Drone-in-a-box offshore: what Shell's Mars trial means for inspection buyers

What Shell has demonstrated at Mars

According to JPT, Shell ran drone-in-a-box trials in April 2026 from its Mars floating production unit in Mississippi Canyon Block 807, in the US Gulf of Mexico, which has since been renamed the Gulf of America. In those trials the operator showed it could safely launch and recover the aircraft. The system comprises a docking station, an external camera that monitors the drone and supports pre-flight checks, and a gas sensor for compliance with electrical codes. It is operated from a bespoke laptop over Starlink and cellular (5G/LTE) connectivity, and can launch, capture data, land and recharge without a pilot on site. Shell is also the first Gulf operator to obtain Federal Aviation Administration (FAA) approval to self-authorise beyond-visual-line-of-sight (BVLOS) drone operations from any of its facilities in the region.

The use case is post-hurricane remanning. Hurricanes can force floating platforms in the Gulf to shut in many times over their service lives. Before personnel return to restart production, the usual visual safety check has been a helicopter flyby. An autonomous drone based on the facility could deliver a more detailed visual inspection sooner, which the source suggests could result in a faster return to production. We treat that as a claim to be proven, not an outcome already banked.

In mid-August, at the rooftop drone test facility at Shell Technology Center Houston, senior robotics engineer Ross Doak showed the full cycle. The container opens, the aircraft runs its initialisation checks, flies a short survey and lowers itself back into the box, which then closes. He then commanded a similar flight from a conference room. The source identifies landing, not launch, as the hard problem offshore, because the deck and the aircraft are both moving while a remote pilot supervises from somewhere else.

Why a resident drone is an engineering purchase, not a service contract

In our experience, operators have mostly bought offshore drone inspection as a campaign service: a crew mobilises, flies within visual line of sight, and demobilises with a set of images. A drone-in-a-box system works differently. It is a permanent installation. It needs platform power, a telemetry path to shore and a sited enclosure, and its output feeds the facility’s structural integrity management (SIM) process directly. We think the purchasing decision should therefore move away from operations procurement and towards the integrity and engineering functions, and the specification has to follow it.

Imagery that supports a remanning decision after a hurricane is a safety-critical input. API RP 2SIM for fixed structures and API RP 2FSIM for floating systems both treat post-event special inspection as part of integrity management, and API Bulletin 2HINS gives Gulf-specific post-hurricane inspection guidance. Whoever signs off remanning needs objective evidence that the inspection was adequate for the damage it was meant to find. The two error directions carry very different costs:

• A missed defect puts personnel back on a structure with undetected damage: a primary steel member, a riser guide, a damaged walkway or a compromised escape route.
• A false alarm keeps the facility shut in while a manned or helicopter inspection is arranged. That costs production and adds aviation exposure from the follow-up inspection, but nobody is returned to a damaged structure.

The baseline for comparison is the helicopter flyby, not perfection. A flyby is quick and well understood. Its weaknesses are also familiar: the standoff is fixed, the aircraft cannot look under decks, viewing time is limited and imagery is often inconsistent between events. In our view, a drone programme justifies itself by showing detection at least equal to that baseline on every damage category, delivered faster and with more consistent evidence. Higher image resolution alone does not demonstrate it.

The engineering that decides whether it works

Relative navigation on a moving landing surface

An onshore drone-in-a-box lands on a pad that is fixed in an earth-referenced frame. Standard GNSS guidance with a precision landing aid is enough. Offshore, what matters is the aircraft’s position relative to the box, and the box moves with the hull. A credible system needs a relative navigation solution. That can be moving-baseline RTK between a receiver on the box and one on the aircraft, visual fiducials on the landing surface tracked by a downward camera, or both. It also needs real-time knowledge of deck motion so the descent can be timed or rejected.

Mars is a tension leg platform, so deck motions at the box are small but not zero. A semi-submersible, a spar and a turret-moored FPSO each have a different motion signature, and a turret-moored FPSO also weathervanes, which changes the approach heading to the box. Industry has long managed helicopter landings against declared deck-motion limits from helideck monitoring systems, as set out in UK CAA CAP 437 and reflected in Gulf practice through HSAC and API helideck guidance. We would expect a resident drone to have an equivalent envelope. It should be declared, derived from trials, and enforced automatically.

The airflow over the topsides adds a further constraint. Turbulence shed by modules and cranes, hot exhaust plumes from turbines and flare radiation are established helideck hazards. A small multirotor is more sensitive to gusts than a helicopter, so siting the box against the prevailing wind sectors matters as much as the aircraft’s own wind rating.

