We Post Sandia Lab/U.S. DOE Report Guidance on Risk Analysis and Safety Implications of a Large Liquefied Natural Gas (LNG) Spill Over Water
Return To Front Page
Report's Methodology Includes Caveats
(December 23, 2004) -- The U.S. Department of Energy (DOE) has released an unclassified version of a report prepared by the Sandia National Laboratory under contract to DOE: Guidance on Risk Analysis and Safety Implications of a Large Liquefied Natural Gas (LNG) Spill Over Water.
LBReport.com posts a link to the document in pdf form, below.
Among several caveats, the report acknowledges that for some events -- like "intentional" LNG releases (i.e. terrorism) -- real-world data on actual experienced consequences are (to date) lacking...and advises relying on computer models and other projections for "risk analysis" and public safety purposes.
"Currently, the potential for an intentional LNG cargo tank breach, the dynamics and dispersion of a large spill, and the hazards of such a spill, are not fully understood," the report says.
It adds that "for an intentional event, existing experimental data on LNG spill dynamics, dispersion, and burning over water cover spill volumes that are more than two orders of magnitude less than the spill volumes being postulated in many recent studies. This lack of information forces analysts to make many assumptions and simplifications when calculating the size, dispersion, and thermal hazards of a spill."
It advises, "Where analysis reveals that potential impacts on public safety and property could be high and where interactions with terrain or structures can occur, modern, validated computational fluid dynamics (CFD) models can be used to improve analysis of site-specific hazards, consequences, and risks."
The report also says that specific sites require further "site specific" studies.
The report lists its key conclusions as:
1. The system-level, risk-based guidance developed in this report, though general in nature
(non site-specific), can be applied as a baseline process for evaluating LNG operations
where there is the potential for LNG spills over water.
2. A review of four recent LNG studies showed a broad range of results, due to variations in models, approaches, and assumptions. The four studies are not consistent and focus only on
consequences rather than both risks and consequences. While consequence studies are
important, they should be used to support comprehensive, risk-based management and
planning approaches for identifying, preventing, and mitigating hazards to public safety and
property from potential LNG spills.
3. Risks from accidental LNG spills, such as from collisions and groundings, are small and
manageable with current safety policies and practices.
4. Risks from intentional events, such as terrorist acts, can be significantly reduced with
appropriate security, planning, prevention, and mitigation.
5. This report includes a general analysis for a range of intentional attacks. The consequences from an intentional breach can be more severe than those from accidental breaches. Multiple techniques exist to enhance LNG spill safety and security management and to reduce the potential of a large LNG spill due to intentional threats. If effectively
implemented, these techniques could significantly reduce the potential for an intentional
6. Management approaches to reduce risks to public safety and property from LNG spills
include operation and safety management, improved modeling and analysis, improvements
in ship and security system inspections, establishment and maintenance of safety zones , and
advances in future LNG off-loading technologies. If effectively implemented, these
elements could reduce significantly the potential risks from an LNG spill.
7. Risk identification and risk management processes should be conducted in cooperation with appropriate stakeholders, including public safety officials and elected public officials.
Considerations should include site-specific conditions, available intelligence, threat
assessments, safety and security operations, and available resources.
8. While there are limitations in existing data and current modeling capabilities for analyzing LNG spills over water, existing tools, if applied as identified in the guidance sections of this report, can be used to identify and mitigate hazards to protect both public safety and property. Factors that should be considered in applying appropriate models to a specific problem include: model documentation and support, assumptions and limitations,
comparison with data, change control and upgrade information, user support, appropriate
modeling of the physics of a spill, modeling of the influence of environmental conditions,
spill and fire dynamics, and peer review of models used for various applications. As more
LNG spill testing data are obtained and modeling capabilities are improved, those
advancements can be incorporated into future risk analyses.
9. Where analysis reveals that potential impacts on public safety and property could be high and where interactions with terrain or structures can occur, modern, validated computational fluid dynamics (CFD) models can be used to improve analysis of site-specific hazards, consequences, and risks.
10. LNG cargo tank hole sizes for most credible threats range from two to twelve square meters; expected sizes for intentional threats are nominally five square meters.
11. The most significant impacts to public safety and property exist within approximately 500 m of a spill, due to thermal hazards from fires, with lower public health and safety impacts at distances beyond approximately 1600 m.
12. Large, unignited LNG vapor releases are unlikely. If they do not ignite, vapor clouds could spread over distances greater than 1600 m from a spill. For nominal accidental spills, the resulting hazard ranges could extend up to 1700 m. For a nominal intentional spill, the
hazard range could extend to 2500 m. The actual hazard distances will depend on breach
and spill size, site-specific conditions, and environmental conditions.
