GASTECH 2OO2

PROGRAMME

Mario Dogliani, Head, Innovation Research and Product Selection, Ship Division, RINA SPA

MARIO DOGLIANI, graduated in Naval Architecture and Marine Engineering in 1983 at Genoa University, is the Manager of the Innovation, Research & Products Section of RINA S.p.A. the Italian Ship Classification Society. He joined RINA in 1985 and since then has been involved in Research & Development activities in the fields of hydrodynamics, structural response, risk analysis and safety of both offshore installations and ships.

Safety assessment of LNG Offshore Storage andRegasification Unit

Mario DoglianiRINA SPA

Italy

Dogliani page. 2

1. Introduction

Within the AZURE R&D project, a complete feasibility analysis of a FULL FLOATING LNG chain wascarried out covering design aspects of the LNG FPSO (Floating Production Storage Offloading), the LNGshuttle tanker fleet, the LNG FSRU (Floating Storage Re-gasification Unit) as well as the BTT (Boom ToTanker) LNG transfer system.

Outlines of the overall project results as well as of a few specific design aspects were presented in a seriesof papers at GASTECH 2000 /1/, /2/, /3/, /4/; the aim of this paper is to complete this overview byproviding insight into the specific safety aspects of the FSRU and the related gas transfer system.

More specifically the key issues of an FSRU’s safety can be identified as follows:

ß risk acceptance criteria: the FSRU is an hybrid installation which presents features (and risks)typical of both offshore oil storage units and of oceangoing LNG ships; hence, ad hoc riskacceptance criteria are needed;

ß results of the risk assessment – FSRU topside: from a design standpoint, the topside is ofparticular interest since, contrary to LNG oceangoing ships, the process equipment located there isnormally operating thus introducing risks neither normally considered nor regulated onboardships;

ß results of the risk assessment – BTT LNG transfer system: the LNG transfer system is clearly themost critical issue from both safety and operational standpoint, detailed re-design based on riskassessment was a must in the project;

ß applicability of the IGC Code: several safety issues can be approached based on the InternationalCode of Safety of Gas Carriers (IGC Code), particularly as far as LNG storage, floater’s stability,power generation & distribution and crew accommodation are concerned.

After providing an outline of the safety assessment procedure adopted in the study, on purposelydeveloped for this type of unit, the above safety issues are presented in the following paragraphs,providing details on the initial design, safety assessment, risk quantification and identified risk mitigationmeasures.

As a result of the study, it was proved that present technology allows the construction and operation ofFSRU units which are at least as safe as presently operating offshore oil storage floating installations: thebasis of this statement are illustrated and documented in the present paper.

2. FSRU main characteristics

The considered FSRU, whose main characteristics are provided in table 1, is a monohull floating terminal(see figure 1) where the LNG is received, stored, vaporised and exported to the onshore gas distributionnetwork.

Loa (m) - length overall 285.0Lbp (m) - length between perpendiculars 240.0B (m) - breadth 50.0Dfl (t) - displacement at full load 141,600Dbl (t) - displacement in ballast conditions 98,000Tfl (m) - maximum draught (full load) 12.6Tbl (m) - ballast draught 8.95

Table 1: FSRU’s main characteristics

The unit was conceived with 200,000 m3 LNG storage capacity, 10,000 m3/h transhipment flow rate and450,000 m3/h re-gasification rate. LNG storage is achieved by means of four LNG storage tanks, throughthe GTT membrane containment technique, with a boil-off rate lower than 0.15% per day. Further detailson the FSRU and its ancillary systems can be found in /2/.

Dogliani page. 3

Figure 1: FSRU and BTT systems (artistic impression)

LNG is loaded into the FSRU via tandem connection; in this situation the fundamental requirements forthe BTT system are to work in cryogenic operative conditions and to compensate the relative motionsbetween the FSRU stern and the LNG shuttle tanker's bow.

The BTT main components, are:

ß the boom, able to slew around the kingpost to compensate for relative angular motions ("fish tailing")in the horizontal plane (± 70°) of the two floatersß the double pantograph system, which compensates for relative wave frequency motionsß the automatic control system which monitors the relative position of the two vessels and controls theemergency procedures.

