The Hindenburg, The Titanic and Shell Prelude FLNG

Government concerns

Being influenced no doubt by the examples, in the North Sea and the Gulf of Mexico, of what can go wrong in the great offshore adventure, the WA government held an Inquiry completed and published May 2015.It’s only natural, that such an Inquiry was conducted witnessing as we all did, observing in our living rooms, the penalties that Society pays when things go wrong. Who wouldn’t worry? Construction was advanced at the shipyards with this mammoth ship taking shape and coming their way.This wasn’t an ordinary vessel, it would on its deck support a hazardous substance plant, not an onshore plant with its storage tanks geographically displaced from the process with its loading jetty some distance away. It was a protype, FLNG was a revolutionary concept yet to be proved safe in operation.The Inquiry concluded that whether Prelude FLNG, was safe or not, cannot be answered but stated that the Inquiry had been made aware of the considerable efforts made by Shell in working to ensure that the risks associated with Prelude are appropriately reduced.

Assumptions

Shell in its submissions were confident that Prelude would operate at risk levels in terms of potential loss of life, equal to or better than other offshore installations, fixed and FPSO worldwide.From Quantitative Risk Analysis (QRA) and Formal Safety Assessment (FSA) they concluded the Temporary Refuge (TR) impairment frequency for Prelude was an order of magnitude lower than the industry norm, that is from 1 in 1000 to 1 in 10,000.

Contributing to this positivity Conoco/Philips submitted that there was no technical reason why we cannot make FLNG safer than other hydrocarbon businesses, it is fundamentally no different – do not think there is anything specifically magic and different about it.There were a number of opposing views, Chevron and Dept of Mines raised concerns that FLNG was an unproven technology. Trades Unions also raised concern namely re the risks of Prelude workers who were to be retained onboard in grade 5 cyclonic conditions. (Wind at or exceeding 156 mph or 136 knots)

Notable Exclusions from the Shell submission was Combined or Simultaneous Operations

Prelude would routinely operate, in combination with offtake tankers, loading LNG, LPG and condensate in dynamic conditions on the high sea. In this atypical operation of an offshore installation, Prelude regularly offloads cargo into tankers, moored aside the Prelude, or in close proximity to it. In North Sea operations, if combined operations are planned, the Safety Case requires to assess the combined risks of such an operation, that is, the risks imposed by the Facility on the Tankers, and vis a versa, the risks of berthing and offloading to the tanker imposed on Prelude. In the 2015 submissions to the government, the accumulative risks of combined operations were not covered, other than the environmental risks of loss of containment of cargo from the tanker on the environment, and the design of the Marine Loading Arms in dynamic conditions.

———————————————————————————————————

Part One: Unsubstantiated Confidence in Shell submissions

But it was the confidence in the submissions, great expectations, obvious from Shell and some Industry submissions, that Prelude would not just be safe, but would rival or be safer than conventional offshore installations, fixed and FPSO, currently operating anywhere across the world.This assumption, now stunted with the current reality. Since start up, Prelude’s availability to produce, is around 69%, the RDS CEO in recent discussions with journalists explained that for 4 months at the end of 2021 the LNG plant operated reliably giving an operating reliability over the 4-year period of circa 14%, but it’s now shut down again after the fire for an indefinite period. In search of reality, is an analysis of Prelude safety performance in operation compared to the North Sea safety performance over several years. In Part 5.1 are discussed the implications of not fully covering the risk of combined operations as explained in a review of an incident, where a gas vapour cloud emanating from a condensate tanker, was ingested into the Temporary Refuge inlets and where gas sensors in close proximity to the inlets went into alarm causing the automatic closure of the inlet fire dampers in response, followed by a full muster.

Part Two: Assumptions versus Reality

An analysis of safety performance between Shell FLNG and North Sea offshore installations based on public domain data published by NOPSEMA and HSE-UK covering 2018,2019 and 2020.

HSE Safety Data 2018 to 2020

The HSE is the Health and Safety Executive Offshore Division based in Aberdeen, an organisation set up post the Piper A disaster.Although the North Sea production is in decline there were in 2020, as covered in data from the UK Oil & Gas authority, active consents to produce from 150 oil and 84 gas fields.Some 29,000 people were gainfully employed on 180 offshore installations (sample size used below) to harness energy from these fields located in UK waters in the North Sea per se but also West of Shetland in the Atlantic, and the Irish sea, mainly gas from the Morecambe Bay area.

The data from HSE and NOPSEMA used in this comparative analysis covers Dangerous Occurrences (DO), a common definition of which shared by both, Regulators. The difference between HSE data and NOPSEMA data is in the UK accidental or unplanned loss of containment of hydrocarbons (HRC) is reported separately as per Cullen Recommendation 39 that a database of HRC releases be developed.HRC is the principal performance indicator of technical integrity offshore, and HSE and the industry has been trying to reduce these incidents over many years, but they still persist at unacceptable levels.As many installations reach, or exceed original design life, this struggle will continue, as an offshore installations failure characteristics are Age Related. It can be expected that failure rates will increase with age, and as many installations reach, or exceed their expected operational design life.

2.1: HSE North Sea Dangerous Occurrences 2018 to 2020

In 2018 there were 347 Dangerous Occurrences (DO) consisting of 235 DO and 112 Hydrocarbon losses of containment from a homogeneous population currently of 180. Over that 365-day reporting period an incident in the oilfield occurred at a frequency of one per day, 365/347 or 1.05 per day. HSE, for confidentiality reasons, do not indicate the spread of these incidents, so some installations will have had no DO and some more. The average mean time of dangerous occurrences per installations in 2018 was simply 347/180 or 1.92. So, if the homogeneous population of installations were theoretically contributing equally to the grand total an individual installation, would report 1.9, say 2 Dangerous Occurrences per reporting period of 365 days.In 2019, on the same basis, HSE report 344 DO or one per day, with an individual installation contribution of 2 per year. In 2020, HSE reported 266 DO one every 1.4 days, with an individual installation contributing 1.5 per year.

2.2 Prelude FLNG NOPSEMA data for Offshore Occurrences 2018 to 2020

In 2018 the first Dangerous Occurrences (DO) related to the tanker berthing and mooring trials was reported on 10/5/18.These occurrences as explained previously included unplanned hydrocarbon releases. For that period NOPSEMA recorded in its public domain website 17 DO. So, on average, an incident occurred on Prelude every 21 days.In 2019, on a similar basis, 26 DO were reported on Prelude, on average one every 14 day. In 2020, on the same basis. NOPSEMA data reported for Prelude 19 DO, one every 19 days, a slight reduction.

________________________________________________________________

Summary: over the period 2018 – 2020

HSE Offshore reported a Dangerous Occurrences in the oilfield, an average of one per day, and for a typical offshore installation a DO occurred once or twice a year.

For Prelude, for the 3-year period there were 62 Dangerous Occurrences, on average one every 18 days or 20 a year. Set against this a North Sea installation recorded 1 per year in 2018, and 2 per year in 2019/20.

In 2018 there was 1 DO every 365 days in the North Sea set against Prelude with 17 DO or 1 every 21 days

2019 HSE data had 2 DO every 365 days or 1 DO every 182 days, Prelude had 26 DO or 1 every 14 days

2020 HSE data had 2 DO every 365 days or 1 every 182 days, Prelude had 19 DO or one every 19 days, an improving picture but not statistically significant.

