ARTICLE IN PRESS

Reliability Engineering and System Safety 93 (2008) 1328–1344

www.elsevier.com/locate/ress

Analysing the risk of LNG carrier operations

Erik Vanema,, Pedro Antãob, Ivan Østvikc,1, Francisco Del Castillo de Comasd
a
DNV Research, Det Norske Veritas, 1322 Høvik, Norway
b
Unit of Marine Technology and Engineering, Technical University of Lisbon, Instituto Superior Técnico, Lisboa, Portugal
c
LMG Marin, Bergen, Norway
d
Navantia, Madrid, Spain
Received in revised form 15 January 2007; accepted 30 July 2007
Available online 17 August 2007

Abstract

This paper presents a generic, high-level risk assessment of the global operation of ocean-going liquefied natural gas (LNG) carriers.
The analysis collects and combines information from several sources such as an initial hazid, a thorough review of historic LNG
accidents, review of previous studies, published damage statistics and expert judgement, and develops modular risk models for critical
accident scenarios. In accordance with these risk models, available information from different sources has been structured in the form of
event trees for different generic accident categories. In this way, high-risk areas pertaining to LNG shipping operations have been
identified. The major contributions to the risk associated with LNG shipping are found to stem from five generic accident categories, i.e.
collision, grounding, contact, fire and explosion, and events occurring while loading or unloading LNG at the terminal. Of these,
collision risk was found to be the highest. According to the risk analysis presented in this paper, both the individual and the societal risk
level associated with LNG carrier operations lie within the As Low As Reasonable Practicable (ALARP) area, meaning that further risk
reduction should be required only if available cost-effective risk control options could be identified. This paper also includes a critical
review of the various components of the risk models and hence identifies areas of improvements and suggests topics for further research.
r 2007 Elsevier Ltd. All rights reserved.

Keywords: LNG carriers; Marine transportation; Risk analysis; Maritime safety; Gas tankers; Formal safety assessment; Liquefied natural gas

1. Introduction and background conventional designs even though they may violate current
prescriptive requirements.
1.1. The SAFEDOR project As a part of the SAFEDOR project, generic Formal
Safety Assessment (FSA) studies on various ship types
The study presented in this paper was carried out within have been initiated. The risk assessment of LNG carriers
SAFEDOR [1]. SAFEDOR is a research project co- presented herein represents one part—step 2—of one of
financed by the European Commission as an integrated these generic FSAs.
project (IP) in their 6th Framework Programme. One of
the aims of this project is to encourage innovative ship 1.2. Liquefied natural gas and LNG shipping
design for cleaner and safer maritime transport. In order to
facilitate this, concepts for a risk-based regulatory frame- Liquefied natural gas (LNG) is composed of mostly
work will be developed that will open for acceptance of methane and is a cryogenic liquid at approximately
novel design concepts based on risk analyses. These novel 162 1C. When vaporized, its flammability range is
design solutions might have equal or better safety than between approximately 5% and 15% by volume, i.e. a
mixture with air within this range of concentrations is
flammable. Thus, in addition to possible damages due to its
Corresponding author. Tel.: +47 67 57 70 09; fax: +47 67 57 75 20. cryogenic temperatures, LNG spills are associated with
E-mail address: [email protected] (E. Vanem). hazards such as pool fires and ignition of drifting vapour
1
Grieg Logistics, Bergen, Norway since March 2006. clouds. In its liquid state, LNG is not explosive, and LNG

0951-8320/$ - see front matter r 2007 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ress.2007.07.007
 ARTICLE IN PRESS
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344 1329

Fleet development - LNG tankers

400

350

300

250

# ships
200

150

100

50

0
1965 1975 1985 1995 2005
Year

Fig. 1. LNG fleet developments 1965–2005 and forecast until 2010.

