Royal Dutch Shell Plc  .com Rotating Header Image



By Bill Campbell, statement embargoed for publication on 11 September 2013

Death by Sandblasting – how production concerns, versus safety of employees, caused offshore deaths


The Shell Chairman and his Legal Counsel accepts that the evidence held by police that offshore staff were afraid to raise permits and had been conditioned by onshore managers to ignore safety procedures over a prolonged period is authentic


This story is about behaviour, bad behaviour.  It is about how offshore workers were bullied, coerced, harassed by onshore management to keep oil and gas production going at all costs and over a prolonged period of time.  It’s about how operators will do what is expected of them if they are put under unreasonable pressure.  It’s about how under these conditions deviation, or bending of rules, leads to breaking rules, and eventually to ignoring rules altogether.  Ignoring rules, despite the consequences, becomes just the normal way of doing things in the Brent oilfield.


It was in this hostile environment that two relatively young men with the rest of their life in front of them were asked by their supervisor to have a look see at a temporary repair, a neoprene bandage held down by jubilee clips, that had been placed some weeks earlier to prevent leakage from a hydrocarbon pipe running down into the storage cells from an oil/gas separator vessel.  Just go and sort it out, no permit mind you, if the plant shuts down because you were fiddling with this repair, and the pipe leaked activating the gas alarms, then without the permit with its signatory boxes complete, the bosses on the beach couldn’t identify who to punish.  So for years the use of permits was avoided for this reason. Fear of retribution motivated this almost constant violation of the permit to work system.


As a consequence of all this on 11th September 2003, less than 4 years after a major audit had highlighted these concerns, and as predicted in the presentation to the complete leadership team in Aberdeen in October 1999, the inevitable happened.


In 1999 Directors were made aware that the behaviours verified would lead inevitably to a major accident, it’s just a matter of time, they needed to take action but they failed to do so. 


In 1999 in the daily operation of the Brent facilities, the cardinal rule was to do nothing, and attempt nothing, if there was even a faint possibility that production could be interrupted, even if this meant not doing outstanding tests and inspections on safety critical systems. This was formalised by the notorious Touch F-All policy issued by the Brent Asset Manager which appeared on many of the maintenance procedures for critical equipment as the TFA mode.  Equipment on that list was not to be maintained or inspected because in doing so the hydrocarbon process may be accidentally tripped.


With this pervasive negative safety culture, the operators quickly learned that to maintain production despite the consequences was good behaviour; they would be rewarded for that.  But conversely, causing the process to trip was bad, whatever the justification; they would be punished for that. 


What was the root cause of the accident?


The separators level control system was functionally degraded such that it was in a failed state.  So was the downstream emergency shutdown valve which was partially closed to try and retain some semblance of level control on the vessel with its LCV eroded by reservoir sand. The innards of the emergency shutdown and other valves around the process had been sand blasted over the years when the wells were beaned up much too quickly to get the process up and running thus exceeding the critical velocity of the gas which caused carry over of reservoir sands which then flowed flow up the wells to pollute the internals of process equipment.  The separator vessel ESDV was just one of many emergency valves in a similar condition.


So why were the men asked to repair the leaking bandage? 


It should have been for safety reasons since some weeks earlier the same repair had leaked and gas, not water with parts per million of oil, but gas, had been released into the column setting off the gas alarms.  So everyone accountable for operations onshore and offshore knew that the possibility of flooding the column with gas existed.  Prior to the shutdown a permanent repair of the pipe was given the highest priority, but simply ignored, not enough time, so start up took place. 


The public inquiry determined the deceased were asked to repair the leak over concerns about production not safety.  Safety it appears was the last thing to be considered.   A pig was to be launched into the export line and if the platform shutdown the pig might get stuck. So the risk assessment prior to the pig launch was entirely focussed not on safety but on maintaining production at all costs. So the instruction was sort out the repair guys, ensure it doesn’t leak during pigging.  So they died because of concerns about production.


What happened when the bandage leaked?


When the bandage gave way there were two routes for the gas to go, the as-designed route to the flare but also the illegitimate route directly via a clear pathway into the enclosed space through the hole in the pipe.  The volume entering the enclosed space was estimated, from a mass balance, and as specified at the Inquiry, to be over 6 thousand cubic metres of rich hydrocarbons.