3. Safety assessment procedure

3.1 General

The objective of the FSRU safety assessment was to review potential internal accident scenariosassociated with its operation and to identify design modifications to reduce the associated risks. This wasachieved by means of a preliminary hazard analysis of the FSRU which involved the assessment ofpotential hazards, their screening and the incorporation into the design of remedial measures.

The BTT is essential for the overall safety of the combined FSRU-LNG carrier system, therefore theobjective of its risk assessment was to estimate its safety level in all the operating phases of LNG transfer.

3.2 Assessment procedure

When the AZURE project started, an established safety assessment process for either a LNG floatingchain or each single item of the chain was not available, moreover, no specific codes, standards andregulations addressing the full chain existed. Therefore, based on the review of applicable regulations andon the identified gaps, the following tailor-made safety assessment framework was established:

Risk assessment technique Applied toHAZard IDentification (HAZID) FSRU topside, FSRU, BTTFailure Mode Effect & Criticality Analysis (FMECA) BTTZone Analysis (ZA) FSRU topside;

3.2.1 Preliminary steps

Before starting the safety assessment, the two following preliminary steps are required:

Dogliani page. 4

ß definition of the system under analysis, of its interfaces with other systems in the LNG chain andidentification of the mission profile;

ß execution of a functional analysis, consisting in the identification of all the functions needed for thecorrect completion of the mission; this typically involves a classification of functions as follows:

- main functions which are necessarily active for the completion of the mission; depending on eachmission phase, not all the functions need to be simultaneously active.

- auxiliary functions aimed at supporting main functions- constraint functions required to fulfil external constraints (environmental, legal, etc.)- safety functions aimed at preventing or mitigating accidents or downgraded conditions.

3.2.2 HAZID

The HAZID is generally a structured brainstorming process which identifies potential accidents in eachmission phase. Possible causes of accidents, hazards, their consequences and any safeguards, which maybe in place to prevent them, are reviewed during the HAZID, which is broken down into three sequentialstages: hazard identification (i.e. what can go wrong), frequency assessment (i.e. how likely), andconsequence assessment (i.e. how bad).

The primary aim of the exercise is to identify as many failure conditions (or Hazards) as possible for eachmission phase. The exercise is also intended to provide relevant details of the failure effects, failurecauses, failure detection and regulations and to provide an estimate of probability and severity.

It carrying out the HAZID, the following process be followed:

1. consider each mission phase individually and identify as many relevant hazards as possible;2. identify the causes, consequences and other relevant information for each hazard;3. record all the generated information on HAZID worksheets.

3.2.3 FMECA

FMECA is an hazard identification technique based on a single failure concept under which eachindividual failure is considered as an independent occurrence with no relation to other failures in thesystem, except for the subsequent effect that it might produce. Through this technique, the waysequipment can fail, the possible causes, the effects these failures on the system performance and theirranking according to the combination of severity and probability of occurrence are documented.

The FMECA is carried out on a series of worksheets, where the results are listed in a tabular format,equipment item by equipment item, following a systematic bottom up approach. Two different levels ofdetail were considered in the analysis:

1st level: the analysis is carried out on the overall system, and each function of each main sub-system isanalysed;2nd level: the analysis is carried for the components of sub-systems. Each conceivable mode in which acomponent or unit can fail with respect to its intended function is analysed.

The 2nd level FMECA is performed for the sub-systems which failed the 1st level analysis; i.e.:

ß whose individual failure can cause major or more serious effects, andß where a redundant system is not provided, andß the probability of occurrence of acceptance criteria are not met.

3.2.4 ZA

The aim of Zone Analysis is to provide a detailed knowledge of the risk of occurrence of hazardousfailure in a given area and the risk of propagation of a local effect to the whole area and possibly beyond.

The basic scheme of a ZA is as follows:

ß define the objective of the study (e.g. a type of hazard)ß for each zone, carry out an inventory of hazardous materials in the zone

Dogliani page. 5

ß collect data relative to process, segregation / separation criteria, detection / alarms, emergencyresponse etc.

ß assume occurrence of failure and assess local and end effect as well as likelihoodß deduce risk picture for each zone.

