: Cheap at Half the Price: 11 Sept 2003
initial investigation into the causes of the tragedy indicated that a
jubilee clip fixing a neoprene patch on the 4-inch degasser line had
been slackened. This caused a leak of oily water from the pipe resulting
in gas condensate flashing to a heavier than air gas. As events unfolded
over a period of some ten minutes, the rate of release and quantity of
gas increased sufficiently to overcome the two men who did not put on
their emergency re-breathing apparatus.
That the company intends to better manage the patches on its corroded pipes, at first induces relief until one realises that what is meant is, patches will be more closely monitored, not necessarily new or repaired pipes installed. On the day of the deaths 69 corroded pipes were running with temporary patches in the Brent field. 'Temporary' is actually a misnomer as patches are frequently re-classified as 'permanent' to the extent that, short of failure, no further intervention is intended. Indeed, an opportunity to replace the patched 4-inch degasser drain line was only weeks earlier rejected during a platform maintenance shutdown so as not to delay production start up.
Shell's second "lesson" is the need "to improve the assessment of risks associated with interconnected systems". The law requires a system of written permits to work (PTWs) where the magnitude of the risk demands stringent control. That just about captures every conceivable intervention associated with hydrocarbons processes on an offshore production platform. Why, then, did a PTW in this case fail to prevent the deaths? Teething problems had been experienced following a recent shift to an electronic system. There was also the increasing reliance on a so-called "umbrella" PTW, the purpose of which is to authorise routine operational activities on the process side. The evidence shows that this arrangement had mutated into a virtual license to roam into whatever area or activity thought necessary to ensure steady-state production was not interrupted. Indeed, the entry of the two men into the confined space of the utilities shaft on the day of their deaths was exactly on this basis.
The third "lesson" is that rapid asphyxiation in oxygen deficient atmospheres "needs to be better understood by the workforce". So, too, by those who manage them?
Fourthly, the report says, "procedures governing leg entry and gas hazard response (i.e. immediate evacuation and/or donning of re-breathers) were not apparently followed". The HSE ACoP on confined space entry does not apply offshore but it is for Shell to devise arrangements and procedures at least as stringent as those in the AcoP, which they had apparently done. However, on the day these two lads died this procedure had long since been a dead letter of the law.
On 25 September Shell's Production Director, Greg Hill, wrote to staff outlining progress on learning the four "lessons". He implored: "we simply cannot become complacent in our attitudes and approach to safety. Like all accidents, this one was clearly preventable". As to cause he added, "There were a number of unique conditions that perfectly aligned at a moment in time to create danger and tragedy. If any one of these conditions had they been slightly different, it would not have occurred". (sic) He reminded staff in conclusion that: "they need to concentrate on two very important areas - accountability for safety and overall integrity".
Not much to quibble about here except that in Shell's preliminary report no trace of "unique" conditions may be found. All the causal factors identified were, in every way, not unique. Leaks from hydrocarbon systems usually consist of hydrocarbons. If such a leak is into a confined space it is quite normal to find hydrocarbons there. It is not unique to ensure that people entering the space are warned and properly protected. The object is to prevent the expected. For example, where gas migration is certain to occur with potentially devastating consequences unless prevented, valves, whose performance and integrity is assured, must be installed. Management systems and resources must be provided to that end. This common sense principle is codified in law by, among other things, the Verification Scheme (regulation 15: Safety Case Regulations 1996).
The Verification Scheme requires that for the full life of the installation a detailed written scheme should list all safety critical elements. Any valve, structure, plant, equipment, system or component whose failure could cause or contribute substantially to a major accident is safety critical. The passing valves through which gas condensate leaked to the 4-inch line were safety critical. They should have been fit for the intended purpose of containing hydrocarbons under pressure, dependable and effective and able to perform as specified. The duty holder must also appoint an independent competent person to audit the scheme. Any error, failure, performance deficiency or maintenance shortfall in a safety critical item must be prevented where practicable or, where not, remedial action taken. The HSE investigators are looking at the failures of verification on Brent Bravo and asking the question: were they generic to all Shell installations?
