DNV QRA Sample Report

QRA

Lyse LNG Base Load Plant

2110A11U Lyse Contract No_{61-10156.05.01} :

Linde Job Code:

STAVANGER Lyse Project No: R100

Item No:

Linde Doc. No:

&AA S-CS 1002

Lyse Doc. No:

R100-LE-S-RS0003

Page 1 of 133

Lyse Infra AS

Quantitative Risk Analysis (QRA)

Lyse LNG Base Load Plant

Train 1

03 ISSUE 03 25.08.2008 Revised acc. to Lyse Comments Can Rath Buttinger 02 ISSUE 02 14.03.2008 Revised acc. to the Comments in

QRA presentation from 26.02.2008 Can Rath Ralph 01 ISSUE 01 22.02.2008 Revised acc. to the Lyse Comments Can Rath/Baumgartner Ralph

DRAFT - 28.12.2007 Can Buttinger Can

Rev

(Lyse)

Status

(Linde)

Issue

QRA

Lyse LNG Base Load Plant

2110A11U Lyse Contract No_{61-10156.05.01} :

Linde Job Code:

STAVANGER Lyse Project No: R100

Item No:

Linde Doc. No:

&AA S-CS 1002

Lyse Doc. No:

R100-LE-S-RS0003 Page 1 of 133 Lyse Infra AS

Table of Contents 

1.0

Executive Summary... 3

2.0

Introduction ... 9

2.1

Objective of the Study ... 9

2.2

General Description of the Approach ... 9

3.0

General Description of Process and Facilities... 13

3.1

Natural Gas Treatment and Gas Liquefaction ... 13

3.1.1

Feed Gas Reception ... 13

3.1.2

Natural Gas Pretreatment... 13

3.1.3

NG Liquefaction... 14

3.2

Refrigerant System... 14

3.2.1

Refrigerant Cycle... 15

3.2.2

Refrigerant Storage and Make-Up... 15

3.3

LNG Storage / LNG Loading ... 16

3.3.1

LNG Storage ... 16

3.3.2

LNG Loading ... 16

3.4

Fuel Gas System ... 17

3.5

Hot Oil System ... 17

3.6

Flare System ... 18

3.7

ESD and Blowdown System... 18

4.0

Study Methodology... 20

4.1

Risk Analysis Basics... 20

4.2

Definition and Types of Risk... 20

4.3

Acceptance Criteria ... 21

4.4

Hazard Identification... 23

5.0

Data used for the Risk Assessment... 25

5.1

Scenarios ... 25

5.2

Leak Frequencies ... 26

5.3

Release Duration... 27

5.4

Atmospheric Conditions... 28

5.5

Population Distribution... 28

5.6

Ignition Sources... 29

5.7

Consequence Calculations... 30

5.7.1

Discharge and Dispersion ... 30

5.7.2

Instantaneous Releases ... 31

QRA

Lyse LNG Base Load Plant

2110A11U Lyse Contract No_{61-10156.05.01} :

Linde Job Code:

STAVANGER Lyse Project No: R100

Item No:

Linde Doc. No:

&AA S-CS 1002

Lyse Doc. No:

R100-LE-S-RS0003 Page 2 of 133 Lyse Infra AS

5.7.4

Release Duration... 31

5.7.5

Dispersion ... 31

5.7.6

Thermal Radiation and Overpressure... 31

5.8

Mitigation Measures taken into Account ... 32

6.0

Results of the Risk Analysis... 34

6.1

Risk 1

and 2

party ... 34

6.2

Risk 3

party ... 39

6.3

Location Specific Risk ... 45

6.4

Overpressure Risk... 46

7.0

Sensitivity Evaluation... 50

7.1

Sensitivity 1: Pit on the jetty, LNG Storage Tank and the

Pentane Tank ... 50

7.1.1

Discussion ... 50

7.1.2

Comparison with Criteria ... 53

7.2

Sensitivity 2: Rock Wall towards the public area on the peninsula ... 53

7.2.1

Discussion ... 53

7.2.2

Comparison with Criteria ... 54

7.3

Sensitivity 3: Splitting of process vessels inside the refrigerant cycle into

smaller vessels and additional block valves to reduce

the volume of inventory loops... 54

8.0

Conclusions ... 55

9.0

Appendix A: Assumption Sheets ... 56

10.0

Appendix B: Hazard Identification ... 90

11.0

Appendix C: Equipment Count... 95

12.0

Appendix D: Results of LEAK 3.2 Calculations ... 99

13.0

Appendix E: Individual Risk Ranking Report... 104

14.0

Appendix F: Details on the Analysis Procedure ... 127

1.0 Executive

Summary

Linde Engineering AG (Linde), on the behalf of Skangass AS (Skangass), has conducted a Quantitative Risk Analysis (QRA) of the first train of the new Lyse LNG Base Load Plant, lo-cated near Stavanger, Norway. The objective of the study was to determine the level of risk associated with the Lyse LNG Base Load Plant, which is currently being designed, and com-pare it with the acceptance criteria given by Lyse Infra AS (Lyse).

Approach

To achieve this objective, a thorough analysis was made of all hazardous substance invento-ries and streams within the plant. In particular, all equipment were counted and used as a basis to calculate leakage frequencies. The determination of leakage frequencies was done using the program "LEAK", a proprietary program from Det Norske Veritas (DNV). To achieve this, the whole plant was segmented, four leak size categories were defined, and leakage frequency calculations were performed for the segments based on the categories.

Meteorological data as well as population data provided by Lyse were used for study. The data are important for DNV's risk assessment tool PHAST RISK (further SAFETI), which takes into account (when applicable):

• Pool fires, • Jet Fires, • Flash Fires and

• Vapour Cloud Explosions.

For the scenarios defined for the Lyse LNG Base Load Plant, the population and the deter-mined ignition source distribution were entered into PHAST RISK and analysed with respect to their contribution to individual risk and to societal risk.

Results

PHAST RISK calculates both individual risk and societal risk. The individual risk for 1st, 2nd and 3rd parties are calculated based on these results which are then compared to the acceptance criteria.

As expected, the main contribution to the overall risk is due to vapour cloud explosions and flash fires.

Individual Risk, 1st _{and 2}nd _party

Individual risk is a measure of risk to which an individual person is exposed. The individual risk criteria are divided in this analysis into Individual Specific Risk (ISR) and Average Individual Risk (AVR).

The 1st party risk is defined as a fatality risk for the Lyse LNG Base Load Plant personnel. Maintenance personnel and operators during supervision rounds are considered to be the most exposed personnel.

Fatality risk for the LNG Carrier personnel (Truck, Ship Loading and external contractors) have been considered as 2nd party and are also assumed to be within the most exposed personnel group.

The figures 1 and 2 show the calculated individual risk contour lines for the Lyse LNG Base Load Plant. The calculated risk contours of individual risk for the most exposed person is illus-trated in Figure 1. The figure shows the contours of the most exposed person to suffer a fatality every 100 000 years (green line), every 1 000 000 years (dark blue line). The risk is illustrated for the most exposed person present in the process plant area, 20 % of their working time per year.

Figure 1: Most exposed person individual risk contour lines for the Lyse LNG Base Load Plant

The risk contours for the individual risk are also calculated and is illustrated in Figure 2.

The figure shows the contours of individual risk for a fatality every 10 000 years (green line), every 100 000 years (dark blue line), etc. The risk is illustrated for 1 person present at any point outside a building in the plant, continuously 8 hours a day, 5 days a week during a whole year (45 weeks).

10-5 /yr 10-6 /yr

Figure 2: Individual risk contour lines for the Lyse LNG Base Load Plant

The Individual Risk (IR) has been extracted from the PHAST RISK risk report: It is calculated for 1 person and for each worker group present at any point in the plant, continuously 8760 hours per year.

The Individual Specific Risk (ISR) for 1st and 2nd party, which considers the individual working hours for each group, is given below in Table 1.

