10th International Symposium on Practical Design of Ships and Other Floating Structures

Houston, Texas, United States of America

2007 American Bureau of Shipping

Formal Safety Assessment of LNG Tankers

Erik Vanem1), Pedro Anto2), Francisco Del Castillo de Comas3), Rolf Skjong1)
1)
DNV Research & Innovation, Det Norske Veritas
Hvik, Norway
2)
Instituto Superior Tcnico
Lisboa, Portugal
3)
Navantia
Madrid, Spain

Abstract and evaluated in terms of cost-effectiveness. Finally,

LNG carriers are normally considered to be among the
safest vessels in the merchant fleet today. They have a
reputation within the industry of being well designed,
constructed, maintained and operated with a high focus
on safety in every aspect. However, in order to quantify
the risk level, as well as evaluate design options for
improved safety, this paper presents a Formal Safety
Assessment of the world fleet of oceangoing LNG carri-
ers. Modular risk models for critical accident scenarios
have been developed and in this way, high-risk areas
pertaining to LNG shipping operations have been identi-
fied. Both the individual and the societal risk level were
demonstrated to lie within the ALARP area, suggesting
that further risk reduction from cost-effective risk con-
trol options should be required. It was further shown
that several cost-effective risk control options related to
navigation exist, and these should be recommended for
mandatory implementation. Other options that were
evaluated turned out to be less cost-effective.
Keywords
Maritime safety; Formal safety assessment; Risk analy-
sis; LNG carriers; Design and operation; IMO.
Introduction and Background
The aim of this paper is to quantify the risk level per-
taining to LNG shipping by employing the Formal
Safety Assessment methodology on the current fleet of
oceangoing LNG carriers. Furthermore, it will identify
and evaluate various design options and operational
measures for further risk mitigation in terms of cost-
effectiveness. The outline of the paper is as follows:
First, the introduction and background information will
be given. Second, risk acceptance criteria will be elabo-
rated upon in accordance with the approach described in
MSC 72/16 (Norway, 2000). Then, the risk models are
outlined and utilized in order to estimate the overall
risk. Next, risk control options are identified, prioritized
some recommendations for further research are made,
followed by the conclusion.
The SAFEDOR Project
The study presented in this paper was carried out within
the EU-sponsored research project SAFEDOR (Bain-
bridge et al., 2004). One of the aims of this project is to
encourage innovative ship design for more effective,
cleaner and safer maritime transport. In order to facili-
tate this, concepts for a risk-based regulatory framework
and a risk-based design processes will be developed.
This will allow for approval of novel solutions in ship
design; designs that might have equal or better safety
performance than conventional designs even though
they may violate current prescriptive requirements.
As a part of the SAFEDOR project, Formal Safety As-
sessment (FSA) studies on various ship types have been
initiated. This paper presents the FSA on LNG carriers.
Other shiptypes that have been subject to FSA within
SAFEDOR are cruise, RoPax and container vessels.
Liquefied Natural Gas and LNG Shipping
Liquefied Natural Gas (LNG) is composed mostly of
methane and is a cryogenic liquid at approximately
162 C at normal atmospheric pressure. When vapor-
ized, its flammability range is between approximately 5
to 15 percent by volume. LNG spills are associated with
hazards such as pool fires and ignition of drifting vapor
clouds in addition to hazards related to the cryogenic
temperatures. In its liquid state, LNG is not explosive,
and LNG vapor will only explode if ignited in a mixture
with air within the flammability range and within an
enclosed or semi-enclosed space. Natural gas may also
present an asphyxiation hazard. LNG is not toxic and
will not be persistent if spilled in a marine environment.
LNG weighs less than water, thus LNG spilled on water
will float.
In liquefied form, the volume of LNG is 600 times less
than the same amount of natural gas at room tempera-
tures. LNG shipping is therefore an economical way of
transporting large quantities of natural gas over long
distances. LNG carriers are purpose-built tank vessels
for transporting LNG at sea.
The current world fleet of LNG carriers is relatively
small, as of October 2006 it contained 209 ships, but it
has been steadily increasing in recent years. A further
increase is expected in the coming years, and the order
books contain 136 ships. Fig. 1 illustrates the LNG fleet
development, and includes a forecast until 2010. The
total number of LNG carrier shipyears is 2838 (includ-
ing 2005). 1857 of these are accumulated since 1990.
Fleet development - LNG tankers
400
350
300
250
# ships
200
150
100
50
0
1965 1975 1985 1995
Year
Fig. 1: LNG fleet developments 1965 2005 and fore-
cast until 2010.
The average size of the current fleet is almost 123,000
m3, whereas the average size of vessels currently in the
order book is 166,000 m3. LNG super-tankers with
capacities of 200,000 250,000 m3 are foreseen in the
near future (Scheibach et al., 2006).
All LNG carriers are double hull vessels, but there exist
different cargo containment systems of independent or
integrated cargo tanks. Two main types of vessel de-
signs dominate the current LNG fleet, namely the mem-
brane tank designs and the spherical tank designs. In
membrane tank designs, the cargo containment system
consists of a very thin invar or stainless steel double-
walled, insulated cargo envelope that is structurally
supported by the ships hull. The spherical tank carriers,
also referred to as Moss tankers, have spherical alumi-
num tanks or prismatic shaped stainless steel tanks that
are self-supporting within the ships hull. These tanks
are insulated externally. Each of the main types of LNG
vessel designs are constituting about half of the fleet
(the actual distribution is 50% membrane ships, 45%
spherical tankers and 5% of other types of LNG tankers
as of 2005), but membrane tankers are dominant among
LNG new buildings.
The FSA Approach
FSA is a standard risk assessment with the aim of de-
veloping maritime safety regulations in a structured and
systematic way. FSA can be used in the evaluation of
new regulations as well as for comparison between
existing and possibly improved regulations. It aims at
balancing safety and environmental protection levels
with costs. Both technical and operational issues, in-
cluding the influence of the human element may be
incorporated in an FSA. The methodology is described
as a 5-step process:
0. Preparatory steps
1. Identification of hazards
2. Risk analysis
3. Identifying risk control options
4. Cost benefit assessment
5. Recommendations for decision-making
IMO has developed guidelines for FSA studies (IMO
2002). A number of FSA studies have been reported to
IMO according to these, and decisions have been made
based on such submissions (IACS 2004).
Scope Definition
This paper describes a high-level, generic FSA on LNG
carriers, and the scope is the entire fleet of ocean-going
LNG carriers. Historic accident experience indicates
that the risk level of the main types of LNG carriers is
comparable; hence a generic LNG carrier is assumed
representative for all types of LNG vessels. It is noted
2005
that membrane tanks have experienced leakage through
its primary barrier, and are also believed to be more
vulnerable to the effects of dynamic loads and sloshing,
but risk contributions from such scenarios are assumed
small. Thus, detailed studies of specific ships as well as
specific trades and port environments are out of scope.
For the purpose of this generic analysis, a 138,000 m3
membrane LNG vessel currently under construction at
Navantia will be used as a reference vessel where
needed. The cargo capacity of this reference vessel is
within the main range of LNG carriers, and its speed is
typical for this type of vessels. The main characteristics
of the vessel are given in Table 1.
Table 1: Main characteristics of the reference vessel
Length overall 284.40 m
Breadth (molded) 42.50 m
Draft design (molded) under keel 11.40 m
Double bottom depth 2.9 m
Double side width 2.32 m
Total cargo tank capacity 138,000 m3
Service speed at design molded draft 19.50 knots
Accommodation capacity 40 personsa
a
including 4 Suez canal workers
Only the shipping phase of the LNG chain is consid-
ered, covering loading at the export terminal, the actual
voyage and unloading at the receiving terminal. Risks
pertaining to exploration, production, liquefaction, stor-
age and regasification of natural gas are considered out
of scope. Furthermore, only the operational phase of an
LNG vessel is considered, and risks associated with
construction, repairs in dock and scrapping of LNG
vessels are out of scope.
Security issues are regarded as out of scope. The envi-
ronmental risks associated with LNG shipping are as-
sumed small and not relevant to this study since LNG is
