Investigation Report

Unofficial translation

Report
Report title Activity number
Draugen rupture of the loading hose on 10 January 2008 005093002

Classification
; Public Restricted Highly confidential
No public access Confidential

Summary

In connection with the loading of oil from Draugen to the tanker Navion Scandia on 10
January 2008 an undesired incident arose that resulted in the rupture of the loading hose. This
led to the accidental discharge of around 6 m3 of oil into the sea.

The loading hose between the loading buoy on Draugen and the tanker Navion Scandia was
equipped with a so-called breakaway coupling (MBC). This was a technical barrier that
worked and prevented a larger discharge of oil.

The incident did not result in any direct hazard for the personnel on board the Navion
Scandia or Draugen.

Shell's emergency response organisation handled the situation in accordance with the
established routines. This applies correspondingly to the shipowning company and their
handling of the alert notification and emergency response during the initial phase.

The operator for Draugen is A/S Norske Shell, and the vessel is owned and operated by the
shipowning company Teekay Shipping Norway AS.

Petroleum Safety Authority Norway's investigation has identified seven nonconformities

with the regulatory requirements. Two of the nonconformities are related to Shell's failure to
observe the operator's "see to duty", as well as inadequate management and control of
contracts. The remaining nonconformities are related to Teekay's inadequate maintenance
management, competence management, follow-up after buoy loading incidents and the use of
safety critical information, change management, and the follow-up by management.

Involved parties
Main group Approved by/date
T-2 Hanne Etterlid, Inspection Coordinator
Participants in the investigation group Investigation leader
Arnt-Heikki Steinbakk and Anne Gro Lkken Anders Tharaldsen
 2

Contents
1 SUMMARY.................................................................................................................................................. 3
2 INTRODUCTION ....................................................................................................................................... 4
3 ORGANISATION AND TECHNICAL DESCRIPTION OF OIL LOADING ON DRAUGEN ......... 5
3.1 ORGANISATION ..................................................................................................................................... 5
3.2 TECHNICAL DESCRIPTION ..................................................................................................................... 6
3.2.1 Bow Loading System (BLS) on the Navion Scandia ........................................................................ 7
3.2.2 Maintenance of BLS ........................................................................................................................ 8
3.2.3 Design and modification of BLS on the Navion Scandia................................................................. 8
4 COURSE OF EVENTS ............................................................................................................................... 9
4.1 EARLIER BLS INCIDENTS ...................................................................................................................... 9
4.2 COURSE OF EVENTS ON THE NAVION SCANDIA ON 10 JANUARY 2008 ................................................ 10
4.3 CAUSE OF THE INCIDENT ..................................................................................................................... 11
4.3.1 Direct cause .................................................................................................................................. 11
4.3.2 Underlying causes......................................................................................................................... 13
4.4 EMERGENCY RESPONSE CONDITIONS .................................................................................................. 13
5 ACTUAL AND POTENTIAL CONSEQUENCES OF THE INCIDENT............................................ 13
5.1 ACTUAL CONSEQUENCES .................................................................................................................... 13
5.2 POTENTIAL CONSEQUENCES................................................................................................................ 14
6 OBSERVATIONS ..................................................................................................................................... 14
6.1 OBSERVATIONS SHELL ..................................................................................................................... 14
6.1.1 Inadequate observance of Shell's "see to duty" ............................................................................. 14
6.1.2 Inadequate management and control of contracts ........................................................................ 15
6.2 OBSERVATIONS TEEKAY .................................................................................................................. 16
6.2.1 Maintenance management relating to the BLS unit ...................................................................... 16
6.2.2 Inadequate competence management - personnel with responsibility for maintenance of the BLS
unit ................................................................................................................................................ 16
6.2.3 Follow-up after buoy loading incidents and use of safety critical information............................. 17
6.2.4 Management of modifications to the BLS unit .............................................................................. 18
6.2.5 Inadequate follow-up by management .......................................................................................... 19
6.2.6 Requirement for control of the BLS unit before start-up of loading operation ............................. 19
6.3 TECHNICAL BARRIERS THAT HAVE WORKED ....................................................................................... 20
7 OTHER COMMENTS.............................................................................................................................. 20
7.1 METERING OF LOADED OIL ................................................................................................................. 20
7.2 SHELL'S OWN INVESTIGATION ............................................................................................................. 20
7.3 ISDT'S ROLE ....................................................................................................................................... 20
8 APPENDICES ........................................................................................................................................... 21
 3

1 Summary
In connection with the loading of oil from Draugen to the tanker Navion Scandia on 10
January 2008, an undesired incident arose that resulted in an accidental discharge of oil into
the sea. The operator for Draugen is A/S Norske Shell, and the tanker vessel is owned and
operated by the shipowning company Teekay Shipping Norway AS (Teekay).

The Navion Scandia started to load oil on 10 January 2008 at 4:15 a.m. An alarm on the
Navion Scandia and Draugen indicated a fault in the bow loading system (BLS unit), and the
pumps on Draugen stopped automatically then. It was established on board the Navion
Scandia that a hydraulic hose had ruptured on the BLS unit. Immediately afterwards the
central control room on Draugen detected that the loading hose between the FLP and tanker
had ruptured. The same observation had also been made on the standby vessel. Alert
notification procedures were initiated, and Shell's own emergency response centre was
manned.

The initiating incident that led to the discharge of oil was the rupture of the hydraulic hose.
Due to the lack of a restriction orifice in the system, the hydraulic pressure disappeared
immediately. This resulted in the rapid closure of the coupler valve, which led in turn to the
buildup of a great deal of pressure in the loading hose. The reflection pressure exceeded the
design pressure of the Marine Breakaway Coupling (MBC), and the trigger mechanism was
thus activated. The hose broke into two and around 6 m3 of oil was discharged into the sea.
The MBC was a technical barrier that worked and prevented a larger discharge of oil.

The incident did not result in any direct hazard to the personnel on board the Navion Scandia
or Draugen.