13. Cascading damage (multiple cargo tank failures) due to brittle fracture from exposure to cryogenic liquid or fire-induced damage to foam insulation was considered. Such releases
were evaluated and, while possible under certain conditions, are not likely to involve more
than two or three cargo tanks for any single incident. Cascading events were analyzed and
are not expected to greatly increase (not more than 20%-30%) the overall fire size or hazard
ranges noted in Conclusion 11 above, but will increase the expected fire duration.
The Sandia report says four other recent LNG studies (which showed a broad range of results) used differing methodologies and focused "only won consequences rather than both risks and consequences. While consequence studies are important, they should be used to support comprehensive, risk-based management and planning approaches for identifying, preventing, and mitigating hazards to public safety and property from potential LNG spills."
To view the entire unclassified version of the Sandia report in pdf form, click Guidance on Risk Analysis and Safety Implications of a Large Liquefied Natural Gas (LNG) Spill Over Water, Dec. 2004. [Tip: To save download time, right click on the link and save the document to an appropriate file.]
In terms of international LNG spills -- like terrorism -- the report says in pertinent part:
Currently, the potential for an intentional LNG cargo tank breach, the dynamics and dispersion of a large spill, and the hazards of such a spill, are not fully understood, for two primary reasons. First, the combination of LNG ship designs and current safety management practices for LNG transportation have reduced LNG accidents, so that there is little historical or empirical information on large breaches or spills...Second, for an intentional event, existing experimental data on LNG spill dynamics, dispersion, and burning over water cover spill volumes that are more than two orders of magnitude less than the spill volumes being postulated in many recent studies.
This lack of information forces analysts to make many assumptions and simplifications when
calculating the size, dispersion, and thermal hazards of a spill. This section summarizes the
modeling and analyses conducted to assess the potential for an intentional LNG breach and
the associated hazards to public safety and property from a resulting spill...
...[A]vailable intelligence and historical data were also used to establish a range
of potential intentional LNG cargo tank breaches that could be considered credible and
possible. This included evaluation of information on insider and hijacking attacks on ships,
and external attacks on ships. Again, the level of knowledge, materials, and planning needed
to create intentional breaching events was evaluated. Based on this evaluation, explosive
shock physics modeling and analysis were used to perform scoping calculations of potential
breach sizes for a range of intentional attacks...
While a discussion of the specific threats and expected consequences is inappropriate for this report, it is appropriate to discuss the range of breaches that were calculated for a wide range of intentional events. A summary of the modeling and analysis efforts developed and
conducted to calculate the potential breaches from various intentional scenarios is presented
in an associated Classified report [Hightower 2004].
A computational shock physics code, CTH, and material data were used to calculate expected
breach sizes for several different intentional scenarios. CTH is a Eulerian finite volume code
and is required to estimate and analyze the large-scale deformations and material responses
under very high strain rates that might be developed due to high velocity penetration or
Based on the scoping analyses for LNG tanker designs, the range of hole sizes calculated
from most intentional breaches of an LNG cargo tank is between 2 - 12 m2. Our analysis suggests that, in most cases, an intentional breaching scenario would not result in a nominal tank breach of more than 5 - 7 m2. This range is a more appropriate value to use in calculating potential hazards from spills. Based on the threat it is possible to breach more than one LNG cargo tank during an event.
For both LNG tanker designs, a breach could occur in LNG cargo tanks either above or
below the water line. The location impacts the amount of LNG spilled onto the water surface
and the amount of LNG that might be spilled into the internal ballast areas between the hulls
and vacant hold areas. LNG spilled between the hulls could negatively impact the structural
integrity of the tanker or the cargo tanks. Table 13 identifies the level of ship damage from
each of the breaching events indicated.
The intentional breaches and spills shown above include several different events, including a range of potential attacks and insider threats. The large breach sizes calculated, while smaller than commonly assumed in many studies, still provide the potential for large LNG spills.
Based on the ranges identified in this study, a nominal breach size of 5 - 7 m2 was considered. Spill prevention or mitigation techniques should be considered where the
consequences or hazards from such breach sizes are most severe.
Table 13 shows that, for many intentional breaching events, the cryogenic damage to the
LNG vessel could be minor to moderate, or even severe. Severe structural damage could
occur from some of the very large spills caused by intentional breaches. This result is
because the volume and rate of the LNG spilled could significantly impact the ship’s
structural steel. A cascading failure that involves damage to adjacent cryogenic tanks on the
ship from the initial damage to one of the LNG cargo tanks is a possibility that cannot be
Determination of the potential or likelihood of such an event depends on the breach scenario, the spill location, and any implementation of prevention and mitigation strategies to prevent such an event. In areas where cascading failures might be a significant issue, the use of complex, coupled, thermal, fluid and structural analyses should be considered to improve the analysis of the potential for and extent of structural damage to the LNG ship and other LNG cargo tanks.