Finally, the data from the North Sea is not statistically sensitive, if for example, a smaller number of installations was used, for argument’s sake let’s say some installations may have been closed down awaiting removal and reported no DO. So, for 2018 the then homogeneous population of North Sea installations was 180, DO frequency was 2 per year, if 160 is considered due perhaps the reduce population for whatever reason, the DO numbers increase slightly to 2.17 per year, a statistically insignificant change

——————————————————————————————————–

3.0: Conclusions from Comparative Analysis

The North Sea after the Piper A disaster, as with the improvement in the supervision of offshore health and safety with the creation of NOPSEMA, has increased competent industry supervision by the HSE Offshore Division in Aberdeen.In the years covered above, HSE inspections offshore, have averaged 128 per annum, so they are busy people.That this has been after Piper Alpha, the most regulated industry in the UK, it should give confidence to the committee that the failure data for UK offshore installations is accurate and under reporting of Dangerous Occurrences by Operators to the regulatory authority is not an issue. Over the period discussed, as with Prelude, thankfully no fatalities were reported.

Human error and lack of understanding also becomes less of an issue as the competence of the operators grows and as they gain a better understanding of the equipment and processes, they operate. But it is also a factor, that human error can increase if workers suffer overwork and sleep deprivation as occurred on Prelude (as was covered by Australian media). This concern was mainly raised with regards to tanker handling during busy periods.

3.1: The implications of Combined Operations

The Shell submission did not make clear the risks imposed on Prelude by offloading cargo, for example the accepted and routine venting of flammable vapour from condensate tankers during offloading, did not cover in submissions to the Inquiry that such venting, not considered a loss of containment and is accepted industry practice, as demonstrated in the findings of Incident 6314 of 23/12/19 for example. This event led to potential impairment of the Temporary Refuge when gas was ingested into the TR inlets. With reference to the risks of combined operations as discussed above, the gas vapour cloud surrounding the TR did not emanate from Prelude facilities (as raised by the Dept of Mines submitter as a concern) but from a tanker well aft from the stern of Prelude.This is further discussed in Part.5.

——————————————————————————————————-

Part 4: A brief summary of NOPSEMA data of Dangerous Occurrences recorded from 2018 to 2020. To aid the committee, or any other interested party, the summary includes the Incident Number

——————————————————————————————————–

4.1 Loss of Containment of Hydrocarbons and Non-Hydrocarbons

INCIDENT 5444 (10/10/18)

Gas leak from flange of marine loading arm resulting in General Platform Alarm (GPA), Emergency Response (ER), and muster of non-essential persons.

NB: Explanation of what (ER) general procedures mean

Non-essential is by definition crew members with no emergency duties other than assembling at their muster station on change of platform status where they wait until instructed to do otherwise by the Offshore Installation Manager (OIM). Muster checkers count the numbers at their stations so that persons are quickly accounted for. On an alarm sounding, fire teams muster, normally maintenance staff, at their emergency response stations whilst operating technicians report at the scene on what is happening, to the constantly manned Central Control Room, who then communicate this information to the Emergency Response Room within the TR, where the OIM musters along with his helpers, to command and control the situation.

INCIDENT 5444: 10/10/18

Gas leak from 2 flanges on Marine Load Arm (MLA) caused thermal stress resulting in bowing of pipework.This phenomenon was accepted by the design consultants of the MLA as not being covered by them

INCIDENT 6106 (23/8/19)

Gas leak from hydrocarbon process equipment

INCIDENT 6151 (8/9/19)

Coincidental gas sensors 14 meters from an MLA confirm a leak, this is followed by GPA, ER and full muster. NOPSEMA Direction 780 discusses

INCIDENT (10/12/19)

Loss of containment when work party broke into equipment containing High Pressure liquid that had not been correctly isolated. NOPSEMA Direction 780discusses

INCIDENT 6314 (23/12/19)

Coincidental gas sensors at HVAC inlets A and B of TR actuate dampers to close.Emergency Response Teams report that this was due to venting from a condensate tanker some 5 minutes after the venting occurred. GPA, ER and full mister ensues.This incident is discussed in Part 5.

INCIDENT 6318 (24/12/19)

Gas release between 1 and 300kg

INCIDENT 6335 (9/1/20)

Gas release, followed by GPA, ER and muster. Loss of containment during reinstatement of Relief Valve, NOPSEMA Direction 780 discusses

Non hydrocarbon loss of containment

INCIDENTS 6156 – loss of containment of hydraulic oil, 6360 – steam leak, 6435 loss of 1200 litres of lubricating oil.

