Journal of Loss Prevention in the Process Industries 22 (2009) 634–638

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: www.elsevier.com/locate/jlp

Preliminary risk analysis for LNG tankers approaching a maritime terminal

Roberto Bubbico, Sergio Di Cave, Barbara Mazzarotta*
Dipartimento di Ingegneria Chimica Materiali Ambiente, Università di Roma ‘‘La Sapienza’’, Via Eudossiana 18, 00184 Roma, Italy

a r t i c l e i n f o a b s t r a c t

Article history: LNG ships may represent a remarkable risk source, especially when approaching a land terminal, not only
Received 28 August 2008 due to the possible occurrence of maritime accident, but also since they may represent a suitable target
Received in revised form for terrorist attacks. A preliminary risk analysis for LNG ships approaching the Panigaglia terminal is
7 January 2009
carried out: based on literature data and on the characteristics of the location, a spill originated from
Accepted 8 February 2009
a sea accident can be excluded; on the contrary, intentional damages may cause the release of a large
amount of LNG, giving rise to a pool fire. Consequence analysis shows that dangerous thermal effects are
Keywords:
expected within a radius of 700–1500 m; in the location under exam, the impact on resident population
LNG
Maritime transport will be negligible, for the most probable attack site, and marginal for an occasionally used anchorage,
Terminal which should be no longer allowed.
Security Ó 2009 Elsevier Ltd. All rights reserved.
Panigaglia

1. Introduction concerning security, have gained importance, with the focus on

Despite the unrivalled safety record of LNG tankers of eight
reported accidents, and no casualties, over a 40 years period
(SANDIA, 2004), one should still bear in mind that an instanta-
neous, catastrophic release of the entire cargo may represent an
extremely hazardous event, in terms of extension of the impact
area associated to fatalities. However, the crew size of an LNG
tanker is typically in the range of 10–30 persons and, for accidents
at sea, the number of persons at risk will increase only in case of
collision with other ships, or when sailing close to coastal towns.
Under ordinary transport conditions the occurrence of such
a release is unrealistic, due to the specialized structure of LNG ships
providing physical barriers and insulation to protect the product:
the inner tank and the outer hull are more than 2 m apart, so that
even a large hole in the hull will result in a much smaller one in the
tank. A recent study (SANDIA, 2004) indicates that the required
velocity to cause a breach of a cargo tank during a 90 collision with
a large vessel is 6–7 knots; if significant penetration of the ships
occurs, they will remain joined and the available release area will
be reduced to less than 10% of the breach (Ammerman, 2002).
Based on the above consideration, the risk of maritime LNG
shipping can be considered rather limited, especially when
compared both with other maritime transport sectors and with
process industry. Nevertheless, in recent years other safety aspects,
* Corresponding author. Tel.: þ39 06 44585 590; fax: þ39 06 4827 453.
E-mail addresses: bubbico@ingchim.ing.uniroma1.it (R. Bubbico), sergio.dicave@
uniroma1.it (S. Di Cave), mazzarot@ingchim.ing.uniroma1.it (B. Mazzarotta).
deliberately provoked accidents, such as terrorist acts, and, from
this point of view, LNG carriers may represent an obvious target.
Where the scope of the attack is to causing the greatest damages,
the selected means will ensure the release to be severe, and the site
will be selected in order to involve as many persons as possible in
the consequence of the accident.
In the present work, a preliminary risk assessment study will be
carried out for an LNG carrier approaching the Italian terminal of
Panigaglia.
2. Accidental scenarios in maritime LNG transport
LNG is transported in properly insulated cryogenic tanks as
a low density (around 450 kg/m3) liquid at its boiling point (around
161.5  C) using double-hulled ships. Two main tank designs are
adopted: spherical tanks, supported independently of the main
ship structure, and prismatic, membrane-lined tanks, installed
against the inner hull. The former type is provided with 4–6
spherical tanks, for a total capacity typically in the range 50,000–
135,000 m3; the latter type have a few membrane tanks of typical
size around 40,000 m3 each, for a total maximum capacity
exceeding 160,000 m3. In some cases, nitrogen is used to purge
some below-decks spaces to aid in preventing fires; the ship holds
may be designed to collect spilled LNG.
No major accident involving LNG ships at sea or in port has been
reported over a 40 years period (Pitblado, Baik, Hughes, Ferro, &
Shaw, 2004) and no shipboard fatality was originated from LNG spills,
which occurred in eight cases, but never originated a cargo fire; in