Positioning and heading close to steel

Inspection flight close to the structure degrades GNSS in ways every survey engineer on our team will recognise. Multipath from the jacket, hull and topsides steel corrupts pseudoranges. Sky view collapses under decks and alongside the hull, and satellite geometry deteriorates exactly where the high-value images are taken. Magnetometers suffer even more, because large steel masses distort the local field enough to make compass heading unreliable at close range. Dual-antenna GNSS heading is no escape: it suffers the same multipath and sky-view loss, made worse by the short antenna baseline a small multirotor can carry. It is useful in open sky, but close to the structure heading has to come from inertial and visual-inertial odometry that can bridge GNSS outages for the duration of the close-range pass. Obstacle sensing must likewise be independent of the GNSS solution. GNSS interference is also a live threat in some operating regions. The same reasoning we set out on how spoofing propagates into DP and positioning decisions applies to an autonomous aircraft that relies on satellite positioning to find its way home.

The coordinate frame defects are recorded in

This is where geomatics discipline matters most and gets the least attention. A floating structure has no fixed earth position. If a drone geotags each image in WGS 84 or a projected UTM grid, a defect is tied to a point the platform occupied at that instant. On the next survey the platform will sit at a different offset from its mean position, and the same weld will carry different coordinates.

Defects on a floating facility belong in the platform’s body-fixed grid, the same frame as the as-built drawings and the 3D model. To get there, each image’s earth-referenced position must be transformed using the platform’s own position, heading and attitude at that image’s epoch. That requires the platform GNSS, gyro and motion reference unit data to be logged and time-synchronised with the aircraft, preferably to a common GNSS time reference. Without it, change detection between events depends on manual image matching, and repeatability is lost. Positional accuracy of the deliverable should be stated against a recognised framework such as the ASPRS Positional Accuracy Standards for Digital Geospatial Data, with quality metadata structured to ISO 19157-1:2023. Then the GIS or asset register that receives the data knows what it is holding.

Image quality and coverage acceptance

A visual inspection stands or falls on whether it could have seen the defect. The governing parameters are well known: ground sample distance at the actual standoff, angle of incidence, motion blur, lighting and exposure, and coverage completeness against the inspection scope. A coating breakdown survey and a check for gross structural deformation need very different GSD and viewing geometry, so one blanket specification will not serve both. Coverage gaps follow the facility geometry. Under-deck areas, the splash zone, the flare boom and riser hang-off areas above the waterline are all harder for an autonomous route than open topsides. Items below the waterline are a different matter: on TLPs such as Mars, spars and semi-submersibles, SCR and riser porches typically sit on the pontoons or lower columns, and an aerial drone cannot reach them at all. They need ROV, diver or other subsea methods. The mission plan should state explicitly which items in the post-event scope the drone does not cover and which method covers them instead.

Power, communications and the post-storm state

The use case contains a dependency that is easy to overlook. The drone is needed most immediately after a hurricane, when the facility has been shut in and evacuated. At that point platform power may be on emergency supply or batteries, and the Starlink and cellular antennas or other telemetry equipment may be damaged. The box and the aircraft may have taken the storm themselves. The system has to survive the design storm in its stowed state, cold-start on whatever services remain, and get usable data ashore. Real-time streaming of full-resolution imagery over a degraded satellite link is often impractical. We consider a design that stores data on board and transmits a prioritised low-resolution subset first to be more realistic.

Aviation assurance after self-authorisation

Self-authorisation for BVLOS moves the assurance burden onto the operator. The FAA approval does not replace the internal case. For a Gulf of America operation the regulatory route is American: US BVLOS approvals have been issued through Part 107 waivers and exemptions, with a dedicated Part 108 rule proposed, and the FAA does not formally use the JARUS SORA methodology adopted by EASA and many other regulators. We still find SORA a useful structure for the operator’s own documented risk assessment, provided it supplements rather than replaces the FAA basis. The operator also needs a defined approach to detect-and-avoid in a busy offshore helicopter environment, and integration with existing aviation management, for which IOGP’s aircraft management guidance (Report 590) is the natural reference. Hazardous area classification sets the final siting constraint: the box goes outside classified areas, or the equipment is certified for the area it occupies under the applicable scheme (API RP 500 or RP 505 with the corresponding NEC articles, or IEC 60079). Shell’s unit carries a gas sensor for electrical code compliance.

