GASTECH 2OO2. Mario Dogliani, Head, Innovation Research and Product Selection, Ship Division, RINA SPA

Transcription

1 PROGRAMME GASTECH 2OO2 Mario Dogliani, Head, Innovation Research and Product Selection, Ship Division, RINA SPA MARIO DOGLIANI, graduated in Naval Architecture and Marine Engineering in 1983 at Genoa University, is the Manager of the Innovation, Research & Products Section of RINA S.p.A. the Italian Ship Classification Society. He joined RINA in 1985 and since then has been involved in Research & Development activities in the fields of hydrodynamics, structural response, risk analysis and safety of both offshore installations and ships.

2 Safety assessment of LNG Offshore Storage and Regasification Unit Mario Dogliani RINA SPA Italy

3 1. Introduction Within the AZURE R&D project, a complete feasibility analysis of a FULL FLOATING LNG chain was carried out covering design aspects of the LNG FPSO (Floating Production Storage Offloading), the LNG shuttle tanker fleet, the LNG FSRU (Floating Storage Re-gasification Unit) as well as the BTT (Boom To Tanker) LNG transfer system. Outlines of the overall project results as well as of a few specific design aspects were presented in a series of papers at GASTECH 2000 /1/, /2/, /3/, /4/; the aim of this paper is to complete this overview by providing insight into the specific safety aspects of the FSRU and the related gas transfer system. More specifically the key issues of an FSRU s safety can be identified as follows: risk acceptance criteria: the FSRU is an hybrid installation which presents features (and risks) typical of both offshore oil storage units and of oceangoing LNG ships; hence, ad hoc risk acceptance criteria are needed; results of the risk assessment FSRU topside: from a design standpoint, the topside is of particular interest since, contrary to LNG oceangoing ships, the process equipment located there is normally operating thus introducing risks neither normally considered nor regulated onboard ships; results of the risk assessment BTT LNG transfer system: the LNG transfer system is clearly the most critical issue from both safety and operational standpoint, detailed re-design based on risk assessment was a must in the project; applicability of the IGC Code: several safety issues can be approached based on the International Code of Safety of Gas Carriers (IGC Code), particularly as far as LNG storage, floater s stability, power generation & distribution and crew accommodation are concerned. After providing an outline of the safety assessment procedure adopted in the study, on purposely developed for this type of unit, the above safety issues are presented in the following paragraphs, providing details on the initial design, safety assessment, risk quantification and identified risk mitigation measures. As a result of the study, it was proved that present technology allows the construction and operation of FSRU units which are at least as safe as presently operating offshore oil storage floating installations: the basis of this statement are illustrated and documented in the present paper. 2. FSRU main characteristics The considered FSRU, whose main characteristics are provided in table 1, is a monohull floating terminal (see figure 1) where the LNG is received, stored, vaporised and exported to the onshore gas distribution network. Loa (m) - length overall Lbp (m) - length between perpendiculars B (m) - breadth 50.0 Dfl (t) - displacement at full load 141,600 Dbl (t) - displacement in ballast conditions 98,000 Tfl (m) - maximum draught (full load) 12.6 Tbl (m) - ballast draught 8.95 Table 1: FSRU s main characteristics The unit was conceived with 200,000 m 3 LNG storage capacity, 10,000 m 3 /h transhipment flow rate and 450,000 m3/h re-gasification rate. LNG storage is achieved by means of four LNG storage tanks, through the GTT membrane containment technique, with a boil-off rate lower than 0.15% per day. Further details on the FSRU and its ancillary systems can be found in /2/. Dogliani page. 2

