Royal Dutch Shell Plc  .com Rotating Header Image

The Hindenburg, The Titanic and Shell Prelude FLNG

The Hindenburg, The Titanic and Shell Prelude FLNG

By John Donovan

A huge bomb the size of several aircraft carriers welded together is floating off the coast of Australia. It was never meant to be a bomb but is now deemed to be so dangerous, susceptible to an explosion, that it is on emergency shutdown after a fire. 

This article is written in collaboration with a retired Shell Global HSE Consultant Mr Bill Campbell. For several years we have been jointly ringing alarm bells about the Shell Prelude FLNG project.

Mr Campbell has a worldwide reputation in offshore safety.

I operate several websites focused on Shell including widely known for publishing leaked insider information about Shell mega projects. A Russian government minister Oleg Mitvol has confirmed that Shell whistleblower information I supplied to him cost Shell its majority stake in the Sakhalin2 project.

The Hindenburg and The Titanic both utilised the cutting-edge technologies of their time yet ended up being forever associated with mind-numbing calamity and disaster on an epic scale. 

Prelude has already come very close to disaster and is currently shut down by the Australian regulator, the Australian National Offshore Petroleum and Environmental Management Authority (NOPSEMA) on safety grounds after an onboard fire. 

It is important to bear in mind that an industrial disaster on the scale of the Deepwater Horizon oil spill can potentially bring down even an oil giant such as BP. It almost did. See this extract from a BBC News article: The giant oil spill from a BP rig off the US coast in 2010 nearly ruined the company, its chief executive has said. Bob Dudley described the fire on the Deepwater Horizon and its aftermath as “a near death experience” for the firm.

Prelude is the world’s largest floating liquefied natural gas platform as well as the largest offshore facility ever constructed. The superlatives showered on Prelude over the years make it sound ominously like those associated with The Hindenburg and The Titanic prior to the disasters that tragically occurred.

I was first approached about Prelude by a whistleblower source several years ago. He said in December 2013:  “…god for bid if anything should happen on that vessel in the future I want it known that I raised my concerns officially.”: “It will go down like a lead balloon (or possibly prelude) but if I was an Australian I would refuse to work on the vessel…”

Nine years later the ill-fated vessel has been shut down because of repeated dangerous occurrences and near catastrophe. 

At the time of the whistleblower allegations, which was supported by evidence, I sought advice from a team of four experts. They included Mr Campbell, a senior engineer who led offshore safety audits for Shell. After he retired, Shell hired him to continue the same function.

It is a matter of public record that Mr Campbell is the author or contributor of numerous articles since 2004 published on my website ringing alarm bells about the Prelude project. Thus far, Mr Campbell has not actually said “told you so” but the thought must have passed his mind many times as alarming events have unfolded. Basically, Mr Campbell provided the expertise and I provided the platform to publish his warnings.

Many years ago, Shell made the mistake of failing to properly heed Mr Campbell’s warnings about issues uncovered when he led a safety audit team during the inspection of the Brent Bravo North Sea platform. The failure to do so tragically resulted in the avoidable deaths of two platform workers and Shell receiving a record-breaking fine. Mr Campbell fearlessly drew attention to falsified safety records and the operation of a “Touch Fuck All” approach to safety-critical maintenance. Production was given a higher priority than workers lives. Years later, even the lifeboats were found to be unseaworthy!

Mr Campbell gave expert testimony to the U.S. Congressional Inquiry into the Deepwater Horizon disaster.

He is rightly recognised as an authority worldwide on the design, operations and maintenance of these rather unique workplaces.

This article includes reference to two articles Mr Campbelll has recently supplied to the Parliament of Western Australia Economics & Industry Standing Committee, which has a brief covering Energy.

The same information has been sent to other potentially interested parties including the Australian National Offshore Petroleum and Environmental Management Authority and the Australian maritime union.

Our overriding concern is about the safety of the relevant workers and the public.

At the start of my collaboration with Mr Campbell, initially on Shell North Sea safety issues, Shell created a crisis reaction team in an effort to detach him from his contact with me. Shell lawyers even leaned on his solicitors as part of a coordinated military-style plan later expanded into an international cloak and dagger operation which has continued until current times.

Shell has the most appalling safety record hence we were perceived as a real threat just by exposing the truth. The listed fines and newspaper headlines over the years speak for themselves.

