(December 23, 2004) -- The U.S. Department of Energy (DOE) has released an unclassified version of a report prepared by the Sandia National Laboratory under contract to DOE: Guidance on Risk Analysis and Safety Implications of a Large Liquefied Natural Gas (LNG) Spill Over Water.

LBReport.com posts a link to the document in pdf form, below.

Among several caveats, the report acknowledges that for some events -- like "intentional" LNG releases (i.e. terrorism) -- real-world data on actual experienced consequences are (to date) lacking...and advises relying on computer models and other projections for "risk analysis" and public safety purposes.

"Currently, the potential for an intentional LNG cargo tank breach, the dynamics and dispersion of a large spill, and the hazards of such a spill, are not fully understood," the report says.

It adds that "for an intentional event, existing experimental data on LNG spill dynamics, dispersion, and burning over water cover spill volumes that are more than two orders of magnitude less than the spill volumes being postulated in many recent studies. This lack of information forces analysts to make many assumptions and simplifications when calculating the size, dispersion, and thermal hazards of a spill."

It advises, "Where analysis reveals that potential impacts on public safety and property could be high and where interactions with terrain or structures can occur, modern, validated computational fluid dynamics (CFD) models can be used to improve analysis of site-specific hazards, consequences, and risks."

The report also says that specific sites require further "site specific" studies.

The report lists its key conclusions as:

Currently, the potential for an intentional LNG cargo tank breach, the dynamics and dispersion of a large spill, and the hazards of such a spill, are not fully understood, for two primary reasons. First, the combination of LNG ship designs and current safety management practices for LNG transportation have reduced LNG accidents, so that there is little historical or empirical information on large breaches or spills...Second, for an intentional event, existing experimental data on LNG spill dynamics, dispersion, and burning over water cover spill volumes that are more than two orders of magnitude less than the spill volumes being postulated in many recent studies.

This lack of information forces analysts to make many assumptions and simplifications when calculating the size, dispersion, and thermal hazards of a spill. This section summarizes the modeling and analyses conducted to assess the potential for an intentional LNG breach and the associated hazards to public safety and property from a resulting spill...

...[A]vailable intelligence and historical data were also used to establish a range of potential intentional LNG cargo tank breaches that could be considered credible and possible. This included evaluation of information on insider and hijacking attacks on ships, and external attacks on ships. Again, the level of knowledge, materials, and planning needed to create intentional breaching events was evaluated. Based on this evaluation, explosive shock physics modeling and analysis were used to perform scoping calculations of potential breach sizes for a range of intentional attacks...

While a discussion of the specific threats and expected consequences is inappropriate for this report, it is appropriate to discuss the range of breaches that were calculated for a wide range of intentional events. A summary of the modeling and analysis efforts developed and conducted to calculate the potential breaches from various intentional scenarios is presented in an associated Classified report [Hightower 2004].

A computational shock physics code, CTH, and material data were used to calculate expected breach sizes for several different intentional scenarios. CTH is a Eulerian finite volume code and is required to estimate and analyze the large-scale deformations and material responses under very high strain rates that might be developed due to high velocity penetration or explosion scenarios.

Based on the scoping analyses for LNG tanker designs, the range of hole sizes calculated from most intentional breaches of an LNG cargo tank is between 2 - 12 m². Our analysis suggests that, in most cases, an intentional breaching scenario would not result in a nominal tank breach of more than 5 - 7 m². This range is a more appropriate value to use in calculating potential hazards from spills. Based on the threat it is possible to breach more than one LNG cargo tank during an event.

For both LNG tanker designs, a breach could occur in LNG cargo tanks either above or below the water line. The location impacts the amount of LNG spilled onto the water surface and the amount of LNG that might be spilled into the internal ballast areas between the hulls and vacant hold areas. LNG spilled between the hulls could negatively impact the structural integrity of the tanker or the cargo tanks. Table 13 identifies the level of ship damage from each of the breaching events indicated.

[table omitted]

The intentional breaches and spills shown above include several different events, including a range of potential attacks and insider threats. The large breach sizes calculated, while smaller than commonly assumed in many studies, still provide the potential for large LNG spills.

Based on the ranges identified in this study, a nominal breach size of 5 - 7 m² was considered. Spill prevention or mitigation techniques should be considered where the consequences or hazards from such breach sizes are most severe.

Table 13 shows that, for many intentional breaching events, the cryogenic damage to the LNG vessel could be minor to moderate, or even severe. Severe structural damage could occur from some of the very large spills caused by intentional breaches. This result is because the volume and rate of the LNG spilled could significantly impact the ship’s structural steel. A cascading failure that involves damage to adjacent cryogenic tanks on the ship from the initial damage to one of the LNG cargo tanks is a possibility that cannot be ruled out.

Determination of the potential or likelihood of such an event depends on the breach scenario, the spill location, and any implementation of prevention and mitigation strategies to prevent such an event. In areas where cascading failures might be a significant issue, the use of complex, coupled, thermal, fluid and structural analyses should be considered to improve the analysis of the potential for and extent of structural damage to the LNG ship and other LNG cargo tanks.

...Evaluation of the Fire Hazard of an Intentional LNG Spill

In order to determine the general range of hazard levels and to provide a demonstration of how hazard zones can be delineated...

[I]n most of the scenarios identified, the thermal hazards from an intentional spill are expected to manifest as a pool fire, based on the high probability that an ignition source will be available from most of the events identified. Based on a detailed review of the existing experimental literature presented in Appendix C, nominal fire modeling parameters were used to calculate the expected thermal hazards from a fire for the intentional breach scenarios developed...

The results... show that the thermal hazards of 37.5 kW/m² are expected to occur within approximately 500 m of the spill for most of the scenarios evaluated. For the 2 m² three-hole breach, it was assumed that individual pools would form; whereas, for the 5 m² three-hole breach, a single pool was assumed to form. The release from the three holes was considered to happen simultaneously. It should be noted that these conditions consider cascading damage resulting from fire or cryogenic-induced failure.

Most of the studies reviewed assume that a single, coherent pool fire can be maintained for very large pool diameters. This would be unlikely due to the inability of air to reach the interior of a fire and maintain combustion on an LNG pool that size. Instead, the flame pool envelope would break up into multiple pool fires (herein: ‘flamelets’), the heights of which are much less than the fuel bed diameter used in the calculations by the four previously discussed studies. This breakup into flamelets results in a much shorter flame height than that assumed for a large pool diameter. In reality, L/D (height/pool diameter) would probably be much smaller than that assumed by the correlations in many studies, which predict an L/D ratio between 1.0 and 2.0. A more realistic ratio could be less than 1.0 [Zukoski 1986] [Corlett 1974] [Cox 1985].

Because the heat radiated by the flamelets would be far less than the heat radiation calculated in the many studies (based on a large pool fire), the amount of radiative heat flux that an adjacent object receives would be less, thereby decreasing the size of the thermal hazard zone. As discussed in Appendix D, the use of a mass fire assumption could reduce hazard distances for large spills. The development of fire whirls might increase the hazard zone. Therefore, this type of pool fire model should be carefully considered to improve thermal hazards analysis from potential large spills.

The results presented suggest that the potential thermal hazards for large spills can vary significantly, based on the uncertainty associated with potential spill sizes, dispersion variations, and threats. Based on the estimated pool size for large spills, even with the possibility of reduction in effects for mass fires as opposed to single pool fires, high thermal hazards approaching 37.5 kW/m² could probably extend to approximately 500 meters. The thermal hazards between 500 meters and 1600 meters decrease significantly. The hazards would be low, approximately 5 kW/m² beyond 1600 m from even a large spill. Based on these observations, approximate hazard zones seem to exist between 0 - 500 m, 500 - 1600 m, and over 1600 m, and were used to develop guidance on managing risks for LNG spills.

...Evaluation of Vapor Dispersion Hazard of Intentional LNG Spills

In most of the scenarios identified, the thermal hazards from a spill are expected to manifest as a pool fire, based on the high probability that an ignition source will be available from most of the events identified. In some instances, such as an intentional spill without a tank breach, an immediate ignition source might not be available and the spilled LNG could, therefore, disperse as a vapor cloud. For large spills, the vapor cloud could extend to more than 1600 m, depending on spill location and site atmospheric conditions. In congested or highly populated areas, an ignition source would be likely, as opposed to remote areas, in which an ignition source might be less likely.

