Memorandum submitted by Bill Campbell
BACKGROUND
This document relates to the enforcement regime
of the Offshore Safety Division (OSD) of the HSE in Aberdeen as
applied to the oil and gas industry and Shell UK in particular
who operated circa 30% of the offshore installations in
UK territorial waters
This document uses data provided (prior to late
2001) by Ian Whewell who is currently the Head of OSD and after
2001 by information made available to the public on the HSE enforcement
web-site and from information provided to me by the HSE under
the Freedom of Information Act.
This document also uses data from a post Fatalities
Technical Integrity Review completed by Shell immediately after
a double fatality event on Brent Bravo on 11 September 2003. This
information was presented to OSD officials in November that year
only weeks after the fatalities. This data is summarised in Tables
provided as an Appendix and highlights an appalling state of affairs
indicating a collapse in essential controls from 1999 to 2003
resulting in the conditions highlighted in the Tables.
The document also provides data that rather
than forcing improvement, post the fatalities there has been a
continual decline in standards offshore as witnessed by a significant
increase in enforcement actions a number of which are still outstanding.
There has also been an increase in high potential incidents. It
would appear that the negative safety culture witnessed in Shell
operations from 1999 till 2003, a factor in the unlawful deaths
in September 2003, still persists. Despite the increased efforts
and vigilance of the HSE the current enforcement regime appears
unable to make the Duty Holder comply with his legal obligations.
Given the absolute number, spread and overlap of these enforcement
actions Shell have been continually in breach of some offshore
legislation or other since 1999 till the present day.
The question that needs to be put to HSE by
the Select Committee is why:
September to November 2003
— When given the information contained
(in the Appendices Tables One to Three attached to this document)
by Shell Directors in November 2003 did HSE not act to issue enforcement
Notices, and prosecute Shell for the conditions apparent on the
16 offshore installations covered in the tables, the only action
taken was on the effected installation where the fatalities took
place, ie Brent Bravo.
— All these installations continued
in full production despite the conditions highlighted in the Appendices.
By Law the workers on these installations should have been informed
of the risks they were exposed to but this did not happen.
— That the workforce on these
installations were not informed is not contested by HSE and has
been confirmed in writing to me by Ian Whewell the current Head
of OSD. OSD also at the time in November 2003 did not seek assurances
from Shell that the risks of continued operation were acceptable.
— The information presented to
HSE by Shell Directors in 2003 was also not passed to the Procurator
Fiscal and therefore was not led as evidence before the Sheriff
at the subsequent Fatal Accident Inquiry held between November
2005 and February 2006. This is not contested by HSE and was confirmed
to me in writing by Geoffrey Podger currently CEO of the HSE in
the UK.
— This failure meant that the
FAI was ineffective and did not, because this evidence was not
given to the Sheriff, get to the root cause of the fatalities.
— Despite dialogue with the HSE
and meetings with them, specifically on 31st August 2006, no explanation
is forthcoming from them as to why their officials did not take
the necessary action in 2003 to improve the conditions presented
to them by Shell. Immediate improvements to reduce risks to the
workforce that were in the intolerable region should have been
facilitated through the enforcement process as described in the
Health and Safety Commission Policy. This would have led to public
disclosure of these conditions through prosecution flowing from
the Notices. Also, and importantly, of putting this into the public
domain through the mechanism of the Fatal Accident Inquiry so
that the Sheriff amongst other things may have recommended improvements
to the legislative regime which had clearly failed.
— It is the authors contention
that given the Sheriff did not see this evidence his report contained
no recommendations for improvement. So after the fatalities, rather
than improvement, the HSE data from 2003 till present day bears
witness to a steady and significant decline in Shell North Sea
operations even after the fatal accident event with lessons from
that event either not being learned or ignored.