3.3 Risk acceptance criteria

The consequences can be evaluated using the in-house physical modelling software tools available to thecompanies. Likewise frequency calculations can be undertaken using reliability data. A point to notehowever is that acceptability criteria only requires evaluation of the nearest order of magnitude. For thisreason judgmental ranking may be an acceptable replacement for quantitative analysis during thepreliminary design stage.

The selected acceptance criteria for the AZURE project are provided in the following tables.

F Annual Frequency Return Period / Annual Frequency1 <10-5 Extremely improbable2 10-5 - 10-4 Extremely remote3 10-4 - 10-3 Remote4 10-3 - 10-2 Reasonably probable5 > 10-2 Frequent

Code SafetyFunction

Description Impairment

ER Escaperoute

At least two escape routes from all temporarily orpermanently manned working stations. At least oneleading to a safe shelter area shall remain availablefor a predetermined time period.

Access to the TR and furtherescape to evacuation pointsimpossible due to accidentalconditions

TR Temporaryrefuge

There shall be a safe shelter area on the FPSO.This area will remain available for a predeterminedtime period in all hazardous situations.

Structural loss, deteriorationof conditions or loss ofcommunication and support

ES Evacuationsystem

A system for safe (dry) evacuation for on boardpersonnel shall be established. Safe transfer fromthe shelter area shall be part of the system. It shallremain available for a predetermined tiem period.

Use of evacuation systemimpossible due to accidentalconditions

MS Mainsupportstructure

The structure shall be safe for the time required forthe safe relocation of the unit (when relevant) orfor the time needed to safely evacuate personnelfrom the FSRU.

No longer safe to stay on theFSRU due to risk of capsizingor major structural breakdownof the vessel

Safety Function Required endurance timeEscape route 30 minTemporary refuge 45 minEvacuation system 45 minMain support structure 45 min

DA Severity Loss of Life1 Negligible No damage to personnel , safety functions fully available2 Minor Light injuries to personnel and/or local damage to safety functions3 Severe Serious injuries to personnel and/or large local damages to safety functions4 Critical Fatalities amongst personnel locally, impairment of safety functions5 Catastrophic A large number of fatalities amongst personnel also outside the event area, total

impairment of safety functions.

Dogliani page. 6

DB Severity Asset damage / Delay in Production1 Negligible Less than 1 week loss of total production2 Minor Between 1 week and 2 months loss of production3 Severe Between 2 and 6 months loss of production4 Critical Threaten the integrity of the unit / Between 6 months and 1 year loss of production5 Catastrophic Total loss of unit / More than 1 year loss of total production

DC Severity Gas leakage (m3) Fire/explosion - Environment1 Negligible < 0.06 Nil consequences2 Minor 0.06 – 0.6 Minor or repairable consequences3 Severe 0.6 - 6 Significant consequences. Possible interruption of the plant4 Critical 6 - 60 Serious or critical consequences5 Catastrophic > 60 Catastrophic or major consequences

Finally, the following risk acceptance matrix was selected: here unacceptable risks would require acomplete re-definition of the system/procedure concerned, ALARP risks would require corrective actionsand acceptable risks would not ask for actions.

5432 Unacceptable1 ALARP (As Low As Reasonably Practicable)

F/D 1 2 3 4 5 Acceptable

4. Results of the safety assessment

4.1 FSRU

The analysis of the FSRU has been carried out using a tabular "zonal analysis". This technique identifiednumerous potentially hazardous scenarios that were assessed for frequency/gravity and screened versusthe acceptance criteria.

Results, see table 4.1 where only ALARP issues are presented, are shown in the form of risk acceptancematrix: for each item presented there, remedial actions and design modifications are discussed in table 4.2.

54 2.8, 2.53 1.4 2.3/3.1, 1.2/2.12 2.2 1.3/2.41 1.5

F/D 1 2 3 4 5Probability

Table 4.1 - FSRU safety assessment (black = safety; blue = environment; red = asset)

System Remedial Actions Remarks Mitigation1.2.1: Structural steel work protection for LNG leakage. Structure protected accordingly.LP LNG

transfer intostorage tank

1.2.2: Spillage collection should be arranged to direct theleakage over board.

LP LNG leakage that could lead to pooling ofLNG will be directed overboard (port side ofunit). Protection of the side plating of theFSRU.