10-4 /yr 10-5 /yr 10-6 /yr 10-7 /yr

Table 1: Individual Specific Risk (ISR) for 1st and 2nd party Buildings/Personnel Locations ISR [year]

Operator 1.2 X 10-4

Process Area (Maintenance) 1.2 X 10-4

Truck Loading 6.7 X 10-5

Ship Loading (Jetty) 2.0 X 10-5

Ship Bridge 5.0 X 10-5

Ship Deck 4.8 X 10-5

ISR > 1 X 10-3 Not acceptable

1 X 10-3 < ISR < 1 X 10-6 ALARP

ISR < 1 X 10-6 Acceptable

The Average Individual Risk (AVR) of 5.0 X 10-5 per year for all personnel (1st and 2nd party) is within the ALARP regime, i.e. As Low As Reasonably Practical, which means that the mitiga-tion measures may be applied as long as the respective cost benefit ratio is reasonable.

Individual Risk, 3rd _party

For the Lyse LNG Base Load Plant such mitigation measures have already been applied (e.g. a rock wall "mound" around the LNG tank, the ESD and Blowdown system).

The Individual Specific Risk (ISR) for the 3rd party risk is given below in Table 2.

Table 2: Individual Specific Risk (ISR) for the 3rd party

Personnel Locations ISR [year]

Peninsula 4.6 X 10-8

Hiking Track 2.2 X 10-6

Ferry Terminal_office workers 7.6 X 10-7 Ferry Terminal_industry workers 3.8 X 10-7 Ferry Terminal_passengers 4.0 X 10-7 Energiveien+Risavika_office workers 4.6 X 10-9 Energiveien+Risavika_industry workers 4.6 X 10-9 Container Area_office workers 3.2 X 10-9 Container Area_industry workers 3.2 X 10-9 Rest Companys_office workers 2.8 X 10-14 Rest Companys_industry workers 2.8 X 10-14

ISR > 1 X 10-5 Not acceptable 1 X 10-5 < ISR < 1 X 10-7 ALARP

ISR < 1 X 10-7 Acceptable

The Average Individual Risk (AVR) of 1.5 X 10-7 per year for people living, working or staying outside the Lyse LNG base load plant does not exceed the acceptance criteria of 1 X 10-5 / year and is within the ALARP regime.

Societal Risk, 3rd _party

Societal risk (or 3rd party risk) is a measure of the collective risk to which a certain population is subjected as a whole. It is usually depicted in form of a so-called FN curve, which shows the frequency (F), that a given number, N people or more (hence N+) will be exposed to lethal consequences.

The societal risk calculated for the Lyse LNG Base Load Plant is shown below in Figure 3.

The minimum and maximum risk criteria are shown in Figure 3 as blue and green lines respec-tively. Calculations of the external societal risk (e.g. Hiking Track, Peninsula, Industry Area and Ferry Terminal) have shown that this risk for the Lyse LNG Base Load Plant falls into the area between the upper and lower limit line, i.e. the ALARP regime.

Conclusions

A careful risk analysis of the first train of the Lyse LNG Base Load Plant has been performed, including a very detailed counting of all pieces of equipment (including all pipelines, vessels and compressors etc.).

It has been found that the calculated levels of individual risk for the 1st, 2nd and 3rd parties are in compliance with the criteria set by Lyse.

The individual specific risk for 1st and 2nd party for the most exposed person in each group, maintenance and operators, is lower than 1 X 10-3 per year and within the acceptance criteria.

The average individual risk for personnel is 5.0 X 10-5 _{per year and therefore clearly below} the acceptance criteria of 1 X 10-4 / year.

The individual specific risk for 3rd party for the most exposed population (e.g. hiking track, ferry terminal industry and office workers) is within the ALARP regime. The average individual risk is 1.5 X 10-7 per year and therefore within the lower region of ALARP, close to acceptable in general. The calculated risk for the Peninsula people is acceptable since the rock wall (mound) is taken into account (refer to the Chapter 7.2).

2.0 Introduction

Linde is currently performing the design of train 1 of the new Lyse LNG Base Load Plant, lo-cated near Stavanger, Norway, on behalf of Skangass. The design of the plant shall conform to EN 1473:2007 "Installation and equipment for liquefied natural gas – Design of onshore instal-lations" [1]. To fulfil EN 1473 a hazard assessment shall be carried out during the design of the plant. A part of this hazard assessment is a risk investigation, in this case using Quantitative Risk Analysis (QRA). This document describes in detail the results and methodology used to obtain the results of the QRA.

2.1

Objective of the Study

The objective of the study was to estimate the level of risk by QRA. The performed QRA cov-ered all essential risks of the new Lyse LNG Base Load Plant as far as they are of relevance and have been determined in the Hazard Identification (HAZID) [Appendix B].

The individual personnel risk and the 3rd party risk are evaluated in this study. The overpres-sure risk to the plant buildings and equipment (Central Control Room, LNG Tank etc.) and a consequence modelling of worst case scenarios, e.g. hydrocarbon dispersion from the LNG Tank, are included in the calculations.

2.2 General

Description of the Approach

QRA is a well established methodology to assess the risks of industrial activities and to com-pare them with risks of normal activities. Linde has used a QRA methodology as shown in Figure 4.

The QRA performed by Linde used the QRA Reports performed by Advantica [2] as a refer-ence.

Data Collection

This study is based on the following documents:

• Process Flow Diagrams (PFDs) • Heat and Material Balance

• Process and Instrument Diagrams (P&IDs) • Process Description

• General Plot Plan

• Mechanical and Process Data Sheets • ESD and Blow-down System Concept • Lyse LNG Base Load Plant Site conditions • Manning Level Table [3].

• Acceptance Risk Criteria for Lyse LNG Base Load Plant • Development Area Plan and Information from Lyse

Figure 4: QRA Methodology

Collection and Analysis of Background Data

This was an internal Linde exercise to collect information relevant to the QRA study. The leak frequencies for equipment, valves etc. are based on DNV database and included in DNV's proprietary program “LEAK”.

Hazard Identification (HAZID)

The hazard identification process is important for any risk analysis. A HAZID was been per-formed prior to the QRA by Linde. A HAZOP study for the main plant has been completed.

Frequency Analysis

Failure frequencies were determined for each event in order to perform a probabilistic risk as-sessment. Generally, a number of techniques are available to determine such frequencies. The approach relies on generic data. This provides failure frequencies for equipment items where data has been obtained from failure reports from a range of facilities. DNV has developed an extensive generic failure frequency database for this purpose, which is compiled in DNV's pro-prietary LEAK 3.2 software. These leak frequencies are based on the "UK Health & Safety Ex-ecutive" data for offshore facilities. To reflect the design of the Lyse LNG base load plant, which is a onshore facility and has clean service, new leak frequencies for pipes and process vessels based on the "Purple Book" [6] are implemented in the LEAK Program. The changes are shown in Appendix D. This program was used to determine overall leakage frequencies subsequently used in the risk assessment.

Consequence Analysis

For each hazard scenario PHAST RISK (Software for the Assessment of Flammable, Explo-sive and Toxic Impacts) and PHAST (Process Hazard Assessment Software Tool) software was used to determine consequence effect zones for each hazard. The different possible out-comes could be:

• Dispersing of Hydrocarbon Vapour Cloud • Explosion • Fireball • BLEVE • Flash Fire • Jet Fire • Pool Fire.

The CO2/H2S (sour gas) in CO2 wash unit is routed to the regenerative thermal oxidation and

then sent to atmosphere at safe location. Dispersion from a leak of CO2/H2S gas cloud due to

low operating pressure is not considered as the contribution to the risk is minor compared to the above mentioned outcomes.

The particular outcomes modelled depend on source terms (conditions like fluid, temperature, pressure etc.) and release phenomenology. The current understanding of the mechanisms occurring during and after the release is included in state-of-the-art models in the PHAST RISK and PHAST packages.