Petroleum Safety Authority Norway was notified of the incident within a reasonable period of
time, i.e. less than one hour after the incident arose.

Shell's first-line and second-line emergency response organisations, i.e. on board Draugen and
at Rket in Kristiansund, handled the situation in accordance with their established routines,
as far as we have experienced. This applies correspondingly to the shipowning company
Teekay and their handling of the alert notification and emergency response during the initial
phase.

The underlying causes of the discharge of oil in our opinion are related to inadequate follow-
up by the management, including inadequate use of experience from incidents with the BLS
unit and inadequate change management, as well as inadequate competence management. We
also believe that unclear responsibilities related to the follow-up of the BLS unit may have
also been a contributing factor to the incident.

Our investigation identified seven nonconformities with the regulatory requirements. Two of
these are attributed to Shell and related to a failure to observe the operator's "see to duty" and
inadequate management and control of contracts. The remaining nonconformities are related to
Teekay's inadequate maintenance management, competence management, follow-up after buoy
loading incidents and the use of safety critical information, change management, and the follow-
up by management. An improvement point related to Teekay concerning control of the BLS
unit before the start-up of the loading operation was also identified.
 4

2 Introduction

In connection with the loading of oil from Draugen to the tanker Navion Scandia on 10
January 2008 an undesired incident arose that resulted in an accidental discharge of oil into
the sea. The operator for Draugen is A/S Norske Shell (Shell) and the tanker vessel is owned
and operated by the shipowning company Teekay.

Petroleum Safety Authority Norway (PSAN) decided on 10 January 2008 to carry out an
investigation of the incident. The Nordmre and Romsdal Police District also decided to
investigate the incident and requested assistance from PSAN.

The investigation group consisted of: Arnt-Heikki Steinbakk, Anne Gro Lkken and Anders
Tharaldsen (investigation leader).

Terms of reference for the investigation

1. Clarify the scope, course and potential of the incident and evaluate triggering and
underlying causes, as well as follow-up measures.
2. Evaluate operational, technical and managerial factors related to the incident.
3. Identify any regulatory violations, recommend further follow-up and identify any needs
for the use of policy measures.
4. Prepare the investigation report.

PSAN's area of responsibility encompasses measures for the prevention of damage or injury
to personnel, the environment and financial assets, including measures to prevent or stop
accidental pollution from an installation.

Method

The investigation group travelled to Kristiansund on the same day that the incident occurred.
After arrival in Kristiansund a meeting was held with the investigation leader from the police.
In addition, the investigation group held a meeting with Shell on 11 January 2008, where
information was provided to both PSAN's and the police's investigation groups, as well as
Shell's own investigation group. The participants at the start-up meeting are listed in
Appendix B. The representatives from the police and PSAN were subsequently brought on
board the Navion Scandia. A plan was established to interview the relevant personnel on
board in cooperation with the police.

A total of six interviews were conducted with personnel from the Navion Scandia, as well as
an interview with a representative for Advanced Production and Loading AS (APL) who was
on board. APL is the supplier of the BLS unit on the Navion Scandia. A summary of the
personnel interviewed can be found in Appendix B.

In addition, an inspection of the hydraulic hoses and bow loading system (BLS) on board the
Navion Scandia was carried out on 11 January 2008, in addition to the loading hose, which
was inspected after it arrived onshore on 12 January 2008. The inspections were carried out
jointly with the police and are documented by photos from the scene of the incident and the
equipment.
 5

The investigation group had a video conference with the personnel in the central control room
on Draugen on 12 January 2008. The police subsequently interviewed two of these persons.
PSAN was not present during these interviews. In addition, there was a meeting where Shell,
the police and PSAN participated on 12 February 2008. The participants at the meeting are
specified in the matrix in Appendix B. A meeting was also held between PSAN and the police
on the same day.

Video conferences were held with Shell in the initial phase of the investigation and after
returning from Kristiansund. The investigation group also participated in a meeting with APL
and Teekay in Arendal on 24 January 2008 and with Teekay at PSAN's offices on 25
February 2008. Due to practical reasons these meetings were held as joint meetings with the
group that is investigating the oil discharge from Statfjord on 12 December 2007.

The documents that have been collected and used in the investigation include drawings, logs,
procedures, reports, photos, etc. See the enclosed list of documents (Appendix A).

The investigation report sums up the results from PSAN's investigation, and they are
presented based on the terms of reference for the investigation group.

3 Organisation and technical description of oil loading on Draugen

The description of the organisation of oil loading on Draugen is based on information
obtained from Shell, and it is limited primarily to the tasks of the parties involved. Details
concerning the distribution of responsibility and roles between the parties has been difficult to
obtain, since Shell has not been able to produce documentation describing this.

In the technical description, the investigation group has obtained information from Shell, the
equipment supplier APL, Teekay and StatoilHydro.

3.1 Organisation
Oil from Draugen is transported by the transport company for Draugen, I/S Draugen
Transport (ISDT).

The tankers are supplied by Teekay through a Contract of Affreightment between ISDT and
Teekay, i.e. ISDT is Teekay's client.

ISDT was formed by Den norske stats oljeselskap a.s (now StatoilHydro), Shell, BP and
Chevron, and it bears responsibility for the quality of the delivery and approval of the vessels.
ISDT is managed by StatoilHydro.

The ISDT Committee arranges regular HES/operation and management committee meetings
with Teekay. These meetings are in addition to the formal management committee meetings,
where both commercial and HES matters are reviewed. Shell participates as a formal
management committee member, and Shell's senior tanker advisor and the scheduling office
are also represented at the meetings.

The tanker advisor also arranges HES/operation meetings with Teekay, as well as the specific
follow-up of technical problems, incidents, audits, etc., and the advisor also has access to
specific reports that are published in connection with loading.
 6

Shell's approval of tankers for oil loading at Draugen takes place essentially as follows:

Teekay nominates a vessel in accordance with the lift programme.

