Journal of Loss Prevention in the Process Industries xxx (2013) 1e13

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Integrated risk assessment for LNG terminals

O.N. Aneziris*, I.A. Papazoglou, M. Konstantinidou, Z. Nivolianitou
National Centre for Scientific Research “DEMOKRITOS”, Terma Patriarchou Grigoriou, Aghia Paraskevi 15310, Greece

a r t i c l e i n f o a b s t r a c t

Article history: This paper presents an integrated risk assessment framework for Liquefied Natural Gas (LNG) terminals.
Received 17 December 2012 The basic steps for risk assessment are the following: a) hazard identification, b) accident sequence
Received in revised form modeling, where logic models such as Event Trees and Fault Trees are developed c) data acquisition and
26 July 2013
parameter estimation, used to estimate frequencies of the initiating events, component unavailability and
Accepted 26 July 2013
probabilities of human actions, d) accident sequence quantification, where all accident sequences are
assessed, e) consequence assessment, where release, evaporation rate, radiation levels and overpressure
Keywords:
owing to immediate or delayed ignition of LNG is performed and f) integration of results where risk indices
Quantified risk assessment
LNG, consequences
are assessed. Risk assessment of an onshore and an offshore LNG terminal is performed, according to the
Fault Trees and Event Trees for LNG basic methodological steps, and the distances where individual risk levels equal to 10
5e10
7/yr are
terminals assessed and presented in the form of individual contours. A section dedicated to I.A. Papazoglou, pioneer in
Initiating events Quantitative Risk Assessment both in the nuclear and chemical industry is also provided.
Greek pioneer in process safety Ó 2013 Published by Elsevier Ltd.

1. Introduction Cozzani (2012). A thorough analysis on the siting regulations and

This paper presents the methodological and procedural steps for
quantitative risk assessment of liquefied natural gas (LNG) and its
application to two LNG terminals, an onshore and an offshore one.
The onshore plant consists of two storage tanks with total capacity
of 100,000 m3 and the offshore of four double containment
spherical tanks, each with capacity of 34,672 m3. This analysis was
performed in the framework of the iNTeg-Risk project, coordinated
by Steinbeis (Jovanovic, 2010), where the ultimate scope was to
compare the two LNG terminals with different siting. Over the last
years risk assessment methodology has been widely used for esti-
mating risk of chemical plants storing flammable and toxic sub-
stances, such as ammonia, LPG and fuels, as discussed by CCPS
(2000), ISO 17776 (2000), Lees (1996), Papazoglou, Aneziris,
Bonanos, and Christou (1996), Papazoglou, Nivolianitou, Aneziris,
and Christou (1992), Taveau (2010) and Tixier, Dussere, Salvi, and
Gaston (2002). More specifically, quantified risk assessment of
LNG installations appears in several cases in the literature, such as
the risk assessment of LNG importation terminals using the
Bayesian-LOPA methodology, as presented by Yun, Rogers, and
Mannan (2009), the analysis by Raj and Lemoff (2009) for siting
LNG facilities based on the NFPA 59A standard and risk analysis of
LNG terminals in case of terrorist attack by Landucci, Tugnoli,
Spadoni, and Cozzani (2012) and Tugnoli, Landucci, Salzano, and
* Corresponding author.
E-mail address: olga@ipta.demokritos.gr (O.N. Aneziris).
industrial standards for LNG terminals and their differently
evolving paths within Europe and the United States (U.S.) is pre-
sented by Licari and Weimer (2011). On the other hand risk analysis
has been performed for LNG carrier operations by Vanem, Antão,
Østvik, and de Comas (2008) and for LNG tankers approaching a
marine terminal by Bubbico, Cave, and Mazzarotta (2009). Finally,
high pressure natural gas pipelines have been studied by Jo and
Ahn (2002, 2005).
Extensive research has been performed in the area of conse-
quence analysis after an LNG release. The behavior of an LNG spill in
the atmosphere has been extensively studied on ground, over water
and under water. Results of experiments and modeling concerning
LNG outflow, dispersion, pool fires and vapor explosions have been
presented by Cleaver, Johnson, and Ho (2007), Hanlin (2006),
Koopman and Ermak (2007), Ohba, Kouchi, Hara, Vieillard, and
Nedelka (2004) and more recently by Giannissi, Venetsanos,
Markatos, and Bartzis (2013), Ivings, Lea, Webber, Jagger, and
Coldrick (2013), Raj (2011) and Raj and Bowdoin (2010). Conse-
quence analysis for estimating hazard distances for LNG vessel
cargo releases during transit and while at berth with spills on water
have been studied by ABS Consulting (2004). In addition a Sandia
Report (2004) presents risk assessment methods of LNG spills on
water. Consequence analyses have been also performed for LNG
marine incidents by Pitblado, Baik, Hughes, Ferro, and Shaw (2004)
and by Taylor (2007) for siting LNG facilities.
Additional studies to mitigate the effects of an LNG outflow
together with limiting its volume involved in accidents have been

0950-4230/$ e see front matter Ó 2013 Published by Elsevier Ltd.

