On 11 September 2003, Sean McCue and Keith Moncrieff died whilst working in the utilities shaft of Shell's Brent Bravo production platform. At 15.35 hours they entered the concrete leg to check the condition of a leaking temporary pipe patch on a 4-inch drain line located on the 81metre level approximately 70 metres below deck level. Shortly after they had reached the work site gas detectors started to pick up the presence of gas. The men reported to the platform control room that there was a significant leak of liquid from the pipe patch and they were trying to stop it. A general platform alarm was initiated automatically by the fire and gas system followed by a process blowdown. The recovery team entered the shaft some three and a half hours later once the atmosphere had been confirmed as gas free and found the bodies of the technicians at 19.15 hours. Cause of death was later confirmed as asphyxiation.

The full story of how the two men met their deaths has yet to be made public. The HSE and the Police have each investigated, and their respective reports are with the Procurator Fiscal on whose say a prosecution of Shell will depend. The HSE are necessarily tight-lipped on the outcome of their investigation pending a decision on prosecution.

Shell's initial investigation into the causes of the tragedy indicated that a jubilee clip fixing a neoprene patch on the 4-inch degasser line had been slackened. This caused a leak of oily water from the pipe resulting in gas condensate flashing to a heavier than air gas. As events unfolded over a period of some ten minutes, the rate of release and quantity of gas increased sufficiently to overcome the two men who did not put on their emergency re-breathing apparatus.

In addition to defective plant there were fundamental root cause failures in the management systems. For example, in the months preceding the incident, major organisational change designed to save money, and acknowledged as having the potential to seriously impair safety, was badly botched. Safety procedures and routines on the installation had fallen into disuse. Audit and monitoring mechanisms designed to inform senior managers of developing problems had long ceased to be effective. For 2 years and more workforce warnings of danger had been judged worthless by Shell and Wood Group managements.

The events on the day
No permit was issued prior to entry into the utilities shaft on the basis that Sean McCue, a Shell technician, was classified as "leg authorised" as opposed to "leg competent"(the latter requires both a permit and the presence of a leg-entry sentry). Keith Moncrieff, a Wood Group technician, went along to assist. Overall supervisory responsibility in such instances rests with the Process Shift Supervisor and here a major uncertainty emerges. Not specified in any document, what precisely was the intended scope of work?

One Shell manager discussing this with OILC expressed his belief that the work scope was simply to perform a visual inspection. The two men were to check the condition of a neoprene repair patch fitted some 20 months earlier on a leak on the 4-inch closed drain line. However, included in the equipment found at the worksite was a fresh piece of neoprene, snips and a screwdriver suggesting that the intention was from the beginning to intervene in some material way. It is clear that one of the jubilee clips on the patch had been slackened.

The function of this 4-inch pipe is to drain the closed drain degasser unit. Oily water had accumulated in the pipe at a pressure relative to the column of water within. When this water leaked through the patch it passed to the level below and gas condensate held in suspension in the water flashed out as a heavier than air vapour setting off a series of at first low, followed by high, gas alarms. Eventually, the General Platform Alarm (GPA) was automatically triggered. As events unfolded the men had discussed with the control room options for stopping the leak rather than evacuation. Blowout's information is that, at first, no attempt was made to advise the men to evacuate the shaft until after the GPA had activated, by which time events were rapidly overtaking them.

Sudden rush of gas
Why did the situation escalate so suddenly? Not known to the men, or to the control room operators, the small amount of condensate present in the 4-inch drain line had apparently migrated there through a couple of leaking valves situated between it and the High Pressure Flare Header. The route from the Header to the patched 4-inch drain line was through the Storage Import Manifold. When process shutdown was initiated and blowdown commenced vast quantities of high-pressure gas condensate passed into the HP Flare Header, as it is designed to do as part of the blowdown sequence, and from there found its way through the faulty valves to the 4-inch drain line where the men were present. What had started as a run of water from a leaking pipe became a torrent of high-pressure gas. At least one of the passing valves had had reliability problems for at least two years. Despite its status as safety critical, necessary remedial work had never been done.

The men had taken with them into the utilities shaft a UHF hand held radio known to be reliable and functioning. However, radio communication whilst in the shaft is dependent on repeater antennae at various levels so as to relay signals up and down the shaft. Contact with the control room was lost when power tripped out consequent to blowdown. The contingency for this event is the UPS (Uninterrupted Power Supply), an auxiliary power system designed to kick in immediatly main platform power is lost thereby ensuring that safety-related and emergency response systems remain powered up. However, because of non-completed electrical maintenance elsewhere on the installation, the UPS failed to maintain power to the repeaters.