The evidence is overwhelmingly yes. In mid-2002 HSE served on Shell no less than five Improvement Notices following verification failures on five installations. Clearly without success, the HSE had been coaching the company in an attempt to get it out of its verification difficulties. As far back as 21 December 2000, HSE Inspector Thompson, served an Improvement Notice on the company's Cormorant Alpha platform because of recurring verification failures. His accompanying letter stated:
Nearly 3 years later on Brent Bravo, that action had yet to be taken.
Many other opportunities to prevent the two deaths came and went on the Brent Bravo. For example, for three-plus years the workforce on all four Brent platforms had been protesting that recurring cycles of downmanning and cutbacks in essential maintenance were inevitably going to have dire consequences. Shell and Wood Group management persistently rejected the men's concerns out of hand. In April 2003, the OILC, desperately worried at the deteriorating situation, made a formal complaint to the HSE and asked that something be done - and fast! The union assisted the HSE investigation by providing extensive documentation showing the extent of safety critical maintenance backlog in the Brent Field.
Early on in the 6-month investigation, on 12 May, HSE wrote to Shell confirming the seriousness of the problems. Not only was the maintenance backlog substantial it was evident the company was not in a position to know its true extent. For example, Shell's own performance standard for completion of safety critical non-routine work is 28 days. To provide assurance to senior managers that this standard is being met, a 'traffic light' procedure is supposed to alert them on the 29th day of any safety critical item remaining un-repaired or non-functioning. However, in excess of two months beyond this trigger point was lapsing before management was receiving the information. Worse, the information was not being acted upon, even then - a failure compounded further by the non-recording of these outstanding items as backlog.
The HSE May letter instructed Shell to review its maintenance management systems and advise on an action plan and timetable for remedy and observed: "Shell are now changing to a new Risk Assessment Matrix (RAM), with revised performance standards but this is at an early stage of development". Assurance taken from this pending development would have been seriously misplaced. RAM (Risk Assessment Matrix) is integral to OBIP (the Offshore Business Improvement Project) and was actually at the root of the union complaint to the HSE.
"Improving" the business
OBIP and RAM were rolled out late 2002 for implementation in 2003. The business case being made was that maturing North Sea fields are increasingly hostage to the combination of progressively falling production and rising unit costs. Consequently, operating expenditure has to be slashed, so Shell says, to maintain profitability and extend field life. This means less maintenance is to be done by fewer people who will work harder. An OBIP target was set to reduce non-routine corrective maintenance by 50% by means of simply not doing the work. The reduced capability to maintain the installations has to be managed by targeting remaining manpower and cash to where needed most to ensure 95% production uptime.
Safety, of course, is not to be compromised and to that end the RAM tool aims to aid decision making by suggesting what jobs should be done and what can be ignored or deferred. The patched 4-inch pipe at the core of this tragedy was "rammed" using the new technique in July 2003 and deemed not a priority. The electrical work outstanding on UPS-related systems had been "rammed" and placed below the action threshold. One of the valves that allowed gas to pass had been "rammed" and assessed as work that could be put aside for another time.
One of the more disquieting aspects of this whole affair is that, not only was OBIP, with its RAM tool, implemented within schedule by means of mass sacking of around 36 skilled and experienced platform staff, it was done so right under the noses of the HSE team who were investigating and confirming the extent of safety critical maintenance backlog still outstanding from previous rounds of cutbacks and sackings.
The RAM tool
Interestingly, the HSE investigation, commencing in March and terminating in September, while examining how RAM was rolled out and implemented, did not examine the RAM methodology itself in any detailed way. If they are examining it now, as part of their investigation into these two deaths, they will be worried by what they see.