Shell's office for the scheduling of tankers submits the vessel to Shell International
Trading and Shipping Company Limited (Stasco) for SAFE clearance (vetting).
For third-party cargo, vetting data is also collected from the partner company.
Shell's scheduling office also submits the vessel to Shell's terminal clearance unit at
Anasuria, which clears the vessel for Draugen.
If the vessel is not cleared by the aforementioned units, Teekay will be requested to
nominate another vessel.

Audits are performed by both ISDT and Shell. It was decided in the autumn of 2007 to
perform an audit through ISDT with participation from Shell in 2008. This audit will be
harmonised with Shell's needs to perform a separate Shell audit, since Shell also uses Teekay
for other North Sea contracts.

3.2 Technical description

The Draugen installation was installed on the field in 1993. The installation stands on a
gravity base structure at a depth of around 250 metres. The oil produced on the field is stored
in cells in the installation's shaft. Two pumps lead the oil through two lines out to the FLP
(Floating Load Platform) loading buoy and then through a loading hose to the tanker. The oil
loading rate from Draugen to the tanker is 5000 m3/h. The design pressure for the export
system is 50 bar.

The distance from Draugen to the loading buoy is around 2.9 kilometres. The loading hose
that is used between the loading buoy and tanker is 84 metres long with a diameter of 16
inches. The hose has a burst pressure of 95 bar and a maximum working pressure of 19.5 bar.
A pressure sensor triggers an alarm in the control room on Draugen when the pressure in the
hose exceeds 8 bar.

The tanker positions itself next to the loading buoy by means of dynamic positioning (DP),
then the loading hose and a hawser (70 metres) are connected to the vessel.

Figure 3-1: Illustrative photo of oil loading on Draugen

The loading hose is equipped with a so-called Marine Breakaway Coupling (MBC), which is
designed to detach when the pressure exceeds 35 bar or if there is tension in the hose. There
 7

are valves at both ends of the connection that close when the hose breaks into two and prevent
thus oil from flowing out.

The safety system for the loading system shall fulfil the requirements for the detection of
abnormal conditions and equipment to prevent or limit the consequences. Signals between the
installation and tanker are transmitted by means of a telemetry signal. The Green Line signal
for the start-up of the loading pumps is transmitted when the valves and equipment on both
the installation and vessel are set to the correct state. In an emergency situation when the
Green Line is broken, the loading pumps on the installation will stop and the valves will close
sequentially.

3.2.1 Bow Loading System (BLS) on the Navion Scandia

Hitec Marine AS (now APL) was responsible for the design and construction of the BLS unit
for the Navion Scandia, based on the original system design that was used for the first time on
the tanker Tove Knutsen in 1992. The build year for the Navion Scandia is 1998.

There are two valves on the vessel's BLS unit that can close the flow of oil. The one that is
located the closest to the loading hose is the couple valve. The inboard valve, which is the
other valve, is located further into the vessel (downstream). The coupler valve is a disc valve,
while the inboard valve is a ball valve. There is also a disc valve at the end of the loading hose
(Hose End Valve).

Figure 3-2: Illustration of BLS with coupler valve and Photo 3-1: BLS (Source: APL)
Hose End Valve (Source: APL)

The design of the solution incorporates time delays for the closing of the valves in relation to
the shutdown of the loading pumps on the installation. The time delays are sequential and
essential to avoid high pressure in the loading hose when the valves close. The time delays for
the valves are as follows:
Coupler valve: minimum 25 seconds
Inboard valve: minimum 28 seconds
Cargo valves: around 35 seconds

The valve's closing time must be tested after every fourth loading operation. The valves on the
BLS unit have end switches for both the open and closed positions The Green Line is broken
if the valves are closed during loading.

The coupler valve is operated by means of hydraulic pressure. The hydraulic system is driven
by the Hydraulic Power Unit (HPU) in the front of the bow, via pipes and hydraulic hoses to
 8

the actual coupler valve. The hydraulic hose installed between the coupler valve and flow
control valve has a specified working pressure of 250 bar.

Figure 3-3: Illustration of coupler valve with Hose End Valve connected (Source: APL)

3.2.2 Maintenance of BLS

The BLS supplier's Maintenance Manual Bow Loading System requires preventative
maintenance for the valves and associated equipment. Section 3.1 specifies visual inspection
of all the equipment with a view to damage and leaks, either monthly or after each loading
operation. Section 3.2 specifies a requirement for the testing of the emergency shutdown
system after every fourth loading to check the closing time for the coupler and inboard valves,
for example. Section 3.3. specifies a requirement for a three-monthly inspection of hydraulic
hoses and replacement if damage is observed. Section 3.5 specifies that all hydraulic hoses
shall be replaced every third year or if damage is observed.

A Maritime Letter that was issued in February 2003 based on experience with ruptured
hydraulic hoses, sharpens, for example, the visual control requirements before and after each
loading operation, three-monthly close visual inspection and testing of the hydraulic system.
The interval for the replacement of hydraulic hoses is set at two and a half years regardless of
the condition. In January 2005, a new Maritime Letter was sent, which stressed the
importance of establishing and observing the guidelines for the inspection and replacement of
hydraulic hoses by making reference to the letter from February 2003.

The maintenance programme1 for the Navion Scandia has implemented the requirements for
the maintenance and replacement of hydraulic hoses and observes the monthly inspection
requirement in addition to the three-monthly requirement.

In the Service Letter from the BLS supplier dated 21 November 2007, a modification of the
coupler valve by the installation of a restriction orifice is recommended.

3.2.3 Design and modification of BLS on the Navion Scandia

The original design of the hydraulic system on the BLS unit required the installation of a
restriction orifice in the valve housing for regulation of the closing time for the coupler valve.
When the BLS unit was manufactured, however, this orifice was not installed, and regulation

1
BLS-0001-A and BLS-0003-A
 9

of the closing time takes place instead over a flow control valve. Flexible hoses are used in
the hydraulic system between the couple valve and flow control valve. If there is a leak in the
hydraulic hose, the hydraulic oil will flow out freely and the flow control valve will be
disabled. This means that the closing time for the couple valve will be reduced considerably.