vapour will explode only if ignited in a mixture with air ing within the ship’s hull. These tanks are insulated
within the flammability range and within an enclosed or externally. Both tanker alternatives are designed, con-
semi-enclosed space. Natural gas may also present an structed and equipped with sophisticated systems for
asphyxiation hazard. LNG is not toxic and will not be carrying LNG over long distances, stored at temperatures
persistent if spilled in a marine environment. LNG weighs around 162 1C. Each of the main types of LNG vessel
less than water, thus LNG spilled on water will float. designs constitute about half of the fleet (the actual
In liquefied form, the volume of LNG is 600 times less distribution is 50% membrane ships, 45% spherical
than the same amount of natural gas at room tempera- tankers and 5% of other types of LNG tankers), but
tures. LNG shipping is therefore an economic way of membrane tankers are dominant among LNG new
transporting large quantities of natural gas over long buildings. LNG vessels are generally well designed, well
distances. LNG is transported and stored at normal maintained and operating with well-trained crew. Thus,
atmospheric pressure, and LNG carriers are purpose-built LNG shipping so far has a good safety record. The two
tank vessels for transporting LNG at sea. main types of LNG carriers are illustrated in Fig. 2.
The current world fleet of LNG carriers is relatively
small; as of August 2005 it contained 183 ships,2 but it has 1.3. The FSA methodology
been increasing steadily in recent years. A further increase
is expected in the coming years. Fig. 1 illustrates the LNG FSA is a standard risk assessment, with the aim of
fleet development, and includes a forecast until 2010. developing maritime safety regulations in a structured and
During the more than 40 years of LNG shipping, the total systematic way. It should not be mistaken for a risk
number of LNG carrier shipyears is 2838 (including 2005). assessment for a specific ship or a ship’s safety case. FSA
Of these, 1857 are accumulated since 1990. may better be described as a safety case for the rules and
In addition to an increase in numbers, the size of LNG regulations. FSA can be used in the evaluation of new
carriers is also increasing. The average size of the current regulations and for comparison between existing and
fleet is almost 120,000 m3, whereas the average size of possibly improved regulations, and it aims at balancing
vessels currently in the order book is 156,000 m3.2 LNG safety and environmental protection levels with costs. Both
super-tankers with capacities of 200,000–250,000 m3 are technical and operational issues, including the influence of
foreseen in the near future [2]. the human element on shipping accidents, may be
All types of LNG carriers are double-hull vessels, but incorporated in an FSA. Various aspects and applications
there exist different cargo containment systems of inde- of the FSA methodology have been extensively discussed in
pendent or integrated cargo tanks. The current LNG fleet different academic journals [3–9].
is dominated by two main types of vessel designs, i.e. the IMO has developed guidelines for FSA studies [10]. By
membrane tank designs and the spherical tank designs. In now, a number of FSA studies have been performed and
membrane tank designs, the cargo containment system reported to IMO according to these guidelines, and
consists of a very thin invar or stainless steel double-walled, decisions have been made based on such submissions
insulated cargo envelope that is structurally supported by [11,12]. The methodology is described as a 5-step process:
the ship’s hull. The spherical tank carriers, also referred to
as Moss tankers, have spherical aluminium tanks or 0. Preparatory steps
prismatic-shaped stainless steel tanks that are self-support- 1. Identification of hazards
2. Risk analysis
2
Information obtained at http://www.lngoneworld.com. 3. Identifying risk control options
 ARTICLE IN PRESS
1330 E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

Fig. 2. Main types of LNG carriers: moss spherical tankers (top) and membrane tankers (bottom).

