Former company auditor makes claims of serious breaches in safety standards and falsified maintenance records on North Sea fields
By Upstream staff
SHELL is facing a major new top management scandal following startling disclosures of how it persistently ignored critical safety warnings on its UK flagship Brent field in the North Sea by running its four platforms “flat out” while allegedly violating operating procedures, falsifying maintenance records and corruptly failing to maintain safety critical equipment.
In an exclusive interview with Upstream, Bill Campbell, a former Shell International group auditor in The Hague, reveals how in the late 1990s the top directors of Shell Expro in Aberdeen, the UK arm of the Anglo-Dutch group, allegedly sanctioned a policy widely known as Touch Fuck All (TFA), whereby offshore installation managers were told to stop any work with the potential to cause unplanned shutdowns.
The allegations levelled by Campbell against Malcolm Brinded, Shell’s group chief executive for global E&P, who was in charge of the UK business at the time, and his oil director Chris Finlayson, who is now country president of Shell Russia, claim the two men ran an operation where production took priority over safety concerns.
Upstream has also seen copies of a Shell internal audit from November 2003, two months after the deaths of two men in the utility leg on the Brent Bravo platform, which shows safety standards across a large number of Shell’s main European assets had deteriorated still further since the 1999 Platform Safety Management Review (PSMR). (See separate stories pages 28&29).
Campbell, who worked for Shell in many senior capacities for 24 years, was called upon by group management in The Hague to carry out a PSMR in 1999 of Shell Expro’s Northern Business Unit installations, including the four Brent plaforms, after growing internal concerns over major incidents on the company’s Cormorant Alpha and North Cormorant installations.
Campbell says he discovered that the TFA policy meant a significant proportion of essential maintenance on safety critical equipment was being deferred because of the risk that executing this maintenance might accidentally result in having to shut down production. His five-strong audit team found that, although the work had been deferred, it was still reported in-house as maintenance that had been completed.
Campbell alleges that his audit found that by manipulating technical integrity performance indicators, Brent asset manager David Bayliss had constantly fed false figures into the corporate database, indicating levels of compliance much higher than those actually achieved. For instance, the audit team discovered that while in August 1999 he was reporting 100% compliance with safety critical preventative maintenance on Brent Alpha, the actual figure was only about 14%.
The PSMR audit and many other Shell internal documents seen by Upstream have uncovered totally inappropriate attitudes, skills and behaviours that were evident in the operation of the four Brent installations. “During this time, the organisation lost control and opportunities were taken by people to run the business as they saw fit,” alleges Campbell. “It was organisational change for change sake. Morale was generally at rock bottom after large reductions in offshore staffing, and there were huge management failures in drawing up standards and a tendency for senior managers to grow their own rules,” he claims.
The PSMR audit found that the TFA acronym was in fact in widespread use in Shell Expro and appeared at every level in the Northern Business Unit, both onshore and offshore, on official notes and memoranda. Campbell discovered the TFA policy had by late 1999 resulted in 75% or more of safety critical elements (SCE), such as fire and gas detection systems on Brent, not being maintained within their specified period. Verification of SCE is a requirement placed on all operators by the UK Health&Safey Executive (HSE) under the provisions of the Prevention of Fire, Explosion&Emergency Response (PFEER) regulations.
Campbell says that when he and his audit team visited Brent they discovered about 30% to 40% of the equipment failed under test, even though under the regulations such equipment had to be available immediately if so required. Deluge and oil mist detector systems on all four platforms failed under test with huge risk implications for the platforms’ safety, he claims.
The findings of the Campbell-led review team, when taken together with a long-string of subsequent events, including the deaths of two men on Brent Bravo in 2003, now threaten to plunge Shell into its biggest internal crisis since Jeroen Van der Veer took over as chairman from Phil Watts, who was ousted by the board in early 2004 for having overstated the group’s oil reserves.
Upstream revealed earlier this month that Shell is still suffering major safety problems on its Brent Bravo platform, which has just suffered two gas leaks in three weeks, fuelling fears that little has improved since the 1999 PSMR on either the safety or regulatory Last week, Bravo experienced further problems when a water pipeline passing through the utility leg sprung a leak, forcing work in the leg to be suspended. Campbell believes the root-cause of Shell Expro’s current problems started with a re-organisation carried out by Brinded during the 1990s. As a consequence of Brinded’s enhanced Expro plan, the Brent business was merged with the Northern Business Unit, all of which was overseen by oil director Finlayson.
“Under Brinded’s regime, all the previously strong checks and balances whereby a director would have approached another were then played out by someone who was subordinate to the oil director, who at the same time was the person who was also driving the production,” claims Campbell.
Concurrently, the HSE function was downgraded so the manager responsible had to go through a long chain of command rather than, as previously, having a direct line to the top. Under Brinded’s changes, Campbell claims, the day-to-day power and authority for Brent operations was put under the control of asset manager Bayliss, who reported to Northern Business Unit general manager Jorn Berget, who in turn was accountable to Finlayson and ultimately Brinded.
Campbell was highly critical of Berget’s hands-off management style, which he argued let Bayliss run the Brent field assets with minimum oversight, effectively unchecked.
The PSMR audit, involving interviews with about 250 people, soon started to uncover the darkest truths about the way the Brent installations were being “sweated” for long periods in order to meet the heavy demands placed on the field by a highly lucrative gas nomination contract negotiated under Brinded. Shell and its 50:50 Brent partner ExxonMobil had spent about£1 billion in the 1990s converting the four large platforms to producing quite large volumes of low- pressure gas and relatively small quantities of oil. The ageing first-generation field, which started production in November 1976, was given a new lease of life in the 1990s and was then still supplying about one-third of the UK’s total gas demand.
Campbell argues that Shell failed to properly implement the recommendations of the 1999 audit team and that contributed in large measure to the situation when two men died on Brent Bravo on 11 September 2003. He claims the risk levels on the platform were so high that a major accident was inevitable as the time the platform was exposed to these risks increased. He alleges that the loss of safety consciousness among top managers in Shell Expro was so bad that the company was extremely lucky not to have suffered a more serious accident, perhaps even involving the loss of one of its platforms.
Shell tells Upstream it has taken the Campbell allegations very seriously. As a result of these concerns, it confirms that last year it launched a thorough and detailed independent internal investigation. “This recent investigation showed there had been a significant management response to the findings raised in the PSMR, including a detailed improvement plan with action being taken, and progress reviewed by senior management,” says Shell. The group says it responded vigorously and properly to the PSMR findings. “The allegation regarding operating with high-risk levels is untrue and we absolutely refute this. Safety is and will remain our first priority offshore. If the HSE considers this to be the case, they have the powers to require an immediate shutdown,” says Shell. Shell claimed the internal investigation team found that the allegations made by Campbell in December 2004 contained significant inferences and extrapolations of the PSMR findings which were not verified in the historical records of the PSMR, nor during interviews conducted by the investigation team last year.
Campbell, meanwhile, also exposes high-level incompetence and a chronic weakness in the application of the current Safety Case regime, including a failure of the verification process by the UK’s safety watchdog, the Offshore Division of the HSE, headed by Taf Powell. The offshore audit found that dangerous practices persisted as oil workers had been conditioned by management not to raise problems. Furthermore, external verifiers have a commercial relationship with the major oil companies, thus raising questions over their supposed independence. At that time, they also seemed to have no relationship with the HSE.
In the wake of the reserves debacle, Shell has sought to considerably strengthen its internal controls and Van der Veer has made attempts to start rebuilding the group’s reputational loss suffered as a result of the circumstances surrounding Watts’ exit. There is now a danger the group could be plunged into a new crisis by safety revelations that are potentially far more serious than the reserves issue.
Audit chief removed from review post after raising questions over management direction
By Upstream staff
SHELL failed to act on Bill Campbell’s central recommendation that its top three Brent managers should immediately be suspended from duty following his audit team’s devastating internal investigation revealing the negative safety culture across the field. Instead, UK chief Malcolm Brinded removed Campbell from his position as the lead role in the audit review team.
The conclusions of the hard-hitting Platform Safety Management Review (PSMR), seen by Upstream, will have made very uncomfortable reading for Brinded, then oil director Chris Finlayson and gas director Tom Botts, the three senior directors in charge of Shell Expro in late-1999.
The audit effectively confirmed workforce suspicions that safety was being compromised in the interests of production. Campbell was aware his audit team colleagues were unlikely to recommend the suspension of Shell Expro managers that they were working with as it would have put their own careers in jeopardy.
However, as head of the audit team representing parent company Shell International in The Hague, Campbell had no such inhibitions. At a meeting to present the team’s findings to Expro managers and directors on 22 October 1999, Campbell suggested, due to the gravity of its findings, including possible criminal conduct in alleged falsification of statutory maintenance records for ESD valves, that Northern Business Unit general manager Jorn Berget, Brent asset manager David Bayliss and his deputy Graham Birnie be immediately suspended from duty pending an inquiry.
“All the safety shortcuts being taken were largely due to the pressure being put on Bayliss and Birnie not to stop production. It was the extraordinary stress placed on Bayliss which caused all the problems as he knew if Shell didn’t meet its gas output targets it would lose money it was as simple as that,” Campbell claims.
The audit team recommended Expro directors should consider several actions, including immediately stopping Brent Bravo production, until such time as the “probably intolerable” risks of continual operations could be assessed and remedial action taken. It also highlighted unacceptable weaknesses and deficiency across the rest of the Brent field.
Among many PSMR conclusions on Brent it found a lack of controls in the inhibitions and overriding of safeguarding systems; a failure of the independent external and Shell internal verification process; a failure to ensure only competent staff who are assessed as such perform safety-critical roles; a failure to inform the workforce on Bravo of the intolerable risks and its causes; and a failure to notify the UK Health&Safety Executive (HSE) of the true circumstances surrounding maintenance on the field.
The PSMR concluded that safety claims being made at the time by the Aberdeen-based union the Offshore Industry Liaison Committee, which had appeared in the press, were entirely factual. “In fact, the situation was much worse. This will be a huge reputation issue if these findings leak on to the streets,” warned the PSMR review. The audit team found workforce consultation on Brent was not consistently applied and did not always seem to be in line with current legislation. On some installations visited, the safety representatives said they did not feel they had any influence at all over decisions. When interviewed by the audit team, some individuals in Shell Expro indicated they were having to deal with very high levels of stress.