0950-4230/$ – see front matter Ó 2009 Elsevier Ltd. All rights reserved.
doi:10.1016/j.jlp.2009.02.007
 R. Bubbico et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 634–638
seven other cases incidents, due to collision and grounding, caused
structural damages to the ships, but no spill occurred (SIGTTO, 2003).
In the period 1964–1977, against about 6700 LNG carriers
movement, three cases of grounding, stranding, drifting; four cases
of collision, impact, ramming; six cases of leaks from tanks or
during transfer; and six other cases not specified are reported (Cox,
Comer, Pyman, & Slater, 1980). No fire and explosion, war loss and
hostility, hull and machinery damage involved LNG carriers. In the
middle 1960s, crack occurred in the deck of two LNG carriers
(Methane Princess and Descartes) due to small spills of low-
temperature LNG and improper choice of the construction material
(carbon steel): it should be remarked that these were among the
first small ships used for LNG transport. In 1969 and 1970, the tanks
of two LNG carriers (Polar Alaska and Arctic Tokyo) were damaged
due to sloshing of the product. In the late 1970s, two LNG carriers
(El Paso Paul Kayser and LNG Taurus) were affected by serious
groundings, but with no cargo loss, even if the speed of the ships at
the moment was rather high (12–19 knots).
The SANDIA report, issued at the end of 2004 (SANDIA, 2004),
discusses the safety implications of large LNG spills over water,
reviewing several existing studies and providing further analysis.
The report considers three types of reference accidents at sea:
accidental collision with a small vessel, accidental collision with
a large vessel, and accidental grounding: a breach of 5–10 m2,
limited to one container, is expected only in the second case, with
an actual spill area of 0.5–1 m2. In most cases, the spilled LNG will
burn in a pool fire about 150 m in diameter (1 m2 breach): thermal
hazards will extend to approximately 250 m (37.5 kW/m2) and
750 m (5 kW/m2). In some cases, LNG will evaporate from the pool
and disperse as a vapour cloud, extending to beyond 1600 m in
about 20 min (LFL concentration), under stable atmospheric
condition F and 2 m/s wind velocity.
The same report (SANDIA, 2004) also investigates several
intentional LNG cargo tank damage scenarios, based on the evalu-
ation of a range of events, including sabotage, insider threats, and
external attacks (such as those with small missiles and rockets, and
with bulk explosives), even if only the scenarios requiring means
Fig. 1. Map of the terminal area.
635
and technical skill considered credible based on historical data and
intelligence reports were taken into account. The analysis lists two
types of intentional breaches limited to one cargo tank (breach area
0.5–12 m2), one type involving two cargo tanks (breach area 5 m2)
and one type involving three cargo tanks (breach area 2 m2).
Generally, an intentional breaching scenario would cause a tank
breach smaller than 5–7 m2 and the released LNG will be imme-
diately ignited in a pool fire. For a 5 m2 breach area (1 cargo tank
involved), a pool fire about 300 m in diameter will occur, origi-
nating thermal hazards within approximately 400 m (37.5 kW/m2)
and 1300 m (5 kW/m2), values increasing to about 600 and 1900 m,
respectively, for the worst pool fire scenario reported (breach size
12 m2). In case of vapour dispersion, followed by delayed ignition,
the impact distance may reach up to 2450 m (one cargo tank
involved) or exceed 3600 m (three cargo tanks involved), for a 5 m2
breach area. It should be remarked that, due to the weapons used,
an intentional damage would be most often followed by the
immediate ignition of the spill: therefore, the possibility of
a delayed ignition of a large cloud seems rather remote. Anyway, in
case of intentional attacks, the potential damage to critical infra-
structure elements (bridges, tunnels, industrial centres, LNG
unloading terminals and platforms, harbours), or populated areas
can be significant in high hazard zones.
3. Study case
3.1. LNG terminal area
The LNG terminal of Panigaglia is provided with a 500 m pier,
two storage tanks (50000 m3 each) and a regasification unit: it