4. Cost–benefit assessment Table 1

5. Recommendations for decision-making. Main characteristics of reference vessel

Length overall 284.40 m

The study presented in this paper corresponds to the Length between perpendiculars 271.00 m
second step—risk analysis—of an ongoing FSA on LNG Breadth (moulded) 42.50 m
tankers. Depth to main deck (moulded) 25.40 m
Depth to trunk deck (moulded) 32.20 m
Draft design (moulded) under keel 11.40 m
2. Defining the scope of study Draft scantling (moulded) 12.30 m
Double-bottom depth 2.9 m
This paper describes a high-level, generic risk analysis of Double-side width 2.32 m
LNG carriers, and the scope of the study is the whole fleet Total displacement 98,500 t
of ocean-going LNG carriers. A generic LNG carrier is Total cargo tank capacity 138,000 m3
Total insulation thickness 0.530 m
assumed representative for the various types of LNG Service speed at design moulded draft 19.50 knotsa
vessels. Historic accident experience indicates that the risk Accommodation capacity 40 personsb
level of the main types of LNG carriers is comparable, so
a
this assumption seems valid up to a certain level of detail. It At NCR (90% of MCR) of main propulsion machinery.
b
Including 4 Suez canal workers.
is noted that membrane tanks have experienced cargo tank
leakage through its primary barrier, and are also believed
to be more vulnerable to effects of dynamic loads and Security issues are regarded as out of scope. The
sloshing of LNG cargo, but risk contributions from such environmental risks associated with LNG shipping are
scenarios are assumed small in comparison with the main assumed small since LNG is non-toxic and non-persistent,
accident scenarios investigated in this study. Therefore, and is therefore not relevant to this study. Thus, the focus
detailed studies of specific ships as well as specific trades of this study has been on safety and risk to human lives.
and port environments are defined out of scope. Third-party risks to people on shore are also left out of the
However, a particular reference vessel will be used where study. It is argued that such risks should rather be
needed. For the purpose of this generic analysis, a investigated in specific risk analyses pertaining to specific
138,000 m3 membrane LNG vessel currently under con- LNG terminals or LNG trades, and these issues are more
struction at Navantia was chosen. The cargo capacity of related to the siting of LNG terminals than to IMO
this reference vessel is within the main range of LNG regulations for maritime safety. Thus, this study only
carriers and its speed is typical for this type of vessels. It considers the risks to LNG crew as well as risks to crew and
has a reversible geared, cross-compound steam-driven passengers onboard other vessels. Finally, the focus has
28,000 kW  83 RPM main turbine and a 5-blade fixed been on accidents of a certain scale, and high-frequency,
pitch-type propeller. The main characteristics of the small-scale occupational accidents have not been empha-
reference vessel are given in Table 1. sized.
Only the shipping phase of the LNG chain is considered,
covering loading at the export terminal, the actual voyage 3. Risk acceptance criteria
and unloading at the receiving terminal. Risks pertaining
to exploration, production, liquefaction, storage and In order to evaluate the risk as estimated by a risk
regasification of natural gas are considered out of scope. analysis, appropriate risk acceptance criteria should be
Furthermore, only the operational phase of an LNG vessel established prior to and independent of the actual risk
is considered, and risks associated with construction, analysis. Among different principles of safety [13], the As
repairs in dock and scrapping of LNG vessels are out of Low As Reasonably Practicable (ALARP) principle will be
scope. employed, i.e. risk acceptance criteria should divide
 ARTICLE IN PRESS
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344 1331