Billions are at stake for Shell in mega projects such as Prelude. The huge sums involved may sway sound judgement. In this connection, it is notable that Shell CEO Ben van Beurden has recently downplayed the unfolding dramatic events as “Teething Problems“. Given the content of the attachments and the actions already taken by NOPSEMA, his self-serving description seems to bear out the fear that Shell is still prepared to improperly risk offshore workers lives to achieve its commercial objectives.


ARTICLE: Why Floating LNG is such a risky business venture (Online Link )

Selected extracts

Hope as they say springs eternal, so hopefully Prelude will have a long and major incident free life. But, and it’s a big but, in the event of some catastrophe the Company would be open to the accusation that it ignored design conventions adopted as a result of the learnings from previous calamitous events worldwide and willingly accepted an option for development which, when compared to current EU and UK directives and standards, in essence ignores those standards, making the FLNG option inherently unsafe.

The question to the Board post such an event would be why did you accept a development option FLNG when you were fully aware that the risks to your employees offshore we’re not as low as reasonably practicable? And why therefore did you make financial interests a priority for this project over the health and safety of your employees when you had a choice to do otherwise?

ARTICLE: Prelude FLNG risks are on par with modern offshore oil and gas facilities say Shell – but are they? (Online Link)

Selected extract:

If we consider the dimensions of the vessel at 488 long by 74 wide by 33.3 metres down to the water line this represents a volume of circa 1.2 million cubic metres. So 100 m3 of LNG can in windless conditions create a dome shaped cloud that engulfs the entire vessel and if a wind exists, as is the norm, such a cloud could engulf the TR, its escape routes and the lifeboats in a matter of minutes.


We have now done everything in our power to bring Mr Campbell’s expert assessment to the attention of the parties involved, including Shell and the Australian authorities.

The list of Prelude articles containing many alarming headlines means that if god forbid, as the whistleblower warned, there is a disaster, it will surely be the most predicted man-made disaster in history. 

More information here about me, my website and my main contributor on Shell safety issues, Mr Bill Campbell.



In 2015 the steering committee, after review of submissions to them, concluded that perhaps the question on everyone’s mind at this time is FLNG safe? the Committee cannot answer. Perhaps after reading this summary, and the attached paper, the current committee will be better advised.

The Shell submissions, bold and confident, declared that Prelude FLNG would be safer in terms of potential loss of life than fixed and FPSO facilities currently operating worldwide. Also, remarkably, that Temporary Refuge impairment on Prelude would be 10 times lower than the present industry standard from 1 in 1000 to one in 10,000 years.

Period 2018 to 2020. 

For comparison, Prelude was compared with North Sea data for Dangerous Occurrences, this data available in the public domain from the Regulators HSE and NOPSEMA.

HSE reported a dangerous occurrence on average one per day from a sample population of 180 in 2018.  A total of 347 occurrences that year. This equates to one occurrence per offshore installation per year. Prelude over the 3-year period discussed had 62 dangerous occurrences with a frequency between these events of 18 days. Simply put, the number of failures on Prelude are 365/18 or 20 times more than the average North Sea installation. Refer to Part 2 of the paper in Search of Reality sent with this summary.

NOPSEMA reports 8 losses of containment of hydrocarbons, causing General Platform Alarms to sound, followed by Emergency Response and full muster

There were also 3 losses of containment of non-hydrocarbons

There were 7 fires or suspected fires but this needs to be qualified by the fact that there were 11 dangerous occurrences due to failure of safety critical systems used to extinguish or mitigate against major fire events to stop escalation into a major accident event with potential impairment of the Temporary Refuge.  For example, inability of the main firewater main to meet design flow standards, seawater deluge system around LNG tanks could not again meet design requirements, helideck firewater pump fails to operate etc 

There were 15 Failures of the installations Emergency Shutdown System, including the emergency depressurisation of process vessels and pipework to minimise energy available should a major conflagration persist. A principal ESD valve on incoming riser failed to close.  These failures should not be considered in isolation. We have to consider the failures related to fires now combined with failure of ESD systems to react to the fire and to gas detection.