4.2: Fire or suspected fire

INCIDENTS 5458 and 5545 smoke detected in forward machine space, 5651 fire in oxygen generator, 5590, fire on steam pipe insulation, 6339 fire in laundry of accommodation 6364 activation of smoke alarms GPA, ER and muster, 6280 operations of two flame detectors GPA and muster

4.3: Failure of Safety Critical Equipment (SCE) Systems designed and installed to prevent escalation of fire.

INCIDENTS 5391, Seawater deluge protection for LNG tanks set 22-26 deluge valve fails to meet design flow rates. 5491, Seawater deluge valve fails, 6386 Helideck firewater pump fails, 6591 Galley fire damper fails, 6172 faulty water mist detected during operation, 6060 Seawater firewater supply not meeting design standard and 6083 Seawater deluge valve would not reset. 6249 Distributed Control System (DCS) monitoring the hydrocarbon process lost communication with it. 5458 smoke was detected in forward machine space, 5445 smoke detected in forward machinery space. 5501 (20/7/18) during monthly performance test fire damper at level A HVAC inlet of TR failed to operate.

4.4: Failure of Emergency Shutdown System (ESD) vital to close in the process, and depressurise gas to flare, to reduce rapidly hydrocarbon inventories to minimal levels in vessels and pipework to reduce probability of escalation that could lead to a Major Accident Event (MAE), and other failures

INCIDENTS: – 6241 & 6374 Failure of valves in hydrocarbon process, 6127 Emergency Shutdown Valve (ESDV) failed to close, 6283 failure of 2 ESDV,valves, 6308 Hydrocarbon process relief valve failure, 6229 Blank plate found in Relief Valve that would have prevented it operating to reduce pressure, 6385 Process emergency pressure reduction during reduction during blowdown failed to meet design parameters, 6128 Principal ESDV incoming riser valve failed tooperate,6432 Failure of relief valve, 6144, process shutdown valve failed to operate, 6294 failure of primary instrument protection on a process Knock Out vessel, 5531 instrumentation monitoring process not meeting design requirements, 5524 failure of deck foam system, 5531 safeguarding instrumentation not meeting performance standard and 6312 damage to instrumentation tubing

4.5:Potential fatality or serious injury

INCIDENTS: – 6056 Worker Struck on head when ice fell from Marine Loading Arm. 6408 Gas detector sensor protection cover on Line of Sight (LOS) system dislodged in 50 knot wind. 6147 two Technicians narrowly avoid injury when MLA arm moved uncontrollably.5475 high levels of hydrogen sulphide H2S.

4.6: Loss of main and emergency generation

INCIDENTS: – 5523 loss of power followed by GPA and muster, 5552 avoidable damaged caused when running an Emergency Generator during tests, 5551 a loss of power followed by GPA and muster, 6361 loss of power GPA and muster, 6362 a loss of power followed by GPA and muster, 6368 Emergency Generator overheating, 6099 Emergency Generator fails to start

4.7: Sources of Ignition of flammable gases

INCIDENT 6553 on 27/5/20

After an inspection it was discovered that cranes F and A to D presented a source of ignition. This was months after start of operations late 2018 and shipment of first cargo 12/5/2019. The NOPSEMA report informs cranes A to D remained isolated but Crane F which is aft of the TR protection blast wall, and in close proximity to the TR, had been de-isolated then operating under a risk assessment. The implications of this are discussed in Part 6.

