USE OF RISK ANALYSIS FOR EMERGENCY PLANNING OF LNG CARRIERS

Transcription

1 USE OF RISK ANALYSIS FOR EMERGENCY PLANNING OF LNG CARRIERS Mr. Erik Skramstad, Det Norske Veritas, Norway; Mrs. Stine U. Musaeus, Det Norske Veritas, Norway; Capt. Steingrim Melbeo, Osprey Maritime, UK. This paper describes a risk based review and assessment of the emergency preparedness plan of a fleet of LNG carriers and is based on a study carried out by DNV for Osprey Maritime. The objective was to ensure that the emergency plans offered coverage for realistic risks and hazardous situations. The assessment aimed at identifying the scenarios/situations that should be addressed in the emergency preparedness plan and on this basis identifies discrepancies in the existing emergency planning. Risk analysis methods was applied for this purpose. The risk matrix approach combining the likelihood of an event with its consequences (severity) into a risk level for each scenario proved to be an effective tool. The evaluation was carried out for seven consequence classes; crew, 3 rd party personnel, environment, own property, down time, reputation and 3 rd party assets. Qualitative likelihood and severity categories were established for each consequence class. Scenarios representing a significant risk for either of these classes should be reflected in the company s emergency planning. The paper outlines the methodology, the type of events included and how it was used as a valuable aid in the emergency preparedness planning. Limitations and potential opportunities are also addressed in the paper.

2 1 BACKGROUND The safety in design and operation of LNG carriers has always had a high focus reflecting the perceived hazard potential as well as the potential financial impacts on shutdown and failure of delivery. The industry has developed and refined its practices gradually over years achieving very good results, but with limited overall guidance for safety management. It is therefore possible that the risk picture is fragmented and that the safety efforts are not directed to the most important areas based on a holistic view. At the same time there is an increasing attention to safety and environmental issues from all involved parties (including exporters, importers, port authorities, the crew, 3 rd party personnel, the owner as well as the society at large). On this background Osprey, one of the leading operators of LNG carriers, requested DNV to perform a risk assessment to provide a consistent basis for their review and update of the emergency planning of their LNG fleet. Osprey operates a fleet of 12 LNG carriers (two of these vessels have previously been operated by other companies). The fleet comprises vessels of different design that operate on different trades. It is evident that risk assessment and preparation of emergency plans need to be differentiated to reflect these differences in the Osprey fleet. However, as a first step it was agreed that a generic assessment for a "representative vessel" should be performed both to provide a general overview, to demonstrate the methodology and to form a basis for future refinement if required. The study concentrated on the risk assessment, with a brief review of existing emergency plans to assess whether these reflected and complied with the risk picture. The future revision and update of emergency plans were not a part of this study. These activities need to be carried out closely co-ordinated with other operational issues by the crew and Osprey operating personnel and was therefore not part of the DNV study. Figure 1 LNG carrier in transit in open sea. SKRAMSTAD, MUSAEUS, MELBO PAGE 2

3 2 APPROACH A standard qualitative risk analysis approach was adopted comprising the following main steps: Propose and agree a set of acceptance criteria forming a basis for the study Perform a hazard identification to systematically identify potential risks for different operational modes Evaluate the likelihood of the different risks Evaluate the impact of the different risks with respect to the different consequence categories. Categorise and rank the different hazards. Identify possible risk reducing measures that could be considered. The scope of this work did not comprise a detailed review of the existing emergency plans, but a preliminary screening was carried out 2.1 Methodology and Risk acceptance criteria In order to present the risk picture in dimensions reflecting the views of the different stakeholders it was agreed that the following risk categories should be addressed: Table 1 Consequence Classes and letter coding in the subsequent tables. Consequence Class Human Environment Material Assets Letter Code Crew C 3 rd party personnel P E Company property/ Ship S Down time D Reputation R 3 rd party material assets M It was agreed to employ a risk matrix approach for the assessment and the risk criteria were therefore implicitly defined by the categorisation of likelihood and consequences and the definition of acceptance bands in the risk matrix. The risk matrix combines the likelihood and the consequences of the event and an example is presented in Table 2 below. The consequence in the severity categories increases with the numbering 1 to 4 and the likelihood decreases with the numbering A to E. The definitions of likelihood and severity categories for each consequence class are presented in Table 3 and Table 4. Table 2 Example of a Risk Matrix SEVERITY A M H H H LIKELIHOOD B M M H H C L M M H D L L M M E L L L L SKRAMSTAD, MUSAEUS, MELBO PAGE 3