4 PROGRAMME Figure 1: FSRU and BTT systems (artistic impression) LNG is loaded into the FSRU via tandem connection; in this situation the fundamental requirements for the BTT system are to work in cryogenic operative conditions and to compensate the relative motions between the FSRU stern and the LNG shuttle tanker's bow. The BTT main components, are: ß the boom, able to slew around the kingpost to compensate for relative angular motions ("fish tailing") in the horizontal plane (± 70 ) of the two floaters ß the double pantograph system, which compensates for relative wave frequency motions ß the automatic control system which monitors the relative position of the two vessels and controls the emergency procedures. 3. Safety assessment procedure 3.1 General The objective of the FSRU safety assessment was to review potential internal accident scenarios associated with its operation and to identify design modifications to reduce the associated risks. This was achieved by means of a preliminary hazard analysis of the FSRU which involved the assessment of potential hazards, their screening and the incorporation into the design of remedial measures. The BTT is essential for the overall safety of the combined FSRU-LNG carrier system, therefore the objective of its risk assessment was to estimate its safety level in all the operating phases of LNG transfer. 3.2 Assessment procedure When the AZURE project started, an established safety assessment process for either a LNG floating chain or each single item of the chain was not available, moreover, no specific codes, standards and regulations addressing the full chain existed. Therefore, based on the review of applicable regulations and on the identified gaps, the following tailor-made safety assessment framework was established: Risk assessment technique Applied to HAZard IDentification (HAZID) FSRU topside, FSRU, BTT Failure Mode Effect & Criticality Analysis (FMECA) BTT Zone Analysis (ZA) FSRU topside; Preliminary steps Before starting the safety assessment, the two following preliminary steps are required: Dogliani page. 3

5 definition of the system under analysis, of its interfaces with other systems in the LNG chain and identification of the mission profile; execution of a functional analysis, consisting in the identification of all the functions needed for the correct completion of the mission; this typically involves a classification of functions as follows: - main functions which are necessarily active for the completion of the mission; depending on each mission phase, not all the functions need to be simultaneously active. - auxiliary functions aimed at supporting main functions - constraint functions required to fulfil external constraints (environmental, legal, etc.) - safety functions aimed at preventing or mitigating accidents or downgraded conditions HAZID The HAZID is generally a structured brainstorming process which identifies potential accidents in each mission phase. Possible causes of accidents, hazards, their consequences and any safeguards, which may be in place to prevent them, are reviewed during the HAZID, which is broken down into three sequential stages: hazard identification (i.e. what can go wrong), frequency assessment (i.e. how likely), and consequence assessment (i.e. how bad). The primary aim of the exercise is to identify as many failure conditions (or Hazards) as possible for each mission phase. The exercise is also intended to provide relevant details of the failure effects, failure causes, failure detection and regulations and to provide an estimate of probability and severity. It carrying out the HAZID, the following process be followed: 1. consider each mission phase individually and identify as many relevant hazards as possible; 2. identify the causes, consequences and other relevant information for each hazard; 3. record all the generated information on HAZID worksheets FMECA FMECA is an hazard identification technique based on a single failure concept under which each individual failure is considered as an independent occurrence with no relation to other failures in the system, except for the subsequent effect that it might produce. Through this technique, the ways equipment can fail, the possible causes, the effects these failures on the system performance and their ranking according to the combination of severity and probability of occurrence are documented. The FMECA is carried out on a series of worksheets, where the results are listed in a tabular format, equipment item by equipment item, following a systematic bottom up approach. Two different levels of detail were considered in the analysis: 1st level: the analysis is carried out on the overall system, and each function of each main sub-system is analysed; 2nd level: the analysis is carried for the components of sub-systems. Each conceivable mode in which a component or unit can fail with respect to its intended function is analysed. The 2nd level FMECA is performed for the sub-systems which failed the 1st level analysis; i.e.: whose individual failure can cause major or more serious effects, and where a redundant system is not provided, and the probability of occurrence of acceptance criteria are not met ZA The aim of Zone Analysis is to provide a detailed knowledge of the risk of occurrence of hazardous failure in a given area and the risk of propagation of a local effect to the whole area and possibly beyond. The basic scheme of a ZA is as follows: define the objective of the study (e.g. a type of hazard) for each zone, carry out an inventory of hazardous materials in the zone Dogliani page. 4

