PROGRAMME

GASTECH 2OO2

Mario Dogliani, Head, Innovation Research and Product Selection, Ship

Division, RINA SPA
MARIO DOGLIANI, graduated in Naval Architecture and Marine Engineering in 1983 at Genoa
University, is the Manager of the Innovation, Research & Products Section of RINA S.p.A. the
Italian Ship Classification Society. He joined RINA in 1985 and since then has been involved
in Research & Development activities in the fields of hydrodynamics, structural response, risk
analysis and safety of both offshore installations and ships.
PROGRAMME

Safety assessment of LNG Offshore Storage and

Regasification Unit

Mario Dogliani
RINA SPA
Italy
PROGRAMME

1. Introduction
Within the AZURE R&D project, a complete feasibility analysis of a FULL FLOATING LNG chain was
carried out covering design aspects of the LNG FPSO (Floating Production Storage Offloading), the LNG
shuttle tanker fleet, the LNG FSRU (Floating Storage Re-gasification Unit) as well as the BTT (Boom To
Tanker) LNG transfer system.
Outlines of the overall project results as well as of a few specific design aspects were presented in a series
of papers at GASTECH 2000 /1/, /2/, /3/, /4/; the aim of this paper is to complete this overview by
providing insight into the specific safety aspects of the FSRU and the related gas transfer system.
More specifically the key issues of an FSRU’s safety can be identified as follows:
ß risk acceptance criteria: the FSRU is an hybrid installation which presents features (and risks)
typical of both offshore oil storage units and of oceangoing LNG ships; hence, ad hoc risk
acceptance criteria are needed;
ß results of the risk assessment – FSRU topside: from a design standpoint, the topside is of
particular interest since, contrary to LNG oceangoing ships, the process equipment located there is
normally operating thus introducing risks neither normally considered nor regulated onboard
ships;
ß results of the risk assessment – BTT LNG transfer system: the LNG transfer system is clearly the
most critical issue from both safety and operational standpoint, detailed re-design based on risk
assessment was a must in the project;
ß applicability of the IGC Code: several safety issues can be approached based on the International
Code of Safety of Gas Carriers (IGC Code), particularly as far as LNG storage, floater’s stability,
power generation & distribution and crew accommodation are concerned.
After providing an outline of the safety assessment procedure adopted in the study, on purposely
developed for this type of unit, the above safety issues are presented in the following paragraphs,
providing details on the initial design, safety assessment, risk quantification and identified risk mitigation
measures.
As a result of the study, it was proved that present technology allows the construction and operation of
FSRU units which are at least as safe as presently operating offshore oil storage floating installations: the
basis of this statement are illustrated and documented in the present paper.

2. FSRU main characteristics

The considered FSRU, whose main characteristics are provided in table 1, is a monohull floating terminal
(see figure 1) where the LNG is received, stored, vaporised and exported to the onshore gas distribution
network.
Loa (m) - length overall 285.0
Lbp (m) - length between perpendiculars 240.0
B (m) - breadth 50.0
Dfl (t) - displacement at full load 141,600
Dbl (t) - displacement in ballast conditions 98,000
Tfl (m) - maximum draught (full load) 12.6
Tbl (m) - ballast draught 8.95
Table 1: FSRU’s main characteristics
The unit was conceived with 200,000 m3 LNG storage capacity, 10,000 m3/h transhipment flow rate and
450,000 m3/h re-gasification rate. LNG storage is achieved by means of four LNG storage tanks, through
the GTT membrane containment technique, with a boil-off rate lower than 0.15% per day. Further details
on the FSRU and its ancillary systems can be found in /2/.

Dogliani page. 2
PROGRAMME

Figure 1: FSRU and BTT systems (artistic impression)