Seve

rity

Dogliani page. 7

System Remedial Actions Remarks Mitigation

1.2.3: Assess potential for explosive overpressurebetween tank top and process deck

Shown not to be an issue – this is an inertedvoid space with only fully welded pipingpassing through it. Hydrocarbon gas detectionin the void space exhausting inert gas flowwill indicate any leakage into this space.

1.3.1: Verify when sizing flare that incident radiationdoes not impair escape route from port, aft crane.

Crane now removed due to requirement toreduce potential for dropped object incidents.

1.3.2: PRV system should include method for snuffing anignited vent release.

Nitrogen snuffing systems included.

1.4.1: Potential for rollover incident on FSRU: need fordensimeters, stock management, and re-circulation.

Reserve capacity relief valve to protect againstthis event

LNGstorage

1.4.2: Size tank PRV capacity for rollover. As per 1.4.1 above.

2.1.1: Structural steel work protection for LNG leakage. As per 1.2.1 above.In tankLNG pump. 2.1.2: Direct LNG leakage overboard. As per 1.2.2 above.

2.2.1: Structural steel work protection for LNG leakage. As per 1.2.1 above.Recondenser entry toHP pumps

2.2.2: Provide spillage collection beneath LP LNGprocess vessels, direct LNG leakage overboard.

As per 1.2.2 above.

2.3.1: Assess means of escape from port cranes. As per 1.3.1 above.

2.3.2: Review position of flare relative to potentialflammable gas cloud

Recommended as part of detail design for theflare.

Exit fromHP pumps.Entry toSCV. 2.3.3: Flange orientation to minimise jet fire effects. Point noted for detail design phase.

2.5.1: Fully welded export piping from SCV's to turret. Normal part of flange minimisation in design.

2.5.2: Consider benefits of use of sub-sea isolation valve(SSIV) on pipeline to isolate FSRU from the pipelineinventory.

The use of an SSIV can be subjected to riskreduction cost/benefit analysis.

2.5.3: Fire Risk Analysis (FRA) to assess need forpassive fire protection and blast rating of forwardaccommodation bulkhead and turret structure.

These measures have been included in thebasis of design.

2.5.4: FRA to assess fire/blast protection of lifeboats. Point noted for detail design phase.

SCV to sub-sea pipelineconnection.

2.5.5: Emergency planning during detail design shouldconsider benefits of delaying evacuation until gasinventory has been released.

Point noted for detail designphase/contingency procedures.

Exportpiping

2.8.1 : Ensure that export piping is protected from impactof helicopter falling from edge of helideck. Either directprotection or deflection of falling object.

Included in basis of design.

Process 3.1.1: Design should, if possible, eliminate need to liftover live, hydrocarbon bearing equipment. If this is notfeasible, lifting devices should have a high factor ofsafety and, where possible, LNG/NG flow-rates reducedto a minimum in exposed vessels and piping.

Large boom cranes previously fitted for liftingitems in the process area have been removed.Instead structural frames will be providedlocal to equipment for hoisting operations,followed by trolley transfer to the forward laydown area where a boom crane is available fortransferring items to/from supply vessels.

Table 4.2 - FSRU safety assessment – remedial actions & design mitigation measures

4.2 BTT LNG transfer systemTo be successful, the LNG transfer operation implies that the following conditions should be simultaneously met:

i) the transfer system itself works properlyii) the relative motion of the 2 vessels remains within certain limitsiii) the transfer is covered by an adequate procedure.

Accordingly, the aim of the risk assessment were:

Dogliani page. 8

ß to evaluate the reliability and availability of the loading system;ß to assess under which conditions the nautical behaviour of the LNG shuttle can be controlled;ß to check if the transfer procedure covers all the required steps and is free of foreseeable mistakes.

LNG TRANSFER PHASES BTT OPERATION SEQUENCES

I) Approach (a) BTT in rest position (survival conditions)II) Connection (b) BTT raising and slewing

(c) Cable acquisition(d) Pantograph downward and final alignment(e) Pantograph mechanical connection(f) Product lines connection

III) Loading (g) Loading operationsIV) Disconnection Reverse of sequences phase 2V) Departure (a) BTT in rest position (survival conditions)

FMECA was carried out at two different levels of detail:

1st level: for all operational modes, each function of each main sub-system is analysed;2nd level: carried out for the sub-systems which failed the 1st level analysis; i.e.:

• whose individual failure can cause major or more serious effects, and• where a redundant system is not provided, and• the probability of occurrence of acceptance criteria are not met.