...Evaluation of the Fire Hazard of an Intentional LNG Spill
In order to determine the general range of hazard levels and to provide a demonstration of
how hazard zones can be delineated...
[I]n most of the scenarios identified, the thermal hazards from an intentional spill are expected to manifest as a pool fire, based on the high probability that an ignition source will be available from most of the events identified. Based on a detailed
review of the existing experimental literature presented in Appendix C, nominal fire
modeling parameters were used to calculate the expected thermal hazards from a fire for the
intentional breach scenarios developed...
The results... show that the thermal hazards of 37.5 kW/m2 are expected
to occur within approximately 500 m of the spill for most of the scenarios evaluated. For the
2 m2 three-hole breach, it was assumed that individual pools would form; whereas, for the 5 m2 three-hole breach, a single pool was assumed to form. The release from the three holes was considered to happen simultaneously. It should be noted that these conditions consider cascading damage resulting from fire or cryogenic-induced failure.
Most of the studies reviewed assume that a single, coherent pool fire can be maintained for
very large pool diameters. This would be unlikely due to the inability of air to reach the
interior of a fire and maintain combustion on an LNG pool that size. Instead, the flame pool
envelope would break up into multiple pool fires (herein: ‘flamelets’), the heights of which
are much less than the fuel bed diameter used in the calculations by the four previously
discussed studies. This breakup into flamelets results in a much shorter flame height than
that assumed for a large pool diameter. In reality, L/D (height/pool diameter) would
probably be much smaller than that assumed by the correlations in many studies, which
predict an L/D ratio between 1.0 and 2.0. A more realistic ratio could be less than 1.0
[Zukoski 1986] [Corlett 1974] [Cox 1985].
Because the heat radiated by the flamelets would be far less than the heat radiation calculated in the many studies (based on a large pool fire), the amount of radiative heat flux that an adjacent object receives would be less, thereby decreasing the size of the thermal hazard zone. As discussed in Appendix D, the use of a mass fire assumption could reduce hazard
distances for large spills. The development of fire whirls might increase the hazard zone.
Therefore, this type of pool fire model should be carefully considered to improve thermal
hazards analysis from potential large spills.
The results presented suggest that the potential thermal hazards for large spills can vary
significantly, based on the uncertainty associated with potential spill sizes, dispersion
variations, and threats. Based on the estimated pool size for large spills, even with the
possibility of reduction in effects for mass fires as opposed to single pool fires, high thermal hazards approaching 37.5 kW/m2 could probably extend to approximately 500 meters. The thermal hazards between 500 meters and 1600 meters decrease significantly. The hazards would be low, approximately 5 kW/m2 beyond 1600 m from even a large spill. Based on these observations, approximate hazard zones seem to exist between 0 - 500 m, 500 - 1600 m, and over 1600 m, and were used to develop guidance on managing risks for LNG spills.
...Evaluation of Vapor Dispersion Hazard of Intentional LNG Spills
In most of the scenarios identified, the thermal hazards from a spill are expected to manifest as a pool fire, based on the high probability that an ignition source will be available from most of the events identified. In some instances, such as an intentional spill without a tank breach, an immediate ignition source might not be available and the spilled LNG could, therefore, disperse as a vapor cloud. For large spills, the vapor cloud could extend to more than 1600 m, depending on spill location and site atmospheric conditions. In congested or
highly populated areas, an ignition source would be likely, as opposed to remote areas, in
which an ignition source might be less likely.
As mentioned in Section 4, the impact from a vapor cloud dispersion and ignition from a
large spill can extend beyond 1600 meters, based on our review of external data discussed in
Appendix C. This suggests that LNG vapor dispersion analysis should be conducted using
site-specific atmospheric conditions, location topography, and ship operations to assess
adequately the potential areas and levels of hazards to public safety and property.
Consideration of risk mitigation measures, such as development of procedures to quickly
ignite a dispersion cloud and stem the leak, if conditions exist that the cloud would impact
If ignited close to the spill, and early in the spill, the thermal loading from the vapor cloud ignition might not be significantly different from a pool fire, because the ignited vapor cloud would burn back to the source of liquid LNG and transition into a pool fire. If a large vapor cloud formed, the flame could propagate downwind, as well as back to the source.
If the cloud is ignited at a significant distance from the spill, the thermal hazard zones can be extended significantly. The thermal radiation from the ignition of a vapor cloud can be very high within the ignited cloud and, therefore, particularly hazardous to people...
In order to obtain LNG dispersion distances to LFL for intentional events, calculations were performed using VULCAN...A low wind speed and highly stable
atmospheric condition were chosen because this state has shown to result in the greatest
distances to LFL from experiment, and thus should be the most conservative...As indicated in Table 15, the dispersion distance to LFL for intentional events might extend from nominally 2500 m to a conservative maximum distance of 3500 m for this unlikely event.
