LNG Bunkering Risks are a critical concern in the maritime industry, as the safe transfer of liquefied natural gas requires meticulous planning and execution. Effective risk assessment methodologies are essential to identify potential hazards and mitigate them before they escalate into serious incidents. By utilizing comprehensive worksheet templates, operators can systematically evaluate risks associated with LNG bunkering operations.
This proactive approach not only enhances safety but also ensures compliance with regulatory standards. Understanding and addressing these risks is vital for the sustainability and efficiency of marine fuel operations.
Introduction
Each LNG bunkering operation is unique and therefore, has a unique set of hazards and risks. This appendix introduces a risk assessment methodology, describes a process for performing a risk assessment, and provides example worksheet templates for a truck-to-vessel bunkering operation.
Risk Assessment Methodology
To characterize the risk of LNG Risk Assessment in the Liquefied Natural Gas Bunkering Operations, Hazard Identificationbunkering operations, risk assessment teams must tailor a sound risk assessment methodology that can successfully answer the following questions:
- What can go wrong? Risk assessment methods are used to identify hazards that can create accidents. These can include equipment failures, human errors, and external events. Based on the quantity and types of hazards that may affect the bunkering option, analysts can gain a good understanding of the risk associated with the operation.
- How likely is it? Likelihood is usually expressed as the probability or frequency of an accident occurring. If the likelihood is low enough, analysts may conclude that a possible accident scenario is not credible, not of concern, or of extremely low risk. But, the criteria for making such judgments often change with the type and severity of the consequence related to the possible accident.
- What are the impacts? An accident can affect many areas of concern with different degrees of negative results. The type and severity of consequences related to an accident help an analyst understand and judge risk.
The following are key terms and definitions associated with the risk assessment process:
Hazards: Situations, conditions, characteristics, or properties that create the possibility of unwanted consequences.
Causes: Underlying reasons (e. g., equipment failure, human error) why the initial incident occurs and safeguards fail to interrupt the chain of events.
Safeguards: Planned protections that are intended to interrupt the progression of accident sequences at various points in accident chains of events. Safeguards can be applied to prevent the likelihood of occurrence or to minimize the consequences. These planned protections may be physical devices, human interventions, or administrative policies.
Likelihood: The likelihood of events is often expressed as a frequency, events per year. To assess the frequency of any event, analysts must consider (1) how often the hazard is present (e. g., how many times an operation is performed) and (2) the probability of experiencing the accident during any exposure to the hazard.
Table 1 is an example of likelihood categories.
| Table 1. Likelihood Categories | |
|---|---|
| Category | Category Descriptions |
| Almost Certain (E) | Occurs 1 or more times per year |
| Likely (D) | Occurs once every 1 to 10 years |
| Possible (C) | Occurs once every 10 to 100 years |
| Unlikely (B) | Occurs once every 100 to 1 000 years |
| Rare (A) | Occurs once every 1 000 to 10 000 years |
Consequences: Unwanted impacts that can negatively affect subjects of interest. These types of impacts can include: deaths/injuries to workers and the public, property damage, business interruption, environmental impacts, and impacts to company reputation. The severity of consequences can range from insignificant to catastrophic. Each owner/operator has unique considerations; therefore, impact and severity descriptions should be tailored to reflect organizational concerns. Table 2 provides an example of a consequence matrix containing representative impact and severity categories.