received, in 2003, 123 ships carrying up to 70,000 m3 LNG each, and
has a capacity of about 3.5  109 m3/yr of natural gas (Gas Natural
Italia, 2008). The terminal, which is operating since 1971 is, pres-
ently, the only one in Italy, even if a few other LNG terminal are
under construction. The Panigaglia terminal is located in the
municipality of Portovenere, close to La Spezia harbour, as shown in
Fig. 1, obtained using ArcView 3.2a: the zone includes well known
636 R. Bubbico et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 634–638
sea resorts (Portovenere and Lerici), and areas of environmental
interest (Palmaria island). The terminal is very close to Fezzano
suburb of La Spezia, at north, and to Portovenere at south. In Fig. 1,
the red colour scale refers to population density, increasing as the
tone becomes darker: at 2001 census, the residents in Fezzano and
Portovenere were 933 and 3034, respectively. The dot points
represent specific vulnerability points, such as schools or hospitals,
or points where a concentration of population is likely (pubblic
offices, stations, etc.).
Also shown in Fig. 1 is the outer breakwater, which protects the
entrance of La Spezia harbour, leaving two passages, on the west
side (500 m width), with two allowed routes (middle and west),
and on the east side (300 m width), with a single allowed route
(east). All the ships maneuvering in the harbour should limit their
speed to a safe value: the east route can be used only by smaller
ships (GDW < 500 t) and military units (La Spezia is one of the main
naval bases in Italy), while larger ships should use the middle route
to enter and the west route to leave the harbour, respectively (CP,
2001). Ships carrying dangerous goods and waiting to enter the
harbour should be securely anchored at the position E9 (see Fig. 1),
1.4 nautical miles (about 2.6 km) east of Torre Scuola Point, eastern
point of Palmaria island. Only in special cases, in day time and for
a limited period of time (6 h), ships directed to Panigaglia terminal
may be allowed to wait inside the harbour, at the position India 2
(see Fig. 1).
In case of bad weather it may be prohibited to the LNG ships to
proceed to the terminal, and in some cases, their passage may be
allowed only during the night (CP, 1985). Bad weather is not
unusual: in December 2005, Margaret, a 84-m long ship trans-
porting concrete, which was trying to find repair, failed to anchor
due to the strong South-West wind, impacted against the outer
breakwater embarking water and remaining partially submerged
(Corriere della Sera, 2005).
3.2. Accidental scenarios
First, the possibility of accidents at sea has been examined,
based on the information reported in the literature (SANDIA, 2004).
Accidental collisions with small or large vessels cannot be excluded,
due to the congestion of the harbour; nevertheless, due to the low
ship velocity, it is unrealistic that a collision will occur at the speed
(6–7 knots) required to open a breach in the cargo. Also grounding
cannot be excluded (and actually occurred, in 2005, to Margaret
ship), but generally does not result in LNG cargo breaches, espe-
cially at low speed. Accordingly, an LNG release in the harbour area
due to a maritime accident seems a very remote event, and will not
be taken into account in the analysis.
Then, the possibility of an intentional LNG cargo tank damage
was taken under consideration. This event cannot be completely
excluded, even if the strong military presence and activity in the
area will represent a substantial obstacle for terrorists. The waiting
position E9 is well distant from the coastal towns in the area, and is
not likely to be selected, since an intentional damage will cause
negligible consequences. On the other hand, no activity on or below
the surface is allowed in Panigaglia bay and in the proximity of the
pier (CP, 2001), limiting the possibility that a ship can be attacked in
the proximity of the terminal. Even if an insider-supported action
cannot be excluded, it is rather improbable, due to routine checks of
the crewmembers background. All this considered, the more
credible locations for an attack would probably be when the ship is
closer to the coast, passing by the outer breakwater (point P1 in