While previous studies have addressed the vapor dispersion issue from a consequence
standpoint only, the risk analysis performed as part of this study indicates that the potential for a large vapor dispersion from an intentional breach is highly unlikely. This is due to the high probability that an ignition source will be available for many of the initiating events identified, and because certain risk reduction techniques can be applied to prevent or mitigate the initiating events identified. The significant distances, though, of a potential vapor dispersion suggest that LNG vapor dispersion analysis and risk mitigation measures should be carefully considered to protect adequately both the public and property.
Table 15: Dispersion Distances to LFL for Intentional Spills
The analyses from the fire and vapor dispersion calculations suggest that high thermal
hazards from intentional events extend significantly from the spill location. [See Table 16 in pdf document].
RISK REDUCTION STRATEGIES
A customized, risk management approach is necessary because every LNG site has unique
features. Performance-based safety requirements are often used in instances where there is a
lack of good information on operational consequences or hazards. In many cases, safety
information does exist and, based on available data, prescriptive safety requirements
described by codes, standards, or other regulations are often developed and recommended.
For combined safety and security applications, where threats can change or grow rapidly,
performance-based regulations and strategies can often provide the flexibility needed to
respond to the evolving security and safety needs.
To obtain the most complete picture of the potential consequences in a given breach scenario, a target-mechanism-consequence model is suggested. The target is the vulnerable element on which some mechanism acts to produce an undesired consequence. For example, a private residence (target) on a nearby shore can be ignited by radiant energy from a burning LNG spill (mechanism) that might lead to loss of property (consequence)...
...Risk Management Strategies: Prevention and Mitigation
Many factors can impact risks to public safety and property from an LNG spill: design,
materials selection, manufacturing methods, inspection and testing, assembly techniques,
worker training, and safety operations, among others. For example, two ship design features
that can impact risk are hull type (single vs. double) and hull material (steel vs. a more exotic material). Other significant factors include terminal location and design, port handling elements (e.g., tugboats and firefighting equipment), communications systems, and
emergency response capabilities.
It is important to realize that a decision involving large capital expense can have long-lasting effects (e.g., LNG terminal site selection). For this reason, it is imperative to consider carefully all risk management decisions in order that residual or future risks can be managed to an acceptable level.
In general, risk can be managed by prevention or mitigation. Prevention seeks to avoid an
accident or attack; mitigation reduces the effects of an accident or attack...
While the prevention and mitigation strategies identified in the table are possible, many
might not be cost-effective or even practical in certain locations or applications. Risk
management should be based on developing or combining approaches that can be effectively
and efficiently implemented to reduce hazards to acceptable levels in a cost-effective manner.
This type of approach has been in use and is in use by the LNG industry, the Coast Guard,
and public safety organizations to ensure the safety of the transportation of LNG. These
efforts include a number of design, construction, safety equipment, and operational efforts to
reduce the potential for an LNG spill...
Because of the safety and security challenges posed by transporting millions of gallons of
LNG, vessels typically undergo a more frequent and rigorous examination process than
conventional crude oil or product tankers. LNG vessels are boarded by marine safety
personnel prior to U.S. port entry to verify the proper operation of key navigation, safety, fire fighting, and cargo control systems.
LNG vessels are subject to additional security measures. Many of the security precautions
for LNG vessels are derived from analysis of "conventional" navigation safety risks, such as
groundings, collisions, propulsion, and steering system failures. These precautions pre-date
the events of September 11, 2001, and include such items as traffic control measures for
special vessels that are implemented when an LNG vessel is transiting or approaching a port
and security zones around the vessel to prevent other vessels from approaching it. Also
included are escorts by Coast Guard patrol craft and, as local conditions warrant,
coordination with other Federal, State and local transportation, law enforcement and/or
emergency management agencies to reduce the risks to, or reduce the interference from, other
port area infrastructures or activities. All such measures are conducted under the authority of existing port safety and security statutes, such as the Magnuson Act (50 U.S.C. 191 et. seq.) and the Ports and Waterways Safety Act.
Since September 11, 2001, additional security measures have been implemented, including
the requirement that all vessels calling in the U.S. must provide the Coast Guard with a 96-
hour advance notice of arrival (increased from 24 hours advance notice, pre-9/11). This
notice includes information on the vessel's last ports of call, crew identities, and cargo
information. Based on vessel-specific information, the Coast Guard conducts at-sea
boardings, in which Coast Guard personnel conduct special "security sweeps" of the vessel
and ensure that "positive control" of the vessel is maintained throughout its port transit.
This is in addition to the safety-oriented boardings previously described.