6 collect data relative to process, segregation / separation criteria, detection / alarms, emergency response etc. assume occurrence of failure and assess local and end effect as well as likelihood deduce risk picture for each zone. 3.3 Risk acceptance criteria The consequences can be evaluated using the in-house physical modelling software tools available to the companies. Likewise frequency calculations can be undertaken using reliability data. A point to note however is that acceptability criteria only requires evaluation of the nearest order of magnitude. For this reason judgmental ranking may be an acceptable replacement for quantitative analysis during the preliminary design stage. The selected acceptance criteria for the AZURE project are provided in the following tables. F Annual Frequency Return Period / Annual Frequency 1 <10-5 Extremely improbable Extremely remote Remote Reasonably probable 5 > 10-2 Frequent Code ER TR ES MS Safety Function Escape route Temporary refuge Evacuation system Main support structure Description At least two escape routes from all temporarily or permanently manned working stations. At least one leading to a safe shelter area shall remain available for a predetermined time period. There shall be a safe shelter area on the FPSO. This area will remain available for a predetermined time period in all hazardous situations. A system for safe (dry) evacuation for on board personnel shall be established. Safe transfer from the shelter area shall be part of the system. It shall remain available for a predetermined tiem period. The structure shall be safe for the time required for the safe relocation of the unit (when relevant) or for the time needed to safely evacuate personnel from the FSRU. Impairment Access to the TR and further escape to evacuation points impossible due to accidental conditions Structural loss, deterioration of conditions or loss of communication and support Use of evacuation system impossible due to accidental conditions No longer safe to stay on the FSRU due to risk of capsizing or major structural breakdown of the vessel Safety Function Required endurance time Escape route 30 min Temporary refuge 45 min Evacuation system 45 min Main support structure 45 min D A Severity Loss of Life 1 Negligible No damage to personnel, safety functions fully available 2 Minor Light injuries to personnel and/or local damage to safety functions 3 Severe Serious injuries to personnel and/or large local damages to safety functions 4 Critical Fatalities amongst personnel locally, impairment of safety functions 5 Catastrophic A large number of fatalities amongst personnel also outside the event area, total impairment of safety functions. Dogliani page. 5

7 D B Severity Asset damage / Delay in Production 1 Negligible Less than 1 week loss of total production 2 Minor Between 1 week and 2 months loss of production 3 Severe Between 2 and 6 months loss of production 4 Critical Threaten the integrity of the unit / Between 6 months and 1 year loss of production 5 Catastrophic Total loss of unit / More than 1 year loss of total production D C Severity Gas leakage (m3) Fire/explosion - Environment 1 Negligible < 0.06 Nil consequences 2 Minor Minor or repairable consequences 3 Severe Significant consequences. Possible interruption of the plant 4 Critical 6-60 Serious or critical consequences 5 Catastrophic > 60 Catastrophic or major consequences Finally, the following risk acceptance matrix was selected: here unacceptable risks would require a complete re-definition of the system/procedure concerned, ALARP risks would require corrective actions and acceptable risks would not ask for actions Unacceptable 1 ALARP (As Low As Reasonably Practicable) F/D Acceptable 4. Results of the safety assessment 4.1 FSRU The analysis of the FSRU has been carried out using a tabular "zonal analysis". This technique identified numerous potentially hazardous scenarios that were assessed for frequency/gravity and screened versus the acceptance criteria. Results, see table 4.1 where only ALARP issues are presented, are shown in the form of risk acceptance matrix: for each item presented there, remedial actions and design modifications are discussed in table 4.2. Severity , /3.1, 1.2/ / F/D Probability Table FSRU safety assessment (black = safety; blue = environment; red = asset) System Remedial Actions Remarks Mitigation LP LNG 1.2.1: Structural steel work protection for LNG leakage. Structure protected accordingly. transfer into 1.2.2: Spillage collection should be arranged to direct the LP LNG leakage that could lead to pooling of storage tank leakage over board. LNG will be directed overboard (port side of unit). Protection of the side plating of the FSRU. Dogliani page. 6

8 System Remedial Actions Remarks Mitigation LNG storage 1.2.3: Assess potential for explosive overpressure between tank top and process deck 1.3.1: Verify when sizing flare that incident radiation does not impair escape route from port, aft crane : PRV system should include method for snuffing an ignited vent release : Potential for rollover incident on FSRU: need for densimeters, stock management, and re-circulation : Size tank PRV capacity for rollover. As per above. In tank 2.1.1: Structural steel work protection for LNG leakage. As per above. LNG pump : Direct LNG leakage overboard. As per above : Structural steel work protection for LNG leakage. As per above. Recondense r entry to HP pumps Shown not to be an issue this is an inerted void space with only fully welded piping passing through it. Hydrocarbon gas detection in the void space exhausting inert gas flow will indicate any leakage into this space. Crane now removed due to requirement to reduce potential for dropped object incidents. Nitrogen snuffing systems included. Reserve capacity relief valve to protect against this event 2.2.2: Provide spillage collection beneath LP LNG As per above. process vessels, direct LNG leakage overboard : Assess means of escape from port cranes. As per above : Review position of flare relative to potential Recommended as part of detail design for the flammable gas cloud flare. Exit from HP pumps. Entry to SCV : Flange orientation to minimise jet fire effects. Point noted for detail design phase. SCV to subsea 2.5.1: Fully welded export piping from SCV's to turret. Normal part of flange minimisation in design. pipeline The use of an SSIV can be subjected to risk connection. reduction cost/benefit analysis. Export piping Process 2.5.2: Consider benefits of use of sub-sea isolation valve (SSIV) on pipeline to isolate FSRU from the pipeline inventory : Fire Risk Analysis (FRA) to assess need for passive fire protection and blast rating of forward accommodation bulkhead and turret structure. These measures have been included in the basis of design : FRA to assess fire/blast protection of lifeboats. Point noted for detail design phase : Emergency planning during detail design should consider benefits of delaying evacuation until gas inventory has been released. Point noted for detail design phase/contingency procedures : Ensure that export piping is protected from impact Included in basis of design. of helicopter falling from edge of helideck. Either direct protection or deflection of falling object : Design should, if possible, eliminate need to lift Large boom cranes previously fitted for lifting over live, hydrocarbon bearing equipment. If this is not items in the process area have been removed. feasible, lifting devices should have a high factor of Instead structural frames will be provided safety and, where possible, LNG/NG flow-rates reduced local to equipment for hoisting operations, to a minimum in exposed vessels and piping. followed by trolley transfer to the forward lay down area where a boom crane is available for transferring items to/from supply vessels. Table FSRU safety assessment remedial actions & design mitigation measures 4.2 BTT LNG transfer system To be successful, the LNG transfer operation implies that the following conditions should be simultaneously met: i) the transfer system itself works properly ii) the relative motion of the 2 vessels remains within certain limits iii) the transfer is covered by an adequate procedure. Accordingly, the aim of the risk assessment were: Dogliani page. 7

9 to evaluate the reliability and availability of the loading system; to assess under which conditions the nautical behaviour of the LNG shuttle can be controlled; to check if the transfer procedure covers all the required steps and is free of foreseeable mistakes. LNG TRANSFER PHASES BTT OPERATION SEQUENCES I) Approach (a) BTT in rest position (survival conditions) II) Connection (b) BTT raising and slewing (c) Cable acquisition (d) Pantograph downward and final alignment (e) Pantograph mechanical connection (f) Product lines connection III) Loading (g) Loading operations IV) Disconnection Reverse of sequences phase 2 V) Departure (a) BTT in rest position (survival conditions) FMECA was carried out at two different levels of detail: 1st level: 2nd level: for all operational modes, each function of each main sub-system is analysed; carried out for the sub-systems which failed the 1st level analysis; i.e.: whose individual failure can cause major or more serious effects, and where a redundant system is not provided, and the probability of occurrence of acceptance criteria are not met. Results, see table 4.3 where only ALARP issues are presented, are shown in the form of risk acceptance matrix: for each item presented there, remedial actions and design modifications are discussed in table 4.4. Severity III.g.9 II.d.2; III.g.3 2 II.b.1, II.d.1, E.1, III.g.4 E.2 1 III.g.6 F/D Probability Table BTT safety assessment (black = safety; blue = environment) No. Name & function Failure description and effect Suggested risk control options II.b.1 BTT Turn to correct position Brake system failure and loss of electrical power due to electrical and/or mechanical failure and/or bad weather. Arm free to turn, possible fall, possible Dedicated maintenance and periodic functioning check to be implemented. II.d.1 III.g. 4 II.d.2 Acquisition cable Assure mechanical link between the pantograph and the LNG carrier Articulated jumper Lower BTT horizontal slewing Acquisition winch Assure pantograph lowering and correct alignment for connection on LNG carrier injury to people around. Bad position or rupture due to excessive tension or mechanical failures. The pantograph cannot be connected. Possible injury to people in the area due to the free movement of the cable. Failure due to overpass of rotation limits. Gas leakage and possible injury to people. Loss of relative position between pantograph and shuttle due to failure in the control system. The acquisition cable is subjected to higher/lower tension than expected. Possible cable failure and injury to people in the area. Periodic check of cable position & wear. Dedicated maintenance (& replacement) of cable. Operational procedures for personnel dedicated to the connection to prevent this accident. Detection means are provided. Two safety levels (30 degr limit). Emergency disconnection is activated by the intervention of ESD1/2. Operational procedures for personnel dedicated to the connection to prevent this accident. III.g. Flanges. Mechanical failures due to wear or tear. Leak detection sensors to be installed Dogliani page. 8

10 3 Sealing. Gas leakage. around the LNG carrier manifold. III.g. 6 Main lifting system (boom hoist, outer/inner pendants). Keep crane arm position. Compensate vertical variations. E.1 Emergency shear pin of all QCDC's. Avoid unwanted emergency disconnection in normal operations E.2 Hydraulic accumulators. Oil feeding to solenoid valves. III.g. 9 Couplers. Ensure connection of BTT Cable failure due to mechanical fault or improper/inverse action due to failures in the control system. Extremely remote possibility of crane collapse leading to leakage and harm to people. Pantograph outside operating limits and subsequent emergency disconnection. Incorrect shear pin installed due to maintenance error. Emergency disconnection is prevented and BTT damaged; possible leakage. Normal disconnection is still allowed. Low pressure due to leakage or rupture of the accumulator. Emergency disconnection is prevented and BTT damaged; possible leakage. Normal disconnection is still allowed. Failure due to mechanical fault, wear end tear. Leakage & injury to people. Means of detection are already provided: cable load sensors and limit angle sensors. A specific shear pin design and/or accommodation avoiding replacement by incorrect pin to be provided. It should be checked the separation between normal and emergency functions. Leak detection sensors to be installed in the area of the LNG carrier manifold. Table BTT safety assessment remedial actions & design mitigation measures Based on the above, design modifications were implemented among them the most relevant are the following: A back-up retraction winch system. In case of failure of the main retraction system, a back-up winch placed at the boom tip will be used to retract the double pantograph to its upper position. A telemetry system to check the separation distance. Before the connection, the relative position of the two vessels have to be checked, to ensure that the double pantograph works within its operating envelope and is connected properly. A telemetry device will be used the measure this distance. Load cells on cables. In order to detect any mechanical failure or wearing of the cables guiding equipment, the cables tension will be permanently monitored: the analysis of cables tension time history will reveal abnormal friction which, if undetected, would wear cables. A triple redundancy of the double pantograph position monitoring system. The position monitoring system of the double pantograph starts automatically the emergency disconnection and activates the crane position control. To enhance the reliability of the system, a triple redundant acquisition chain is used to track the double pantograph position even if a sensor deliver a wrong information. Beam gas detectors around the connection area. Swivel joints are already provided with leak detection in the packing area. Beam gas detectors are added around the manifold in the connection area. A specific shear pin for emergency disconnection of QCDC's. A safety pin placed in the emergency disconnector avoids unwanted disconnection. During an emergency disconnection, this safety pin is sheared by the hydraulic actuator; the pin s special shape prevents its replacement (e.g. during maintenance) with any other pin unable to shear as wanted in case of emergency disconnection. 5. Applicability of the IGC Code 5.1 Regulatory framework LNG FSRU is a new concept, therefore an important aspect in the safety analysis was to identify applicable rules and to provide an interpretation of the regulatory regime pertaining to the system. A number of codes, standards and regulations (i.e. IGC, Class Rules, API, etc.) were identified and checked for applicability. In addition, the FSRU being designed for operating in the Adriatic Sea, requirements from the relevant Regional Council, the Italian Department of Health and the Italian Department of Environment as well as from the European Community were considered. Dogliani page. 9

11 Concerning the applicability of the IGC Code, summary table 5.1 was developed and adopted in the project; in this list only those items which resulted non completely applicable are shown. IGC code requirement Application / remarks Chapter 1 general 1.5 survey and certification Applicable. Arrangement to be provided for survey at sea. Chapter 2 ship survival capability 2.2 freeboard and intact stability Applicable in principle. Towing to site to be considered. 2.5 damage assumptions. Applicable. Extent of side damage may need to be adapted. Bottom damage not relevant as the FSRU is in a fixed site. 3.3 cargo pump room and cargo compressor room Chapter 3 ship arrangement Applicable. Can be extended to process machinery and equipment. However prime mover of hydrocarbon processing machinery need not to be located in safe area if they are suitable for the zone class. 3.5 access to spaces in cargo area Applicable. Provisions to be taken for inspection at sea in operation. 3.6 airlocks Can be modified by MODU code para bow/stern loading/unloading Applicable. Consideration to be given to permanent gas loading Chapter 4 cargo containment 4.3 design loads Applicable. Criteria could be adapted to site specific dynamic loads and probability of occurrence. Ditto for thermal loads. 4.7 secondary barrier Applicable. The containment period of 15 days designed for a standard voyage to be adapted to the FSRU always at sea acceleration To be adapted to site, based on seakeeping analysis/model test Chapter 5 process pressure vessels 5.2 cargo and process piping Applicable. The ANSI piping codes could also be used bearing in mind that in general materials are not valid below 29 deg. C 5.3 type tests Applicable. Number of cycles to be adapted to site 5.9 vapour return May be not necessary with the shuttle Chapter 7 cargo press./temp. control 7.1 general Applicable. Flaring can be allowed. Site specific temperatures Chapter 8 cargo tanks vent system 8.2 pressure relief systems Applicable. Flaring can be allowed Chapter 10 electrical installations 10.1 general Applicable. Neutral regime, segregated in marine practice and connected to the earth in offshore process practice, is to be clarified 10.2 types of equipment Applicable. Electric motors (safe type) could be allowed in hazardous areas. Hazardous areas extent & class according to recognised standard (API 500, IP code) Chapter 11 fire protection and extinction 11.1 fire safety requirements Applicable. The presence of a process plant is to be taken into account. Recognised standards such as NFPA can also be used. Chapter 13 instrumentation 13.6 gas detection requirements Applicable. Individual detectors may be used instead of sampling. 5.2 Specific issues Hazardous areas Table 5.1 summary of IGC Code non completely applicable requirements The definition of hazardous areas should be in compliance with one of the following codes: 1. API MODU Code 3. IP 15 "Area Classification Code for Petroleum Installations". The latter is the most conservative and commonly used in the offshore industry and therefore suggested for this specific application. Dogliani page. 10

12 According to IP 15 Code, «a hazardous area is a three dimensional space in which a flammable atmosphere may be expected to be present at such frequencies a to require special precautions for the construction and use of electrical apparatus. All the other areas are referred to as non-hazardous». «The hazardous areas are subdivided in three zones as follow. Zone 0. That part of the hazardous area in which a flammable atmosphere is continuously present or present for long periods. Zone 1. That part of the hazardous area in which a flammable atmosphere is likely to occur in normal operation. Zone 2. That part of the hazardous area in which a flammable atmosphere is not likely to occur in normal operation and, if occurs, will exist only for a short period» Internal combustion engines on the deck As far as the location of the internal combustion engines on the deck is concerned, MODU Code was considered according to which the cargo area (i.e., the portion of deck above the LNG tanks) is defined as hazardous zone of type 2. Therefore it was concluded that internal combustion engines in Zone 2 can be accepted if they are constructed to reduce the risk of ignition from sparking or high temperature in compliance with a recognised standard (e.g. IP 15). Additionally, engines situated on the roof of the cargo tanks are not normally accepted, therefore the solution of a raised deck becomes the only way ahead. In this respect, the following rules can also fit the design: IGC Code establishes (indirectly) that, to be acceptable, this deck should be higher than 2.4 m; IGC Code sets forth a minimum distance of 10 m between vent exits and the nearest intake or opening to accommodation spaces, service spaces and control stations, etc.: this provides further inputs as to how to build the raised deck, since a possible interpretation is that any potential gas leak source must be at least 10 m away from any source of ignition. So far, emphasis has been put on the gas leak as an initiating event, with the presence of sources of ignition as possible causes of escalation. Assuming the generation modules are someway enclosed, care should be taken to tackle the following issues: spark control (possible solutions: raised exhaust stack, anti-spark equipment, etc.); control of hot surfaces (e.g. by providing insulation to the exhaust stack ); discharge of gas e.g. through vents not free, but conveyed to the flare or to a safe position; examination of the possibility of combustion of soot along the stack (soot formation is probably unlikely if only methane is burnt). Now, also the reverse should be analysed: that is, a generation module can be itself an initiating event, possibly impacting on the tanks, for the following reasons: fire structural collapse (maybe as a consequence of a fire or helicopter crash) missiles (the rotor disintegration of gas turbines) The reliability of fire-fighting equipment and all the safety systems involved (detection, shutdown, etc.) must be then demonstrated when the design is at a sufficient detail level. If the module is enclosed, the walls should be capable of withstanding the missiles from gas turbines. The raised structure may require structural and thermal calculations to verify the resistance to incidents, whose likelihood is to be properly assessed. 6. Overall safety of the FSRU The risk levels associated with the FSRU concept compared with current, accepted industry practices has led to the conclusion that the FSRU risk profile is likely to at least equivalent to the risk profile of a "normal" turret-moored FPSO. The rationale leading to this conclusion was a comparison of the primary features of the FSRU with those of an FPSO, as outlined below: Process equipment the FSRU has a very open, uncongested process area with a limited amount of equipment that is thus well spaced out with no stacking required. Compared to an FPSO, this will lead to: Dogliani page. 11

13 - lower hydrocarbon release frequencies (less flanges/valves/small bore piping) - lower ignition probabilities (good natural ventilation, less accumulation risk) - reduced escalation risks (good equipment separation) - lower potential explosive overpressures. Furthermore, due to the open spaces on the FSRU, the chances of escaping from a process area incident to the TR are judged to be greater than for the FPSO; Process gases an FPSO with gas compression for injection or gas lift purposes is dealing with longer chain hydrocarbon gases at higher pressures than the export gas on the FSRU. These heavier gases are not buoyant and thus, in the event of leakage, will have a greater residence time on the unit, increasing the risk of ignition. Furthermore, they are capable of producing much higher overpressures in the event of an explosion and have higher jet fire radiation outputs; Process liquids the LNG on the FSRU will not lead to pool fire scenarios as the design allows any liquid rain out to be diverted overboard without significant environmental consequences. While oil pool fires are easier to extinguish than liquid gas pool fires, they are fought in situ and are not channelled overboard away from the surrounding equipment. The risk of a pool fire and subsequent escalation is therefore considered to be specific to the FPSO and not a significant risk contribution for the FSRU; Personnel exposure the FPSO is much more complex and hence maintenance intensive installation, with a much higher POB (Personnel On Board), i.e. 3 to 4 times more that of the FSRU. The PLL (Potential Loss of Life) in a major incident onboard the FPSO would consequently be higher. Location the function of the FSRU is such that it will be located much closer to the shore than the average FPSO, decreasing the time needed for shore based rescue and support services to be on site. FSRU features which may be considered to have a negative impact on its risk profile compared to that of an FPSO are: Cryogenic hazards the low temperatures of LNG can be the cause of structural impairment in the event of leakage and contact with normal steel. This is a well known phenomenon and recommendations have been made for the appropriate structural protection to be put in place where necessary (following detailed analysis of leakage extents); LNG storage fires in the unlikely event of tank rupture, a LNG fire may be impossible to extinguish, whereas the industry has experience of fighting oil tank fires. Evidently the probability of such an incident has to be minimised through hull/tank design, but the LNG tanks are equipped with secondary barriers and multiple levels of over pressure protection. Note that the benefit of a location close to shore would play a part in such an incident, with fire fighting support vessels on the scene more rapidly than might be the case for an FPSO. This scenario would lead to evacuation of either unit and thus would only affect the risk profile for the asset; Sloshing in LNG tanks the membrane design of LNG tanks requires the transfer of structural loading from the membrane to the hull structure. The loading on the membrane due to LNG sloshing has been studied extensively and shown to be acceptable for a known design of membrane tank, but nonetheless this remains an issue to be proven for the specific design of membrane proposed for the FSRU; Leakage due to LNG carrier unloading the connection and disconnection of LNG unloading couplings is considered to increase the risk of hydrocarbon releases local to the FSRU, when compared to an FPSO using the preferred option of a remote unloading buoy. However, with the new BTT system any such release would occur at some distance down wind from the FSRU, such that this should not significantly impact the individual risk for personnel on the unit. Ship collision risk due to LNG carrier unloading the configuration of the BTT system will lead to a similar risk of LNG carrier/fsru collision as for an FPSO tandem offloading to a shuttle tanker. It is recognised that this presents a higher risk to the FSRU than a remote Dogliani page. 12

14 7. Conclusions unloading buoy, but with the use of dedicated LNG carriers and appropriate precautions during manoeuvring, such hazards can be controlled. The studies and analyses undertaken within the AZURE project in support of the FSRU design have shown that the floating alternative for a LNG receiving terminal is a viable solution. In particular, as discussed in this paper, based on a comprehensive risk assessment, it is judged that in most instances the FSRU has a risk profile lower than the accepted risk of Crude oil FPSO and that the reduced fire and explosion risks on the FSRU relative to the FPSO outweigh the few potential higher risks identified in the analysis. Moreover, these issues are considered to present risks that can be controlled during the engineering design phase using existing LNG industry experience. 8. References /1/ Mayer M., Sheffield J., Robertson A., Courtay R., "Safe Production of LNG on an FPSO, Proceedings GASTECH 2000, Houston, November /2/ Scarpa G., Dogliani M., Ducert A., "A Floating LNG Receiving Terminal: a Possible Solution for Italy, Proceedings GASTECH 2000, Houston, November /3/ Spittael L., Zalar M., Laspalles P., Brosset L., "Membrane LNG FPSO and FSRU - Methodology for Sloshing Phenomenon", Proceedings GASTECH 2000, Houston, November /4/ Marchand D., Prat C., Besse P., "Floating LNG: Cost and Safety Benefits of a Concrete Hull", Proceedings GASTECH 2000, Houston, November Dogliani page. 13