APL and Teekay have reported that they were aware of the modification, i.e. the restriction
orifice was not installed as specified in the drawings, after the incident with the tanker
Elisabeth Knutsen on the Gullfaks field in December 2004. Shell was not aware of the
modification until it was revealed by the investigation of the incident with the Navion Scandia
on Draugen on 10 January 2008.

No documentation has been submitted for verification of the design specifications against "as-
built". In addition, no documentation has been provided for the processing and approval of the
modification of the component for the coupler valve closing time by the manufacture or
customer.

No analysis has been submitted that describes what risk the modification of the BLS entails.

Hydraulic hose

Photo 3-2: Hydraulic hose installed between the coupler valve and Figure 3-4: Hydraulic hose installed between the
flow control valve on BLS coupler valve and flow control valve on BLS
(Source: Police) (Source: APL)

4 Course of events

4.1 Earlier BLS incidents

During loading from Gullfaks SPM 2 to the tanker Elisabeth Knutsen on 12 December 2004
the loading hose's weak link ruptured and around 12 m3 of oil leaked into the sea. Statoil's
subsequent investigation of the incident showed a rupture of the hydraulic hose in the BLS
unit and immediate closure of the coupler valve. This resulted in a pressure surge in the
loading hose and the rupture of the weak link. The recommended measures after the incident
included:
modification of the hydraulic system so that the right closing time is maintained if the
hydraulic hose ruptures
routines for the replacement of hydraulic hoses shall be considered
analysis of the loading hose with breakaway coupling (wink link)
 10

On 24 January 2006 during loading from Draugen with the tanker Grena, the Green Line
signal was lost and the loading stopped. During this incident there was also a pressure buildup
in the loading hose and a subsequent rupture. The estimated oil discharge was from 15 to 70
m3.

In connection with the loading of oil from Statfjord A to the tanker Navion Britannia on 12
December 2007 the loading hose ruptured. This resulted in the discharge of around 4,400 m3
of oil into the sea. The incident on the Navion Britannia has several similarities with the
incident on the Navion Scandia on 10 January 2008.

4.2 Course of events on the Navion Scandia on 10 January 2008

The Navion Scandia embarked from Pembroke, UK on 6 January 2008 and arrived at
Draugen on 9 January 2008. The hydraulic hoses were controlled in accordance with the
checklist2 on 9 January 2008 at 10:00 a.m. and no damage to the hoses was observed. In
accordance with the checklist for loading equipment3, ESD1 and ESD2 were carried out and
everything worked normally. The Green Line was displayed on the panel on the bridge, and
the Navion Scandia started to load oil on 10 January 2008 at 4:15 a.m.

At 7:50 a.m. an alarm was triggered on the Navion Scandia and on Draugen, which indicated
a fault in the BLS unit. The alarm broke the Green Line, and the pumps on Draugen stopped
automatically. The loaded volume was around 17,000 m3 at the time, and the planned cargo
was 136,000 m3.

At 7:52 a new alarm was triggered on Draugen, which indicated that the pressure in the
loading hose exceeded the limit of 8 bar.
A seaman on board the Navion Scandia discovered at 7:55 a.m. that a hydraulic hose had
ruptured on the BLS unit. The central control room on Draugen used the CCTV camera
mounted on the FLP and observed that the loading hose had ruptured. The standby vessel
Ocean Sky also reported to the bridge of the Navion Scandia that the hose had ruptured. The
rupture was also verified by the crew on board the Navion Scandia, and this was reported
back to the bridge.

The breakaway coupling worked as intended, and it was thus a barrier that worked and
prevented a large discharge of oil into the sea.

Alert notification procedures were initiated and Shell's own emergency response centre was
manned.

PSAN's emergency response duty office was notified by Shell at 8:34 a.m., and the oil
discharge was estimated to be from 3 to 10 m3, where 10 m3 corresponds to the total volume
of oil in the hose.

The Navion Scandia was disconnected at 9:45 a.m.

The standby vessel Stril Poseidon, which is equipped with NOFO oil protection equipment,
and the SAR helicopter stationed at Heidrun, were mobilised.

2
Bow Loading Equipment Check List # 1 (Shuttle Tanker)
3
Bow Loading Equipment Check List # 2 (Shuttle Tanker)
 11

Shell did not find it appropriate to use dispersion agents or oil spill booms to remove or
collect the oil after the discharge.

The Norwegian National Coastal Administration, Norwegian Pollution Control Authority,

Ministry of Labour and Social Inclusion and Nordmre Police District were notified of the
incident by PSAN.

Photo 4-1: Oil slick after the discharge Photo 4-2: FLP after rupture of loading hose

4.3 Cause of the incident

4.3.1 Direct cause

The initiating incident that led to the discharge of oil was the rupture of the hydraulic hose on
the BLS unit on board the tanker. Due to the lack of a restriction orifice in the system, the
hydraulic pressure disappeared very quickly. This resulted in the rapid closure of the coupler
valve, which led in turn to the buildup of a great deal of pressure in the loading hose. The
reflection pressure exceeded the design pressure of the MBC, and the trigger mechanism was
thus activated. The hose broke into two and around 6 m3 of oil was discharged into the sea.
This volume corresponds to the amount that will be discharged when the MBC works
according to its design.

The direct cause of this incident is almost identical to earlier incidents on Gullfaks and
Statfjord, on 12 December 2004 and 12 December 2007, respectively, as described in Section
4.1.

Hydraulic hoses
StatoilHydro's Research Centre in Trondheim performed a visual inspection4 of six hydraulic
hoses from the BLS unit on the Navion Scandia after the incident on Draugen. The
inspections showed that all the hoses are painted with white paint, most of which has flaked
off. The through-going hole/rupture in the hose that caused the incident is associated with
heavy corrosion of the steel reinforcement in the hose, which indicates that the damage started
from the outside. A primary leak from the inside would not have resulted in corresponding
corrosion, because the hydraulic oil would have preserved the steel. Bulging of the outer
sheath (rubber) was also noted in connection with a number of the cracks otherwise observed,
which indicates that there is corrosion of the steel reinforcement here as well. The bulging is
also due to the buildup of corrosion products under the outer sheath. It appears perhaps that

4
Status visual inspection of hydraulic hoses from Draugen
 12

the marked hoses (Manuli TESS hoses) show less of a tendency for cracking of the outer
sheath and subsequent corrosion of the steel reinforcement.