http://dx.doi.org/10.1016/j.jlp.2013.07.014

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
2 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13
set off as early as 1996 by using high expansion foam to cover
dispersed LNG as described by Takeno et al. (1996) and water
curtains as described by Olewski, Nayak, Basha, Waldram, and
Véchot (2011), Rana, Cormier, Suardin, Zhang, and Mannan
(2008) and Rana and Mannan (2010).
This paper is organized as follows. After the introduction of
Section 1, Section 2 presents in brief the methodological and pro-
cedural steps for risk assessment in LNG installations, Section 3
describes the LNG terminals and Section 4 presents the major
steps of quantitative risk analysis for LNG terminals. Finally Section
5 presents the conclusions of this study and at Section 6 a dedi-
cation to I.A. Papazoglou, pioneer in Quantitative Risk Assessment
both in the nuclear and chemical industry is presented.
2. Methodological and procedural steps for risk assessment
The methodology and procedures to be followed for the quan-
tification of risk from installations handling flammable substances
can be distinguished into three major phases, as already presented
by Papazoglou et al. (1992), which are the following:
a) Assessment of plant-damage states and their frequency of
occurrence
b) Assessment of consequences of flammable substances release
c) Risk integration.
2.1. Assessment of plant-damage states and their frequency of
occurrence
The first phase of an integrated risk assessment consists of
analyzing the installation to identify potential accident initiators,
assess the response of the plant to these initiators and establish end
damage states of the plant resulting in the release of a dangerous
substance in the environment. Furthermore, the frequency with
which the identified plant-damage states are expected to occur is
estimated. This phase can be distinguished in the following five
procedural tasks:
a) Hazard source identification
The main sources of potential hazardous-substance releases are
identified and the initiating events that can cause such releases are
determined.
b) Accident sequence determination
A logic model for the installation is developed, which includes
each and every initiator of potential accident and the response of
the installation to these initiators. Specific accident sequences are
defined (in models called Event Trees) which consist of an initiating
event, specific system failures or successes, their timing and human
responses. Accident sequences result in plant-damage states, which
involve release of the hazardous substance.
System failures are in turn modeled (in models called Fault
Trees) in terms of basic component failures and human errors to
identify their basic causes and to allow for the quantification of the
system failure probabilities and accident sequence frequencies.
c) Plant-damage state definition
A plant-damage state uniquely characterizes the installation-
dependent conditions of release of the hazardous substance. Acci-
dent sequences resulting into the same conditions of release are
grouped into categories each corresponding to a particular plant-
damage state.
Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
d) Data assessment and parameter evaluation
Parameters which must be estimated include the frequencies of
the initiating events (external events, human errors, component
failures) component unavailability and probabilities of human ac-
tions. Estimation of these parameters is based on generic values.
e) Accident sequence and plant-damage state quantification
This task quantifies the accident sequences and the plant-
damage states, that is, calculates their frequency of occurrence. In
particular, the plant model built in the step “Accident sequence
determination” is quantified using the parameter values estimated
in the previous task. Accident sequences to be quantified in the
Event Trees are specified and manipulated according to the laws of
Boolean algebra in order to be put in a form suitable for quantifi-
cation. The results of this task are the calculation of the frequency of
occurrence of each accident sequence and consequently of each
plant-damage state.
Once the plant-damage states and their frequencies are estab-
lished, the consequences to the public and worker’s health must be
established. It is not necessary to estimate consequences for each and
every plant-damage state. A screening procedure can be followed
where only those plant-damage states with significant frequency will
be retained. Caution must be exercised, however, to avoid excluding
states with extremely severe consequences. Alternatively, conse-
quences may be quantified for all identified plant-damage states
prior to the frequency estimation. Then, frequency calculations are
performed only for those states with non-negligible consequences.
2.2. Consequences of flammable substance releases
The second phase of the integrated risk assessment aims at the
establishment of the consequences of the released flammable LNG,
which may be either thermal radiation or overpressure.
a) Determination of release categories of flammable material
A release category for flammables defines all necessary condi-
tions that uniquely determine the level of overpressure or heat ra-
diation at each point in the area around the release of flammable
material (LNG in this case). A release category uniquely determines
the type of the physical phenomenon that could result in fatalities or
injuries. For example, in the case of LNG releases, it is established
whether a pool fire will take place or whether an explosion or
deflagration will result, following atmospheric dispersion of the gas.
b) Estimation of heat radiation and peak overpressure
In this step, a model for simulating the heat radiation or the
peak overpressure resulting from the released flammable material
and the associated physical phenomenon is established. The SOC-
RATES computer code (Papazoglou et al., 1996) has been used for
consequence analysis and risk integration. Fire and explosion
models incorporated, are based on the pool fire and deflagration
models presented in the Yellow Book (TNO, 1992) for estimation of
heat radiation and peak overpressure respectively. Dispersion of
LNG in case of delayed ignition is based on the simple dense box
model, presented by Bais, Zerefos, and Ziomas (1989).
c) Dose assessment
The integrated, over time, exposure of an individual to the
extreme phenomenon generated by the flammable material is
calculated. This defines the “dose” an individual receives.
 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13
The effects of thermal radiation and overpressure effects on
exposed individuals are calculated with the following equations,
according to the Green Book (CCPS, 2000; Lees, 1996; TNO, 1989):
Dðx; yÞ ¼ ½qðx; yÞ4=3 t10
4
where: q(x,y) is the thermal flux at distance r, r ¼ (x2 þ y2)1/2 from
the center of the fire (W/m2), D(x,y): dose at point r of the center of
the fire with coordinates x, y, t: duration of exposure (s).
For overpressure, the dose function is calculated as follows,
according to the Green Book (CCPS, 2000; Lees, 1996; TNO, 1989):
Dðx; yÞ ¼ 7:38103 þ 1:310
9
Ps P s Is
Is ¼ 1P t
2 s p
where: Ps is the overpressure, Is the impulse of the shock wave and
tp is the duration of the positive shock wave.
d) Consequence assessment
Appropriate dose/response models receiving as input the dose
of heat radiation or overpressure calculate the probability of fatality
or injury of the individual receiving the dose.
The probability that an individual will die as a result of its
exposure to the extreme phenomenon is estimated in terms of
doseeresponse models receiving as input the dose calculated by
the dose module. All doseeresponse models employed in SOCRA-
TES are based on a “probit” function for the substance and/or
phenomenon, as presented in the Green Book (CCPS, 2000; Lees,
1996; TNO, 1989).
The probit model can be described as follows: it is assumed that
each individual into a population exhibits a different “strength” in
coping with a dose, D, of an adverse effect. Furthermore, the model
assumes that this strength, S, is normally distributed with mean
value 5 and standard deviation 1. It is also stipulated that a dose “D”
generates a “stress” P0 on each individual that is a function of the
dose and of the substance. In particular
P0 ¼ Probit ¼ A þ BlnD
where A, B are substance (or phenomenon) dependent constants.
The model assumes that a person dies if its strength, S, is lower
or equal than the dose induced stress P0; that is, the probability of
an individual dying, pd, as a result of a dose (D) is given by
ZP0 " #
1 ðu
5Þ2
pd ¼ Pr fS  P0 g ¼ pffiffiffiffiffiffi exp
du
2p 2

N
or
PZ0
5 " #
1 ðu
5Þ2
pd ¼ pffiffiffiffiffiffi exp
du
2p 2

N
It is noteworthy that pd, implies that if N people receive dose D,
then the expected number of fatalities is (pd$N).
The probability of lethality owing to the impact of the whole
body from the shock wave created by an unconfined vapor explo-
sion (UVCE) is given by the following probit function (TNO, 1989).
P0 ¼ 5
2:44 ln Dðx; yÞ
TNO (1989) also provides the probit function for exposure to
thermal radiation as
Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
3
P0 ¼
14:9 þ 2:56 ln Dðx; yÞ (6)
which in turn yields the probability of death for an individual
standing at a distance from the source for t seconds.
(1) As presented by Papazoglou et al. (1996) for the flash fire phe-
nomenon, it is assumed that any person within the trace of the
flammable cloud receives a lethal dose of thermal radiation while
for any person outside the trace the probability of death is assumed
equal to zero.
2.3. Risk integration
In this last phase integration of the results obtained so far,
(2) that is combining the frequencies of the various accidents with
the corresponding consequences, results in the quantification of
risk, as presented by Papazoglou et al. (1992, 1996). Two risk
measures are usually used to quantify risk, namely individual
fatality risk at a location and group fatality risk in a given area. In
this analysis individual fatality risk at a location has been
assessed.
3. Brief description of LNG terminals
Two LNG terminals have been studied, an onshore and an
offshore. The onshore terminal, as presented in Fig. 1, comprises the
following sections: jetty, storage, boil-off recovery and vapor-
ization. The jetty is composed by the docking area for LNG ships and
equipped with unloading arms. A pipeline goes along the jetty to
the storage tanks and permits the LNG transfer. The storage section
is composed by two double containment tanks and three sub-
merged pumps delivering LNG from the tanks. The boil-off recovery
section is composed by cryogenic compressors and a blower. The
role of the compressors is to recover boil-off gas generated during
the normal operation and the unloading phase, and transfer it to
the recondenser. The vaporisation section is composed by four
vaporizers with primary and booster pumping systems. High
pressure natural gas exiting the vaporiser is transmitted to the
pipeline network.
The LNG offshore terminal consists of four double containment
(3) spherical tanks, each with capacity 34,672 m3, booster pumps,
compressors of the boil-off LNG, a recondenser, an intermediate
fluid vaporiser and the relevant liquid and vapor LNG pipelines. The
unloading area consists of the unloading arm and the liquid and
vapor pipelines connecting the LNG tank to the arm, as presented in
the box diagram of Fig. 2. A pipeline exiting the vaporiser transfers
natural gas to the pipeline network. More details on both terminals
are presented by Uguccioni (2010).
The operation of both LNG terminals can be described in the
following phases:
a) LNG is transferred from a ship via the loading arm and a
pipeline to the storage tanks. This transfer is achieved through
the ship’s pumps and lasts for 24 h for each loading, depending
(4) on the quantity which is transferred.
b) Storage of LNG at 1 bar.
c) Transfer of LNG from tanks to the vaporisers, where natural gas
is produced and transferred to the pipeline net.
4. Quantified risk assessment of LNG terminals
4.1. Hazard source identification of LNG terminals
(5)
The main objective of this step is to identify the sources of LNG
release in the installation and the initiating events that can lead to
4 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13