One of the most important post-9/11 maritime security developments has been the passage of
the Maritime Transportation Security Act of 2002 (MTSA). Under the authority of MTSA,
the Coast Guard has developed new security measures applicable to vessels, marine facilities,
and maritime personnel. The domestic maritime security regime is closely aligned with the
International Ship and Port Facility Security (ISPS) Code. Under the ISPS Code, vessels in
international service, including LNG vessels, must have an International Ship Security
Certificate (ISSC). To be issued an ISSC, the vessel must develop and implement a threatscalable security plan that establishes access control measures, security measures for cargo handling and delivery of ships stores, surveillance and monitoring, security communications, security incident procedures, and training and drill requirements. The plan must also identify a Ship Security Officer who is responsible for ensuring compliance with the ship's security plan.
For an LNG terminal, regulations developed under the authority of the Ports and Waterways
Safety Act assign to the Coast Guard the responsibility for safety issues within the "marine
transfer area" of LNG terminals. The "marine transfer area" is defined as that part of a
waterfront facility between the vessel, or where the vessel moors, and the first shutoff valve
on the pipeline immediately before the receiving tanks. Safety issues within the marine
transfer area include electrical power systems, lighting, communications, transfer hoses and
piping systems, gas detection systems and alarms, firefighting equipment, and operations
such as approval of the terminal's Operations and Emergency Manuals and personnel
New maritime security regulations have been recently developed for terminal facilities.
These regulations require the LNG terminal operator to conduct a facility security assessment
and develop a threat-scalable security plan that addresses the risks identified in the
assessment. Much like the requirements prescribed for vessels, the facility security plan
establishes access control measures, security measures for cargo handling and delivery of
supplies, surveillance and monitoring, security communications, security incident procedures,
and training and drill requirements...
Ramming could occur between an LNG tanker and a fixed object or between a boat and an
LNG tanker. As noted in Appendix B, unless the LNG tanker speed is above 5 – 7 knots or
the object is very sharp, ramming of the LNG tanker into an object will not likely penetrate
both hulls and the LNG cargo tank. Likewise, if the LNG tanker is rammed by a small boat,
such as a pleasure craft, the kinetic energy is insufficient to penetrate the inner hull of a
double-hulled LNG ship.
Therefore, while ramming does not appear to be a major concern or present significant
hazards, changes in some safety and security operations could reduce the chances of a
ramming event. For example, requiring tug escorts for LNG ships in high consequence areas
would reduce the potential for an insider to ram intentionally an LNG vessel into a critical
infrastructure element. Another option would be to ensure that crewmembers have been
properly evaluated and the ship interdicted and searched sufficiently in advance of entry into
the U.S. to thwart a hijacking attempt or insider sabotage. These efforts reduce the ability of an adversary to pick the time, place, and target for a ramming event and reduce the risk from a potential ramming scenario.
Triggered explosion events assume pre-placed explosives, either on the ship or in a fixed
location. At some sites, sweeping of the waterway, harbor bottom, and terminal areas for
explosives or mines might be required. This is especially true for high hazard areas, shallow
waterways, or terminals where explosives might be hidden. To prevent sabotage of an LNG
cargo tank through a triggered explosive on board a ship, the same type of early interdiction,
searches, and control of the ship discussed in the ramming prevention scenario could be
Insider Takeover or Hijacking
A number of security measures, including armed security control aboard the ship and early
interdiction and inspection of the ship prior to its entry into the U.S., could prevent many of the large breaching scenarios identified in Sections 4 and 5. This could significantly reduce hazards levels and enable spill mitigation measures available to emergency response
organizations to be used effectively.
A ship hijacking should be considered credible through coordinated efforts by insiders or
others. The threat could proceed with the breach and spill of an LNG cargo tank through use
of planted or smuggled explosives or by overriding offloading system safety interlocks to
discharge LNG intentionally onto the ship, onto unloading terminal equipment, or onto the
water. While a number of operational procedures have been implemented to help prevent
this type of potential scenario, control and surveillance of an LNG ship must be appropriately
maintained to ensure adequate time to respond to a potential hijacking event.
External Terrorist Actions
External terrorist attacks could come from a number of avenues, including attack of the LNG
ship with a wide range of munitions or bulk explosives. A U.S.S Cole-type attack is often
suggested as a potential attack scenario, as well as attacks with munitions such as rocketpropelled grenades, or missiles or attacks by planes. Depending on the size of the weapon or explosive charge and the location of the attack, the potential breach and LNG spill will vary.
Common approaches to prevent or mitigate these events are to make structures more resistant
to attacks or to increase the standoff distance between the initiation of explosives and the
ship. While security zones are presently used effectively for safety considerations at most of
the LNG import locations in the U.S., a security halo for an LNG ship would have to be
much smaller and effectively maintained to develop the security zones needed to prevent
some of these events. Such measures could prevent a potential attacker from approaching
close enough to cause severe damage to an LNG vessel. This security zone might require
different escort ships and escort procedures, improved overhead and subsurface surveillance,
enhanced training, or enhanced security response procedures.