4 The combination of likelihood and severity represents the risk level. The combinations with a high risk potential are marked with H and dark grey shading. Medium risk level is coloured light grey and marked with M. Low risk level is blank and marked with L. The high risk level is normally considered as unacceptable and risk reducing (mitigating measures) is required to reduce the risk level. Medium risk level is in risk analysis terms called an ALARP region (As Low As Reasonable Possible). Risk reducing measures should be considered and implemented if cost benefit evaluations are favourable. The low risk level cells are considered as acceptable risk and no further risk reduction is required. Establishing the acceptable, the ALARP and the unacceptable risk regions in the matrix depends on the definition of the likelihood and severity categories. The regions alter for the different consequence classes listed in Table 1 above and were established in agreement with the LNG operator. The acceptance criteria will therefore represent and reflect the operator s visions and ambitions with respect to safety. Table 3 Definition of likelihood levels Level Description Indicative frequency (per vessel year) Definition A FREQUENT >0.5 Will occur frequently B PROBABLE May occur several times C OCCASIONAL Likely to occur during lifetime D REMOTE Unlikely to occur during lifetime E IMPROBABLE > So unlikely event, it may not be experienced Table 4 Definition of severity levels Consequence Class MINOR MAJOR CRITICAL CATASTROPHIC Human/ Crew (C) Minor injury Serious injury One fatality Several fatalities Personnel 3 rd party (P) No injury Minor injury Serious injury Fatalities Environmental (E) Negligible pollution Pollution reportable to regulatory authorities. 1) Material/ Assets Company Properties/ Ship (S) Down time (D) Reputation (R) 3 rd party Assets (M) Minor damage. Possible to repair on board. Negligible down time. Negligible or no loss of reputation. No effect on 3 rd party. Minor release. No long term effect on recipients. 2) Damage. Require seeking port and/or a longer stay in port to repair damage. Pollution reportable to regulatory authorities. 1) Major release. Limited effects on recipients. 2) Major damage. Yard repair required. Pollution reportable to regulatory authorities. 1) Uncontrolled pollution. Long term effect on recipient. 2) Loss of vessel / ship. Down time up to one day. Down time up to one week. Down time more than one week. Reputation affected locally (Terminal/ port authorities, etc.). Minor damage to 3 rd party assets close to the ship. Short repair duration. 1) Whether reportable to authorities depends on the legislation in the country/ waters the release occur. Reputation effected on the national authorities. Noted in the industry. Major damage to 3 rd party assets in the vicinity of the ship. Long repair duration. Major public interest. Loss of reputation in the industry. Extensive damage to 3 rd party assets. Considerate consequence distances. 2) Effect on recipient depends on type of recipient, which can be affected by the release. This can differ very much from location to location. SKRAMSTAD, MUSAEUS, MELBO PAGE 4

5 3 HAZARD IDENTIFICATION The hazard identification was carried out as a work group session with DNV and Osprey personnel. The group included personnel with experience in risk analysis methodology, and familiarity with LNG ship design and operations. The Hazid was carried out as systematic review of all operations in all operational modes reviewing the different sections of the vessel, the operations and also external events. 1. Structural failure to hull 2. Structural damage due to incorrect loading 3a Overfilling of tanks 3b Overpressure of tanks 4. Unignited leak in the cargo system 5. Release of Nitrogen 6. Release of bunker oil 7. Fire in engine room 8. Accommodation fire 9. Fire on open deck 10. Fire in cargo handling module 11. Fire in void spaces around LNG tanks 12. Fire in void spaces like ballasting tanks 13. Fire in forward storage area 14a Explosion in engine room due to fuel gas 14b Explosion in engine room due crank house failure 15. Boiler explosion Example of identified Hazards: 16. Explosion in accommodation 17. Explosion in open area on deck 18. Explosion in cargo handling module 19. Explosion in void spaces around tanks 20. Explosion in ballasting tanks 21. High wind/ waves 22. Earthquake- tsunami 23. Lightning 24. Sabotage 25. War action 26. Collision 27a Workplace accident 27b Crane operations 27c Working in tanks/ enclosed spaces 28. Operating error 29. Failure of mooring system due to tidal effect 30. Leak from loading arm 31. Loss of instrumentation during loading operation 32. ESD not functioning 33. Loss of power supplies 34. Loss of emergency powers 35. Loss of Nitrogen 36. Loss of hydraulic systemcompressed air 37. Stowaway 38. Unignited leak from tank 39. Ignited leak from tank 40. Loss of navigational or manoeuvring capabilities 41. Grounding 42. Hitting the quay 43. Mooring failure/ anchor dragging 44. Man over board 45. Fire on bridge 46. Piracy/hijacking 47. Fire onboard neighbouring vessel 48. Illness or epidemics 49. Loss of stability 50. Gas freeing 51. Upstart after repair Figure 2 One of Osprey Maritime s LNG carriers at terminal. SKRAMSTAD, MUSAEUS, MELBO PAGE 5

6 4 RISK ASSESSMENT The identified hazards were categorised based on the likelihood and impact by the work group. The different hazards were considered for the following operational modes: Loading/ offloading at Terminal Entering/ Leaving Port Transit close to coast/ shore Transit in open sea Preparation for inspection/repair /recommissioning T (Terminal) P (Port) C (Coast) S (Sea) R This review was carried out for all hazards, operational modes and all risk categories. The results were summarised in tabular formats as illustrates for some of the events in Table 5. The notation in the likelihood column refers to the coding in Table 3 and the severity categories as defined in Table 4. The consequences, which are highlighted in bold in the table show that the risk (combination of frequency and severity) falls into the ALARP-region when implemented into the risk matrix as shown in Table 6. SKRAMSTAD, MUSAEUS, MELBO PAGE 6

7 Table 5 OP.MO DE: Example of risk categorisation. Loading or offloading at terminal (T) NoHazid description T4 Leak on the cargo system; unignited release continuous flow. This comprises all leak sizes that cannot easily be stopped by operational routines to a rupture in a pipe. Potential consequence is brittle fracture of hull or secondary structure. Frost burns for personnel. No consequences to 3 rd party anticipated. T5 Release of liquid nitrogen. Can give local effects to steel due to low temperature. Possible frost burn for personnel T6 T7 T8 T9 Release of bunker oil during loading operation. Very low risk of fire and personnel injuries. The oil may mess up nearby quays affecting 3 rd party assets Fire in the engine room. Since always manned during this operational mode, the escalation potential is considered low. The event is considered not to effect 3rd party. All fires will have to be reported to terminal, thus local reputation is affected. Accommodation fires. The crew present in the accommodation most likely quickly extinguishes these fires. It is considered to be less likely to occur than fire in the engine room, but still a remote probability. If developing to a large fire more crewmembers may be affected by the accident, than for an engine room fire. 3 party not likely to be affected. Fires on open deck. Ignited cargo release. The consequences depend on the release size and the development of the event, including shut down. Early ignition gives smaller consequences than late ignition. Most likely there is a flash fire which burn back to a smaller fire at the release location (jet or diffusive, depending on pressure in the system and if the release hits obstructions or not). Whether the fire may escalate to the LNG tanks depend on the possibility to shut down fuel to the fire. Likeliho Conseque od nce Occasion al (C) Occasion al (C) Occasion al (C) Remote (D) Remote (D) Remote (D) C2, P1, E1, S2, D3, R3, M1 C2, P1, E1, S2, D2, R1, M1 C1, P1, E3, S1, D2, R3, M2 C3, P1, E1, S2, D3, R3, M1 C3, P1, E1, S2, D3, R3, M1 C4, P3, E1, S3, D4, R3, M2 E P Comment Ignited events are considered below (T9). Loading operation is carried out simultaneously with the LNG operation. Less attention by the operators to nitrogen than LNG. Environmental effect depends on the amount released and recipient in the terminal area. The likelihood and corresponding consequences depend on the fire size. The results listed in the columns refer to a large fire. Minor fires are assessed to give one category lower, both for likelihood and consequences. Same as for T7 (Explosion see T16) Escalation not included. (Explosion see T17) SKRAMSTAD, MUSAEUS, MELBO PAGE 7

8 Each event was plotted into the risk matrix as illustrated in Table 6 below. Those events falling into the medium or high risk categories were followed up in the emergency planning process. The letter notation refers to the operational modes and the number refers to the Hazid number, both presented earlier. Table 6 Risk results for Crew SEVERITY 1 Minor injury 2 Serious injury 3 One fatality 4 Several fatalities A Will occur frequently B May occur several times T27a P27a C27a S27a LIKELIHOOD C Likely to occur during lifetime D Unlikely to occur during lifetime T6 P4, P43 C4 S4, S40 T13, T45, T49 P5, P6, P13, P49 C5, C6, C13, C49 S5, S6, S13, S14b, S49 T4, T5, T23, T27c, T48 P42, P44, P45,P48 C45, C48 S45, S48 R2 T10, T15, T38, T47 P10, P15, P18, P23, P38, P41 C10, C15, C18, C23, C38, C41 S7, S10, S14a, S15, S18, S23, S38 R1 T27b P46 C44, C46 S44 T7, T8, T14a/b, T26 P7, P8, P9, P14a/b, P26 C7, C8, C9, C14a/b, C26 S8, S9, S26, S46 T1, T2, T3a, T9, T18, T21, T22, T24, T25, T29, T30, T39 P24, P25, P39 C1, C24, C25, C39 S1, S24, S25, S39 E So unlikely event, it may not be experienced T12 P12 C12 S12 P17 C17 S17 T3b, T11, T16, T17, T19, T20 P1, P3b, P11, P16, P19, P20, P22 C3b, C11, C16, C19, C20, C21 S3b, S11, S16, S19, S20, S21 SKRAMSTAD, MUSAEUS, MELBO PAGE 8

9 Since 4 operational modes and 7 consequence classes were considered for some 30 hazards (average for each operational mode) around 840 entries were considered in the different risk matrices. In order to ease the readability, the risk picture was summarised in summary tables as shown in Table 7 for future follow up. Unacceptable risk is marked in black, risk in the ALARP region is marked in grey shading and acceptable risk is marked with a hyphen. Blank entries indicate either that the scenario is not applicable for the particular operational mode or that separate evaluations are required. Table 7 Risk result summary Scenario Crew 3 rd party personnel SKRAMSTAD, MUSAEUS, MELBO PAGE 9 Envir. Ship Downtime Repute 3 rd party material T P C S T P C S T P C S T P C S T P C S T P C S T P C S 3b Overpressure Unignited leak in the cargo system Release of Nitrogen Release of bunker oil Fire in engine room Accommodation fire Fire on open deck Fire in cargo handling module a 14b Explosion in engine room due to fuel gas Explosion in engine room due crank house failure Boiler explosion Earthquake- tsunami Lightning /25 Sabotage/war actions Collision a Workplace accident Loss of emergency powers 35 Loss of Nitrogen 38 Unignited leak from tank Ignited leak from tank Loss of navigational or manoeuvring capabilities Grounding Mooring failure/ anchor dragging Man over board Piracy/hijacking Fire onboard neighbouring vessel Illness or epidemics Loss of stability

10 5 RESULTS Six events stands out in the respect they enter either into ALARP or unacceptable level for nearly all the consequence classes and operational modes. These are sabotage, war action, collision, ignited release from a cargo tank including overfilling during loading operation and structural damage to hull. These situations should particularly be focused upon in the further emergency preparedness work. For the other events that have been assessed into the ALARP region, a review of the company s procedure in order to address where the risk can be reduced is recommended. Such a review includes the emergency planning, which can be used to reduce the consequences of the event. Operating procedures should also be included. Good operational practice affects the likelihood of the event occurring. 5.1 Scenarios that potentially could lead to unacceptable risk There are few scenarios resulting in unacceptable risk and the only consequence classes affected are 3 rd party personnel and reputation. There is no scenario representing an unacceptable risk to the crew, the environment, company properties, down time or 3 rd parties property. For 3 rd party human life the scenarios that potentially could lead to unacceptable risks include: sabotage war action collision ignited release from a cargo tank including overfilling during loading operation. The three first scenarios are dependent of actions caused by an outsider. The possibilities of reducing the risk are therefore limited. However in all cases company procedures should be reviewed in order to address where the risk can be reduced. Ignited release from a cargo tank including overfilling during loading operation is the two identified scenarios, which could give unacceptable risk for the company reputation. These are the same scenarios, which give unacceptable risk to 3 rd party human life. 5.2 Scenarios in the ALARP region ALARP stands for that risk should preferably be reduced to as low as reasonable possible. Basically for all the scenarios that have been evaluated into the ALARP region, the resulting action is a review of the company s procedure in order to address where the risk can be reduced. Such a review includes the emergency planning, which can be used to reduce the consequences of the event and the operational procedures, which can reduce the likelihood of an event occurring. Some short comments are only summarised for each consequence class. Risk to crew The crew is exposed in many of the cases because they are present when the event initiate. This applies for instance to releases during loading/ offloading, fires on the bridge, fires/explosion in the engine room, and fires in the accommodation area. Otherwise some of the situations include an outsider, such as sabotage, war action, collision or piracy Risk to 3 rd party person When evaluating risk to 3 rd party a general assumption has been applied; a gas cloud cannot reach other 3 rd party when in open sea. Collision events are the only scenario that may affect 3 rd party for this operational mode. A fire or explosion in the engine room has been assessed to give collision as a secondary effect when sailing in port or close to shore. This latter situation is considered unlikely. The terminal personnel are most exposed as 3 rd party personnel. In order to potentially affecting the inhabitants, the scenario has to include a catastrophic failure of a cargo tank. SKRAMSTAD, MUSAEUS, MELBO PAGE 10

11 5.2.2 Risk to environment Environmental risk is related to release of bunker oil, either during loading operation, operational errors during sailing, grounding or that a LNG tank is destroyed leading to total loss. The environmental effect may differ considerably, depending both on the location of the release (which recipients are present) and country (governmental legislation). However no release has been assessed to give long term effects on recipients in this qualitative assessment Risk to company properties Company properties are synonymous with the ship itself. Events with the potential of causing a large repair enter the ALARP region. This is fire/ explosion in the different areas of the carrier (engine room, cargo system and deckhouse). It is assumed that fires in manned areas, as for the engine room when being at the terminal, entering/leaving the port or sailing close to shore are detected early. Such fires are given a lower damage category than when being unmanned. Otherwise collisions, grounding and hitting quay are likely to give large damage requiring major repair. This applies also to some natural causes such as high wind/waves and tsunami Risk to down time The events mentioned above, which required large repair, also cause down time for the company. But also all the other fires as well as unignited events may give down time more than one day, in order to repair or just to investigate the event. Man overboard and piracy scenarios can also lead to down time for a carrier Risk to reputation The risk of loss of reputation has been more difficult to assess. In particular since it is so many factors that can affect the result such as media interest in the event. As general rule scenarios with large consequences has been assessed to affect the reputation, especially those affecting inhabitants. In addition situations giving either severity category 3 for the environment or severity categories 3/4 for the down time (down time more than one day) have been considered sensitive to the company s reputation Risk to 3 rd party assets Events causing a large release from the cargo tanks may affect 3 rd quay or collisions have been evaluated into the ALARP region. party assets. Otherwise contact with 6 EMERGENCY PLANNING Based on the DNV report on the risk assessment, the preliminary review of emergency plan and a brief report summarising the practices employed in developing emergency plans offshore, Osprey personnel incorporated the results into a new comprehensive emergency plan. This document applies for all vessels in the Osprey fleet supplemented by ship and trade specific additions. The emergency plan describes the emergency organisation, roles and responsibilities, reporting lines etc. The emergency plan address all identified hazards as listed by DNV supplemented by additional scenarios. A table is included for each of the hazards listing required/recommended actions for the different operational modes. The table specifies the actions, who is responsible and timing. When required supplementary explanatory information is included. An example of one of these tables is shown below. SKRAMSTAD, MUSAEUS, MELBO PAGE 11

12 Table 8 Sample page from Osprey Maritime s Emergency plan document 7 CONCLUSION The risk analysis approach has provided a consistent and complete basis for the emergency planning. The results from qualitative risk analysis are often disputed as subjective and inaccurate. And a thorough treatment of all risks for all stakeholders from a complex ship operation is a vast task and in practice it is necessary to make simplifications. But the actual results from the risk analysis are not the most important output; the main benefits from applying risk analysis as a basis for the emergency planning have been: The systematic and documented approach giving a higher degree of confidence that credible hazards have been identified, considered and evaluated. The overall approach considering all operational modes and potential risk impact on the different parties allow for focused and balanced implementation of safety measures. The structured approach involving operational personnel in the planning and thereby creating ownership and awareness. Not only did the results from the risk analysis provide structured input for the purpose of prepare and implement useful contingency plans and enable Osprey Maritime to identify where additional safeguards should be put in place, it also provide very useful information for the planning of emergency drills. Therefore, not only has it helped us to improve the reactiveness (contingency plans), but equally important the proactiveness. (safety training and drills) Osprey Maritime are at the moment preparing new procedures for the Safety & Training Manual which will enable the Captain and his staff to better plan and execute onboard emergency drills. The procedures will be closely linked with the Casualty Contingency Plans. - o0o - SKRAMSTAD, MUSAEUS, MELBO PAGE 12