There were 4 potential fatality or serious injuries involving two crewmembers at the marine load arm when it moved uncontrollably. In addition, a block of ice forming on the arm fell hitting a worker on his helmet. In another incident the weather protection covers for a line-of-sight gas detector on the upper deck dislodged in a 50-knot wind

There were 7 losses of main and emergency power generation causing Alarms and muster

There were 5 sources of ignition, during an inspection it was found that the Cranes F in close proximity to the Temporary Refuge and Cranes A thro D located above the process and utility modules.  The cranes were only found to be defective on 27 March 2019 about a year after production commenced in late 2018

On 23 December 2019, gas was detected at the HVAC inlets of the TR on levels A and B resulting in Alarm, Emergency Response and full muster. Note that Crane F was in this vicinity.   The flammable gas vapour cloud DID NOT emanate from Prelude but from a condensate tanker moored some 90 metres to the rear of the stern of Prelude being loaded from Prelude at the time. The weather conditions were calm with a slight breeze, unfortunately the breeze was blowing from the tanker towards the aft of the vessel. At that time there was NO APPROVED PROCEDURE for this activity and hadn’t been from when first cargo of condensate was offloaded months earlier. The decision, shared by Shell and the Regulator, was do not carry out a major investigate, the venting of vapour from the tanker was said to be a routine activity, not an unplanned release, venting of cargo tanks accepted industry practice. In the Authors opinion, this Incident was not investigated appropriately, it did not determine why the Prelude Terminal crew allowed this offload, when calm weather heightened the known risks and when the wind was in the wrong direction towards Prelude where the plume arrived 5 minutes later.  

Why was there no approved procedure? When it was eventually issued on 9 July 2021 the procedure stated that in the conditions prevailing the Terminal Loading Team to consider stopping cargo operations to prevent a gas plume reaching Prelude, wind speed and direction needs to be taken into account prior to the commencement of cargo operations. If this procedure had been available and enacted upon. the potential impairment of the TR would have been avoided



The Committee should note there were no Dangerous Occurrences reported by NOPSEMA for this period, similar to the HSE database, assume due the Covid. As you are aware however on 2/12/21 a small fire started a sequence of events. Loss of main and emergency generation could not be remedied immediately; all this is covered in a Direction from NOPSEMA, and as a result, Prelude FLNG is expected to be down for months. 

WM Campbell DMS MIEE B.Sc. C.Eng.


Government concerns

Being influenced no doubt by the examples, in the North Sea and the Gulf of Mexico, of what can go wrong in the great offshore adventure, the WA government held an Inquiry completed and published May 2015.It’s only natural, that such an Inquiry was conducted witnessing as we all did, observing in our living rooms, the penalties that Society pays when things go wrong. Who wouldn’t worry? Construction was advanced at the shipyards with this mammoth ship taking shape and coming their way.This wasn’t an ordinary vessel, it would on its deck support a hazardous substance plant, not an onshore plant with its storage tanks geographically displaced from the process with its loading jetty some distance away. It was a protype, FLNG was a revolutionary concept yet to be proved safe in operation.The Inquiry concluded that whether Prelude FLNG, was safe or not, cannot be answered but stated that the Inquiry had been made aware of the considerable efforts made by Shell in working to ensure that the risks associated with Prelude are appropriately reduced.


Shell in its submissions were confident that Prelude would operate at risk levels in terms of potential loss of life, equal to or better than other offshore installations, fixed and FPSO worldwide.From Quantitative Risk Analysis (QRA) and Formal Safety Assessment (FSA) they concluded the Temporary Refuge (TR) impairment frequency for Prelude was an order of magnitude lower than the industry norm, that is from 1 in 1000 to 1 in 10,000.

Contributing to this positivity Conoco/Philips submitted that there was no technical reason why we cannot make FLNG safer than other hydrocarbon businesses, it is fundamentally no different – do not think there is anything specifically magic and different about it.There were a number of opposing views, Chevron and Dept of Mines raised concerns that FLNG was an unproven technology. Trades Unions also raised concern namely re the risks of Prelude workers who were to be retained onboard in grade 5 cyclonic conditions. (Wind at or exceeding 156 mph or 136 knots)

Notable Exclusions from the Shell submission was Combined or Simultaneous Operations

Prelude would routinely operate, in combination with offtake tankers, loading LNG, LPG and condensate in dynamic conditions on the high sea. In this atypical operation of an offshore installation, Prelude regularly offloads cargo into tankers, moored aside the Prelude, or in close proximity to it. In North Sea operations, if combined operations are planned, the Safety Case requires to assess the combined risks of such an operation, that is, the risks imposed by the Facility on the Tankers, and vis a versa, the risks of berthing and offloading to the tanker imposed on Prelude. In the 2015 submissions to the government, the accumulative risks of combined operations were not covered, other than the environmental risks of loss of containment of cargo from the tanker on the environment, and the design of the Marine Loading Arms in dynamic conditions.


