of the HSE the current enforcement regime appears unable to make the Duty Holder comply with his legal obligations. Given the absolute number, spread and overlap of these enforcement actions Shell have been continually in breach of some offshore legislation or other since 1999 till the present day.

  The question that needs to be put to HSE by the Select Committee is why:

September to November 2003

    —    When given the information contained (in the Appendices Tables One to Three attached to this document) by Shell Directors in November 2003 did HSE not act to issue enforcement Notices, and prosecute Shell for the conditions apparent on the 16 offshore installations covered in the tables, the only action taken was on the effected installation where the fatalities took place, ie Brent Bravo.

    —    All these installations continued in full production despite the conditions highlighted in the Appendices. By Law the workers on these installations should have been informed of the risks they were exposed to but this did not happen.

    —    That the workforce on these installations were not informed is not contested by HSE and has been confirmed in writing to me by Ian Whewell the current Head of OSD. OSD also at the time in November 2003 did not seek assurances from Shell that the risks of continued operation were acceptable.

    —    The information presented to HSE by Shell Directors in 2003 was also not passed to the Procurator Fiscal and therefore was not led as evidence before the Sheriff at the subsequent Fatal Accident Inquiry held between November 2005 and February 2006. This is not contested by HSE and was confirmed to me in writing by Geoffrey Podger currently CEO of the HSE in the UK.

    —    This failure meant that the FAI was ineffective and did not, because this evidence was not given to the Sheriff, get to the root cause of the fatalities.

    —    Despite dialogue with the HSE and meetings with them, specifically on 31st August 2006, no explanation is forthcoming from them as to why their officials did not take the necessary action in 2003 to improve the conditions presented to them by Shell. Immediate improvements to reduce risks to the workforce that were in the intolerable region should have been facilitated through the enforcement process as described in the Health and Safety Commission Policy. This would have led to public disclosure of these conditions through prosecution flowing from the Notices. Also, and importantly, of putting this into the public domain through the mechanism of the Fatal Accident Inquiry so that the Sheriff amongst other things may have recommended improvements to the legislative regime which had clearly failed.

    —    It is the authors contention that given the Sheriff did not see this evidence his report contained no recommendations for improvement. So after the fatalities, rather than improvement, the HSE data from 2003 till present day bears witness to a steady and significant decline in Shell North Sea operations even after the fatal accident event with lessons from that event either not being learned or ignored.

    —    As an example of the scale of the risks due to the conditions presented to HSE in November 2003 in my opinion, as a recognised industry expert, is that 16 immediate Prohibition Notices should have been served on Shell UK. These Notices covering those 16 installations where there were unapproved (thus potentially defective and dangerous) temporary repairs on pipe-work. Refer to Table One. The justification for this is clear and beyond dispute in that it was an unapproved temporary repair, this repair being materially defective according to the Sheriff, that was the initiating event leading to the fatalities on Brent Bravo.

    —    As an example of the scale of the risks due to the conditions presented to HSE in November 2003 in my opinion, as a recognised industry expert, is that 13 improvement Notices should have been served on Shell UK. These Notices covering those 13 installations where there were over 1000 Fire and Gas sensors and systems found to be in a "fail to danger condition". Refer to Table Two.

    —    As an example of the scale of the risks intrinsic to the conditions presented to HSE in November 2003 in my opinion, as a recognised industry expert, is that nine immediate prohibition Notices should have been served on Shell UK. These Notices covering those nine installations with Emergency Shutdown Valves (ESDV) known to be in a failed condition or which had falsified performance records in the maintenance database, or in some cases both. Refer to Table Three. The justification for this is clear and beyond dispute in that it was the failure of an ESDV (known by the Operators to be in a failed condition prior to the fatalities) that contributed to the deaths by allowing a massive influx of hydrocarbons into the Utility Shaft on Brent Bravo. Despite this, nine offshore installations were allowed to continue in operation with principal gas and oil riser ESDV known to be degraded or in a failed condition.

    —    The issuance of 25 immediate Prohibition Notices (and 13 Improvement Notices) would have caused the 16 effected offshore installations to have ceased operations until the temporary repairs and ESDV were either assessed as being materially sound or returned in the case of the ESDV to a fully functioning condition.