A plausible cause of the damage is degradation (embrittlement, softening) of the outer rubber
sheath in the areas on the hoses that are exposed to the highest stress as a result of bending,
etc. Degradation can be attributed to the following factors: Ageing by oxidation, UV,
temperature, chemical environment (for example, the application of paint in the case at hand)
or a combination of two or more of the aforementioned factors. When the outer sheath is
degraded/cracks the steel reinforcement is exposed to a marine atmosphere and corrodes. At a
given point in time the corrosion becomes critical to the strength of the hose, and the rest of
the reinforcement becomes overloaded, resulting in bursting.

Poor or "inappropriate" rubber quality cannot be excluded either, since it appears perhaps that
it is primarily the unmarked hoses that have damage corresponding to the damage in the area
of the hose rupture.

Photo 4-3: Damage to the hydraulic hose with enlargement of the corrosion in the reinforcement (Source:
StatoilHydro's Research Centre in Trondheim)

The heavy corrosion and the amount of corrosion products ("rust") indicates that the damage
has developed over a long period of time, such a several months. This means that the damage
to the outer sheath must have been present for a while.

Based on this survey and observations the investigation group made during the inspection on
board the Navion Scania, we believe that a thorough visual inspection would have detected
the damage to the hydraulic hose at an earlier point in time.

Loading hose
Testing performed by ASAMS5 on the MBC after the incident concludes that it has worked
according to its design.

5
Test of MBC performed by ASAMS Limited
 13

Photo 4-4: MBC mounted on the part of the loading hose Photo 4-5: MBC mounted on the part of the loading hose
that is connected to the tanker that is connected to the FLP

4.3.2 Underlying causes

The underlying causes of the discharge of oil are related in our opinion to inadequate follow-
up by the management, including inadequate use of experience from incidents, inadequate
change management, and inadequate competence management.

We also believe that unclear responsibility related to the follow-up of the BLS unit may have
also been a contributing factor to the incident.

See an elaboration of the conditions that we believe are the most important in Chapter 6.

4.4 Emergency response conditions

This accidental oil discharge did not result in any direct hazard to the personnel on board the
Navion Scandia or Draugen.

The Petroleum Safety Authority Norway was notified of the incident within a reasonable
period of time, i.e. less than one hour after the incident arose.

Shell's first-line and second-line emergency response organisations, i.e. on board Draugen and
at Rket in Kristiansund, handled the situation in accordance with their established routines,
as far as we have experienced. This applies correspondingly to the shipowning company
Teekay and their handling of the alert notification and emergency response during the initial
phase.

The investigation group has not taken any stand on whether it was a correct decision by Shell
not to use dispersion agents or collect the oil that was discharged into the sea, since the
assessment of this matter is under the jurisdiction of another specialist authority (Norwegian
National Coastal Administration and Norwegian Pollution Control Authority).

5 Actual and potential consequences of the incident

5.1 Actual consequences

Due to high pressure the MBC was activated and the loading hose was divided into two parts.
The subsequent oil discharge was estimated to be 6 m3.

Examinations performed subsequently by Shell have confirmed that there is no proven

material damage to the technical systems on Draugen or the FLP.
 14

No personal injuries were reported in connection with the incident.

5.2 Potential consequences

The design pressure of the export system, which is 50 bar, has been exceeded by around 30
bar in connection with the incident, which means that it has been exposed to pressure beyond
its original test pressure. Therefore there will be a potential for further material damage and
leaks from the system. A hydrocarbon leak would result in potential ignition and exposure of
the personnel. Note, however, there was no personnel present on the FLP during the loading
operation, and this is routinely the case.

The MBC has a design pressure of 35 bar, while the hose's burst pressure is 95 bar. The
potential for a large oil discharge is therefore very unlikely with a well-functioning MBC.

6 Observations

PSANs observations are generally divided into three categories:

Nonconformity: In this category there are observations where PSAN believes that there has
been a violation of the regulations.
Improvement point: Linked to observations where we see shortcomings, but do not have
enough information to identify any violation of the regulations.
Conformity/barriers that have worked: Used when conformity with the regulations has
been identified.

We have presented our observations related to Shell and Teekay in separate sections.

6.1 Observations Shell

6.1.1 Inadequate observance of Shell's "see to duty"

Nonconformity
It has been established that there are defects in Shell's follow-up of their subcontractors with
regard to the safe performance of the loading operation on board the tanker Navion Scandia.

Grounds:
As described in Section 4.1 there was information available in the industry from prior
incidents with the BLS unit concerning the challenges related to the loading of oil by means
of solutions corresponding to those used on the Navion Scandia.

Shell has not used this information to implement follow-up activities in relation to the
shipowning company that could have identified issues related to the maintenance of the
technical condition of the BLS unit and other relevant conditions, cf. Section 6.2.

As a partner in the transport company ISDT, Shell has not identified weaknesses in
connection with the follow-up of the shipowning company. We also make reference to the
tanker advisor function with the specific follow-up of technical problems, incidents and
audits.
 15

Requirement:
Section 5 of the Framework Regulations relating to responsibility according to these
regulations, where it is specified in the second paragraph that the operator shall see to it that
everyone carrying out work for him, including contractors or sub-contractors, complies with
requirements contained in legislation related to health, the environment and safety, cf.
Section 13 of the Framework Regulations relating to the duty to establish, follow up and
further develop a management system, Section 14 of the Framework Regulations relating to
the qualification and follow-up of other participants, and Section 15 of the same regulations
relating to verifications, which stresses, for example, that the party responsible shall verify
that the requirements in legislation relating to health, the environment and safety have been
met, cf. Section 3 of the Management Regulations relating to the management of health, the
environment and safety, where it is specified that the party responsible shall ensure that the
management of health, the environment and safety comprises the activities, resources,
processes and the organisation necessary to ensure prudent activities and continuous
improvement.