Risk Calculations

The outcome of the PHAST RISK analysis are risk terms presented in form of risk contours and FN curves, where the former is a form of location specific individual risk measurement while the latter is a measure for societal (group) risk.

The individual risk is the risk for a hypothetical individual assumed to be continuously present at a specific location. The individual at that particular location is expected to sustain a given level of harm from the realization of specified hazards. It is usually expressed in risk of death per year. Individual risk is presented in form of risk contours.

Societal Risk is the risk posed to a local community or to the society as a whole from the haz-ardous activity. In particular it is used to measure the risk to every exposed person, even if they are exposed on one brief occasion. It links the relationship between the frequency and the number of people suffering a given level of harm from the realization of a specified hazard. It is usually referred to a risk of death per year.

Risk Criteria

Risk criteria for both individual risk and societal risk have been discussed with Lyse. These criteria are compared to other risk criterion and to the results of the actual risk assessment for the plant.

Risk Assessment

Once risks have been determined, they will be assessed against the criteria level and ranked to determine the principal contributors. Ranking enables attention to be focused on the main contributors. This is of particular significance when assessing the viability of different mitigation measures.

Risk Mitigation

Risk reduction measures concentrate on the major risk contributors identified during risk rank-ing. Discussion is made on how different risk reduction measures will affect the overall risk level in relation to the ALARP principle (As Low As Reasonably Practical).

Report structure

The safety studies are documented according to the following report structure:

• Main report

The main report summarizes the study data, methodology, the risk results, conclusions and sensitivities

• Appendix A – Assumptions

The main assumptions where the studies are based on are presented in this appendix. • Appendix B – HAZID

This appendix documents the results of the HAZID workshop in Munich, October 2007. • Appendix C – Equipment Count

This appendix documents the equipments with their dimensions and inventories used to determine the leak size and – frequency for the risk assessments

• Appendix D – Result of LEAK 3.2 Calculations

This appendix documents the risk leakage frequencies based on the UK HSE databank [4] and the Dutch Purple Book [5]

• Appendix E – Individual Risk Ranking Report

This appendix documents the risk ranking points, for which the individual risk has been calculated

• Appendix F – Details on the Analysis Procedure

3.0

General Description of Process and Facilities

The section briefly describes the process and facilities to ensure a common understanding. The description only addresses those parts, which are of relevance to the QRA.

3.1

Natural Gas Treatment and Gas Liquefaction

3.1.1 Feed Gas Reception

Feed gas is received via a pipeline pressure let-down station from the Kårstø NG Plant with a pressure of approx. 180 bara. The pressure is controlled at plant inlet to 111 bara. A Feed Gas Fiscal Metering Station 15-XT-101 including a filtration device for the removal of particles is installed.

3.1.2 Natural Gas Pretreatment

CO2 Wash Unit

For CO2 removal from natural gas with the present conditions a chemical wash is the most favourable process. An aqueous amine solution (aMDEA) is utilised as solvent.

The CO2 wash unit is a Linde designed unit (contrary to a packaged unit). Material and equipment within the unit are designed and supplied according to Linde Standards and Specifications.

The feed gas is first heated in the Feed Gas Heater 20-HA-101 against warm lean solvent and further heated in the Feed Gas Trim Heater 20-HA-103 A/B against warm sweet gas to avoid cold temperatures and to allow for efficient CO2 removal. It enters the Amine Wash Column 20-VE-101 and flows from bottom to top through a random packing. Introduced lean amine flows in the opposite direction extracting the acid gas. The CO2 forms a very weak bond with the alkali. In the top of the column solvent traces are removed by water from the purified gas in some additional trays. The wash water for these trays is recirculated by the Water Circulation Pump 20-PA-101 A/B; a small quantity of water is introduced into the cycle by the Amine Make Up Water Pump 20-PB-102 A/B as fresh water (demin. water) to fulfil the water balance of the amine system.

The clean gas exits the wash tower with a CO2 content of max 50 vppm and a temperature of approx. 40°C. It is cooled in heat exchanger 20-HA-103 A/B against Feed Gas to approx. 25°C and leaves the section at a pressure of approx. 109 bara.

The loaded amine solution from 20-VE-101 passes via Amine MP Flash Drum 20-VA-102 through the Solvent Heat Exchanger 20-HB-101, where it is warmed up against regenerated solvent and is further routed to the middle section of the Amine Strip Column VE-102. In 20-VE-102 the reflux water flows from the top through two packed beds. The CO2 is stripped in hot oil heated Amine Strip Column Reboiler 20-HA-102. The regenerated solvent leaves the column at the bottom via heat exchanger 20-HB-101 and is pumped by the Lean Solvent Pump PA-103 A/B to the top of the Amine Wash Column VE-101 via the Feed Gas Heater 20-HA-101 and Lean Solvent Cooler

20-HC-101. Approximately 15 % of the flow is routed through the Cartridge Filter 20-LF-101 to remove particles and then through the Activated Carbon Filter 20-LF-102 for removal of heavy hydrocarbons to prevent foaming.

The acid gas leaves the top of column 20-VE-102 after having passed the water wash section, installed for reduction of amine vapour in the acid gas fraction. After cooling in the Amine Strip Column Condenser 20-HC-103 the gas is separated from the condensate in the Amine KO Drum 20-VA-101. The Amine Strip Column Reflux Pump 20-PA-102 A/B delivers the condensate back to the top of column 20-VE-102. The Amine KO Drum

20-VA-101 also allows for removal of heavy hydrocarbons. The sour gas is routed to the Regenerative Thermal Oxidation20-XT-101 and then sent to atmosphere.

The Solvent Storage Drum 20-VS-101 is designed to hold the complete liquid inventory of the plant. In case of foaming anti foam agent can be injected into the solvent from the Anti Foam Package 20-XU-101.

Dryer Station

The sweet, water oversaturated feed gas from the wash unit is fed to the Feed Gas Water KO Drum 20-VL-111 to remove any free liquid upstream of the driers. The liquid from this vessel is routed back to the Amine MP Flash Drum 20-VA-102 to reduce the water make-up of the CO2 wash unit.

The drier station is a two-bed molecular sieve adsorber station with a cycle time of 12 hrs. The natural gas is flowing through one of the Feed Gas Driers 20-VK-111 A/B. The water contained in the natural gas is reduced to a level near to zero where no freezing can occur in the downstream liquefaction section. To reduce the temperature fluctuation of the dry gas, a parallel step of 30 minutes is included, where both drier vessels are on adsorption. The dry feed gas passes the Dry Gas Filter 20-LF-111 to remove mole sieve dust which could affect the performance of the downstream cryogenic process section.

During this period the other feed gas drier is heated approx. 9 hrs and then cooled approx. 2 hrs by the regeneration gas stream. Dry feed gas at approx. 106 bara serves as regeneration gas. Heating of the regeneration gas to 210°C is provided in the Regeneration Gas Heater 20-HA-111 against hot oil and cooling against ambient air in the Regeneration Gas Cooler 20-HC-111, followed by the Regeneration Gas Water KO Drum 20-VL-112 where the water is separated and routed to 20-VE-102. The water saturated regeneration gas is compressed by Regeneration Gas Blower 20-KF-111 and routed back into the feed line upstream of the Feed Gas Driers 20-VK-111 A/B.

3.1.3 NG Liquefaction

After CO2 and water removal the natural gas is routed to the cold part of the process, which consists of three spiral-wound heat exchanger bundles integrated in one shell. Liquefaction and subcooling of the feed gas at high pressure is possible because of absence of heavy hydrocarbon components in the design feed gas.

The natural gas from the filter 20-LF-111 is first cooled down to approx. -26°C in the Feed Gas Precooler 25-HX-101. It is then further cooled down in the Feed Gas Liquefier 25-HX-102 and throttled to a subcritical pressure of approx. 20 bara to get pure liquid. Finally the natural gas is subcooled in the Feed Gas Subcooler 25-HX-103 to a temperature of approx. -159°C which is low enough to meet the flow limit of 2000 Sm³/h tank return gas allowed for reinjection into the tailgas pipeline.