As mentioned in Section 4, the impact from a vapor cloud dispersion and ignition from a large spill can extend beyond 1600 meters, based on our review of external data discussed in Appendix C. This suggests that LNG vapor dispersion analysis should be conducted using site-specific atmospheric conditions, location topography, and ship operations to assess adequately the potential areas and levels of hazards to public safety and property.

Consideration of risk mitigation measures, such as development of procedures to quickly ignite a dispersion cloud and stem the leak, if conditions exist that the cloud would impact critical areas.

If ignited close to the spill, and early in the spill, the thermal loading from the vapor cloud ignition might not be significantly different from a pool fire, because the ignited vapor cloud would burn back to the source of liquid LNG and transition into a pool fire. If a large vapor cloud formed, the flame could propagate downwind, as well as back to the source.

If the cloud is ignited at a significant distance from the spill, the thermal hazard zones can be extended significantly. The thermal radiation from the ignition of a vapor cloud can be very high within the ignited cloud and, therefore, particularly hazardous to people...

In order to obtain LNG dispersion distances to LFL for intentional events, calculations were performed using VULCAN...A low wind speed and highly stable atmospheric condition were chosen because this state has shown to result in the greatest distances to LFL from experiment, and thus should be the most conservative...As indicated in Table 15, the dispersion distance to LFL for intentional events might extend from nominally 2500 m to a conservative maximum distance of 3500 m for this unlikely event.

While previous studies have addressed the vapor dispersion issue from a consequence standpoint only, the risk analysis performed as part of this study indicates that the potential for a large vapor dispersion from an intentional breach is highly unlikely. This is due to the high probability that an ignition source will be available for many of the initiating events identified, and because certain risk reduction techniques can be applied to prevent or mitigate the initiating events identified. The significant distances, though, of a potential vapor dispersion suggest that LNG vapor dispersion analysis and risk mitigation measures should be carefully considered to protect adequately both the public and property.

Table 15: Dispersion Distances to LFL for Intentional Spills

The analyses from the fire and vapor dispersion calculations suggest that high thermal hazards from intentional events extend significantly from the spill location. [See Table 16 in pdf document].

RISK REDUCTION STRATEGIES

A customized, risk management approach is necessary because every LNG site has unique features. Performance-based safety requirements are often used in instances where there is a lack of good information on operational consequences or hazards. In many cases, safety information does exist and, based on available data, prescriptive safety requirements described by codes, standards, or other regulations are often developed and recommended.

For combined safety and security applications, where threats can change or grow rapidly, performance-based regulations and strategies can often provide the flexibility needed to respond to the evolving security and safety needs.

To obtain the most complete picture of the potential consequences in a given breach scenario, a target-mechanism-consequence model is suggested. The target is the vulnerable element on which some mechanism acts to produce an undesired consequence. For example, a private residence (target) on a nearby shore can be ignited by radiant energy from a burning LNG spill (mechanism) that might lead to loss of property (consequence)...

...Risk Management Strategies: Prevention and Mitigation

Many factors can impact risks to public safety and property from an LNG spill: design, materials selection, manufacturing methods, inspection and testing, assembly techniques, worker training, and safety operations, among others. For example, two ship design features that can impact risk are hull type (single vs. double) and hull material (steel vs. a more exotic material). Other significant factors include terminal location and design, port handling elements (e.g., tugboats and firefighting equipment), communications systems, and emergency response capabilities.

It is important to realize that a decision involving large capital expense can have long-lasting effects (e.g., LNG terminal site selection). For this reason, it is imperative to consider carefully all risk management decisions in order that residual or future risks can be managed to an acceptable level.

In general, risk can be managed by prevention or mitigation. Prevention seeks to avoid an accident or attack; mitigation reduces the effects of an accident or attack...