In April 2002, the joint venture Sigma 3, was set up to bring together Shell's three main offshore engineering and maintenance contractors, Wood Group, AMEC and KBR (a subsidiary of Halliburton). A 7-year deal, described by some as a 'shared-risk shared-reward' arrangement, is worth an estimated £750million. Each contractor in its own right brings first-class bona fides in offshore expertise to the table, no problems there. Key goals are "delivering outstanding business success in safety, cost competitiveness and production through new ways of working". By maximising production uptime at the lowest possible cost the consortium intends to generate maximum added value for its members over the seven years of the contract. A contract founded upon incentives not to spend money is any client's dream. It is for OBIP through RAM to deliver it.
The Sigma 3 dividend
In the new regime a large chunk of day-to-day decision-making on what plant, equipment and systems should attract maintenance resources is devolved down from Shell managers to the Sigma 3 contractors' employees. RAM is described as a problem-solving tool for corrective maintenance. The 'problem' to be solved is that in 2002 some 570,000 man hours were expended on Non-routine Maintenance at a cost of £15million (distributed over 16 Shell installations), an amount equal to the spend on Planned Maintenance routines. The OBIP target is to half that expenditure virtually immediately and so net £50million over the 7-year life of Sigma 3.
RAM starts by taking the standard risk assessment approach of assigning values to the two components of risk, consequence and probability, and combining them to get a quantification of risk. However, RAM bends the outcome to arrive, not at a conclusion as to what should be done to avoid uncontrolled risk, but to gauge what risks might successfully be taken. In other words, whereas a 'normal' risk assessment seeks to minimise uncertainty by explicitly planning how the job should be done while at the same time introducing suitable additional precautions to control residual risk, OBIP's RAM tool seeks to balance the benefits (cost saving) of doing nothing at all against the potential consequences (fatalities and production down-time) of being caught out. It's the classic dichotomy between managing risk, on the one hand, and chance taking, on the other. The uninitiated think wrongly that they are one and the same thing.
But the most insidious - and actually dangerous - aspect of RAM is the extent to which it cuts the principal duty holder's management out of the loop. RAM assessment outcomes may fall within one of five bands of response. These are: a) manage locally; b) low priority, manage locally; c) medium, manage within department; d) high priority, ensure management awareness; and e) top priority, urgent action with management involvement. Only when the extent of risk, consequent to a decision not to perform remedial work, is assessed at or above band (d) is the RAM assessor (employed by a Sigma 3 contractor) obliged to flag up the possible consequences to Shell management. Otherwise, it's his call.
On 18 August the HSE notified Shell that the investigation into union complaints about the hazards posed by accumulated maintenance backlog, and the potential of OBIP to make matters worse, was complete. The regulator provided the company with a shopping list of nine points to be acted upon in timescales varying from within 28 days to "as soon as possible" (whatever that means). The nine actions - none of which, incidentally, challenged RAM methodology, covered six topics around OBIP implementation:
Tom Botts, Shell's Managing Director, apparently unchallenged by the outcome of the HSE investigation, appeared on the evening television news regretting the deaths and announcing that, nevertheless: "HSE had recently given Shell the all clear on safety".
A shambles of this scale and consequence was not inevitable. Workforce concerns could have been given theweight they deserved. In one example of many, on 12 March, Brent Bravo's resident platform electrician (RPE) sent a report up the line detailing concerns about the probable adverse consequences of OBIP. A copy is in Blowout's possession. Amongst many issues raised the RPE shows that pending reductions in electrical staff will lead to the loss of hard won platform-specific knowledge and experience. Platform electrical drawings, he confirmed, were in a poor state, a serious shortcoming for which a solution had long been promised but never delivered upon because of previous manpower cutbacks.
The RPE spells it out: "The move to flying squad EX inspection and maintenance squads, combined with the loss of a full-time platform inspector and the loss of a full time 1st line supervisor will result in a deterioration in quality control in vital safety related work".