3.2 Refrigerant

System

The cooling duty required to produce the LNG is provided by a simple but efficient closed mixed refrigerant cycle which consists of nitrogen, ethylene, propane, butane, pentane and a portion of the compressed tank return gas (Linde patent).

A motor driven geared centrifugal compressor is applied to compress the refrigerant.

3.2.1 Refrigerant Cycle

The refrigerant is withdrawn from the shell side of the precooler 25-HX-101 at a temperature of approx. 20°C and a pressure of approx. 4 bara, i.e. approx. 10°C overheated against saturated conditions. The refrigerant passes the Cycle Compressor Suction Drum 25-VL-101 and is then compressed in the first stage of Cycle Compressor 25-KA-101. After cooling to approx. 25°C and partly condensing against air in the Cycle Compressor Intercooler 25-HC-101 the liquid and gas are separated in the Cycle Compressor Interstage Drum 25-VL-102. The gas is further compressed in the 2nd stage of 25-KA-101 and partly condensed in Cycle Compressor Aftercooler 25-HC-102 at a temperature of approx. 25°C. Liquid formed in 25-HC-102 is separated in the Cycle HP Separator 25-VA-101.

The liquid from 25-VA-101 is sent to 25-VL-102 which also serves as a buffer for the heavy components of the MRC. The liquid hydrocarbon stream is routed to 25-HX-101 where it is subcooled to approx. –26°C and then, after being expanded in a Joule-Thomson valve, used for the precooling of the natural gas.

The cycle gas from the separator 25-VA-101 is cooled in the precooler 25-HX-101 to the same temperature, partly condensed and fed to the Cold MRC Separator 25-VA-102. The liquid from this separator is subcooled in the liquefier 25-HX-102 to a temperature of approx. –114°C and used as refrigerant for 25-HX-102 after expansion in a Joule-Thompson valve. The vapour from this separator is condensed in 25-HX-102 and subcooled in the subcooler 25-HX-103 to a temperature of approx. –159°C and provides the cooling duty for the subcooling of the natural gas after expansion in a Joule-Thomson valve to approx. 4.7 bara. After expansion to shell pressure the cycle gas streams are warmed up in the common shell side of the cryogenic spiral wound heat exchangers and returned jointly to the suction side of the 1st stage of the Cycle Compressor 25-KA-101 via the suction drum 25-VL-101.

3.2.2 Refrigerant Storage and Make-Up

• The make-up for the refrigerant system is required mainly due to cycle gas losses via the gas seals of 25-KA-101. The quantities required are adjusted according to the composition readings and the temperatures in the cold part and are provided via flow meters as follows:

• Pure nitrogen is produced in the Backup Nitrogen Package 61-XT-101 and fed to the make-up header by flow control.

• The methane rich stream is withdrawn from the discharge of the Tank Return Gas Compressor 59-KB-101 and is fed to the make-up header by flow control.

• For first start-up, when 59-KB-101 is not in service, the gas is withdrawn downstream of the filter 20-LF-111, expanded and routed to the make-up header.

• Ethylene is stored in the Liquid Ethylene Tank 58-VS-104. The ethylene is vaporised by the Ethylene Make-Up Heater 58-HE-101. Potential traces of water ant methanol are removed in the Ethylene Drier 58-VK-104. To avoid particles in the refrigerant cycle the ethylene is routed via the Ethylene Filter 58-LF-104 to the make-up header.

• Commercial propane is stored in the Propane Tank 58-VS-101. To assure dry propane, potential traces of water and methanol are removed in Liquid Propane Drier 58-LF-101. To avoid particles in the refrigerant cycle the propane is routed via the Liquid Propane Filter 58-LF-101 to the make-up header.

• Commercial butane and commercial pentane are stored in the Butane Tank 58-VS-103 and in the Pentane Tank 58-VS-102 respectively. To assure dry butane and dry pentane, potential traces of water and methanol are removed in the Liquid Butane/Pentane Drier 58-VK-102. To avoid particles in the refrigerant cycle the butane is routed via Liquid Butane/Pentane Filter 58-LF-102 to the make-up header.

3.3

LNG Storage / LNG Loading

Main Purpose of the LNG Storage (Unit 42) and LNG Loading (Unit 47) is the intermediate storage of LNG prior to loading into LNG Carriers at the Jetty and/or to LNG Trucks at the Truck Loading Bay.

The LNG Storage Tank is designed as full containment tank and stores LNG near atmospheric pressure.

LNG vapour due to end flash, boil off and cooling of loading lines is routed via the LNG storage tank to the Tank Return Gas Compressors. Warm vapour return from ship and truck loading is routed via the LNG storage tank to the tank return gas compressor to protect the compressor while cold vapour return is sent directly to the compressor. Excess vapours mainly during loading of ships with increased tank temperatures at start of LNG Loading are sent to flare.

3.3.1 LNG Storage

Main Purpose of the LNG Storage (Unit 42) and LNG Loading (Unit 47) is the intermediate storage of LNG prior to loading into LNG Carriers at the Jetty and/or to LNG Trucks at the Truck Loading Bay.

The LNG Storage Tank is designed as full containment tank and stores LNG near atmospheric pressure.

LNG vapour due to endflash, boil off and cooling of loading lines is routed via the LNG storage tank to the Tank Return Gas Compressors. Warm vapour return from ship and truck loading is routed via the LNG storage tank to the tank return gas compressor to protect the compressor while cold vapour return is sent directly to the compressor. Excess vapours mainly during loading of ships with increased tank temperatures at start of LNG Loading are sent to flare.

3.3.2 LNG Loading

There are two LNG Loading Stations foreseen: One for LNG Ship Loading at the Jetty and one for LNG Truck Loading at the LNG Truck Loading bay. 100 % of the produced LNG can be exported via LNG Carriers and approx. 10 % of the LNG production rate can be exported via LNG Trucks.

LNG Ship Loading and Ship Vapour Return

During LNG Ship Loading the LNG is pumped to the LNG Carriers by means of the LNG Ship Loading Pumps 42-PS-101 A/B, which are installed in the LNG Storage Tank 42-TR-101.

The LNG from the LNG Ship Loading Pump is routed via the LNG Ship Loading Line and the LNG Ship Loading Arm 47-MU-101 to the manifold of the LNG Carrier at the Jetty.

The normal loading rate of the LNG Ship Loading Pump is 1000 m³/h. The flow rate is con-trolled by the variable speed of the electric motor.

Vapour Return from the LNG Ship will be received at a pressure of approx. 1.1 bara at the presentation flange of the ship's manifold and is routed via the LNG Ship Vapour Arm 47-MV-101 and the LNG Vapour Return Line to the LNG Storage Tank 42-TR-47-MV-101 or to the Tank Re-turn Gas Compressor 59-KB-101 depending on the temperature. Warm Vapour ReRe-turn is cooled to tank operating temperature by injecting LNG into the Vapour Return Line.

During no ship loading operation, the LNG Ship Loading Line is kept cold by continuously cir-culating LNG by means of one LNG Truck Loading Pump 42-PS-102 A/B via the LNG Recircu-lation Line and the LNG Loading Line back to the LNG Storage Tank 42-TR-101. This is done to keep the loading system cold and gas free at all times, to allow immediate start up of ship loading after arrival of a LNG Carrier.

LNG Truck Loading and Truck Vapour Return

During LNG Truck Loading the LNG is pumped to the LNG Truck by means of the LNG Truck Loading Pumps 42-PS-102 A/B, which are installed in the LNG Storage Tank 42-TR-101. The LNG from the LNG Truck Loading Pumps is routed via the LNG Truck Loading Line and the LNG Truck Loading Hose 47-MU-102 to the LNG Truck at the LNG Truck Loading Bay. During loading of LNG Trucks (normal loading rate per pump: 65 m³/h) both LNG Truck Loading Pumps can be used.

