Британский регулятор признал непригодным дизайн новой платформы Shell после утечки газа, игнорировавшего предупреждение 2018 года

A 2018 HAZOP reportedly recommended changing the drains system on Shell’s new Penguins FPSO. The recommendation was not enough to prevent the design entering service — and in April 2025 the platform suffered a hydrocarbon gas release that prompted an HSE improvement notice. Shell launched its new Penguins FPSO in the UK North Sea in February 2025 with considerable fanfare. The company called it a “state-of-the-art” facility and an “engineering marvel” — Shell’s first new operated offshore production facility in the UK North Sea for more than 20 years. Less than three months later, 95.3 kilograms of hydrocarbon gas escaped. Production was immediately shut down. Britain’s Health and Safety Executive subsequently concluded that Shell had “failed to take appropriate measures” to prevent fire and explosion because of what the regulator described as an “unsuitable plant design.” (The Chemical Engineer) That was disturbing enough. Now The Chemical Engineer has uncovered something substantially more serious. According to its exclusive investigation published on 24 August 2026, members of the Penguins design team had already recommended changing the problematic open-drains arrangement in 2018 — more than six years before the eventual hydrocarbon release. The recommendation reportedly followed a formal HAZOP — Hazard and Operability Study — which identified that the proposed system could increase the risk of a hydrocarbon release. And when The Chemical Engineer asked Shell about the revelation, Shell did not deny that the recommendation had been made. (The Chemical Engineer) That transforms this from an unfortunate start-up incident into a much more serious process-safety question: If Shell’s own design-assurance process identified the hazard in 2018, why did essentially the same hazardous arrangement reach an operating North Sea platform in 2025? What actually happened at Penguins? The incident occurred on 21 April 2025. According to Shell, gas detectors identified the release and production was stopped immediately. No injuries were reported. (The Chemical Engineer) That prompt shutdown deserves acknowledgement. The consequences could nevertheless have been much worse. HSE’s subsequent investigation focused on the way liquids were removed from a hydrocarbon vent-header knockout drum. Instead of being routed into an appropriately contained hydrocarbon system, liquids were discharged through a drain line into an open drains system. HSE concluded that the design was unsuitable and that Shell had failed to take appropriate measures to prevent fire and explosion. (The Chemical Engineer) In offshore processing, uncontrolled hydrocarbon release is among the hazards engineers spend careers trying to prevent. Gas does not need to produce a fatal accident before the underlying design failure matters. The whole point of process safety is preventing the conditions for catastrophe from forming in the first place. HSE issued Shell with an improvement notice Following its investigation, HSE served Shell with an improvement notice in May 2025. The Chemical Engineer reported that such notices are relatively rare in the offshore oil and gas sector. An improvement notice is not issued because a regulator thinks everything was fine. It is used when HSE believes health and safety law has been breached but considers that operations can continue while corrective action is undertaken. (The Chemical Engineer) The regulatory language was unusually clear. HSE identified: “unsuitable plant design.” And said Shell: “failed to take appropriate measures” to prevent fire and explosion. (The Chemical Engineer) That wording places the problem upstream of the operator who happened to be on duty that day. This was a design issue. And that is why the 2018 warning is now so important. The warning reportedly came from the HAZOP itself A HAZOP is one of the fundamental safeguards used in major-hazard engineering. Teams systematically examine a design to determine how deviations from intended operation could create danger. Pressure too high. Pressure too low. Reverse flow. Blocked discharge. Unexpected liquid. Unexpected gas. Wrong destination. Loss of containment. Ignition. The entire purpose is to identify hazards before steel is installed and people are placed beside it. According to the new Chemical Engineer investigation, a source involved in the Penguins design team said the 2018 HAZOP explicitly recommended modifying the open-drains system because the proposed arrangement could increase the likelihood of a hydrocarbon release. (The Chemical Engineer) That is an extraordinary allegation because the HAZOP appears to have identified essentially the class of hazard that later materialised. The recommendation did not emerge after the accident. It reportedly existed while the platform was still being designed. Shell does not deny the warning Shell was given the opportunity to respond. Its spokesperson told The Chemical Engineer: “Safety remains our highest priority.” Shell also said that following the incident a thorough review was conducted and lessons were learned covering the journey from design through to operation. (The Chemical Engineer) But crucially, according to