...Recommended Focus for Risk Prevention
The threats considered and the safety and security measures employed to address them must
be based on site-specific and location-specific conditions. The level of risk prevention or
mitigation required will depend on the site and its location relative to major population areas and critical infrastructures. In all cases, the risk reduction strategies identified should be considered from a cost-effectiveness viewpoint; i.e. reducing risks to acceptable levels in the most cost-effective manner possible for a given site and location.
To guide risk management efforts and reduce impact on operations, Sandia recommends
defining threat-scalable safety and security measures, and then tying safety and security
related operations to these levels, which is the approach taken by the Department of
Homeland Security for its threat advisory system. In this way, for each threat condition,
protection and operations changes can be implemented in order to maintain the level of risk
to public health and safety at acceptable levels.
Although the Department of Homeland Security defines threat levels, this might or might not
be appropriate for an LNG transport system. As a minimum, Sandia suggests three levels --
normal, off normal, and emergency. Unlike Homeland, whose sole focus is security, LNG
would extend this formalism both to security and to safety.
Generally, the safety efforts currently in place for LNG transportation over water have been very effective in preventing accidents and appear to be adequate. At some locations,
however, security efforts required to prevent intentional breaching events might have to be
increased in order to reduce the risks to public health and safety. Since 9/11, current safety
and security efforts have been increased and are continuing to evolve to meet the challenges
of ever changing security threats...
Before implementation of specific safety or security measures is contemplated at a site, a
baseline risk analysis should be conducted, a minimum acceptable risk estimated, and
vulnerabilities and hazards evaluated. After the initial risk analysis has been completed,
prevention and mitigation measures or strategies can then be considered and evaluated.
These can then be compared to assess if they provide the enhancements required to reduce
the risks of an LNG spill to acceptable levels for a site.
...Application of the Risk Management Process
So far, in this section we have discussed risk reduction for areas or activities within the larger system that includes the LNG tanker, the waterways it travels, and neighboring
infrastructures. We used the risk management guidance and safety information developed in
this report to assess ways to enhance operations and reduce the potential risks to the public.
Hopefully, this will provide the reader with suggestions on how to consider various issues,
including terminal location and site conditions, operational conditions, environmental effects, and safety and security concerns and measures. To be feasible, such a process must be
effective from a surety standpoint, affordable, possible to implement in a timely fashion,
minimize environmental impact, and be otherwise amenable to regulators and stakeholders.
We are not intending to suggest a "cookbook" methodology for selecting new sites; however,
we want the reader to understand what type of issues should be considered and what various
measures should be applied to try to achieve appropriate levels of protection of public safety
and property for LNG imports.
Applying the Risk Management Process to LNG Imports
Risk management of an LNG import facility should be viewed as a system that includes the
LNG tanker, the import terminal facilities and location, the navigational path, and the nearest neighbors along the navigational path and at the import terminal. Four classes of attributes affect the overall risks. These include:
- The context of the import facility -- location, site specific conditions, LNG import, importance to the region;
- Potential targets and threats -- potential accidental events, credible intentional events, and ship or infrastructure targets;
- Risk management goals -- identification of levels of consequences to be avoided, such as injuries and property damage, LNG supply reliability required; and
- Protection system capabilities -- LNG tanker safety and security measures, LNG import
operations safety and security measures, and early warning and emergency
In the risk management process shown in Figure 3, the four attributes discussed are then
evaluated to determine if the protection system in place can effectively meet the risk
management goals identified for a specific import terminal site and operations. If so, then the safety and security measures and operations developed for the LNG import operations are
adequate. Import operations should be reviewed on a regular basis to assess whether changes
in context, targets or threats, risk management goals or risk management systems have
changed such that a reassessment of risks is needed.
If the initial risk assessment determines that the identified risk management goals are not
being met, then potential modifications in location and site conditions, import operations,
safety and security measures, emergency response and early warning measures should be
assessed to determine effective improvements in the overall risk management system Below,
we provide a summary of the elements that should be considered for LNG import facility
applications for each step of the risk management process identified in Figure 3 of this report.
These steps provide a context of how the safety analysis and risk guidance provided in this
report can be used to evaluate options to protect property and public health and safety
associated with LNG import terminals and operations.