Vapour Return from the LNG Trucks will be received at the connection point of the Truck Vapour Return Hose 47-MV-102 and is routed via the Vapour Return Hose and the Vapour Return Line to the LNG Storage Tank 42-TR-101 or to the Tank Return Gas Compressor 59-KB-101 depending on the temperature. Warm Vapour Return is cooled to tank operating temperature by injecting LNG into the Vapour Return Line.

During no truck loading operation, the LNG Truck Loading Line is kept cold by continuously circulating LNG by means of one LNG Truck Loading Pump 42-PS-102 A/B via the LNG Truck Loading Line and the LNG Recirculation Line back to the LNG Storage Tank 42-TR-101. This is done to keep the loading system cold and gas free at all times, to allow immediate start up of Truck loading after arrival of a Truck.

3.4

Fuel Gas System

LNG vapour due to endflash, heat input, cooling of loading lines, ship loading and truck loading is compressed in the Tank Return Gas Compressor 59-KB-101. Part of the tank return gas is routed to the fired Hot Oil Heater as fuel gas. Approx. 2000 Sm³/h is sent to local grid as Sales Gas. For initial start-up and for backup purpose gas from the grid can be used as fuel gas.

3.5

Hot Oil System

The hot oil system supplies the process heat for the plant at two temperature levels. Two cycles are provided, a medium temperature cycle for regeneration of the amine and a high temperature cycle for the heating of the regeneration gas.

The heat for both cycles is provided by the Fired Hot Oil Heater 52-FA-101, a direct fired heater supplied by fuel gas. In this heater the hot oil is heated to approx. 260°C to supply heat for the Regeneration Gas Heater 20-HA-111. This high temperature cycle is pressurized by the Hot Oil Cycle Pump I 52-PA-101 A/B. The required heat for the regeneration of the amine in the Amine Strip Column Reboiler 20-HA-102 is withdrawn from the high temperature cycle downstream of the Hot Oil Cycle Pump I 52-PA-101 and mixed with the cold hot oil downstream of Hot Oil Cycle Pump II 52-PA-102 A/B to limit the maximum temperature to 190°C to avoid degradation of the amine solvent. The hot oil leaves 20-HA-102 with a temperature of approx. 145°C and approx. A small fraction of the flow is pressurized by the Hot Oil Cycle Pump II 52-PA-102 A/B. Most of the hot oil leaving the Amine Strip Column Reboiler 20-HA-102 enters the first hot oil cycle via the balancing line.

The balancing line between the two cycles is also used to provide sufficient suction pressure for the two pumps via the Hot Oil Expansion Drum 52-VL-101.

The Hot Oil Surge Drum 52-VS-101 is provided to store the total inventory of the system in case of filling or maintenance, and a small Hot Oil Filling Pump 52-PA-103 serves to ease filling of the system. Blanketing for the Hot Oil Unit will be done with pure nitrogen.

3.6

Flare System

The Plant is equipped with two flare headers:

• warm gas flare header which ties in directly at the Flare Stack 54-FC-101

• cold gas and liquid flare header including the Blow Down Vessel 54-VD-101 for separa-tion of cold liquid and vapour. The vapour is routed to the bottom of 54-FC-101. The liq-uid is vaporised in the uninsulated Blow Down Vessel 54-VD-101 by ambient heat. In case a warm liquid remains, this liquid can be discharged manually to a barrel.

In addition the low pressure gas from tank and ship loading is routed to the top of the Flare Stack 54-FC-101.

3.7

ESD and Blowdown System

The Emergency Shutdown, Isolation and Depressuring System is used to prevent escalation and to minimise leakage of flammable fluids in case of major plant malfunctions, emergency conditions or damage. The main purpose is to minimise damage by hazards such as fires, un-confined vapour cloud explosions (UVCE) or a boiling liquid expanding vapour explosion (BLEVE) due to bursting vessels. Those hazards may follow on excessive leakage of flamma-ble fluids.

After a leakage or fire is detected and localised by the fire and gas alarm system and indicated in the central control room, the Emergency Shutdown, Isolation and Depressuring System will be activated via push-buttons by the operator from CCR.

After activation, the plant will be blocked in automatically by means of remote-actuated valves (e.g. Emergency Shutdown Valves - ESV) and selected rotating equipment (eg cycle compres-sor) will be shut-down.

Subsequently the Emergency blow-down System can be activated by the operator. The Emer-gency blow-down System is depressurising the whole plant (exclusive of LNG-Tank) to the flare system by remote actuated Blow-down Valves (BDV).

The system can be operated from a separate control panel (ESD panel) in the central control room (CCR) and allows remote actions from safe location in case of emergency.

Stop Feed, Energy Input and Export Streams

For the LNG process plant all feed streams and energy inputs into the depressurizing areas can be shut off. Units transferring energy to a safe place are kept in operation for continuous energy removal. All export streams (e.g. tail gas) will be shut-off.

Depressurizing Philosophy

According to contract and EN 1473, the isolated sections shall be depressurised to

• 50 % of design pressure in 15 minutes or to • 7 barg in 30 minutes

The higher flow is counting.

Units and Equipment without Depressurizing Facilities

Basis for selection of depressurizing sections is the maximum operating or settle out pressure and not the mechanical design pressure, which is for other reasons sometimes well above the maximum operating pressure (compare API RP 521).

The following units and equipment have no depressurizing facilities: • MDEA regeneration; operates at low pressure (appr.1 barg)

• Feed gas Liquefaction passage in 25-HZ-101 (mass of each passages is below 1000 kg limit, the passage is well protected in the shell, the consequence is considerably low) • LNG storage; operates at low pressure (appr. 250 mbarg)

• LNG Ship, LNG piping and LNG Truck Loading system (subcooled liquid at low pressure)

Basis input to QRA

As basis for the QRA a reaction time from first fire&gas alarm until the operator initiates the ESD and blowdown system is assumed to be 600 seconds. As an average value a depressurisation time of 900 seconds shall be used in the QRA (refer to Assumption Sheet RA-4 in Appendix A).

4.0 Study

Methodology

4.1

Risk Analysis Basics

Risks are commonly incurred and accepted in everyday life. There are many different types of risk including risk to life and health, risk to the environment and economic risks, which may impair the survival of a company.

The risk R is commonly described by its two dimensions, i.e. the consequence of an accidental event C and the frequency of this event (F):

R = C x F

The actual risk values can be manifold due to the different types of consequences, which might arise from an accident. It could be a financial loss due to downtime and damage in terms of money per event, a certain number of fatalities or certain damage to the environment, which may also lead to a certain financial loss due to the cost resulting from decontamination etc. The economic loss is very often influenced by the fact that certain accidents will lead to damages in the neighbouring parts of the plant.

The frequency of an event usually is a composite magnitude, e.g. for an ignited gas leak the primary leak frequency will be multiplied by the conditional probability of igniting the gas cloud resulting from the leak. Under certain conditions, even more conditional probabilities may factor into this product to yield the total frequency of a certain event, e.g. the probability of in-time detection of a flammable cloud or the conditional probability, that certain isolation measures (e.g. ESD and Blowdown System) work, when required.

4.2

Definition and Types of Risk

It has become common in the process industries to quantify risk to people in terms of • 1st _{party risk, i.e. the risk to onsite personal}

• 2nd _{party risk, i.e. the risk to external contractors}

• 3rd _{party risk, i.e. the risk, to which the site external population is exposed.}

Further to this one differentiates individual risk, i.e. the risk, to which a single person is ex-posed, and societal or group risk, i.e. the risk to which a certain group of people are exposed. Details are given in Table 3.

Table 3: Types of Risk

Type of Risk Details

1st party individual specific risk Risk to onsite personnel, based on the most exposed person at risk, i.e. operators.

1st party average individual risk Risk based on the individual specific risk and is calculated as average risk to onsite personnel.

2nd party individual specific risk Risk to external contractors, based on the most exposed person at risk, i.e. LNG carrier, external maintenance personnel.