Part One: Unsubstantiated Confidence in Shell submissions

But it was the confidence in the submissions, great expectations, obvious from Shell and some Industry submissions, that Prelude would not just be safe, but would rival or be safer than conventional offshore installations, fixed and FPSO, currently operating anywhere across the world.This assumption, now stunted with the current reality. Since start up, Prelude’s availability to produce, is around 69%, the RDS CEO in recent discussions with journalists explained that for 4 months at the end of 2021 the LNG plant operated reliably giving an operating reliability over the 4-year period of circa 14%, but it’s now shut down again after the fire for an indefinite period. In search of reality, is an analysis of Prelude safety performance in operation compared to the North Sea safety performance over several years. In Part 5.1 are discussed the implications of not fully covering the risk of combined operations as explained in a review of an incident, where a gas vapour cloud emanating from a condensate tanker, was ingested into the Temporary Refuge inlets and where gas sensors in close proximity to the inlets went into alarm causing the automatic closure of the inlet fire dampers in response, followed by a full muster.

Part Two: Assumptions versus Reality

An analysis of safety performance between Shell FLNG and North Sea offshore installations based on public domain data published by NOPSEMA and HSE-UK covering 2018,2019 and 2020.

HSE Safety Data 2018 to 2020

The HSE is the Health and Safety Executive Offshore Division based in Aberdeen, an organisation set up post the Piper A disaster.Although the North Sea production is in decline there were in 2020, as covered in data from the UK Oil & Gas authority, active consents to produce from 150 oil and 84 gas fields.Some 29,000 people were gainfully employed on 180 offshore installations (sample size used below) to harness energy from these fields located in UK waters in the North Sea per se but also West of Shetland in the Atlantic, and the Irish sea, mainly gas from the Morecambe Bay area.

The data from HSE and NOPSEMA used in this comparative analysis covers Dangerous Occurrences (DO), a common definition of which shared by both, Regulators. The difference between HSE data and NOPSEMA data is in the UK accidental or unplanned loss of containment of hydrocarbons (HRC) is reported separately as per Cullen Recommendation 39 that a database of HRC releases be developed.HRC is the principal performance indicator of technical integrity offshore, and HSE and the industry has been trying to reduce these incidents over many years, but they still persist at unacceptable levels.As many installations reach, or exceed original design life, this struggle will continue, as an offshore installations failure characteristics are Age Related. It can be expected that failure rates will increase with age, and as many installations reach, or exceed their expected operational design life.

2.1: HSE North Sea Dangerous Occurrences 2018 to 2020

In 2018 there were 347 Dangerous Occurrences (DO) consisting of 235 DO and 112 Hydrocarbon losses of containment from a homogeneous population currently of 180. Over that 365-day reporting period an incident in the oilfield occurred at a frequency of one per day, 365/347 or 1.05 per day. HSE, for confidentiality reasons, do not indicate the spread of these incidents, so some installations will have had no DO and some more. The average mean time of dangerous occurrences per installations in 2018 was simply 347/180 or 1.92. So, if the homogeneous population of installations were theoretically contributing equally to the grand total an individual installation, would report 1.9, say 2 Dangerous Occurrences per reporting period of 365 days.In 2019, on the same basis, HSE report 344 DO or one per day, with an individual installation contribution of 2 per year. In 2020, HSE reported 266 DO one every 1.4 days, with an individual installation contributing 1.5 per year.

2.2 Prelude FLNG NOPSEMA data for Offshore Occurrences 2018 to 2020

In 2018 the first Dangerous Occurrences (DO) related to the tanker berthing and mooring trials was reported on 10/5/18.These occurrences as explained previously included unplanned hydrocarbon releases. For that period NOPSEMA recorded in its public domain website 17 DO. So, on average, an incident occurred on Prelude every 21 days.In 2019, on a similar basis, 26 DO were reported on Prelude, on average one every 14 day. In 2020, on the same basis. NOPSEMA data reported for Prelude 19 DO, one every 19 days, a slight reduction.