Fig. 1), or waiting at the India 2 position. An attack in P1 may
possibly block or reduce the passage, damaging the activity of the
harbour. It has to be noticed, that planning an attack in India 2 is
much more complicated, since this anchoring site can be used only
under special conditions, not programmed but decided case by
case.
In case of intentional damage, attention should be paid also to
domino effects, since the terminal it-self may represent a target.
The structure of the Panigaglia tanks (double wall type: internal
tank in low-temperature resistant steel; outer containment con-
sisting of an inner tank in carbon steel enclosed in a pre-stressed
concrete wall) provides a good resistance to overpressure, thermal
radiation and flying fragments; moreover, the terminal-ship
distance at the moment of the attack would be above 1500 m, also
at the closest attack position (India 2), well exceeding the usual
extent of domino effects. According to the literature (SANDIA,
2004), a pool fire will represent the most probable evolution of an
intentional damage: Fig. 2 shows the impact areas for 37.5 kW/m2
(inner circles, in red, about 600 m radius) and 5 kW/m2 (outer
circles, in orange, about 1500 m radius) for an attack located at
India 2, P1, and E9. It can be noticed that the former impact zone,
where severe damages and fatalities are expected, does not cover
the terminal or populated areas; the latter reaches the coast, where
may cause some injuries, but no domino effects; an attack in E9 is
confirmed to have no consequences. The rather improbable case of
vapour dispersion followed by delayed ignition will not be
considered in this preliminary analysis, since a flash fire, but not an
UVCE may occur (see Section 2), and domino effects are excluded.
3.3. Consequence analysis
The consequence analysis is carried out using ALOHA 5.4.1
software. Summer meteorological conditions are assumed, to
obtain conservative estimates: air temperature 26  C, sea temper-
ature 23  C, wind velocity 3.4 m/s, and atmospheric stability classes
E, congruent with the previous data. The prevailing wind in the
zone is from North-East.
The spill is assumed to occur from a circular breach of 5 m2, just
at the sea level. A membrane type ship is considered, with a volume
of the damaged tank of 40,000 m3. The total height of the ship
(from the bottom of the hull to the deck) is 25 m, and its immersion
11.5 m: the initial level of the liquid is assumed 12 m above the sea
surface.
The simulation of LNG release, on open water, results in the spill
of about 7628 t forming a 454 m diameter pool: unfortunately,
ALOHA cannot model pool fires with diameter exceeding 200 m.
These data have been then used as input to another software
(CHEMS-PLUS, Ver. 2.0) obtaining impact zones with a 680 m
radius for 37.5 kW/m2, and of 1560 m for 5 kW/m2. These values
agree rather well with those reported in Section 3.2 (SANDIA,
2004).
In the case of delayed ignition, the zone within LFL concentra-
tion, estimated with ALOHA, extends up to a 1800 m distance from
the origin of the spill, which increases to 2450 m if, as usual, a lower
limit is assumed to account for the presence of flammable pockets
(60% LFL); the maximum width of the cloud is about 1600 m. Fig. 3
shows the impact zones of pool fire and flash fire on the map, for
India 2 e P1 locations, in the hypothesis of wind from North-East.
Regarding the possibility of an UVCE to occur, according to
ALOHA it can be excluded in case of a ‘‘low power’’ ignition source,
while it may happen in case of a ‘‘high power’’ ignition source, such
as a detonation. Actually, even in the remote hypothesis that the
release does not catch fire immediately originating a pool fire, the
evaporation of the pool and the dispersion of the cloud will require
some 10 min, a time which will allow to organise a response against
the attack, and it is not likely that the terrorists will wait in place to
provide a detonation to the cloud. Anyway, also in this case, the
calculated impact distances for an UVCE ignited by a detonation are
in the range 1800–2000 m (assuming destruction of buildings and
 R. Bubbico et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 634–638 637