2nd party average individual risk Risk based on the individual specific risk and is calculated as average risk to external contractors.

Type of Risk Details

3rd party individual specific risk Risk to offsite population expressed as the fatality risk per year. Individual risk is calculated under the assumption that the ex-posed person is present unprotected at the same location for 24 hours per day over 365 days per year. In case of Individual Spe-cific Risk the actual duration of the presence is taken into ac-count.

Societal (3rd party) risk Risk to a group of people outside of the plant. Societal risk usu-ally is quantified in form of the so-called FN curve, specifying the frequency F (per year), that N or more persons are affected by lethal consequences.

4.3 Acceptance

Criteria

The risk in this QRA study is discussed in terms of individual risk and societal risk. The Individ-ual Specific Risk for 1st, 2nd and 3rd party has been defined by Lyse. The 3rd party risk is also calculated as FN Curve and compared with the societal risk acceptance criteria based on UK HSE Societal Risk Criteria. The acceptance criteria defines for the following personnel catego-ries:

• 1st

party, i.e. personnel working for the Lyse LNG Base Load Plant facility.

• 2nd _{party, i.e. LNG Carrier personnel (Truck, Ship Loading and external contractors) can}

be affected by operation activities. • 3rd _{person, i.e. offsite population.}

Note: occupational accidents have been not included in the acceptance criteria and therefore are not considered in the QRA.

1st _{and 2}nd _party

Individual specific risk (ISR) is specified as

ISR = Σ (Effective Frequency x Occupancy x Vulnerability),

where "Occupancy" is a factor which relates the time for which a person is exposed to work hazards (in hours) to the total number of hours within a year (8760). For sake of simplicity we assumed, that a typical operator works in 8 hour shifts for 5 of 7 days per week, i.e. his annual working hours are 45 weeks x 5 days x 8 hours = 1800 hours per year. He is 20% of his work-ing time outside. The effective frequency is calculated 0.2 x outdoor frequency + (1-0.2) x in-door frequency. Hence the occupancy factor is 1800 / 8760 = 0.20. For the definition of vulner-ability please refer the Appendix F.

The acceptance criterion for Individual Specific Risk (ISR) for the most exposed person for 1st and 2nd party is expressed as the yearly probability for loss of life. The ISR is acceptable for < 1 X 10-6 per year, the risk level above 1 X 10-3 per year becomes unacceptable. The region in between is the ALARP area.

The Average Individual Risk (AVR) is specified as follows:

AVR = Σ (ISR x Number of personnel) / Σ Number of personnel

The AVR shall not exceed 1 X 10-4 per year, the risk level under 1 X 10-6 per year is accept-able. The region in between is the ALARP area.

If no individual specific risk (ISR) is found to be above 1 X 10-4 per year, the AVR criteria is fulfilled.

3rd _{party (Societal Risk)}

Individual specific risk (ISR) is specified as

ISR = Σ (Effective Frequency x Occupancy x Vulnerability),

where "Occupancy" is a factor which relates the time for which a person is exposed to hazards (in hours) to the total number of hours within a year (8760). For sake of simplicity we assumed, that a person on the peninsula stays for 4 hours 2 of the 7 days per week in the summer (4 month) and 2 hours at 2 days per week in the winter, i.e. his annual presence hours are (16 weeks x 2 days x 4 hours) + (32 X 2 days X 2 hours) = 256 hours per year. He is staying 100% outside. The effective frequency is calculated with a location fraction of 1 outdoor frequency. Hence the occupancy factor is 256 / 8760 = 0.03.

The acceptance criterion for Individual Specific Risk (ISR) for the most exposed person for 3rd party is also expressed as the yearly probability for loss of life. The ISR is acceptable for < 1 X 10-7 per year, the risk level above 1 X 10-5 per year becomes unacceptable. The region in be-tween is the ALARP area.

The Average Individual Risk (AVR) is specified as follows:

AVR = Σ (ISR x Number of people) / Σ Number of people

The AVR shall not exceed 1 X 10-5 per year, the risk level under 1 X 10-7 per year is accept-able. The region in between is the ALARP area.

Societal risk for 3rd _{party is presented as the probability or frequency of accidents of different} extent. The Figure 5 below states the acceptable and not-acceptable range of the yearly fre-quency (F) – consequence (number of fatalities N or larger) – diagram and shows the accep-tance criterion based on UK HSE Societal Risk Criteria. It also indicates an area where the company shall actively seek to reduce the risk based on the ALARP principle.

4.4 Hazard

Identification

The study has been based on identified major inventories of flammable and explosive materials in the LNG Base Load Plant units, together with major lines connecting the inventories. Infor-mation on inventories, stream compositions, operating conditions and locations has been based on the available drawings and further information. In addition the results of the hazard identification of Hazard Study (HAZID) (Appendix B) were used. The investigations were veri-fied on the basis of operating procedures, P&IDs and the knowledge provided by LINDE. In the HAZID, only those hazards are identified, which might lead to a leakage of hydrocarbons and a subsequent fire or explosion. Other hazards with operational consequences have been dis-cussed in the normal HAZOP study.

The basic results of the HAZID are shown in Table 4 .

Table 4: HAZID Summary

Hazard Treatment in QRA

Hydrocarbon (gas / liquid or two phase) leaks outdoors

Included in QRA in four event classes of very large, large, medium and small leak at various locations in the individual areas.

This hazard covers the majority of flammable leak-age scenarios.

Hydrocarbon (HC gas / liquid or two phase) leaks in buildings

Not included in the QRA Buildings containing HC:

- The buildings are specified with explosion group zone 1; therefore the risk of internal explosion is reduced.

- The protective effect of the building is not con-sidered in the SAFETI calculation (conservative consideration).

Buildings containing no HC:

- Gas entering in a building is presented by ade-quate gas detection and closing the air-intake. Non-hydrocarbon fire Not included in the QRA as of minor importance. Non hydrocarbon chemical leak or fire Involved chemicals (e.g. MDEA etc.) have a minor

contribution to risk due to quantities; hence they are not of relevance in this QRA.

Loss of power Not included in the QRA since failure leads to fail safe conditions.

Loss of instrument air Not included in the QRA since failure leads to fail safe conditions.

Loss of safety systems Not included in the QRA since failure leads to fail safe conditions.

Loss of control system Not included in the QRA since failure leads to fail safe conditions.

Occupational accidents Not included in the QRA as this is identical to gen-eral petrochemical facilities and known to be mar-ginal

Natural environmental impact (extreme weather, earthquake, etc)

Not included in the QRA due to low risk contribution. Pipeline rupture Included in the QRA.

Pipeline exposed/free span Included as a potential cause for leaks. Pipeline dented Included as a potential cause for leaks. Excessive pipeline expansion Included as a potential cause for leaks.

Hazard Treatment in QRA

5.0

Data used for the Risk Assessment

This section informs about the basic data and detailed assumptions which were used for the calculations and the individual steps taken to arrive at the risk picture.

5.1 Scenarios

For the purpose of this QRA the plant was analysed with respect to its hydrocarbon content. Units without relevant hydrocarbon content were excluded from the further analysis. These scenarios consider releases of hydrocarbons from small, medium, large or very large leaks in pipe work or equipments. This leaves the following units for further consideration as shown in Table 5 and Figure 6:

Table 5: Units covered in this QRA Unit Inventory Loop

No. used in fig. 6

Designation

20 IL1 Feedgas Purification

20 IL2A NG Liquefication Gas

25 IL2B1 NG Liquefication Liquid_103 bar System 25 IL2B2 NG Liquefication Liquid_19 bar System

59 IL3A LNG Storage Return Gas

42 IL3B LNG Storage

47 IL4 LNG Truck Loading

47 IL5A LNG Ship Loading Tank Top 47 IL5B1/2/3 LNG Ship Loading Line

47 IL5C LNG Ship Loading Jetty

25 IL6A1 Refrigeration Gas System_4 bar System 25 IL6A2 Refrigeration Gas System_18 bar System 25 IL6A3 Refrigeration Gas System_40 bar System 25 IL6B1 Refrigeration Liquid 25-HX-101/103 System 25 IL6B2 Refrigeration Liquid 25-VA-101 System

25 IL6B3 Refrigeration Liquid 25-VA-102/25-HX-102 System 25 IL6B4 Refrigeration Liquid 25-VL-102 System

58 IL7 Propane Storage

58 IL8 Pentane Storage

58 IL9 Butane Storage

58 IL10A Ethylene Storage Gas System 58 IL10B Ethylene Storage Liquid System 20/52 IL11 Hot Oil System

15 IL12 Feedgas Fiscal Metering 59 IL13 Tailgas Fiscal Metering

The solvent regeneration system has not been taken into account in this QRA due to its com-parably small inventories. A leak of MDEA from process equipment or piping leads to a release of CO2 loaded MDEA to dike area and pit, which does not impose a relevant hazard to people.