While the prevention and mitigation strategies identified in the table are possible, many might not be cost-effective or even practical in certain locations or applications. Risk management should be based on developing or combining approaches that can be effectively and efficiently implemented to reduce hazards to acceptable levels in a cost-effective manner.

This type of approach has been in use and is in use by the LNG industry, the Coast Guard, and public safety organizations to ensure the safety of the transportation of LNG. These efforts include a number of design, construction, safety equipment, and operational efforts to reduce the potential for an LNG spill...

Because of the safety and security challenges posed by transporting millions of gallons of LNG, vessels typically undergo a more frequent and rigorous examination process than conventional crude oil or product tankers. LNG vessels are boarded by marine safety personnel prior to U.S. port entry to verify the proper operation of key navigation, safety, fire fighting, and cargo control systems.

LNG vessels are subject to additional security measures. Many of the security precautions for LNG vessels are derived from analysis of "conventional" navigation safety risks, such as groundings, collisions, propulsion, and steering system failures. These precautions pre-date the events of September 11, 2001, and include such items as traffic control measures for special vessels that are implemented when an LNG vessel is transiting or approaching a port and security zones around the vessel to prevent other vessels from approaching it. Also included are escorts by Coast Guard patrol craft and, as local conditions warrant, coordination with other Federal, State and local transportation, law enforcement and/or emergency management agencies to reduce the risks to, or reduce the interference from, other port area infrastructures or activities. All such measures are conducted under the authority of existing port safety and security statutes, such as the Magnuson Act (50 U.S.C. 191 et. seq.) and the Ports and Waterways Safety Act.

Since September 11, 2001, additional security measures have been implemented, including the requirement that all vessels calling in the U.S. must provide the Coast Guard with a 96- hour advance notice of arrival (increased from 24 hours advance notice, pre-9/11). This notice includes information on the vessel's last ports of call, crew identities, and cargo information. Based on vessel-specific information, the Coast Guard conducts at-sea boardings, in which Coast Guard personnel conduct special "security sweeps" of the vessel and ensure that "positive control" of the vessel is maintained throughout its port transit.

This is in addition to the safety-oriented boardings previously described. One of the most important post-9/11 maritime security developments has been the passage of the Maritime Transportation Security Act of 2002 (MTSA). Under the authority of MTSA, the Coast Guard has developed new security measures applicable to vessels, marine facilities, and maritime personnel. The domestic maritime security regime is closely aligned with the International Ship and Port Facility Security (ISPS) Code. Under the ISPS Code, vessels in international service, including LNG vessels, must have an International Ship Security Certificate (ISSC). To be issued an ISSC, the vessel must develop and implement a threatscalable security plan that establishes access control measures, security measures for cargo handling and delivery of ships stores, surveillance and monitoring, security communications, security incident procedures, and training and drill requirements. The plan must also identify a Ship Security Officer who is responsible for ensuring compliance with the ship's security plan.

For an LNG terminal, regulations developed under the authority of the Ports and Waterways Safety Act assign to the Coast Guard the responsibility for safety issues within the "marine transfer area" of LNG terminals. The "marine transfer area" is defined as that part of a waterfront facility between the vessel, or where the vessel moors, and the first shutoff valve on the pipeline immediately before the receiving tanks. Safety issues within the marine transfer area include electrical power systems, lighting, communications, transfer hoses and piping systems, gas detection systems and alarms, firefighting equipment, and operations such as approval of the terminal's Operations and Emergency Manuals and personnel training.

New maritime security regulations have been recently developed for terminal facilities. These regulations require the LNG terminal operator to conduct a facility security assessment and develop a threat-scalable security plan that addresses the risks identified in the assessment. Much like the requirements prescribed for vessels, the facility security plan establishes access control measures, security measures for cargo handling and delivery of supplies, surveillance and monitoring, security communications, security incident procedures, and training and drill requirements...

Ramming

Ramming could occur between an LNG tanker and a fixed object or between a boat and an LNG tanker. As noted in Appendix B, unless the LNG tanker speed is above 5 – 7 knots or the object is very sharp, ramming of the LNG tanker into an object will not likely penetrate both hulls and the LNG cargo tank. Likewise, if the LNG tanker is rammed by a small boat, such as a pleasure craft, the kinetic energy is insufficient to penetrate the inner hull of a double-hulled LNG ship.