| Table 2. Representative Consequence Categories | ||||
|---|---|---|---|---|
| Severity Categories | Impacts | |||
| Death & Injury | Economic | Environmental | Reputation | |
| Low (1) | Low level short-term subjective inconvenience or symptoms. No measurable physical effects. No medical treatment. | No shutdown, costs less than $1 000 to repair. | No lasting effect. Low-level impacts on biological or physical environment. Limited damage to minimal area of low significance. | Public concern restricted to local complaints. Ongoing scrutiny/attention from regulator. |
| Minor (2) | Objective but reversible disability/ impairment and/or medical treatment injuries requiring hospitalization. | No shutdown, costs less than $10 000 to repair. | Minor effects on biological or physical environment. Minor short-term damage to small area of limited significance. | Minor, adverse local public or media attention and complaints. Significant hardship from regulator. Reputation is adversely affected with a small number of site-focused people. |
| Moderate (3) | Moderate irreversible disability or impairment (< 30 %) to one or more persons. | Operations shutdown, loss of day rate for 1-7 1days and/or repair costs of up to $100 000. | Moderate effects on biological or physical environment but not affecting ecosystem function. Moderate short-medium term widespread impacts (e. g., oil spill causing impacts on shoreline). | Attention from media and/or heightened concern by local community. Criticism by Non- Governmental Organizations (NGO). Significant difficulties in gaining approvals. Environmental credentials moderately affected |
| Major (4) | Single fatality and/or severe irreversible disability or impairment (> 30 %) to one or more persons. | Operations shutdown, loss of day rate for 7-28 days and/or repair costs of up to $1 000,000. | Serious environmental effects with some impairment of ecosystem function (e. g., displacement of species). Relatively widespread medium-long term impacts. | Significant adverse national media/public/NGO attention. May lose license to operate or not gain approval. Environment/management credentials are significantly tarnished. |
| Critical (5) | Short or long-term health effects leading to multiple fatalities, or significant irreversible health effects to > 50 persons. | Operations shutdown, loss of day rate for more than 28 days and/or repair costs more than $1 000,000. | Very serious effects with impairment of ecosystem function. Long-term widespread effects on significant environment (e. g., unique habitat, National Park). | Serious public or media outcry (international coverage). Damaging NGO campaign. License to operate threatened. Reputation severely tarnished. Share price may be affected. |
Risk: The risk of a hazard is based on the combination of the likelihood and consequence assessment, allowing risks of different hazards, operations, and potential accidents to be compared using a common measuring stick. Table 3 presents examples of risk levels assigned for each combination of likelihood and severity combination. Each owner/operator has unique considerations and risk tolerances, thus risk levels should be tailored to reflect those individual organizational risk tolerances.

Risk Assessment Process
Accidents usually occur through a chain of events ending in one or more unwanted effects. This chain of events begins with hazards capable of causing consequences. If there are no hazards, there are no consequences. An equipment failure, human error, or external event is necessary for a hazard to cause consequences. Sometimes one or more equipment failures, human errors, or external events must take place after the initiating event for an accident to occur. An accident has at least one unwanted consequence with a measurable effect. This outcome is influenced throughout the chain of events by the presence of safeguards and their success or failure.
Read also: Guidance on HAZID and HAZOP for LNG bunkering operations
The risk assessment team should develop various accident chains for representative bunkering options by identifying potential hazards, causes, consequences, and safeguards by applying a sound methodology and structured assessment process (Figure).

To do this, the team could employ the HazID methodology which leverages experts to brainstorm potential scenarios to facilitate in identification of health, safety, and environmental (HSE) hazards associated with various LNG Key Considerations for Successful Bunkering Facility Developmentbunkering options.
Key steps required to develop the risk profiles include:
- Assemble an appropriate team of experts familiar with LNG loading/unloading operations and LNG bunkering.
- Provide an overview of each bunkering option, including major phases of the operations (e. g., connect, transfer, disconnect, lift) and types of vessels involved.
- Brainstorm hazards that could potentially result in unwanted consequences.
- Identify potential causes of the hazard.
- Identify safeguards potentially in place to prevent the likelihood of occurrence (prevention) or minimize the consequences (mitigation).
- Describe the consequences and, if the hazard could result in a release of LNG, score the risk of the hazard as a function of likelihood and consequence considering all impact types: deaths/injuries, economic impacts, environmental impacts, and impacts to company reputation.
- If applicable, document the linkage between hazards that could be causes of other hazards.
- Record the team’s discussions on HazID worksheets.