— As an example of the scale of
the risks due to the conditions presented to HSE in November 2003
in my opinion, as a recognised industry expert, is that 16 immediate
Prohibition Notices should have been served on Shell UK. These
Notices covering those 16 installations where there were unapproved
(thus potentially defective and dangerous) temporary repairs on
pipe-work. Refer to Table One. The justification for this is clear
and beyond dispute in that it was an unapproved temporary repair,
this repair being materially defective according to the Sheriff,
that was the initiating event leading to the fatalities on Brent
Bravo.
— As an example of the scale of
the risks due to the conditions presented to HSE in November 2003
in my opinion, as a recognised industry expert, is that 13 improvement
Notices should have been served on Shell UK. These Notices covering
those 13 installations where there were over 1000 Fire and Gas
sensors and systems found to be in a "fail to danger condition".
Refer to Table Two.
— As an example of the scale of
the risks intrinsic to the conditions presented to HSE in November
2003 in my opinion, as a recognised industry expert, is that nine
immediate prohibition Notices should have been served on Shell
UK. These Notices covering those nine installations with Emergency
Shutdown Valves (ESDV) known to be in a failed condition or which
had falsified performance records in the maintenance database,
or in some cases both. Refer to Table Three. The justification
for this is clear and beyond dispute in that it was the failure
of an ESDV (known by the Operators to be in a failed condition
prior to the fatalities) that contributed to the deaths by allowing
a massive influx of hydrocarbons into the Utility Shaft on Brent
Bravo. Despite this, nine offshore installations were allowed
to continue in operation with principal gas and oil riser ESDV
known to be degraded or in a failed condition.
— The issuance of 25 immediate
Prohibition Notices (and 13 Improvement Notices) would have caused
the 16 effected offshore installations to have ceased operations
until the temporary repairs and ESDV were either assessed as being
materially sound or returned in the case of the ESDV to a fully
functioning condition.
2003 TILL PRESENT
DAY
— A significant number of the
41 Notices served after 2003 were for serious repeat offences.
For example a number of the Notices were for repeat offences in
utility shafts, the area where the fatalities occurred on Brent
Bravo, and for failures such as allowing workers to use a stairwell
that was condemned in an inspection report as unsafe. This report
was subverted as an example of the continuance of a negative safety
culture.
— Shell also failed to report
a significant gas leak (a dangerous occurrence under the H&S
at Work Act) to the HSE this year. This is further evidence of
the continuance of a negative safety culture.
— The HSC Enforcement Policy clearly
states that these are circumstances where prosecution should take
place in the public interest but none have been forthcoming related
to 39 out of the 41 Notices. Two of the Notices related to Brent
Bravo for which Shell UK were prosecuted at Stonehaven Sheriff
Court in April 2005.
Prior to the Fatalities—failure of enforcement
regime to get Shell to improve conditions offshore rate of issuance
of enforcement actions one per 90 days with no prosecutions
1. From December 1999 until September 2003
before the double fatality that occurred on Brent Bravo on 11th
September that year 15 Enforcement Actions were issued upon Shell
UK for its North Sea operations, 13 of which were Improvement
Notices and two were Prohibition Notices as evidence of a persistent
and continual failure to comply with legal requirements with serious
and often repeat breaches of Offshore legislation.
2. This began in December 1999 when HSE
served an improvement Notice on Cormorant Alpha Quote there are
serious failures in the safety critical equipment verification
scheme—Unquote.
3. The year 2000 was a particularly bad
year with evidence mounting of a continual and chronic decline
in offshore standards for example a fire developed in the fire-pump
room on Leman. The deluge system failed to protect the pump and
maintenance, which should have been carried out in 1999, had been
neglected. Also some 93 non-essential crew members from Brent
Delta were evacuated after prolonged loss of all life support
systems caused by maintenance being neglected.
4. In October 2000 the Dunlin A platform
had to be evacuated after build up of hydrocarbons in its Utility
Shaft and in November the newly commissioned Shearwater platform
which handles extremely high pressure, high temperature hydrocarbons,
was evacuated after higher than normal pressures were recorded
at the wellheads.