BOIL - OFF
UNLOADING ARMS
VAPOR RETURN ARM
SUBMERGED SUBMERGED PUMPS

L
L

JETTY STORAGE LNG TANK

STORAGE LNG TANK BLOWER

L BOIL - OFF
VENT COMPRESSOR
BOIL - OFF
ABSORPT AIR
TO PIPELINE
NETWORK
NATURAL GAS

MEMBRANES

FUEL- GAS

VAPORIZERS AIR
BOOSTER
PRIMARY COMPRESSORS
PUMPS
PUMPS RISER

Fig. 1. Simple diagram of the process of the onshore LNG terminal.

the release of this substance to the environment. This methodo-
logical step can be distinguished in the following tasks:
Plant familiarization and information gathering
This task involves the familiarization of the analysts with the
plant design and operation. This included a study of the plant
documentation supplied by the plant through the coordinators of
iNTeg-Risk and a visit to an onshore LNG terminal in Greece, similar
to the one analyzed. The plant documentation contained short
plant description, process flow and block diagrams and description
of equipment and LNG flow rates.
Identification of release sources of concern
The aim is to identify all possible sources of LNG release (within
the boundary of the study). To this end, the installation was divided
into sub-compartments, each representing a possible release
source, as described in the following paragraph “Development of
Master Logic Diagram”.
Identification of plant operating states of concern
Three operating states of the installation were established,
which are the following: a) loading of LNG from the ship to the tank,
b) storage of LNG in the tank and c) transfer of LNG from the tank to
the pipeline.
Consideration of all operating states of the LNG storage facility
was deemed necessary since it affects the possible release sources,
release mode, as well as the amount of the LNG released.
Initiating event selection
Events which may create a disturbance in the installation and
have the potential to lead to the release of LNG are identified and
listed. The aim is to make this list as complete as possible, including
events beyond the design basis of the plant. Two different ap-
proaches, namely the Master Logic Diagrams (Papazoglou &
Aneziris, 2003) and the use of check lists have been followed for
the identification of the initiating events. Master Logic Diagrams
(MLD) have been developed for all sections of the installation
resulting in the identification of a list of initiating events. This list
was further checked for completeness with recorded initiating
events of past accidents and/or studies (check lists).
The Master Logic Diagrams resembles to Fault Trees, but without
any formal mathematical properties. They start with a “Top Event”
which is the undesired event (like “Loss of Containment”) and
continue decomposing it into simpler contributing events until
events of lower levels cause the events of the immediately above
one. The development continues until a level is reached where
events directly challenging the various safety functions of the plant
are identified. For a chemical installation the “Top Event” of interest
is the potential of release of a hazardous substance to the envi-
ronment. Loss of Containment (LOC) means a discontinuity or loss
of the pressure boundary between the hazardous substance and the
environment, resulting in release of hazardous substances. A
generic MLD for LOC in installations handling hazardous substances
is presented by Papazoglou and Aneziris (2003). There are two
major categories of events leading to Loss of Containment: those
resulting in a structural failure of the containment and those
resulting in containment bypassing because of an inadvertent

Fig. 2. Simple box diagram of the process of the offshore LNG terminal.

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13
opening of an engineered discontinuity in the containment (e.g.
valves, hatches). Seven general ways (or direct “causes”) in which a
structural failure of the containment may occur can be distin-
guished, which are the following: overpressure, underpressure,
corrosion, erosion, external loading, high temperature and vibra-
tion. The second major category of causes for “loss of containment”
results to containment bypass, either because operations start
while it is open, or because the containment opens during
operations.
4.1.1. Development of Master Logic Diagram
The detailed MLD for the onshore LNG storage plant has been
developed, for all possible sites of LNG release and for all plant
operation states (storage, loading, unloading). The basic step for the
construction of the MLDs is the identification of critical areas.
Critical areas contain considerable quantity LNG. On the basis of the
extent of possible consequences the onshore installation has been
divided into four sections as follows:
a) Unloading arm section. It comprises the jetty and the unload-
ing arms for the LNG transfer from ship to tanks. It also com-
prises the transfer pipeline from the jetty to the storage tanks.
b) Storage tanks section. It comprises the two containment tanks
with their submerged pumps.
c) Absorption/Vaporizer section. This section covers the absorp-
tion tower, the vaporizers as well as their pumping system and
the transfer line to distribution net.
d) Boil-off recovery section. This section comprises the cryogenic
compressors and the blower.
Master Logic Diagrams have been constructed for the four crit-
ical areas and for all operational phases of the storage tanks. The
MLD for LNG storage tanks during storage phase is presented in
Fig. 3. The generic MLD, as described by Papazoglou and Aneziris
(2003), when applied to the Loss of Containment of the LNG stor-
age tanks, during storage results in the following direct causes for
LOC: corrosion, overpressure, external loading, and containment
bypass. Overpressure is decomposed in rollover and internal
pressure increase. Internal pressure increase may be caused by boil-
off gas removal malfunction or excess external heat. External
STRUCTURAL
FAILURE
OVER
CORROSION
PRESSURE
INTERNAL
PRESSURE ROLL OVER
INCREASE
COOLING EXCESS
MALFUNCTION HEAT
BOIL OFF
REMOVAL EXTERNAL
MALFUNCTION
Fig. 3. Master Logic Diagram of the LNG storage tank during storage phase.
Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
5
loading, in case of onshore installations, may be achieved in the
following ways: snow, ice, earthquake, flooding and extra loads.
The Master Logic Diagrams for both terminals onshore and
offshore are similar, since they are general diagrams taking into
account the major phases and processes. The main difference be-
tween onshore and offshore installation is that in the first case the
natural phenomena which may cause external loading to the LNG
tanks are snow/ice, earthquakes or flooding, while in the second
case (offshore) only ice, winds and wave/currents can lead to
structural failure owing to external loading.
All initiating events, identified for the onshore LNG tanks during
the storage phase are presented in Table 1. A literature review con-
cerning past accidents and their causes in LNG storage facilities was
performed, in order to check the initiating events identified with
MLD, as presented by Aneziris, Papazoglou, and Konstantinidou
(2010). The results showed good agreement, since all accidents
initiating events such as overfilling, rollover, leakages, overpressure,
corrosion, natural phenomena, water hammer, disconnection of
unloading arms, external fire and external load, were adequately
identified.
4.1.2. Screening of initiating events
Screening of the initiating events has been performed on the
basis of their release category. Release categories with relatively
small releases are not quantified. For example liquid releases which
occur if there is containment bypass or corrosion in the LNG tank
may be ignored in the unloading and loading phase of the tank.
Table 2 presents the initiating events from both LNG plants which
are quantified and Table 3 the corresponding damage states. Both
LNG plants have many common initiating events such as boil-off
removal malfunction, high temperature in LNG coming from ship,
excess external heat, external fire, overfilling, rollover, low level etc.
Initiating events of the onshore LNG tanks are snow/ice, earth-
quakes or flooding, while for the offshore LNG only ice, winds and
wave/currents are applicable.
4.2. Accident sequence modeling
Accident sequence modeling can be distinguished in the
following four tasks: event sequence modeling, system modeling,
LOSS OF
CONTAINMENT
LOSS OF
BOUNDARY
CONTAINMENT
BYPASS
EXTERNAL
LOADING
OPEN WHEN OPEN
OPERATION DURING
STARTS OPERATION
NATURAL EXTRA
PHENOMENA LOAD
SNOW, ICE EARTHQUAKE FLOODING
6 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13

Table 1 Table 3
Initiating events and associated plant-damage states for LNG tanks, during storage Damage states of LNG terminals.
phase.
LNG tank
Initiating events Plant-damage states 1. Tank rupture (roof failure) owing to overpressure
2. Tank rupture (roof failure) owing to overfilling
1. Corrosion Hole in tank, equivalent to 1 inch
3. Tank rupture owing to underpressure
2. Boil-off removal malfunction Tank rupture (roof failure)
Loading section
during storage owing to overpressure
4. Pipe rupture (tank to pumps)
3. Excess external heat Tank rupture (roof failure)
Unloading section
during storage owing to overpressure
5. Pipe rupture (ship to tank)
4. Rollover Tank rupture (roof failure)
Outlet pipeline
owing to overpressure
6. Full bore
5. Earthquake Catastrophic rupture of tank
6. Snow, ice Catastrophic rupture of tank
7. Floods Catastrophic rupture of tank
8. Extra loads Catastrophic rupture of tank
safety system from the required operation initiates a transient and
9. Valve left open Exit of LNG through 1 inch drainage valve requires certain safety functions to avoid release of natural gas.
10. Containment bypass Exit of LNG through 1 inch drainage valve
during storage b) Standby compressor available