non-toxic and non-persistent. Thus, the focus of this
study has been on safety and risk to human lives al-
though third party risks to people on shore are left out of
the study. It is argued that such risks should rather be
investigated in specific risk analyses pertaining to spe-
cific LNG terminals or LNG trades. These issues are
more related to the placement of LNG terminals than to
IMO regulations for maritime safety. Thus, this study
only considers the risks to LNG crew and crew and
passengers onboard other vessels. Finally, the focus has
been on accidents of a certain scale, and high frequency,
small-scale occupational accidents have not been em-
phasized.
Risk Acceptance Criteria
In order to evaluate the risk, appropriate risk acceptance
criteria should be established prior to and independent
of the actual risk analysis. For this risk analysis on LNG
carriers, risk acceptance criteria for individual and so-
cietal risks were derived for crew as well as for passen-
gers onboard other vessels that might be affected by a
possible LNG accident.
Criteria for Individual Risk
A thorough review of alternative risk acceptance criteria
was presented in Skjong et al. (2005). Based on this
review, the acceptance criteria for individual fatality
risk to crew presented in Table 2 were adopted for the
current study. These apply to the risk level experienced
by an exposed crewmember. The individual risk to third
parties is intuitively assumed to be negligible.
Table 2: Individual risk acceptance criteria for crew
Intolerable risk > 10-3 Per year
ALARP area 10-6 10-3 Per year
Negligible risk < 10-6 Per year
Criteria for Societal Risk
Societal risk acceptance criteria for crew were estab-
lished based on the approach described in Norway
(2000). According to this method, acceptance criteria
are associated with the economic importance of LNG
shipping, calibrated against the average fatality rate per
unit of economic production. Based on reasonable esti-
mates of daily rates, operational costs and capital costs
due to initial investments, the economic value of LNG
shipping was estimated to be USD 1.6 million per
shipyear. The risk acceptance criteria that were derived
based on these estimates are illustrated in Fig. 2. It
should be noted that these criteria are somewhat stricter
than the criteria proposed for tankers in general in Nor-
way (2000).
Risk acceptance criteria for LNG tankers
1,00E-01
F (Frequency of N or more fatalities)
1,00E-02
1,00E-03
1,00E-04
1,00E-05
1,00E-06
1 10 100
Fa ta litie s (N)
Fig. 2: Societal risk acceptance criteria for crew
These societal risk acceptance criteria can also be as-
sumed appropriate for crew onboard other vessels.
However, for passengers, more strict criteria might be
appropriate. Thus, for the purpose of this study, societal
risk acceptance criteria for passengers (onboard other
vessels) with anchor points that are one order of magni-
tude lower than for the criteria for crew will be used.
Critical Accident Scenarios
Operational Experience with LNG Shipping
Marine transportation of LNG has gradually increased
since the first LNG cargo was transported by sea in
1959 and the first purpose built LNG tanker was en-
gaged in commercial trade in 1964. Thus, more than 40
years of operational experience with LNG carriers has
accumulated over the years, and this experience will be
utilized as an indication of the current risk level.
An accident survey reveals information of 158 events,
with or without LNG spillage, involving LNG carriers
larger than 6000 GRT in normal operation (Vanem et al.
2006). The breakdown of these events on ship types is
illustrated in Fig. 3. It is emphasized that this only illus-
trates the total number of incidents without considering
the severity of the accidents or the relative population of
membrane and spherical carriers.
The available material indicates that accidents have
happened more often on spherical type LNG ships dur-
ing the history of LNG shipping. It also indicates that
accidents have been more frequent on membrane ships
during the last 20 years. Available statistics are too
sparse to draw any definite conclusions, and conclusions
cannot be drawn without considering the population of
each LNG carrier type. It is noted that accidents have
occurred for all types of LNG carriers. For the purpose
of this high-level study, the accident frequency is hence-
forth assumed independent of the LNG carrier type.
 Historic LNG incidents These are believed to constitute the main risk contribu-
Other Unknown tors and risks from other scenarios are assumed negligi-