Results, see table 4.3 where only ALARP issues are presented, are shown in the form of risk acceptancematrix: for each item presented there, remedial actions and design modifications are discussed in table 4.4.

543 III.g.9 II.d.2; III.g.32 II.b.1, II.d.1, E.1,

E.2III.g.4

1 III.g.6F/D 1 2 3 4 5

Probability

Table 4.2 - BTT safety assessment (black = safety; blue = environment)

No. Name & function Failure description and effect Suggested risk control optionsII.b.1 BTT

Turn to correctposition

Brake system failure and loss ofelectrical power due to electrical and/ormechanical failure and/or bad weather.Arm free to turn, possible fall, possibleinjury to people around.

Dedicated maintenance and periodicfunctioning check to be implemented.

II.d.1 Acquisition cableAssure mechanicallink between thepantograph and theLNG carrier

Bad position or rupture due to excessivetension or mechanical failures.The pantograph cannot be connected.Possible injury to people in the area dueto the free movement of the cable.

Periodic check of cable position & wear.Dedicated maintenance (& replacement)of cable. Operational procedures forpersonnel dedicated to the connection toprevent this accident.

III.g.4

Articulated jumperLower BTThorizontal slewing

Failure due to overpass of rotationlimits. Gas leakage and possible injuryto people.

Detection means are provided. Twosafety levels (30 degr limit). Emergencydisconnection is activated by theintervention of ESD1/2.

II.d.2 Acquisition winchAssure pantographlowering andcorrect alignmentfor connection onLNG carrier

Loss of relative position betweenpantograph and shuttle due to failure inthe control system. The acquisitioncable is subjected to higher/lowertension than expected. Possible cablefailure and injury to people in the area.

Operational procedures for personneldedicated to the connection to preventthis accident.

III.g.3

Flanges. Mechanical failures due to wear or tear. Leak detection sensors to be installedaround the LNG carrier manifold.

Seve

rity

Dogliani page. 9

3 Sealing. Gas leakage. around the LNG carrier manifold.III.g.6

Main liftingsystem (boomhoist, outer/innerpendants). Keepcrane arm position.Compensatevertical variations.

Cable failure due to mechanical fault orimproper/inverse action due to failuresin the control system. Extremely remotepossibility of crane collapse leading toleakage and harm to people. Pantographoutside operating limits and subsequentemergency disconnection.

Means of detection are already provided:cable load sensors and limit anglesensors.

E.1 Emergency shearpin of all QCDC's.Avoid unwantedemergencydisconnection innormal operations

Incorrect shear pin installed due tomaintenance error.Emergency disconnection is preventedand BTT damaged; possible leakage.Normal disconnection is still allowed.

A specific shear pin design and/oraccommodation avoiding replacement byincorrect pin to be provided.

E.2 Hydraulicaccumulators.Oil feeding tosolenoid valves.

Low pressure due to leakage or ruptureof the accumulator. Emergencydisconnection is prevented and BTTdamaged; possible leakage. Normaldisconnection is still allowed.

It should be checked the separationbetween normal and emergencyfunctions.

III.g.9

Couplers. Ensureconnection of BTT

Failure due to mechanical fault, wearend tear. Leakage & injury to people.

Leak detection sensors to be installed inthe area of the LNG carrier manifold.

Table 4.4 - BTT safety assessment – remedial actions & design mitigation measures

Based on the above, design modifications were implemented among them the most relevant are thefollowing:

ß A back-up retraction winch system. In case of failure of the main retraction system, a back-up winchplaced at the boom tip will be used to retract the double pantograph to its upper position.

ß A telemetry system to check the separation distance. Before the connection, the relative position of thetwo vessels have to be checked, to ensure that the double pantograph works within its operatingenvelope and is connected properly. A telemetry device will be used the measure this distance.