Therefore, while ramming does not appear to be a major concern or present significant hazards, changes in some safety and security operations could reduce the chances of a ramming event. For example, requiring tug escorts for LNG ships in high consequence areas would reduce the potential for an insider to ram intentionally an LNG vessel into a critical infrastructure element. Another option would be to ensure that crewmembers have been properly evaluated and the ship interdicted and searched sufficiently in advance of entry into the U.S. to thwart a hijacking attempt or insider sabotage. These efforts reduce the ability of an adversary to pick the time, place, and target for a ramming event and reduce the risk from a potential ramming scenario.

Triggered Explosion

Triggered explosion events assume pre-placed explosives, either on the ship or in a fixed location. At some sites, sweeping of the waterway, harbor bottom, and terminal areas for explosives or mines might be required. This is especially true for high hazard areas, shallow waterways, or terminals where explosives might be hidden. To prevent sabotage of an LNG cargo tank through a triggered explosive on board a ship, the same type of early interdiction, searches, and control of the ship discussed in the ramming prevention scenario could be applicable.

Insider Takeover or Hijacking A number of security measures, including armed security control aboard the ship and early interdiction and inspection of the ship prior to its entry into the U.S., could prevent many of the large breaching scenarios identified in Sections 4 and 5. This could significantly reduce hazards levels and enable spill mitigation measures available to emergency response organizations to be used effectively.

A ship hijacking should be considered credible through coordinated efforts by insiders or others. The threat could proceed with the breach and spill of an LNG cargo tank through use of planted or smuggled explosives or by overriding offloading system safety interlocks to discharge LNG intentionally onto the ship, onto unloading terminal equipment, or onto the water. While a number of operational procedures have been implemented to help prevent this type of potential scenario, control and surveillance of an LNG ship must be appropriately maintained to ensure adequate time to respond to a potential hijacking event.

External Terrorist Actions

External terrorist attacks could come from a number of avenues, including attack of the LNG ship with a wide range of munitions or bulk explosives. A U.S.S Cole-type attack is often suggested as a potential attack scenario, as well as attacks with munitions such as rocketpropelled grenades, or missiles or attacks by planes. Depending on the size of the weapon or explosive charge and the location of the attack, the potential breach and LNG spill will vary.

Common approaches to prevent or mitigate these events are to make structures more resistant to attacks or to increase the standoff distance between the initiation of explosives and the ship. While security zones are presently used effectively for safety considerations at most of the LNG import locations in the U.S., a security halo for an LNG ship would have to be much smaller and effectively maintained to develop the security zones needed to prevent some of these events. Such measures could prevent a potential attacker from approaching close enough to cause severe damage to an LNG vessel. This security zone might require different escort ships and escort procedures, improved overhead and subsurface surveillance, enhanced training, or enhanced security response procedures.

...Recommended Focus for Risk Prevention

The threats considered and the safety and security measures employed to address them must be based on site-specific and location-specific conditions. The level of risk prevention or mitigation required will depend on the site and its location relative to major population areas and critical infrastructures. In all cases, the risk reduction strategies identified should be considered from a cost-effectiveness viewpoint; i.e. reducing risks to acceptable levels in the most cost-effective manner possible for a given site and location.

To guide risk management efforts and reduce impact on operations, Sandia recommends defining threat-scalable safety and security measures, and then tying safety and security related operations to these levels, which is the approach taken by the Department of Homeland Security for its threat advisory system. In this way, for each threat condition, protection and operations changes can be implemented in order to maintain the level of risk to public health and safety at acceptable levels.

Although the Department of Homeland Security defines threat levels, this might or might not be appropriate for an LNG transport system. As a minimum, Sandia suggests three levels -- normal, off normal, and emergency. Unlike Homeland, whose sole focus is security, LNG would extend this formalism both to security and to safety.

Generally, the safety efforts currently in place for LNG transportation over water have been very effective in preventing accidents and appear to be adequate. At some locations, however, security efforts required to prevent intentional breaching events might have to be increased in order to reduce the risks to public health and safety. Since 9/11, current safety and security efforts have been increased and are continuing to evolve to meet the challenges of ever changing security threats...