Following the malfunction of one compressor of the boil-off

human performance analysis and classification of accident se-
quences into plant-damage states. More details are presented by
Papazoglou et al. (1992).
The completion of the Hazard Identification methodological
step resulted in the identification of nineteen initiating events, as
presented in Table 2, leading to twenty-one Event Trees for quan-
tification, for both LNG terminals. In this section two Event Trees
are presented, one for the onshore plant and one for the offshore.
The Event Tree developed for initiating event “Boil-off removal
malfunction during unloading from ship to tank” (ET-1) for the
onshore terminal is presented in Fig. 4. This model presents the
possible response of the storage facility to boil-off removal mal-
function during unloading from ship to tank. It comprises the
following heading events (see Fig. 4):
a) Boil-off removal malfunction during unloading from ship
to tank
During unloading of LNG from ship to tank the operation of one
compressor is required to remove LNG vapors and keep the pres-
sure within safety limits. Any deviation of the boil-off removal
Table 2
Initiating events of LNG terminals.
LNG tank
1. Boil-off removal malfunction, during unloading
2. Boil-off removal malfunction, during storage
3. High temperature in LNG, coming from ship
4. Excess external heat in storage tank area
5. Level rise beyond safety height, or overfilling
6. Rollover during unloading
7. Rollover during storage
8. Inadvertent starting of additional compressors
9. Continuation of unloading beyond lower safety level
10. Increase of send out rate from tank
Unloading section (from ship to tank)
11. Excess external heat in jetty area
12. Water hammer in loading arm, due to inadvertent valve closure
13. Inadequate cooling of loading arm
14. High winds during unloading
Sendout section
15. Inadvertent closure of valve in send out
Recondenser
16. Inadvertent start of compressor
17. Booster pump malfunction
18. External fire
Outlet pipeline
19. Vaporiser failure leading to pipebreak owing to low temperature of line
20. Strong waves during unloading (only for offshore plant)
21.Strong waves during storage (only for offshore plant)
removal system, the standby compressor may start operating. If it
starts operating successfully the boil-off is removed and tank
pressure is within safe limits.
c) Manual stop of send out
Following the failure of both compressors, operators both at the
plant and at the ship should recognize the pressure increase in the
tank, communicate this fact among themselves and should termi-
nate the unloading operation.
d) Pressure control system
This event corresponds to the successful sensing of the pressure
rise and the closing of the appropriate valves and pumps by the
automatic pressure control system for emergency shut down (ESD).
e) Pressure Safety Valves (PSVs)
This event models the successful operation of the pressure
safety valves in the event of a continuing pressure rise beyond and
above the nominal safety valves set points.
This event tree determines five accident sequences. Three of
them (#le#3) constitute successful termination of the incident.
One (#4) results in release of LNG from the PSVs and one (#5)
sequence leads to tank rupture and release of LNG.
The Event Tree developed for the initiating event “Strong waves
during unloading” (ET-2) of the offshore plant, is presented in Fig. 5.
This model presents the possible response of the offshore storage
facility to strong waves during unloading from ship to tank. It
comprises the following events (headings) (see Fig. 5):
a) Strong waves during unloading from ship to tank
During unloading of LNG from ship to tank the presence of
strong waves initiates a transient and requires certain safety
functions to avoid release of LNG. The release may be the result of
the impact of the ship on the offshore facility.
b) Manual termination of unloading
In case of strong waves operators both at the offshore plant and
at the ship should recognize the criticality of the situation, should
communicate this fact among themselves and should terminate the
unloading operation.
c) Floating barriers

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13
Fig. 4. Event Tree with initiating event “Boil-off removal malfunction during unloading from ship to tank” (onshore plant).
This event models the successful intervention of the floating
barriers that may prevent the violent contact of the ship on the
offshore facility.
The event tree determines three accident sequences. Two of
them (#l, #2) constitute successful termination of the incident. The
last (#3) sequence leads to tank rupture and release of LNG.
Accident sequences developed in this phase have been classified
in the following plant-damage states: a) tank rupture owing to
overpressure or overfilling, b) tank rupture owing to underpressure
(implosion) and c) pipebreak in the piping between ship and tank.
4.2.1. System Fault Trees
Fault trees have been developed for system modeling of all
safety systems identified in the event sequence modeling of the
LNG terminals. In this section Fault trees developed for the event
tree with initiating event “Boil-off removal malfunction during
unloading from ship to tank” (see Fig. 4) are presented. These Fault
Trees have the following top events: a) Boil-off removal malfunc-
tion during unloading from ship to tank b) Standby compressor
malfunction c) No manual stop of operation d) Pressure control
system fails to stop unloading from ship e) Loss of instrument air
and f) Loss of electrical power supply and are depicted in Figs. 6e10.
Fault tree for boil-off removal malfunction during unloading
from ship to tank
The boil-off removal system mainly consists of two compressors.
Operation of one of them is required to maintain LNG in the desired
temperature. Any reduction of operating compressor’s capacity
initiates an incident. The Fault Tree for boil-off removal malfunc-
tion, is shown in Fig. 6. The top event of this tree occurs if the
operating compressor fails, if there is a loss of industrial air (sup-
port system further analyzed in separate Fault Tree) or if there is a
loss of electrical power (support system further analyzed in sepa-
rate Fault Tree).
Fig. 5. Event Tree with initiating event “Strong waves during unloading” (offshore LNG
plant).
Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
7
Fault Tree for compressor malfunction
The Fault Tree for the event “Compressor malfunction”
following boil-off removal malfunction in ET-1 is presented in Fig. 7.
The top event in this tree will occur if the second (standby)
compressor is unavailable, if the valves (inlet or outlet) fail to
operate, if there is a loss of industrial air (support system further
analyzed in a separate Fault Tree, see Fig. 9) or if there is a loss of
electrical power (support system further analyzed in a separate
Fault Tree, see Fig. 10).
Fault Tree for manual termination of unloading due to pressure
increase
The Fault Tree for the event “No manual stop of operation”
following boil-off removal malfunction in ET-1 is presented in
Fig. 8. The top event in this tree will occur if either the operators on
the ship do not act, or if the operators at the storage facility do not
act, or if the pumps of the ship fail to stop. The non reaction of
operators on ship will occur if the operators fail to stop the loading
procedure, or if the operator fails to communicate the problem or if
the communication between the ship and the facility has failed. The
non reaction of operators on site will occur if operators ignore the
alarm, or if the alarm fails or if the communication of pressure
signal between the jetty and the control room fails.
Fault Tree for the loss of industrial air
The Fault Tree for the event “Loss of industrial air” which is a
support system is presented in Fig. 9. The top event in this tree will
occur if there is loss of electrical power or if there is a failure of the
air compressor.
BOIL OFF REMOVAL
MALFUNCTION -
UNLOADING
@IE-1-1
COMPRESSOR #1 LOSS OF IA LOSS OF ELECTRICAL
FAILURE POWER
COMP. FAIL#1 @LOSS IA-1 LOSS OF EL. SUPPLY
Fig. 6. Fault Tree for boil-off removal malfunction during unloading from ship to tank.
8 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13

Fig. 7. Fault Tree for compressor malfunction.

Fault Tree for the loss of electrical power
The Fault Tree for the event “Loss of electrical power” which is a
support system is presented in Fig. 10. The top event in this tree will
occur if there is a loss of offsite power and the diesel generator does
not start.
In total twenty six Fault Trees have been developed for quanti-
fication of all Event Trees, of the LNG plants and were quantified
according to the methodology developed and with data from the
OREDA (1992, 1997) database. More details for all Fault Trees are
provided by Aneziris et al. (2010). The top events of all Fault Trees
constructed for system modeling are presented in Table 4.
4.2.2. Data assessment and parameter evaluation
In order to quantify the models described three major categories
of parameters must be estimated which are frequencies of initiating
events, component failure data and probabilities of human errors.
Frequencies of initiating events can be estimated from historical
data, or detailed logic models or engineering judgment. In the
analysis of the LNG terminals Fault Trees have been developed for
two initiating events, namely for boil-off removal malfunction
during loading and storage. All others have been estimated and
presented in Table 5.
Component failure data have been estimated by using data of
OREDA (1992, 1997) database and by assuming that components
follow the exponential law for times to failure. Frequencies of
failure and unavailabilities on demand have been calculated for
Fault Tree quantification. More details on calculated data for Fault
Tree quantification and are provided by Aneziris et al. (2010).
Most of the human actions incorporated in the logic models are
action errors or errors of detection and can be classified as of the
“cognitive” type according to the definition of Hannaman, Spurgin,
and Lukic (1985). This means that they consist of actions not
routinely performed, but actions required as a response to events
not included in normal operation (e.g. fire, problem in unloading).
Following the model suggested by Hannaman et al. (1985), the
probability of failing to perform a required action of the cognitive
type depends on the time available to the operator for thinking out
the cause of the symptoms available to him and identifying the
required response. The failure probability for these types of errors
was assessed to be 0.01/demand for action and communication
errors and 0.001/demand for detection errors.
4.2.3. Accident sequence and plant-damage state quantification
The step of the probabilistic safety assessment includes all tasks
associated with the quantification of accident sequences. The plant

Fig. 8. Fault Tree for no manual termination of unloading related to pressure increase.

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13 9

Table 4
List of top events of Fault Trees constructed for LNG risk assessment.

1. Boil-off removal malfunction during unloading

2. Compressor malfunction
3. No manual termination of unloading due to pressure increase
4. Pressure control system fails to stop unloading from ship
5. Loss of industrial air
6. Loss of electrical power
7. Pressure signal failure
8. Fire fighting system failure on jetty
9. No manual termination of unloading due to high temperature
10. No manual termination of loading due to high winds
11. No manual termination of loading due to high level
12. High level control system failure
13. Level signal failure
14. Recirculation between tanks failure
15. Temperature signal failure
16. No manual stop of compressor
17. Automatic system fails to stop compressor
Fig. 9. Fault Tree for loss of industrial air. 18. Boil-off removal malfunction during storage
19. Fire fighting system failure, in tanks area
20. Sprinklers failure in tanks and vessels
21. No manual stop of operation due to low level in tank
model built during the major step “accident sequence determina-
22. Low level control failure
tion” has been quantified using parameter values estimated in the 23. No manual stop of send out due to low pressure in tank
previous step of “data assessment and parameter evaluation”. The 24. Pressure control in send out failure
quantification of accident sequences includes the determination in 25. Failure of pressure control of vaporizer
the Event Trees of the accident sequences to be quantified, and 26. No manual stop of send out to vaporizer
27. Boil-off removal malfunction during loading
their manipulation. Manipulation utilizes the laws of Boolean
algebra to put the sequences into a form suitable for quantification.
Results of this step consist of the cutsets for each accident sequence
and their associated frequencies. For example the cutsets of acci- The frequency with which each of these plant-damage states is
dent sequence #5 of event tree developed for initiating event “Boil- estimated according to CPR 18E (1999) as 5  10
7/m and a 20 m
off removal malfunction during unloading from ship to tank” (see length has been assumed for pipe sections from LNG tanks to
Fig. 4) are presented in Table 6. Cutsets for the event tree developed pumps, outlet pipeline of onshore terminal and double length for
for the initiating event “Strong waves during unloading” for the outlet pipeline of offshore terminal. Frequencies of occurrence per
offshore LNG plant are presented in Table 7. year of all plant-damage states of this analysis are presented in
As already presented in accident sequence modeling, accident Table 8.
sequences have been classified in the following plant-damage
states: a) tank rupture owing to overpressure or overfilling, b) tank 4.3. Consequence analysis
rupture owing to underpressure and c) pipebreak in the piping
between ship and tank. The frequency of each plant-damage state In the installations under analysis six damage states have been
has been calculated by adding the frequencies of the accident se- considered for each terminal, as presented in Table 3, which are
quences forming the plant-damage state and considering the
duration of each phase. It has been assumed the duration of loading
Table 5
is 1000 h/yr and the duration of storageeunloading 7660 h/yr.
Frequencies of initiating events.
Two more plant-damage states have been considered as
resulting from single events namely: pipebreak between LNG tanks Initiating events Frequency (/yr)
and pumps, full bore outlet pipeline break. These plant-damage Excess external heat (or high temperature in product) 10
1
states have the potential of releasing LNG into the environment. during unloading from ship to tank
External fire in jetty during unloading from ship to tank 10
1
Inadvertent valve closure during unloading 10
2
from ship to tank
Inadequate cooling of Loading arm during 10
2
unloading from ship to tank
High winds during unloading from ship to tank 10
1
High level in tank during unloading from ship to tank 10
1
Rollover in tank during unloading from ship to tank 10
1
Rollover in tank during storage 10
1
Inadvertent Start of Compressor during storage 10
1
External fire near tank during storage 1
Low level in tank during send out 10
1
Increased send out rate from tank 10
1
Closed valve in send out from tank 10
2
Inadvertent Starting of Compressor e Increased 10
1
flow rate to recondenser
Booster pumps malfunction at the exit of recondenser 10
1
External fire near recondenser 1
Vaporizer failure 5  10
1
Strong waves during unloading from ship to tank 10
2
of offshore LNG plant
Strong winds or currents during storage of 10
3
offshore LNG plant
Fig. 10. Fault Tree for loss of electrical power.

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
10 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13

Table 6
Cutsets of accident sequence# 5 of Event Tree with initiating event “Boil-off removal malfunction during unloading from ship to tank”.

Frequency (/h) Cutsets

1 3.31E-11 DIESEL GENER LOSS AC PRESSURE ALARM PSV

2 2.00E-11 AIR COMPRESSOR PRESSURE ALARM PSV
3 1.98E-11 DIESEL GENER LOSS AC OP. COMMUNICATION PSV
4 1.98E-11 DIESEL GENER LOSSAC OP. SHIP PUMP PSV
5 1.00E-11 AIR COMPRESSOR OP. COMMUNICATION PSV
6 1.00E-11 AIR COMPRESSOR OP. SHIP PUMP PSV
7 1.98E-12 DIESEL GENER LOSS AC OP. ALARM PSV
8 1.74E-12 COMP. FAIL#1 IN. VALVE FAIL. PRESSURE ALARM PRESSURE SIGNAL PSV
9 1.12E-12 COMMUNICATION DIESEL GENER LOSS AC PSV
10 1.12E-12 COMM_MANUAL DIESEL GENER LOSS AC PSV
11 1.04E-12 COMP. FAIL#1 IN. VALVE FAIL. OP. SHIP PUMP PRESSURE SIGNAL PSV
12 1.04E-12 COMP. FAIL#1 IN. VALVE FAIL. OP. COMMUNICATION PRESSURE SIGNAL PSV
13 1.00E-12 AIR COMPRESSOR OP. ALARM PSV
14 6.63E-13 AIR COMPRESSOR COMMUNICATION PSV
15 6.63E-13 AIR COMPRESSOR COMM_MANUAL PSV
16 1.00E-14 AIR COMPRESSOR PSV PUMPS
TOTAL 1.23E-10