With contact with the control room now lost, disorientated and deluged by gas, the men unsuccessfully tried to escape.

Near disaster
Not stated in Shell's interim report is that, devastating as the two deaths are, the unrealised potential was so much more severe. Had the gas/air mixture ignited within the concrete shaft the topsides of the installation would likely have suffered catastrophic damage. The calculation is not difficult to make. The initiating explosion of a lesser volume of condensate on Piper Alpha caused extensive structural damage and destroyed the control room but the effects of blast were significantly lessened because bulkheads blew out allowing blast overpressures to vent to open air. No such mitigating factor existed 76 metres down Brent Bravo's concrete utilities shaft. The only way is up.

But sources of ignition are never tolerated in potentially explosive atmospheres, right? Wrong. Some weeks after the tragedy during a general clean up within the utilities shaft damaged light fittings were discovered close to the 4-inch drain line. Two lights were badly damaged, the battery section of one them cracked open and detached from the main battery. The investigation could not determine what caused the damage nor for how long the electrical faults had existed. A Shell report confirms: "The damage is such that the EX rating of the fittings has been compromised".

HSE investigation
Before departing the Brent Bravo on 15 September the HSE accident investigation team issued a Prohibition Notice forbidding the use of certain items of plant and equipment. A second Prohibition Notice was served on 19 September halting all production and processing of hydrocarbons until certain pre-start conditions were met. Additionally, two control valves were taken into possession for forensic tests. Unconnected with the incident in which the two men were killed a third Prohibition Notice was served relating to an incident on13 September where a pipe being moved from the pipe deck to the catwalk fell and became lodged in the substructure below the drillfloor.

The four "lessons"
Shell's preliminary report into the 11 September deaths lists lessons learned as:
 

The procedures governing leg entry and gas hazard response (i.e. immediate evacuation and/or donning of re-breathers) were not apparently followed

That the company intends to better manage the patches on its corroded pipes, at first induces relief until one realises that what is meant is, patches will be more closely monitored, not necessarily new or repaired pipes installed. On the day of the deaths 69 corroded pipes were running with temporary patches in the Brent field. 'Temporary' is actually a misnomer as patches are frequently re-classified as 'permanent' to the extent that, short of failure, no further intervention is intended. Indeed, an opportunity to replace the patched 4-inch degasser drain line was only weeks earlier rejected during a platform maintenance shutdown so as not to delay production start up.

Shell's second "lesson" is the need "to improve the assessment of risks associated with interconnected systems". The law requires a system of written permits to work (PTWs) where the magnitude of the risk demands stringent control. That just about captures every conceivable intervention associated with hydrocarbons processes on an offshore production platform. Why, then, did a PTW in this case fail to prevent the deaths? Teething problems had been experienced following a recent shift to an electronic system. There was also the increasing reliance on a so-called "umbrella" PTW, the purpose of which is to authorise routine operational activities on the process side. The evidence shows that this arrangement had mutated into a virtual license to roam into whatever area or activity thought necessary to ensure steady-state production was not interrupted. Indeed, the entry of the two men into the confined space of the utilities shaft on the day of their deaths was exactly on this basis.

The third "lesson" is that rapid asphyxiation in oxygen deficient atmospheres "needs to be better understood by the workforce". So, too, by those who manage them?

Fourthly, the report says, "procedures governing leg entry and gas hazard response (i.e. immediate evacuation and/or donning of re-breathers) were not apparently followed". The HSE ACoP on confined space entry does not apply offshore but it is for Shell to devise arrangements and procedures at least as stringent as those in the AcoP, which they had apparently done. However, on the day these two lads died this procedure had long since been a dead letter of the law.

Unique conditions?
On 25 September Shell's Production Director, Greg Hill, wrote to staff outlining progress on learning the four "lessons". He implored: "we simply cannot become complacent in our attitudes and approach to safety. Like all accidents, this one was clearly preventable". As to cause he added, "There were a number of unique conditions that perfectly aligned at a moment in time to create danger and tragedy. If any one of these conditions had they been slightly different, it would not have occurred". (sic) He reminded staff in conclusion that: "they need to concentrate on two very important areas - accountability for safety and overall integrity".

Not much to quibble about here except that in Shell's preliminary report no trace of "unique" conditions may be found. All the causal factors identified were, in every way, not unique. Leaks from hydrocarbon systems usually consist of hydrocarbons. If such a leak is into a confined space it is quite normal to find hydrocarbons there. It is not unique to ensure that people entering the space are warned and properly protected. The object is to prevent the expected. For example, where gas migration is certain to occur with potentially devastating consequences unless prevented, valves, whose performance and integrity is assured, must be installed. Management systems and resources must be provided to that end. This common sense principle is codified in law by, among other things, the Verification Scheme (regulation 15: Safety Case Regulations 1996).

Verification failures?
The Verification Scheme requires that for the full life of the installation a detailed written scheme should list all safety critical elements. Any valve, structure, plant, equipment, system or component whose failure could cause or contribute substantially to a major accident is safety critical. The passing valves through which gas condensate leaked to the 4-inch line were safety critical. They should have been fit for the intended purpose of containing hydrocarbons under pressure, dependable and effective and able to perform as specified. The duty holder must also appoint an independent competent person to audit the scheme. Any error, failure, performance deficiency or maintenance shortfall in a safety critical item must be prevented where practicable or, where not, remedial action taken. The HSE investigators are looking at the failures of verification on Brent Bravo and asking the question: were they generic to all Shell installations?

The evidence is overwhelmingly yes. In mid-2002 HSE served on Shell no less than five Improvement Notices following verification failures on five installations. Clearly without success, the HSE had been coaching the company in an attempt to get it out of its verification difficulties. As far back as 21 December 2000, HSE Inspector Thompson, served an Improvement Notice on the company's Cormorant Alpha platform because of recurring verification failures. His accompanying letter stated:

 

"As the identified breach of Safety Case Regulations 15 is likely to have wider Shell corporate implications within UK operations, we shall be writing to you separately to ensure that action is taken in a planned and prioritised manner to review and revise as necessary the verification arrangements for all other UK offshore installations".

Nearly 3 years later on Brent Bravo, that action had yet to be taken.

Workforce sidelined
Many other opportunities to prevent the two deaths came and went on the Brent Bravo. For example, for three-plus years the workforce on all four Brent platforms had been protesting that recurring cycles of downmanning and cutbacks in essential maintenance were inevitably going to have dire consequences. Shell and Wood Group management persistently rejected the men's concerns out of hand. In April 2003, the OILC, desperately worried at the deteriorating situation, made a formal complaint to the HSE and asked that something be done - and fast! The union assisted the HSE investigation by providing extensive documentation showing the extent of safety critical maintenance backlog in the Brent Field.

Early on in the 6-month investigation, on 12 May, HSE wrote to Shell confirming the seriousness of the problems. Not only was the maintenance backlog substantial it was evident the company was not in a position to know its true extent. For example, Shell's own performance standard for completion of safety critical non-routine work is 28 days. To provide assurance to senior managers that this standard is being met, a 'traffic light' procedure is supposed to alert them on the 29th day of any safety critical item remaining un-repaired or non-functioning. However, in excess of two months beyond this trigger point was lapsing before management was receiving the information. Worse, the information was not being acted upon, even then - a failure compounded further by the non-recording of these outstanding items as backlog.

The HSE May letter instructed Shell to review its maintenance management systems and advise on an action plan and timetable for remedy and observed: "Shell are now changing to a new Risk Assessment Matrix (RAM), with revised performance standards but this is at an early stage of development". Assurance taken from this pending development would have been seriously misplaced. RAM (Risk Assessment Matrix) is integral to OBIP (the Offshore Business Improvement Project) and was actually at the root of the union complaint to the HSE.

"Improving" the business
OBIP and RAM were rolled out late 2002 for implementation in 2003. The business case being made was that maturing North Sea fields are increasingly hostage to the combination of progressively falling production and rising unit costs. Consequently, operating expenditure has to be slashed, so Shell says, to maintain profitability and extend field life. This means less maintenance is to be done by fewer people who will work harder. An OBIP target was set to reduce non-routine corrective maintenance by 50% by means of simply not doing the work. The reduced capability to maintain the installations has to be managed by targeting remaining manpower and cash to where needed most to ensure 95% production uptime.

Safety, of course, is not to be compromised and to that end the RAM tool aims to aid decision making by suggesting what jobs should be done and what can be ignored or deferred. The patched 4-inch pipe at the core of this tragedy was "rammed" using the new technique in July 2003 and deemed not a priority. The electrical work outstanding on UPS-related systems had been "rammed" and placed below the action threshold. One of the valves that allowed gas to pass had been "rammed" and assessed as work that could be put aside for another time.