Summary: over the period 2018 – 2020

HSE Offshore reported a Dangerous Occurrences in the oilfield, an average of one per day, and for a typical offshore installation a DO occurred once or twice a year.

For Prelude, for the 3-year period there were 62 Dangerous Occurrences, on average one every 18 days or 20 a year. Set against this a North Sea installation recorded 1 per year in 2018, and 2 per year in 2019/20.

In 2018 there was 1 DO every 365 days in the North Sea set against Prelude with 17 DO or 1 every 21 days

2019 HSE data had 2 DO every 365 days or 1 DO every 182 days, Prelude had 26 DO or 1 every 14 days

2020 HSE data had 2 DO every 365 days or 1 every 182 days, Prelude had 19 DO or one every 19 days, an improving picture but not statistically significant.

Finally, the data from the North Sea is not statistically sensitive, if for example, a smaller number of installations was used, for argument’s sake let’s say some installations may have been closed down awaiting removal and reported no DO. So, for 2018 the then homogeneous population of North Sea installations was 180, DO frequency was 2 per year, if 160 is considered due perhaps the reduce population for whatever reason, the DO numbers increase slightly to 2.17 per year, a statistically insignificant change


3.0: Conclusions from Comparative Analysis

The North Sea after the Piper A disaster, as with the improvement in the supervision of offshore health and safety with the creation of NOPSEMA, has increased competent industry supervision by the HSE Offshore Division in Aberdeen.In the years covered above, HSE inspections offshore, have averaged 128 per annum, so they are busy people.That this has been after Piper Alpha, the most regulated industry in the UK, it should give confidence to the committee that the failure data for UK offshore installations is accurate and under reporting of Dangerous Occurrences by Operators to the regulatory authority is not an issue. Over the period discussed, as with Prelude, thankfully no fatalities were reported.

Human error and lack of understanding also becomes less of an issue as the competence of the operators grows and as they gain a better understanding of the equipment and processes, they operate. But it is also a factor, that human error can increase if workers suffer overwork and sleep deprivation as occurred on Prelude (as was covered by Australian media). This concern was mainly raised with regards to tanker handling during busy periods.

3.1: The implications of Combined Operations

The Shell submission did not make clear the risks imposed on Prelude by offloading cargo, for example the accepted and routine venting of flammable vapour from condensate tankers during offloading, did not cover in submissions to the Inquiry that such venting, not considered a loss of containment and is accepted industry practice, as demonstrated in the findings of Incident 6314 of 23/12/19 for example. This event led to potential impairment of the Temporary Refuge when gas was ingested into the TR inlets. With reference to the risks of combined operations as discussed above, the gas vapour cloud surrounding the TR did not emanate from Prelude facilities (as raised by the Dept of Mines submitter as a concern) but from a tanker well aft from the stern of Prelude.This is further discussed in Part.5.


Part 4: A brief summary of NOPSEMA data of Dangerous Occurrences recorded from 2018 to 2020. To aid the committee, or any other interested party, the summary includes the Incident Number


4.1 Loss of Containment of Hydrocarbons and Non-Hydrocarbons

INCIDENT 5444 (10/10/18)

Gas leak from flange of marine loading arm resulting in General Platform Alarm (GPA), Emergency Response (ER), and muster of non-essential persons.

NB: Explanation of what (ER) general procedures mean

Non-essential is by definition crew members with no emergency duties other than assembling at their muster station on change of platform status where they wait until instructed to do otherwise by the Offshore Installation Manager (OIM). Muster checkers count the numbers at their stations so that persons are quickly accounted for. On an alarm sounding, fire teams muster, normally maintenance staff, at their emergency response stations whilst operating technicians report at the scene on what is happening, to the constantly manned Central Control Room, who then communicate this information to the Emergency Response Room within the TR, where the OIM musters along with his helpers, to command and control the situation.