11 % 1% ble in comparison. It is noted that the accident catego-
Spherical ries listed above are general maritime accident scenarios
51 % that can occur for all types of ships, but the potential
consequences and the possible further escalation of the
Membrane
37 % scenarios are specific to LNG carriers due to the charac-
teristics of its LNG cargo.
LNG incidents, 1985 and later
Other Unknown Risk Modeling
4% 2%
Spherical
33 %
In the following, overall risk models for each accident
category will be developed and the frequencies and
Membrane
consequences associated with each of the sub-models
61 % will be further investigated in order to estimate the risk.
Fig. 3: Breakdown of LNG accidents on shiptype
Frequency Estimation
Accident Categorization The frequency estimates of initiating events are based
The 158 known relevant accidents can be broken down on the historic frequencies in Table 3. However, some
on a few generic accident types as presented in Table 3. modifications are deemed necessary for the estimates
pertaining to the fire and explosion scenario and the
Table 3: Breakdown of LNG accidents on categories loading/unloading scenario.
Accidents Frequency 50% of the reported fire and explosion accidents were
Accident category vent riser fires. Since these incidents are not safety-
(#) (per shipyr)
Collision 19 6.7 x 10-3 critical, they were disregarded. The initiating frequency
of fire and explosion is reduced accordingly, i.e. to 1.8 x
Grounding 8 2.8 x 10-3
10-3 per shipyear. 22 loading/unloading incidents have
Contact 8 2.8 x 10-3 been reported, but only 9 of these reported any leakage
Fire and Explosion 10 3.5 x 10-3 of LNG. This corresponds to a frequency of 3.2 x 10-3
Equipment/machinery 55 1.9 x 10-2 for loading/unloading accidents resulting in leakage of
LNG, and this frequency will be used in the risk as-
Heavy weather 9 3.2 x 10-3
sessment. The initial frequencies used for each accident
Loading/unloading 22 7.8 x 10-3 scenario are presented in Table 4. If these frequencies
Containment system 27 9.5 x 10-3 are compared to statistics for other generic vessel types,
Total 158 5.6 x 10-2 such as oil tankers, chemical tankers, LPG tankers and
bulk carriers, they are found to agree reasonable well. In
general, the accident frequencies are found to be some-
These accident categories are in general agreement with what lower for LNG carriers than for these other types
the scenarios identified during the hazid (stvik et al. of vessels, but this may be explained by the high focus
2005). However, some of the categories above are not on safety on these ships and the generally high compe-
particularly associated with severe consequences. For tence level of the LNG crew.
example, equipment and machinery failure that lead to
subsequent events such as collision, grounding or fire Table 4: Frequency estimates for initiating events
have been assigned to the category corresponding to this Frequency
subsequent event. Hence, the remaining equipment and Accident category
(per shipyr)
machinery failure incidents are not believed to be very Collision 6.7 x 10-3
critical to ship or crew safety. Also, incidents due to bad
weather and failure of the cargo containment system Grounding 2.8 x 10-3
that are not leading to any subsequent accidents are Contact 2.8 x 10-3
believed to constitute a relatively small risk contribu- Fire and Explosion 1.8 x 10-3
tion. Thus, the five following generic accident catego- Leakage of LNG; loading/unloading 3.2 x 10-3
ries were selected for further study in the risk analysis:
Collision Consequence Estimation
Grounding The expected consequences for each of the selected
Contact (Striking any fixed or floating objects scenarios will be assessed by utilizing event tree tech-
other than another ship or the sea bottom) niques. First, an event tree for each accident scenario
will be constructed based on conceptual risk models.
Fire or explosion Then, these event trees will be quantified using a variety
Incidents while loading/unloading of cargo of different techniques for the different branches. This
procedure will be outlined in the following. The esti-
mates in Table 4 will be used as initiating frequencies.
Event Tree Configuration
As the event trees tend to grow complex, it is not feasi-
ble to describe them in detail within the format of this
Finally, if the crew is unable to evacuate in time, there
might be fatalities due to LNG hazards or the sinking of
the ship. The grounding and contact risk models that
form the basis for event trees are illustrated in Fig. 5.
Grounding/contact
Grounding or contact frequency
frequency model