One of the more disquieting aspects of this whole affair is that, not only was OBIP, with its RAM tool, implemented within schedule by means of mass sacking of around 36 skilled and experienced platform staff, it was done so right under the noses of the HSE team who were investigating and confirming the extent of safety critical maintenance backlog still outstanding from previous rounds of cutbacks and sackings.

The RAM tool
Interestingly, the HSE investigation, commencing in March and terminating in September, while examining how RAM was rolled out and implemented, did not examine the RAM methodology itself in any detailed way. If they are examining it now, as part of their investigation into these two deaths, they will be worried by what they see.

In April 2002, the joint venture Sigma 3, was set up to bring together Shell's three main offshore engineering and maintenance contractors, Wood Group, AMEC and KBR (a subsidiary of Halliburton). A 7-year deal, described by some as a 'shared-risk shared-reward' arrangement, is worth an estimated £750million. Each contractor in its own right brings first-class bona fides in offshore expertise to the table, no problems there. Key goals are "delivering outstanding business success in safety, cost competitiveness and production through new ways of working". By maximising production uptime at the lowest possible cost the consortium intends to generate maximum added value for its members over the seven years of the contract. A contract founded upon incentives not to spend money is any client's dream. It is for OBIP through RAM to deliver it.

The Sigma 3 dividend
In the new regime a large chunk of day-to-day decision-making on what plant, equipment and systems should attract maintenance resources is devolved down from Shell managers to the Sigma 3 contractors' employees. RAM is described as a problem-solving tool for corrective maintenance. The 'problem' to be solved is that in 2002 some 570,000 man hours were expended on Non-routine Maintenance at a cost of £15million (distributed over 16 Shell installations), an amount equal to the spend on Planned Maintenance routines. The OBIP target is to half that expenditure virtually immediately and so net £50million over the 7-year life of Sigma 3.

RAM starts by taking the standard risk assessment approach of assigning values to the two components of risk, consequence and probability, and combining them to get a quantification of risk. However, RAM bends the outcome to arrive, not at a conclusion as to what should be done to avoid uncontrolled risk, but to gauge what risks might successfully be taken. In other words, whereas a 'normal' risk assessment seeks to minimise uncertainty by explicitly planning how the job should be done while at the same time introducing suitable additional precautions to control residual risk, OBIP's RAM tool seeks to balance the benefits (cost saving) of doing nothing at all against the potential consequences (fatalities and production down-time) of being caught out. It's the classic dichotomy between managing risk, on the one hand, and chance taking, on the other. The uninitiated think wrongly that they are one and the same thing.

But the most insidious - and actually dangerous - aspect of RAM is the extent to which it cuts the principal duty holder's management out of the loop. RAM assessment outcomes may fall within one of five bands of response. These are: a) manage locally; b) low priority, manage locally; c) medium, manage within department; d) high priority, ensure management awareness; and e) top priority, urgent action with management involvement. Only when the extent of risk, consequent to a decision not to perform remedial work, is assessed at or above band (d) is the RAM assessor (employed by a Sigma 3 contractor) obliged to flag up the possible consequences to Shell management. Otherwise, it's his call.

HSE "confronts"
On 18 August the HSE notified Shell that the investigation into union complaints about the hazards posed by accumulated maintenance backlog, and the potential of OBIP to make matters worse, was complete. The regulator provided the company with a shopping list of nine points to be acted upon in timescales varying from within 28 days to "as soon as possible" (whatever that means). The nine actions - none of which, incidentally, challenged RAM methodology, covered six topics around OBIP implementation:

 

AUDIT: There was no evidence of an independent audit having been carried out of the management of the OBIP organisational changes as part of your SMS arrangements.

 Two weeks later our two colleagues were killed.

Tom Botts, Shell's Managing Director, apparently unchallenged by the outcome of the HSE investigation, appeared on the evening television news regretting the deaths and announcing that, nevertheless: "HSE had recently given Shell the all clear on safety".

Workforce concerns
A shambles of this scale and consequence was not inevitable. Workforce concerns could have been given theweight they deserved. In one example of many, on 12 March, Brent Bravo's resident platform electrician (RPE) sent a report up the line detailing concerns about the probable adverse consequences of OBIP. A copy is in Blowout's possession. Amongst many issues raised the RPE shows that pending reductions in electrical staff will lead to the loss of hard won platform-specific knowledge and experience. Platform electrical drawings, he confirmed, were in a poor state, a serious shortcoming for which a solution had long been promised but never delivered upon because of previous manpower cutbacks.