ß Load cells on cables. In order to detect any mechanical failure or wearing of the cables guidingequipment, the cables tension will be permanently monitored: the analysis of cables tension timehistory will reveal abnormal friction which, if undetected, would wear cables.

ß A triple redundancy of the double pantograph position monitoring system. The position monitoringsystem of the double pantograph starts automatically the emergency disconnection and activates thecrane position control. To enhance the reliability of the system, a triple redundant acquisition chain isused to track the double pantograph position even if a sensor deliver a wrong information.

ß Beam gas detectors around the connection area. Swivel joints are already provided with leak detectionin the packing area. Beam gas detectors are added around the manifold in the connection area.

ß A specific shear pin for emergency disconnection of QCDC's. A safety pin placed in the emergencydisconnector avoids unwanted disconnection. During an emergency disconnection, this safety pin issheared by the hydraulic actuator; the pin’s special shape prevents its replacement (e.g. duringmaintenance) with any other pin unable to shear as wanted in case of emergency disconnection.

5. Applicability of the IGC Code

5.1 Regulatory framework

LNG FSRU is a new concept, therefore an important aspect in the safety analysis was to identifyapplicable rules and to provide an interpretation of the regulatory regime pertaining to the system.

A number of codes, standards and regulations (i.e. IGC, Class Rules, API, etc.) were identified andchecked for applicability. In addition, the FSRU being designed for operating in the Adriatic Sea,requirements from the relevant Regional Council, the Italian Department of Health and the ItalianDepartment of Environment as well as from the European Community were considered.

Dogliani page. 10

Concerning the applicability of the IGC Code, summary table 5.1 was developed and adopted in theproject; in this list only those items which resulted non completely applicable are shown.

IGC code requirement Application / remarksChapter 1 general

1.5 survey and certification Applicable. Arrangement to be provided for survey at sea.Chapter 2 ship survival capability

2.2 freeboard and intact stability Applicable in principle. Towing to site to be considered.2.5 damage assumptions. Applicable. Extent of side damage may need to be adapted. Bottom damage

not relevant as the FSRU is in a fixed site.Chapter 3 ship arrangement

3.3 cargo pump room and cargocompressor room

Applicable. Can be extended to process machinery and equipment. Howeverprime mover of hydrocarbon processing machinery need not to be located insafe area if they are suitable for the zone class.

3.5 access to spaces in cargo area Applicable. Provisions to be taken for inspection at sea in operation.3.6 airlocks Can be modified by MODU code para 6.33.8 bow/stern loading/unloading Applicable. Consideration to be given to permanent gas loading

Chapter 4 cargo containment4.3 design loads Applicable. Criteria could be adapted to site specific dynamic loads and

probability of occurrence. Ditto for thermal loads.4.7 secondary barrier Applicable. The containment period of 15 days designed for a standard

voyage to be adapted to the FSRU always at sea.4.12 acceleration To be adapted to site, based on seakeeping analysis/model test

Chapter 5 process pressure vessels5.2 cargo and process piping Applicable. The ANSI piping codes could also be used bearing in mind that

in general materials are not valid below – 29 deg. C5.3 type tests Applicable. Number of cycles to be adapted to site5.9 vapour return May be not necessary with the shuttle

Chapter 7 cargo press./temp. control7.1 general Applicable. Flaring can be allowed. Site specific temperatures

Chapter 8 cargo tanks vent system8.2 pressure relief systems Applicable. Flaring can be allowed

Chapter 10 electrical installations10.1 general Applicable. Neutral regime, segregated in marine practice and connected to

the earth in offshore process practice, is to be clarified10.2 types of equipment Applicable. Electric motors (safe type) could be allowed in hazardous areas.

Hazardous areas extent & class according to recognised standard (API 500,IP code)

Chapter 11 fire protection and extinction11.1 fire safety requirements Applicable. The presence of a process plant is to be taken into account.

Recognised standards such as NFPA can also be used.Chapter 13 instrumentation

13.6 gas detection requirements Applicable. Individual detectors may be used instead of sampling.

Table 5.1 – summary of IGC Code non completely applicable requirements

5.2 Specific issues

5.2.1 Hazardous areas

The definition of hazardous areas should be in compliance with one of the following codes:

1. API 5052. MODU Code3. IP 15 "Area Classification Code for Petroleum Installations".

The latter is the most conservative and commonly used in the offshore industry and therefore suggested for thisspecific application.

Dogliani page. 11

According to IP 15 Code, « a hazardous area is a three dimensional space in which a flammable atmosphere may beexpected to be present at such frequencies a to require special precautions for the construction and use of electricalapparatus. All the other areas are referred to as non-hazardous …».

« The hazardous areas are subdivided in three zones as follow.Zone 0. That part of the hazardous area in which a flammable atmosphere is continuously present or present for longperiods.Zone 1. That part of the hazardous area in which a flammable atmosphere is likely to occur in normal operation.Zone 2. That part of the hazardous area in which a flammable atmosphere is not likely to occur in normal operationand, if occurs, will exist only for a short period ».

5.2.2 Internal combustion engines on the deck

As far as the location of the internal combustion engines on the deck is concerned, MODU Code wasconsidered according to which the cargo area (i.e., the portion of deck above the LNG tanks) is defined ashazardous zone of type 2. Therefore it was concluded that internal combustion engines in Zone 2 can beaccepted if they are constructed to reduce the risk of ignition from sparking or high temperature incompliance with a recognised standard (e.g. IP 15).

Additionally, engines situated on the roof of the cargo tanks are not normally accepted, therefore thesolution of a raised deck becomes the only way ahead. In this respect, the following rules can also fit thedesign:

ß IGC Code establishes (indirectly) that, to be acceptable, this deck should be higher than 2.4 m;ß IGC Code sets forth a minimum distance of 10 m between vent exits and the nearest intake or

opening to accommodation spaces, service spaces and control stations, etc.: this provides furtherinputs as to how to build the raised deck, since a possible interpretation is that any potential gasleak source must be at least 10 m away from any source of ignition.

So far, emphasis has been put on the gas leak as an initiating event, with the presence of sources ofignition as possible causes of escalation. Assuming the generation modules are someway enclosed, careshould be taken to tackle the following issues:ß spark control (possible solutions: raised exhaust stack, anti-spark equipment, etc.);ß control of hot surfaces (e.g. by providing insulation to the exhaust stack );ß discharge of gas e.g. through vents not free, but conveyed to the flare or to a safe position;ß examination of the possibility of combustion of soot along the stack (soot formation is probably

unlikely if only methane is burnt).Now, also the reverse should be analysed: that is, a generation module can be itself an initiating event,possibly impacting on the tanks, for the following reasons:ß fireß structural collapse (maybe as a consequence of a fire or helicopter crash)ß missiles (the rotor disintegration of gas turbines)

The reliability of fire-fighting equipment and all the safety systems involved (detection, shutdown, etc.)must be then demonstrated when the design is at a sufficient detail level. If the module is enclosed, thewalls should be capable of withstanding the missiles from gas turbines. The raised structure may requirestructural and thermal calculations to verify the resistance to incidents, whose likelihood is to be properlyassessed.

6. Overall safety of the FSRU

The risk levels associated with the FSRU concept compared with current, accepted industry practices hasled to the conclusion that the FSRU risk profile is likely to at least equivalent to the risk profile of a"normal" turret-moored FPSO. The rationale leading to this conclusion was a comparison of the primaryfeatures of the FSRU with those of an FPSO, as outlined below:

• Process equipment – the FSRU has a very open, uncongested process area with a limited amountof equipment that is thus well spaced out with no stacking required. Compared to an FPSO, this willlead to:

Dogliani page. 12

- lower hydrocarbon release frequencies (less flanges/valves/small bore piping)- lower ignition probabilities (good natural ventilation, less accumulation risk)- reduced escalation risks (good equipment separation)- lower potential explosive overpressures.

Furthermore, due to the open spaces on the FSRU, the chances of escaping from a process area incident tothe TR are judged to be greater than for the FPSO;

• Process gases – an FPSO with gas compression for injection or gas lift purposes is dealingwith longer chain hydrocarbon gases at higher pressures than the export gas on the FSRU. Theseheavier gases are not buoyant and thus, in the event of leakage, will have a greater residence timeon the unit, increasing the risk of ignition. Furthermore, they are capable of producing muchhigher overpressures in the event of an explosion and have higher jet fire radiation outputs;• Process liquids – the LNG on the FSRU will not lead to pool fire scenarios as the designallows any liquid rain out to be diverted overboard without significant environmentalconsequences. While oil pool fires are easier to extinguish than liquid gas pool fires, they arefought in situ and are not channelled overboard away from the surrounding equipment. The riskof a pool fire and subsequent escalation is therefore considered to be specific to the FPSO and nota significant risk contribution for the FSRU;• Personnel exposure – the FPSO is much more complex and hence maintenance intensiveinstallation, with a much higher POB (Personnel On Board), i.e. 3 to 4 times more that of theFSRU. The PLL (Potential Loss of Life) in a major incident onboard the FPSO wouldconsequently be higher.• Location – the function of the FSRU is such that it will be located much closer to the shorethan the average FPSO, decreasing the time needed for shore based rescue and support services tobe on site.

FSRU features which may be considered to have a negative impact on its risk profile compared to that ofan FPSO are:

• Cryogenic hazards – the low temperatures of LNG can be the cause of structural impairmentin the event of leakage and contact with normal steel. This is a well known phenomenon andrecommendations have been made for the appropriate structural protection to be put in placewhere necessary (following detailed analysis of leakage extents);• LNG storage fires – in the unlikely event of tank rupture, a LNG fire may be impossible toextinguish, whereas the industry has experience of fighting oil tank fires. Evidently theprobability of such an incident has to be minimised through hull/tank design, but the LNG tanksare equipped with secondary barriers and multiple levels of over pressure protection. Note thatthe benefit of a location close to shore would play a part in such an incident, with fire fightingsupport vessels on the scene more rapidly than might be the case for an FPSO. This scenariowould lead to evacuation of either unit and thus would only affect the risk profile for the asset;• Sloshing in LNG tanks – the membrane design of LNG tanks requires the transfer ofstructural loading from the membrane to the hull structure. The loading on the membrane due toLNG sloshing has been studied extensively and shown to be acceptable for a known design ofmembrane tank, but nonetheless this remains an issue to be proven for the specific design ofmembrane proposed for the FSRU;• Leakage due to LNG carrier unloading – the connection and disconnection of LNGunloading couplings is considered to increase the risk of hydrocarbon releases local to the FSRU,when compared to an FPSO using the preferred option of a remote unloading buoy. However,with the new BTT system any such release would occur at some distance down wind from theFSRU, such that this should not significantly impact the individual risk for personnel on the unit.• Ship collision risk due to LNG carrier unloading – the configuration of the BTT systemwill lead to a similar risk of LNG carrier/FSRU collision as for an FPSO tandem offloading to ashuttle tanker. It is recognised that this presents a higher risk to the FSRU than a remote

Dogliani page. 13

unloading buoy, but with the use of dedicated LNG carriers and appropriate precautions duringmanoeuvring, such hazards can be controlled.

7. Conclusions

The studies and analyses undertaken within the AZURE project in support of the FSRU design haveshown that the floating alternative for a LNG receiving terminal is a viable solution.

In particular, as discussed in this paper, based on a comprehensive risk assessment, it is judged that inmost instances the FSRU has a risk profile lower than the accepted risk of Crude oil FPSO and that thereduced fire and explosion risks on the FSRU relative to the FPSO outweigh the few potential higher risksidentified in the analysis.

Moreover, these issues are considered to present risks that can be controlled during the engineering designphase using existing LNG industry experience.

8. References

/1/ Mayer M., Sheffield J., Robertson A., Courtay R., "Safe Production of LNG on an FPSO”,Proceedings GASTECH 2000, Houston, November 2000.

/2/ Scarpa G., Dogliani M., Ducert A., "A Floating LNG Receiving Terminal: a Possible Solution forItaly”, Proceedings GASTECH 2000, Houston, November 2000.

/3/ Spittael L., Zalar M., Laspalles P., Brosset L., "Membrane LNG FPSO and FSRU - Methodology forSloshing Phenomenon", Proceedings GASTECH 2000, Houston, November 2000.

/4/ Marchand D., Prat C., Besse P., "Floating LNG: Cost and Safety Benefits of a Concrete Hull",Proceedings GASTECH 2000, Houston, November 2000.