Step One - Characterize Assets
In this step, the context of the LNG facility such as location, site-specific conditions, and nominal operations should be identified and developed. Information that should be collected and considered includes:
- Type and Proximity of Neighbors (Sections 3.3, 4.2, and 5.1)
- Distance to residential, commercial, and industrial facilities or other critical
infrastructures such as bridges or tunnels, and
- Transit -- Near or in major ship channel or remote from channel
- Environmental Conditions (Sections 3.2 and 3.3)
- Wind-driven Spill Movement & Dispersion -- prevailing wind direction, speed, and
- Severe Weather Considerations -- hurricanes, storm surges,
- Tidal-driven Spill Movement & Dispersion -- height, current, and influence on spill
movement and dispersion,
- Seismic issues - ground displacement, soil liquefaction, and
- Temperature issues -- ice, thermal impediment to operations
- Nominal Operational Conditions (Sections 2.1, 2.2, and 3.3)
- LNG tanker size and design,
- Expected frequency of shipments,
- Importance of LNG Shipments -- Available storage, seasonal demands, percentage of
regional or local supply, and
- Transit -- additional traffic (near other large ships, pleasure boats) and distance to it;
transit near critical infrastructures, such as other terminals, commercial areas, or
residential areas; number of critical facilities along transit; distance to critical
facilities along transit.
Step Two -- Identify Potential Threats (Sections 4.1 and 5.1)
In this step, the potential or likely threats expected for the facility, based on site location and relative attractiveness of either an LNG tanker or other nearby targets, should be identified.
Accidental Event Considerations -- shipping patterns, frequency of other large ships,
major objects or abutments to be avoided, warning systems, weather impacts on
waterways or operations,
Intentional Event Considerations -- threat levels identified by Homeland Security,
identified threats, past threats and shipping attacks, difficulty of attack scenarios for a
given site, and
Attractiveness of Targets -- impact of LNG tanker attack, impact on facilities near
navigational route, impact on other facilities near site not associated with LNG
Step Three - Determine Risk Management Goals and Consequence Levels (Section 6.1)
Identify risk management goals or consequence levels for LNG operations, including
potential property damage and public safety (including injury limits). Setting of the goals
and levels would be conducted in cooperation with stakeholders, public officials, and public
safety officials. Consideration should be given to evaluating a range of potential risk
management goals and consequence levels. In this way, an assessment of the range of
potential costs, complexity, and needs for different risk management options can be
compared and contrasted. Common risk management goals and consequence level
considerations should include:
Allowable duration of a loss of service, ease of recovery,
Economic impact of a loss of service,
Damage to property and capital losses from a spill and loss of service, and
Impact on public safety from a spill -- potential injuries, deaths.
Step Four - Define Safeguards and Risk Management System Elements (Section 6.2)
This step includes identifying all of the potential safety and security elements and operations available on the LNG tanker, at the terminal, or in transit. They include not only safety features but also safety and security-related operations and emergency response and recovery capabilities. These include:
Operational Prevention and Mitigation Considerations
LNG tanker safety/security features,
Proximity and availability of emergency support -- escorts, emergency response, fire,
medical and law enforcement capabilities,
Early warning systems,
Ship interdiction and inspection operations and security forces, and
Ability to interrupt operations in adverse conditions -- weather, wind, waves.
Design for storm surges, blasts, thermal loading,
Security measures -- fences, surveillance, exclusion areas,
Effective standoff from residential, commercial, or other critical infrastructures based
on recommended hazard distances from an LNG spill over water, and
Redundant offloading capabilities.
Step Five - Analyze System and Assess Risks (Sections 3.3, 4.2, and 5.1)
In this step, the defined risk management goals and consequence levels should be compared
to the existing system safeguards and protective measures. This effort would include
evaluation of each element of the event tree identified in Figure 4 for a potential spill that
might occur for the site-specific conditions, threats, and calculated hazard distances and
If the system safeguards in place provide protection of public safety and property that meet risk management goals, then the overall risks of an LNG spill would be considered
compatible with public safety and property goals. The risk management process should be
updated regularly to assess whether changes in threats or threat levels, operations, LNG
tanker design, or protective measures have occurred that would impact the ability of the
system safeguards to meet identified or improved public health and safety goals.
Step Six -- Assess Risk Prevention and Mitigation Techniques (Sections 6.2 and 6.3)
If the potential hazard distances and hazard levels calculated exceed the consequence levels and risk management goals for the LNG terminal and import operations, then the enhanced
risk mitigation and prevention strategies identified in Table 20 should be considered. While
many of the options listed would be possible for a given site, developing approaches or
combinations of approaches should be considered that can be effectively and efficiently
implemented and that provide the level of protection, safety, and security identified for the
LNG operations at each site.
...RISK ASSESSMENT OF LNG SPILLS OVER WATER
High consequence operations such as the transportation, off-loading, and storage of LNG imply potential risks to people and property. Risk is defined as the potential for suffering harm or loss and is often quantified as the product of the probability of occurrence of a threatening event times the system vulnerability to that event and the consequences of that event. Thus,
Risk = Pt (threat occurring) x Ps (system failure/threat) x Consequences;
Where: Pt = the probability of an accidental or intentional threat,
Ps = the probability that preventive or mitigating measures fail, and
Consequences = usually expressed in fatalities or costs.