Before implementation of specific safety or security measures is contemplated at a site, a baseline risk analysis should be conducted, a minimum acceptable risk estimated, and vulnerabilities and hazards evaluated. After the initial risk analysis has been completed, prevention and mitigation measures or strategies can then be considered and evaluated. These can then be compared to assess if they provide the enhancements required to reduce the risks of an LNG spill to acceptable levels for a site.

...Application of the Risk Management Process

So far, in this section we have discussed risk reduction for areas or activities within the larger system that includes the LNG tanker, the waterways it travels, and neighboring infrastructures. We used the risk management guidance and safety information developed in this report to assess ways to enhance operations and reduce the potential risks to the public. Hopefully, this will provide the reader with suggestions on how to consider various issues, including terminal location and site conditions, operational conditions, environmental effects, and safety and security concerns and measures. To be feasible, such a process must be effective from a surety standpoint, affordable, possible to implement in a timely fashion, minimize environmental impact, and be otherwise amenable to regulators and stakeholders.

We are not intending to suggest a "cookbook" methodology for selecting new sites; however, we want the reader to understand what type of issues should be considered and what various measures should be applied to try to achieve appropriate levels of protection of public safety and property for LNG imports.

Applying the Risk Management Process to LNG Imports

Risk management of an LNG import facility should be viewed as a system that includes the LNG tanker, the import terminal facilities and location, the navigational path, and the nearest neighbors along the navigational path and at the import terminal. Four classes of attributes affect the overall risks. These include:

• The context of the import facility -- location, site specific conditions, LNG import, importance to the region;

• Potential targets and threats -- potential accidental events, credible intentional events, and ship or infrastructure targets;

• Risk management goals -- identification of levels of consequences to be avoided, such as injuries and property damage, LNG supply reliability required; and

• Protection system capabilities -- LNG tanker safety and security measures, LNG import operations safety and security measures, and early warning and emergency response/recovery measures.

In the risk management process shown in Figure 3, the four attributes discussed are then evaluated to determine if the protection system in place can effectively meet the risk management goals identified for a specific import terminal site and operations. If so, then the safety and security measures and operations developed for the LNG import operations are adequate. Import operations should be reviewed on a regular basis to assess whether changes in context, targets or threats, risk management goals or risk management systems have changed such that a reassessment of risks is needed.

If the initial risk assessment determines that the identified risk management goals are not being met, then potential modifications in location and site conditions, import operations, safety and security measures, emergency response and early warning measures should be assessed to determine effective improvements in the overall risk management system Below, we provide a summary of the elements that should be considered for LNG import facility applications for each step of the risk management process identified in Figure 3 of this report.

These steps provide a context of how the safety analysis and risk guidance provided in this report can be used to evaluate options to protect property and public health and safety associated with LNG import terminals and operations.

Step One - Characterize Assets

In this step, the context of the LNG facility such as location, site-specific conditions, and nominal operations should be identified and developed. Information that should be collected and considered includes:

• Type and Proximity of Neighbors (Sections 3.3, 4.2, and 5.1)
• Distance to residential, commercial, and industrial facilities or other critical infrastructures such as bridges or tunnels, and
• Transit -- Near or in major ship channel or remote from channel

• Environmental Conditions (Sections 3.2 and 3.3)
• Wind-driven Spill Movement & Dispersion -- prevailing wind direction, speed, and variability,
• Severe Weather Considerations -- hurricanes, storm surges,
• Tidal-driven Spill Movement & Dispersion -- height, current, and influence on spill movement and dispersion,
• Seismic issues - ground displacement, soil liquefaction, and
• Temperature issues -- ice, thermal impediment to operations

• Nominal Operational Conditions (Sections 2.1, 2.2, and 3.3)
• LNG tanker size and design,
• Expected frequency of shipments,
• Importance of LNG Shipments -- Available storage, seasonal demands, percentage of regional or local supply, and
• Transit -- additional traffic (near other large ships, pleasure boats) and distance to it; transit near critical infrastructures, such as other terminals, commercial areas, or residential areas; number of critical facilities along transit; distance to critical facilities along transit.

