The revolutionary concept of offshore LNG installations (FLNG) is said to have economic and environmental advantages. A distinct disadvantage however is that the risks to health and safety of persons employed offshore on the LNG FPSO’s, such as Prelude, will be higher, when compared to onshore LNG plants of similar capacity, specifically the potential for loss of life; …loss of containment of hydrocarbons is likely to occur on Prelude during its operational life, either through flaws in the design, human error or failure to inspect and maintain. It’s almost inevitable. It’s only to be hoped that the consequences of these losses never reach their full potential.
By Bill Campbell, Retired HSE Group Auditor, Shell International
Prelude FLNG turns conventional wisdom on its head
The revolutionary concept of offshore LNG installations (FLNG) is said to have economic and environmental advantages. A distinct disadvantage however is that the risks to health and safety of persons employed offshore on the LNG FPSO’s, such as Prelude, will be higher, when compared to onshore LNG plants of similar capacity, specifically the potential for loss of life.
This article concentrates on the perfect contradiction that exists between managing risks on an onshore LNG plant when compared with floating LNG. Whereas onshore plants, handling hazardous substances reduce risk by physical separation, such separation, although attempted on Prelude would not be accepted onshore because the separation distances are inadequate. Prelude will store high quantities of cryogenic hydrocarbon liquids on the installation. The heat energy of the liquids is enormous. This contradicts the £6 billion or so expenditure in the North Sea, post Piper Alpha, to do as much as reasonably practicable, to reduce the heat energy available so that escalation of hydrocarbon events are limited such that the Temporary refuge (TR), normally the Living quarters, and including escape routes to the TR and evacuation from it, will not be impaired within one hour to allow safe evacuation of the facility. The frequency of TR impairment should be demonstrated to be no more than once in 1000 yrs. It’s a high standard to achieve.
Finally, because of the measures taken in the design and layout of onshore plants, the potential loss of life is much reduced. This is contradicted by offshore installations where the total population is determined to be at risk.
Is Prelude a cause for celebration or concern?
Shell has for many years had considerable expertise and experience in the production, storage and transport of LNG, in many respects world leaders. Society in general has benefited hugely from advances in technology, which are shown in the long term to be to the common good. Such as the North Sea black gold rush of the 70’s. Doing something different, something that has not been done before, is a risky business, and risk takers are needed if mankind is to advance. This FLNG technology is necessary to develop significant sources of isolated gas deposits located under the sea, in many cases in remote locations. So floating LNG is revolutionary, a bold and adventurous move, but is it a step too far? Only time will tell. Will all the design assumptions made by Shell be valid, or are there some critical factors that have been overlooked, or are we simply being expedient as human beings, because FLNG is the only viable economic way to obtain these gas reserves, and these reserves are essential and will benefit many, is it acceptable to close our minds and forget what happened in the past?
Doing something different, we have been here before
When offshore installations were first installed in the North Sea is was the compactness of these facilities, the juxtaposition of many hazardous areas and activities with hundreds of workers constantly present that was the principal concern. What would happen if something went badly wrong? Miles from land the installation would be required to deal with emergencies on its own, and unlike onshore plants, the 200 or more workers on the platform would be all potentially at risk. Big Oil lobbied against this doomsday argument, surely the design of these huge installations, and the plethora of safeguarding systems would restrict the potential of accidents offshore, it did not seem reasonable they argued, that events offshore could escalate such that the installation itself could be destroyed. The then UK labour government set up a committee to look at offshore safety which reported to parliament in 1980. But by that time some 80 installations were up and running. Nothing much was achieved.
Eight years later the world watched in horror as 167 workers died and a huge installation was destroyed. Big oil collectively had assured the British public that the extraction of oil and gas offshore could be done safely, no one could really challenge this although a few tried. But what happened in July 1988 was too awful to contemplate; it just wasn’t supposed to happen. No one foresaw it.
Piper Alpha was destroyed because the heat energy available was unrestricted
The catastrophic consequences of Piper Alpha could not be avoided on that fateful day because the gas stored in the incoming gas pipelines (acting as a storage tank) could not be isolated because there were no Emergency Shutdown Valves (ESDV) in the incoming gas pipeline on Piper, so the gas kept flowing onto the installation. The heat energy released from this ignited gas destroying load bearing structure in minutes, the secondary explosion was caused when the incoming pipeline failed, weakened by the intense heat. Subsequently, following the public inquiry, many measures were taken, including installing ESDV’s and other measures, to reduce the heat energy from an escalating hydrocarbon event. In future, no installation could suffer the fate of Piper Alpha. The industry had the benefit of hindsight. But Prelude turns this safeguarding feature on its head, it casts aside the minimization of heat energy philosophy as if it is no longer important.