INCIDENT 5444: 10/10/18

Gas leak from 2 flanges on Marine Load Arm (MLA) caused thermal stress resulting in bowing of pipework.This phenomenon was accepted by the design consultants of the MLA as not being covered by them

INCIDENT 6106 (23/8/19)

Gas leak from hydrocarbon process equipment

INCIDENT 6151 (8/9/19)

Coincidental gas sensors 14 meters from an MLA confirm a leak, this is followed by GPA, ER and full muster. NOPSEMA Direction 780 discusses

INCIDENT (10/12/19)

Loss of containment when work party broke into equipment containing High Pressure liquid that had not been correctly isolated. NOPSEMA Direction 780discusses

INCIDENT 6314 (23/12/19)

Coincidental gas sensors at HVAC inlets A and B of TR actuate dampers to close.Emergency Response Teams report that this was due to venting from a condensate tanker some 5 minutes after the venting occurred. GPA, ER and full mister ensues.This incident is discussed in Part 5.

INCIDENT 6318 (24/12/19)

Gas release between 1 and 300kg

INCIDENT 6335 (9/1/20)

Gas release, followed by GPA, ER and muster. Loss of containment during reinstatement of Relief Valve, NOPSEMA Direction 780 discusses

Non hydrocarbon loss of containment

INCIDENTS 6156 – loss of containment of hydraulic oil, 6360 – steam leak, 6435 loss of 1200 litres of lubricating oil.

4.2: Fire or suspected fire

INCIDENTS 5458 and 5545 smoke detected in forward machine space, 5651 fire in oxygen generator, 5590, fire on steam pipe insulation, 6339 fire in laundry of accommodation 6364 activation of smoke alarms GPA, ER and muster, 6280 operations of two flame detectors GPA and muster

4.3: Failure of Safety Critical Equipment (SCE) Systems designed and installed to prevent escalation of fire.

INCIDENTS 5391, Seawater deluge protection for LNG tanks set 22-26 deluge valve fails to meet design flow rates. 5491, Seawater deluge valve fails, 6386 Helideck firewater pump fails, 6591 Galley fire damper fails, 6172 faulty water mist detected during operation, 6060 Seawater firewater supply not meeting design standard and 6083 Seawater deluge valve would not reset. 6249 Distributed Control System (DCS) monitoring the hydrocarbon process lost communication with it. 5458 smoke was detected in forward machine space, 5445 smoke detected in forward machinery space. 5501 (20/7/18) during monthly performance test fire damper at level A HVAC inlet of TR failed to operate.

4.4: Failure of Emergency Shutdown System (ESD) vital to close in the process, and depressurise gas to flare, to reduce rapidly hydrocarbon inventories to minimal levels in vessels and pipework to reduce probability of escalation that could lead to a Major Accident Event (MAE), and other failures

INCIDENTS: – 6241 & 6374 Failure of valves in hydrocarbon process, 6127 Emergency Shutdown Valve (ESDV) failed to close, 6283 failure of 2 ESDV,valves, 6308 Hydrocarbon process relief valve failure, 6229 Blank plate found in Relief Valve that would have prevented it operating to reduce pressure, 6385 Process emergency pressure reduction during reduction during blowdown failed to meet design parameters, 6128 Principal ESDV incoming riser valve failed tooperate,6432 Failure of relief valve, 6144, process shutdown valve failed to operate, 6294 failure of primary instrument protection on a process Knock Out vessel, 5531 instrumentation monitoring process not meeting design requirements, 5524 failure of deck foam system, 5531 safeguarding instrumentation not meeting performance standard and 6312 damage to instrumentation tubing

4.5:Potential fatality or serious injury

INCIDENTS: – 6056 Worker Struck on head when ice fell from Marine Loading Arm. 6408 Gas detector sensor protection cover on Line of Sight (LOS) system dislodged in 50 knot wind. 6147 two Technicians narrowly avoid injury when MLA arm moved uncontrollably.5475 high levels of hydrogen sulphide H2S.

4.6: Loss of main and emergency generation

INCIDENTS: – 5523 loss of power followed by GPA and muster, 5552 avoidable damaged caused when running an Emergency Generator during tests, 5551 a loss of power followed by GPA and muster, 6361 loss of power GPA and muster, 6362 a loss of power followed by GPA and muster, 6368 Emergency Generator overheating, 6099 Emergency Generator fails to start

4.7: Sources of Ignition of flammable gases

INCIDENT 6553 on 27/5/20

After an inspection it was discovered that cranes F and A to D presented a source of ignition. This was months after start of operations late 2018 and shipment of first cargo 12/5/2019. The NOPSEMA report informs cranes A to D remained isolated but Crane F which is aft of the TR protection blast wall, and in close proximity to the TR, had been de-isolated then operating under a risk assessment. The implications of this are discussed in Part 6.