He lists concrete examples to illustrate why OBIP as proposed will introduce significant hazards additional to those the workforce are already trying to cope with consequent to previous cut backs. The recent electric shock incident of an unsupervised electrician on the Brent Charlie, he said, was in part the outcome of cutbacks of the type now being contemplated on a much wider scale under OBIP.
Safety law requires prior consultation with employees to assess the risk implications of planned organisational changes. If consultation is measured by the extent to which management responds to workforce inputs, then consultation this was not. Pre-consultation OBIP proposals differ not a jot from what in the end got implemented. The Bravo's RPE was not alone in having his legitimate and authoritative concerns and suggestions ignored. As his pre-OBIP observation presciently put it: "It smacks of making the case for safety fit the business rather than making the business fit the case for safety".
As OBIP 'consultation' and 'implementation' played out across the Brents in the first half of 2003 contractors' safety representatives resigned en masse disgusted both at the failure of management to take seriously workforce safety concerns and the final straw of the botched extension offshore of the Working Time Directive. As one safety representative told Blowout: "We were just sick of being used as window dressing to give the appearance of consultation on health and safety issues when, in reality, the substance is zero".
Root cause analysis
A series of systemic failures set the scene for the deaths of these two young men. A dysfunctional safety management system, maladministration of the verification scheme, management refusal to countenance legitimate workforce safety concerns, HSE's preference for 'persuasion' where tougher sanctions could have been more effective, the cohort of disempowered and disillusioned safety representatives who absented themselves - all converged to leave the workforce naked and defenceless in the face of management determination to, yet again, cut costs using ill-considered methods.
Act or Omission?
Thirty-nine Wood Group employees were killed on the night Piper Alpha blew apart. To this day, a dozen of its ex-employees are walking wounded, their lives blighted forever by the negligence of those who owed them a duty of care. Back in 1988 Wood Group management did not interrogate Occidental on how safe was its offshore operation. There was just gratitude at the good fortune that had come the company's way in acquiring such a lucrative contract - a feeling shared by a workforce anticipating a steady wage for a couple of years. Piper Alpha was a death trap but, in fairness, Wood Group's sin in sending men out to it was one of omission. However, to do the same again would be a sin of commission, something we thought would never again happen in Britain's offshore oil and gas industry. Or are we just naive?
Digging ever deeper to the roots of this tragedy seems to expose more complexity and no doubt the 'official' report, when eventually it is made public, will reveal factors not even mentioned here. But at the end of the day one suspects simpler explanations: a workforce not angry enough about the treatment it is receiving and a complementary management that doesn't feel it has to try harder.
What went wrong?
Risk is a fact of industrial life and we have more than our fair share of it offshore. Only risk that is known about, quantified and adequately controlled is acceptable. Work activities conducted in circumstances where the degree of risk is unknown or misunderstood, or where there are misplaced assumptions about the effectiveness of precautions and control measures, is not risk management. It is chance taking.
Is that what happened here? If so, who were the gamblers: the lads who went down the leg to their deaths, or those who were running the show?
In the final analysis the law requires management to provide a safe place of work, including access and egress, safe systems of work (usually written), safe and suitable equipment, safe and competent fellow workers together with adequate supervision and instruction.
Management must plan what is done and make sure that people do what is planned. Employees, for their part are absolutely bound to co-operate with management to these ends.
This diagram usefully illustrates the essentials of a safety management system. It is for senior management to establish policy, organise and plan its implementation, measure progress and effectiveness and continually audit the performance both of the system and the people within it.
Senior management must provide sufficient resources to make the policy outcomes achievable. The shop floor must commit and contribute to achieving the common organisational goals.
Striking the balance between profitability and safety is a management skill not all managements achieve all of the time.
One thing is sure. Cost cutting, pushed through without sufficient thought to the consequences, or superimposed on an already dysfunctional system, tips the balance. Sometimes leading to unplanned events, other times, not. Uncertain outcomes. It's called gambling.
Click here to return to www.royaldutchshellplc.com
Click here to return to www.tellshell.net
Click here to return to Royal Dutch Shell Group .com