the publication, Shell did not deny that the 2018 HAZOP recommendation had been made. (The Chemical Engineer) That leaves the central question unanswered. What happened to the recommendation? Was it rejected? Was it accepted but never implemented? Was it considered closed on the basis of another safeguard? Did the design subsequently change? Was somebody persuaded that the risk had been reduced sufficiently? Was the recommendation downgraded? Was cost or schedule a consideration? And who ultimately signed off the final arrangement? These are not speculative questions. They are precisely the audit trail that a serious process-safety organisation should possess. The design chain needs to be reconstructed The Penguins FPSO has a complex engineering history. Shell awarded the design work to Fluor in 2017, with detailed design work carried out in Manila in the Philippines. The vessel was constructed by China Offshore Oil Engineering Company in China and commissioned for Shell in Norway before being deployed in the North Sea. (The Chemical Engineer) Fluor did not respond to The Chemical Engineer’s request for comment on the latest investigation. (The Chemical Engineer) None of that automatically transfers responsibility from Shell. Contractors routinely perform engineering work for major operators. The operator still owns the project requirements, engineering assurance process, design standards, HAZOP close-out process and eventual decision to accept a facility into operation. If the 2018 HAZOP recommendation was properly raised, there should be a documentary trail showing how it was dispositioned. That trail is now central to the story. This was supposed to be Shell’s next generation The contrast with Shell’s promotional language is striking. When Penguins began production on 4 February 2025, Shell described it as one of the most technologically advanced platforms it operated in the North Sea. The company emphasised its compact cylindrical design, flareless system and efficiency improvements. Shell said the project would have around 30% lower operational emissions than Brent Charlie, which had previously handled Penguins production. (Shell) Peak output was expected to reach roughly 45,000 barrels of oil equivalent per day. The field holds approximately 100 million barrels of oil equivalent of estimated recoverable resources. And Shell expected the new development to extend production from Penguins by as much as another 20 years. (Shell) This was therefore not an ageing platform being nursed through the final stages of North Sea life. It was new. It had been through a modern design process. It had been marketed as technologically advanced. Yet only weeks into operation, Britain’s safety regulator found an unsuitable design capable of creating fire and explosion risk. That alone demanded explanation. A prior HAZOP warning intensifies the question dramatically. Experts were surprised even before the latest revelation When The Chemical Engineer first reported on the HSE notice in July 2025, process-safety specialists expressed surprise that the design had reached an operating offshore facility. The magazine reported that experts regarded routing hydrocarbon liquids into the open-drains system as inappropriate in this offshore context and more characteristic of arrangements used onshore away from potential ignition sources. (The Chemical Engineer) One expert, Nigel Bowker, said the consequences “could clearly have been greater” and urged Shell to share the lessons from its investigation across the industry. (The Chemical Engineer) Sean O’Sullivan, chair of IChemE’s Safety and Loss Prevention Special Interest Group, said engineers should take particular note because the improvement notice related specifically to design suitability. (The Chemical Engineer) At that stage, the experts were reportedly surprised that HAZOP had apparently failed to catch the issue. The latest investigation changes that premise. According to the source involved in the project, HAZOP did catch it. The question is what happened afterwards. Finding a hazard is useless if the recommendation disappears This is the uncomfortable lesson. Major-hazard companies often point to elaborate safety-management systems as evidence that catastrophic risks are controlled. HAZOP. Design reviews. Independent verification. Technical authorities. Engineering practices. Safety cases. Audits. Assurance reviews. All are useful. But a safety system is only effective if uncomfortable findings survive the organisation. A HAZOP recommendation is not protection in itself. The protection comes from properly resolving it. If a recommendation identifies a credible hydrocarbon-release pathway, somebody must either modify the design or demonstrate — with documented engineering justification — why the proposed arrangement is safe. The more important the hazard, the stronger that justification needs to be. If the recommendation simply disappears into project paperwork, the existence of the HAZOP becomes almost meaningless. What did the 2018 recommendation actually say? The complete recommendation has not been published. That is important. The Chemical Engineer reports the existence and substance of the recommendation through a source involved with the design team. We therefore do not yet know its full wording. We do not