LNG bunkering within North America is early in its development and there is relatively limited experience internationally. Therefore, at this time, there is a lack of historical accident data on which to base the risk assessment. To develop the risk profile, the team should consider hazards, causes, and consequences for historical accidents of analogous operations, including LNG import/export, traditional bunkering, and hazardous material transfers.
Table 4 provides an example worksheet template for a truck-to-vessel bunkering operation.
| Table 4. Template Worksheet for Truck to Vessel Hazard Assessment | ||||||||
|---|---|---|---|---|---|---|---|---|
| No. 1 | Truck to Vessel | |||||||
| Item | Hazard | Typical Causes | Typical Consequences | Impact | S | L | Risk Level | Representative Safeguards |
| 1.1 | What if there is an LNG leak from pump/piping/ hoses during transfer? | Corrosion/erosion External impact Fatigue failure Gasket, packing failure Hose failure or disconnection Improper hose connection Improper maintenance Material defect (e. g., weld) Piping not properly cooled down prior to transfer. Seal failure. Use of inappropriate piping/ hoses (e. g., not LNG rated) Valve leaking or misaligned to the atmosphere VibrationExcessive movement of the loading arm (linked from 1.5) Supply truck drives/rolls away with hoses still connected (linked from 1.10) Another vessel collides with the receiving vessel (linked from 1.11)Cargo dropped onto tank or loading lines (linked from 1.13) Fire aboard the receiving vessel (linked from 1.14)Extreme sea state (linked from 1.17) Earthquake (linked from 1.18) | Small release of LNG | Environmental | Bunkering procedures Communication between parties involved in bunkering (e. g., person in charge) Controls and/or prohibitions of simultaneous | |||
| Small release of LNG, resulting in brittle fracture of ship deck; fire damage to ship/supply tank/ surrounding equipment potentially affecting a small area | Economic | |||||||
| Small release of LNG, resulting in fire/explosion/cryogenic hazards to personnel in the immediate area | Death & Injury | |||||||
| 1.2 | What if there is an LNG leak from the supply truck? | Corrosion/erosion External impact Gasket/packing failure Improper maintenance Material defect Valve leaking or misaligned to the atmosphere Vehicle collides with the supply truck (linked from 1.12) Cargo dropped onto tank or loading lines (linked from 1.13) Earthquake (linked from 1.18 | Small release of LNG | Environmental | Bunkering procedures Controls and/or prohibitions of simultaneous passenger and bunkering operations Equipment inspection/testing prior to bunkering ESD system ESD system tests Bunkering of Liquefied Natural Gas-fueled Marine Vessels in North America No. 1 Truck to Vessel Item Hazard Typical Causes Typical Consequences Impact S L Risk Level Representative Safeguards Vehicle collides with the supply truck (linked from 1.12) Cargo dropped onto tank or loading lines (linked from 1.13) Earthquake (linked from 1.18) Flammable material detectors Maintenance procedures Personal protective equipment Supervision during transfer operations Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Periodic certification of hoses Vessel emergency response plans Local emergency response plans | |||
| Small release of LNG, resulting in fire damage to ship/supply tank/ surrounding equipment potentially affecting a small area | Economic | |||||||
| Small release of LNG, resulting in fire/explosion/cryogenic hazards to personnel in the immediate area | Death & Injury | |||||||
| 1.3 | What if there is a disconnect of piping/hoses during transfer (prior to stopping flow)? | Improper connection Excessive movement of the loading arm (linked from 1.5)Supply truck drives/rolls away with hoses still connected (linked from 1.10) Another vessel collides with the receiving vessel (linked from 1.11) Cargo is dropped onto loading lines (linked from 1.13) Extreme sea state (linked from 1.17) | Very small release of LNG | Environmental | Bunkering procedures Communication between parties involved in bunkering (e. g., person in charge) Controls and/or prohibitions of simultaneous passenger and bunkering operations Designed breakaway coupling protects other equipment Drip tray Equipment inspection/testing prior to bunkering ESD system ESD system tests Flammable material detectors Maintenance procedures Personal protective equipment Supervision during transfer operations Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Vessel emergency response plans Local emergency response plans | |||