2003 TILL PRESENT DAY

    —    A significant number of the 41 Notices served after 2003 were for serious repeat offences. For example a number of the Notices were for repeat offences in utility shafts, the area where the fatalities occurred on Brent Bravo, and for failures such as allowing workers to use a stairwell that was condemned in an inspection report as unsafe. This report was subverted as an example of the continuance of a negative safety culture.

    —    Shell also failed to report a significant gas leak (a dangerous occurrence under the H&S at Work Act) to the HSE this year. This is further evidence of the continuance of a negative safety culture.

    —    The HSC Enforcement Policy clearly states that these are circumstances where prosecution should take place in the public interest but none have been forthcoming related to 39 out of the 41 Notices. Two of the Notices related to Brent Bravo for which Shell UK were prosecuted at Stonehaven Sheriff Court in April 2005.

Prior to the Fatalities—failure of enforcement regime to get Shell to improve conditions offshore rate of issuance of enforcement actions one per 90 days with no prosecutions

  1.  From December 1999 until September 2003 before the double fatality that occurred on Brent Bravo on 11th September that year 15 Enforcement Actions were issued upon Shell UK for its North Sea operations, 13 of which were Improvement Notices and two were Prohibition Notices as evidence of a persistent and continual failure to comply with legal requirements with serious and often repeat breaches of Offshore legislation.

  2.  This began in December 1999 when HSE served an improvement Notice on Cormorant Alpha Quote there are serious failures in the safety critical equipment verification scheme—Unquote.

  3.  The year 2000 was a particularly bad year with evidence mounting of a continual and chronic decline in offshore standards for example a fire developed in the fire-pump room on Leman. The deluge system failed to protect the pump and maintenance, which should have been carried out in 1999, had been neglected. Also some 93 non-essential crew members from Brent Delta were evacuated after prolonged loss of all life support systems caused by maintenance being neglected.

  4.  In October 2000 the Dunlin A platform had to be evacuated after build up of hydrocarbons in its Utility Shaft and in November the newly commissioned Shearwater platform which handles extremely high pressure, high temperature hydrocarbons, was evacuated after higher than normal pressures were recorded at the wellheads.

  5.  In February 2001 Kittiwake was evacuated after the loss of control on an oil well and in June that year in relation to Auk and Fulmar HSE raised concerns that five releases of hydrocarbons had been due to corroded pipework and had occurred over the previous 12 month period.

  6.  By October 2001 and with obvious frustration at lack of action by Shell the HSE wrote to Shell complaining that progress on Improvement Notices issued related to the verification schemes on Cormorant A and Dunlin A in 1999 and 2000 and the North Sea generally, are significantly overdue. According to HSE the Company has been in continual breach of these Regulations for over 18 months The HSE request that to give this the attention and priority it deserves that their letter be discussed at corporate level in the organisation.

  7.  The seeds fell on stony ground, for after the letter was received a further five Improvement Notices related to verification schemes were served prior to the fatal accident in Sept. 2003. This was evidence of the failure of Shell Directors to take remedial action although they have been notified that they are in breach of Regulations endangering the lives of persons offshore.

  8.  Despite these warnings to Directors highlighted above in January 2002 100 non essential crew were evacuated from Brent Charlie after a leak of Hydrogen Sulphide into its Utility Shaft and in March of that year HSE issued an improvement Notice on North Cormorant Quote— You have failed to provide an effective system of work for the maintenance of plant Unquote.

  9.  In December 2002 HSE issued a further Improvement Notice—there was an uncontrolled release of flammable or explosive substances on the Shearwater installation that released from abnormal activities during a process isolation that had not been subject to suitable and sufficient risk assessment.

Immediately after the Fatalities—Why did the OSD officials not take action?

  10.  With a number of these Improvement Notices still ongoing in the field two persons were killed in the Utility Shaft of Brent Bravo on 11th September 2003. Failure of the verification scheme was evident in these deaths as noted in the determination of the Sheriff at the Fatal Accident Inquiry in that ESD valves and other safety critical equipment failed to operate all of which contributed directly to the deaths or impinged upon the immediate emergency response to that incident.

  11.  Immediately after the fatalities Shell conducted a technical integrity review which highlighted appallingly bad conditions on 17 offshore installations including Brent Bravo where the deaths occurred.