paper. However, the conceptual risk model for each Loading Probability of being loaded/in ballast
condition model
accident scenario will be presented in the following, and
it is these that dictate the structure of the event trees. Damage extent Probability distribution of damage
model
A typical collision scenario with an LNG carrier might
Cargo leakage
develop in the following way: First, a collision occurs frequency
Probability of cargo release

between two ships. The collision might occur when the

LNG hazard Probability distribution of
LNG carrier is in ballast or when it is fully loaded. The model LNG hazards materializing
LNG vessel might be the struck or the striking ship. If
Survivability Probability of
the LNG vessel is the striking ship, the likelihood of model sinking
further escalation of the accident is regarded as small as Evacuation
it will receive the collision impact in the bow in front of model

the collision bulkhead. If the LNG carrier is the struck Number of

ship, the collision might cause damage that penetrates
the outer and inner hulls depending on the collision
energy. If penetrating the inner hull, it might cause
leakage of cargo. This might result in materialization of
an LNG hazard such as pool fire. Cryogenic tempera-
tures of LNG or heat generated from a pool fire might
deteriorate the strength of the ship and may eventually
lead to sinking. If LNG hazards materialize or the ship
sinks, failure to evacuate in time may lead to a number
of fatalities among the crew. Finally, for some of the
possible LNG hazards, fatalities may occur among crew
or passengers onboard the other vessel. The risk model
illustrated in Fig. 4 describes a typical collision sce-
nario, and an event tree is constructed according to this.
Collision
frequency
Collision frequency
Loading
Probability of being loaded/in ballast
condition model
Damage extent
Probability distribution of damage
model
Cargo leakage
Probability of cargo release
frequency
LNG hazard
model
Survivability
model
Third parties
model
fatalities, LNG
Consequence
Fig. 5: Grounding or contact risk model
It is distinguished between three types of fire scenarios,
according to where onboard the fire starts: in the ma-
chinery spaces, in accommodation areas or day rooms
and in the cargo area. For fires starting in machinery
spaces or in accommodation areas, it is deemed highly
unlikely that it will spread to the cargo area and no LNG
specific hazards are assumed. Thus, these scenarios will
resemble similar fire accidents on other cargo ships such
as oil tankers. The compressor room is regarded as the
most likely place in the cargo area for a fire to break
out, and such fires will be specific to LNG carriers. For
a compressor room fire, the following scenario is as-
sumed: The fire protection systems might fail in pre-
venting or extinguishing the fire or explosion, which
might lead to a breach in the cargo containment system
and subsequent leakage of LNG. If there is leakage of
LNG, an LNG hazard might materialize allowing for the
Probability distribution of
possibility that the ship will not survive. Finally, in the
LNG hazards materializing event of an escalating fire, the crew needs to evacuate,
Probability of
and failure to do so in time might result in a number of
sinking fatalities. The fire and explosion risk model adopted in
Evacuation this study is illustrated in Fig. 6.
model

Number of Number of
fatalities, other fatalities, LNG
vessel

Consequence

Fig. 4: Collision risk model

The grounding and contact scenarios will resemble the
collision scenario in many ways. First, a ground-
ing/contact event might occur in either loaded or ballast
condition. The grounding or contact will result in a
certain extent of ship damage, and this damage might
cause leakage of cargo and/or loss of stability. If LNG is
released, one or more LNG hazards might materialize.
Again, the LNG carrier might sink due to the damage or
due to deteriorating strength caused by an LNG leakage.
 Fire/explosion frequency model
Engine room fire Accommodation area fire Compressor room fire
Loading
condition model
Fire protection
model
Cargo leakage
model
Consequence
Fig.6: Fire and explosion risk model
Spillage events during loading or unloading of cargo are
generally assumed to be of small scale where only a
limited number of the crew is exposed to risks of inju-
ries or death. Fatal accidents are only deemed likely for
crew members directly exposed to the cryogenic LNG.
The resulting risk model is illustrated in Fig. 7, which