LNG is loaded into the FSRU via tandem connection; in this situation the fundamental requirements for
the BTT system are to work in cryogenic operative conditions and to compensate the relative motions
between the FSRU stern and the LNG shuttle tanker's bow.
The BTT main components, are:
ß the boom, able to slew around the kingpost to compensate for relative angular motions ("fish tailing")
in the horizontal plane (± 70°) of the two floaters
ß the double pantograph system, which compensates for relative wave frequency motions
ß the automatic control system which monitors the relative position of the two vessels and controls the
emergency procedures.
3. Safety assessment procedure
3.1 General
The objective of the FSRU safety assessment was to review potential internal accident scenarios
associated with its operation and to identify design modifications to reduce the associated risks. This was
achieved by means of a preliminary hazard analysis of the FSRU which involved the assessment of
potential hazards, their screening and the incorporation into the design of remedial measures.
The BTT is essential for the overall safety of the combined FSRU-LNG carrier system, therefore the
objective of its risk assessment was to estimate its safety level in all the operating phases of LNG transfer.
3.2 Assessment procedure
When the AZURE project started, an established safety assessment process for either a LNG floating
chain or each single item of the chain was not available, moreover, no specific codes, standards and
regulations addressing the full chain existed. Therefore, based on the review of applicable regulations and
on the identified gaps, the following tailor-made safety assessment framework was established:
Risk assessment technique Applied to
HAZard IDentification (HAZID) FSRU topside, FSRU, BTT
Failure Mode Effect & Criticality Analysis (FMECA) BTT
Zone Analysis (ZA) FSRU topside;
3.2.1 Preliminary steps
Before starting the safety assessment, the two following preliminary steps are required:

Dogliani page. 3
PROGRAMME

ß definition of the system under analysis, of its interfaces with other systems in the LNG chain and
identification of the mission profile;
ß execution of a functional analysis, consisting in the identification of all the functions needed for the
correct completion of the mission; this typically involves a classification of functions as follows:
- main functions which are necessarily active for the completion of the mission; depending on each
mission phase, not all the functions need to be simultaneously active.
- auxiliary functions aimed at supporting main functions
- constraint functions required to fulfil external constraints (environmental, legal, etc.)
- safety functions aimed at preventing or mitigating accidents or downgraded conditions.
3.2.2 HAZID
The HAZID is generally a structured brainstorming process which identifies potential accidents in each
mission phase. Possible causes of accidents, hazards, their consequences and any safeguards, which may
be in place to prevent them, are reviewed during the HAZID, which is broken down into three sequential
stages: hazard identification (i.e. what can go wrong), frequency assessment (i.e. how likely), and
consequence assessment (i.e. how bad).
The primary aim of the exercise is to identify as many failure conditions (or Hazards) as possible for each
mission phase. The exercise is also intended to provide relevant details of the failure effects, failure
causes, failure detection and regulations and to provide an estimate of probability and severity.
It carrying out the HAZID, the following process be followed:
1. consider each mission phase individually and identify as many relevant hazards as possible;
2. identify the causes, consequences and other relevant information for each hazard;
3. record all the generated information on HAZID worksheets.
3.2.3 FMECA
FMECA is an hazard identification technique based on a single failure concept under which each
individual failure is considered as an independent occurrence with no relation to other failures in the
system, except for the subsequent effect that it might produce. Through this technique, the ways
equipment can fail, the possible causes, the effects these failures on the system performance and their
ranking according to the combination of severity and probability of occurrence are documented.
The FMECA is carried out on a series of worksheets, where the results are listed in a tabular format,
equipment item by equipment item, following a systematic bottom up approach. Two different levels of
detail were considered in the analysis:
1st level: the analysis is carried out on the overall system, and each function of each main sub-system is
analysed;
2nd level: the analysis is carried for the components of sub-systems. Each conceivable mode in which a
component or unit can fail with respect to its intended function is analysed.
The 2nd level FMECA is performed for the sub-systems which failed the 1st level analysis; i.e.:
ß whose individual failure can cause major or more serious effects, and
ß where a redundant system is not provided, and
ß the probability of occurrence of acceptance criteria are not met.
3.2.4 ZA
The aim of Zone Analysis is to provide a detailed knowledge of the risk of occurrence of hazardous
failure in a given area and the risk of propagation of a local effect to the whole area and possibly beyond.
The basic scheme of a ZA is as follows:
ß define the objective of the study (e.g. a type of hazard)
ß for each zone, carry out an inventory of hazardous materials in the zone

Dogliani page. 4
PROGRAMME

ß collect data relative to process, segregation / separation criteria, detection / alarms, emergency
response etc.
ß assume occurrence of failure and assess local and end effect as well as likelihood
ß deduce risk picture for each zone.
3.3 Risk acceptance criteria
The consequences can be evaluated using the in-house physical modelling software tools available to the
companies. Likewise frequency calculations can be undertaken using reliability data. A point to note
however is that acceptability criteria only requires evaluation of the nearest order of magnitude. For this
reason judgmental ranking may be an acceptable replacement for quantitative analysis during the
preliminary design stage.
The selected acceptance criteria for the AZURE project are provided in the following tables.
F Annual Frequency Return Period / Annual Frequency
1 <10-5 Extremely improbable
2 10 - 10-4
-5
Extremely remote
3 10-4 - 10-3 Remote
4 10-3 - 10-2 Reasonably probable
5 > 10-2 Frequent

Code Safety Description Impairment

Function
ER Escape At least two escape routes from all temporarily or Access to the TR and further
route permanently manned working stations. At least one escape to evacuation points
leading to a safe shelter area shall remain available impossible due to accidental
for a predetermined time period. conditions
TR Temporary There shall be a safe shelter area on the FPSO. Structural loss, deterioration
refuge This area will remain available for a predetermined of conditions or loss of
time period in all hazardous situations. communication and support
ES Evacuation A system for safe (dry) evacuation for on board Use of evacuation system
system personnel shall be established. Safe transfer from impossible due to accidental
the shelter area shall be part of the system. It shall conditions
remain available for a predetermined tiem period.
MS Main The structure shall be safe for the time required for No longer safe to stay on the
support the safe relocation of the unit (when relevant) or FSRU due to risk of capsizing
structure for the time needed to safely evacuate personnel or major structural breakdown
from the FSRU. of the vessel

Safety Function Required endurance time

Escape route 30 min
Temporary refuge 45 min
Evacuation system 45 min
Main support structure 45 min
DA Severity Loss of Life
1 Negligible No damage to personnel , safety functions fully available
2 Minor Light injuries to personnel and/or local damage to safety functions
3 Severe Serious injuries to personnel and/or large local damages to safety functions
4 Critical Fatalities amongst personnel locally, impairment of safety functions
5 Catastrophic A large number of fatalities amongst personnel also outside the event area, total
impairment of safety functions.

Dogliani page. 5
PROGRAMME

DB Severity Asset damage / Delay in Production

1 Negligible Less than 1 week loss of total production
2 Minor Between 1 week and 2 months loss of production
3 Severe Between 2 and 6 months loss of production
4 Critical Threaten the integrity of the unit / Between 6 months and 1 year loss of production
5 Catastrophic Total loss of unit / More than 1 year loss of total production
DC Severity Gas leakage (m3) Fire/explosion - Environment
1 Negligible < 0.06 Nil consequences
2 Minor 0.06 – 0.6 Minor or repairable consequences
3 Severe 0.6 - 6 Significant consequences. Possible interruption of the plant
4 Critical 6 - 60 Serious or critical consequences
5 Catastrophic > 60 Catastrophic or major consequences
Finally, the following risk acceptance matrix was selected: here unacceptable risks would require a
complete re-definition of the system/procedure concerned, ALARP risks would require corrective actions
and acceptable risks would not ask for actions.
5
4
3
2 Unacceptable
1 ALARP (As Low As Reasonably Practicable)
F/D 1 2 3 4 5 Acceptable
4. Results of the safety assessment
4.1 FSRU
The analysis of the FSRU has been carried out using a tabular "zonal analysis". This technique identified
numerous potentially hazardous scenarios that were assessed for frequency/gravity and screened versus
the acceptance criteria.
Results, see table 4.1 where only ALARP issues are presented, are shown in the form of risk acceptance
matrix: for each item presented there, remedial actions and design modifications are discussed in table 4.2.
5
4 2.8, 2.5
Severity

3 1.4 2.3/3.1, 1.2/2.1

2 2.2 1.3/2.4
1 1.5
F/D 1 2 3 4 5
Probability
Table 4.1 - FSRU safety assessment (black = safety; blue = environment; red = asset)

System Remedial Actions Remarks Mitigation

LP LNG 1.2.1: Structural steel work protection for LNG leakage. Structure protected accordingly.
transfer into 1.2.2: Spillage collection should be arranged to direct the LP LNG leakage that could lead to pooling of
storage tank leakage over board. LNG will be directed overboard (port side of
unit). Protection of the side plating of the
FSRU.

Dogliani page. 6
PROGRAMME

System Remedial Actions Remarks Mitigation

1.2.3: Assess potential for explosive overpressure Shown not to be an issue – this is an inerted
between tank top and process deck void space with only fully welded piping
passing through it. Hydrocarbon gas detection
in the void space exhausting inert gas flow
will indicate any leakage into this space.
LNG 1.3.1: Verify when sizing flare that incident radiation Crane now removed due to requirement to
storage does not impair escape route from port, aft crane. reduce potential for dropped object incidents.
1.3.2: PRV system should include method for snuffing an Nitrogen snuffing systems included.
ignited vent release.
1.4.1: Potential for rollover incident on FSRU: need for Reserve capacity relief valve to protect against
densimeters, stock management, and re-circulation. this event
1.4.2: Size tank PRV capacity for rollover. As per 1.4.1 above.
In tank 2.1.1: Structural steel work protection for LNG leakage. As per 1.2.1 above.
LNG pump. 2.1.2: Direct LNG leakage overboard. As per 1.2.2 above.
Recondense 2.2.1: Structural steel work protection for LNG leakage. As per 1.2.1 above.
r entry to 2.2.2: Provide spillage collection beneath LP LNG As per 1.2.2 above.
HP pumps process vessels, direct LNG leakage overboard.
Exit from 2.3.1: Assess means of escape from port cranes. As per 1.3.1 above.
HP pumps. 2.3.2: Review position of flare relative to potential Recommended as part of detail design for the
Entry to flammable gas cloud flare.
SCV. 2.3.3: Flange orientation to minimise jet fire effects. Point noted for detail design phase.
SCV to sub- 2.5.1: Fully welded export piping from SCV's to turret. Normal part of flange minimisation in design.
sea pipeline 2.5.2: Consider benefits of use of sub-sea isolation valve The use of an SSIV can be subjected to risk
connection. (SSIV) on pipeline to isolate FSRU from the pipeline reduction cost/benefit analysis.
inventory.
2.5.3: Fire Risk Analysis (FRA) to assess need for These measures have been included in the
passive fire protection and blast rating of forward basis of design.
accommodation bulkhead and turret structure.
2.5.4: FRA to assess fire/blast protection of lifeboats. Point noted for detail design phase.
2.5.5: Emergency planning during detail design should Point noted for detail design
consider benefits of delaying evacuation until gas phase/contingency procedures.
inventory has been released.
Export 2.8.1 : Ensure that export piping is protected from impact Included in basis of design.
piping of helicopter falling from edge of helideck. Either direct
protection or deflection of falling object.
Process 3.1.1: Design should, if possible, eliminate need to lift Large boom cranes previously fitted for lifting
over live, hydrocarbon bearing equipment. If this is not items in the process area have been removed.
feasible, lifting devices should have a high factor of Instead structural frames will be provided
safety and, where possible, LNG/NG flow-rates reduced local to equipment for hoisting operations,
to a minimum in exposed vessels and piping. followed by trolley transfer to the forward lay
down area where a boom crane is available for
transferring items to/from supply vessels.
Table 4.2 - FSRU safety assessment – remedial actions & design mitigation measures
4.2 BTT LNG transfer system
To be successful, the LNG transfer operation implies that the following conditions should be simultaneously met:
i) the transfer system itself works properly
ii) the relative motion of the 2 vessels remains within certain limits
iii) the transfer is covered by an adequate procedure.
Accordingly, the aim of the risk assessment were:

Dogliani page. 7
PROGRAMME

ß to evaluate the reliability and availability of the loading system;

ß to assess under which conditions the nautical behaviour of the LNG shuttle can be controlled;
ß to check if the transfer procedure covers all the required steps and is free of foreseeable mistakes.
LNG TRANSFER PHASES BTT OPERATION SEQUENCES
I) Approach (a) BTT in rest position (survival conditions)
II) Connection (b) BTT raising and slewing
(c) Cable acquisition
(d) Pantograph downward and final alignment
(e) Pantograph mechanical connection
(f) Product lines connection
III) Loading (g) Loading operations
IV) Disconnection Reverse of sequences phase 2
V) Departure (a) BTT in rest position (survival conditions)
FMECA was carried out at two different levels of detail:
1st level: for all operational modes, each function of each main sub-system is analysed;
2nd level: carried out for the sub-systems which failed the 1st level analysis; i.e.:
• whose individual failure can cause major or more serious effects, and
• where a redundant system is not provided, and
• the probability of occurrence of acceptance criteria are not met.
Results, see table 4.3 where only ALARP issues are presented, are shown in the form of risk acceptance
matrix: for each item presented there, remedial actions and design modifications are discussed in table 4.4.
5
4
Severity

3 III.g.9 II.d.2; III.g.3

2 II.b.1, II.d.1, E.1, III.g.4
E.2
1 III.g.6
F/D 1 2 3 4 5
Probability
Table 4.2 - BTT safety assessment (black = safety; blue = environment)
No. Name & function Failure description and effect Suggested risk control options
II.b.1 BTT Brake system failure and loss of Dedicated maintenance and periodic
Turn to correct electrical power due to electrical and/or functioning check to be implemented.
position mechanical failure and/or bad weather.
Arm free to turn, possible fall, possible
injury to people around.
II.d.1 Acquisition cable Bad position or rupture due to excessive Periodic check of cable position & wear.
Assure mechanical tension or mechanical failures. Dedicated maintenance (& replacement)
link between the The pantograph cannot be connected. of cable. Operational procedures for
pantograph and the Possible injury to people in the area due personnel dedicated to the connection to
LNG carrier to the free movement of the cable. prevent this accident.
III.g. Articulated jumper Failure due to overpass of rotation Detection means are provided. Two
4 Lower BTT limits. Gas leakage and possible injury safety levels (30 degr limit). Emergency
horizontal slewing to people. disconnection is activated by the
intervention of ESD1/2.
II.d.2 Acquisition winch Loss of relative position between Operational procedures for personnel
Assure pantograph pantograph and shuttle due to failure in dedicated to the connection to prevent
lowering and the control system. The acquisition this accident.
correct alignment cable is subjected to higher/lower
for connection on tension than expected. Possible cable
LNG carrier failure and injury to people in the area.
III.g. Flanges. Mechanical failures due to wear or tear. Leak detection sensors to be installed
3 around the LNG carrier manifold.

Dogliani page. 8
PROGRAMME

3 Sealing. Gas leakage. around the LNG carrier manifold.

III.g. Main lifting Cable failure due to mechanical fault or Means of detection are already provided:
6 system (boom improper/inverse action due to failures cable load sensors and limit angle
hoist, outer/inner in the control system. Extremely remote sensors.
pendants). Keep possibility of crane collapse leading to
crane arm position. leakage and harm to people. Pantograph
Compensate outside operating limits and subsequent
vertical variations. emergency disconnection.
E.1 Emergency shear Incorrect shear pin installed due to A specific shear pin design and/or
pin of all QCDC's. maintenance error. accommodation avoiding replacement by
Avoid unwanted Emergency disconnection is prevented incorrect pin to be provided.
emergency and BTT damaged; possible leakage.
disconnection in Normal disconnection is still allowed.
normal operations
E.2 Hydraulic Low pressure due to leakage or rupture It should be checked the separation
accumulators. of the accumulator. Emergency between normal and emergency
Oil feeding to disconnection is prevented and BTT functions.
solenoid valves. damaged; possible leakage. Normal
disconnection is still allowed.
III.g. Couplers. Ensure Failure due to mechanical fault, wear Leak detection sensors to be installed in
9 connection of BTT end tear. Leakage & injury to people. the area of the LNG carrier manifold.
Table 4.4 - BTT safety assessment – remedial actions & design mitigation measures
Based on the above, design modifications were implemented among them the most relevant are the
following:
ß A back-up retraction winch system. In case of failure of the main retraction system, a back-up winch
placed at the boom tip will be used to retract the double pantograph to its upper position.
ß A telemetry system to check the separation distance. Before the connection, the relative position of the
two vessels have to be checked, to ensure that the double pantograph works within its operating
envelope and is connected properly. A telemetry device will be used the measure this distance.
ß Load cells on cables. In order to detect any mechanical failure or wearing of the cables guiding
equipment, the cables tension will be permanently monitored: the analysis of cables tension time
history will reveal abnormal friction which, if undetected, would wear cables.
ß A triple redundancy of the double pantograph position monitoring system. The position monitoring
system of the double pantograph starts automatically the emergency disconnection and activates the
crane position control. To enhance the reliability of the system, a triple redundant acquisition chain is
used to track the double pantograph position even if a sensor deliver a wrong information.
ß Beam gas detectors around the connection area. Swivel joints are already provided with leak detection
in the packing area. Beam gas detectors are added around the manifold in the connection area.
ß A specific shear pin for emergency disconnection of QCDC's. A safety pin placed in the emergency
disconnector avoids unwanted disconnection. During an emergency disconnection, this safety pin is
sheared by the hydraulic actuator; the pin’s special shape prevents its replacement (e.g. during
maintenance) with any other pin unable to shear as wanted in case of emergency disconnection.
5. Applicability of the IGC Code

5.1 Regulatory framework

LNG FSRU is a new concept, therefore an important aspect in the safety analysis was to identify
applicable rules and to provide an interpretation of the regulatory regime pertaining to the system.
A number of codes, standards and regulations (i.e. IGC, Class Rules, API, etc.) were identified and
checked for applicability. In addition, the FSRU being designed for operating in the Adriatic Sea,
requirements from the relevant Regional Council, the Italian Department of Health and the Italian
Department of Environment as well as from the European Community were considered.

Dogliani page. 9
PROGRAMME

Concerning the applicability of the IGC Code, summary table 5.1 was developed and adopted in the
project; in this list only those items which resulted non completely applicable are shown.
IGC code requirement Application / remarks
Chapter 1 general
1.5 survey and certification Applicable. Arrangement to be provided for survey at sea.
Chapter 2 ship survival capability
2.2 freeboard and intact stability Applicable in principle. Towing to site to be considered.
2.5 damage assumptions. Applicable. Extent of side damage may need to be adapted. Bottom damage
not relevant as the FSRU is in a fixed site.
Chapter 3 ship arrangement
3.3 cargo pump room and cargo Applicable. Can be extended to process machinery and equipment. However
compressor room prime mover of hydrocarbon processing machinery need not to be located in
safe area if they are suitable for the zone class.
3.5 access to spaces in cargo area Applicable. Provisions to be taken for inspection at sea in operation.
3.6 airlocks Can be modified by MODU code para 6.3
3.8 bow/stern loading/unloading Applicable. Consideration to be given to permanent gas loading
Chapter 4 cargo containment
4.3 design loads Applicable. Criteria could be adapted to site specific dynamic loads and
probability of occurrence. Ditto for thermal loads.
4.7 secondary barrier Applicable. The containment period of 15 days designed for a standard
voyage to be adapted to the FSRU always at sea.
4.12 acceleration To be adapted to site, based on seakeeping analysis/model test
Chapter 5 process pressure vessels
5.2 cargo and process piping Applicable. The ANSI piping codes could also be used bearing in mind that
in general materials are not valid below – 29 deg. C
5.3 type tests Applicable. Number of cycles to be adapted to site
5.9 vapour return May be not necessary with the shuttle
Chapter 7 cargo press./temp. control
7.1 general Applicable. Flaring can be allowed. Site specific temperatures
Chapter 8 cargo tanks vent system
8.2 pressure relief systems Applicable. Flaring can be allowed
Chapter 10 electrical installations
10.1 general Applicable. Neutral regime, segregated in marine practice and connected to
the earth in offshore process practice, is to be clarified
10.2 types of equipment Applicable. Electric motors (safe type) could be allowed in hazardous areas.
Hazardous areas extent & class according to recognised standard (API 500,
IP code)
Chapter 11 fire protection and extinction
11.1 fire safety requirements Applicable. The presence of a process plant is to be taken into account.
Recognised standards such as NFPA can also be used.
Chapter 13 instrumentation
13.6 gas detection requirements Applicable. Individual detectors may be used instead of sampling.
Table 5.1 – summary of IGC Code non completely applicable requirements
5.2 Specific issues
5.2.1 Hazardous areas
The definition of hazardous areas should be in compliance with one of the following codes:
1. API 505
2. MODU Code
3. IP 15 "Area Classification Code for Petroleum Installations".
The latter is the most conservative and commonly used in the offshore industry and therefore suggested for this
specific application.

Dogliani page. 10
PROGRAMME

According to IP 15 Code, « a hazardous area is a three dimensional space in which a flammable atmosphere may be
expected to be present at such frequencies a to require special precautions for the construction and use of electrical
apparatus. All the other areas are referred to as non-hazardous …».
« The hazardous areas are subdivided in three zones as follow.
Zone 0. That part of the hazardous area in which a flammable atmosphere is continuously present or present for long
periods.
Zone 1. That part of the hazardous area in which a flammable atmosphere is likely to occur in normal operation.
Zone 2. That part of the hazardous area in which a flammable atmosphere is not likely to occur in normal operation
and, if occurs, will exist only for a short period ».
5.2.2 Internal combustion engines on the deck
As far as the location of the internal combustion engines on the deck is concerned, MODU Code was
considered according to which the cargo area (i.e., the portion of deck above the LNG tanks) is defined as
hazardous zone of type 2. Therefore it was concluded that internal combustion engines in Zone 2 can be
accepted if they are constructed to reduce the risk of ignition from sparking or high temperature in
compliance with a recognised standard (e.g. IP 15).
Additionally, engines situated on the roof of the cargo tanks are not normally accepted, therefore the
solution of a raised deck becomes the only way ahead. In this respect, the following rules can also fit the
design:
ß IGC Code establishes (indirectly) that, to be acceptable, this deck should be higher than 2.4 m;
ß IGC Code sets forth a minimum distance of 10 m between vent exits and the nearest intake or
opening to accommodation spaces, service spaces and control stations, etc.: this provides further
inputs as to how to build the raised deck, since a possible interpretation is that any potential gas
leak source must be at least 10 m away from any source of ignition.
So far, emphasis has been put on the gas leak as an initiating event, with the presence of sources of
ignition as possible causes of escalation. Assuming the generation modules are someway enclosed, care
should be taken to tackle the following issues:
ß spark control (possible solutions: raised exhaust stack, anti-spark equipment, etc.);
ß control of hot surfaces (e.g. by providing insulation to the exhaust stack );
ß discharge of gas e.g. through vents not free, but conveyed to the flare or to a safe position;
ß examination of the possibility of combustion of soot along the stack (soot formation is probably
unlikely if only methane is burnt).
Now, also the reverse should be analysed: that is, a generation module can be itself an initiating event,
possibly impacting on the tanks, for the following reasons:
ß fire
ß structural collapse (maybe as a consequence of a fire or helicopter crash)
ß missiles (the rotor disintegration of gas turbines)
The reliability of fire-fighting equipment and all the safety systems involved (detection, shutdown, etc.)
must be then demonstrated when the design is at a sufficient detail level. If the module is enclosed, the
walls should be capable of withstanding the missiles from gas turbines. The raised structure may require
structural and thermal calculations to verify the resistance to incidents, whose likelihood is to be properly
assessed.
6. Overall safety of the FSRU

The risk levels associated with the FSRU concept compared with current, accepted industry practices has
led to the conclusion that the FSRU risk profile is likely to at least equivalent to the risk profile of a
"normal" turret-moored FPSO. The rationale leading to this conclusion was a comparison of the primary
features of the FSRU with those of an FPSO, as outlined below:
• Process equipment – the FSRU has a very open, uncongested process area with a limited amount
of equipment that is thus well spaced out with no stacking required. Compared to an FPSO, this will
lead to:

Dogliani page. 11
PROGRAMME

- lower hydrocarbon release frequencies (less flanges/valves/small bore piping)

- lower ignition probabilities (good natural ventilation, less accumulation risk)
- reduced escalation risks (good equipment separation)
- lower potential explosive overpressures.
Furthermore, due to the open spaces on the FSRU, the chances of escaping from a process area incident to
the TR are judged to be greater than for the FPSO;
• Process gases – an FPSO with gas compression for injection or gas lift purposes is dealing
with longer chain hydrocarbon gases at higher pressures than the export gas on the FSRU. These
heavier gases are not buoyant and thus, in the event of leakage, will have a greater residence time
on the unit, increasing the risk of ignition. Furthermore, they are capable of producing much
higher overpressures in the event of an explosion and have higher jet fire radiation outputs;
• Process liquids – the LNG on the FSRU will not lead to pool fire scenarios as the design
allows any liquid rain out to be diverted overboard without significant environmental
consequences. While oil pool fires are easier to extinguish than liquid gas pool fires, they are
fought in situ and are not channelled overboard away from the surrounding equipment. The risk
of a pool fire and subsequent escalation is therefore considered to be specific to the FPSO and not
a significant risk contribution for the FSRU;
• Personnel exposure – the FPSO is much more complex and hence maintenance intensive
installation, with a much higher POB (Personnel On Board), i.e. 3 to 4 times more that of the
FSRU. The PLL (Potential Loss of Life) in a major incident onboard the FPSO would
consequently be higher.
• Location – the function of the FSRU is such that it will be located much closer to the shore
than the average FPSO, decreasing the time needed for shore based rescue and support services to
be on site.
FSRU features which may be considered to have a negative impact on its risk profile compared to that of
an FPSO are:
• Cryogenic hazards – the low temperatures of LNG can be the cause of structural impairment
in the event of leakage and contact with normal steel. This is a well known phenomenon and
recommendations have been made for the appropriate structural protection to be put in place
where necessary (following detailed analysis of leakage extents);
• LNG storage fires – in the unlikely event of tank rupture, a LNG fire may be impossible to
extinguish, whereas the industry has experience of fighting oil tank fires. Evidently the
probability of such an incident has to be minimised through hull/tank design, but the LNG tanks
are equipped with secondary barriers and multiple levels of over pressure protection. Note that
the benefit of a location close to shore would play a part in such an incident, with fire fighting
support vessels on the scene more rapidly than might be the case for an FPSO. This scenario
would lead to evacuation of either unit and thus would only affect the risk profile for the asset;
• Sloshing in LNG tanks – the membrane design of LNG tanks requires the transfer of
structural loading from the membrane to the hull structure. The loading on the membrane due to
LNG sloshing has been studied extensively and shown to be acceptable for a known design of
membrane tank, but nonetheless this remains an issue to be proven for the specific design of
membrane proposed for the FSRU;
• Leakage due to LNG carrier unloading – the connection and disconnection of LNG
unloading couplings is considered to increase the risk of hydrocarbon releases local to the FSRU,
when compared to an FPSO using the preferred option of a remote unloading buoy. However,
with the new BTT system any such release would occur at some distance down wind from the
FSRU, such that this should not significantly impact the individual risk for personnel on the unit.
• Ship collision risk due to LNG carrier unloading – the configuration of the BTT system
will lead to a similar risk of LNG carrier/FSRU collision as for an FPSO tandem offloading to a
shuttle tanker. It is recognised that this presents a higher risk to the FSRU than a remote

Dogliani page. 12
PROGRAMME

unloading buoy, but with the use of dedicated LNG carriers and appropriate precautions during
manoeuvring, such hazards can be controlled.
7. Conclusions

The studies and analyses undertaken within the AZURE project in support of the FSRU design have
shown that the floating alternative for a LNG receiving terminal is a viable solution.
In particular, as discussed in this paper, based on a comprehensive risk assessment, it is judged that in
most instances the FSRU has a risk profile lower than the accepted risk of Crude oil FPSO and that the
reduced fire and explosion risks on the FSRU relative to the FPSO outweigh the few potential higher risks
identified in the analysis.
Moreover, these issues are considered to present risks that can be controlled during the engineering design
phase using existing LNG industry experience.

8. References
/1/ Mayer M., Sheffield J., Robertson A., Courtay R., "Safe Production of LNG on an FPSO”,
Proceedings GASTECH 2000, Houston, November 2000.
/2/ Scarpa G., Dogliani M., Ducert A., "A Floating LNG Receiving Terminal: a Possible Solution for
Italy”, Proceedings GASTECH 2000, Houston, November 2000.
/3/ Spittael L., Zalar M., Laspalles P., Brosset L., "Membrane LNG FPSO and FSRU - Methodology for
Sloshing Phenomenon", Proceedings GASTECH 2000, Houston, November 2000.
/4/ Marchand D., Prat C., Besse P., "Floating LNG: Cost and Safety Benefits of a Concrete Hull",
Proceedings GASTECH 2000, Houston, November 2000.

Dogliani page. 13