| Very small release of LNG, resulting in cryogenic hazards to personnel in the immediate area | Death & Injury | |||||||
| Very small release of LNG; no economic consequence | ||||||||
| 1.4 | What if the ESD system fails to stop LNG flow when leak or inadvertent disconnect occurs? | ESD instrumentation failure Icing on piping and/or valves interferes with ESD function No ESD system on supply truck Operator error/interference with ESD function Programming errors (e. g.improper logic) Use of nonstandard equipment | Large release of LNG | Environmental | Ability to manually initiate ESD system Bunkering equipment configuration control Bunkering procedures ESD system checkout and periodic testing Personal protective equipment Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Vessel emergency response plans Local emergency response plans | |||
| Large release of LNG, resulting in brittle fracture of ship deck; fire damage to ship/supply tank/ surrounding equipment potentially affecting a large area personnel in the surrounding area | Economic | |||||||
| Serious media attention and public outcry | Reputation | |||||||
| 1.5 | What if there is excessive movement of the hose/loading arm? | External impact Improper maintenance Loading arm control system failure Operator error in placing and adjusting loading arm Structural failure Extreme wind (linked from 1.16) Earthquake (linked from 1.18) | LNG leak from pump/piping/hoses during transfer (linked to 1.1) | Bunkering procedures ESD system Loading arm design standards and inspections Maintenance procedures | ||||
| Disconnect of piping/hoses during transfer (prior to stopping flow) (linked to 1.3) | ||||||||
| 1.6 | What if the tank is overfilled? | Level controller and operator fail to stop flow when tank is ful | Small to medium release of LNG | Environmental | Bunkering procedures High level alarm Independent level inputs to ESD system Personal protective equipment Tank instrumentation Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Vessel emergency response plans Local emergency response plans | |||
| Small to medium release of LNG, resulting in brittle fracture of ship deck/fire damage to ship/supply tank/surrounding equipment potentially affecting a small area | Economic | |||||||
| Small to medium release of LNG, resulting in fire/explosion/ cryogenic hazards to personnel in a small area | Death & Injury | |||||||
| 1.7 | What if the tank is overpressured? | Continued transfer to liquid- full tank and relief valve fails to open Fire aboard the receiving vessel (linked from 1.14) | Large release of LNG | Environmental | Bunkering procedures, including emergency operations ESD system shut off on high level Personal protective equipment Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Vessel emergency response plans Local emergency response plans | |||
| Large release of LNG, resulting in brittle fracture of ship deck/ fire damage to ship/supply tank/ surrounding equipment potentially affecting a large area | Economic | |||||||
| Large release of LNG, resulting in fire/explosion/cryogenic hazards to personnel in the surrounding area | Death & Injury | |||||||
| Serious media attention and public outcry | Reputation | |||||||
| 1.8 | What if the transfer lines are not de- inventoried and/or purged properly? | Operator error | Small release of LNG | Environmental | Bunkering procedure, including: de-inventorying, purging, inerting, and disconnection steps Operator training | |||
| Small release of LNG, resulting in brittle fracture of ship deck; fire damage to ship/supply tank/ surrounding equipment potentially affecting a small area | Economic | |||||||
| Small release of LNG, resulting in fire/explosion/cryogenic hazards to personnel in the immediate area | Death & Injury | Personal protective equipment Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Vessel emergency response plans Local emergency response plans | ||||||
| 1.9 | What if LNG (cryogenic liquid) is blocked in between two valves? | Improper purging | Damage to valve/piping | Economic | Bunkering procedure, including: de-inventorying, purging, inerting, and disconnection steps Personal protective equipment Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources | |||