Step Two -- Identify Potential Threats (Sections 4.1 and 5.1)

In this step, the potential or likely threats expected for the facility, based on site location and relative attractiveness of either an LNG tanker or other nearby targets, should be identified.

Accidental Event Considerations -- shipping patterns, frequency of other large ships, major objects or abutments to be avoided, warning systems, weather impacts on waterways or operations,

Intentional Event Considerations -- threat levels identified by Homeland Security, identified threats, past threats and shipping attacks, difficulty of attack scenarios for a given site, and

Attractiveness of Targets -- impact of LNG tanker attack, impact on facilities near navigational route, impact on other facilities near site not associated with LNG operations.

Step Three - Determine Risk Management Goals and Consequence Levels (Section 6.1)

Identify risk management goals or consequence levels for LNG operations, including potential property damage and public safety (including injury limits). Setting of the goals and levels would be conducted in cooperation with stakeholders, public officials, and public safety officials. Consideration should be given to evaluating a range of potential risk management goals and consequence levels. In this way, an assessment of the range of potential costs, complexity, and needs for different risk management options can be compared and contrasted. Common risk management goals and consequence level considerations should include:

Allowable duration of a loss of service, ease of recovery,

Economic impact of a loss of service,

Damage to property and capital losses from a spill and loss of service, and

Impact on public safety from a spill -- potential injuries, deaths.

Step Four - Define Safeguards and Risk Management System Elements (Section 6.2)

This step includes identifying all of the potential safety and security elements and operations available on the LNG tanker, at the terminal, or in transit. They include not only safety features but also safety and security-related operations and emergency response and recovery capabilities. These include:

Operational Prevention and Mitigation Considerations

LNG tanker safety/security features,

Proximity and availability of emergency support -- escorts, emergency response, fire, medical and law enforcement capabilities,

Early warning systems,

Ship interdiction and inspection operations and security forces, and

Ability to interrupt operations in adverse conditions -- weather, wind, waves.

Protective Design

Design for storm surges, blasts, thermal loading,

Security measures -- fences, surveillance, exclusion areas,

Effective standoff from residential, commercial, or other critical infrastructures based on recommended hazard distances from an LNG spill over water, and

Redundant offloading capabilities.

Step Five - Analyze System and Assess Risks (Sections 3.3, 4.2, and 5.1)

In this step, the defined risk management goals and consequence levels should be compared to the existing system safeguards and protective measures. This effort would include evaluation of each element of the event tree identified in Figure 4 for a potential spill that might occur for the site-specific conditions, threats, and calculated hazard distances and hazard levels.

If the system safeguards in place provide protection of public safety and property that meet risk management goals, then the overall risks of an LNG spill would be considered compatible with public safety and property goals. The risk management process should be updated regularly to assess whether changes in threats or threat levels, operations, LNG tanker design, or protective measures have occurred that would impact the ability of the system safeguards to meet identified or improved public health and safety goals.

Step Six -- Assess Risk Prevention and Mitigation Techniques (Sections 6.2 and 6.3)

If the potential hazard distances and hazard levels calculated exceed the consequence levels and risk management goals for the LNG terminal and import operations, then the enhanced risk mitigation and prevention strategies identified in Table 20 should be considered. While many of the options listed would be possible for a given site, developing approaches or combinations of approaches should be considered that can be effectively and efficiently implemented and that provide the level of protection, safety, and security identified for the LNG operations at each site.

...RISK ASSESSMENT OF LNG SPILLS OVER WATER

High consequence operations such as the transportation, off-loading, and storage of LNG imply potential risks to people and property. Risk is defined as the potential for suffering harm or loss and is often quantified as the product of the probability of occurrence of a threatening event times the system vulnerability to that event and the consequences of that event. Thus,

Risk = Pt (threat occurring) x Ps (system failure/threat) x Consequences;
Where: Pt = the probability of an accidental or intentional threat,
Ps = the probability that preventive or mitigating measures fail, and
Consequences = usually expressed in fatalities or costs.