Section 12 of the Management Regulations relating to information states that the party
responsible shall identify the information that is necessary, and process and distribute such
information at the proper time, to enable the planning and performance of petroleum
activities, and to improve health, the environment and safety, cf. Section 18 of the
Management Regulations relating to the collection, processing and use of data, in order, for
example, to implement corrective and preventative measures, cf. Section 19 of the same
regulations, where it is stated that the party responsible shall record, investigate and examine
hazardous and accident situations to prevent recurrence.

6.1.2 Inadequate management and control of contracts

Nonconformity
Inadequate management and control of contracts for oil affreightment from Draugen.

Grounds:
As described above in Section 3.1 there are many parties involved who have responsibilities
related to oil affreightment from Draugen.

Based on information and documents received from Shell it is our opinion that responsibilities
and roles related to the follow-up of chartered tankers are not clearly defined. This applies in
particular in relation to who has the primary responsibility for ensuring a proper follow-up of
the individual tankers and loading operations they perform.

Requirement:
Section 3 of the Management Regulations, where it is stated that the party responsible shall
ensure that the management of health, the environment and safety comprises the activities,
resources, processes and the organisation necessary to ensure prudent activities and
continuous improvement. Responsibility and authority shall be clearly defined at any given
time. Section 21 of the Management Regulations relating to follow-up also states that the
party responsible shall follow up to ensure that all the elements of his own and other
participants management systems have been established and work as intended. This follow-
up shall contribute to identifying technical, operational or organisational weaknesses,
failures and deficiencies
 16

6.2 Observations Teekay

6.2.1 Maintenance management relating to the BLS unit

Nonconformity
It has been established that there are defects in the design and observance of the maintenance
programme for the Navion Scandia.

Grounds:
The job description for the three-monthly maintenance programme states that all hydraulic
hoses shall be checked for damage and defective hoses shall be replaced. This was performed
most recently on 23 August 2007 (around 4.5 months before the incident). The start of
cracking in the rubber sheath was not detected.

Monthly visual inspection of the BLS unit was performed regularly according to the
documentation on board, most recently on 11 December 2007. The job description states that
all the equipment shall be checked for damage and leaks. The comments on the inspection
results include "Well checked and tested" and "The BLS was found in good condition No
remarks".

Interviews conducted on the vessel and meetings with the management of Teekay and the
equipment supplier (APL) revealed that there are different opinions on how the practical
execution of items in the maintenance procedures shall be performed.

In our opinion, the damage to the hydraulic hoses that we observed during the investigation
indicates that these inspections were not followed or the type/level of condition monitoring
was incorrect. Subsequent technical examination of the hydraulic hoses, as described in
Section 4.3.1, supports this assessment.

Requirement:
Section 21 of the Management Regulations relating to follow-up states that the party
responsible shall follow up to ensure that all the elements of his own and other participants
management systems have been established and work as intended. This follow-up shall
contribute to identifying technical, operational or organisational weaknesses, failures and
deficiencies

Section 22 of the Activities Regulations relating to procedures states that procedures shall be
designed and used so that they fulfil their intended functions, as well as Section 42 relating to
maintenance, where it is stated that the party responsible shall ensure that installations or
parts thereof shall be maintained so that they are capable of performing their intended
functions. Section 44 of the Activities Regulations relating to a maintenance programme
states that fault modes which constitute a risk to health, the environment or safety shall be
prevented systematically by means of a maintenance programme.

6.2.2 Inadequate competence management - personnel with responsibility for

maintenance of the BLS unit

Nonconformity
It has been established that the competence and risk comprehension of Teekay's personnel is
inadequate.
 17

Grounds:
The interviews conducted on board and at a meeting with Teekay on 25 February 2008
revealed that the personnel who perform the maintenance have not received specific training
for maintenance of the BLS unit. In our opinion, this means that the performing personnel
have inadequate comprehension of the risk factors that exist, which is a prerequisite for being
able to make the right priorities and decisions with respect to the operations to be performed.

The maintenance performed, check prior to start-up and safety notice distributed after the
incident on Statfjord on 12 December 2007 have not resulted in detection of the damage to or
leaks in the hydraulic hoses. Compare with the description of the condition of the damaged
hydraulic hose, Section 4.3.1.

Requirement:
Section 11 of the Management Regulations relating to manning and competence, where it is
stated that the party responsible shall ensure adequate manning and competence in all phases
of the petroleum activities, cf. Section 19 of the Activities Regulations relating to competence,
where it is stated that the personnel shall have the competence necessary to be able to carry
out the activities safely and in accordance with the legislation relating to health, the
environment and safety.

6.2.3 Follow-up after buoy loading incidents and use of safety critical information

Nonconformity
It has been established that Teekay did not make adequate use of prior experience from
similar incidents to achieve an improvement.

Grounds:
The investigation of several corresponding incidents revealed weaknesses of a human,
technical and organisational nature. The follow-up of the identified weaknesses has been
inadequate.

The recommendation after the incident with the tanker Elisabeth Knutsen in December 2004
called, for example, for modification of the hydraulic system so that the proper closing time
would be maintained if the hydraulic hose ruptured. In November 2007 a Service Letter was
distributed by the equipment supplier, which recommended the installation of a restriction
orifice in the hydraulic outlet on the coupler valve.

The modification was not performed until after the incident on the Navion Scandia on 10
January 2008.

On the same day as the incident on Statfjord with the Navion Britannia on 12 December 2007,
a safety notice from Teekay was distributed by e-mail. The notice was sent to the captains on
Teekay's vessels with a copy to the company's management. The recipients of the notice were
requested to check all the hydraulic hoses on the BLS unit for damage and wear and to replace
the hoses if any damage was detected. The notice requested confirmation that the work had
been performed and that the hoses were in good condition. Such a confirmation was sent by
the Navion Scandia without any detection of the damage to the hydraulic hose.
 18

Better follow-up of the safety notice and other information would have prevented occurrence
of the incident.