the following: a) LNG tank rupture, owing to overpressure, over-
filling or underpressure b) pipe rupture containing LNG, unloaded
from ship with rate 2000 m3/h for the onshore plant and with
4000 m3/h for the offshore plant c) pipe rupture containing LNG
pumped from the send out pumps to the plant with rate 250 m3/h
in the onshore and 4330 m3/h in the offshore d) pipe rupture
containing natural gas which is transferred to the outlet section of
the plant with rate 2000 m3/h for the onshore plant and 9600 m3/h
for the offshore one.
4.3.1. LNG tank rupture, owing to overpressure, overfilling or
underpressure
In case of LNG tank rupture it is assumed that the roof of the
tank will fail and either immediate or delayed ignition will occur. In
case of immediate ignition there will be a pool fire (see Fig. 8,
branch #1), while in case of delayed ignition LNG will vaporize and
produce a cloud denser than air spreading according to the weather
conditions (wind speed, ambient temperature, class of atmospheric
stability, humidity). LNG concentrations depend on the amount of
the released LNG and the atmospheric and meteorological condi-
tions. An accident sequence resulting in LNG release to the envi-
ronment, if precisely determined, would lead to a unique type of
release. Such precise knowledge is not always available, however,
and in such cases there is an uncertainty about the possible release
category following the accident. If the cloud reaches concentrations
between upper and lower flammability level (5e15% by volume)
the mixture can be ignited if contacted by an ignition source and
either a flash fire (see Fig. 11, branch #2) or an explosion will take
place (see Fig. 11, branch #3).
4.3.2. Pipe rupture in unloading section (ship to tank)
A number of accident sequences could result in a pipebreak in
the piping which connects the ship to the LNG tank. For this plant-
damage state it is assumed that: in the onshore plant LNG is
released at the unloading rate equal to 2000 m3/h for 10 min and in
the offshore plant LNG is released at the unloading rate equal to
4000 m3/h for 10 min. In case of pipe rupture containing LNG im-
mediate ignition will cause a pool fire (see Fig. 11, branch #1), while
in case of delayed ignition LNG will vaporize at a rate equal to the
release rate and produce a cloud denser than air spreading ac-
cording to the weather conditions. If the cloud reaches concentra-
tions between upper and lower flammability level (5e15% by
volume) the mixture can be ignited if contacted by an ignition
source and either a flash fire (see Fig. 11, branch #2) or an explosion
will take place (see Fig. 11, branch #3). In all cases of pipe rupture it
has been assumed that 10 min are required for operators to close
the appropriate valves and stop the release, following personal
communication with safety engineers of LNG plants.
4.3.3. Pipe rupture in loading section (after send out pump)
There are no additional events which mitigate such an accident,
and the event was not reduced to other simpler events to deter-
mine its frequency. The frequency of this event is assessed directly,
based on engineering data and the pipe length. The assumption
made is the following: the pipe rupture in the onshore plant con-
taining LNG pumped from the send out pumps to the plant with
rate 250 m3/h for 10 min, while in the offshore plant the relevant
rate is 4330 m3/h for 10 min.

Table 8
Frequency (/yr) of all plant-damage states.

Plant-damage state Frequency (events/yr)

Table 7
Cutsets of accident sequence# 3, of Event Tree with initiating event “Strong waves ONSHORE LNG FACILITY
during unloading” (offshore LNG plant). 1 Tank rupture owing to overpressure 1.79  10
6
2 Tank rupture owing to overfilling 1.55  10
7
Frequency Cutsets
3 Tank rupture owing to underpressure 2.63  10
9
(/yr)
4 Pipebreak in the piping between ship and tank 1.55  10
5
1 1.00E-05 FLOAT_BARRIER OP. COMMUNICATION WAVE_UNLOADING 5 Pipebreak between LNG tanks and pumps 1.0  10
5
2 1.00E-05 FLOAT_BARRIER OP. SHIP PUMP WAVE_UNLOADING 6 Pipebreak in the outlet pipeline 1.0  10
5
3 1.13E-06 FLOAT_BARRIER MOVEMENT WAVE_UNLOADING OFFSHORE LNG FACILITY
SENSOR 7 Tank rupture owing to overpressure 4.10  10
6
4 1.00E-06 FLOAT_BARRIER OP. ALARM WAVE_UNLOADING 8 Tank rupture owing to overfilling 1.55  10
7
5 5.64E-07 COMMUNICATION FLOAT_BARRIER WAVE_UNLOADING 9 Tank rupture owing to underpressure 2.63  10
9
6 5.64E-07 COMM_MANUAL FLOAT_BARRIER WAVE_UNLOADING 10 Pipebreak in the piping between ship and tank 1.55  10
5
7 1.00E-08 FLOAT_BARRIER PUMPS WAVE_UNLOADING 11 Pipebreak between LNG tanks and pumps 1.0  10
5
TOTAL 2.3E-05 12 Pipebreak in the outlet pipeline 2.0  10
5

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13
Fig. 11. Consequences following the rupture of an LNG tank or liquid pipeline.
Fig. 12. Consequences following the rupture of a high pressure natural gas pipeline.
Fig. 13. Individual risk contours for onshore LNG terminal (distance in m).
Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
11
In case of pipe rupture containing LNG immediate ignition will
cause a pool fire (see Fig. 11, branch #1), while in case of delayed
ignition LNG will vaporize at a rate equal to the release rate and
produce a cloud denser than air spreading according to the
weather conditions. If the cloud reaches concentrations between
upper and lower flammability level (5e15% by volume) the
mixture can be ignited if contacted by an ignition source and either
a flash fire (see Fig. 11, branch #2) or an explosion will take place
(see Fig. 11, branch #3).
4.3.4. Pipe rupture in outlet section
There are no additional events which mitigate such an accident,
and the event was not reduced to other simpler events to deter-
mine its frequency. The frequency of this event is assessed directly,
based on engineering data and the pipe length. The assumption
made is the following: in the onshore plant pipe rupture containing
NG which is transferred to the outlet section of the plant with rate
750 m3/h for 10 min, while in the offshore plant the relevant rate is
9600 m3/h for 10 min.
In case of pipe rupture containing high pressure natural gas
immediate ignition will cause a jet fire (see Fig. 12, branch #1),
while in case of delayed ignition natural gas will disperse according
to the weather conditions. If the cloud reaches concentrations be-
tween upper and lower flammability level (5e15% by volume) the
mixture can be ignited if contacted by an ignition source and either
a flash fire (see Fig. 12, branch #2) or an explosion will take place
(see Fig. 12, branch #3).
4.4. Risk integration and results
For all plant-damage states presented in Table 3, all types of
release which might occur such as pool fire, jet fire, flash fire and
explosion have been considered and the individual risk profile has
been assessed. Parameters with variability such as wind speed,
wind direction, atmospheric stability, ambient temperature and
position of ignition source have been considered as random vari-
ables, along with the probability density functions that quantify the
uncertainty about them, as presented in Table 9. The computer code
SOCRATES (Papazoglou et al., 1996) has been used for consequence
assessment and integration of results.
12 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13

Table 9
Variability of variables for consequence assessment of LNG damage states.
Uncertain variable
1 Wind speed distribution
2 Wind direction
3 Ambient temperature
4 Atmospheric stability
5 Distance of ignition for
delayed ignition following tank rupture
6 Distance of ignition for
delayed ignition following pipe
rupture (tank to pumps
7 Distance of ignition for delayed
ignition following pipe
rupture (ship to tank)
8 Distance of ignition for delayed
ignition in send out pipeline:
HAZOP, FMEA and qualitative risk matrices, without real guidance
how to use these methods in an integrated way.
Distribution Application of the methodological steps of probabilistic safety
Normal (1e8 m/s)
analysis in LNG terminal, in the framework of iNTeg-Risk project
50.8% N, 4.32% NE, 4.28% E, resulted in the identification of 21 initiating events which can cause
2.90% SE, 18.26% S, 4.34% SW, accident and lead to one of the six plant-damage states identified
2.29% W, 11.82% NW and presented in Table 3. Risk from operation of LNG terminals has
Normal (10e32  C)
been identified by calculating the probability of an individual fa-
16.67% for each PeG Stability
Class (AeF) tality per year of facility operation and has been expressed in the
Uniform in the range form of isorisk curves. The most important contributor to individ-
of 50e500 m ual risk is the failure of the piping between ship and terminals
Uniform in the range
followed by delayed ignition. This is due to the amount of LNG
of 50e350 m
released, followed by dispersion and ignition (either immediate or
Uniform in the range delayed). Next follows the rupture of tank followed by delayed
of 100e1000 m ignition (either flash or explosion) of vapors. The offshore terminal
has higher individual risk rates, owing to the number and size of the
Uniform in the range
tanks, which handle larger quantities than the onshore.
of 100e1000 m