know its classification. We do not know its assigned owner. We do not know its due date. And we do not know the formal close-out justification. Those documents matter enormously. The safest conclusion on the currently public evidence is therefore: A source involved in the Penguins design says the 2018 HAZOP explicitly recommended changing the open-drains system because of hydrocarbon-release risk; Shell did not deny the recommendation existed; seven years later HSE identified the relevant design as unsuitable following an actual hydrocarbon release. (The Chemical Engineer) That sequence is documented through the reporting. Whether ignoring or inadequately closing the recommendation directly caused the 2025 event remains to be established. The environmental permit itself described segregation There is another useful piece of official documentation. Shell’s April 2024 Penguins Production Permit Environmental Assessment Justification, published through the UK government, describes the facility’s open hazardous-drain system. The document says drainage from hazardous areas was to be “completely segregated from any other drainage system to eliminate the risk of hydrocarbon vapour transmission to other areas.” (GOV.UK) It also describes the system as intended for deck drainage and for residual hydrocarbon liquids from equipment after the bulk hydrocarbons had been transferred elsewhere and the equipment had been completely depressurised. (GOV.UK) That makes HSE’s later concern about hydrocarbons entering the open-drains system even more technically significant. The entire logic of drain-system design is to prevent flammable vapours reaching places where they can find ignition sources or endanger personnel. HSE had inspected Penguins before startup — but not this component Shell cannot reasonably argue that HSE approval of the installation means the regulator had approved every design choice. The regulator itself does not work that way. The Chemical Engineer reported that HSE inspected Penguins in July 2024, but the inspection did not cover the knockout drum involved in the subsequent release. HSE inspections necessarily examine selected topics rather than every component on a massive offshore installation. Likewise, offshore operators submit safety cases to HSE before operation, but those do not contain individual risk assessments for every specific component. (The Chemical Engineer) That places primary responsibility where offshore safety law intends it to sit: with the operator. Regulators inspect and enforce. They do not design the installation on the operator’s behalf. The improvement work has now reportedly been completed There has also been a corporate change since the incident. Shell and Equinor combined their UK offshore oil and gas assets into Adura, with Penguins among the assets transferred into the new business. Shell and Equinor each own half of the new company. (Shell) An Adura spokesperson told The Chemical Engineer that the corrective actions required by the HSE improvement notice transferred to Adura in December 2025 and “have since been completed.” (The Chemical Engineer) That is welcome. But correcting the design after the release does not answer why a hazard reportedly identified during design remained capable of producing an incident years later. The retrospective engineering fix and the prospective governance failure are two different issues. Shell says lessons were learned Shell’s latest statement deserves proper weight. The company says safety remains its highest priority and that a comprehensive review followed the incident. It says lessons were learned “on processes from design to operation.” (The Chemical Engineer) That wording is interesting. It implicitly recognises that the issue was not confined to what operators did on 21 April 2025. The lessons extend back through the project lifecycle. Design. Engineering assurance. Commissioning. Operation. That is exactly where the scrutiny now needs to go. Publish the HAZOP trail Shell can settle much of this controversy itself. Publish the relevant portions of the 2018 HAZOP. Publish the recommendation concerning the drains system. Publish its risk ranking. Publish the close-out response. Identify who approved the close-out by role, if personal names cannot appropriately be disclosed. Publish the engineering justification for retaining the final design. Publish any later design reviews that reconsidered the issue. Publish the internal investigation into the April 2025 release. And publish the lessons Shell says it learned. There may be commercially sensitive material requiring redaction. There is no obvious public-interest justification for keeping the safety reasoning itself secret. Offshore workers across the industry could potentially benefit from understanding exactly how the problem survived from hazard review into operational plant. HAZOP recommendations should not require hindsight This matters beyond Shell. The offshore industry is built upon accumulated lessons written in blood. Piper Alpha demonstrated what uncontrolled hydrocarbon release and ignition can do to an offshore installation. Every modern offshore process-safety system exists partly because industries learned — repeatedly and painfully — that small failures can escalate catastrophically when multiple safety barriers fail together. Nobody was injured at Penguins. That is fortunate. Gas detectors worked. Operators shut production down. Those barriers succeeded. But good process safety is not judged solely by whether the final barrier worked. It asks why the hazardous condition reached that barrier at all. If the hazard had already been identified during design, the question becomes still more urgent. The uncomfortable timeline The timeline can now be stated simply. 