Where buyers get it wrong

1. Specifying the aircraft instead of the inspection record

We routinely see tenders that specify flight endurance, camera resolution and wind rating, then say little about the deliverable. The product the integrity engineer needs is an inspection record. That means imagery tied to asset tags, with known resolution, known coverage and a traceable chain from acquisition to sign-off. Aircraft performance only matters to the extent that it produces that record.

2. Georeferencing a floating structure in an earth-fixed frame

The error is easy to miss in a single demonstration and typically surfaces only at a later post-event comparison, by which time the archive is already inconsistent.

3. Treating one hull’s qualification as transferable

A recovery envelope demonstrated on a tension leg platform says little about a semi-submersible or an FPSO; each hull type, and where box location matters each installation, needs its own.

4. Assuming platform services survive the storm

Factory acceptance on shore power with clean telemetry does not qualify a system for a shut-in facility with degraded services, which is its primary use case.

5. Leaving the remanning decision rights undefined

The drone produces images. A competent person has to judge whether they show the structure is fit for personnel to return. Programmes often define the flight operation in detail and leave unclear who reviews the imagery, against which acceptance criteria, and who stands in when that engineer is unavailable on the morning after a storm. The decision chain belongs in the facility SIM plan, not in the drone contractor’s operations manual. The same principle drives the case we made on which inspection data actually supports a structural fitness decision: data only has value against the decision it supports.

How to decide

We have written these recommendations to be testable in a tender, a qualification plan or the first period of operation.

• Run drone and helicopter inspections in parallel until each damage category in the post-event scope has a minimum sample of comparisons agreed in the qualification plan, drawn from real events or planned exercises, before the flyby is retired. A calendar period is not enough, because a season may bring no shut-in at all. On every comparison, record which defects each method found and which it missed. Retire the flyby only when the drone shows equal or better detection on every damage category in the post-event scope.
• Define inspection classes with numeric image acceptance criteria. For each class, set a maximum GSD at the planned standoff, a maximum angle of incidence, and a blur rejection threshold. Where a photogrammetric model is required, specify forward and side overlap (typically of the order of 80% forward and 60–70% side for close-range structural photogrammetry, adjusted for the required model accuracy). Reject and re-fly any sortie that fails, and track the rejection rate as a KPI.
• Specify the platform body-fixed grid as the delivery frame. Require logging of platform position, heading and attitude at 10 Hz or better, synchronised with the aircraft to GNSS time. Require the transformation to be documented in each deliverable’s metadata, and state positional accuracy against ASPRS classes, evaluated against check points in the platform body-fixed frame.
• Qualify the landing envelope per hull type. The qualification plan should set a minimum landing count in each band of wind speed and deck motion, cover the full declared envelope rather than benign days only, and log every abort with its cause. The declared limits should then be enforced automatically from motion reference unit and anemometer inputs.
• Test the post-storm condition explicitly. Demonstrate cold start after loss of normal platform power, operation on emergency supply, and data return over the backup telemetry path. Size enclosure wind resistance to the facility’s design hurricane criteria, and define a power strategy (UPS, emergency generator remote start or dedicated supply) that covers the expected shut-in duration plus the first post-event mission sequence.
• Assign subsea scope explicitly. List every submerged item in the post-event scope, including riser porches on pontoons and lower columns, and name the ROV, diver or other method responsible for it.
• Write the remanning decision chain into the SIM plan. Name the competent reviewer role, a deputy, the acceptance criteria for each structural element in the post-event scope, and a maximum time from all-clear to imagery review. Measure that time on every event.
• Index every image to the asset register. Each image should carry an asset tag, an acquisition epoch and ISO 19157 quality elements, so that the GIS or integrity database can filter by element and compare events without manual matching.
• Track four programme KPIs from day one: mission completion rate, image rejection rate, autonomous landing abort rate, and elapsed time from weather all-clear to a reviewed inspection record. Together they show whether the system delivers on the one claim that would justify it, a faster and better-evidenced return to production.

Shell’s result shows that autonomous launch and recovery from a floating facility in the Gulf can be done, and its FAA approval to self-authorise BVLOS operations opens the door to wider use. For any operator following, we believe the harder work lies in the frame definition, the acceptance criteria and the decision chain behind the aircraft, and that is where the specification should concentrate.

---

Based on: JPT Exclusive: Shell Advances Drone Operations in the US Gulf