Throughout the organisation many people up to management level were aware of the issues on the Brent field and were concerned, but still remained passive. Finalyson, who as oil director chaired the 22 October meeting, heard the PSMR presentation, made only a few comments but no firm commitment to take any action. An impasse had been reached between the two sides and Brent Bravo operations were allowed to carry on as if nothing had happened, it is claimed.
Campbell was “extremely disappointed” that NBU general manager Jorn Berget, Brent asset manager Bayliss, and his deputy Birnie did not show up for the meeting. Finlayson declined a suggestion from Campbell that the meeting be postponed as the three top Brent managers were all missing and most of the PSMR findings related to the field. Instead, Brent was represented by offshore installation manager Chris Blaydon. Otherwise, other members of the so-called Expro leadership team did attend the PSMR presentation, among others Botts and his general manager of southern operations Roger Colmer, central field manager Marc Carne, the financial director, the HSE manager, and the technical services manager. Campbell comments that Botts, who now heads up Shell’s European business, was made aware of the PSMR findings related to Brent “but seemed to appreciate my remarks that the gas business was not found to be a problem area”. Brinded had not been expected to attend the PSMR meeting, so the team had arranged a meeting with him the week after. However, before this could happen, without explanation, Campbell was dismissed by Brinded from his role as lead auditor. No reason was ever given by Shell Expro or by Brinded for the decision to remove the independent Shell International auditor.
Later, the PSMR team, now led by Campbell’s deputy Ken Merry, held a meeting with Brinded. Merry is alleged to have pointed the finger at Brinded telling him it was the audit team’s opinion that it was his key business drivers and the messages they were fostering that were creating the undesirable safety behaviour within the company. Brinded was allegedly told it was his gas nomination contract, his style of management, his enhanced Expro model and his decisions that had created the autonomous, self-regulating and aggressive band of managers at Shell Expro’s Seafield House offices in Aberdeen. Members of the team recall how “Brinded went ballistic”, threatening Merry for daring to speak out against him in such a manner and ordering him out of the room.
Shell tells Upstream in a statement that during the PSMR, Campbell’s relationship with many parties had deteriorated. “For this reason it was felt that he should not lead the final discussions with management,” it says. The group adds that the terms of reference for the PSMR did not extend to recommendations for changes to management.
“Campbell’s recommendations to remove individuals were not supported by other members of the PSMR team,” claims Shell. Campbell accuses Brinded, Finlayson and other Shell Expro directors of ignoring red danger signals. “I believe probably some 98% of Shell employees believe in the company’s corporate and ethical values contained in its ‘Statement of General Business Principles’ and want to operate that way. Then why was it that Brinded didn’t seem to really care?” asks Campbell.
After his removal from the audit team, Campbell returned to The Hague and tried to raise his concerns through Shell International Exploration & Production (SIEP) to the regional director with responsibility for the UK, and through SIEP’s HSE manager to the then director of SIEP. He believes Shell management did little to try and deal with those directly responsible for the safety problems, or to lower the overall safety risks on the Brent field in the years between his 1999 PSMR findings and the deaths of two men on Brent Bravo on 11 September 2003.
Finlayson left Expro in September 2000 and was subsequently promoted to become Shell’s country chairman in Nigeria, until last year when he became president of Shell Russia. Berget was promoted in January 2001, according to Campbell with Brinded’s support, to become regional production director for Shell Oil responsible for North and South America, in addition to being a board member of Enventure Technologies&Enterprise Products GP. In November 2004, Berget left Shell after being appointed executive vice president for BG Advance, part of the BG Group. Bayliss was known to have kept his Brent field job for a period after the PSMR audit team produced its findings. Investigations by Upstream have discovered he is still employed by Shell Expro as an operations manager for its northern installations in the Central North Sea, based at the company’s Tullos offices in Aberdeen.
By Upstream staff
THE UK’s offshore safety watchdog, the Health&Safety Executive (HSE), is shown in Bill Campbell’s evidence to be a deeply entrenched and secretive body, writes Christopher Hopson. He believes it has failed in its public duty to ensure proper verification of offshore safety systems, thereby increasing the risk levels on many of the UK’s ageing North Sea installations.
The implications from Campbell’s 1999 Platform Safety Management Review (PSMR) of Shell’s Northern Business Unit installations, and a Shell internal audit from November 2003, is that the current legislative regime has failed in its primary aim of reducing the risks to people working offshore.
After the July 1988 Piper Alpha disaster, Lord Cullen entrusted the UK oil and gas industry to take control of its own affairs, putting the responsibility for regulating offshore safety under the control of the HSE. Rather than recommending a prescriptive regulatory framework, he trusted operators to prepare their own case for safety, commonly referred to as a Safety Case. It is the operator, not the HSE, which decides what is important and what must be done in order to make an installation safe. Consequently, they are required to analyse the residual risks on their offshore installations and demonstrate to the regulator, and to their employees, that the operating risks are ‘as low as is reasonably practicable’ (ALARP).
The systems used to achieve this should be tested, or verified, by appointing an Independent and Competent Person through internal organisational means or the employment of an external body such as DNV, Lloyds Register or Bureau Veritas to ensure they meet pre-determined performance standards.
However, such a regime depends on operators acting in an open and frank manner, acting honourably and not being deceitful in demonstrating operating risks are ALARP. It is alleged, as in the case of Shell’s Brent field and others, that these checks have simply not worked and some oil companies have exploited the trust placed in them.
“The bottom line was that in 1999 safety on Brent Bravo was being run at above the ALARP levels published in its Safety Case. In fact it was being operated in the intolerable region,” claims Campbell. He believes oil companies have no option but to “keep up” with the growing problem of corrosion and internal erosion on older installations. “The problem is many North Sea platforms are now 25 to 30 years old and have reached the end of their design life. “Incrementally, on a day-to-day basis, the risks are steadily increasing, and essentially there is nothing we can do about it, apart from shutting down production for long periods of time,” he says.
Campbell claims the Brent platforms have probably now reached the stage where they are no longer maintainable at ALARP levels and never will be again. “They really have to shut all the platforms down for a year and replace all the hydrocarbon pipework and vessels, which have corroded and eroded, but nobody is going to do that unless they are forced,” he says. He points out that one unfortunate side effect for UK safety as a result of Cullen’s recommendations was that the HSE has ended up “twice removed” from the offshore hardware. “Effectively, the HSE is only there to regulate the management systems of the operator. So instead of having an inspection function with all those skills, it is essentially acting as an auditor, which is auditing business controls,” Campbell adds. He believes the proper operation of the UK industry’s safety verification schemes has entirely failed.
During his PSMR audit, Campbell claims to have discovered lots of false reporting when he questioned Shell Expro and the independent verification body staff to ask them how they tested the validity of information coming from offshore installations. Under interview, Campbell says many confirmed the verification information on Brent was just not at all accurate. Shell Expro’s internal verification body, known as HSE/4, was found to lack influence and authority. The PSMR found staff were aware of the manifest shortcomings of the verification scheme but were unable to influence matters. Therefore they appeared to passively accept the situation.
Campbell says that when he asked inspectors from an independent external verification body whether they had ever signed off equipment that was not working, they confirmed they had done so. He claims they simply saw their role as verifying equipment against what the operator told them was their performance criteria. Campbell claims that although the verification body seemed to be aware that there was ‘goal-widening’ regarding standards, it still signed off the equipment. “They simply declared they had no authority to question the efficacy of the standard,” says Campbell. “Under interview, they confirmed the whole verification scheme was a complete sham.”
The verification body allegedly claimed the HSE had not shown any interest in the offshore verification scheme, it had never met anyone from its Offshore Safety Division (OSD) in an official capacity and it had never been in touch to discuss the agency’s role in the verification process. The verification body, just like HSE/4, admitted to having had difficulty in getting meetings with Brent asset manager David Bayliss and getting access to the Brent platforms.
Under interview with Campbell, the inspector also alleged that because he was bullied and coerced he had prematurely signed off paperwork indicating that offshore safety systems he knew to have defects were in order. The inspector allegedly indicated it was quite common to find whole sections of Brent’s fire and gas systems inhibited and therefore unable to be tested at any time during his visit. He was not aware of whether such large-scale inhibition of safety systems had been authorised, but was of the opinion such a modus operandi must increase the risks of a hydrocarbon event not being picked up and/or escalating out of control.
Campbell believes the OSD should have shown a much greater interest in taking an oversight of the whole verification process. He claims that by the time the HSE gets around to issuing improvement or even prohibition notices it is already too late. “The OSD themselves don’t seem to fully understand their role under the Safety Case regulations. It wasn’t designed as some gentleman’s agreement to be made with operators that would allow the risks on offshore installations to get higher. It was to act to stop those risks from getting that high in the first place,” argues Campbell. “When the offshore worker representation scheme envisaged by Cullen is failing and the operator and OSD are incompetent in ensuring actions to reduce ALARP are carried out in a timely fashion, then the whole offshore safety system is simply failing,” he claims.
The HSE claims that today it does have a different overall approach to verification than existed in 1999 and 2003, and that it does now engage with independent external agencies as well as UK North Sea operators. The HSE tells Upstream in a statement: “Inspection techniques include witnessing of physical testing of safety critical plant and equipment against stated performance standards as well as interrogation of records and information generated by the independent verification bodies such as Lloyd’s Register and DNV.”
The HSE confirms it was not informed in 1999 of the results of Campbell’s PSMR audit. “The HSE became aware of the PSMR in October 2003 as the result of information provided by a Shell employee involved in the work, who felt the information could be of assistance in the investigation of Brent Bravo fatalities,” says the HSE. The safety watchdog says it had “no reason to believe there was intended deception on the part of Shell” as the company had acknowledged its verification scheme was not giving it assurance of asset integrity. “Companies would not be required to inform HSE, nor would HSE expect to be routinely told about the results of this work, although inspectors may, as part of their intervention strategies, discuss such reviews and look at actions taken to address the findings,” the HSE adds.
The HSE says during this time, although it was not made aware of the PSMR findings, it was concerned about the deteriorating condition of Shell’s installations in the Northern Business Unit. “A team of inspectors critically examined, in depth, Shell’s verification system. “As a result, HSE identified weaknesses in Shell’s management of safety and between 2000 and 2002 served eight improvement notices on the company including for Cormorant Alpha for failing to monitor the maintenance of safety critical systems adequately,” the HSE adds. Campbell points out a weakness of Lord Cullen’s approach is that it was believed that once a Safety Case was granted to an operator “we would sail into some mythical steady state situation” on offshore installations where the risks would not change.
After the two deaths on Brent Bravo in 2003 and right up to 2005, Shell’s own database shows there does not seem to have been much improvement to the verification scheme. “Even now, there are still apparent anomalies in the reporting of tests on ESD valves and literally hundreds of fire and gas sensors fail to show danger when tested 290-odd on one Shell installation alone,” Campbell claims. Campbell has, over recent years and particularly since the Brent Bravo deaths, asked the OSD to act on the fact Shell was, in his view, “criminally negligent”.
Goal-widening rather than goal-setting Questions over ‘corrupt and deeply flawed independent verification process’ but directors not seen as at fault by company if wrongdoing occurred
By Upstream staff
ABERDEEN-based Wood Group, the main Brent field contractor, also took stinging criticism from former Shell International group auditor Bill Campbell. Wood Group managers onshore told the Platform Safety Management Review (PSMR) audit team they knew full well that Brent field maintenance reports had been falsified and they accepted the situation. The contractor is accused in the PSMR of colluding with Brent asset manager David Bayliss “in inappropriate and unauthorised planned maintenance deferral”, including putting 98 overrides on the Brent Delta fire and gas detection system and 29 such overrides on Brent Bravo.
“Many of these overrides were not even authorised,” claims Campbell. Campbell claims Bayliss built a reputation internally for “goal-widening rather than goal-setting on safety”, exposing about 700 Brent field workers under his charge to excessive risks over a long period. Campbell says he discovered “a corrupt and deeply flawed independent verification process that simply allowed performance criteria to be widened”.
Perhaps most disturbing of all, according to Campbell, it was established during the investigation that when Brent emergency shutdown (ESD) valves failed their leak-off tests, deputy asset manager Graham Birnie had on several occasions arranged for the test records to show “test acceptable, no fault found”. On each occasion, when an ESD valve failed a test, the installations were started up with no attempt at any risk assessment. Evidence gathered in the audit indicates that when some weeks later these risk assessments were eventually produced they indicated that the operating risks were not acceptable. The fitting of ESD valves to all of the UK’s offshore oil and gas platforms was one of the early moves following Occidental’s Piper Alpha disaster in July 1988 when 167 workers were killed. The industry standard for ESD leak-off rates for these valves when installed, adopted by Shell, was no more than 1 cubic metre per minute.
Campbell alleges Bayliss amended this standard to “if greater than 20 cubic metres per minute replace at the next shutdown”. The rest of Shell Expro, the Central and Southern field units all at the time maintained the original Expro standard.
According to Campbell, on 15 October 1999 Birnie, also under interview, quite casually agreed that he had “doctored ESD maintenance records” and even pulled into the interview a Wood Group process engineer in an attempt to justify the continued operation of an oil separator in violation of Expro codes of practice.
Wood Group, approached by Upstream with eight detailed questions regarding the Campbell allegations over its role as the main Brent field contractor, says it is awaiting the imminent Fatal Accident Inquiry determination and therefore does not feel it appropriate to comment.
Shell tells Upstream it is simply not true that Shell Expro senior management in the 1990s allowed goal-widening on safety, while the Brent assets were being “sweated” for long periods in order to meet heavy production demands. Shell believes its audit investigation team fully examined Campbell’s allegations of goal-widening last year but were unable to find any definitive evidence to support such allegations. Also the company does not believe there was a deliberate falsification of records. “Changes to safety criteria were carried out through due process as part of our quantitative risk assessment in consultation with the relevant Shell technical authority,” says the group.
Lord Cullen’s report found it was the lack of ESD valves on main pipelines that had ultimately caused the destruction of the Piper Alpha platform. An early recommendation was that such valves should be immediately installed on all offshore production installations a move made by the industry in the early 1990s, spending billions on installing such valves across the UK North Sea.
Campbell’s disclosures also show that data on ESD valves on a gas riser line and an oil riser line, both on Brent Delta, had failed to operate in accordance with performance standards set out in the Safety Case between 1999 to 2003.
Under interview by the audit team, Gordon Muir, then the Brent engineering manager, admitted he was “terrified by what Bayliss and Birnie were getting up to”. Campbell says when he was made aware of the changes Bayliss was getting Wood Group to do for him, Muir said he had no knowledge, even though he was the only recognised authority for any engineering change on Brent. Bayliss was interviewed by Campbell and other audit team members Ken Merry and Keith Mutimer in his office in Shell Expro’s Seafield House in Aberdeen.
Campbell, who describes Bayliss as “a complex character”, says the team went through a litany of concerns. At the end of a long interview, Bayliss, according to Campbell, shook his head in the affirmative and acknowledged it was “a fair cop”, admitting he just tried everything so he did not have to shut down the Brent field. During the interview, he blamed Brinded for putting him under intolerable pressure, according to Campbell. “Running Brent was just like flying an aircraft with one engine. You knew the consequences if the second engine failed but you just accepted it. The whole safety ethos was built on a basis of sand,” Campbell concludes.
By Upstream staff
SUSTAINED pressure on Shell’s directors finally paid dividends last year when Bill Campbell, by then an ex-employee but still a shareholder, finally managed to persuade the group to carry out an internal investigation into his audit claims, resulting in a meeting with company chief executive Jeroen Van der Veer, writes Christopher Hopson.
Campbell had in December 2004 written a letter to Malcolm Brinded, who by then had been promoted to Shell’s global head of exploration and production, outlining his concerns over the way Brinded, then oil director Chris Finlayson and the Brent managers had failed to act on his Platform Safety Management Review (PSMR) recommendations.
Following the reserves debacle in early 2004, Shell introduced a new set of internal controls so that any complaint against the conduct of one of its directors was immediately passed on to the internal audit department in The Hague, which then pursues an investigation.
So it was that an investigation was carried out last year, led by Shell International’s chief internal auditor Jakob Stausholm, together with Richard Sykes, a senior environmental adviser. Their terms of reference were to investigate Campbell’s concerns as expressed in his 21 December 2004 letter to Brinded a copy of which has been seen by Upstream.
According to Campbell, the audit team, which spent three to four months interviewing about 100 people within Shell, backed him, finding no evidence that Shell had carried out any of the immediate actions recommended in Campbell’s 1999 PSMR audit to reduce the risks on Brent Bravo. Campbell says they also discovered that only about 20% of the behavioural recommendations in his PSMR audit had been acted upon, while 80% of his recommendations still remained to be carried out “some five years after” he had submitted the findings to Shell Expro directors.
However, Shell tells Upstream that its audit investigations did not reveal this. “Shell responded vigorously and properly to the PSMR findings. As part of this follow up audit we interviewed all relevant people, including retired people, and did not find this. “A follow up review of the PSMR report was published in February 2001. The review found that much had been improved. It did recognise that Business Units continued to find it difficult to close out actions targeted at behavioural change, which as we explained take longer. The review identified areas for further attention which were all followed up,” adds Shell.
Campbell says the investigation report claimed that Shell had now accepted that the risks on Brent were dangerously high in 1999. They also established that the Campbell-led PSMR had been handled well and in an open way that was in line with Shell International Exploration&Production guidelines.
Campbell claims Finlayson admitted to the investigators that at the time he had given false and misleading information to the workforce, to the press, and wider society. In September 1999, the oil director had vigorously denied concerns raised by the OILC union that Shell Expro was operating in an unsafe manner by not carrying out maintenance on its safety critical equipment to cut costs, curtailing safety checks and overlooking design defects. At the time, Shell Expro, backed up by the oil industry body the UK Offshore Operators Association, had all rounded on the Oil Industry Liaison Committee (OILC), accusing the union of “scaremongering” tactics over its safety concerns.
Brinded was asked by the investigators why he had dismissed Campbell as head of the audit team in 1999. He answered that he did not think Northern Business Unit general manager Jorn Berget would have been receptive to Campbell carrying on and implementing the PSMR findings. “It is hardly surprising that Berget would not be receptive to me carrying out my recommendations because one of them was that he should be sacked. The investigation could find no other explanation as to why Brinded had kept him on,” says Campbell.
Campbell finally met with Shell’s chief executive Jeroen Van der Veer to discuss the findings of the internal investigation during the evening of 25 July 2005 at its headquarters in The Hague. Also present at that meeting were Shell’s group legal counsel Bert Hess, plus Stausholm and Sykes. “I pointed out that I believed Stausholm and Sykes had generally done as good a job as they could with their investigation because there were still people in the Shell organisation who believed they hadn’t done anything wrong in 1999,” Campbell says. “Generally, I felt their findings supported my position, although there were some things I didn’t agree with. They confirmed the risks on Brent were high in 1999 and remained high in 2003 when two men were killed on Brent Bravo,” he adds. He says he told Van der Veer that “even if you can’t say directly, I think there was a causal linkage between what happened in 1999 and 2003 which led to the deaths of those two individuals”. Hess allegedly said he could not accept there was a direct linkage, but accepted there were indirect linkages. “What I said and Van der Veer seemed to agree to an extent was that if you create the conditions on an offshore installation where the risks are dangerously high and those risks exist for a prolonged period, then it becomes inevitable that over time you will have a major accident,” says Campbell. According to Campbell, both Van der Veer and Hess seemed to accept that principle.
However, while it would be difficult for Van der Veer to deny that the company operated unsafely in 1999, and even illegally in 2003 which is why it pleaded guilty in court to breaches of the law that caused the deaths of two men Campbell says Van der Veer would not accept that this should be laid at the door of the directors. “I said in that case we are 180 degrees apart as it was the directors who took the decisions that created this state of affairs. “We had an oil director in Finlayson who made false statements to the workforce and press; and Brinded, who now says he accepted the PSMR findings, but did nothing to act on its recommendations,” argues Campbell. Van der Veer allegedly would not respond to that central point and the meeting was abruptly brought to an end.
Campbell was not allowed to have a copy of the investigation findings, or to see the recommended action as, he was told, this was work still in progress, which Hess would complete and present to Van der Veer at a later juncture.
On subsequently following up on the issue some time later Campbell was told that Van der Veer had sent a letter to Brinded informing him that Shell Expro had been sailing very close to the wind in 1999. Campbell remains deeply unhappy over such an outcome and maintains Shell’s directors should now take full responsibility for their actions.
By Upstream staff
BILL Campbell developed a real passion for safety issues from an early age by learning the lessons from UK coal-mining disasters as to how best to protect workers against the ever-present threat of an industrial accident in a high-risk business, writes Christopher Hopson.
Today, as a seasoned technical professional, he can rightly boast at having spent over 40 years as a much sought-after safety expert with wide experience in both the UK mining and international oil and gas industries. “From a very early age I became interested in the behaviours of people who get themselves hurt,” he recalls.
Campbell started his working life in his mid-teens during the 1960s as an electrical engineering apprentice with the UK’s National Coal Board (NCB). “I guess my early real interest in safety developed during training and working underground. You very quickly realised that to survive in the coal mining industry you needed an almost intuitive sense of how to look after yourself,” Campbell says. “I witnessed some horrific coal mining accidents… and realised the suddenness of the loss of people. I also saw a lot of people with their heads in their hands who were sorry after the event, even though the circumstances had often prevailed for some considerable time,” he adds.
Campbell qualified with a BSc in Electrical Power and Electronic Engineering at Strathclyde University in 1975 and then returned to the NCB. He made the switch from coal to the oil industry in 1979, moving to Aberdeen to join Shell Expro as a senior commissioning engineer.
He worked for Shell in many senior capacities for 24 years until he retired in 2002. “I got a bit of a shock when I joined Shell because the oil business at that time wasn’t the efficient, modern industry I had imagined,” he says. “In fact, compared to mining it seemed to me to be a wasteful industry. Also, the technology at that time was what I would consider to be medieval.”
On joining Shell, Campbell was initially involved from 1979 to 1984 in commissioning North Sea equipment that was under construction at Lowestoft on the English east coast. Later he moved on from this commissioning role to become a senior electrical engineer for offshore commissioning on the Dunlin and Cormorant Alpha offshore installations, and a senior facilities design engineer for modifications to the Dunlin, North Cormorant and Cormorant A installations. At one stage in the early 1980s he was a facilities design engineer responsible for supervising a troop of engineers who were carrying out minor design changes on installations.
Campbell was one of the first technically qualified offshore installation managers (OIM) when he was put in charge of Shell’s Brent Alpha platform in the UK northern North Sea in 1984. In 1986 he moved to London to become operations adviser for the Eider platform during the detailed design phase, training operations staff and commissioning modules in Middlesborough. Offshore he worked on Eider construction and then as the operations OIM from first oil.
During 1990 to 1993 he was made asset manager of the Cormorant Alpha platform with an annual operating expenditure budget of around£80 million. During that time he managed the installation of emergency shutdown valves and other safety modifications on Cormorant Alpha, including a new temporary refuge.
Campbell subsequently became Shell Expro’s head of production operations and maintenance strategy from 1993 to 1996, responsible as head of a department that set the standards of competence for essential training and emergency response. He led a team that reviewed Shell Expro’s internal maintenance and inspection strategy, which for the first time carried out an analysis of Expro’s safety critical production equipment. “It was my department which actually developed the independent internal verification process,” he recalls fondly.
His straightforward, no-nonsense style won him many admirers within Shell, where he is widely remembered for his thoroughly professional approach, rooted in a deep belief in Shell’s business principles and the need to put safety first.
In 1996 he then moved to Shell International Exploration&Production (SIEP) in The Hague where he worked in a variety of posts: serving as a senior maintenance engineer (1996 to 2000); global consultant (1999 to 2001); HSE group auditor (1998 to 2001), and finally internal audit manager (from 2000 to 2002). He took early retirement from Shell in June 2002.
During that period Campbell led between 27 and 30 safety audits for SIEP worldwide. “Probably around 50% of those were satisfactory and some 50% were not,” he calculates. It was during that period, in 1999, that he was called back to Aberdeen to carry out the PSMR audit for Shell Expro. It was there that the real story begins.
By Upstream staff
Letter from Bill Campbell: Former Shell International group auditor
In response to the letter from Bjorn Edlund (Upstream 23 June 2006), the Platform Safety Management Review (PSMR) was actually commissioned because Shell experienced a number of serious incidents and the internal audit process was raising increasing numbers of serious findings.
The PSMR covered all of Shell Expro but the significant concerns lay in the operation of the Brent facilities. Brent Bravo in particular was being run with residual risks estimated by the team to be in the intolerable region. Although Mr Edlund stresses the importance of the improvement plans put in place post-PSMR, these plans appear to have been totally ineffective or not fully applied.
What the Shell internal investigation actually reported was that it found no evidence that the short-term measures recommended in 1999 to reduce risk immediately on Brent Bravo were ever carried out and the long-term actions to reverse the negative safety culture were truncated when only 20% complete.
It also reported that almost no files were now available in Shell’s internal audit department in Aberdeen related to PSMR, as they had gone missing, and that the PSMR files held in The Hague had to be replaced in 2003 by me, as they had also gone missing. As an indication that things had not improved from 1999, an internal investigation team reviewed the situation on the Brent facilities in 2003 in the weeks following the major accident.
It was observed by this team set up by the production director that there were:
•97 temporary repairs on pipework, 40 of which were not approved
•56 gas detectors, 26 toxic gas detectors, nine oil mist detectors, five flame detectors, one smoke detector and one general platform alarm point that failed to danger, that is, may not have operated on demand in the event of a major release of hydrocarbons
•A number of ESD valves that had their leak-off test results falsified, the same finding as in 1999. Plus, and most importantly, the persistence of a negative safety culture appeared to be normalised behaviour.
These findings were supported by an independent review of Shell operations by the Offshore Safety Division of the HSE. Mr Edlund makes the comment that Shell is committed to achieving continuous improvement in safety performance and part of this commitment includes a $1 billion integrity upgrade programme.
This statement is extremely misleading. Shell, as with other operators in the North Sea, has submitted Safety Cases for all their offshore installations. The Offshore Installation Safety Case Regulations places a duty on a Duty Holder to ensure offshore installations are operated in compliance with their Safety Case at all times it is a criminal offence not to do so.
In allowing all of its 15 offshore installations (as covered in the technical integrity review in 2003) to deteriorate to the condition that now requires $1 billion expenditure, Shell has operated with neglect in that the risks on all its installations are not at ALARP (as low as is reasonably practicable) levels but are at levels probably unacceptable to society.
Their workers, who should have been made aware of these increased risks and of the remedial action to immediately reduce those risks in 2003, were not so made aware. Mr Edlund’s improvements, if you can call them such, are in reality just to return the risk levels on the 15 offshore installations to the ALARP levels as published in their respective Safety Cases at the time they were issued and accepted by the OSD.
Until these levels are returned to the published and accepted ALARP values then the offshore workforce on the 15 installations are subject to heightened risk levels with the increased probability that a major accident event can occur in the interim period.
Bill Campbell
Former Shell International group auditor
By James MacKenzie
Shell has been slammed for management failures and equipment defects by a Scottish Fatal Accident Inquiry (FAI) into the deaths of two workers in the utility leg of the Brent Bravo platform in the UK North Sea on 11 September 2003.
Sean McCue, 22, from Kennoway in Fife, and Keith Moncrieff, aged 45, from Invergowrie, Tayside, died when they were overcome by a large release of hydrocarbon gas.
It was found the accident might have been prevented if the company had acted properly in dealing with a temporary repair on a leaking pipe. Aberdeen Sheriff Colin Harris said in his FAI determination that the deaths may have been prevented if a temporary repair had been managed and the risk of working inthe leg had been properly assessed. An emergency shutdown valve failed, as well as two others, allowing oil and gas to travel into the pipeline and leg where the men were working.
Shell has already been fined£900,000 ($1.7 million) at Stonehaven Sheriff Court in Scotland last year after pleading guilty to breaches of sections two and three of the 1974 Health&Safety at Work Act, including failing to carry out a risk assessment on the platform.
The 38-day FAI in Aberdeen, conducted by Harris, took evidence from 61 witnesses. His long-awaited final determination is a major disappointment to the unions, offshore workers and the relatives of the two dead men who have campaigned for a better UK offshore safety regime.
Harris said during the course of the inquiry it became apparent that evidence relating to the condition of certain valves on the platform might be relevant to the cause of the deaths of the two men, or have contributed to the incident that resulted in their deaths. However, he added that certain evidence, such as the possible consequences to the structure of the platform, and its crew, of the ignition of the vapour within the utility shaft, while of concern to some of the parties and no doubt of importance to the offshore industry and those who work in it, was “in my opinion more appropriate for consideration at an inquiry of a more general nature”.
Speaking in Upstream on 16 June 2006, former Shell International group auditor Bill Campbell said that during a platform safety management review in 1999 he had been particularly shocked at what he had discovered on Brent Bravo, which was being run with dangerously high levels of risk. He said he found equipment was being operated in a dangerous condition, vital maintenance was being ignored and that this was covered up.
Campbell had sent his evidence to the Procurator Fiscal’s office in Aberdeen in October 2005 in the hope of getting it heard at the FAI. However on the advice of the Health&Safety Executive the material was deemed as not relevant to be heard at the inquiry.
Shell said it fully accepted the sheriff’s findings.
“In the three years since this tragic incident we have worked hard to understand the root causes of why it happened and have put measures in place to prevent anything like this happening again,” said the company. “Immediately following the tragedy we initiated a thorough review of all our North Sea offshore installations. With this input and the root cause analysis, we have made significant improvements in our systems, procedures and offshore training programmes. These improvements, some of which were reflected in the sheriff’s determination, have resulted in a safer offshore working environment on Shell’s installations. “Today, our safety procedures and our physical integrity are demonstrably better: corrosion management and maintenance regimes are more thoroughly managed; a new electronic permit-to-work system is in operation; training for leg entry and the use of breathing equipment is more robust; we are removing all volatile hydrocarbons from platform legs; and have sponsored research into the narcotic effects of hydrocarbon gas, about which the industry knew very little three years ago. “We are committed to achieving continuous improvement in our safety performance and we have seen positive results in the last few years. However, we fully accept that there is still much we need to do to achieve the safety performance we seek and to meet our goal of zero incidents,” added Shell.