Part 5: How a flammable gas cloud routinely vented from a condensate Tanker and reached the TR HVAC inlets


On 23 December 2019 a GPA sounded, all non-essential workers went to their muster stations within the Temporary Refuge and a full emergency followed. An Emergency Response team on arrival at the scene found that gas sensors in the ventilation inlets at deck levels A & B had initiated the automatic closing of the fired dampers at HVAC Inlets A and B This automatic action to close fire dampers is necessary to prevent ingress of gas into the accommodation building where sources of ignition are likely to exist and many workers are assembled. The immediate investigation concluded that 5 minutes before gas entered the inlets a tanker being loaded with condensate had vented its tanks to atmosphere to relieve pressure in the cargo tank being loaded, at that time. the weather was calm with light winds.

5.1: A review of the Investigation Report of NOPEMSA incident 6314

Cargo vapours venting from condensate tankers are known about and venting is not uncommon. It is Industry practice. The conclusion from the NOPEMSA incident investigation was do not conduct a major Investigation.

The procedure, not available at the time of this incident, explains that offloading a condensate cargo from Prelude required appropriate weather conditions to prevail prior to starting offload to the tanker, namely wind speed and direction. In calm conditions, the procedures that are now in place give guidance on what is required because of venting of the condensate tanks on the tanker is known can create a flammable vapour cloud which would normally be diluted and dispersed on a windy day but the winds were light.The Incident report explains that venting flammable gas vapour to atmosphere is not considered to be an unplanned loss of containment and occurs when necessary to maintain the pressure in the top of the tank being filled.

This INCIDENT 6341 occurred on 23 December 2019 and the investigation report concluded do not conduct major investigationa position mutually agreed between Shell and the Regulator. The report clarifies further – it is not clear how, given a reasonable variation of circumstances, a flammable gas cloud from the tanker could reach Prelude in a concentration high enough to be an ignition risk.

To explain, the reasonable variation of circumstances implied here was that this gas cloud should not have been problematic if the wind had been blowing in the right direction from aft of Prelude toward the tanker, but it wasn’t.The breeze was in fact lightly steering the developing vapour cloud towards Prelude where, 5 minutes later, it was present at the HVAC inlets of the TR, both at level A and level B.The tanker was approximately 90 metres directly behind the stern of Prelude. On detection of the gas a GPA was initiated and the inlet dampers closed. The Emergency Teams arrived to investigate and a muster commenced.

All this SHOULD NOT HAVE HAPPENED, but it did, perhaps because the offloading of condensate from Prelude to the tanker did not at the time have an approved procedure. The procedure was finally issued for use on 9 July 2021 many months after the first offload of condensate from Prelude on 25 March 2019 and this incident on 23 December 2019.

What did the approved procedure say?

Venting in calm conditions wind speeds less than 5 knots

The Prelude Terminal Loading Team (who were present on the tanker at the time as their duties dictated) to consider stopping cargo operations toprevent any gas plume reaching Prelude, wind speed and direction need to be taken into account prior to commencement of cargo operations.


Would be better if to consider should be changed to must stop i.e., less of aguidance note and more of an instruction making it mandatory.

If this procedure had been issued for use, prior to this incident, would this incident have occurred? Probably not.But that is wishful thinking because they weren’t.It also begs the question, why did the regulator not ask about what procedures were in place then find out there was no procedure. It was obvious that a gas cloud, if the vessel vented, would migrate to the Prelude because that’s the way the breeze was blowing.They also knew that crane F was an ignition source near the TR. They have criticised Shell for not understanding inter-related risk but they also did not themselves have a holistic approach to their investigation.

Explanatory notes

(1):Temporary Refuges must be protected from impairment at all times, that is crucial.TR were installed following Lord Cullen’s recommendations post Piper Alpha.It is in essence he said for there had to be a safe haven, that would be used during a Major Accident Event (MAE), and where persons who escape to it could muster and await instruction to depart or abandon the facility. The Prelude Safety Case will cover the required TR performance standards which are subject to regular inspection to demonstrate the continued integrity of the TR.Formal Safety Assessments (FSA) et al should have demonstrated to the Regulator that the TR structure can endure as a place of safety for a minimum of 60 minutes without being impaired. The Operator has to demonstrate that the impairment frequency of the TR will be no greater than once in 1000 years during operations.