5. In February 2001 Kittiwake was evacuated
after the loss of control on an oil well and in June that year
in relation to Auk and Fulmar HSE raised concerns that five releases
of hydrocarbons had been due to corroded pipework and had occurred
over the previous 12 month period.
6. By October 2001 and with obvious frustration
at lack of action by Shell the HSE wrote to Shell complaining
that progress on Improvement Notices issued related to the verification
schemes on Cormorant A and Dunlin A in 1999 and 2000 and the North
Sea generally, are significantly overdue. According to HSE the
Company has been in continual breach of these Regulations for
over 18 months The HSE request that to give this the attention
and priority it deserves that their letter be discussed at corporate
level in the organisation.
7. The seeds fell on stony ground, for after
the letter was received a further five Improvement Notices related
to verification schemes were served prior to the fatal accident
in Sept. 2003. This was evidence of the failure of Shell Directors
to take remedial action although they have been notified that
they are in breach of Regulations endangering the lives of persons
offshore.
8. Despite these warnings to Directors highlighted
above in January 2002 100 non essential crew were evacuated from
Brent Charlie after a leak of Hydrogen Sulphide into its Utility
Shaft and in March of that year HSE issued an improvement Notice
on North Cormorant Quote— You have failed to provide an
effective system of work for the maintenance of plant Unquote.
9. In December 2002 HSE issued a further
Improvement Notice—there was an uncontrolled release of
flammable or explosive substances on the Shearwater installation
that released from abnormal activities during a process isolation
that had not been subject to suitable and sufficient risk assessment.
Immediately after the Fatalities—Why did
the OSD officials not take action?
10. With a number of these Improvement Notices
still ongoing in the field two persons were killed in the Utility
Shaft of Brent Bravo on 11th September 2003. Failure of the verification
scheme was evident in these deaths as noted in the determination
of the Sheriff at the Fatal Accident Inquiry in that ESD valves
and other safety critical equipment failed to operate all of which
contributed directly to the deaths or impinged upon the immediate
emergency response to that incident.
11. Immediately after the fatalities Shell
conducted a technical integrity review which highlighted appallingly
bad conditions on 17 offshore installations including Brent Bravo
where the deaths occurred.
12. This Review found hundreds of unapproved
pipework repairs, refer to Appendix Table One, Thousands of fire
and gas sensors in fail to danger condition, refer to Appendix
Table Two and criminal neglect re the maintenance of ESD valves
with some installations operating with ESD valves known to be
in a failed condition, refer to Appendix Table Three.
13. And as importantly the Review found
indications of an ingrained a persistent negative safety culture
and that that culture had apparently persisted since 1999. For
example the Permit to Work (PTW) violations were common including
doing much work under the operations umbrella rather than through
a PTW, this was a contributory factor in the fatal accident and
also neglect of maintenance and knowingly operation plant in a
dangerous condition had become the norm.
14. Shell shared all this with officials
of the Offshore Safety Division (OSD) of the HSE in Aberdeen on
November only weeks after the fatalities.
15. Despite this malaise, and with the Shell
Production Director telling HSE he was shocked and horrified by
what his Review Team had reported to him all the 17 installations
with the exception of Brent Bravo continued to operate with no
system or process being shutdown to reduce risks. No Enforcement
actions of any description were issued.
16. Ian Whewell, the current Head of OSD
in Aberdeen has confirmed to me in writing, and from a meeting
held with him last year that HSE officials in November 2003 did
not seek assurances from Shell that the risks of continued operation
were acceptable.
17. He also confirmed that HSE had not sought
assurance at that time from Shell that the workforce on the 17
installations other than Brent Bravo were informed (as they should
have been in Law) of the enhanced risks on their specific installations
all of which continued in normal operation.