Prelude FLNG produces and stores thousands of tonnes of LNG daily
The hull is essentially a huge area within which storage tanks for cryogenic liquids are installed. If the chilled liquids were accidentally released into the atmosphere they disperse back into methane expanding during this phase change by 600 times. But there is gas also, LPG and gas condensates. Every 7 days or so Prelude will transfer onto an LNG carrier moored alongside (ship to ship transfer between two vessels in motion) enough heat energy (when the LNG is converted back to natural gas) to power the whole of London for a week. Put another way, if Prelude was a conventional gas platform, the energy entrapped in the 300 mile gas pipeline to an LNG plant in Broome WA, would equate in heat energy terms to just a half mile of LNG in the same size of pipe. Loss of life and damage to plants handling hazardous substances onshore is minimized by physical separation to reduce the effects of escalation, the so called domino effect, and loss of life or injury to workers who would normally be restricted to that part of the process where the explosion or fire occurred. But Prelude as a floating LNG plant is supported on a bedplate (the hull) which is only 488 m by 75 m. Within this limited area this atypical LNG plant has a hotel (Living Quarters), substantial utilities to service the hydrocarbon process, some 210 – 220 ever present workers, and on top of the quarters is a helipad, where 6 times a week a return flight to the mainland is scheduled.
Prelude may not have the space to reduce risks through physical segregation
From bitter experience over the years risks (after Flixborough et al) are minimized on onshore plants handling hazardous substances through plant design and layout. Catastrophic events over the last 60 years including explosions resulting from LNG spillage suggest that if the probability of loss of containment cannot be guaranteed at such facilities, and it can’t, then the consequences of such a loss must be reduced as low as is reasonably practicable.
This is achieved mainly by physical separation. Occupied buildings such as control rooms, workshops, warehouses and admin blocks are remotely located, or protected by the natural topography of the side, or man made earthwork, or other means to divert pressure waves. Fire breaks should contain the fire to the module or area affected. Onshore plants handling hazardous substances can often be scattered over an area measurable in square miles. So given that the probability of loss of containment cannot be reduced to negligible levels, onshore plant design and layout restricts the potential consequences of such an event should it occur?
Shell accepts that the Prelude LNG facility would normally occupy an area 4 times greater than it does if on land. But taking the example of a modern day plant complying with UK standards and Codes of Practice, and the results of Social Impact studies etc, the facility at Mossmorran covers a substantial area (this Esso/Shell plant is of course more than a LNG plant but it is an excellent example of where space and topography is used not only to reduce risks at the plant, but to facilities and people outside the plant boundaries). The Shell section of the plant is 5 miles from its Braefoot Terminal jetty with the storage tanks containing chilled liquids circa ½ mile from the jetty. The reality is that an LNG plant on land could cover a considerable land area much greater than an area 4 times the size of the Prelude deck space.
These factors conspire together to increase the potential loss of life on Prelude especially when the total population required to operate, service and maintain this facility live, work and sleep within the plant boundaries, and, the plant is 300 miles from the nearest town
The LNG industry itself accepts this argument. Studies carried out have determined that the highest risk category for an LNG or LPG FPSO is the collective risk to onboard workers. Various media outlets suggest Prelude will have manning levels around 200. On land, an LNG plant has a dayshift and nightshift; staff go home at the end of their shift which reduces the population within the plant gates at any one time. Authorized access to process areas is needed for operators and maintenance crew. Non-operational personnel are located in occupied building which by location and design should not be at risk. Civil assets, police, ambulance and Fire Brigades are available to assist in a major crisis and carry out combined emergency exercises for that purpose.
Although Prelude will be the largest floating structure in the world, its dimensions at 488 by 75 by 105 m are minimal when compared to the many acres afforded to an onshore plant. The total population needed to run the show offshore remains constant. And at least initially Prelude will need to tackle the emergency on its own. If a major accident occurs, with serious injuries, burns etc, ambulances cannot arrive within 12 minutes or so at the gates of the Prelude plant. Given that search and rescue will commence from Broome, this town is 300 miles from Prelude. On a good day, outward and return journey time could be 5 hours with an additional ½ hour loading injured persons on board – plus refueling the aircraft prior to its return. If onward transition of seriously injured persons is necessary, on the assumption that Broome will have limited facilities, getting casualties to a hospital that can handle serious burns, and provide intensive care otherwise, involves another 2 and ½ hour flight to Perth.
How does the total number of persons offshore have such an influence on the quantification of risk?
This is simply because, as with all offshore installations, the total number of persons required to run the LNG plant, day and night, are present within the plant boundaries so the potential loss of life (PLL), should something go seriously wrong, takes that fact into account. There is no getting away from this; it’s just the way the arithmetic of risk works. PLL for Prelude will be quantified as the average risk to an individual on the facility multiplied by the total numbers on board.
Can due diligence by the Board of Royal Dutch Shell be assumed?
For such a large capital project I am sure the economic viability of Prelude was scrutinized closely.
With respect to health and safety risks my assumption is that the project team assured the Board that the risks of FLNG had been demonstrated to be as low as is reasonably practicable. Despite health and safety risks to the crew of Prelude being higher than an onshore LNG plant my assumption is that Directors are aware of this. Given that the potential consequences of explosion and fire offshore must be higher than onshore, the only way this can be refuted is if Shell can guarantee that the probability of loss of containment on Prelude is negligible. No one will do that.