Effectively evaluating the risks of a large LNG spill over water requires that the potential hazards (results of events that are harmful to the public and/or property) and consequences be considered in conjunction with the probability of an event, plus the effectiveness of physical and operational measures of LNG transportation to prevent or mitigate a threatening event. For example, safety equipment, operational considerations and requirements, and risk management planning can work together to reduce the risks of an LNG spill by reducing both the probability of an event that could breach the LNG tanker and by reducing the consequences of a spill.
Because of the difficulty in assessing the effectiveness of ship safety measures and operational safety and security strategies, many studies assume the probability of an event and a ship’s vulnerability to be one; therefore, the concentration is on calculating expected consequences. This often provides worst-case results with low probability and very high uncertainty, which can inappropriately drive operational decisions and system designs.
Therefore, for high consequence and low probability events, a performance-based approach is often used for developing risk management strategies that will reduce the hazards and risks to both public safety and property.
3.1 Risk Analysis Elements of a Potential LNG Spill
The risk analysis approach of a potential LNG spill should include:
...Uncertainty: Assessment of the accuracy of the assumptions used and the probable ranges.
...Comprehensiveness: Do the failure modes considered account for all major avenues of
loss? Understanding the full range of consequences associated with a catastrophe can
require considerable effort. Completeness is important to properly support risk assessment
and risk management.
Two important variables are ‘directness of effect’ and ‘latency.’ For example, if an
explosion breaches an LNG cargo tank on a ship, that is a direct effect. Conversely, if a
resulting explosion damages an LNG terminal—hampering future LNG deliveries for
extended periods -- that is an indirect or latent effect. Latency refers to when the effects
are felt. Immediate effects occur simultaneously with the threat; whereas latent effects
occur after an interval, the length of which might vary from system to system. It should
be emphasized that indirect/latent effects sometimes dominate other consequences.
...Evaluation of risk reduction measures: One way to reduce risk is to remove or block the threat; i.e., prevent the disaster from occurring in the first place. For example,
reinforce ships against collisions or reduce ship speeds in a harbor to reduce the chance of
...Threat as a moving target: Many avenues to failure -- mechanical, environmental
insult, operator error -- are amenable to analysis and can be confidently predicted to occur
with some probability in the future. Other types of threats can be constantly changing and
difficult to assess accurately, requiring more robust approaches for prevention or
mitigation and frequent re-evaluations of new threats.
Deciding on the sufficiency of protection measures to meet risk management goals is often aided by a benefit-cost evaluation. In most locations and most operations, some level of risk is common and, therefore, a "residual" risk often remains. For example, certain levels of safety equipment are standard features in automobiles, such as seat belts, air bags, and antilock brakes. While they might be effective safety measures, they do not provide total protection in all automobile accident scenarios. Therefore, the public does have some level of risk associated with driving.
While many potential safeguards might be identified for a given location, the level of risk
reduction and risk management required to be protective of public safety and property for LNG
transportation will vary based on site-specific conditions. The risk management goals for a given location should be determined in cooperation with all stakeholders. Stakeholders include the general public, public safety officials and elected officials, facility operators, port and transportation safety and security officials, underwriters, utility representatives, regulatory agencies, and ship management companies.
In releasing the unclassified version of the Sandia report, the U.S. Department of Energy issued the following statement:
The Department of Energy (DOE) today released the results of a comprehensive, year-long study of Liquefied Natural Gas (LNG) safety and security that was conducted by scientists at the Sandia National Laboratory. The Sandia study indicates that we can continue to transport LNG safely, as long as we continue to implement appropriate safety and security measures.
The Sandia study is significant to the advancement of technical knowledge because it is the only risk-based study of LNG that exists. The study is also considered important because it emphasizes the need to use risk analysis as part of the facility siting process and because it provides solutions for safely and securely managing the risks of shipping LNG, a clean energy source the nation needs to meet our increasing energy demand.
Sandia's study is a significant and valuable addition to the understanding of LNG safety and security issues, as well as the risk mitigation measures appropriate for protecting LNG cargoes over water and the population centers located nearby. The report will no doubt prove a valuable tool for the LNG industry, for Federal, State, and local government regulators, as well as for the general public as they deliberate on the future siting of LNG facilities needed to meet America's increasing demand for natural gas.
The Sandia report was produced under contract with DOE, working with "the U.S. DOE, the U.S. Coast Guard, LNG industry and ship management agencies, LNG shipping consultants, and government intelligence agencies to collect background information on ship and LNG cargo tank designs, accident and threat scenarios, and standard LNG ship safety and risk management operations."
Contact us: mail@LBReport.com