Requirement:
Section 12 of the Management Regulations relating to information states that the party
responsible shall identify the information that is necessary, and process and distribute such
information at the proper time, to enable the planning and performance of petroleum
activities, and to improve health, the environment and safety, cf. Section 18 of the
Management Regulations relating to the collection, processing and use of data, in order, for
example, to implement corrective and preventative measures, cf. Section 19 of the same
regulations, where it is stated that the party responsible shall record, investigate and examine
hazardous and accident situations to prevent recurrence. Section 21 of the Management
Regulations relating to follow-up states that the party responsible shall follow up to ensure
that all the elements of his own and other participants management systems have been
established and work as intended. This follow-up shall contribute to identifying technical,
operational or organisational weaknesses, failures and deficiencies, cf. Section 22 of the
Management Regulations relating to improvement, where it is stated that the party
responsible shall continuously improve health, the environment and safety by identifying the
processes, activities and products that need improvement, and implementing the necessary
improvement measures.

6.2.4 Management of modifications to the BLS unit

Nonconformity
Inadequate management of modifications to the BLS unit.

Grounds:
Modifications were made to the original design of the BLS unit.

The first BLS unit produced by APL was delivered in 1992 and installed on board the Tove
Knutsen. It was in accordance with the original design. The remaining BLS units from APL
were delivered without a restriction orifice. The weakness in the design of the BLS unit was
not known to Teekay until after the incident involving the tanker Elisabeth Knutsen on 12
December 2004. During the meeting with APL and Teekay on 24 January 2008, it was
revealed that APL was aware of the design changes since the early 1990s, but it could not be
explained why these changes in relation to the original design had been made. No risk
assessments have been made by APL or Teekay with regard to the design modifications and
their potential consequences. In addition, the design modifications were not regarded as a
nonconformity and were handled accordingly.

Requirement:
Section 15 of the Framework Regulations relating to verifications states that the party
responsible shall decide on the extent of verifications, the method to be used in and the degree
of independence of the verification in order to document that the requirements have been met,
cf. Section 8 of the Management Regulations relating to the basis and criteria for decision,
where it is stated that, prior to decisions being made, the party responsible shall ensure that
issues relating to health, the environment and safety have been comprehensively and
adequately considered. The third paragraph of the same section also states that the party
responsible shall ensure the necessary co-ordination of decisions at the various levels and in
the various areas in order to avoid unintentional effects, cf. Section 13 of the Management
Regulations relating to general analysis requirements, where it is stated that the party
 19

responsible shall ensure that analyses are carried out that provide the necessary decision-
making basis in order to give due consideration to health, the environment and safety, cf.
Section 15 of the same regulations relating to quantitative risk analyses and emergency
preparedness analyses, where detailed rules are provided concerning the risk analysis
requirements.

Section 20 of the Management Regulations relating to the handling of nonconformities states

that the party responsible shall record and follow up nonconformities with requirements in
legislation relating to health, the environment and safety, including nonconformities with
internal requirements. The nonconformities shall be corrected, their causes shall be
established and corrective actions shall be taken to prevent recurrence of the nonconformity.

6.2.5 Inadequate follow-up by management

Nonconformity
It has been established that there are defects in Teekay's management of important HES
aspects related to the oil loading system.

Grounds:
The investigation established defects in Teekay's observance of important aspects related to
the requirements for and follow-up of design, prerequisites for safe operations and
maintenance of the BLS unit, including the management of changes, management of
competence and provisions for correct maintenance, as described in Sections 6.2.1 - 6.2.5.

Requirement:
Section 3 of the Management Regulations, where it is stated that the party responsible shall
ensure that the management of health, the environment and safety comprises the activities,
resources, processes and the organisation necessary to ensure prudent activities and
continuous improvement. Responsibility and authority shall be clearly defined at any given
time.

6.2.6 Requirement for control of the BLS unit before start-up of loading operation

Improvement point:
It has been established that there are unclear requirements related to control of the BLS unit
before start-up of the loading operation.

Grounds:
Teekay has used several checklists on the Navion Scandia as a basis for checking the BLS
unit and associated valves and equipment before the start-up of the loading or unloading
operation. The checklist that was used before the start-up of the loading operation in question
contains a set of checkpoints, but it does not explain how the check should be performed in
clear text. Therefore there is room for different interpretations and methods for performing the
check of the BLS unit.

Comparing statements from the personnel on board the tanker with statements from the
management of Teekay confirms that there are different opinions and interpretations relating
to the use of the checklists.
 20

Requirement:
Section 2 of the Management Regulations relating to barriers states that it shall be known what barriers have
been established and which function they are intended to fulfil. Section 22 of the Activities Regulations relating
to procedures also states that procedures shall be designed and used so that they fulfil their intended functions,
as well as Section 42 of the Activities Regulations relating to maintenance, where it is stated that the party
responsible shall ensure that installations or parts thereof shall be maintained so that they are capable of
performing their intended functions.

6.3 Technical barriers that have worked

The incident at 7:50 a.m. when the hole in the hydraulic hose to the coupler valve caused a
break in the Green Line, closing of valves on the tanker and shutdown of export pumps on
Draugen functioned as intended in accordance with the design of this system.

The loading hose between the loading buoy on Draugen and the tanker Navion Scandia was
equipped with a so-called breakaway coupling (MBC). This was a technical barrier that
worked and prevented a larger discharge of oil.

7 Other comments

7.1 Metering of loaded oil

During buoy loading, the volume of oil that is exported from the storage tank to the tanker is
metered relatively accurately by means of metering equipment installed on board the fixed
installation. Corresponding equipment is not installed on board the tanker. If the loading hose
ruptures, an immediate metering of the difference between the exported and received volume
of oil on board the tanker will therefore not be achieved. In cases where the MBC fails, there
will be a potential for large discharges.

7.2 Shell's own investigation

The investigation leader works as a senior tanker advisor for Shell. The tanker advisor's
function includes arranging HES/operation meetings with Teekay, as well as specific follow-
up of technical problems, incidents, audits, etc. The advisor also has access to specific reports
that are published in connection with loading.

We question thus whether Shell's investigation group can achieve an adequate degree of
impartiality in relation to the subject matter of the investigation.

PSAN's investigation was completed before Shell's own investigation was completed. We
have therefore not used Shell's final investigation results in our work.

7.3 ISDT's role

Based on the information we have received from Shell, as described in Section 3.1, ISDT
bears responsibility with regard to the follow-up of the tankers that are used on Draugen,
including the Navion Scandia.

In our opinion, this company could have also identified conditions that would have prevented
the incident from occurring through better follow-.up.
 21

8 Appendices

A: The investigation has been based on the following documents:

Description of the MT Navion Scandia Brochure.

Working drawing Loading manifold 20" BLS, rev. 0, dated 14 January 1997.
Working drawing Loading manifold 2538, rev. A, dated 18 November 1997.
Working drawing Coupler 20" BLS, rev. A, dated 13 January 1997.
Working drawing Hydraulic system BLS 2538, rev. 0, dated 2 April 1998.
Layout drawing Connection of loading hose. Copy received on the Navion Scandia
on 11 January 2008.
Illustration Connection between the plunger and hose valve. Copy received on the
Navion Scandia on 11 January 2008.
Illustration hose valve's mode of operation. Copy received on the Navion Scandia on
11 January 2008.
Job description Monthly maintenance procedure, BLS-0001-A, printout dated 11
January 2008.
Job description Three-monthly maintenance procedure, BLS-0003-A, printout dated
11 January 2008.
Job description Captain (master), responsibility and authority, doc. no. OR0016,
version 10.
Job description Chief Engineer, responsibility and authority, doc. no. OR0017,
version 7.
Job description Chief Engineer JR, responsibility and authority, doc. no. OR0247,
version 1.
Job description Seaman on Duty, doc. no. OR0033, version 6.
Internal checklist for arrival to or departure from the field, rev. no. 02.05, rev. date 26
July 2005.
Checklist 1 Buoy loader equipment, doc. no. FM0328, version 2.
Checklist 1 Buoy loader equipment completed, doc. no. FM0328, version 2.
Checklist 2 Buoy loader equipment, doc. no. FM0329, version 2.
Checklist 2 Buoy loader equipment completed, doc. no. FM0329, version 2.
Checklist for arrival to Draugen, doc. no. FM0026, version 6.
IMO Crew list for the MT Navion Scandia, dated 9 January 2008.
Log for performance of maintenance on the Navion Scandia, 29 October 2006 to 8
January 2008. Printout dated 11 January 2008.
Standard for Ship and Quality Assurance, Shell, issued January 2004.
Contract of Affreightment between Den norske stats oljeselskap a.s and I/S Draugen
Transport, dated 20 December 1996.
Guidelines for the Quality Assurance of Oil, Chemical and Gas Carriers, Shell
Trading, issued January 2004.
Investigation Report, Oil Spill and Hose Failure, Draugen, 24 November 2006.
APL Service letter, 21 November 2007.
Preliminary investigation report from Shell, Draugen FLP etc., Navion Scandia Oil
Spill, 10 January 2008. Received on 5 March 2008.
 22

Investigation report, discharge of oil during loading to the Navion Britannia from
Statfjord, dated 12 December 2007. Statoil report no.: A EPN LI 2007-05, dated 8
February 2008.
Bow Loading System Specification (Shuttle Tanker) Standard Operating Practices,
Teekay, doc. no. SP0781, version 1.
Navion Company Maritime Letter, NAV-L-30070, 3 February 2003.
Teekay Company Maritime Letter, TKN-L-50032, 26 January 2005.
E-mail received from Shell on 12 March 2008: Regarding the roles of
Shell/STASCO/StatoilHydro and ISDT in assuring the suitability of vessels note the
following:
Test av MBC. Performed by ASAMS Limited: 5/8 UNC Activated Titanium
Breakstuds for Testing. From 16 NB STD. CDC MBC for A/S Norske Shell. Serial
number: GTM 0189/Material Number: T534-0608823/Material: Ti6AL4V.
ASAMS/0011911
Inspection of hydraulic hoses from Draugen. Report from Statoil Hydro's research
centre. Received by e-mail on 10 March 2008.
Instruction for Operation and Inspection of the APL and AkerPusnes BLS (Bow
Loading System) design and construction. Teekay, undated. Received copy by e-mail
from Shell on 17 January 2008.
Changes to BLS maintenance. Undated message from Teekay sent to all operators and
vessels with an APL or APL/Pusnes type BLS unit. Received copy by e-mail from
Shell on 17 January 2008.
Emergency Shutdown and Disconnection (ESD) Procedure, doc. no. SP0258, version
2
Bow Loading Operation Procedure (Shuttle Tanker), doc. no. SP0778, version 1.
Bow Loading System Specification (Shuttle Tanker), doc. no. SP0781, version 1.
Navion Scandia tanker pool. E-mail from Shell dated 25 January 2008.
 23

B: Summary of personnel interviewed: (removed from the Internet)

INTERVIEWED
STARTUP
NAME FUNCTION DURING SUMMARY MEETING
MEETING
INVESTIGATION

C: Abbreviations:

1 (inch): 25.4 millimetres

APL: Advanced Production and Loading AS (formerly MCG/Hitec Marine AS)
BLS: Bow Loading System
ESD: Emergency Shut Down
FLP: Floating Load Platform
Green line: Signal that must be present before loading can take place.
HPU: Hydraulic Power Unit
Maritime letter: Shipowning company circular with important information to the vessels
MBC: Marine Breakaway Coupling
MTO: Man, Technology and Organisation