Offshore Installations have a poor track record in preventing loss of containment
Gas and oil leaks in the highly regulated North Sea are recorded in government statistics. These are either minor leaks or significant leaks. With reference to gas leaks, a significant leak is one where a flammable atmosphere exists as a result of the leak which could explode if it came into contact with a source of ignition. In a recent years significant gas leaks were occurring somewhere in the oilfield every 5 days, i.e. 83 leaks that year in total. Shell has had more than its fair share of leaks; on Brent Charlie for example it had 6 such leaks in one day. Shell reacted and tried to keep ahead off this problem on all its installations by fitting temporary clamps to hydrocarbon carrying pipes. From its own data, not disputed, hundreds of these repairs were not approved by a competent person prior to installation. A public inquiry in 2006 attributed the cause of deaths on Brent Bravo to a materially defective temporary repair. So Shell has previous form. Hopefully this North Sea behavior by Shell is non-transferable down under. The data on North Sea gas leaks covered circa 200 installations and many other Operators, but still it makes the striking, and irrefutable point that offshore installations by their very nature, have challenging technical integrity issues.
Can loss of containment of LNG, LPG, condensates or gas be considered a negligible probability on Prelude?
From all the above loss of containment of hydrocarbons is likely to occur on Prelude during its operational life, either through flaws in the design, human error or failure to inspect and maintain. It’s almost inevitable. It’s only to be hoped that the consequences of these losses never reach their full potential.
In the end, are we confident the Shell board of directors understands fully the risks of FLNG?
In the last analysis, through application of due diligence, Royal Dutch Shell Plc must be satisfied at Board level (otherwise the concept would not have been approved), that the incremental increase in risk to the health and safety of persons on the installations such as Prelude, although higher than for an onshore plant, are still at levels that are tolerable. And that these risk levels, particularly the potential for loss of life is at a level acceptable not only to RDS, its stakeholders, employees, and the industry regulator, but also to Society in general.
This is a bold assumption, but hope as they say, springs eternal.
COMMENT POSTED ON SHELL BLOG BY “dutchdude”: 22 FEB 2014
To Bill C: You wonder if at board level the risks of Prelude are understood? Must be rhetorical, because you know as well as I do that management at the top is mainly by sound bites and assurances by other lower ranking staff members. Each level going up has a benefit in portraying the project in the best possible light. Safety concerns are at best noted down but “extreme views” are never tolerated. The principle of ALARP is one of the most misused safety concepts around. It is fair to assume that many people worked parts of Prelude and that components are reasonably safe. It is also fair to assume that nobody understands the total aggregate risk of all these components together. Irrespective of all the massive QRAs produced. Prelude is a fantastic undertaking, let’s hope it is not a similar tale as Babel tower, overreaching and the end of a huge empire.
Posting on Shell Blog on 22 Feb 2014 by Hans Bouman. Some 32 years in Shell E&P; last two jobs were Head of Production Technology Shell International EP and Manager Asset Groningen, the most valuable asset in Shell and ExxonMobil.
Excellent article which very clearly puts the finger on the sore spot! As a seasoned and most senior HSE auditor you are in the best position to reflect on these points. If I still would be working I would make your article compulsory reading for any HSE or Audit course. Budding HSE and audit professionals can learn from you.
After all my years in Shell, I know of no projects in our business that have not suffered from pinhole leaks, corrosion, faulty software, poor or wrongly executed design and maintenance, etc etc. Any of these occurrences should be de-escalated quickly if the proper systems and processes are in place. Yet, things do go wrong and on a vessel like the Prelude, the potential for rapid escalation of the problem is real.
The PLL appears to have been massaged low enough on paper and so the decision makers can wash their hands in innocence if something goes wrong. With a project of this magnitude and complexity (a Moonshot or an Elephant in Shell speak?), there is only one spot where the ultimate decision to proceed is taken and that is right at the very top.
Shell used to take pride in the fact that if a project did not pass the business principles, it just would not get done. The Prelude project does not involve corrupt governments or pressure from the USA to not get involved. So the top of Shell can relax, nothing stands in the way of their business principles anymore, only some mere technical challenges. However, the business principles cover more than corruption and environmental issues. Health and Safety are also very important matters in these principles.
Perhaps it should have been decided to call this a stranded asset and not book the reserves. But we all know how important booking of reserves is!
The top of Shell consists of very smart people so they must have considered this. And then to trust the advice of the technical side after all the problems over the past 10-15 years with major projects, as frequently reported on this site of Donovan, is – to put it mildly – quite courageous. Maybe they felt like Kennedy: ‘We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard, ’. But Kennedy was a politician with different goals. Politicians do not drill wells and develop oilfield projects!
Or Shell should have come clean and admit that this is a trial and first of a series where we will learn from mistakes in order to develop otherwise stranded assets. Now that would be real courageous!