A very high-performance standard indeed.Shell submitted Prelude risk to TR would be bettered by being an order of magnitude lower at once in 10,000 yrs.On what basis is this statement supported by evidence?

TR are inspected monthly and as a matter of interest during such an inspection (Incident 5501 on 25/7/18) the fire damper on level A was found to be inoperable before it was then repaired.

(2): Gas Sensors are normally calibrated for Methane, ignition of which can occur when the gas in air volume is between 4.8 and 15%.In the event described above the cloud, or plume, was of condensate vapours which can also include small proportions of butane and pentane. The sensors activate to give a factor of safety at low level (LEL) 10% or 90%, if you prefer, below the lowest explosive range and high level 20%, if you prefer 80% below the lowest explosive limit of the lowest explosive range of methane.


PART 6: The content of the Prelude Safety Case, as written and issued by Shell for approval by the Regulator, is now compromised by the general malaise observed in these findings and may not know be valid


6.1: The original Quantitative Risk Analysis (QRA) outputs compared now with Reality

A Safety Case is not worth the paper it is written on unless in the operation of the facility the QRA outputs which fed into Formal Safety Assessments, cannot be continually DEMONSTRATED in operations to have credibility.

After operations commence if it is observed that safety critical elements fail completely, or operate below their performance standard, the QRA numbers fed into the number crunching computer become less and less valid and the risks rise as the reliability of such equipment is questionable.

Using the Incident 5501 as an example: this is when a monthly performance test was being carried out on the TR inlets. The fire damper on the HVAC inlet at Level A failed to close. The HSE guidance given to industry is that the operators use for fire dampers a reliability of 99%.The damper is tested monthly so in a 12-month testing period reliability can be assessed. If during this one occasion a damper on inlet A failed to close its observed reliability reduces 11/12 or 91%.

6.2: Reworking the QRA with historic failure data observed during operations

If you were considering the failure rates of this single piece of equipment alone then fine, but Prelude has many damaged systems, which have in operation failed in service e.g. the main fire main, the fire main on the helideck, the emergency depressurisation system for the hydrocarbon process, the Marine Loading Arms, the notoriously unreliable emergency generator, the deck foam system, the seawater deluge for cooling LNG tanks, the cranes are not explosion proof, gas clouds enter the TR inlets during a routine operation, the DistributedControl System (DCS), fundamental to monitoring andcontrolling a complex hydrocarbon processes lost contact with it, like the brake pedal on your car losing contact with brakes on the wheels. So, in a short period of time, the safety case assessments are invalid, its credibility as a document, the accuracy of its contents, has not been demonstrated. It seems that its wishful thinking, a hope and a prayer, when set aside the harsh reality during operations.


Note for Committee

There is no failure data both in the NOPSEMA and HSE public domain websites for 2021.Expect this is due to effects of Covid so safety performance of Prelude and HSE during this period is not available.

The committee will be aware that Prelude FLNG shutdown again on 2/11/21 after a small fire.Prelude is expected to be out of commission for months, Direction 1860 issued related to unreliability of essential power and other issues re the potential catastrophic failure of the hull to support.

Concerns were raised by Shell employees, ex-employees and shareholders, in particular that the not published report (that got into the hands of a journalist somehow) from the regulatory authority that loss of power for a period of time could lead to cooling of the vessel hull with catastrophic consequences. Pretty scary for friends and family of a Prelude worker!

The over confident submissions by Shell to the committee for me had a sense of unreality, it was generally good news, like a sales pitch, but these submissions made no mention of this hazard and its potential consequences, why? Does the current Safety Case mention this eventuality also?

If NOPSEMA knew about this hazard, and its potential catastrophic consequences prior to the incident on 2/12/21, why was Prelude FLNG operating prior to this date at all?

Bill Campbell: DMS MIEE B.Sc. C.Eng.


From Wikipedia: RMS Titanic departing Southampton on April 10, 1912Public Domain

The Hindenburg disaster was an airship accident that occurred on May 6, 1937. Public Domain. and its sister non-profit websites,,,,,, and are owned by John Donovan. There is also a Wikipedia feature.

Comments are closed.

%d bloggers like this: