Risk Assessment in the Liquefied Natural Gas Bunkering Operations, Hazard Identification

To understand the risks (risk evaluation) involved in LNG bunkering, a technique called Hazard Identification (HAZID) is employed.

Risk Identification

Hazard Identification (HAZID)

The various scenarios of a LNG bunkering operation are systematically analyzed to identify the risks and they are then subject to frequency estimations and consequence modeling. The main hazards recognized in this study relate to LNG leakage, also known as LOC of LNG, exclusively during the bunkering operation. Hazards that arise from intermediate LNG storage (i. e. on land storage or in shuttle tankers used to transport LNG) are not considered within the scope of this study. During the hazard identification, the cause, consequence and credibility of each of the hazards have been identified.

The work process in this study started by comparing HAZIDS in past DNV projects on LNG. On Table B below, an example of the process sections, equipment and scenarios that are considered are listed.

The DNV RP recommends this table. HAZIDS results include a list describing the threats and a risk-ranking matrix. Risk-ranking matrixes prioritize the events through evaluation of their severity. Medium- and high-risk events should be analyzed numerically in the QRA. Both of these tables can be seen in Table B and C. The HAZID results will be used to form the bow-tie model explained below.

Bow-Tie Model

HAZID is a process performed to understand the potential causes and consequences of an LNG leakage. This information is fundamental to build a bow-tie model, which is a tool for understanding the mechanisms of a hazardous event.

LNG Leak Causes

In figure 1, a hierarchy of identified failure mechanisms that could initiate a LNG leak/LOC during bunkering is shown

The orange coloured boxes represent the initial events. These could then lead to the secondary events, which are represented by the turquoise coloured boxes, and finally, the purple coloured boxes represent a leak. For unplanned disconnection the events are exactly the same as for damage/rupture case (this is marked by the [*] box), to simplify the model (i. e. the event tree is exactly the same for both main events except for the additional failure of poorly made up connections in the system).

For ease of modeling the LNG system is split into process sections. Figure 2 shows how the system has been split in this study. The various process sections have different types of equipment, which needs to be considered, and will therefore be calculated and modeled for
frequencies in different ways.

Identification of Loss of Containment Scenarios

Based on the process section separation, a list of LOC scenarios has been identified:

1. Hose leakage – small.
2. Hose leakage – medium.
3. Hose leakage – large (FBR).
4. Hose disconnection – ERC works.
5. Hose disconnection – ERC fails (FBR).
6. Discharging tank leakage.
7. Receiving tank leakage.
8. Discharge line (piping, flanges, valves, pump etc.) leakage – small.
9. Discharge line leakage – medium.
10. Discharge line leakage – large (FBR).
11. Receiving line leakage – small.
12. Receiving line leakage – medium.
13. Receiving line leakage – large (FBR).

All of these scenarios will be evaluated for emergency shutdown system (ESD) working, ESD failure with operator intervention, and ESD and operator failure.

LNG Leak Consequences

The consequences reflect the LNG hazards and outcomes of a leak discussed in article Ship to Ship Bunkering Operations of the Liquefied Natural GasLNG. Human accidents due to frost burns require very close contact with LNG, and realistically this will only be a risk to the LNG transfer operators, not third party individuals. Equipment damage and environmental effects are also critical issues, but not related to safety zone calculations. The main concern for this study is the consequence of fire and explosions. Fire and explosions does however not happen as a direct result of the leak. Fire and explosion requires a leak, a mix with air at correct concentrations and the presence of an ignition source. The calculation of leak probability is the largest part of the workload, while the likelihood of ignition presences is added as a single probability ranging from 0-100 % probability per leak event.

Risk Analysis

Frequency Analysis

The frequency analysis determines the likelihood of a release of hazardous LNG/NG from process equipment for LNG bunkering. The objective of the LEAK frequency analysis is to estimate the frequency of accidental releases originating from the process equipment of the discharging and receiving unit in a Ship to Ship Bunkering Operations of the Liquefied Natural Gasship-to-ship (STS) LNG bunkering system. The interface between the discharging and receiving units, the cryogenic transfer hose, will be covered separately through fault tree analysis.

Transfer Hose Failure Frequencies

The interface between the two units covers the cryogenic hose and vapor return line. This process section cannot be calculated using LEAK software as there is no data covering hoses and in particular not cryogenic. To produce leak frequencies for the hose, a fault tree is created and events leading to a leakage are considered at a fundamental level. The aim is to create generic failure frequencies for flexible cryogenic transfer hoses.

Current standard practice is to use data from Advisory Committee on Dangerous Substances (ACDS) on loading arm frequencies directly. ACDS is considered the most representative data on LNG bunkering systems so far. Loading arms are more complex fixed pipes with multiple swivel systems, and differ significantly from hose based systems in terms of the fault tree. Loading arms will as a consequence include other factors in addition to considering the ACDS. This will be a more conservative approach, and it also shows the procedure in calculating frequencies from initial to main event.

DNV RP accident scenarios
Accidents scenarios, which should be considered for relevance.

This section will present what is considered initial events, which could lead to LNG leakage or LOC taking place and explanations for determining event frequencies. The assumptions made will be summarized. When the relevant events are determined, the “fault tree” (excel add-in) will be used to calculate the frequencies for this process section of the transfer system.

Based on the HAZID two main types of failures have been identified for the flexible cryogenic transfer hose: an unplanned disconnection (of the breakaway coupling) and damage or rupture of the hose, see figure 12.

Fault Tree

In this study, nine initial events have been identified, and five gates. A full picture and input overview for the fault tree model can be seen on the table below.

The following two figures, 3 and 4, will provide an overview over initial events considered (purple coloured boxes) and gates (blue coloured boxes) for establishing the frequencies.

Due to space limitations the total model is split in two sections: figure 3 covers damage rupture events and figure 4 covers disconnection.

SIMOPS Offshore
SIMOPS Offshore are simultaneous operations taking place offshore. This failure event relates to collision risk and frequencies. This type of failure is site-specific, meaning that it will vary depending on the port traffic in that specific location. In site-specific studies, nautical activity in a port is considered and collision frequencies and their impact energies are calculated specifically. The assessment will further cover the probability of LOC scenarios. Overall, the assessment requires high amounts of port data to be completed.

This thesis is generic and not site-specific. As such it does not include considerations relevant to a specific site. The selected failure frequency represents collisions as a whole and does not include information on the size and force of the impact, nor the ensuing consequences. The frequency is considered low, and to be conservative it is assumed that all collisions lead to LOC failures for the hose. A low SIMOPS Offshore frequency is reasonable since the bunkering is considered to take place in ports or other sheltered locations, as discussed in section Ship to Ship Bunkering Operations of the Liquefied Natural GasNautical Activity.

ACDS loading arm frequency consider collisions as one of its contributors to failure. The frequency consequently used is 2,30E-07. Leak frequencies presented in ACDS is based on filling of LNG tankers, which typically last for 18-24 hours. A ferry has a much shorter duration, assumed to last two hours per bunkering operation, in this study. The frequencies are consequently modified according to duration.

Statistics must be gathered over several decades to give reliable outcome (sample population). Small-scale STS bunkering has only been a technical solution since 2001 (Norwegian ferry Glutra was the first LNG fuelled ship), and any data compiled is not considered sufficient. The chosen frequency is conservative considering that collision events have been reduced over time, attributed to introduction of dynamic positioning systems and improved communication systems, electronic charting, navigational techniques and improved procedures. Based on this, any collision frequency chosen based on historical data should be conservative to current expected frequency.

SIMOPS Onshore

SIMOPS Onshore are simultaneous operations taking place onshore and refers to failures such as dropped objects, falling goods and impacts. The LNG fuelled vessel (receiving unit) will in the case of small-scale LNG bunkering be moored to dock. In the case of limited port time, simultaneous operations such as lifting of goods might take place. If these operations fail, it could have consequences for the LNG process equipment.

OGP – Risk Assessment Data Directory, Report No. 434-08 Mechanical lifting failures, is used to provide frequencies for SIMOPS Offshore. In part two, summary of recommended data, in the table “Dropped object probabilities for mobile units (per lift)”. The mobile unit’s probability is used instead of the fixed as the receiving ship could experience movement and for STS both units are seaborne. To be conservative in the choice of frequency the total frequency used is 1,4E-05. This frequency includes all types of lifting failures for mobile units. It is also assumed that SIMOPS Onshore takes place once for every bunker operation. By assuming this we can apply the frequency directly as a per operation frequency. The assumption to assume SIMOPS every time is very conservative as current LNG bunkering guidelines advice against such operations while bunkering takes place.

Drift-off

Drift-off failures develop from mooring failure and loss of stability in vessels. This frequency can also be provided by ACDS (as for SIMOPS Offshore). The drift-off frequency is consequently 6,70E-07 for loading arm failure for larger transfers. This frequency will also be altered to fit the current study.

Overfilling, overpressure and Cool-down

Overfilling and overpressure in the tanks, can lead to failures in the rest of the process equipment. Rapid cool-down is a risk to the entire process equipment. These types of events are further divided into two initial events, which include instrumentation and/or system failure or operator error.

Control Failure in Instrumentation and Systems

Control failures in instrumentation and systems are divided into three types of failures. Frequency information on these instrumentations is gathered from OREDA, Offshore Reliability Data 5 th edition 2009, Volume 1 – Topside Equipment (pages 457, 479 and 497). The failure rates given are per hour of operation. There are 8 760 hours in a year, but bunkering only takes place a fraction of these hours.

• PLC (Programmable Logic Controller): 17,37E-06.
• LCV (Level Control Valve): 2,98E-06.
• Sensors: 3,53E-06.

These frequencies will be modified to account for frequency per bunkering operation.

Operator Error (Monitoring)

OGP – Risk Assessment Data Directory, Report No. 434-05 Human factors, in QRA table 2.7 is used to provide information on the “Human Errors”. Once proper training has been provided, monitoring of the operation for an operator is uncomplicated and repetitive. The receiving unit’s control room, where monitoring takes place, should be stress-free when in port. Based on these assumptions, the operator error for monitoring qualifies as human error type 2, with frequency 10E-04 per demand. This number is directly used as the operator error per transfer.

Connection Failures

For unplanned disconnection scenarios, connection failure is an additional event, which can take place. Connection failures can be divided between equipment failures and operator error. Both of these failures can be obtained from the ACDS and once again they will be modified to comply with bunkering time.

Equipment Failures

The frequency is combined from two initial sources and includes poor jointing or connection between the hose and pipework, and failures in the quick release connectors. A leak could occur at the flange face, resulting in an initial slow release with little impact at first, but later develop through erosion of the flange face material by the leaking fluid. The complete frequency for this failure is 6,88E-05.

Operator errors (Connections)

Prior to bunkering, the hose is connected to the vessel’s manifold. The connection is established manually by an operator, which could lead to connection errors for the hose. The ACDS provides a specific failure rate for connection failures by the operator, 6,10E-06, which will be used and modified according to bunkering time.

Transfer Hose Failure Frequency Overview

This table is a summary of the initial event frequencies that will be used in the fault tree calculations. The values presented represent failures per bunker operation, after having been modified as described for each specific failure event. The complete calculations for transfer hose (interface) failure frequency can be seen on table below:

When this information is added to the fault tree excel add-in, (shown on table here), these are the excel input values. The next table illustrates the calculations made and the model, the following results are produced:

Leak size distribution is another important feature to the analysis. For disconnection failures, 100 % of the total frequency is referred to as a large release or full bore rupture (FBR). In the case of damaged/ruptured failures, 70 % is a small leak, 25 % is a medium leak and the last 5 % are large leaks. The Dutch guideline for risk calculations, also known as HARI, is a source open to the public. It estimates that hose leakage leads to rupture in 10% of the cases when hoses are involved. This is however not including LNG transfer hoses with its advanced technologies. DNV GL practice in newer frequency analysis studies estimate that a 5 % rupture scenario for large leaks is sufficiently conservative.

Read also: Basic Information about Liquefied Natural Gas Bunkering Operations

The categorization of leak event into large (rupture), medium and small sizes is a judgment based on DNV’s estimates of the leak sizes typical for all hose failures, together with comparison against hole size distributions for typical process leaks.

Vapor return

The transfer system is equipped with a vapor return line. Source data provided and gathered does not cover the vapor return line explicitly. Vapor return line leaks are generally much less significant than for the LNG line itself. The same frequencies will be used for the vapor return line as for the LNG line for the various process sections. This means that we consider the same failure rates for vapor return line as LNG line. Vapor return line will be parallel to the LNG line for every process section including; discharging line, receiving line and transfer hose.

Process Equipment Failure Frequency

To calculate frequencies for the process equipment on either unit (except for tanks, see below Tanks Failure Frequency), LEAK software can be used. To obtain the correct frequencies the system needs to be analyzed and equipment needs to be counted, and grouped together. Piping and instrumentation diagram (P&ID) has been analyzed for bunkering scenarios and the following system table has been concluded as representative of a typical STS arrangement.

LEAK Assumption

The following operational assumptions form the basis of the process LEAK frequency analysis:

• The operating pressure is set to 10 bar (g) for the LNG line and 2 bar (g) for the vapor return line.
• The gas/liquid distribution ratio is 0/100 for the LNG line and 95/5 for the vapor return line.
• Pump and ESD (automated valve) is only present on the discharging side.
• Both sides have flow meter.
• The system boundaries exclude the nitrogen tanks and the equipment related to purging exclusively.
• “System Modification Factor” (a function in LEAK software) is applied, which allows for piping to be excluded as separate process equipment
• All components are considered to have LNG or NG presence at all times during the active bunkering hours.
• Category calculation basis is set to hole size (not release rate). Leak will be calculated for three sizes: small, medium and large (full bore rupture). See table below.
• Process time/activity level is set to two hours.

Hole sizes and format is based on industry standard.

Process equipment types are divided into two categories:

1. Diameter dependent: process pipes, flanges, manual and actuated valves.
2. Diameter independent: all other equipment e. g. pumps. For this category the leak sizes are quoted on an equipment size of 6 inches. Allowed, as leak frequencies remain the same for larger diameters.

Pipe line

A common aspect of uncertainty in QRA is associated with the frequency of inter-unit pipeline releases. Application of process pipework failure data will tend to give overly conservative values with respect to longer inter-unit pipe segments. The historical data for process piping from the HCRD is therefore not used for this part of the assessment. Instead, the normal practice is used, which is to apply a factor of 25 % to the overall release frequency to account for process piping contribution.

There is however evidence that the HCRD data gives much higher failure frequencies than what is expected based on historical evidence for LNG facilities. Given the perceived risks associated with LNG it is often the case that fully welded pipelines and connections are employed. This means that in a P&ID, all valves are not necessarily flanged. Based on the findings of the statistical analysis, the contribution from piping in the LNG facility is reduced to 10 % of that of process piping on a regular Oil & Gas offshore platform. Overall piping contribution to the release frequency is then 2,5 %. Topside process equipment contributes to 97,5 % of the release frequency and is not the same as inter-unit pipework. To account for topside process equipment, 100 % is divided by 97,5 %. The overall factor applied to the detailed part count to include the piping contribution is 1,026 (i. e. the increase is 2,6 %).

LEAK Scenarios

The HCRD data includes many leaks that have occurred at low system pressures. LEAK software is consequently set to separate between different types of leak pressures. Figure 5 displays the leak scenarios, their ratios and how they relate.

LEAK functions is set to calculate separate hole size frequencies for the tree types of leak scenarios:

• Total leak frequency (100 %).
• Full pressure leak frequency (94 %): assume a leak trough the defined hole, beginning at the normal operating pressure, until controlled by isolation and blow down, with a probability of isolation/blow down failure.
• Zero pressure leak frequency (6 %): this scenario includes all leaks where the pressure inside the leaking equipment is virtually zero (0,01 bar (g) or less).

Normally a quantitative risk assessment will assume that all leaks are full leaks because these have the potential of developing into serious events endangering personnel and critical safety functions. 68 However, in this study, the pressure in the system is set to 10 bar (g), which is quite high. Zero pressure leaks will therefore be included as it is reasonable that pressures can be lower than 10 bar (g).

The LEAK software is presently not capable of producing results for all the different leak pressures in one operation. The total leak frequencies produced will consequently have an error. Additionally the results will produce yearly averaged frequencies and not the per operation frequencies which this study requires. Certain parts of the LEAK frequency analysis have consequently been done manually.

1. Run leak with normal operating pressure to estimate full pressure leak frequencies. If limited leak (51 %) or full leak (49 %) is needed specifically the values can be obtained from taking the correct ratio from the full pressure leaks.
2. Change pressure to 0,01 bar (g) for the entire system and re-run the model, in order to get the leak frequency distribution for zero pressure leaks.
3. Add full pressure leak and zero pressure leak frequencies to yield the correct total leak frequencies.
4. LEAK generates averaged yearly frequencies. There are 8 760 hours in a year and a bunkering operation takes two hours. The frequencies are modified accordingly.

Process Equipment Failure Frequencies Overview

LEAK will produce large amounts of data for the different settings, such as:

• leak scenarios,
• hole sizes,
• process sections,
• segments and equipment.

In this study, total leaks (100 %) have been considered. All three-hole sizes have been considered in order to ascertain compatibility with outflow modeling in QRA. The relevant frequencies, for this study, in terms of process sections, are the ones where the main LNG line is split from the vapor return line, and the discharging and the receiving sides are separated from each other (see figure 6 and 7).

Figure 6 provides the initial results from LEAK with full and zero pressure leaks. In the next figure, the total leak has been calculated. First column is calculated as yearly average, while the second is per operation. The frequency cells marked with blue to the far right in figure 7, are the frequencies used for consequence modeling.

The below table “LEAK Frequency Distribution by Process Section”, includes information which will not directly be used in consequence modeling. It is however added to demonstrate the variation in failure frequency depending on process section, and how failure will vary between different hole size categories. Small leaks have a much higher likelihood of taking place than large leaks.

Tanks Failure Frequencies

The frequency for discharging and receiving tanks will be set as the collision frequency, because rupture in the tank is only dependent on collisions as a realistic option. The frequencies will therefore be the same as the SIMOPSs frequency for the hose. The bunker barge tank is in general more exposed compared to receiving tank that is usually integrated into the structure. It is assumed that collision only leads to tank damages 5 % of the time for discharging unit, and 1 % for the receiving unit. These assumptions are also based on ship size and structure. The LNG tanks are double hull, able to withstand relatively high impacts of outside force before rupture.

For SIMOPS Offshore the representative frequency is 2,30E-07, reduced with factor of 10 to be consistent with bunkering time of two hours and multiplied with the relevant probabilities of rupture due to collision.

• Discharging (5 %): 1,15E-09.
• Receiving (1 %): 2,30E-10.

When tanks rupture there are no method for stopping the leak, so in this scenario the whole static inventory will disperse and be lost. This means that there is no isolation time and no dynamic inventory for this risk scenario. The tanks will be considered full of LNG in the case of a rupture.

Consequence Modeling

In this section, output is generated which will provide input for concluding the necessary range of safety zones. This section will cover PHAST and PHASTRisk input values (i. e. constant and variable parameters), assumptions made and software working procedure.

Input data for PHAST includes frequency and inventory calculation. For calculation purposes, the data will be added in excel. The file is called “Consequence Modeling Calculations”.

The file is incorporated and its content includes:

• INPUTS: constant parameters, dimensions and weather data.
• FREQUENCIES: frequencies for the initial 13 LOC scenarios before split into the sub scenarios of ESD and ERC failures.
• TRANSFER HOSE: two tables; the first table includes input data (frequencies, isolation time and hole size), and the second table providing with PHAST outputs (release rate and duration) and complete inventory calculations.
• PROCESS EQUIPMENT: split between discharging and receiving line. Includes the same two tables as for transfer hose.
• TANKS: equal information as for transfer hose.

Frequency Limit

DNV internal guidelines for frequency calculations (G16 LNG guidelines) suggest not including scenarios with frequencies lower than 10^-8 . This is because these scenarios are too small to contribute to the 10^-6 contour.

All the frequencies identified on the “FREQUENCIES” page should be considered but when they undergo the final sub scenario distribution of ESD and ERC failure the frequencies drop considerably. The final scenario frequency considered in PHAST and PHASTRisk modeling will be included in the tables for “TRANSFER HOSE”, “PROCESS EQUIPMENT” and “TANKS” respectively.

Many of these are well below the limit (i. e. tank frequencies of 10^-11 and 10^-12) and could therefore have been excluded. Exclusion takes place in modeling as there is additional work to adding any risk scenario. All scenarios, regardless of low frequency, will be considered in this study to provide results for all process sections of the bunkering system. A total of 65 LOC scenarios are assessed.

Inventory

When it comes to the PHAST inputs, some values are identified and others, like the inventory, need to be calculated. The inventory is the total mass released [kg] in the event of any risk scenario. The inventory consists of static and dynamic inventory.

• Static inventory is the LNG/NG volume that a specific process section can hold. The volume depends on the dimensions of the hose, piping or tank within the defined process section.
• Dynamic inventory is what can be released if the system is not shut down immediately and LNG/NG is still “pushed” through the system. The volume size of the dynamic inventory also depends on dimensions, but it additionally depends on pump rate, pressure, time to stop (isolation time) etc.

For smaller leaks, the inventory is limited by the release rate during the time before ESD plus the content of the hose. For larger leaks, with a release rate higher than the pump flow, the inventory is assumed to be equal to 120 % of the pump flow (see discharge rate below) multiplied by the time to ESD plus the hose content.

Inventory Calculations

Static Inventory (SI):

Dynamic Inventory (DI):

Total inventory (TI):

$TI \left[kg\right]=SI \left[kg\right]+DI \left[kg\right]$

Release rate (RR) is a PHAST output. This means that DI and TI will not be fully calculated until the model has had a run through with SI data. RR is dependent on the hole size for damaged/ruptured scenarios, and is dependent on pump rate times the discharge rate for the leak in full bore rupture (FBR) scenario.

Discharge Rate

The pump discharge rate should be set between 120-150 % of the nominal pump flow, to account for the sudden pressure loss downstream and the subsequent reaction of a centrifugal pump upstream of the rupture. The lower value can be used if there is a single hose and the loading line is short and across level ground. The latter value is used, if there are several loading arms, the loading line is long and the tanks are elevated. In this base case, there is one hose and relatively short loading lines, and only a slight elevation in the process system. The most realistic and reasonable assumption is therefore estimated to be 120 %.

Assumptions for PHAST Modeling

• Parameters not mentioned are set at default value by the software, as used by DNV.
• Release type: constant rate.
• Release direction: horizontal.
• Dispersions parameter: spill will take place on water as surface.
• Pool vaporization: bund surface is water.
• Release height: 1 m above ground.
• Calculation parameters: flash fire vulnerability is set to 1, all other set to 0 (i. e. jet/pool/fire/explosion).
• Dispersion height measured as 0,5 m form the ground (see section PHAST results).

Raster Image – STS Bunker Configuration

The bunker arrangement and size that will be used for the “raster image” in PHAST will be based on the image provided on Ship to Ship Bunkering Operations of the Liquefied Natural Gasthis figure. Passing vessels and other vulnerable object will not be included in the image as these are site-specific details. The scope of this report has been to evaluate a generic LNG bunkering arrangement, and not to look at site-specific issues. Additionally, the main objective is to evaluate the risks for passengers on board during bunkering. This means that the relevant consequence contours for this report, relate to how much of the LNG fuelled vessel (receiving unit) is within the various risk criteria’s (i. e. 10^-6 per bunkering operation), and not surrounding elements.

Assumptions for PHASTRisk Modeling

• Wind rose is set to have equal distribution of winds in all directions.
• The software differentiates between day and night time operations, but for this study we will not differentiate between the two.
• The dispersions are measured at 0,5 m height from the ground.
• Exported (output) data considers: flammable dispersion, for LFL faction, at 0,5 m effect height and at maximum concentration.
• Modeling: To calculate the required outcome correctly, the flash fire vulnerability should be set to 1, and all other vulnerabilities to flammable effects should be set to 0 (jet/pool fire/ explosions etc.) The event tree is modified in such a way that delayed ignitions will only result in flash fires and not explosions.
• Ignition made is set to default.
• Ignition probability is set to 100%. This means that there will always be fire when there is a leak (highly conservative).

PHAST Working Procedure

A Build the system tree according to the scenarios defined in the excel sheets:

1. Folder for each process section and the event group scenarios.
2. Bottom events added as “vessel or pipe source”.

B Add the data for each source:

1. Material inputs: substance type (methane), temp value, pressure value and a temporary input for inventory (the correct values will be provided after the first simulation).
2. Scenario inputs: leak type, outdoor (in or out), phase is automatically generates based on temp an pressure, hole diameters (S, M, L).
3. Location inputs: set elevation height.

C Run the model.

D Access the results and gather release rates for all hole sizes, the LNG and vapor return line (total of six release rates):

1. Maximum release rate for large leaks needs to be modified to what is actually possible based on the inventory and discharge calculations, initial result from PHAST is not correct.
2. Based on this information the inventory calculations can be completed.

E Add completed inventory calculations results and correct release rates to the PHAST software.

F Re-run the model to produce correct dispersion values:

1. Maximum dispersion values for the main LNG line for 1/2 LFL at 0,5 m registration height can be seen on images below.

PHASTRisk Working Procedure

A The system tree now needs to be converted to PHASTRisk:

1. Make sure the data is transferred properly.
2. Add the respective frequencies to each scenario (part of the system tree inputs).

B Adding the image of the bunkering layout:

1. Set the scales, dimensions and origin (also known as failure points, dots on the raster image). This is where the process section failure case scenarios are rooted.
2. Register the coordinates for the different process sections: hose, discharging line, receiving line and tanks.

C Add weather information according to specification. Weather was discussed in article Ship to Ship Bunkering Operations of the Liquefied Natural GasWeather.

D Data/parameter changes:

1. Add metrological data (wind rose).
2. Set to flash fire.
3. Day/night time distribution.

E Run model to obtain contours.

Risk Evaluation

PHAST Results

PHAST produce results for maximum dispersion distances for all LOC scenarios. The results below are summarized distances for 1/2 LFL measured at 0,5 m above ground for the main LNG line. Complete list of distances can be seen on image below:

As defined in the assumptions, leak is set to take place 1 m above ground throughout the bunkering system. Dispersion distances are measured at 0,5 m above ground, as this is the height, which gave the largest dispersion lengths, compared to ground level and 1 m measurements. For small leaks, 1m above ground, LNG would evaporate due to heat transfer with air before it reached the ground, but it would not necessarily remain at a height of 1 m either, as an initial drop due to gravitational effects will be experienced before evaporation takes place.

Vapor Return Line

Vapor return line only account for 10 % of the released amounts in the LNG line in the same process section. The vapor return line has not been assessed in terms of its dispersion effects, and it could have been excluded from the study as a whole. It is however included in the overall risk picture, but not in terms of dispersion effects. The longest dispersion distance recorded for vapor return line was 32 m.

LNG Line

Transfer Hose

The main factor affecting dispersion is the size of the hole in the hose. The table below provides minimum and maximum dispersion distances for each size of hole. Further discussions on dispersion distances will be based on dispersion versus hole size distribution.

Factors that will be discussed include:

• Wind speed 2 m/s or 5 m/s.
• Pasquil stability: A (unstable), C (moderate) and E (stable).
• Isolation times: ESD works (fast), ESD fails with operator intervention (moderate) and ESD and operator failure (slow).

A hypothesis for gas dispersion is that for small leaks turbulent winds and high velocities, it can be beneficial to “eliminate” the gas cloud quickly. Then for larger leaks (FBR) the amounts could be so large and the density very high, such that winds only maximizes the dispersion distance. Wind will mix air and gas. Whether the mixture reaches LFL depends on the amount of gas released, the wind and the wind mixing action. Isolation time (i. e. release duration) is a key factor for release distances: the longer the release the larger the volume released.

The small hole size has a low release rate of 0,34 m³/s LNG at point of release. Under these conditions evaporated LNG (i. e. NG) will dilute quickly to below LFL levels due to dispersion effects. Weather type 5A result in the smallest dispersion distance. This is the highest wind speed and turbulence factor combined.

The following distances from low to high are:

• 5C,
• 5E,
• 2A,
• 2C and 2E.

This means that high wind speed and unstable conditions is the most effective in diluting the LNG concentrations for small sizes and that wind speed is the most important factor to stability. In terms of the failure modes, which provide different isolation times, this is irrelevant to the dispersion distance for small hole size.

Medium hole size has a release rate of 8,58 m³/s. The dispersion results for this hole size has less tendencies than for small. When wind speed is at 5 m/s, 5A is still the weather factor with the smallest distances, but in this case it is followed by 5E first and then 5C. This means that for these release amounts, unstable conditions are not having the same dilution effect.

The reason that the same dilution effects are not experienced, is possibly because the concentrations are too high to be diluted effectively, and that instability makes the dispersed area larger. For a wind speed of 2m/s, there are even less clear trends to what generates the long dispersion distances. The isolation time seem to have some influence on the results. “ESD works” provide better results than the two other failure modes, but there is not much difference between “operator intervention” and “complete failure” modes. In terms of wind stability, it is mixed, but stability factor A is overall providing short distances than C.

Large hole size has a considerably large release rate of 75 m³/s. This makes the results even more scattered depending on the various factors affecting dispersion. Isolation time is increasingly relevant and fast isolation response time produce the lower half of the dispersion results. When it comes to weather parameters there is no clear trends. The smallest distance is now 2A with “ESD works” failure mode.

The largest distance is 2C with ESD failure and operator intervention. Operator intervention does not give the longest isolation time. At first glance it is counter intuitive how this can be the highest when ESD and operator failure is much longer. To understand this result, the width of the spread also has to be considered. For moderate isolation time the distance is longer but narrower, for slow isolation time it is wider. Width is less of an issue in terms of dispersion and for defining zones, as the distances measured are considered as a radius and not as a distance in a specific direction. Large hole size gives the same results for both rupture and disconnection.

Process Equipment

Process equipment has the same hole sizes and release rates. Although there are more modeled scenarios for process equipment; discharging and receiving sides are equal and they both reflect the modeled scenarios for transfer hose rupture. This means that all hole size distributions are the same and is why the maximum release is the same in both cases as indicated in the first table in this section. The only reason why transfer hose has a higher average is because it involves more large leak scenarios, as it considers disconnection failures too.

The dispersion results coincide with parts of the hypothesis. Isolation time is relevant but only for larger hole sizes. Weather induced turbulence was important in dispersion of smaller leaks, but provided varying results for larger leaks.

Tanks

Tanks are not considered for isolation times but discussed in terms of weather parameters.
Sequence of dispersion lengths (low to high):

• 5A,
• 2A,
• 5C,
• 2C,
• 5E and 2E.

The dispersion distances are systematic with changes in weather. The released volume is the same in all scenarios, making weather the sensitivity to consider. Unstable weather and high wind speeds provide the shortest dispersion length of 266 m. This means that turbulent weathers is more beneficial in a large release scenario, as it dilutes LNG with air quicker to a concentrations below 2,5 % methane (1/2 LFL).

Security Zones

As discussed in section Ship to Ship Bunkering Operations of the Liquefied Natural GasNautical Activity, security zone can be established based on the dispersion results. When assessing the system for dispersion results vapor line is excluded as it produces only a small fraction of the main LNG line dispersion ranges. Additionally, tank rupture is considered very unlikely and safety zones have not been based on tank rupture up to now. Process equipment and transfer hose have equal maximum dispersion results.

Their averages differentiate, as transfer hose failures include additional cases of large leak failure scenarios through its disconnection failures. The average is most telling for the typical situations rather than considering the maximum, as it represents an extreme case with dispersion lengths more than twice the average. All scenarios have low likelihood of taking place and especially the large releases, which contribute to the longest dispersion distances.

In the port of Rotterdam STS, safety distances for passing ships (security zones) were calculated based on LFL dispersion distances (not 1/2 LFL). The STS case studied in this report had two bunker hoses and the leak scenario considered was simultaneous disconnection of both hoses.

The study concluded with assuming 235 m safety distance. The STS base case for this study has only one transfer hose, with this in mind the average dispersion distance results for transfers hose leakage would be a good security zone estimate. A definite security zone will not be expressed in this section as it would in either case require more location specific information, but hopefully this gives an understanding of the method and process.

LFL Results

ISO Guidelines for LNG bunkering requires that 1/2 LFL is used for risk assessment. Still, LFL results are enclosed to demonstrate the difference between considering LFL, which is the actual risk level, compared to 1/2 LFL, which is conservative.

PHASTRisk Results

PHASTRisk produce contour results through aggregation of risk (i.e. the flammable effects) on grid cells. The software produces 1/2 LFL distances (and LFL), exclusively based on leak taking place.

PHAST produced long dispersion distances. These results modeled with worst case scenarios would be considered in a deterministic approach for safety zones. In a probabilistic approach they are only considered for security zone purposes. Dispersion distances could provide severe consequences, but combined with the frequency, the risk is significantly reduced. PHASTRisk provides a complete risk picture overview by being able to combine frequency with consequences.

The data has been added and risk levels have been set to provide contours. Contours will be set from 10^-5 to 10^-11 , depending on relevance and contours provided. Risk contour results will be considered for nautical activity levels, LFL level, and process section.

Total Contour Results for 1/2 LFL

The figure below includes the total results for 1/2 LFL, produced by all the input parameters discussed in this study.

The immediate point of interest is that contour 10^-8 (yellow line) obtains a similar shape to the safety zone boundaries used today of “25 m distances from process equipment”. However, as is evident, there is no 10^-6 contour to be discussed. The 10^-7 contour (blue line) is exclusively within the bunkering process section on the receiving unit (ferry). The bunker barge will only have first party personnel involvement (operators). The water area within the contour should under no circumstances be occupied while bunkering is taking place, as advised and regulated by guidelines and standards for bunkering.

Increased Nautical Activity Contour Results

The traffic level is said to have great influence on risk levels. For process equipment, calculated in LEAK, varying specific types of initial failures is not possible as LEAK produces total failure frequency for a process component. In the frequency analysis, nautical activity is described as the SIMOPS Offshore failure frequency, and it is used for hose failure frequency and tanks. The initial SIMOPS Offshore frequency considered was 2,30E-08. This is the frequency provided by ACDS data and therefore the only frequency used today if site-specific information is not considered in detail. For tanks, the frequency accounted for was even lower considering the likelihood that a collision would lead to additional failures.

The SIMOPS Offshore failure frequency for the transfer hose can be altered to be more significant by multiplying the frequency by a factor of 100 (100 times as many collisions will occur per operation than what is currently assumed). The resulting frequency was 2,30E-06. Introducing this as part of the hose failure frequency produced the following contour results.

Overall the differences between the two levels of nautical activity produced small differences to the contours and either way the levels are well within the limits of 10^-6 per bunkering operation.

LFL Contour Results

Although 1/2 LFL is considered the correct level for evaluating degree of dispersion, LFL was also tested for low nautical activity. Figure 10 shows the results obtained.

As expected, the contour ranges are slightly reduced, and the 10^-8 contour is now well within the 25 m zone of the critical process equipment (i. e. where the transfer hose and most of the process piping is situated).

Process Section Contour Results

The following images provide contour results for leak from one process section at the time. They are all based on the parameters defined (i. e. regular nautical activity and 1/2 LFL).

Transfer Hose

The industry has often expressed the hose as the most hazardous process section of the LNG process system. This belief seems to agree with the results (see figure 11).

Luckily the industry has made attempts towards hose improvements, and from recent tests it is proved that the critical process equipment related to the bunkering process section on either side, will experiences problems well before any hose damage or rupture.

It should be kept in mind that the hose is the only equipment analyzed with different tools and calculations than the rest of the process equipment. It could hence be argued that the analysis has been overly conservative. As this is the process section of the analysis, with the greatest amounts of assumptions required, it proves that the study has not undermined the effects of the hose (which was the aim, to be realistic but conservative).

Process Equipment

Tanks

For the tanks, the risk level had to be set to 10^-11 as no other risk level would give contour results.

According to QRA methods, low frequencies (<10^-8) could have been excluded from consequence modeling. If they had been excluded, tanks would not have provided any contour results.

Technology Advancements

System specifics in this study have been conservative and especially when considering that technical advancements will take place in the future. Frequencies used today are based on historical data, which of course also reflects failures in earlier versions of the equipment.

Several studies characterize the hose or loading arm as the critical process section in bunkering processes. Naturally, as it is the interface between the two units and it is very exposed compared to the rest of the process equipment. The perceived fears for the bunker hose has caused the industry to focus their efforts on making the most endurable hoses with specific qualities such as strength and flexibility, and the ability to withstand cryogenic temperatures. The structure, material and design chosen are today so advanced that the industry considers the hoses extremely reliable.

One of the main strengths of the hose is ERC (breakaway coupling). ERC is so effective, and the hose structure is so much stronger, to the extent that any tension will result in ERC activation rather than rupture. ERC would have to fail, which is actually yet to be seen. A triggered ERC in any event is a “safe” reaction.

To demonstrate the high level of security of a cryogenic transfer hose, Gasnor reports on site experiences using cryogenic transfer hoses has been included.

Gasnor Experiences

Hose failure in flexible loading and unloading hoses

In the period from May 2003 to December 2010, approximately 42 000 loading, unloading and bunkering operations have been carried out without detection or indication of any hose failures. Hose rupture is often the dimensioning case when accounting for risk assessments related to the location of LNG terminals and in relation to licenses to carry out loading and unloading operations with LNG.

On the basis of this Gasnor AS has completed a review of these types of operations. Some of the results are presented here:

• No hose failure recorded.
• No drip leaks detected.
• Minor gas leaks/“sweating” from snake recorded. (Total five cases, mainly between onshore facilities and vessels).
• Leaks from the couplings are registered:
  • Production Error: spray leak from the hole in the coupling.
  • Drip leakage due to contraction when cooling takes place. By retighten the connection the leak stopped.
  • Leakage in the breakaway coupling (twice).

Operation and maintenance programmes includes daily inspections of the hose and
transmission preparations (purging and inerting). In the study period, Gasnor has replaced approximately 20 hoses due to sweating. Additionally some hoses have been replaced due to visual wear and tear, without any indication of leak.

The report concluded with:

“Review shows there is not registered any hose failure due to normal operation. Nor revealed situations where a hose rupture have been imminent. Inspection, maintenance and choice of high quality hoses will continue to be important to prevent hose failure in the future”.

Conclusion

The environmental and economical advantages of using LNG as a marine fuel are already recognized. The industry has responded and are now preparing for fuel conversion, with the ferry market as the biggest consumer. High risks are assumed when it comes to vulnerable objects (third parties in the vicinity of the operation) during bunkering. Ferries have thus far been instructed not to allow passenger presence during bunkering. The functionality and strengths of LNG are quickly reduced and this restriction in particular is proving problematic for ferry companies, which have passengers onboard at all times.

In response to the perceived risks associated with LNG bunkering operations, this study has focused on outlining the risks, and quantifying them to provide a detailed risk picture. The purpose of this study was to create probabilistic safety distances for LNG bunkering. The justification in doing this was to evaluate the level of safety for passengers onboard LNG fueled vessels during bunkering. The evaluation has been based on achieving the accepted ISO standard requirement of a probability of flammable gas outside the safety zone being less than 10^-6 per bunkering operation as a criterion.

Based on the results provided by PHASTRisk in article Risk Evaluation, it clearly demonstrates that passenger safety can be maintained during bunkering operations. The results of this study conclude that there is no unreasonable risk associated with allowing passenger presence during bunkering. Passenger safety issues should as such not limit the application of LNG as fuel for ferries. The areas onboard withed vessels are at the most inside a 10^-8 risk level. This is the lowest level of risk considered by any industry. The only expense and concern of the industry at this moment should consequently be on economically establishing sustainable infrastructure for small-scale bunkering.

The assessment made here is generic, and even though it could be adjusted for individual bunkering cases, it is not expected that significant variations in risk contours will be experienced from typical system variations to this base case. The variations in results have more scope for site-specific issues like weather and traffic density in the port area. Weather cannot be controlled, but should be evaluated before choosing a specific bunkering location. Based on the PHAST dispersion results, unstable weather and high winds resulted in shorter distances for all hole sizes. The remaining element left to consider is nautical activity and the SIMOPS failures high activity introduce. There are several zones that can be established to control the risk of this category, which means that if exclusion zones or security zones are properly defined then safety zones for passengers will not be an issue.

Treatment of Residual Risk

For studies of risk there is large number of sensitivities that can be analyzed, and further studies should be made. This study has focused on the sensitivities, which are believed to have a significant effect with respect to calculations of the safety zone. This includes weather sensitivities, hole size distributions and some variations in the SIMOPS Offshore frequency to account for varying nautical activity.

As discussed, risks associated with LNG bunkering can be divided into risks inherent to the process equipment (system specific) and risks specific to the bunkering location (site-specific). The site-specific sensitivities can have an affect on the risk level prior, such as port traffic and some have an effect when an accident involving a leak has taken place, like weather. Weather sensitivities are considered in the study and to some extent port traffic, but any safety zone implemented needs to be carefully evaluated against specific site details.

LNG bunkering systems can have some variations in design, but the basic principles will for practical purposes be the same. Several of the process parameters and functions are set by the physics of LNG and the guidelines and standards. The system specific solutions that were not analyzed for sensitivity in this study were set to be the most conservative to avoid underestimating the risk. In this study a single loading hose was assumed, instead of two or three that could be used in shore to ship applications. The reason for this is that one loading hose is more relevant for the costal applications that have been the main focus of this study.

Regulatory requirements limit extensive system variations, and set a number of standard that must be met even before the security zone comes into question. If regulatory requirements are followed this would mean that risk contours would not be larger than the presented even if there were changes to the system or operating parameters. Following, is a discussion on sensitivities that could be considered in future risk assessments for LNG bunkering.

Operating Conditions

In this study, constant cargo temperature was assumed for both the main LNG line and the vapor return line. This means that the discharging unit (the bunker barge) has to deliver the same cargo temperatures for every operation. Realistically, this is not the case, and cargo temperatures are expected to vary between -140 to -162 °C on arrival to the bunkering site.

Temperature variations could also lead to variations in density and pressure, which will have an effect on the transfer operation and how the varying density will influence the development of the gas leak. Sensitivity analysis on varying temperatures could have been performed, but was considered outside the scope of this study. This study has chosen the temperature assumption that is the most conservative, which are the coldest temperatures and consequently the highest density. This makes the evaporation slowest in the situation of an LNG release.

Constant pressure throughout the piping system is not a reality during bunkering operations, as the flowing system will see the pressure drop through its equipment and pipe configurations. Pressure changes and pressure variations could have been calculated using Bernoulli. This would have required more specific data on the system such as; process equipment, specific lengths of pipes, piping configurations, etc., with the associated friction factors within the pipes and hoses. Including this in the calculations would have made the model more advanced. The highest allowed pressure was assumed in all parts of the system for the purpose of determining probabilistic safety zones. It would have given lower calculated consequences of a leak than the outcome of this study and the recommendations made.

Another DNV report did study the effect of pressure variations, and this was the concluding remark:

“When staying in a reasonable range of pressure around the base case, the operating pressure has little influence on the final result. The variation of operating pressure has a greater impact at low pressure (i. e. 1-2 bar (g)), than for higher pressures. Lower pressures usually result in shorter safety distances, except for large leak in windy weather conditions.”

Hose Dimensions

Transfer hoses are produced with varying dimensions, and both length and diameter could have been analyzed as sensitivity. Another DNV study looked at the effect of varying dimensions. Overall it proved that hose length had little effect, while hose diameter was significant in the case of full bore rupture. The variation in hose length mainly impacts the static inventory that would be released as a consequence of a hose rupture.

Emergency Release Couplers

In this report we assumed that the hoses would be equipped with breakaway couplings (or ERC). This is recommended and seems already to have become a standard practice in the industry. Breakaway couplings will ensure that the weak point of the hose is at the coupling. The cryogenic transfer hose has a breaking strength, which will exceed the strength of the breakaway coupling leading to activation of the emergency function of the breakaway coupling. When activated, the breakaway coupling will close in less than a second by the mechanical closing system (valve).

The quick closure significantly reduces any released volumes. Based on bunkering guidelines and recommendation from authorities, which stress the use of ERC, it has been assumed that this is present and the use is best practice, but nevertheless sensitivities could also have been performed.

Isolation Times

Isolation times depend on the system used and there can be many variations. The values chosen in the study are conservative as there are many studies operating with shorter isolation times. One such example is the Skangas report on LNG bunkering in Risavika, Stavanger, which shows that ESD reaction time is considered to be 90 seconds; 60 seconds for detection and reaction, and 30 seconds to close it down.

In this study it was decided to use the longer (more conservative) closing times published in technical guidelines. The effects of reduced isolation times would probably be similar to the results this study prescribes, and for smaller leaks isolation time is practically irrelevant, but for larger leaks it is a great contributing factor. The Skangas report concluded that the contour lines and safety zones are increasingly reduced with shorter closing times.

Release Parameters

Rate, direction and height of release are all factors that can and should be analyzed in further studies. Height and direction can both give substantial differences in the formation of a liquid pool. Especially for small and medium hole sizes this could affect the difference of instant evaporation versus pool formation and prolonged evaporation. The release rate depends on pump flow rates, and will naturally have a large effect on the released amount. Nevertheless, since the value chosen in this study was based on maximum rates advised by authorities, the resulting safety zone should not have become any larger.

Probability of Fire

The probability of flammable effect was set to 100 % probability, to correlate with current QRA practice in the industry. This assumption does not represent real life events, as ignition sources are limited. The effect of varying flammable probabilities could have been an interesting assessment, as the likelihood is considered very low.