——————————————————————————————————-

Part 5: How a flammable gas cloud routinely vented from a condensate Tanker and reached the TR HVAC inlets

———————————————————————————————————

On 23 December 2019 a GPA sounded, all non-essential workers went to their muster stations within the Temporary Refuge and a full emergency followed. An Emergency Response team on arrival at the scene found that gas sensors in the ventilation inlets at deck levels A & B had initiated the automatic closing of the fired dampers at HVAC Inlets A and B This automatic action to close fire dampers is necessary to prevent ingress of gas into the accommodation building where sources of ignition are likely to exist and many workers are assembled. The immediate investigation concluded that 5 minutes before gas entered the inlets a tanker being loaded with condensate had vented its tanks to atmosphere to relieve pressure in the cargo tank being loaded, at that time. the weather was calm with light winds.

5.1: A review of the Investigation Report of NOPEMSA incident 6314

Cargo vapours venting from condensate tankers are known about and venting is not uncommon. It is Industry practice. The conclusion from the NOPEMSA incident investigation was do not conduct a major Investigation.

The procedure, not available at the time of this incident, explains that offloading a condensate cargo from Prelude required appropriate weather conditions to prevail prior to starting offload to the tanker, namely wind speed and direction. In calm conditions, the procedures that are now in place give guidance on what is required because of venting of the condensate tanks on the tanker is known can create a flammable vapour cloud which would normally be diluted and dispersed on a windy day but the winds were light.The Incident report explains that venting flammable gas vapour to atmosphere is not considered to be an unplanned loss of containment and occurs when necessary to maintain the pressure in the top of the tank being filled.

This INCIDENT 6341 occurred on 23 December 2019 and the investigation report concluded do not conduct major investigationa position mutually agreed between Shell and the Regulator. The report clarifies further – it is not clear how, given a reasonable variation of circumstances, a flammable gas cloud from the tanker could reach Prelude in a concentration high enough to be an ignition risk.

To explain, the reasonable variation of circumstances implied here was that this gas cloud should not have been problematic if the wind had been blowing in the right direction from aft of Prelude toward the tanker, but it wasn’t.The breeze was in fact lightly steering the developing vapour cloud towards Prelude where, 5 minutes later, it was present at the HVAC inlets of the TR, both at level A and level B.The tanker was approximately 90 metres directly behind the stern of Prelude. On detection of the gas a GPA was initiated and the inlet dampers closed. The Emergency Teams arrived to investigate and a muster commenced.

All this SHOULD NOT HAVE HAPPENED, but it did, perhaps because the offloading of condensate from Prelude to the tanker did not at the time have an approved procedure. The procedure was finally issued for use on 9 July 2021 many months after the first offload of condensate from Prelude on 25 March 2019 and this incident on 23 December 2019.

What did the approved procedure say?

Venting in calm conditions wind speeds less than 5 knots

The Prelude Terminal Loading Team (who were present on the tanker at the time as their duties dictated) to consider stopping cargo operations toprevent any gas plume reaching Prelude, wind speed and direction need to be taken into account prior to commencement of cargo operations.

Comment

Would be better if to consider should be changed to must stop i.e., less of aguidance note and more of an instruction making it mandatory.

If this procedure had been issued for use, prior to this incident, would this incident have occurred? Probably not.But that is wishful thinking because they weren’t.It also begs the question, why did the regulator not ask about what procedures were in place then find out there was no procedure. It was obvious that a gas cloud, if the vessel vented, would migrate to the Prelude because that’s the way the breeze was blowing.They also knew that crane F was an ignition source near the TR. They have criticised Shell for not understanding inter-related risk but they also did not themselves have a holistic approach to their investigation.

Explanatory notes

(1):Temporary Refuges must be protected from impairment at all times, that is crucial.TR were installed following Lord Cullen’s recommendations post Piper Alpha.It is in essence he said for there had to be a safe haven, that would be used during a Major Accident Event (MAE), and where persons who escape to it could muster and await instruction to depart or abandon the facility. The Prelude Safety Case will cover the required TR performance standards which are subject to regular inspection to demonstrate the continued integrity of the TR.Formal Safety Assessments (FSA) et al should have demonstrated to the Regulator that the TR structure can endure as a place of safety for a minimum of 60 minutes without being impaired. The Operator has to demonstrate that the impairment frequency of the TR will be no greater than once in 1000 years during operations.