The units can be isolated by ESD and Blowdown system or are directly connected to another area, which can be isolated.

Figure 6: Process Areas defined for this QRA (numbers see Table 5)

For these areas an equipment count was performed (refer to Assumption Sheet FA-1 in Ap-pendix A) and considering:

• Equipment (vessels, pumps, heat exchangers, compressors etc.) • Valves (actuated and non-actuated)

• Pipelines

• Small bore fittings, Flange connections (partly, based on the Dutch Purple Book [5]) All equipment has been listed with their respective operating characteristics. These data have been used to calculate the overall leak rates for the individual areas. Details are contained Ap-pendix C.

5.2 Leak

Frequencies

The leak frequency modelling is based on DNV’s leak frequency database LEAK 3.2 and Pur-ple Book. The leak types and sizes are shown in Table 6:

Table 6: Leak types and sizes

Leak Type Leak range [mm]

Small 1 – 10

Medium 10-50 Large 50-100 Very Large (Full Bore Rupture) > 100

Leaks with equivalent diameter below 1 mm are not considered as they do not contribute sub-stantially to the overall risk.

5.3 Release

Duration

The duration of a release is closely linked to the type of detection and isolation. Table 7 lists typical times involved for various alternatives:

Table 7: Typical Duration Times based on DNV database

Description Duration for

Detection and Isolation [s]

Gas detector which auto closes ESD/automatic valve (XSFV). 120 Gas detector with isolation by manual valve closure. 960 Gas detector with isolation by remotely operated closure of control valve. 660 Detection by operator and initiation of ESD & Blowdown System 600 Gas detector with isolation by remotely operated closure of ESD. 360

Process trip which auto closes ESD. 360

Process alarm with isolation by manual valve closure. 1200 Process alarm with isolation by remotely operated closure of control valve. 900 Process alarm with isolation of feed by remotely operated closure of control

valve. Duration determined by either inventory of material (max 1800s) or valve closure time (900s).

max. 1800

Process alarm with isolation of feed by remotely operated closure of ESD. Duration determined by either inventory of material (max 1800s) or valve clo-sure time (600s).

max. 1800

Process alarm with isolation by remotely operated closure of ESD. 600 Detection by field operator, remote area, with manual isolation. 2700 Detection by field operator, remote area, with isolation by remotely operated

control valve.

2400 Detection by field operator, remote area,, with isolation by remotely operated

ESD.

2100 Detection by field operator routine patrol, with manual isolation. 1500 Detection by field operator routine patrol, with isolation by remotely operated

control valve.

1200 Detection by field operator routine patrol, with isolation by remotely operated

control valve. Duration determined by either inventory of material (max 1800s) or valve closure time.

1200

Detection by field operator on routine patrol with isolation of feed by remotely operated closure of ESD. Duration determined by either inventory of material (max 1800s) or valve closure time.

900

Detection by field operator on routine patrol, with isolation by remotely operated ESD.

900

The Lyse LNG Base Load Plant is equipped with a fire and gas detection system and remotely operated ESD valves, control valves, compressor and pumps. The reaction time is 600 s for

detection and initiation of ESD & Blowdown System by the operator, e.g. shut-off of main feed and product streams via ESD valves and tripping of main machines. An average blowdown time of 900 s is used in the calculation (refer to Assumption Sheet HC-2 and RA-4 in Appendix A).

5.4 Atmospheric

Conditions

Weather data have been taken from the site conditions document [6]. For the wind rose data for Sola, refer to Assumption Sheet MI-2 in Appendix A. Table 8 summarises the results, where an angle of 0 degrees presents a wind originating from the North.

Table 8: Weather data for Lyse LNG Base Load Plant Percentage

Stability Class Wind direction [degrees] Wind [m/s] 292.5-337.5 337.5 -22.5 22.5-67.5 67.5-112.5 112.5-157.5 157.5-202.5 202.5-247.5 247.5-292.5 F - 1.5 1.99 0.961 1.012 1.633 1.335 0.501 0.807 1.977 D- 6 14.71 7.09 7.47 12.04 9.89 3.69 5.96 14.57 D - 12 2.79 1.346 1.417 2.293 1.878 0.702 1.13 2.76 Sum 19.49 9.397 9.899 15.966 13.103 4.893 7.897 19.307

Wind speed classes have been used ranging from 1.5 m/s to 12 m/s, whereas for atmospheric stability Pasquill classes ranging from D (neutral) to F (stable) have been selected. The atmos-pheric stability is considered to be neutral during the day and stable during the night. For the calculations 8 wind directions have been used.

5.5 Population

Distribution

For the Lyse LNG Base Load Plant facility, a work day is divided into three shifts; a day shift, an afternoon shift and a night shift, each lasting 8 hours (Assumption Sheet MI-3 in Appendix A). The relevant figures listed in

Table 9 and Table 10:

Table 9: Onsite Population (1st and 2nd party)

Personnel / People Buildings / Areas

Day (per Shift) Night Total Number

Administration Building 3 1 7

Maintenance 2 1 5

Truck Loading 4 2 10

Ship Loading (Jetty) 1 1 3

Ship Deck 2 2 6

Ship Bridge 8 8 24

The personnel in the administration building do the daily operation and supervision of the plant.

Table 10: Off-site Population (3rd party)

Personnel / People Areas

Day Night

Peninsula 16 (in non-work day) 0

Hiking Track 8 (in a non-work day) 0

Personnel / People Areas

Day Night

Ferry Terminal_industry workers 10 0

Ferry Terminal_passengers 1500 0

Energiveien+Risavika_office workers 400 5 Energiveien+Risavika_industry workers 559 0

Container Area_office workers 10 1

Container Area_industry workers 50 0

Rest Companys_office workers 1139 10

Rest Companys_industry workers 715 0

Living Quarters 60 60

5.6 Ignition

Sources

Release of flammable fluid may have many event outcomes, depending on the timing and type of ignition. For example, a release may ignite immediately at the point of release, or it may ig-nite after the cloud has been dispersing for two minutes, or after the cloud has been dispersing for five minutes, or it may not ignite at all. If it ignites, it may give either explosion effects or different types of fire effects depending on the type of release (e.g. jet fire, fireball, pool fire or flash fire).

Each of the outcomes will have different risk effects because each produces an effect zone of a different size and intensity, at a different location. The risk effects for a flammable release will depend on the timing, location and nature of ignition. For example, if an instantaneous release ignites immediately it will produce a hazard zone at the point of release, whereas if it ignites after the cloud has started to disperse, it will produce a hazard zone at the point of ignition. If the ignition produces a fireball, the intensity of the effects within the zone will be different from those for an ignition which produces a flash fire, or for an ignition which produces an explosion.

The different outcomes are presented in the form of event trees (Assumption Sheet RA-1 in Appendix A). Each outcome in an event tree can be assigned a probability, and the program performs the risk calculations for all of the event tree outcomes that are relevant to a particular flammable model.

The ignition probability within PHAST RISK is definable according to the respective site knowl-edge. The immediate ignition probability is directly specified. A default value of 0.3 is used, which would only apply to very large flammable gas releases in a large industrial complex. The delayed ignition probability for any failure case is a calculated value within PHAST RISK, which is based on the defined ignition sources on site, with a unique value for each release case and release direction. The calculation is based on the strength, location and presence factor of all ignition sources specified, and the size and duration of the dispersing flammable vapour cloud.

PHAST RISK assumes "diffuse ignition background" (which could be understood as e.g. traffic illumination, cameras etc.), i.e. ignition may occur even if no specific ignition sources are given.

Plant specific ignition sources, which have been taken into account are listed in Table 11 and their ignition probability have been discussed in Assumption Sheet RA-2 Appendix A.

Table 11: Ignition Sources in Lyse LNG Base Load Plant Ignition Source

Flare 54-FC-101

Fired Heater for Hot Oil 52-FA-101

Regenerative Thermal Oxidation (RTO) (Incinerator) 20-XT-101 Electrical Substation

Traffic (Truck Loading) Parking

External Population

To model the conditional probabilities for the ignition resulting into different types of fires and explosion, an event tree of the type shown in Figure 7 has been used:

Figure 7: Event tree used for fire and explosion modelling

For the probabilities in this event tree, standard setting as used normally in PHAST RISK have been applied (most values taken from the Dutch Purple Book [5]).

5.7 Consequence

Calculations

The analysis of potential consequences following loss of containment is carried out as the first stage of the risk analysis. Consequence analysis involves the estimation of rates of release in the event of loss of containment and prediction of the potential consequences.

5.7.1 Discharge and Dispersion

Material can be released to the atmosphere because of a failure in the containment system. The magnitude of a release depends primarily on the size of the leak in the system, the phase of the material and the operating pressure. For modelling purposes, releases are usually cate-gorized as either instantaneous or continuous. As the analysis is concerned with major

acci-dent hazards, only releases from equipment and releases from holes giving an excess of a release rate of 0.1 kg/s have been included.

5.7.2 Instantaneous Releases

If a catastrophic failure of the shell of a vessel occurs the contents would be released very quickly (instantaneously). This type of failure has been modelled as a hemispherical cloud cen-tred on the release location.

5.7.3 Continuous Releases

Releases of liquids and gases from pipes or equipment items were estimated using basic re-lease rate calculations assuming a fixed value of discharge coefficient. The value of discharge coefficient used (0.65) is taken from a range of values (typically 0.5 to 0.8) which represent various pipe- and equipment configurations. The release rate calculations were performed us-ing PHAST 6.53.1. The calculated release rate was assumed to be constant throughout the release duration.

5.7.4 Release Duration

The release duration depends on the upstream inventory and the means for detection and subsequent isolation of the release. The release duration has been assumed (refer to Assump-tion Sheet RA-4 in Appendix A) to be limited by the upstream inventory up to a maximum dura-tion of 1500 s (600 s detecdura-tion time and 900 s automatic or remotely activated ESD and Blow-down closure time) for small and medium sized leaks. For large and very large leaks an isola-tion time of 600 s has been used. By all size of leaks, the rest flow of fluids from the upstream system, which will be released before the isolation valves closes (in 600 s), is also considered in the PHAST calculation.

5.7.5 Dispersion

When a vapour cloud is generated, either instantaneously or continuously, there may be a substantial degree of mixing of air with the released material. Dispersion was modelled using PHAST version 6.53.1. To allow for destruction of momentum due to impingement of releases or upwind and downwind releases, 50% of releases were modelled as free-field horizontal re-leases and 50% were modelled as ‘impinged’ rere-leases. The dimensions of impinged rere-leases were determined assuming that the clouds were cylindrical in shape, but with the same volume as a horizontal release.

5.7.6 Thermal Radiation and Overpressure

On ignition of a flammable cloud, different types of combustion can occur depending on the particular circumstances. It is normal to characterize the combustion in various ways and for the purpose of this analysis, flash fires, jet fires, pool fires, fireballs and explosions have been considered.

In the event of a flammable release from containment which is not ignited immediately, a hy-drocarbon vapour/air mixture is formed. The concentration of hyhy-drocarbon in the cloud, as pro-gressive dilution with air takes place, is estimated using the dispersion model. The direction and extent of drift of the cloud is influenced by the prevailing weather conditions. The cloud

remains capable of ignition providing the concentration is above the lower flammable limit (LFL). On ignition, a flame front passes at slow speed throughout the flammable cloud and a flame stabilizes near to the point of release as either a jet or pool fire. A flash fire does not produce high levels of overpressure outside the cloud, but inside the cloud there can be iso-lated regions of overpressure which could lead to equipment or building damage. Levels of thermal radiation which are potentially fatal, are produced within, and for a very small distance outside the LFL envelope.

Jet fires are usually the consequence of a momentum dominated release resulting from an

immediately ignited release or from a flash fire that burns back to the point of release. This type of fire has been included in the SAFETI calculations.

Under certain circumstances the flame travelling through a hydrocarbon/air cloud can acceler-ate and attain a significantly higher flame speed than that associacceler-ated with a flash fire. This high flame speed also generates an overpressure wave. This phenomenon is referred to as a

vapour cloud explosion (VCE). Experimental work and observations on incidents have

con-firmed that in order for a flame to accelerate from a low speed to a high speed, some form of congestion is necessary, e.g. a gas cloud within a plant area. Flame acceleration does not oc-cur if the cloud is in the open air, e.g. a cloud over open ground, and indeed if a high speed flame exits from a congested region into an open region, flame deceleration occurs. Vapour cloud explosions are characterized by the production of levels of overpressure which can cause damage to equipment and destruction of buildings well beyond the flammable cloud boundary. Although any person within the flammable cloud is likely to be fatally injured, direct human fatalities from blast outside the flammable cloud are unlikely. Most casualties beyond the cloud envelope arise indirectly, i.e. from crush injuries in collapsed buildings or injuries from fragments.

PHAST RISK uses a modified version of the TNT equivalent model to describe the conse-quences of VCE. This model considers a typical congestion. As there is unconfined space be-tween the process area and the administration building, the results for explosion overpressure towards the administration building and installation outside battery limit can be considered con-servative.

5.8

Mitigation Measures taken into Account

The present concept takes into account various mitigation measures, which are presented in the Assumption Sheets as indicated in Table 12:

Table 12: Risk Reducing Measures

No. Risk Reducing Measure Assumption _{Sheet No.}

1 Loading frequency consideration HC-9

2 Welded Pipes in Feed Gas and LNG service FA-1

3 Full containment LNG Storage Tank FA-3

4 Explosion Protection RA-2

5 Design of the flare stack RA-6

6 Fire and Gas Detection RA-3

No. Risk Reducing Measure Assumption _{Sheet No.}

8 Appropriate measures RA-2, RA-6

9 Active and Passive Fire Protection RA-7

10 Escape Ways RA-8

11 Safe Haven RA-8

For further reduction of the risk to ALARP additional risk reduction measures are evaluated by means of sensitivity calculations in Chapter 7.0.

6.0

Results of the Risk Analysis

This section presents the results of the risk calculations using PHAST RISK with the assump-tion specified in the previous secassump-tions. Risk to people is described in terms of individual risk for 1st, 2nd, 3rd party and societal risk 3rd party.

6.1 Risk

1

and 2

party

Individual Risk, 1st _{and 2}nd _party

The subsequent Figure 8 and Figure 9 show the calculated individual risk contour lines for the Lyse LNG Base Load Plant.

The figures 8 and 9 show the calculated individual risk contour lines for the Lyse LNG Base Load Plant. The calculated risk contours of individual risk for the most exposed person is illus-trated in Figure 8. The figure shows the contours of the most exposed person to suffer a fatality every 100 000 years (green line), every 1 000 000 years (dark blue line). The risk is illustrated for the most exposed person present in the process plant area, 20 % of their working time per year.