After the Fatalities 2003 till present day—failure
of enforcement regime to get Shell to improve conditions after
the fatalities rate of issuance of enforcement actions increased
three-fold to one per 30 days with no prosecutions related to
these Notices
18. During this period a further 41 enforcement
notices were issued upon Shell UK. Most of these were serious
related to reducing the risks of major accident and multiple fatality
events. Two of these enforcement notices were related directly
to the follow up of the fatalities resulting in prosecution for
three breaches of relevant legislation but the remaining 39 enforcement
actions resulted in no prosecutions despite this amounting to
circa 80 separate and repeated breaches of relevant legislation.
19. The amount of serious, high potential
incidents have increased indicating continued failure to ensure
the technical integrity of offshore installations. For example
in 2004—64 non-essential personnel were evacuated from Brent
Delta after a gas leak in the Utility Shaft, gas leaks also occurred
in the Utility Shaft of Dunlin Alpha and a further gas leak occurred
on Cormorant Alpha.
20. In 2005—85 non essential personnel
were evacuated from Brent Bravo after an oil leak in the Utility
Shaft and less than two weeks later 71 non-essential personnel
were evacuated from Brent Bravo following a gas leak.
21. On 15 May 2006 a pinhole leak was found
on the Brent Alpha oil import line. On the 5th of June there was
a release of gas on Brent Bravo. The platform was shutdown whilst
the module was safely isolated and days later work had to be stopped
in the Brent Bravo Utility Shaft after an alert caused by a seep
from a pipeline bringing seawater into the platform.
22. In 2007 Shell reported a gas release
on its Eider offshore installation. That year also Shell had to
evacuate 60 employees from its Brent Bravo installation due to
prolonged loss of power Circa About 100 workers were evacuated
from the North Cormorant installation after one of the two boilers
broke down. Circa about 100 workers were evacuated from the Cormorant
Alpha installation after one of the three power generators failed.
23. In relation to concerns raised by trade
unions related to manning and competency levels on Shell offshore
installations in September this year the HSE upheld all but one
of the concerns raised by the workforce.
24. In November a fire is reported on North
Cormorant, and on the same day Cormorant Alpha suffers a prolonged
outage of power due to failure of utility systems due to failure
to maintain.
APPENDIX
TABLE ONE—TEMPORARY REPAIRS
The initiating event leading to the double fatality
in September 2003 was a leak of hydrocarbons from an unapproved
temporary repair. The Sheriff concluded that in any case the repair
would never have been approved since it was materially deficient.
If the repair when carried out had been a properly engineered
then the fatalities would not have happened. What the Table One
shows is what the Post Fatalities Technical Integrity Review found
all this information passed to HSE in November 2003.
A number of the repairs were, through this examination
process, found to be materially defective and not acceptable to
the competent person assessing them. So we are not describing
here just a potential risk but an actual risk to the persons on
the 17 offshore installations within UK territorial waters covered
in the data attached with this letter.
This reflects an appalling state of affairs
and yet, as discussed later, all these installations with the
exception of Brent Bravo continued in operation although the risks
of doing so were unacceptable and No Enforcement Notices were
issued other than on Brent Bravo and no prosecutions were sought
other than on Brent Bravo
Table One
| Installation |
Number of Temp Repairs | Number of these repairs which were not approved and thus potentially materially defective
|
| Brent Bravo | 33 | 9 excluding the repair which initiated the fatal accident
|
| Brent C | 46 | 28
|
| Brent Delta | 18 | 4
|
| Cormorant A | 37 | 2
|
| North Cormorant | 31 | 5
|
| Dunlin | 28 | 17
|
| Eider | 12 | 3
|
| Tern | 20 | 5
|
| Fulmar | 32 | 15
|
| Auk | 21 | 19
|
| Kittiwake | 9 | 9
|
| Anasuria | 16 | 14
|
| Gannet | 32 | 32
|
| Shearwater | 6 | 4
|
| Nelson | 17 | 17
|
| Leman | 10 | 10
|
| Sean | 2 | 2
|
| 17 in total | 470 | 186
|
APPENDIX
TABLE TWO—FIRE AND GAS DETECTION SYSTEMS
What Table Two shows is that on 14 offshore installations
including Brent Bravo the Review Team found 1278 fire and gas
sensors that were stated by the Review team to be in a fail to
danger condition. In other words, could not have been relied upon
to operate when required in an emergency.