Effectively evaluating the risks of a large LNG spill over water requires that the potential hazards (results of events that are harmful to the public and/or property) and consequences be considered in conjunction with the probability of an event, plus the effectiveness of physical and operational measures of LNG transportation to prevent or mitigate a threatening event. For example, safety equipment, operational considerations and requirements, and risk management planning can work together to reduce the risks of an LNG spill by reducing both the probability of an event that could breach the LNG tanker and by reducing the consequences of a spill.

Because of the difficulty in assessing the effectiveness of ship safety measures and operational safety and security strategies, many studies assume the probability of an event and a ship’s vulnerability to be one; therefore, the concentration is on calculating expected consequences. This often provides worst-case results with low probability and very high uncertainty, which can inappropriately drive operational decisions and system designs.

Therefore, for high consequence and low probability events, a performance-based approach is often used for developing risk management strategies that will reduce the hazards and risks to both public safety and property.

3.1 Risk Analysis Elements of a Potential LNG Spill

The risk analysis approach of a potential LNG spill should include:

...Uncertainty: Assessment of the accuracy of the assumptions used and the probable ranges.

...Comprehensiveness: Do the failure modes considered account for all major avenues of loss? Understanding the full range of consequences associated with a catastrophe can require considerable effort. Completeness is important to properly support risk assessment and risk management.

Two important variables are ‘directness of effect’ and ‘latency.’ For example, if an explosion breaches an LNG cargo tank on a ship, that is a direct effect. Conversely, if a resulting explosion damages an LNG terminal—hampering future LNG deliveries for extended periods -- that is an indirect or latent effect. Latency refers to when the effects are felt. Immediate effects occur simultaneously with the threat; whereas latent effects occur after an interval, the length of which might vary from system to system. It should be emphasized that indirect/latent effects sometimes dominate other consequences.

...Evaluation of risk reduction measures: One way to reduce risk is to remove or block the threat; i.e., prevent the disaster from occurring in the first place. For example, reinforce ships against collisions or reduce ship speeds in a harbor to reduce the chance of a spill.

...Threat as a moving target: Many avenues to failure -- mechanical, environmental insult, operator error -- are amenable to analysis and can be confidently predicted to occur with some probability in the future. Other types of threats can be constantly changing and difficult to assess accurately, requiring more robust approaches for prevention or mitigation and frequent re-evaluations of new threats.

Deciding on the sufficiency of protection measures to meet risk management goals is often aided by a benefit-cost evaluation. In most locations and most operations, some level of risk is common and, therefore, a "residual" risk often remains. For example, certain levels of safety equipment are standard features in automobiles, such as seat belts, air bags, and antilock brakes. While they might be effective safety measures, they do not provide total protection in all automobile accident scenarios. Therefore, the public does have some level of risk associated with driving.

While many potential safeguards might be identified for a given location, the level of risk reduction and risk management required to be protective of public safety and property for LNG transportation will vary based on site-specific conditions. The risk management goals for a given location should be determined in cooperation with all stakeholders. Stakeholders include the general public, public safety officials and elected officials, facility operators, port and transportation safety and security officials, underwriters, utility representatives, regulatory agencies, and ship management companies.

The Department of Energy (DOE) today released the results of a comprehensive, year-long study of Liquefied Natural Gas (LNG) safety and security that was conducted by scientists at the Sandia National Laboratory. The Sandia study indicates that we can continue to transport LNG safely, as long as we continue to implement appropriate safety and security measures.

The Sandia study is significant to the advancement of technical knowledge because it is the only risk-based study of LNG that exists. The study is also considered important because it emphasizes the need to use risk analysis as part of the facility siting process and because it provides solutions for safely and securely managing the risks of shipping LNG, a clean energy source the nation needs to meet our increasing energy demand.

Sandia's study is a significant and valuable addition to the understanding of LNG safety and security issues, as well as the risk mitigation measures appropriate for protecting LNG cargoes over water and the population centers located nearby. The report will no doubt prove a valuable tool for the LNG industry, for Federal, State, and local government regulators, as well as for the general public as they deliberate on the future siting of LNG facilities needed to meet America's increasing demand for natural gas.