6. The contribution of Ioannis Papazoglou to the

5
Total individual risk of the onshore plant is equal to 10 e
10
8/yr at distance of 80, 400, 750 and 1000 m from the center of
the plant respectively. Total individual risk of the offshore plant
has also been calculated and is equal to 10
5e10
8/yr at distance
of 100, 500, 850 and 1100 m from the center of the plants
respectively. Individual risk contours for the onshore plant are
presented in Fig. 13 and are valid under the meteorological as-
sumptions described.
The offshore plant has higher frequencies of plant-damage
states compared to the onshore, owing to the following reasons: a)
larger number of LNG tanks (four compared to two for the onshore)
b) additional initiating event of strong winds, which is applicable
only to the offshore plant and c) larger length of outlet pipeline
which might break. The consequences from LNG release from the
offshore plant cause adverse effects (fatalities) to larger distance
than the onshore, owing to higher quantities of release, but not
proportional to the release rate. Meteorological conditions and the
distance of ignition are important parameters in case of delayed
ignition, since they affect the quantity which will be ignited or
exploded.
5. Conclusions
This paper presents an integrated risk assessment framework
for Liquefied Natural Gas (LNG) terminals. The major steps for risk
assessment are hazard identification, accident sequence modeling,
data acquisition and parameter estimation, accident sequence
quantification, consequence assessment, and integration of results
where individual risk is assessed for any person who might be near
the terminals. Probabilistic methods for risk assessment have
extensively been used in the literature for toxic and flammable
substances (CCPS, 2000; Lees, 1996; Papazoglou et al., 1992, 1996;
Taveau, 2010; Tixier et al., 2002), but not for LNG. This probabi-
listic method for risk assessment assesses in a structured way all
the existing hazards, all barriers and safety measures of the in-
stallations which may prevent the hazards from appearing, the
ways this barriers might fail, the release which will occur, the
possible consequence to people surrounding the terminals and
finally the risk the installation poses to people. Within this
framework Master Logic Diagrams provide a structured method for
hazard identification and uncertainties in weather conditions and
position of sources of ignition are also taken into account in risk
quantification. On the other hand the ISO 17776 presents general
guidelines on tools and techniques for hazard identification and
risk assessment and presents briefly QRA, Fault Trees, Event Trees,
development of QRA in the process industry
Ioannis Papazoglou, was born in Athens in 1949, obtained his
diploma from the School of Electrical & Mechanical Engineering of
the National Technical University of Athens (1972) and his Masters
and PhD degree from the Department of Nuclear Engineering of
MIT in the field of Reliability and Risk Assessment (1974, 1977).
Between 1980 and 1984 he was leader of the Risk Evaluation Group
of the Department of Nuclear Energy at the Brookhaven National
Laboratory, U.S.A. He returned to Greece in 1985 and joined the
National Center for Scientific Research DEMOKRITOS (NCSRD),
where he became Director of the Institute of Nuclear Technology e
Radiation Protection and member of the Board of NCSRD Directors
for ten years.
In 1989 he organized within the NCSRD the Laboratory of Sys-
tems Reliability and Industrial Safety (SRISL), which consists of six
PhD researchers performing Research & Development in the areas
of risk assessment & management, decision analysis and uncer-
tainty quantification mainly applied in chemical installations and
systems. He is one of the pioneers in Quantitative Risk Assessment
both in the nuclear and chemical industry. While in the US he
performed probabilistic safety analysis and reliability of nuclear
power plants, review and evaluation of risk studies, probabilistic
analysis of specific safety issues, generic reliability issues, devel-
opment of NRC probabilistic safety analysis guide and audit manual
and application of multi-objective decision analysis on the disag-
gregation of global safety objectives to system reliability re-
quirements. As the Head of SRISL his major contribution was the
development of a methodology for Quantitative Risk Assessment
for the chemical industry handling toxic, flammable and explosive
substances. This methodology has been applied to various in-
dustries, such as ammonia, LNG, LPG, refineries and explosive
plants. He was also in charge of the development of a methodology
for the evaluation of safety reports of industrial installations subject
to the SEVESO-II Directive, applied to all major hazard industrial
plants in Greece. In addition, he contributed in the development of

Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
 O.N. Aneziris et al. / Journal of Loss Prevention in the Process Industries xxx (2013) 1e13
dynamic reliability of complex systems, decision analysis under
uncertainty, multi-objective techniques useful to determine the
land use around hazardous chemical installations and methods for
emergency response planning. He elaborated the development of
the Occupational Risk Model for quantifying the risk of the working
population in various professions.
Dr. Ioannis Papazoglou has been active in the European scene of
risk assessment & management through various positions in Eu-
ropean organizations and committees. Most recently he has been a
Visiting Professor at Delft Technical University, in the faculty of
Technology Policy and Management-Safety Science Group, orga-
nizing and teaching a course in “Quantification Techniques for Risk
Analysis and Management” between 2006 and 2007. As head of
SRISL he has supervised several PhD theses in the fields of dynamic
reliability and emergency planning. He has published over two
hundred and seventy seven scientific publications comprising ar-
ticles in scientific peer reviewed journals, papers in peer reviewed
conference proceedings, technical reports and book chapters. He
serves at the editorial board of the “Journal of Hazardous Mate-
rials”, “Reliability Engineering and System Safety” and the “Inter-
national Journal of Risk Assessment and Management”. He has
served as Guest Editor in special issues of the “Journal of Hazardous
Materials”, “Reliability Engineering and System Safety” and “Safety
Science”. He has been the General Chairman of ESREL’96 e PSAMIII
and of ESREL 2010 conferences both organized in Greece, and
member of the Technical Committee of almost all ESREL confer-
ences to date. He was the Chairman of the European Safety and
Reliability Association (ESRA) for several years, the President of the
International Association for Probabilistic Safety Assessment and
Management (IAPSAM) Board of Directors and Member of the same
Board, and he has served at the Executive Committee of the Society
for Risk Analysis-Europe.
References
ABS Consulting. (2004). Consequence assessment methods for incidents involving re-
leases from liquefied natural gas carriers. ABS Consulting.
Aneziris, O., Papazoglou, I. A., & Konstantinidou, M. (2010). Quantitative risk analysis
of LNG plants. Report of iNTegRISK Project.
Bais, A. F., Zerefos, C. S., & Ziomas, I. C. (1989). Accidental releases form storage
installations. Journal of Loss Prevention in the Process Industries, 2, 155e160.
Bubbico, R., Cave, S., & Mazzarotta, B. (2009). Preliminary risk analysis for LNG
tankers approaching a maritime terminal. Journal of Loss Prevention in the
Process Industries, 22(5), 634e638.
CCPS. (2000). Guidelines for chemical process quantitative risk analysis (2nd ed.). New
York: AIChE.
Cleaver, P., Johnson, M., & Ho, B. (2007). A summary of some experimental data on
LNG safety. Journal of Hazardous Materials, 140(3), 429e438.
CPR 18E. (1999). Guidelines for quantitative risk assessment. In Publication series on
dangerous substances (PSG 3). Purple Book. www.content.publicatiereeksgevaar
lijkestoffen.nl/documents/PGS3-1999-v0.1-quantitative-risk-assessment.pdf.
Giannissi, S. G., Venetsanos, A. G., Markatos, N., & Bartzis, J. G. (2013). Numerical
simulation of LNG dispersion under two-phase release conditions. Journal of
Loss Prevention in the Process Industries, 26(1), 245e254.
Hanlin, A. L. (2006). A review of large-scale LNG spills: experiments and modeling.
Journal of Hazardous Materials, 132(2e3), 119e140.
Hannaman, G. W., Spurgin, A. J., & Lukic, Y. (1985). Model for assessing human
cognitive reliability in PRA studies, In IEEE 3rd conf. on human factors and nu-
clear power plants, Monterey, CA, June 23e27.
ISO 17776. (2000). Petroleum and natural gas industries e Offshore production in-
stallations e Guidelines on tools and techniques for hazard identification and risk
assessment.
Ivings, M. J., Lea, C. J., Webber, D. M., Jagger, S. F., & Coldrick, S. (2013). A protocol for
the evaluation of LNG vapour dispersion models. Journal of Loss Prevention in the
Process Industries, 26(1), 153e163.
Jo, Y. D., & Ahn, B. J. (2002). Analysis of hazard areas associated with high-pressure
natural-gas pipelines. Journal of Loss Prevention in the Process Industries, 15(3),
179e188.
Jo, Y.-D., & Ahn, B. J. (2005). A method of quantitative risk assessment for trans-
mission pipeline carrying natural gas. Journal of Hazardous Materials, 123(1e3),
1e12.
Please cite this article in press as: Aneziris, O. N., et al., Integrated risk assessment for LNG terminals, Journal of Loss Prevention in the Process
Industries (2013), http://dx.doi.org/10.1016/j.jlp.2013.07.014
13
Jovanovic, A. (2010). iNTeg-Risk project: concept and first results. In Proceedings of
the 2nd iNTeg-Risk conference: New technologies and emerging risks e Dealing
with multiple and interconnected emerging risks. Stuttgart (Germany): Steinbeis
Edition, ISBN 978-3-938062-33-3.
Koopman, R. P., & Ermak, D. L. (2007). Lessons learned from LNG safety research.
Journal of Hazardous Materials, 140(3), 412e428.
Landucci, G., Tugnoli, A., Spadoni, G., & Cozzani, V. (2012). LNG regasification ter-
minals: assessment of accidents due to external acts of Interference. In Proc. of
11th International probabilistic safety assessment and management conference and
the annual European safety and reliability conference 2012, PSAM11 ESREL 2012:
Vol. 6 (pp. 4373e4382).
Lees, F. P. (1996) (2nd ed.).. Loss prevention in the process industries, 3 Vol. London
and Baton: Butterworths.
Licari, F. A., & Weimer, C. D. (2011). Risk-based siting considerations for LNG ter-
minals e comparative perspectives of United States & Europe. Journal of Loss
Prevention in the Process Industries, 24(6), 736e752.
Ohba, R., Kouchi, A., Hara, T., Vieillard, V., & Nedelka, D. (2004). Validation of heavy
and light gas dispersion models for the safety analysis of LNG tank. Journal of
Loss Prevention in the Process Industries, 17(5), 325e337.
Olewski, T., Nayak, S., Basha, O., Waldram, S., & Véchot, L. (2011). Medium scale
LNG-related experiments and CFD simulation of water curtain. Journal of Loss
Prevention in the Process Industries, 24(6), 798e804.
OREDA. (1992). Offshore reliability data handbook (2nd Ed.). Veritasveien 1, N-1322
Hovik, Norway: Det Norske Veritas.
OREDA. (1997). Offshore reliability data handbook (3rd Ed.). Veritasveien 1, N-1322
Hovik, Norway: Det Norske Veritas.
Papazoglou, I. A., & Aneziris, O. N. (2003). Master Logic Diagram: method for hazard
and Initiating event identification in process plants. Journal of Hazardous Ma-
terials, A97, 11e30.
Papazoglou, I. A., Aneziris, O., Bonanos, G., & Christou, M. (1996). SOCRATES: a
computerized toolkit for quantification of the risk from accidental releases of
toxic and/or flammable substance. International Journal of Environment and
Pollution, 6(4e6), 500e533.
Papazoglou, I. A., Nivolianitou, Z., Aneziris, O., & Christou, M. (1992). Probabilistic
safety analysis in chemical installations. Journal of Loss Prevention in the Process
Industries, 5(3), 181e191.
Pitblado, R., Baik, J., Hughes, G., Ferro, C., & Shaw, S. (2004). Consequences of LNG
marine incidents. In CCPS conference Orlando.
Raj, P. K. (2011). Evaporating liquid flow in a channel (an integral model based on
shallow water flow approximation). Journal of Loss Prevention in the Process
Industries, 24(6), 886e899.
Raj, P. K., & Bowdoin, L. A. (2010). Underwater LNG release: does a pool form on the
water surface? What are the characteristics of the vapor released? Journal of
Loss Prevention in the Process Industries, 23(6), 753e761.
Raj, P. K., & Lemoff, T. (2009). Risk analysis based LNG facility siting standard in
NFPA 59A. Journal of Loss Prevention in the Process Industries, 22(6), 820e829.
Rana, M. A., & Mannan, M. S. (2010). Forced dispersion of LNG vapor with water
curtain. Journal of Loss Prevention in the Process Industries, 23(6), 768e772.
Rana, M. A., Cormier, B. R., Suardin, J. A., Zhang, Y., & Mannan, M. S. (2008).
Experimental study of effective water spray curtain application in dispersing
liquefied natural gas vapor clouds. Process Safety Progress, 27(4), 345e353.
Sandia Report. (2004). Guidance on risk analysis and safety implications of a large
liquefied natural gas (LNG) spill over water. SAND 2004-6258.
Takeno, K., Ichinose, T., Tokuda, K., Ohba, R., Yoshida, K., & Ogura, K. (1996). Effects
of high expansion foam dispersed onto leaked LNG on the atmospheric diffu-
sion of vaporized gas. Journal of Loss Prevention in the Process Industries, 9(2),
125e133.
Taveau, J. (2010). Risk assessment and land-use planning regulations in France
following the AZF disaster. Journal of Loss Prevention in the Process Industries, 23,
813e823.
Taylor, D. W. (2007). The role of consequence modeling in LNG facility siting. Journal
of Hazardous Materials, 142(3), 776e785.
Tixier, J., Dussere, G., Salvi, O., & Gaston, D. (2002). Review of 62 risk analysis
methods of industrial plants. Journal of Loss Prevention in the Process Industries,
15, 291e303.
TNO. (1989). Methods for determination of possible damage to people and objects
resulting from releases of hazardous materials (Green Book). Voorburg.
TNO. (1992). Methods foe the calculation of physical effects resulting from releases of
hazardous materials (liquids and gases), (Yellow Book). Voorburg, The
Netherlands: Committee for the Prevention of Disasters.
Tugnoli, A., Landucci, G., Salzano, E., & Cozzani, V. (2012). Supporting the selection
of process and plant design options by inherent safety KPIs. Journal of Loss
Prevention in the Process Industries, 25(5), 830e842.
Uguccioni, G. (2010). Reference solution containing report documents, methods and
tools for the assessment and management of emerging risks related to new and
intensified technologies available for LNG gasification terminals. Report of
iNTegRISK Project.
Vanem, E., Antão, P., Østvik, I., & de Comas, F. D. C. (2008). Analysing the risk of LNG
carrier operation. Reliability Engineering & System Safety, 93(9), 1328e1344.
Yun, G., Rogers, W. J., & Mannan, M. S. (2009). Risk assessment of LNG importation
terminals using the Bayesian-LOPA methodology. Journal of Loss Prevention in
the Process Industries, 22(1), 91e96.