was used to construct event trees for this scenario.
Loading/unloading
Probability of loading/unloading incident with spillage
spill frequency model
Spillage extent Probability distribution of spillage extent
model
LNG hazard
model
Accident model
Consequence
Fig. 7: Loading or unloading spill risk model
Event Tree Quantification
In order to assign probabilities for the various escalating
events, and thereby quantify the probabilities and con-
sequences associated with each scenario, various ap-
proaches and techniques have been used. For each sub-
model and for each branch of the event tree, the method
that was found to be most accurate and practical was
utilized. Detailed descriptions of all these are not possi-
ble within the scope of this paper, but an outline de-
scribing the main approaches will be provided in the
following.
The event tree for the collision scenario was quantified
based on various techniques. First, some general as-
sumptions were made, e.g. the probability of being the
striking or struck ship was assumed to be 0.5, and the
probability of being loaded and in ballast was assumed
to be 0.5 (since LNG shipping is principally unilateral in
nature). The damage extent model contains several
parts, describing the probability distribution of damage
location, depth, length and height that again determines
Fire/explosion frequency the probabilities of water ingress, receiving the damage
in the cargo area, etc. For these probabilities, results
from previous studies have been utilized, e.g. Olufsen et
Probability of being loaded/in al. (2003), Skjong & Vanem (2004), Laubenstein et al.
ballast, at sea/port
(2001), Denmark et al. (2001). The extent of collision
Probability of fire protection damage will determine the probability of cargo leakage.
system failing The remaining parts of the risk model, related to materi-
alization of LNG hazards, survivability and evacuation,
Probability of cargo
release are describing events associated with notable uncertain-
ties and no amount of relevant data exist. Therefore, a
Probability
LNG hazard
distribution of LNG workshop was arranged where expert opinion was elic-
model
hazards materializing
ited and incorporated in the event tree. A separate Del-
Survivability
model
Probability of
sinking
phi session was arranged in order to arrive at conse-
quence estimates related to number of fatalities on the
Evacuation
model LNG vessel as well as on the other vessel involved in
Number of the collision. All the estimates were inserted into the
fatalities event tree in order to estimate the overall risk related to
the collision scenario.
For the grounding and contact scenarios, similar ap-
proaches for quantification of the event trees were used
as in the collision scenario. The event trees were quanti-
fied accordingly.
Due to its relatively small fleet, sufficient data on fires
onboard LNG carriers is not readily available. It was
therefore assumed that the relative distribution of fires
starting in machinery spaces, accommodation areas and
cargo areas is similar to that of oil tankers, and recent
results from a study on aframax tankers were utilized
(Apostolos et al., 2005). Furthermore, for fires in ma-
chinery spaces and accommodation areas, consequence
statistics from oil tanker accidents were assumed appro-
Probability distribution of priate for LNG tankers. The risk model for compressor
LNG hazards materializing room fires were quantified based on different sources of
Number of fatalities, LNG information. For example, the assumed failure rate of
crew, terminal workers the fire protection system was based on results from
previous studies on other ship types (MCA, 1998;
Vanem & Skjong, 2004). Estimates on probabilities
related to LNG leakage, LNG hazards survivability and
evacuation performance were again based on expert
judgment.
The event tree for spillage events during loading and
unloading of cargo was quantified based on reasonable
assumptions related to typical LNG trading patterns and
normal cargo transfer operations. Furthermore, it was
assumed that only relatively small scale spillages would
occur during loading and unloading, with the potential
to harm only those limited number of crew members
that would be directly exposed to the spilled LNG.
Risk Summation
The risk modeling outlined in the previous sections
results in estimates of the contributions from the various
scenarios to the total potential loss of lives (PLL), as
presented in Table 5 (in terms of per shipyear).

Table 5: Potential Loss of Lives from LNG shipping
PLL PLL
Accident category
(crew) (passengers)
Collision 4.42 x 10-3 1.59 x 10-3
Grounding 2.93 x 10-3 0
Contact 1.46 x 10-3 0
Fire and Explosion 6.72 x 10-4 0 1,E-06
Loading/unloading 2.64 x 10-4 0 1,E-07
Total 9.74 x 10-3 1.59 x 10 -3
Individual Risk to LNG Crew
Assuming a crew of 30 for a typical LNG carrier and a
50/50 rotation scheme (meaning that two complete
crews are needed for continuous operation of the ves-
sel), the individual risk to crew is estimated to be 1.6 x
10-4 per person year. Compared to the individual risk
acceptance criteria established in this study, it is seen
that the individual risk falls within the ALARP area.
It should be noted, however, that this is the individual
risk from major ship accidents, and contributions from
occupational accidents have been disregarded. Occupa-
tional accidents were not included in the present study,
but estimates of occupational fatality risks onboard gas
tankers were presented by Hansen et al. (2002) as 2.7 x
10-2 fatalities per 10,000 days onboard. Assuming a 50-
50 rotation scheme, a crew member will be on board for
approximately 182 days per year, and 10,000 days on-
board corresponds to 55 person years for a typical
crewmember. Hence, the occupational fatality rate of
onboard gas tankers corresponds to around 4.9 x 10-4
per person year. Assuming this estimate and adding this
to the individual risk from ship accidents, a total indi-
vidual risk for crewmembers is estimated to be ap-
proximately 6.5 x 10-4 per person year. This estimate is
still within the ALARP area according to the risk accep-
tance criteria established in this study. On a final note, it
is observed that the individual risk to crewmembers
onboard LNG carriers is dominated by occupational
accidents, with a ratio of 3 occupational fatalities to
every fatality due to ship accidents according to the
estimates above.
FN Curves for Societal Risk
Detailed results from the risk analysis can be used to
produce FN-curves for the overall societal risk to crew
and passengers (Figs. 8-9). Compared to the established
risk acceptance criteria, it is found that also the societal
risks lie within the ALARP region. The FN-curves
showing the contribution from each of the main accident
scenarios clearly demonstrates that the overall risk level
is dominated by the collision, grounding and contact
scenarios. However, fire and explosion are dominating
the low consequence risk contributions in the order of
one or a few fatalities. The frequencies in both figures
are in terms of per shipyear.
Risk level - LNG carriers
Broken down on accident categories
1,E-02
F - frequency of N or more fatalities
1,E-03
1,E-04
1,E-05
1 10 100
N - number of fatalities
Risk level - LNG Collision Grounding
Contact Fire/Explosion Loading/Unloading
Fig. 8: FN-curves for crew
Risk to passengers from LNG carrier operations
1,E-04
F - frequency of N or more fatalities
1,E-05
1,E-06
1,E-07
1,E-08
1 10 100 1000 10000
N - Number of fatalities
Fig. 9: FN-curve for passengers on other vessel
It is observed that the FN-curves resulting from this
study lie slightly above the FN-curves for gas tankers
presented in MSC 72/16 (Norway 2000), but in general
the FN-curves are found to be in reasonable agreement.
There are undoubtedly significant uncertainties associ-
ated with this study. When reviewing the various as-
sumptions made in this study, it becomes evident that
some are conservative while others tend to be optimis-
tic. However, further scrutiny suggests that the net ef-
fect of all assumptions and uncertainties tend to be con-
servative collectively, and the risk analysis presented in
this paper is therefore believed to be somewhat conser-
vative. Nevertheless, in spite of the subjectivity and
inherit uncertainties, on a high level the results from the
current study are believed to be meaningful and robust
for the world fleet of LNG carriers.
Risk Control Options
Three generic accident scenarios are together responsi-
ble for about 90% of the total risk pertaining to LNG
carriers, i.e. collision, grounding and contact scenarios.
Thus, it is initially believed that promising Risk Control
Options (RCO) should address these scenarios in par-
ticular. In order to identify and prioritize prospective
RCOs, two expert workshops were arranged, resulting
in a long list of possible RCOs. From this list, a total of
10 RCOs were selected for further evaluation and cost-
effectiveness assessment (Martinez et al., 2006).
It is noted that according to current IMO practice and in
agreement with the information provided in MSC 72/16
(Norway, 2000), RCOs associated with NCAF or GCAF
(NCAF/GCAF = Net/Gross Cost of Averting a Fatality) studies should be carried out in order to bridge the gaps
values less than USD 3 million will be regarded as cost- in fundamental knowledge pertaining to LNG-specific
effective. The estimated GCAF and NCAF values for hazards. These are represented towards the right-hand
each of the 10 RCOs examined in this study are repro- side of the event trees, describing events in the later
duced in Table 6 (in 106 USD/fatality). stages of a scenario. In particular, it is suggested that
further studies related to the following parts of the risk
Table 6: GCAF/NCAF for each risk control option model are initiated: LNG hazard model, damage extent
RCO description GCAF NCAF models, survivability model, evacuation model and third
Risk based maintenance party model. These studies could be in the form of ex-
- Navigational systems 2.2 <0 periments, calculations or computer simulations.
- Steering systems 7.4 <0
- Propulsion systems 57 <0 Conclusions and Recommendations
- Cargo handling systems 159 118
Strain gauges 394 351 Prior to initiating this FSA on LNG carriers, the general
Increased crashworthiness opinion was that these vessels are associated with high
- Increase double hull width 74 71 safety levels. LNG tankers were thought of as well de-
- Increase double bottom height 60 54 signed, constructed, maintained and operated vessels
- Increase hull strength 60 55 with much attention to safety. Indeed, the safety record
Redundant propulsion system 61 55 of the LNG carrier fleet is among the best in the world.
Improved navigational safety These perceptions have been substantiated by this FSA
- ECDIS 3.1 <0 study where it was found that: a) the safety level lies in
- Track control system 0.4 <0 the ALARP region and b) most investigated RCOs were
- AIS integrated with radar 0.06 <0 found to not be cost-effective. Only risk control options
- Improved bridge design 2.3 <0 related to navigational safety have been found to be
Restrictions on crew schedule 6.3 0.7 cost-effective. Presumably, with the high safety level of
LNG tankers and the relatively low costs associated
Simulator training 12 5.8 with implementing navigational measures, this finding
Increased fatigue design life High <0 can be explained. It is also noted that these measures
Thermal image scanning 28 20 address the identified high-risk areas of collision,
Redundant radar sounding 236 232 grounding and contact.
Acknowledging the physical properties of LNG, the
possible severe consequences of a major spill accident
According to the estimates above, there exist cost- and the difficulty of assuring that the LNG tanks will be
effective RCOs related to navigational safety, and these able to withstand high-energy collision and grounding
should be recommended for mandatory implementation. impacts, preventing such accidents from occurring
Furthermore, some other RCOs are associated with seems intuitively to be the best strategy for mitigating
negative or low NCAF but with GCAF > USD 3 mil- the risk. As such, it should not be surprising that RCOs
lion. These represent economically viable options al- related to navigation turned out most cost effective.
though the potential for risk reduction is rather small.
These could be recommended to ship owners as favor- Notwithstanding the high safety level associated with
able options, although it is not deemed necessary to LNG carriers, the identification of several cost-effective
require compulsory implementation through regulations. risk control options all related to navigational safety
demonstrate that the risk associated with LNG carriers
are not ALARP. In order to bring the risk level down to
Suggestions for Further Research
ALARP it is therefore recommended that these RCOs
should be made a requirement for the LNG tanker fleet.
Even though the risk assessment presented in this paper
is believed to represent the best available estimates,
parts of the study should undoubtedly be regarded as Acknowledgement
subjective. In some areas of the analysis there has been
sufficient knowledge or statistical data available to draw The work reported in this paper has been carried out
meaningful conclusions, whereas in other areas, no under the SAFEDOR project, IP-516278, with partial
sources of information have been available. In the latter funding from the European Commission. The opinions
areas, quantitative estimates have been based on qualita- expressed are those of the authors and should not be
tive considerations and expert judgment, although it is construed to represent the views of the SAFEDOR part-
acknowledged that this is generally associated with a nership, DNV, Navantia or IST.
degree of subjectivity (Skjong & Wentworth, 2001).
However, these risk models are modular by design and
if new knowledge becomes available, the risk models
could and should easily be updated accordingly.
Uncertainties have been particularly salient in some
areas of this analysis, and it is suggested that further
 References
Apostolos, P, Eleftheria, E, Aimilia, A, Cantekin, T,
Severion, D and Nikos, M (2005). Critical Review
of Aframax Tankers Incidents, in Proceedings of
ENSUS 2005.
Bainbridge, J, Christensen, H, Hensel, W, Sames, PC,
Skjong, R, Sobrino, MP, Strang, T and Vassalos, D
(2004). Design/Operation/Regulation for Safety
SAFEDOR, in Proceedings of PRADS 2004.
Denmark, Germany, Norway and UK (2001). Updated
Statistics for Extent of Damage Report from the
research project HARDER. IMO SLF 44/INF.11.
Hansen, HL, Nielsen, D and Frydenberg, M (2002).
Occupational accidents aboard merchant ships,
Occupational and Environmental Medicine 59, 2002,
pp. 85-91.
IACS (2004). Experience with Formal Safety Assess-
ment at IMO, submitted by IACS, IMO MSC
78/19/1.
IMO (2002). Guidelines for Formal Safety Assessment
(FSA) for use in the IMO rule-making process,
IMO MSC/Circ.1023-MEPC/Circ.392.
Laubenstein, L, Mains, C, Jost, A, TAgg, R and Bjrne-
boe, NK (2001). Updated Probabilistic Extents of
damage based on actual Collision Data, in Proceed-
ings of ICCGS 2001.
Martinez, A, Vanem, E and Anto, P (2006). Cost
Benefit Analysis & Recommendations, SAFEDOR
report D 4.3.3.
The author has requested enhancement of the downloaded file. All in-text references underlined in blue are linked to publications on ResearchGate.
MCA (1998). MCA Research Project FSA of Ship-
ping Phase 2 Trial Application to HSC, Deliv-
erable 9 Summary report, MCA, UK.
Norway (2000). "Formal Safety Assessment Decision
parameters including risk acceptance criteria", sub-
mitted by Norway, IMO MSC 72/16.
Olufsen, O, Spouge, J and Hovem, L (2003). The For-
mal Safety Assessment Methodology Applied to the
Survival Capability of Passenger Ships, in Proceed-
ings of RINA Passenger Ships Conference 2003.
Scheibach, K, Noble, P and Broman C (2006). The
Next Generation of Large LNG Carriers, in Pro-
ceedings of the 9th International Marine Design Con-
ference 2006.
Skjong, R and Vanem, E (2004). Damage Stability
Evaluation in Collision of Bulk Carriers, in Pro-
ceedings of ICCGS 2004.
Skjong, R, Vanem, E and Endresen, (2005). Risk
Evaluation Criteria, SAFEDOR report D 4.5.2.
Skjong, R, and Wentworth, BH (2001). Expert judge-
ment and risk perception, in Proceedings of ISOPE-
2001.
Vanem, E and Skjong, R (2004). Fire and Evacuation
Risk Assessment for Passenger Ships, in Proceed-
ings of Interflam 2004.
Vanem, E, stvik, I and Anto, P (2006). Risk Analy-
sis of LNG Tankers, SAFEDOR report D 4.3.2.
stvik, I, Vanem, E and Castello, F (2005). HAZID for
LNG Tankers. SAFEDOR report D 4.3.1.