The gas did not ignite, the volume of gas was such that the mixture would have gone through the lowest to the highest explosive limit very quickly, seconds rather than minutes, and a source of ignition was not present during these seconds.    If it had ignited, then you would not be reading this, no amount of cover-up by Shell and the HSE would kept all his from public scrutiny. The instantaneous pressure from the explosion if it had occurred could have caused severe structural damage at the weak point where the column is mated to the cellar deck. The Sheriff concerned about this recommended a separate Inquiry be conducted on this point alone, but this was ignored. .


What did the Shell post fatuities review reveal about people and behaviours in 2003?


Related to competence there was a shortage of competent resource both onshore and offshore.  The Inquiry found that hundreds of unapproved temporary repairs, including the repair that initiated the fatal accident, had developed because there was a shortage of competent persons to keep up with the backlog of such repairs. Related to competence and attitude there was a lack of ability of staff in key positions both onshore and offshore to take technical overview of systems for which they had a responsibility.


When attempting to understand why across the field 1500 or so breaches of safety regulations had developed over the period from the audit in 1999 they concluded that offshore crewmembers were apparently afraid to “FLAG” problems they have with the hardware on their offshore installations and posed the open question why are crewmembers and staff willing to continue to operate with systems in a potentially dangerous condition?


Have the leaders and managers “conditioned” our crewmembers and staff not to challenge?


With regards to the permit system, the review team found that a key similarity between 1999 and 2003 was violation across the board of the permit system.  The most damming evidence comes in correspondence between the leader of the post fatalities review team, and the author of this article, who in 2005 was retained as a Group Auditor for the Shell upstream Group of Companies.


For those interested in the public Inquiry report you can observe the Sheriff struggle to understand why the deceased had not used a permit before entering the column. Both counsel for Shell and the HSE, could have helped the Sheriff out over this point, but purposefully withheld the known position from the Sheriff. 


The Shell position was clearly understood in that one item that was most certainly a carryover from the 1999 audit was the execution of work under the Operations Umbrella rather than via the permit to work.  This it was stated had become custom and practice.


The culpability of Directors


Culpable homicide that was, now termed culpable manslaughter in Scotland after changes to this law has been historically difficult to prove against the marker of beyond reasonable doubt.  It’s a case of cause and effect.  The effect is clear, on public record, both from the prosecution of Shell to which they pleaded guilty, and to the determinations of a Sheriff at a public inquiry.


The prosecution highlighted that the deaths occurred because production concerns dominated over concerns for employee health and safety. Equipment that was defective was knowingly operated whilst in a dangerous condition.  The inoperability of the safeguarding system for the separator vessel and the emergency valves were said to be brought about by criminal neglect of maintenance.  The Sheriff determined that the fatalities may not have occurred if a permit had been raised or if the emergency valves had not been inoperable. But these were the same defects, a mirror image of the defects known about and presented to Directors in 1999 as serious concerns by their Internal Audit Manager.  Shell accepts that the correspondence to Directors and its content, and the subsequent presentation of all this to Directors, and the follow up of this into actions to mitigate is all their material. 


So it is not surprising that the Shell internal investigation into all this concluded in 2005 to the then CEO of Royal Dutch Shell that there was no evidence that any of the recommendations undertaken by Directors in 1999 were ever undertaken. Perhaps the most serious concern highlighted after the fatalities is that offshore staff appear to have been conditioned not to challenge, but to continue to operate plant whilst it was in a dangerous condition.  So not only did Directors fail to take appropriate action in 1999, but the high level finding of the 1999 concluded that they were responsible for the conditioning of offshore staff at that time.


The Audit found that quote the sampling process of the organisation has verified that there are significant weaknesses in essential controls. In our opinion the fundamental reason for this is not the absence of structures, systems and processes but rather that inappropriate attitude and behaviour causes non-compliance, or deviation from, these control processes. We believe that the key business drivers and messages from corporate level are fostering undesirable behaviour in some parts of the organisation.


Bill Campbell and its sister non-profit websites,,,,,, and are owned by John Donovan. There is also a Wikipedia feature.


Leave a Comment

Comment Rules

  • Please show respect to the opinions of others no matter how seemingly far-fetched.
  • Abusive, foul language, and/or divisive comments may be deleted without notice.
  • Each blog member is allowed limited comments, as displayed above the comment box.
  • Comments must be limited to the number of words displayed above the comment box.
  • Please limit one comment after any comment posted per post.

%d bloggers like this: