1

RISK-BASED LNG FACILITY SITING AND SAFETY ANALYSIS IN THE U.S.: RECENT DEVELOPMENTS

Ted A. Williams, American Gas Association

Nneka Assing, American Gas Association

KEYWORDS: QRA, risk-based, safety analysis, LNG facility siting

ABSTRACT

United States (U.S.) efforts to implement a risk-based approach for LNG facility siting and site analysis for adoption in the regulations for approval of new and proposed expansions of LNG facilities have lagged efforts implemented in other countries. Since the 1970s, siting and site analysis of off-property hazards has been regulated by the U.S. Department of Transportation (DOT) through prescriptive requirements for analysis of hazards of LNG releases, including coverage of thermal radiation associated with LNG pool fires at the proposed site and flammable vapor travel off site in the event of a release of LNG. This paper summarizes and discusses recent developments in risk-based analysis procedures promulgated in the U.S. national consensus standards covering major LNG storage facilities, the National Fire Protection Association (NFPA) Standard 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas.”1 The discussion includes a comparison to major internationally-recognized, risk-based procedures applicable to LNG facility siting, potential implementation issues raised by NFPA 59A risk-based procedures, and potential regulatory adoption issues within the U.S. regulatory structure.

PREFACE

This paper assumes that the reader has a basic understanding of quantitative risk assessment (QRA) concepts and terminology and their implementation within safety programs addressing chemical releases from large industrial facilities and potential offsite hazards. This approach is intended to address contemporary issues relevant to QRA for LNG facilities, particularly for the U.S. where new requirements have recently been published rather than presenting extensive background on QRA methods. Readers wishing to review QRA concepts and applications should consider consulting the references listed at the end of the paper.

While QRA approaches are implemented in a large number of countries engaged in LNG activities, discussion of comparative aspects is strongly associated with the U.S. and the United Kingdom (U.K.), the latter having implemented QRA within its response to European Norm EN 1473, “Installation and Equipment for Liquefied Natural Gas – Design of Onshore Installations,”2 and coverage within the U.K. under Control of Major Accident Hazards (COMAH) regulations affecting LNG facilities and with consultation from the U.K. Health and Safety Executive (HSE). This focus on the U.K. for comparisons is due to the wealth of evaluation literature generated over the last decade on its QRA methods, accessibility to that literature through the HSE and other sources, and the general usefulness of the literature in assessing the new U.S. methods.

The depth of discussion of issues addressed in this paper is limited to make economical use of the format required for LNG 17 Conference papers. Therefore, it is hoped that the issues raised in this paper will be discussed in greater depth in the future at appropriate venues.

Analysis and conclusions presented in this paper represent those of the authors alone and do not represent those of the American Gas Association (AGA) or its members.

1 NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Edition, National Fire Protection Association. 2 European Standard EN 1473, “Installation and Equipment for Liquefied Natural Gas – Design of Onshore Installations,” (English Version), DIN EN 1473, 1997-11.

2

1.0 BACKGROUND: U.S. REGULATIONS AND STANDARDS FOR OFFSITE HAZARDS ASSOCIATED WITH LAND-BASED LNG FACILITY EVENTS

The U.S. currently does not have regulations requiring the use of QRA methods for assessing safety of new and significantly modified onshore LNG facilities as many other countries have, most notably Western Europe in response to EN 1473. Within the U.S. regulatory scheme, responsibilities for regulating safety of onshore LNG facilities with respect to potential releases of LNG and offsite hazards is shared according to jurisdictional requirements of two principal Federal agencies, the U.S. Federal Regulatory Commission (FERC) for siting and certification of onshore facilities serving LNG marine terminal activities and the U.S. Department of Transportation (DOT) for other large onshore facilities, primarily serving the gas distribution utility function. Still other large “non-utility” onshore storage projects are covered by state and/or local government jurisdictions.

FERC oversight of safety with respect to offsite hazards fits within a rather complex environment of jurisdictional limits, which are summarized in Figure 1. FERC’s off site safety responsibilities within this framework includes review of proposed new and significantly modified land-based terminal facilities in accordance with U.S. Federal regulations promulgated by the U.S. DOT, Title 49 Code of Federal Regulations Section 193 (49 CFR 193), summarized in the figure as including onshore piping serving storage tanks and plant facilities, including processing equipment, up to the pipeline leaving the terminal. DOT jurisdictional facilities are covered by 49 CFR 193 similarly up to the exit of the plant and interconnection to the gas transmission piping system, which is covered by other regulations under Title 49. Facilities outside the Federal jurisdiction, most simply characterized as facilities not part of the interstate natural gas system in the U.S. are covered by state and local requirements, which often refer to 49 CFR 193 requirements for offsite hazards as well as to NFPA 59A.3

Figure 1. Depiction of Regulatory Boundaries for LNG Terminal Facilities (from L. O’Donnell, FERC, Presentation, LNG Export Forum, May 2012)

3 O’Donnell, L. “LNG Exports from the U.S.: FERC’s “Nuts and Bolts” Perspective,” LNG Export Forum North America 2012, Houston, Texas, May 16, 2012.

3

NFPA 59A plays an important role not only as an enforcement-ready standard for facilities outside of Federal jurisdiction but as a reference standard for technical requirements for 49 CFR 193. By regulation, the U.S. DOT has over the years proposed adoption of NFPA 59A requirements as a whole or in parts for inclusion in revisions to 49 CFR 193. However, the last major adoption of NFPA 59A within 49 CFR 193 was associated with the 2001 edition of the Standard. Since then, adoption of changes to later versions of NFPA 59A have not been implemented through Federal rulemaking. It is in this environment and with the publication of the 2013 edition of NFPA 59A, and including for the first time QRA methods in the body of the Standard as a “mandatory alternative” method to prescriptive requirements, that QRA methods are at last potential candidate safety requirements for new and significantly modified land-based LNG facilities.

1.1 U.S. Regulations and Standards for Offsite Hazards Associated with Land-Based LNG Facility Events Up until the publication of the 2009 edition of NFPA 59A, offsite safety requirements for consequence modeling and safety criteria were harmonized with 49 CFR 193. Offsite hazard coverage addressed accidental releases of LNG included two hazard classes:

• Offsite thermal radiation hazards associated with pool fires for ignition of LNG vapor within plant impoundments, and

• Offsite flash fire hazards associated with dispersion of LNG vapor outside the plant boundary from evaporating pools within the plant impoundments.

Both NFPA 59A and 49 CFR 193 presented prescriptive requirements for hazard modeling and consequence criteria for human health and property damage. Siting limits are established by “exclusion zones” of activity and occupancy based on calculated radiant heat flux calculations for pool fires (shown in Table 1) and contours for vapor dispersion and potential flash fires assuming ignition of the dispersing cloud at calculated distances to ½ the lower flammability limit (LFL) of natural gas or 2.5% by volume. In modeling vapor dispersion from spills, “design spills” (shown in Table 2) must be addressed. In addition, worst case environmental conditions for dispersion are to be used, including a low wind speed of 2.0 meters per second (m/s) and Pasquill-Gifford atmospheric stability class F, or “the combination of wind speed and atmospheric stability that can occur simultaneously and result in the longest predictable downwind dispersion distance that is exceeded less than 10 percent of the time.”4 While the radiant heat flux limits are associated with specific land uses, the vapor dispersion contour calculated for ½ LFL constitutes “the property line that can be build to” for the LNG project.

As of the publication of the 2009 edition of NFPA 59A, the Standard has diverged in several ways from the 49 CFR 193 offsite hazard analysis requirements. In particular, modeling methods for thermal radiation and vapor dispersion that were previously listed in both NFPA 59A and 49 CFR 193 were removed from the requirements of the Standard and reintroduced in the informative annex. Thermal radiation models acceptable under the mandatory sections of NFPA 59A must be “published in peer-reviewed scientific literature, have a scientific assessment verifying the details of the physics, analysis, and execution process, and have been “approved.”5 Vapor dispersion models under NFPA 59A must be “acceptable to the authority having jurisdiction that has been evaluated by an independent body using the Model Evaluation Protocol facilities published by the Fire Protection Research Foundation report, “Evaluating Vapor Dispersion Models for Safety Analysis on LNG Facilities.”6 49 CFR 193 has not adopted these changes in modeling requirements at this time.

4 NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Edition, Section 5.3.3.5. 5 NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Edition, Section 5.3.3.4. 6 NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Edition, Section 5.3.3.6.

4

Table 1. Radiant Heat Flux Limits to Property Lines and Occupancies [from NFPA 59A (2013), Table 5.3.3.2]; Occupancies [from NFPA 59A (2013), Table 5.3.3.2]

5

Table 2. Design Spills (from NFPA 59A (2013), Table 5.3.3.7)

1.2 Introduction of QRA Methods in NFPA 59A

With the publication of the 2013 edition of NFPA 59A, QRA methods that had previously been in the Standard as an annex outside of the requirements of the Standard were moved into the mandatory requirements as an alternative method for site analysis addressing off-site hazards. In addition, additional details were added to this new coverage, which comprises “Chapter 15” of NFPA 59A. The following is a summary of the Chapter 15 QRA coverage but does not reproduce the Chapter in its entirety due to copyright restrictions and because substantive issues raised in specific points of the summary are discussed in later sections of this paper. Note that the summary items are paraphrased from the Chapter 15 text, except where text is shown as quoted. This summary is shown to provide information on the scope and context of the technical requirements in Chapter 15:

• The scope section of the Chapter defines the coverage as addressing risks outside of the LNG plant boundary from LNG releases, explains that the QRA methods are an alternative to the prescriptive requirements in the standard (Chapter 5), address new and significantly modified LNG plants, and does not address LNG transportation to and from the plant. (Section 15.1)

6

• The general requirements state that LNG plants shall not pose “intolerable risks” to either individuals or society (defined in terms of “individual risk” and “societal risk”) or property and defines conditions where reassessments of risk must be undertaken, including but not limited to every five years or “as required by the AHJ” (i.e., the authority having jurisdiction). (Section 15. 2)

• Definitions presented address “individual risk” and “societal risk” as well as risks that are “as low as reasonably practicable” (ALARP). (Section 15.3)

• Requirements for risk calculations and the basis for assessment require use of “any one” of a number of methodologies listed in the Chapter, provided the methodology is approved by the AHJ and that calculated risks shall be compared to risks to which the population in the general vicinity may be subject “due to natural causes or from other human activities.” (Section 15.4)

• LNG release scenarios are defined and procedures for cataloging scenarios are spelled out including use of structured methods for scenario definition, calculation of release rates and durations, physical behavior of releases, thermal and physical characteristics, and “the spectrum” of hazardous behavior including “flashing, aerosol formation, liquid jetting, pool formation and flow, vapor dispersion, jet fires, flash fires, explosions, fireballs, pool fires, BLEVES, and liquid water interactions.” (Section 15.5)

Table 3. Example Component Failure Database [from NFPA 59A (2013), Table 15.6.1]

7

Table 4. Radiant Heat Flux and Thermal Dosage Outside the Plant Boundary [from

NFPA 59A (2013), Table 15.8.4.1]

• Release probability and conditional probability treatment is outlined, along with “example component annual failure” probabilities, subject to scenarios identified in Section 15.4, and “shall be based on” those found in Table 3 with site specific modifications and conditional probabilities that ‘’shall be approved” and “obtained by the AHJ approved conditional probability databases,” respectively. (Section 15.6)

• Environmental conditions and frequencies of occurrence are specified for consequence analysis, including conditional probabilities of occurrence of 25%, 50%, 75%, and 99% for wind speed, wind direction, ambient temperature, relative humidity, and ground or water temperatures. Topographic features that influence liquid flow interactions with impoundments, surface roughness affecting vapor dispersion, congestion potentially influencing vapor cloud explosive behavior must be analyzed. Also, probabilities of ignition being active during vapor cloud dispersion are to be “assessed and approved.” (Section 15.7)

• For each release scenario, the hazard and consequence assessment is to, by “accepted methods,” take into account impact hazard area and distance subject to hazard behavior, weather and “environment or other conditions” addressing distance to limit for vapor dispersion, distance to limits of pool fire radiant heat flux, distance to vapor (flash) fire limit for heat flux or dosage, distance to limit for heat flux from fireballs, distance to limit for overpressures from explosions, and distances to “other hazards from rapid phase transitions (RPTs), toxic releases and so forth. Cascading damage from primary releases, inside the plant and outside, must be included such that “the risk calculation shall include the cascading effects “ Radiant heat flux limits are based on Table 4, vapor dispersion distances are based on the 100% LFL contour (5% concentration by volume), and explosion damage based on Table 5 using “mathematical models approved by the AHJ.” RPT hazard distances “shall be determined with models approved by the AHJ.” For each scenario,” the total number of persons located within the hazard distance or area shall be enumerated using public demographic or census data or other methodology approved by the AHJ.” Finally, “other hazard criteria for exposure to persons and property damage from potential exposures to different types of hazards indicated in Annex A [of NFPA 59A] shall be used as a guide in the hazard assessment required under Section 15.8.” (Section 15.8)

Table 5. Blast Damage Criteria [from NFPA 59A (2013), Table 15.8.4.3]

8

• Risk contours for individual risk and FN diagrams for societal risk must be used to summarize risk results and represent the various combinations of release scenarios, ambient conditions, and event occurrences, orientation, and exposures. Uncertainties and estimated errors must be accounted for in individual risk contours and societal risk diagrams, respectively. (Section 15.9)

• Risk tolerability criteria must be specified in terms of individual risk acceptability and societal risk acceptability in accordance to Tables 6 and 7 for fatalities and Figure 2 for societal acceptability regions for injuries. (Section 15.10)

Figure 2. Acceptability Regions for Societal (Injury) Risk in the F-N Domain [from NFPA 59A (2013), Figure 15.10.2]

Table 6. Criteria for Tolerability of Individual Risk (IR) from Injury Due to

Exposure to Dangerous Dose or Higher [from NFPA 59A (2013), Table 15.10.1]

Table 7. Criteria for Tolerability of Societal (Fatalities) Risks [from NFPA

59A (2013), Table 15.10.2]

9

• Risk mitigation approaches shall be considered where calculated risks are in “unacceptable” regions or lie between the upper and lower bounds of acceptable ranges. (Section 15.11)

1.3 Intended Improvements in Siting Decision Making QRA analyses in the context of releases of chemicals from large facilities and potential offsite hazards are often intended to serve as part of an organization’s total risk management approach to its business. These approaches allow quantitative measures of risk to be balanced with risk management measures and other considerations to make cost-effective decisions for risk reduction.7 Decision making is supported by the overall process, which encompasses “risk analysis” and broader “risk assessment” perspectives as captured in its traditional form in Figure 3 from “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land Use Planning.”8 The proponents for the Chapter 15 QRA approaches summarize their procedure in five components of risk analysis for facility siting and substantial modifications:

1) Characterizing types of releases,

2) Accounting for location, size, rate, duration of release,

3) Determining probabilities of the release types,

4) Evaluating consequences of releases in terms of “specific hazard exposure” or exposure to people and property, and

5) Comparing calculated risk in terms of the consequences to risk acceptability criteria.9

Figure 3. Risk Analysis/Risk Assessment Flow Diagram (from “Review of HSE’s Risk Analysis

and Protection-Based Analysis Approaches for Land Use Planning”)

7 AIChE/CCPS, “Guidelines for Chemical Process Quantitative Risk Analysis, Second Edition, 2000, Wiley-Interscience, New York, p. xxi. 8 ERM, “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land-Use Planning, Final Report,” September 2004, p. 4. 9-10 Raj, P. and Lemoff, T. “Risk Analysis Based LNG Facility Siting Standard in NFPA 59A,” Journal of Loss Prevention in the Process Industries 22 (2009), pp. 820-829.

10

However, the proponents cite objectives beyond risk management for implementing QRA methods in NFPA 59A as an alternative to prescriptive requirements in the Standard:

“…It is impossible to design proper mitigation actions or emergency response procedures.”… “the Standard and the Regulations do not allow considerations of alternative safety mitigation procedures or technologies in LNG facility siting without obtaining, a priori, a special permit for specific items from the AHJ.”…” Only in the case of dispersion of vapors the effects of certain passive migration measures (such as a provision to detain vapor, employing impoundment surface insulation, providing water curtains, or other methods) can be considered in the calculations.” 10

This contention is arguable, especially in the context of LNG vapor dispersion, since modeling of liquid releases resulting in potential offsite vapor cloud travel is largely dependent upon modeling methods employed, with or without the influence of passive mitigation methods. In an important sense, limitations in modeling methods traditionally used for these behaviors, which were dependent upon independent source term modeling and assumptions of unobstructed vapor flow and terrain effects, required the use of ad hoc methods and produced unrealistic estimates of cloud travel offsite. The general and quite valid perception of such modeling was a dramatically overly-conservative view of design spill releases into facility impoundments. In that sense, QRA may be seen as an approach to balance such overly-conservative estimation of “risk” by introducing more complete and complex aspects of vapor cloud flash fires, including population and property exposure over time, ignition probabilities, and other factors. However, with the increasing adoption of more seamless and complete modeling methods based on computation fluid dynamics (CFD),11 vapor generation and dispersion can be modeled simultaneously and account for wind field, obstacle, and terrain effects along with traditional physical mitigating influences (e.g., air entrainment, gravity flow, heat transfer). Therefore, better modeling of the physical behavior of a design spill or “safety case” can address at least some of the objectives of the proponents of QRA by a simpler means than QRA. Indeed, the proponents’ discussion of QRA for a case of an LNG release and vapor dispersion effectively demonstrate reduced hazard zones as a function of risk using overly conservative and unrealistic dispersion calculations.12 One might argue that similar and potentially greater reductions might be demonstrated with better dispersion calculations, especially through better capture of vapor source and source-to-cloud continuity.

Additionally, the proponents of Chapter 15 propose another view of the value of QRA, which is more aligned with the risk management objectives of the American Institute of Chemical Engineers (AIChE) Center for Chemical Process Safety (CCPS) objective:

“Risk analysis also provides a means of testing, a priori, the effect of any type of mitigation approaches in the extent of the reduction of risk.”

However, again in the context of the vapor dispersion example, better modeling of a design spill with mitigation measures included in the simulation may produce the sought-for a priori information without the additional complexity of recalculating risks using potentially inadequate or ad hoc modeling methods, including methods previously proposed by the authors.13 For example, the effect of high impoundment dike walls or vapor fences on offsite vapor dispersion from a large spill can be modeled directly with the appropriate tools and assessed against a prescriptive safety limit. Regardless of the level of confidence in offsite risk information, assessing such measures using traditional dispersion modeling approaches are not likely to give results for which a high degree of confidence can be maintained.

11 Final Decision, PHMSA Docket No. 2011-0101, Petition for Approval of the FLACS (Version 9.1, Release 2) Vapor Dispersion Model, U. S. Department of Transportation, Pipeline and Hazardous Materials Safety Administration, October 7, 2011. 12 Raj, P. and Lemoff, T. “Risk Analysis Based LNG Facility Siting Standard in NFPA 59A,” Journal of Loss Prevention in the Process Industries 22 (2009), pp. 820-829. 13 Williams, T. “Simplified Methods for Calculating Dispersion of LNG Vapor from Tank/Dike Impoundments Using Integral-Type Models,” AGA Operations Conference Paper, 2008.

11

A more exhaustive discussion of risk-based siting of LNG facilities and comparison of European approaches to U.S. approaches (exclusive of 49 CFR 193 jurisdictional facilities) is provided in a paper by Licari and Weimer.14 As this paper shows, U.S. approaches to accounting for risk of projects has not taken the same approach as European authorities. Specifically with respect to LNG facilities, the paper points out the predominance of prescriptive requirements and their role in the regulatory culture of the U.S.

2.0 DIRECT CHALLENGES FOR IMPLEMENTATION OF NFPA 59A QRA METHODS

Implementing the Chapter 15 QRA methods is confronted by a number of challenges, some of which have been raised in the standards development process by regulators and industry experts.

2.1 Reproducibility Transparent analysis using QRA requires that the methods used are reproducible by a number of practitioners including project proponents, regulators, and independent third parties. To date, the QRA methods in Chapter 15 have not been demonstrated for safety cases by multiple investigators. It is unclear whether the methods have been applied or analyses published for any U.S. LNG facility using the Chapter 15 approach. Published or publicly available QRAs are needed in order to demonstrate reproducibility of the methods. Concerns over reproducibility were expressed during the standards development process at NFPA for the 2013 edition, where one commenter who voted in the negative for including the QRA methods in the mandatory section of the Standard, citing the need for demonstrating reproducibility of the methods.15 Responses to comments received did not address this concern. International efforts to compare risk assessment methodologies touched on issues of reproducibility of analytical approaches for the U.K. Health and Safety Executive (HSE) risk assessment methodology for a benchmark safety case. The HSE methodology is the model for the Chapter 15 methodology according to the proponents.16 The U.K. project, known as the ASSURANCE (Assessment of Uncertainties from Risk Analysis of Chemical Establishments) Project, was sponsored by the European Union and was completed in 2001. Seven risk analysis teams performed full risk assessment studies on the selected safety case, and summary analysis of the results across project teams compared results for hazard identification, frequency analysis, consequence analysis, harm criteria, and risk estimation.17 Aspects of the comparison are discussed below in this paper. However, the immediate point to consider is that no efforts of which the authors are aware have been carried to similarly assess the Chapter 15 methodology

2.2 Validity Validation of QRA methods through the risk assessment phase for applications where events are rare, or in the case of jurisdictional LNG facilities nonexistent in modern experience, would be exceedingly difficult. However, specific elements of the Chapter 15 methodology could be tested such as the societal risk calculations for a hypothetical LNG release event and comparing calculations to actual demographic patterns. Additionally, stochastic aspects of an event such as weather conditions affecting consequences and over a given time series could be compared to data used in risk assessment. To date, the authors could find no specific validation efforts for the Chapter 15 methodology or its components other than physical tests and release experiments that have been used to validate vapor dispersion and fire radiation consequence models. As on commenter on the Chapter 15 methodology stipulated, “…until the risk analysis methods are fully developed and validated, they are difficult if not impossible to use effectively.”18

2.3 Ability to Implement 14Licari, F. and Weimer, C. “Risk-Based Siting Considerations for LNG Termnals – Comparative Perspectives of United States & Europe,” Journal of Loss Prevention in the Process Industries 24 (2011), pp. 736-752. 15 Turpin T. Comment, “Report on Comments, 2011 Fall Revision Cycle,” NFPA 59A. 16 Raj, P. and Lemoff, T. “Risk Analysis Based LNG Facility Siting Standard in NFPA 59A,” Journal of Loss Prevention in the Process Industries 22 (2009), pp. 820-829. 17 “ERM, “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land-Use Planning, Final Report,” September 2004. 18 Helm, C. Comment, “Report on Comments, 2011 Fall Revision Cycle,” NFPA 59A.

12

As is discussed later in the paper, ambiguities regarding acceptability of modeling and discretion of enforcing authorities (“authorities having jurisdiction” or AHJs) without clear identification of alternatives reduces the ability to implement the Chapter 15 methodology. However, the current lack of even basic user guidance is a critical weakness. To address this basic need the Fire Protection Research Foundation (FPRF) issued a request for proposals in 2008 entitled “Development of a Quantitative Risk Assessment Methodology Protocol for LNG Facility Siting” to provide guidance. This project and the need for its completion were cited as reason for a negative vote on moving the Chapter 15 methodology into the mandatory requirements of NFPA 59A.19 However, this project has not been provided sufficient funding to date.

3.0 EQUIVALENCE ISSUES

3.1 Performance versus Prescriptive (Internal) Equivalence within NFPA 59A

The concept of providing alternative pathways within standards is generally targeted at providing flexibility for achieving equivalent levels of safety. In the case of NFPA 59A, prescriptive requirements in Chapter 5 for LNG releases and offsite hazards and Chapter 15 QRA methods, a review of these chapters identified examples of a number of inconsistencies between the prescriptive requirements and QRA requirements.

Design spills. Table 2 presents the design spills to be addressed in meeting the prescriptive requirements for vapor dispersion and flash fire hazards. Table 3 presents release probabilities for a set of spills that are not consistent with the Table 2 design spills, most notably “instantaneous failure of primary container and outer shell” of the LNG storage tank, which has long ago been dismissed as a credible accident for consideration under prescriptive requirements. The importance in a QRA of such speculative failures is reduced by assigning it a very low failure probability. Nevertheless, the inconsistency of credible accidents would produce greatly different consequences in terms of vapor dispersion and flash fire hazard, mitigated in the case of the QRA only by the probability calculation, possibly to a level of “equivalency” acceptable to the AHJ. As will be discussed for stakeholder engagement, this dependency upon probabilities to reduce risk or “condition” highly hazardous events may not end up being acceptable, regardless of the low calculated probability.

Also, Section 15.5.1 requires that scenarios of releases “shall be developed through the use of PHAs, HAZOP, and other systematic thorough studies and evaluations acceptable to the AHJ,” in addition to the Table 2 design spills. Furthermore, “Credible large-release scenarios” shall also be included along with their probabilities of occurrence. The net result of this array of diverse, unspecified, and ambiguously defined requirements is a further divergence from equivalency with the prescriptive path.

Release behaviors and hazards. The prescriptive requirements under Chapter 5 require consideration of pool formation and pool fire radiant fluxes and vapor clouds dispersion and flash fire hazards. In contrast, Section15.5.2.4 requires analysis of a “spectrum of hazardous release behaviors, including but not limited to: flashing, aerosol formation, liquid jetting, pool formation and flow, vapor dispersion, jet fires, flash fires, explosions, fireballs, pool fires, BLEVEs, and liquid water interaction effects. As a result, the QRA alternative must address many more hazards and consequences, many relating to offsite safety. While Chapter 5 lays out general requirements for modeling hazards it covers, Chapter 15 provides no specific guidance, raising questions about the competencies of AHJs to implement or review studies of these phenomena and internal consistency of alternative means of modeling. For example, the requirement to consider BLEVEs is stipulated, no validated methods have been put forth for modeling BLEVEs involving LNG storage vessels.

Radiant flux limits. Table 1 limits for radiant flux categories and land uses in the prescriptive path differs significantly from the flux limits provided for QRA provided in Table 4. The Table 4 fluxes provide documentation of consequences associated with each limits (unlike the limits in Table 1, which are

19 Turpin T. Comment, “Report on Comments, 2011 Fall Revision Cycle,” NFPA 59A.

13

documented and debated in the published literature20), but the justification of difference between the QRA limits and the prescriptive limits are unclear.

Conditional probabilities. Section 15.6.3 covering QRA states, “The conditional probability for each type of hazardous behavior, identified [in]...15.5.2.4 shall be obtained from the AHJ approved conditional probability databases.” QRA, being a probabilistic method of analysis, can often address conditional probabilities that can address cascading or “domino” events, but the prescriptive requirements in Chapter 5 do not take into account such events in determining hazards.

Flammability limits. Chapter 15 uses 100% lower flammability limit (LFL), or 5% LNG vapor in air by volume, as the criterion for flash fire hazards whereas the prescriptive requirements use the more traditional and conservative concentration of 50% LFL or 2.5%. Use of 100% LFL was debated for modifying the prescriptive requirements in the 2013 edition of NFPA 59A, but a proposed change to this concentration was not adopted. Conventional practice internationally retains the 50% LFL limit, which is justified on the basis that modeling methods predict average concentrations over an averaging time and does not account for excursions above and below the average as would be expected within a vapor cloud. This “conservative” limit is, therefore, based upon peak-to-mean measured behavior in vapor cloud experiments within and near the flammable range. A review of HSE’s use of 50% LFL was reviewed as an assumption in QRAs and found to be appropriate for future use.21 This difference in the paths of NFPA 59A is a significant divergence from equivalency since distances to these calculate contours can be very long in the downwind direction. Only incidental influence of probability calculations may bring the risks calculated under the two approaches into alignment.

Ignition sources. Like HSE risk calculations, the prescriptive requirements of NFPA 59A for exclusion zones for vapor dispersion implicitly assume the presence of ignition sources in dispersion vapor clouds at 50% LFL and higher concentrations. HSE has reviewed this criterion, and while it found merit in a more risk-based assumption regarding the presence of ignition sources, it has retained the current assumption.22 In contrast, Chapter 15 requires that ignition source probabilities “being active during the dispersion of a vapor cloud shall be assessed and approved.”23 Technical challenges of accomplishing this in a valid and verifiable manner aside, the probabilistic treatment of the presence of ignition sources combined with the difference in flammability contours presents a major source of divergence between the prescriptive and QRA methods.

3.2 Equivalence Among QRA Approaches Regulatory consideration of multiple approaches for QRA would presume that the approaches produce essentially equivalent risk assessment results. Unfortunately, reviews of approaches, including the ASSURANCE Project, have shown that differences identified in the “verification,” “scientific review,” and “validation” of major methodologies may be responsible for significantly different risk calculations.24 While the Chapter 15 methodology has not undergone such review, it is expected that similar issues of equivalency would arise since the methodology is essentially based on the HSE approach.

20 Raj, P. “A Review of the Criteria for People Exposure to Radiant Heat Flux from Fires,” Journal of Hazardous Materials 159 (2008), pp. 61-71. 21 ERM, “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land-Use Planning, Final Report,” September 2004, p. 79. 22 ERM, “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land-Use Planning, Final Report,” September 2004, p. 60. 23 NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Edition, Section 15.7.3. 24 ERM, “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land-Use Planning, Final Report,” September 2004.

14

Results of benchmarking exercises for QRA methods such as the ASSURANCE Project have demonstrated one the principal weaknesses of QRA methods: predicted frequencies of defined levels of fatalities ranging between 2 and 4 orders of magnitude.25 Figure 4 illustrates the board range of these frequencies.

Figure 4. Differences in Predicted FN Curves (from “Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land Use Planning”)

U.S. participants in NFPA 59A consideration of the Chapter 15 methodology are not unaware of these issues across QRA methodologies. One commenter on the proposal to include the methodology in the mandatory part of the Standard observed:

“...there is no consistency in the application of QRA due to the following reasons: failure rate data used are different for each method and there is no methodology available to adjust failure data for alternative sites, consequence models used are different for each method, and assumptions used in developing hazard scenarios and [sic] different for each method.”26

In fact, an HSE QRA review found that detailed site specific features are unlikely to be significant due to overall uncertainty within QRA assessments performed by seven teams of the ASSURANCE Project. To the reviewers, this observation supported a more generic approach to QRA in the U.K. than a detailed QRA.27

In addition, many QRA methodologies address events and consequences within the plant boundary as well as the offsite hazards and consequences addressed by NFPA 59A, Chapter 15. As a result, it is unclear how events, particularly cascading events, might contribute incrementally to calculated offsite risks, which would not be accounted for in results of Chapter 15 calculations, such as in calculated individual and societal risks. Without detailed comparison of these methods to Chapter 15, it is uncertain whether or not this is an important potential difference.

In contrast to the evaluation literature discussed above, Chapter 15 implies equivalency of methodologies by requiring calculation individual and societal risks using “generally accepted QRA protocol,” using “any one” of several cited published guidelines and standards.28 However, just as different teams have shown different risk assessment results for the same event using the same general QRA methodology, any one team might produce quite different results of an event when using the different methodologies identified in Chapter 15.

25 Institute of Chemical Engineers, Health and Safety Executive, “An Independent Review of the HSE Methodology for Assessing Societal Risk,” HSE, January 2006, p. 18. 26 Turpin T. Comment, “Report on Comments, 2011 Fall Revision Cycle,” NFPA 59A. 27 Institute of Chemical Engineers, Health and Safety Executive, “An Independent Review of the HSE Methodology for Assessing Societal Risk,” HSE, January 2006. 28NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Edition, Section 5.3.3.5.

15

Such outcomes might present contentious regulatory proceedings based on differences in the risk calculations.

4.0 AHJ AND STAKEHOLDER ISSUES

Enforcing authorities, the general public, and commercial interests separate from the project developers exert considerable influence over the use, development, and interpretation of QRA results through the assessment and decision making phases of a new or substantially modified LNG project.

4.1 AHJ Discretion Implementation of QRAs on a given project may, itself, be a subject of AHJ decision making. In the review of HSE procedures in the U.K., completed in 2006, industry expressed its concern that QRA may be “obliged” to carry out QRAs for facilities beyond immediate regulatory requirements.29 This concern would be exacerbated by other documented concerns relating to political considerations over acceptance of societal risk calculations in the COMAH process, high levels of public concern over any event, and general uncertainty over public risk aversion and understanding of societal risk in general.

With respect to NFPA 59A and Chapter 15, “use of the performance-based option requires approval of the authority having jurisdiction,”30 however, it would not preempt the AHJ from requiring a QRA in lieu of, or in addition to, satisfaction of the prescriptive requirements of the Standard. Clearly, this was not the intent of providing Chapter 15 in the mandatory requirements of the Standard and citing as an “alternative” methodology. However, the Standard does not prohibit this level of AHJ discretion in the project approval process. The implications of requiring a QRA for a project could be profound since the public attitudes and risk aversion (discussed further below) may be more influential in decision making and since, as previously discussed, the Chapter 15 QRA requirements are not equivalent to compliance with the prescriptive requirements of the Standard.

AHJ discretion in technical and administrative matters regarding implementation of QRA methodology covers a multitude of issues as briefly summarized in Section 1.2 of this paper. Some of the technical latitude provided to AHJs is a subject of technical capabilities and resources. Certainly, the Chapter 15 requirement that “the selected QRA procedure shall be approved by the AHJ” in Section 15.4.2 is a matter of both technical competence and public policy since, as discussed in Section 3.2 of this paper, different methodologies provide different results. At least some of these differences are traceable to the policy environment in which the methodologies were developed. As a U.S. paper comparing risk assessment methodologies points out, comparisons of U.S., European, and Scandinavian approaches needs to consider three perspectives: (1) analysis of regulatory precedents that provide the orientation of the LNG regulations, (2) similarities and differences of the application processes, and (3) risk mitigation strategies employed. 31

4.2 Public Risk Perception, Risk Aversion, and Communication With respect to risk tolerance or acceptability, the proponents of Chapter 15 emphasize that “society has to agree to establish an ‘acceptable’ level for risk.”32 In fact and with respect to Chapter 15, it appears that individual and societal risks are prescribed in Tables 6 through 8 and Figure 2. The authors would agree that societal acceptance of risk thresholds needs to be developed in a greater environment of consensus to gain

29 Institute of Chemical Engineers, Health and Safety Executive, “An Independent Review of the HSE Methodology for Assessing Societal Risk,” HSE, January 2006, p. 20. 30NFPA 59A, “Standard for the Production, Storage, and Handling of Liquefied Natural Gas (LNG),” 2013 Editiom. Origin and Development. 31 Licari, F. and Weimer, C. “Risk-Based Siting Considerations for LNG Termnals – Comparative Perspectives of United States & Europe,” Journal of Loss Prevention in the Process Industries 24 (2011), pp. 736-752. 32 Raj, P. and Lemoff, T. “Risk Analysis Based LNG Facility Siting Standard in NFPA 59A,” Journal of Loss Prevention in the Process Industries 22 (2009), p. 820.

16

acceptability of QRA methodologies. In pursuing these ends, the paper by Licari and Weimer from “Journal of Loss Prevention in the Process Industries” provides a concise discussion of issues:33

“The [public] engagement and recognition must be approached with a genuine and honest desire to develop sustainable relationships – relationships which build public confidence (rather than suspicion and conjecture) and expend more efforts, time and resources than building the actual regasification terminal…Better public outreach and enhanced risk communication techniques will be needed to sustain and improve public acceptance.”34

However, these authors go on to caution:

On the other hand, the public acceptance process for new regulations and novel LNG projects are less likely to accommodate change…scrutiny and criticism from both the public (including NIMBYs [Not In My Back Yard] and BANANAs [Build Absolutely Nothing Anywhere Near Anything) and industry (including more rigorous dispersion model validation and verification requirements)….U.S. trends in the direction of introducing quantitative societal risk analysis into the siting process. The public will expect new methodologies to meet or exceed siting standards, safety system reliability, and third-party quality control criteria that are common in Europe. [But] The public and technical acceptance processes to change LNG siting regulations will be challenging and complicated in the U.S.”

NFPA 59A, Chapter 15 appears to not have reached out or established the public credibility that would address these concerns. Several sections provide examples of this:

• In Section 15.10, Risk Tolerability Criteria for individual and societal risk appears not to have been vetted for public review and comment in the U.S. beyond the standards development process, which while being a “public review,” typically addresses constituencies not representative of the general public. Tables 6 and 7 of this paper are examples of the criteria in question. Also, zonal criterion for individual risk and land use restrictions are modeled after U.K. “consultation zone” approach for land use planning, but these appear to not have been vetted to the public beyond the standards development process. Also, the consultation zone approach in the U.K. provides a basis for dialogue with local government, with technical support and oversight from HSE, where appropriate. This regulatory approach is considerably different from the U.S. regulatory framework for LNG facilities.

• In Section 15.10.3, acceptability criteria for individual risk and societal risk “shall be suitably modified

taking into consideration the geographic location of the site and other local risk acceptability norms.” It is unclear how this would be applied, especially relative to “local risk acceptability norms” and how they are measured and documented.

• Annex A, Section A.15.10.2: “Societal Risk Tolerance Criteria Used by Different Jurisdictions”

suggests U.S. societal risk tolerances are consistent with other sources. However, review of societal risk issues in the U.S. reveal that consensus is lacking about the use of societal risk. Also, Chapter 15 risks are calculated differently and without the technical background and oversight provided in the U.K. by HSE, especially in areas such as release analysis and consequence models. As a result, this comparison of risk tolerances is a sort of “apples and oranges” comparison.

• With respect to Section 15.8.5, the validity and reliability of census and demographic data is

unknown, and its use for describing societal risk has not been subjected to public consensus.

33-34Licari, F. and Weimer, C. “Risk-Based Siting Considerations for LNG Termnals – Comparative Perspectives of United States & Europe,” Journal of Loss Prevention in the Process Industries 24 (2011), pp. 736-752.

17

• According to Section 15.4.4, “Risks calculated shall be compared with values of risks to which the population in the general vicinity of the proposed/existing plant may be subject due to natural causes or from other human activities.” The implied usefulness of this comparison runs up against a common error of understanding risk perception and aversion: risk associated with siting of industrial facilities or other projects is additive risk to other risks, including both voluntary and involuntary risk absent of a new project. Even if a new project has calculates risks well below other risks faced by the population in the vicinity of the project, the project adds additional risk at the margin and may be treated as excessive.

The risk communication framework published by Sandman may provide a useful context for understanding addressing the challenges for public acceptance of LNG projects and even gaining cooperation in development and acceptance of QRA-based decisions.35 He defines project risk as contributed by the public in the following formula:

Risk [i.e. project risk] = Hazard [e.g., QRA or other technical risk] + Outrage Informally defined, outrage is public abhorrence of potential events that generate fear, whether rational or irrational in a technical sense, as an intrinsic motivator to resist change such as new projects. Sandman formulated 12 outrage components that can characterize public responses to projects. The following are the 12 components representing the extreme qualitative values as perceived by individuals or groups. Parenthetical terms are provided by the authors to help explain the components, especially in the context of how they might apply to an LNG project:

“Safe” [projects] “Risky” [projects]

1. Voluntary [exposure] Coerced [exposure] 2. Natural [events] Industrial [events] 3. Familiar [events or outcomes] Exotic [events or outcomes] 4. Not memorable [outcomes] Memorable [outcomes] 5. Not dreaded [outcomes] Dreaded [outcomes] 6. Chronic [outcomes] Catastrophic [outcomes] 7. Knowable Unknowable 8. Individually controlled Controlled by others 9. Fair Unfair 10. Morally irrelevant Morally relevant 11. Trustworthy sources [analysis] Untrustworthy sources [analysis] 12. Responsive process Unresponsive process

Risk communication strategists have used these components and the “outrage” concept to structure public engagement approaches for at least two decades as of this writing, applying published techniques for reducing the importance of components of outrage and public resistance. These concepts may be helpful in expanding understanding and eventual use of QRA methodologies for LNG facility siting and plant modifications.

4.3 Industry Response The most complete assessment of industry responses to QRA methods is captured in the HSE’s review of its methodology for assessing societal risk.36 The methods for characterizing societal risks are essentially the same for the HSE methodology and NFPA 59A, Chapter 15 since the later was modeled on the HSE methodology according to the proponents of Chapter 15. Societal risks calculations pose special problems in a policy framework

35 Sandman, Peter, “Twelve Principal Outrage Components,” 1991, http://www.psandman.com/col/safety.htm. 36 Health and Safety Executive, “An Independent Review of HSE Methodology for Assessing Societal Risk,” Institute of Chemical Engineers, prepared for the Interdepartmental Task Group on Societal Risk, January 2006.

18

since casualty estimates, independent of probabilities, can be large and can be compared to large, well-known events. The following are some salient points of the industry views expressed:

• Industry groups were skeptical about the value of societal risk calculations since any large incidents with predicted offsite casualties would trigger “socio-political” concerns. Such concerns might politicize decision making and take it out of the realm of risk-based decision making.

• Industry groups were wary that use of societal risk calculations might be influenced by socio-political considerations. In a sense, the actual analysis might be influenced, a priori, by these considerations, such as through the selection of consequence models and other technical aspects of the methodology employed.

• Industry groups were concerned that understanding of risk aversion and societal risks (and their differences) are not well understood and that the risk aversion debate is heavily politically driven.

• Industry groups were frustrated at the lack of transparency of QRAs, including use of failure rates and other data and apparent unsuccessful attempts to validate calculations.

• As mentioned previously, industry groups “worried” about being obligued to carry out QRA. The findings of this study presented a number of actionable recommendations, most notably the expanded use of screening tools for risk estimations of societal risk prior to, or in place of, full QRAs. The HSE tool, QuickFN which generates societal risk curves for the frequency of N or more fatalities (F) by number killed (N). Figure 2 from NFPA 59A, Chapter 15 is an example of plotted curves, although the simple linear characterizations in Figure 2 were judged inadequate in the HSE study. Additional discussion of screening tools and QuickFN is provided in Section 6.0 of this paper.

5.0 REGULATORY AND TECHNICAL CRITERIA AND COMPETENCE ISSUES

5.1 Alignment of Methods and Goals Comparison of alignment of methodologies discussed by Licari and Weimer37 identifies that QRA methodologies, having evolved to support European performance-oriented regulatory approaches for LNG facilities, have supported management strategies that are based on performance goals involving reducing risk. In contrast, the U.S. approach has remained fundamentally prescriptive due to “lack of maturity in U.S. government structure and its regulation of the U.S. LNG industry.” This presents additional challenges for the U.S. since current public focus on use of QRA methodologies has been almost solely upon facility siting and modification application, not risk management within a regulatory structure. Indeed, individual facility operators may be using or intending to use QRA as a risk management approach, but the regulatory structure in the U.S. does not at this time require or incentivize its use to serve these broader purposes. As a result, public knowledge of the application of QRA methodologies is likely to remain focused only on siting deliberations, potentially fostering an adversarial environment around the subject of QRA. It is unknown at this time whether or how fast the U.S. will evolve its regulatory approach to resemble the European model. However, the U.S. has a further road to travel.

5.2 Hazard Criteria Conventionally used hazard criteria for offsite consequences of LNG releases include flash fire causalities [fatalities] within the flammable vapor cloud from dispersing LNG vapor and offsite skin burns [fatalities and injuries] and property damage from pool fires within the LNG facilities. Both of these criteria are discussed in earlier sections of this paper with respect to equivalency of prescriptive and QRA methods in NFPA 59A. For flash fires from vapor clouds, most methodologies presume ignition and casualty within all regions where the vapor concentration is 50% LFL or higher. Some investigators dispute this by qualitatively proposing that individuals can escape the flammable region of a vapor could either before ignition or before a flame front 37 Licari, F. and Weimer, C. “Risk-Based Siting Considerations for LNG Termnals – Comparative Perspectives of United States & Europe,” Journal of Loss Prevention in the Process Industries 24 (2011), pp. 736-752.

19

reached their position. The authors are unaware of any attempt to implement such assumptions within a QRA as a means of adjusting casualty numbers or probabilities. Other arguments for limiting vapor travel have been discussed, such as early ignition of the vapor cloud before reaching maximum distance, but these arguments also have not been translated into probabilistic terms.

Regarding pool fires, proponents of Chapter 15 add that for pool fire radiation, U.S. thermal radiation limits in prescriptive requirements (shown in Table 1) take into account only radiant flux limits independent of time when, in fact, heat flux exposure times are necessary. They also argue that “natural mitigation measures” such as shadows, escape opportunities, and other factors reduce the probabilities for casualty.38 However, there appears to be no methods for quantifying these mitigation effects for populations near hazard zones surrounding LNG facilities and the probabilities of these factors reducing casualties. Additionally, the prescriptive radiant flux levels in Table 1 are based on time-dependent exposures, and while lively debate has continued over whether these time exposures would reflect actual behavior in response to a large pool fire within a facility, solid arguments for reducing exposure times and consequent reduced radiant flux exposures have not received supporting consensus.

Hazardous levels from other release and ignition hazards considered in Chapter 15 have not received consensus for inclusion within QRAs, even though modeling methods of various types have been widely published. The CCPS “Guidelines for Evaluating the Characteristics of Vapor Cloud Explosions, Flash Fires, and BLEVEs,”39 is one resource for modeling the expanded list of hazard types in Chapter 15, but these modeling methods for LNG releases have not be validated for LNG releases and establishing related hazard criteria. For example, when considering jet fires, the time durations, transient surface emission powers, and transient view factors for consequence models are not validated for LNG jet fires so that appropriate radiant flux criteria can be implemented. This deficiency is largely a function of the lack of sufficient consequence models, which is discussed below. While debated continues on more steady state radiant flux criteria for pool fires, current state of knowledge (at least publicly vetted) for LNG jet fires is much less adequate.

5.3 Event and Failure Rate Data Event frequencies and component failure rates is a persistent problem for QRA on LNG facilities. It is arguable that no event frequencies are directly applicable to a planned new or substantially modified LNG facility since analogous events (i.e., involving modern LNG facilities) are absent from the literature. Attempting to apply event failure experience to LNG facilities is fraught with uncertainties because of the uniqueness of LNG land facilities, facility designs, materials used in construction, and credible failure modes of storage vessels, piping, and process equipment. Event probabilities with respect to facility construction accidents appear to be the most valid experience on which to draw for LNG facility construction.

Component failure rates have been the most developed resource for generating credible release descriptions and probabilities, but these failures have high levels of uncertainty, again due to low levels of experience. Application of fair data from other “comparable” component histories has received varying levels of acceptance and has received the most scrutiny. With respect to the HSE independent review, it is noted that “the ‘default’ data [failure] used by the HSE appears to be more pessimistic than that used by other authorities. Industry bodies have expressed concern that such differences could result in the process industries in the U.K. being seriously disadvantaged”40 from over estimation of failure rates and the need for excessive mitigating responses. Recommendations coming out of this study included that HSE and industry should seek to identify failure rates that have broad support. Frequency data should be “urgently reviewed” to establish suitable failure rates for equipment engineered and managed to “best practice.”

38 Raj, P. and Lemoff, T. “Risk Analysis Based LNG Facility Siting Standard in NFPA 59A,” Journal of Loss Prevention in the Process Industries 22 (2009), pp. 820-829. 39AIChE/CCPS. “Guidelines for Evaluating the Characteristics of Vapor Cloud Explosions, Flash Fires, and BLEVEs,” Center for Chemical Process Safety of the American Institute of Chemical Engineers, 1994. 40 Health and Safety Executive, “An Independent Review of HSE Methodology for Assessing Societal Risk,” Institute of Chemical Engineers, prepared for the Interdepartmental Task Group on Societal Risk, January 2006, p. 5.

20

U.S. facility operators reported to the authors similar concerns with respect to ad hoc application of component failure rates from the chemical process industry to LNG facility structures, components, and equipment.41 Overall, recent experience in the application of QRA to existing facilities in the U.S. has been unsatisfactory mainly due to the inapplicability of component failure data. In addition, comments on the proposal to include NFPA 59A QRA methods in the mandatory section of the Standard as Chapter 15 identified a lack of consistency for failure data among the identified QRA resources.

5.4 Consequence Modeling The HSE independent review of its QRA methodology found that when public risk aversion factors are associated with hazards that have high levels of uncertainty (vapor dispersion modeling being cited specifically), the greatest weight of risk aversion is upon those parts of the QRA where outcomes are most uncertain.42 To best control these high levels of uncertainty, greater emphasis needs to be placed on reducing the uncertainty of consequence models.

As noted in Section 1.3, the regulatory adoption of CFD models for vapor dispersion allows a means of directly modeling complex vapor sources and dispersion interactions with obstacles and terrain without the need for implementing ad hoc approaches required for simpler models. Models satisfying the Model Evaluation Protocol (MEP) developed with the support of the FPRF and accepted through petition by the Pipeline and Hazardous Materials Safety Administration (PHMSA) of DOT have met a high level of validation and an accompanying reduced modeling uncertainty, including for complex dispersion problems in the case of CFD codes. Furthermore, some of these models have the capability to model flash fire, fireball, and overpressure behaviors associated with the dispersing cloud; however, the MEP and PHMSA recognition of models does not currently extend to such behaviors.

The question for implementation of the Chapter 15 QRA methodology becomes how are the expanded behaviors to be addressed modeling in a verifiable, reliable, and valid way? Currently, LNG behaviors with respect to jet fires, aerosol behaviors, turbulent combustion of vapor clouds that might develop into a deflagration, and other behaviors have not been adequately characterized in the public literature. As a result, validation of models such as the CCPS Guideline methods for LNG releases cannot proceed to the levels associated with pool fire modeling and the MEP validation of vapor dispersion modeling. Consequences listed in Section 15.8.3 of the Standard that of particular concern for valid modeling of LNG releases include the following:

• Aerosol and jet fires onsite and offsite radiant fluxes

• Fireballs onsite and offsite and offsite radiant fluxes

• Explosions from onsite and offsite vapor cloud ignitions and offsite overpressures

• Rapid phase transitions (RPTs) from onsite and offsite overpressures

• “And so forth,” as the Chapter 15 section calls out. Ambiguities and uncertainties on acceptable models and minimum validation of these behaviors persist. For example, a wide variety of incompatible vapor cloud explosion modeling methods might be chosen for characterizing overpressures, ranging from the TNT Equivalence method to the “Multi-Energy Method to full CFD fire-to-deflagration turbulent combustion approaches. NFPA 59A is silent on what methods are adequate and appropriate beyond requiring approaches “approved by the AHJ.” Without specific guidance for implementing the QRA methodology, it may be that consensus on an appropriate consequence model will not be easily achieved. If coverage of these behaviors is to remain in the mandatory requirements of the Standard with any validity, a great deal of additional work is needed to bring project proponents and AHJs to consensus on modeling methods. 41 Personal communications, AGA Supplemental Gas Committee membership, December 2012. 42 Institute of Chemical Engineers, Health and Safety Executive, “An Independent Review of the HSE Methodology for Assessing Societal Risk,” HSE, January 2006, p. 5.

21

6.0 ALTERNATIVE APPROACHES FOR IMPLEMENTATION OF QRA METHODS

Given the earlier discussion and issues associated with societal risk calculations and public and industry response, greater opportunity for adoption of QRA methods may develop if methods are refocused upon individual risk and deemphasized for societal risk. In addition to avoiding the outstanding issues of societal risk calculations, addressing only individual risk calculations would substantially reduce the analytical burden of conducting QRAs and simultaneously reduce levels of uncertainty in the risk assessment supported decision making. Thinking further along these lines, the HSE review of societal risk points out that requiring full QRA based assessments for facilities may be inconsistent with the expected reliability of the results: “A full QRA is sufficiently resource intensive to make its application disproportionate for low risk installations, and the HSE accepts that such sites may not need to include QRA in their COMAH Safety Reports.”43

As previously noted, the HSE review identified that screening tools preceding final decisions on implementation of QRA may be appropriate to identify cases where detailed risk assessments may be most useful in identifying offsite risks. QuickFN is a screening tool that is based upon detailed QRAs conducted on “a number of representative installations,” presumably to generate results that are reliably consistent with full QRAs. The tool addresses societal risks through a series of scenarios covering different chemicals and facilities to generate approximations of number killed (N) for the log scale interval between 0.1 Nmax and Nmax and a linear extrapolation of the curve below 0.1 Nmax, to emphasize representation of low frequency/high consequence events in terms of societal risk. Figure 5 illustrates conceptually the representation of scenarios and the linear extrapolation in relation to a more complete depiction of the FN curve.

More recent advances in screen tools, including enhancements to QuickFN, may be available from HSE; however, the authors have not identified other screening tools for societal risk. Using such tools might be considered as a replacement for societal risk calculations, in line with the previous suggestion, if rigor in the societal risk calculation is deemed of less importance but still necessary. For more information on QuickFN, HSE directs interested individuals to its report, “Development of an Intermediate Societal Risk Methodology,” HSE Research Report 283.44

Figure 5. Conceptual FN Curve Approximate Using QuickFN (from “An Independent

Review of the HSE Methodology for Assessing Societal Risk”)

43 Institute of Chemical Engineers, Health and Safety Executive, “An Independent Review of the HSE Methodology for Assessing Societal Risk,” HSE, January 2006, p. 5. 44 Health and Safety Executive, “Development of an Intermediate Societal Risk Methodology, HSE Research Report 283, ERM Risk Ltd., 2004.

22

7.0 PROSPECTS FOR THE NEAR TERM

Perhaps the most candid and realistic assessment of the near term prospects general use of QRA methodologies in the U.S. is offered by Licari and Weimer who state that “the U.S. [regulatory] approach is seen to remain prescriptive and conservative in nature – providing additional levels of safety…Emphasis from both sides [Europe and U.S., in their comparative paper] will continue to reinforce the importance of accident avoidance and having multiple barriers to prevent an event of any type from occurring.”45 The interest in and trend toward greater use of QRA methods in the U.S. is likely to continue, albeit at a slower pace than the adoption of Chapter 15 requirements in NFPA 59A, as European-type experience and institutional support gains greater attention within the U.S. regulatory structure. However and as Licari and Weimer point out, the U.S. regulatory structure is not currently aligned to support greater use of these methodologies.

8.0 RECOMMENDATIONS

The following are recommendations of the authors for further development of NFPA 59A and U.S. development of QRA-based regulations generally:

• Ideally, NFPA 59A, Chapter 15 should be returned within the standard to its previous status as a non-mandatory appendix while issues such as those raised in this paper can be more fully discussed and consensus of users and stakeholders achieved. In the process of deliberations on QRA in U.S. regulation of LNG facilities, a broader review of issues of QRA implementation needs to be undertaken.

• At a minimum, application of the current Chapter 15 approach should only be by agreement of both the AHJ and the project proponent and not as a unilateral requirement of the AHJ. U.S. codes and standards experts may differ on whether NFPA 59A provides an AHJ latitude to make such unilateral decisions. However, the Chapter 15 text might be modified to remove any doubt about this potential outcome. QRA methodologies require devotion of significant resources and techniques, and project proponents should always be a party to decisions to make these analyses part of any project.

• Chapter 15 coverage of events and consequences beyond pool fire radiation and vapor cloud flash fires should be reconsidered in the Standard since their inclusion raises issues of equivalency with the prescriptive requirements of the Standard. Additional research and analysis should be performed to allow for better understanding of phenomena, consequences, and modeling to be developed among the U.S. industry and stakeholders. Phenomena raising this concern include, but are not limited to, jet fires, BLEVEs involving LNG, fireballs, vapor cloud explosions, and RPTs.

• As consensus on QRA methods and including other events and consequences is debated, additional efforts should be undertaken to assess, and as needed revise, the risk criteria used in Chapter 15 and whether the overseas basis for thresholds for individual and societal risk are appropriate for the U.S. This is a fundamental issue of public policy in the U.S. that requires a full vetting involving industry, the general public, and regulators as full stakeholders.

• As QRA methods and scope of their application broaden for application to LNG, U.S. efforts should follow the examples of European and U.K. programs such as the ASSURANCE project to review the relevance and appropriateness of hazard identification, release frequency data and analysis, consequence analysis, accident data, harm criteria and risk estimation. Analogues to the ASSURANCE project experience should be available through other regulatory structures such the U.S. Risk Management Plan (RMP) program of the U.S. Environmental Protection Agency (EPA) for various chemical industries in the U.S. This recommendation does not suggest that the RMP

45 Licari, F. and Weimer, C. “Risk-Based Siting Considerations for LNG Termnals – Comparative Perspectives of United States & Europe,” Journal of Loss Prevention in the Process Industries 24 (2011), pp. 736-752.

23

program and LNG regulations should be consolidated since the two Federal regulatory structures have fundamentally different origins and bases under Federal law, only that methodological approached might be compared for improving U.S. QRA practices may be enhanced.

ACKNOWLEDGEMENTS

The authors would like to thank the members of the AGA Supplemental Gas Committee for their consultation and support for this paper, NFPA for it granting of permission to use materials from NFPA 59A (2013), and Ms. Lauren H. O’Donnell, Director, Division of Gas – Environment and Engineering, FERC, for the use of her depiction of regulatory jurisdictional boundaries in Figure 1.

REFERENCES

1. American Institute of Chemical Engineers/Center for Chemical Process Safety. “Guidelines for Chemical Process Quantitative Risk Analysis, Second Edition, 2000, Wiley-Interscience, New York.

2. American Institute of Chemical Engineers/Center for Chemical Process Safety. “Guidelines for

Evaluating the Characteristics of Vapor Cloud Explosions, Flash Fires, and BLEVEs,” Center for Chemical Process Safety of the American Institute of Chemical Engineers, 1994.

3. ERM, “A Review of HSE’s Risk Analysis and Protection-Based Analysis Approaches for Land-Use

Planning, Final Report,” September 2004. 4. European Standard EN 1473, “Installation and Equipment for Liquefied Natural Gas – Design of

Onshore Installations,” (English Version), DIN EN 1473, 1997-11.

5. Fire Protection Research Foundation, “Evaluating Vapor Dispersion Models for Safety Analysis of LNG Facilities Research Project: Technical Report,” Health & Safety Laboratory, April 2007.

6. Health and Safety Executive, “Development of an Intermediate Societal Risk Methodology, HSE

Research Report 283, ERM Risk Ltd., 2004.

7. Health and Safety Executive, “Failure Rate and Event Data for Use Within Risk Assessments, June 28, 2012.

8. Health and Safety Executive, “Reducing Risk, Protecting People: HSE’s Decision-Making Process,” HSE

Books, 2001. 9. Institute of Chemical Engineers, Health and Safety Executive, “An Independent Review of the HSE

Methodology for Assessing Societal Risk,” HSE, January 2006. 10. National Fire Protection Association 59A, “Standard for the Production, Storage, and Handling of

Liquefied Natural Gas (LNG),” 2013 Edition, National Fire Protection Association. 11. Licari, F. and Weimer, C. “Risk-Based Siting Considerations for LNG Termnals – Comparative

Perspectives of United States & Europe,” Journal of Loss Prevention in the Process Industries 24 (2011), pp. 736-752.

12. Raj, P. and Lemoff, T. “Risk Analysis Based LNG Facility Siting Standard in NFPA 59A,” Journal of Loss

Prevention in the Process Industries 22 (2009), pp. 820-829. 13. Raj, P. “A Review of the Criteria for People Exposure to Radiant Heat Flux from Fires,” Journal of

Hazardous Materials 159 (2008), pp. 61-71. 14. TNO, “Guidelines for Quantitative Risk Assessment, ‘Purple Book,’” CPR 18E, Committee for the

Prevention of Disasters, First Edition, 1999.