| Very small release of LNG | Environmental | |||||||
| Very small release of LNG, resulting in cryogenic hazards to personnel in the immediate area | Death & Injury | |||||||
| 1.10 | What if the supply truck drives/rolls away with hoses still connected? | Failure to secure truck (brakes, wheel chocks) Truck driver error Vehicle collides with the supply truck (linked from 1.12) | LNG leak from pump/piping/hoses during transfer (linked to 1.1) | Bunkering procedures, including steps to secure supply truck Driver training Limit traffic in bunkering area | ||||
| Disconnect of piping/hoses during transfer (prior to stopping flow) (linked to 1.3) | ||||||||
| 1.11 | What if another vessel collides with the receiving vessel? | Error in ship navigation by passing ship Poor visibility Steering or propulsion failure in passing ship | LNG leak from pump/piping/hoses during transfer (linked to 1.1) | Mariner training and credentials Piloted operations, where employed USCG safety zones and regulated navigational areas | ||||
| Disconnect of piping/hoses during transfer (prior to stopping flow) (linked to 1.3) | ||||||||
| 1.12 | What if a vehicle collides with the supply truck? | Driver error | LNG leak from the supply truck (linked to 1.2) | Bunkering procedures Driver training Limited traffic in bunkering area Vehicle guards around fixed storage tank | ||||
| Truck drives/rolls away with hoses still connected (linked to 1.10) | ||||||||
| 1.13 | What if cargo is dropped onto supply truck or loading lines? | Crane operator error Crane structural failure Improper maintenance Use of equipment with insufficient lifting capacity Extreme wind (linked from 1.16) Earthquake (linked from 1.18) | LNG leak from pump/piping/hoses during transfer (linked to 1.1 | Bunkering procedures Controls and/or prohibitions of simultaneous cargo and bunkering operations Crane design standards and inspections Crane operator training and certification Maintenance procedures | ||||
| LNG leak from the supply truck (linked to 1.2) | ||||||||
| Disconnect of piping/hoses during transfer (prior to stopping flow) (linked to 1.3) | ||||||||
| 1.14 | What if there is a fire aboard the receiving vessel? | Galley, engine room, passenger compartment fire | LNG leak from pump/piping/hoses during transfer (linked to 1.1) | Bunkering procedures, including emergency operations ESD system Firefighting system Shipboard emergency response procedures | ||||
| Tank is overpressured (linked to 1.7) | ||||||||
| 1.15 | What if there is an external fire near the supply truck? | Onshore/dock fire Transportation equipment fire | Large release of LNG | Environmental | Bunkering procedures, including emergency operations ESD system Facility emergency response procedures Facility firefighting system Personal protective equipment Appropriate electrical classification in bunkering area where accidental releases could occur to limit ignition sources Vessel emergency response plans Local emergency response plans | |||
| Large release of LNG, resulting in fire/explosion damage to ship/ supply tank/surrounding equipment potentially affecting a large area | Economic | |||||||
| Large release of LNG, resulting in fire/explosion/BLEVE/cryogenic hazards to personnel in the surrounding area | Death & Injury | |||||||
| Serious media attention and public outcry | Reputation | |||||||
| 1.16 | What if there is extreme wind during the bunkering operation? | Weather | Excessive movement of the loading arm (linked to 1.5) | Bunkering procedures, including weather limits | ||||
| Cargo is dropped onto tank or loading lines (linked to 1.13) | ||||||||
| 1.17 | What if there is an extreme sea state during the bunkering operation? | Weather | LNG leak from pump/piping/hoses during transfer (linked to 1.1) | Bunkering procedures, including weather limits | ||||
| Disconnect of piping/hoses during transfer (prior to stopping flow) (linked to 1.3) | ||||||||
| 1.18 | What if there is an earthquake during the bunkering operation? | Earthquake | LNG leak from pump/piping/hoses during transfer (linked to 1.1) | Seismic qualifications of cranes Seismic qualifications of fixed onshore tanks | ||||
| LNG leak from the supply truck (linked to 1.2) | ||||||||
| Excessive movement of the loading arm (linked to 1.5) | ||||||||
| Cargo dropped onto tank or loading lines (linked to 1.13 | ||||||||