This reflects an appalling state of affairs and yet all these
installations with the exception of Brent Bravo continued in operation
although the risks of doing so were unacceptable and No Enforcement
Notices were issued other than on Brent Bravo and no prosecutions
were sought other than on Brent Bravo.
Table Two
| Installation | Number of Fire and Gas Sensors found during the Review to be in a Fail to danger Condition, that is their operation in an Emergency could not be assured
|
| Brent A | 20 |
| Brent B | 16 |
| Brent C | 30 |
| Brent D | 35 |
| Dunlin | 6 |
| Cormorant A | 10 |
| Tern | 18 |
| Eider | 3 |
| Gannet | 317 |
| Auk | 265 |
| Fulmar | 434 |
| Shearwater | 37 |
| Nelson | 27 |
| Anasuria FPSO | 60 |
| 14 in Total | 1,278 |
APPENDIX
TABLE THREE—FAILED EMERGENCY SHUTDOWN VALVES
What the Sheriff found was that during the annual maintenance
shutdown on Brent Bravo in August 2003 an ESD valve on the outlet
of the HP Flare KO Vessel failed to close during routine testing.
According to the Sheriff in his report during the same shutdown
some 14 other ESD valves failed to operate within specification
on Brent Bravo. A significant factor contributing to the extent
of the vapour cloud was the failure of the ESD valve on the Flare
KO Vessel outlet to close in the emergency.
Table Three shows the data from Ten Offshore Installations,
found to be operating with ESD valves in failed condition, or
with falsified test results, all these installations with exception
of Brent Bravo continued in operation although the risks of doing
so were unacceptable. This reflects an appalling state of affairs.
All these installations with the exception of Brent Bravo continued
in operation although the risks of doing so were unacceptable
and No Enforcement Notices were issued other than on Brent Bravo
and no prosecutions were sought other than on Brent Bravo.
Table Three
| Installation | Evidence obtained during Review of ESDV in failed condition or where the functionality of the ESDV was degraded but the results of the test had been falsified.
|
| Anasuria FPSO | Repeated ESD valve failures. ESD valves recorded as frigged before test, not tested and left in frigged state after test (frigged means purposefully inhibited from operating).
|
| Brent Alpha | Brent Alpha ESDV fails its leak-off test (LOT) but Work Order (WO) for correctives maintenance cancelled as has the routine to further LOT the valve. Other gas riser closure and LOT tests on ESDV's have also been cancelled.
|
| Brent Bravo | WO's signed off as OK when using wrong test method and known fault on system. WO's cancelled for corrective with faults still present (eg valves). Maintenance Word Order (WO) signed off as OK when test not carried out.
|
| Brent Charlie | Histories for gas riser valve do not show that the valves meet the leak-off criteria. ESDV on High Pressure separators on hydrocarbon process slow to close, no follow up actions, other valve failures not corrected when identified.
|
| Brent Delta | Failed ESD valve not being tested properly but reported as OK for WO closure. Corrective WO's cancelled.
|
| Tern | Hudson overpressure protection ESD valve not meeting required performance, known to Asset Manager.
|
| Cormorant A | Some inadequate maintenance histories in database of SAP computer.. Sticking valves identified during ESD test in 2002, corrective maintenance WO raised but not released for remedial actions.
|
| Dunlin | Fire and Gas signal inputs to ESD valves not tested as there are no input inhibits at ESD system, but routines being signed off or cancelled. Tests signed off as successful even when failures noted.
|
| Fulmar | Failed ESD valves with no follow up identified.
|
| Gannet | Riser ESDV closure and LOT results not in SAP computer. Repeated valve failures.
|
December 2007
| 