A very high-performance standard indeed.Shell submitted Prelude risk to TR would be bettered by being an order of magnitude lower at once in 10,000 yrs.On what basis is this statement supported by evidence?

TR are inspected monthly and as a matter of interest during such an inspection (Incident 5501 on 25/7/18) the fire damper on level A was found to be inoperable before it was then repaired.

(2): Gas Sensors are normally calibrated for Methane, ignition of which can occur when the gas in air volume is between 4.8 and 15%.In the event described above the cloud, or plume, was of condensate vapours which can also include small proportions of butane and pentane. The sensors activate to give a factor of safety at low level (LEL) 10% or 90%, if you prefer, below the lowest explosive range and high level 20%, if you prefer 80% below the lowest explosive limit of the lowest explosive range of methane.

PART 6: The content of the Prelude Safety Case, as written and issued by Shell for approval by the Regulator, is now compromised by the general malaise observed in these findings and may not know be valid

———————————————————————————————————

6.1: The original Quantitative Risk Analysis (QRA) outputs compared now with Reality

A Safety Case is not worth the paper it is written on unless in the operation of the facility the QRA outputs which fed into Formal Safety Assessments, cannot be continually DEMONSTRATED in operations to have credibility.

After operations commence if it is observed that safety critical elements fail completely, or operate below their performance standard, the QRA numbers fed into the number crunching computer become less and less valid and the risks rise as the reliability of such equipment is questionable.

Using the Incident 5501 as an example: this is when a monthly performance test was being carried out on the TR inlets. The fire damper on the HVAC inlet at Level A failed to close. The HSE guidance given to industry is that the operators use for fire dampers a reliability of 99%.The damper is tested monthly so in a 12-month testing period reliability can be assessed. If during this one occasion a damper on inlet A failed to close its observed reliability reduces 11/12 or 91%.

6.2: Reworking the QRA with historic failure data observed during operations

If you were considering the failure rates of this single piece of equipment alone then fine, but Prelude has many damaged systems, which have in operation failed in service e.g. the main fire main, the fire main on the helideck, the emergency depressurisation system for the hydrocarbon process, the Marine Loading Arms, the notoriously unreliable emergency generator, the deck foam system, the seawater deluge for cooling LNG tanks, the cranes are not explosion proof, gas clouds enter the TR inlets during a routine operation, the DistributedControl System (DCS), fundamental to monitoring andcontrolling a complex hydrocarbon processes lost contact with it, like the brake pedal on your car losing contact with brakes on the wheels. So, in a short period of time, the safety case assessments are invalid, its credibility as a document, the accuracy of its contents, has not been demonstrated. It seems that its wishful thinking, a hope and a prayer, when set aside the harsh reality during operations.

———————————————————————————————————

Note for Committee

There is no failure data both in the NOPSEMA and HSE public domain websites for 2021.Expect this is due to effects of Covid so safety performance of Prelude and HSE during this period is not available.

The committee will be aware that Prelude FLNG shutdown again on 2/11/21 after a small fire.Prelude is expected to be out of commission for months, Direction 1860 issued related to unreliability of essential power and other issues re the potential catastrophic failure of the hull to support.

Concerns were raised by Shell employees, ex-employees and shareholders, in particular that the not published report (that got into the hands of a journalist somehow) from the regulatory authority that loss of power for a period of time could lead to cooling of the vessel hull with catastrophic consequences. Pretty scary for friends and family of a Prelude worker!

The over confident submissions by Shell to the committee for me had a sense of unreality, it was generally good news, like a sales pitch, but these submissions made no mention of this hazard and its potential consequences, why? Does the current Safety Case mention this eventuality also?

If NOPSEMA knew about this hazard, and its potential catastrophic consequences prior to the incident on 2/12/21, why was Prelude FLNG operating prior to this date at all?

Bill Campbell: DMS MIEE B.Sc. C.Eng.