The RPE spells it out: "The move to flying squad EX inspection and maintenance squads, combined with the loss of a full-time platform inspector and the loss of a full time 1st line supervisor will result in a deterioration in quality control in vital safety related work".

He lists concrete examples to illustrate why OBIP as proposed will introduce significant hazards additional to those the workforce are already trying to cope with consequent to previous cut backs. The recent electric shock incident of an unsupervised electrician on the Brent Charlie, he said, was in part the outcome of cutbacks of the type now being contemplated on a much wider scale under OBIP.

Safety law requires prior consultation with employees to assess the risk implications of planned organisational changes. If consultation is measured by the extent to which management responds to workforce inputs, then consultation this was not. Pre-consultation OBIP proposals differ not a jot from what in the end got implemented. The Bravo's RPE was not alone in having his legitimate and authoritative concerns and suggestions ignored. As his pre-OBIP observation presciently put it: "It smacks of making the case for safety fit the business rather than making the business fit the case for safety".

As OBIP 'consultation' and 'implementation' played out across the Brents in the first half of 2003 contractors' safety representatives resigned en masse disgusted both at the failure of management to take seriously workforce safety concerns and the final straw of the botched extension offshore of the Working Time Directive. As one safety representative told Blowout: "We were just sick of being used as window dressing to give the appearance of consultation on health and safety issues when, in reality, the substance is zero".

Root cause analysis
A series of systemic failures set the scene for the deaths of these two young men. A dysfunctional safety management system, maladministration of the verification scheme, management refusal to countenance legitimate workforce safety concerns, HSE's preference for 'persuasion' where tougher sanctions could have been more effective, the cohort of disempowered and disillusioned safety representatives who absented themselves - all converged to leave the workforce naked and defenceless in the face of management determination to, yet again, cut costs using ill-considered methods.

Act or Omission?
Thirty-nine Wood Group employees were killed on the night Piper Alpha blew apart. To this day, a dozen of its ex-employees are walking wounded, their lives blighted forever by the negligence of those who owed them a duty of care. Back in 1988 Wood Group management did not interrogate Occidental on how safe was its offshore operation. There was just gratitude at the good fortune that had come the company's way in acquiring such a lucrative contract - a feeling shared by a workforce anticipating a steady wage for a couple of years. Piper Alpha was a death trap but, in fairness, Wood Group's sin in sending men out to it was one of omission. However, to do the same again would be a sin of commission, something we thought would never again happen in Britain's offshore oil and gas industry. Or are we just naive?

Digging ever deeper to the roots of this tragedy seems to expose more complexity and no doubt the 'official' report, when eventually it is made public, will reveal factors not even mentioned here. But at the end of the day one suspects simpler explanations: a workforce not angry enough about the treatment it is receiving and a complementary management that doesn't feel it has to try harder.

What went wrong?
Risk is a fact of industrial life and we have more than our fair share of it offshore. Only risk that is known about, quantified and adequately controlled is acceptable. Work activities conducted in circumstances where the degree of risk is unknown or misunderstood, or where there are misplaced assumptions about the effectiveness of precautions and control measures, is not risk management. It is chance taking.

Is that what happened here? If so, who were the gamblers: the lads who went down the leg to their deaths, or those who were running the show?

In the final analysis the law requires management to provide a safe place of work, including access and egress, safe systems of work (usually written), safe and suitable equipment, safe and competent fellow workers together with adequate supervision and instruction.

Management must plan what is done and make sure that people do what is planned. Employees, for their part are absolutely bound to co-operate with management to these ends.

This diagram usefully illustrates the essentials of a safety management system. It is for senior management to establish policy, organise and plan its implementation, measure progress and effectiveness and continually audit the performance both of the system and the people within it.

Senior management must provide sufficient resources to make the policy outcomes achievable. The shop floor must commit and contribute to achieving the common organisational goals.

Striking the balance between profitability and safety is a management skill not all managements achieve all of the time.

One thing is sure. Cost cutting, pushed through without sufficient thought to the consequences, or superimposed on an already dysfunctional system, tips the balance. Sometimes leading to unplanned events, other times, not. Uncertain outcomes. It's called gambling.

<<Back

http://www.oilc.org/viewarticle.cfm?articleid=191