  12.  This Review found hundreds of unapproved pipework repairs, refer to Appendix Table One, Thousands of fire and gas sensors in fail to danger condition, refer to Appendix Table Two and criminal neglect re the maintenance of ESD valves with some installations operating with ESD valves known to be in a failed condition, refer to Appendix Table Three.

  13.  And as importantly the Review found indications of an ingrained a persistent negative safety culture and that that culture had apparently persisted since 1999. For example the Permit to Work (PTW) violations were common including doing much work under the operations umbrella rather than through a PTW, this was a contributory factor in the fatal accident and also neglect of maintenance and knowingly operation plant in a dangerous condition had become the norm.

  14.  Shell shared all this with officials of the Offshore Safety Division (OSD) of the HSE in Aberdeen on November only weeks after the fatalities.

  15.  Despite this malaise, and with the Shell Production Director telling HSE he was shocked and horrified by what his Review Team had reported to him all the 17 installations with the exception of Brent Bravo continued to operate with no system or process being shutdown to reduce risks. No Enforcement actions of any description were issued.

  16.  Ian Whewell, the current Head of OSD in Aberdeen has confirmed to me in writing, and from a meeting held with him last year that HSE officials in November 2003 did not seek assurances from Shell that the risks of continued operation were acceptable.

  17.  He also confirmed that HSE had not sought assurance at that time from Shell that the workforce on the 17 installations other than Brent Bravo were informed (as they should have been in Law) of the enhanced risks on their specific installations all of which continued in normal operation.

After the Fatalities 2003 till present day—failure of enforcement regime to get Shell to improve conditions after the fatalities rate of issuance of enforcement actions increased three-fold to one per 30 days with no prosecutions related to these Notices

  18.  During this period a further 41 enforcement notices were issued upon Shell UK. Most of these were serious related to reducing the risks of major accident and multiple fatality events. Two of these enforcement notices were related directly to the follow up of the fatalities resulting in prosecution for three breaches of relevant legislation but the remaining 39 enforcement actions resulted in no prosecutions despite this amounting to circa 80 separate and repeated breaches of relevant legislation.

  19.  The amount of serious, high potential incidents have increased indicating continued failure to ensure the technical integrity of offshore installations. For example in 2004—64 non-essential personnel were evacuated from Brent Delta after a gas leak in the Utility Shaft, gas leaks also occurred in the Utility Shaft of Dunlin Alpha and a further gas leak occurred on Cormorant Alpha.

  20.  In 2005—85 non essential personnel were evacuated from Brent Bravo after an oil leak in the Utility Shaft and less than two weeks later 71 non-essential personnel were evacuated from Brent Bravo following a gas leak.

  21.  On 15 May 2006 a pinhole leak was found on the Brent Alpha oil import line. On the 5th of June there was a release of gas on Brent Bravo. The platform was shutdown whilst the module was safely isolated and days later work had to be stopped in the Brent Bravo Utility Shaft after an alert caused by a seep from a pipeline bringing seawater into the platform.

  22.  In 2007 Shell reported a gas release on its Eider offshore installation. That year also Shell had to evacuate 60 employees from its Brent Bravo installation due to prolonged loss of power  Circa About 100 workers were evacuated from the North Cormorant installation after one of the two boilers broke down. Circa about 100 workers were evacuated from the Cormorant Alpha installation after one of the three power generators failed.

  23.  In relation to concerns raised by trade unions related to manning and competency levels on Shell offshore installations in September this year the HSE upheld all but one of the concerns raised by the workforce.

  24.  In November a fire is reported on North Cormorant, and on the same day Cormorant Alpha suffers a prolonged outage of power due to failure of utility systems due to failure to maintain.  

APPENDIX

TABLE ONE—TEMPORARY REPAIRS

  The initiating event leading to the double fatality in September 2003 was a leak of hydrocarbons from an unapproved temporary repair. The Sheriff concluded that in any case the repair would never have been approved since it was materially deficient. If the repair when carried out had been a properly engineered then the fatalities would not have happened. What the Table One shows is what the Post Fatalities Technical Integrity Review found all this information passed to HSE in November 2003.

  A number of the repairs were, through this examination process, found to be materially defective and not acceptable to the competent person assessing them. So we are not describing here just a potential risk but an actual risk to the persons on the 17 offshore installations within UK territorial waters covered in the data attached with this letter.