2017: Shell awards Fluor the Penguins design contract. (The Chemical Engineer) 2018: Detailed design begins. According to The Chemical Engineer’s source, a HAZOP recommends changing the open-drains arrangement because of hydrocarbon-release risk. (The Chemical Engineer) 15 January 2018: Shell announces final investment decision, describing Penguins as an attractive project with a forward break-even price below $40 a barrel. (Shell) 2024: Penguins goes through offshore preparation and HSE inspection; the specific knockout-drum design is not within the scope of the July HSE inspection. (The Chemical Engineer) 4 February 2025: Shell starts production, celebrating Penguins as a modern, state-of-the-art North Sea facility. (Shell) 21 April 2025: 95.3 kg of hydrocarbon gas is unintentionally released. Gas detectors respond and production is stopped. (The Chemical Engineer) May 2025: HSE serves Shell with an improvement notice over “unsuitable plant design” and failure to take appropriate measures against fire and explosion. (The Chemical Engineer) 24 August 2026: The Chemical Engineer reveals the reported 2018 HAZOP warning. Shell does not deny that the recommendation was made. (The Chemical Engineer) That is an extraordinary seven-year arc. This is no longer just a story about an unsuitable drain The engineering defect matters. The governance question matters more. Shell is one of the world’s most experienced operators of hazardous hydrocarbon installations. It possesses enormous engineering resources. It has proprietary Design and Engineering Practices. It employs technical authorities and process-safety specialists. And the Penguins project went through years of design, construction, commissioning and safety assurance. Yet a design HSE eventually called unsuitable survived all the way into production. If the latest reporting is correct, an internal hazard study had specifically raised the danger years earlier. That points to a potential failure not of hazard identification but of hazard resolution. And that is a very different problem. The question Shell now has to answer Nobody should claim on the present evidence that Shell knowingly commissioned a design it expected to leak. The evidence does not establish that. Nor can it yet be said that the 2018 recommendation, had it been implemented exactly as proposed, would certainly have prevented the April 2025 release. That requires the engineering record. But Shell now has a straightforward question to answer publicly: Why was a design identified during a 2018 HAZOP as increasing hydrocarbon-release risk still present when Penguins entered production in 2025? “Lessons were learned” is not the answer. It is what comes after the answer. The workers sent offshore on Penguins — and the wider North Sea industry — deserve to know what happened between the warning and the release. Because HAZOP exists specifically to stop organisations from discovering, seven years later, that somebody had already warned them. Sources The Chemical Engineer — ‘Unsuitable design’ blamed for gas release at Shell’s new North Sea facility Shell — Penguins: next generation platform starts production in the UK North Sea Shell — Shell starts up new facility in UK North Sea, restoring production from the Penguins field UK Government — Penguins Production Permit PRA-282 Environmental Assessment Justification Shell — 2018 final investment decision for Penguins redevelopment Editorial note The existence and substance of the 2018 HAZOP recommendation are reported by The Chemical Engineer from a source involved with the Penguins design team. Shell did not deny to the publication that the recommendation had been made. The published evidence does not yet establish why the recommendation was not reflected in the final operating configuration, whether Shell formally rejected it, whether compensating safeguards were considered adequate, or whether implementation of the recommendation would certainly have prevented the April 2025 event. HSE’s finding of “unsuitable plant design” relates to the 2025 hydrocarbon release and improvement notice. Shell says the incident was detected promptly, production was stopped immediately, a thorough review was carried out and lessons were learned from design through operation. No injuries were reported. Site wide disclaimer also applies. This website and sisters royaldutchshellgroup.com, shellnazihistory.com, royaldutchshell.website, johndonovan.website, shellnews.net, and shellwikipedia.com, are owned by John Donovan - more information here. There is also a Wikipedia segment, the Shell DPA Files, "Shell and the Spies", the Shell Leaks files, as well as books written and published by John Donovan - Kindle eBooks. Timeline of the Donovan Shell Feud. Toxic History of Royal Dutch Shell Group. Shell and the Donovans: The Full Media Record — 550+ Articles, 110 Books, 40 Years.