Fig. 2. Expected impact areas of pool fires caused by an external attack (SANDIA, 2004); inner circles (red) thermal radiation 37.5 kW/m2; outer circles (orange) thermal radiation
5 kW/m2.

serious injury thresholds) which is not so much larger than the pool
fire damage zone.
Finally, resident population may also suffer damages due to the
inhalation of smokes, due to the prevailing wind direction from
North-East: however, when LNG burns, it produces minimal
amounts of smoke, and models often show that the smoke plume
generates a minimal health risk (Lehr & Simecek-Beatty, 2004)
which is particularly true in the case under study, where the
distance is relatively large, and the population can easily shelter
inside buildings.
3.4. Discussion
Preliminarily, it has to be noticed that the possible final events,
and the impact zones calculated for the study case with a ‘‘basic’’
consequence software, such as ALOHA, appear in substantial
agreement with previous results (SANDIA, 2004), based on more
refined models, and well within the spread of experimental and
calculated data available in the literature.
Based on the present results, it seems very unlikely that the
consequences of an accident involving an LNG ship approaching

Fig. 3. Estimated impact areas of pool fires and flash fires caused by an external attack; red zones: thermal radiation 37.5 kW/m2 or natural gas concentration LFL; orange zones:
thermal radiation 5 kW/m2 or natural gas concentration 0.6 LFL.
638 R. Bubbico et al. / Journal of Loss Prevention in the Process Industries 22 (2009) 634–638
the considered terminal may cause casualties to the population.
First, a sea accident giving rise to a spill of LNG can be practically
excluded; second, also an intentional attack, originating a pool fire,
will have only minor consequences for the population. With
reference to Fig. 3, the zone corresponding to the highest thermal
radiation threshold (37.5 kW/m2) is a sea area, which, however,
includes a portion of the outer breakwater, which can be damaged,
in case of attack in P1. Usually, a much lower thermal radiation
threshold (10–12.5 kW/m2) is assumed for lethal effects on the
exposed population which, in this case, results in an impact
distance of about 1000 m from the spill origin. Such impact area
(not shown in Fig. 3) would still have no effect on resident pop-
ulation, in case of attack in P1, while it will marginally affect some
residents (160 persons, based on the average population density of
the municipality) in the most north-eastern part of Portovenere, in
case of attack in India 2. In this lethal zone does not fall any
vulnerability centre; a school is within the 5 kW/m2 impact area,
with injuries possible in the open.
The occurrence of a flash fire, which may affect larger portions of
the Portovenere municipality (see Fig. 3), is to be excluded in most
practical cases, as previously remarked. Indeed, the consequences
of a flash fire, for an attack in the position India 2, may affect the
terminal area; however, a flash fire is expected to produce super-
ficial damages to most exposed items (cables, instrumentation, etc.)
but no damages to the tanks.
Therefore, based on this basic analysis, the approach of a ship to
the Panigaglia terminal appears sufficiently safe, and no additional
mitigative actions may be required, with the only exception of
avoiding that the LNG ships will wait at the India 2 position.
4. Conclusion
Based on the available literature information, a maritime acci-
dent capable of damaging the cargo of an LNG ship, resulting in
a spill into the sea, can be practically excluded in harbour areas, due
to the applied low speed limits and, above all, to the presence of
a double containment for the tanks. On the contrary, the possibility
of a large spill deriving from an intentional damage cannot be
excluded, and a populated harbour area will represent a suitable
target for terrorists.
The location examined in the present work is an LNG
terminal within a harbour provided with outer breakwater
leaving a relatively narrow passage: the consequence analysis
showed that no, or very marginal, involvement of the resident
population has to be expected but, on the other hand, that
material as well as economic losses may occur, if the outer
breakwater is damaged and/or the west passage is partially
obstructed.
References
Ammerman, D. (2002). Marine safety systems, control ballast tanker interactive CD.
SAND2002-3188P. Albuquerque, NM: Sandia National Laboratories.
CP. (1985). Ordinanza 50/1985. Capitaneria di Porto del Compartimento Marittimo di
La Spezia.
CP. (2001). Ordinanza 150/2001. Capitaneria di Porto del Compartimento Marittimo
di La Spezia.
Corriere della Sera. (5 December 2005). Newspaper article, Corriere della Sera,
2005.
Cox, R. A., Comer, P. J., Pyman, M. A. F., & Slater, D. H. (1980). Safety issues in the
sitting of modern LNG terminals. Gastech, 79, 183.
Gas Natural Italia. (2008). www.gasnaturalitalia.com.
Lehr, W., & Simecek-Beatty, D. (2004). Comparison of hypothetical LNG and fuel oil
fires on water. Journal of Hazardous Materials, 107, 3.
Pitblado, R. M., Baik, J., Hughes, G. J., Ferro, C., & Shaw, S. J. Consequences of LNG
marine incidents, CCPS Conference, June 2004, Orlando, Fl.
SANDIA. (2004). Guidance on risk analysis and safety implications of a large liquefied
natural gas (LNG) spill over water. SAND2004-6258. Albuquerque, NM: Sandia
National Laboratories.
SIGTTO. (February 2003). Safe havens for disabled gas carriers. Society of Interna-
tional Gas Tankers and Terminal Operators.