  This reflects an appalling state of affairs and yet, as discussed later, all these installations with the exception of Brent Bravo continued in operation although the risks of doing so were unacceptable and No Enforcement Notices were issued other than on Brent Bravo and no prosecutions were sought other than on Brent Bravo

Table One
Installation Number of Temp Repairs Number of these repairs which were not approved and thus potentially materially defective
Brent Bravo339 excluding the repair which initiated the fatal accident
Brent C4628
Brent Delta184
Cormorant A372
North Cormorant315
Dunlin2817
Eider123
Tern205
Fulmar3215
Auk2119
Kittiwake99
Anasuria1614
Gannet3232
Shearwater64
Nelson1717
Leman1010
Sean22
17 in total470186



APPENDIX

TABLE TWO—FIRE AND GAS DETECTION SYSTEMS

  What Table Two shows is that on 14 offshore installations including Brent Bravo the Review Team found 1278 fire and gas sensors that were stated by the Review team to be in a fail to danger condition. In other words, could not have been relied upon to operate when required in an emergency.

  This reflects an appalling state of affairs and yet all these installations with the exception of Brent Bravo continued in operation although the risks of doing so were unacceptable and No Enforcement Notices were issued other than on Brent Bravo and no prosecutions were sought other than on Brent Bravo.

Table Two
InstallationNumber of Fire and Gas Sensors found during the Review to be in a Fail to danger Condition, that is their operation in an Emergency could not be assured
Brent A20
Brent B16
Brent C30
Brent D35
Dunlin6
Cormorant A10
Tern 18
Eider 3
Gannet317
Auk265
Fulmar434
Shearwater 37
Nelson27
Anasuria FPSO 60
14 in Total1,278




APPENDIX

TABLE THREE—FAILED EMERGENCY SHUTDOWN VALVES

  What the Sheriff found was that during the annual maintenance shutdown on Brent Bravo in August 2003 an ESD valve on the outlet of the HP Flare KO Vessel failed to close during routine testing. According to the Sheriff in his report during the same shutdown some 14 other ESD valves failed to operate within specification on Brent Bravo. A significant factor contributing to the extent of the vapour cloud was the failure of the ESD valve on the Flare KO Vessel outlet to close in the emergency.

  Table Three shows the data from Ten Offshore Installations, found to be operating with ESD valves in failed condition, or with falsified test results, all these installations with exception of Brent Bravo continued in operation although the risks of doing so were unacceptable. This reflects an appalling state of affairs. All these installations with the exception of Brent Bravo continued in operation although the risks of doing so were unacceptable and No Enforcement Notices were issued other than on Brent Bravo and no prosecutions were sought other than on Brent Bravo.

Table Three
InstallationEvidence obtained during Review of ESDV in failed condition or where the functionality of the ESDV was degraded but the results of the test had been falsified.
Anasuria FPSORepeated ESD valve failures. ESD valves recorded as frigged before test, not tested and left in frigged state after test (frigged means purposefully inhibited from operating).
Brent AlphaBrent Alpha ESDV fails its leak-off test (LOT) but Work Order (WO) for correctives maintenance cancelled as has the routine to further LOT the valve. Other gas riser closure and LOT tests on ESDV's have also been cancelled.
Brent BravoWO's signed off as OK when using wrong test method and known fault on system. WO's cancelled for corrective with faults still present (eg valves). Maintenance Word Order (WO) signed off as OK when test not carried out.
Brent CharlieHistories for gas riser valve do not show that the valves meet the leak-off criteria. ESDV on High Pressure separators on hydrocarbon process slow to close, no follow up actions, other valve failures not corrected when identified.
Brent DeltaFailed ESD valve not being tested properly but reported as OK for WO closure. Corrective WO's cancelled.
TernHudson overpressure protection ESD valve not meeting required performance, known to Asset Manager.
Cormorant ASome inadequate maintenance histories in database of SAP computer.. Sticking valves identified during ESD test in 2002, corrective maintenance WO raised but not released for remedial actions.
DunlinFire and Gas signal inputs to ESD valves not tested as there are no input inhibits at ESD system, but routines being signed off or cancelled. Tests signed off as successful even when failures noted.
FulmarFailed ESD valves with no follow up identified.
GannetRiser ESDV closure and LOT results not in SAP computer. Repeated valve failures.

December 2007





 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 21 April 2008