between three levels of risk: intolerable, ALARP and ments, the economic value of LNG shipping was estimated
negligible. For risks within the ALARP area, cost- to be USD 1.6 million per shipyear. The risk acceptance
effectiveness considerations apply to the amount of criteria that were derived based on these estimates are
resources that should be spent on risk mitigation. The illustrated in Fig. 3. It should be noted that these criteria
IMO FSA guidelines [10] recognized this as the current best are somewhat stricter than the criteria proposed for tankers
practice, although criticism of the ALARP principle has in general by Norway [16].
occurred [14]. For this risk analysis on LNG carriers, risk These societal risk acceptance criteria can be assumed
acceptance criteria for individual and societal risks were appropriate also for crew onboard other vessels, but for
derived for crew as well as for passengers onboard other passengers onboard other vessels more strict criteria might
vessels that might be affected by a possible LNG accident. be appropriate. Thus, for the purpose of this study, societal
risk acceptance criteria for passengers with anchor points
3.1. Individual risk acceptance criteria that are one order of magnitude lower than for the criteria
for crew will be used.
A thorough review of alternative risk acceptance criteria
was presented in Skjong et al. [15]. Based on this review, 3.3. Cost-effectiveness criteria
the acceptance criteria for individual fatality risk to crew
presented in Table 2 were adopted for the current study. The results from the risk analysis presented in this paper
This corresponds to the risk level experienced by an may be carried forward to support cost-effectiveness
exposed crewmember. The individual risk to third parties assessments of new as well as existing safety measures. If
(including passengers on other vessels) is intuitively the risk level is found to lie in the ALARP area, all
assumed to be negligible, so only criteria for the LNG available cost-effective risk control options should be
crew are deemed necessary. implemented according to the FSA philosophy. There exist
various measures of cost effectiveness, and two that are
3.2. Societal risk acceptance criteria often used in conjunction with FSA studies are the Gross
Cost of Averting a Fatality (GCAF) and the Net Cost of
Societal risk acceptance criteria for crew were established Averting a Fatality (NCAF), defined by Eqs. (1) and (2).
based on the approach described in Norway [16]. Accord- DC is the cost, DR is the risk reduction and DB is the
ing to this method, acceptance criteria are associated with economic benefit resulting from implementing the measure,
the economic importance of LNG shipping, calibrated respectively:
against the average fatality rate per unit of economic
production. Based on reasonable estimates of daily rates, DC
GCAF ¼ , (1)
operational costs and capital costs due to initial invest- DR

DC  DB
Table 2 NCAF ¼ . (2)
Individual risk acceptance criteria for LNG crew
DR
The risk analysis defines the baseline risk level and
Intolerable risk per year 4103
thereby also the potential for risk reduction. For a
ALARP area per year 106–103
Negligible risk per year o106 prospective measure, i.e. a regulatory option, the risk
models developed in this paper can be used to investigate

Risk acceptance criteria for LNG tankers

1.E-01
F - frequency of N or more fatalities

1.E-02
Intolerable
(per shipyear)

1.E-03

ALARP
1.E-04

1.E-05
Negligible

1.E-06
1 10 100
N - number of fatalities

Fig. 3. Societal risk acceptance criteria for crew.

 ARTICLE IN PRESS
1332 E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

Historic LNG incidents

Other Unknown
11 % 1%

Spherical
51 %

Membrane
37 %

LNG incidents, 1985 and later

Other Unknown
4% 2%
Spherical
33 %

Membrane
61 %

Fig. 4. Breakdown of LNG accidents based on ship type: since the start of LNG shipping (top) and for 1985 and later (bottom).

the expected risk-reducing effect. Further analyses would ing the severity of the accidents or the relative population
also be required in order to estimate the expected cost as of membrane and spherical carriers.
well as any economic benefits that would result from The available material indicates that accidents have
implementing the measure. In accordance with current happened more often on spherical-type LNG ships during
practice within IMO and the proposals presented in MSC the history of LNG shipping, but that accidents have been
72/16 [10], a risk control measure will generally be more frequent on membrane ships during the last 20 years.
recommended for implementation if GCAFpUSD 3 Available statistics are too sparse to draw any definite
million or NCAFpUSD 3 million (note that by definition, conclusions, and conclusions cannot be drawn without
NCAFpGCAF, so if GCAFpUSD 3 million, NCAF will considering the population of each LNG carrier type, but it
always be pUSD 3 million). For risk control options is noted that accidents have occurred for all types of LNG
where the estimated cost effectiveness is close to USD 3 carriers. For the purpose of this high-level study, the
million, further scrutiny might be required. accident frequency is henceforth assumed independent of
LNG carrier type.
4. Accident scenarios
4.2. Generic accident categories
4.1. Operational experience with LNG tankers
The 158 known relevant LNG carrier accidents can be
Marine transportation of LNG has gradually increased grouped into a few generic accident types. The breakdown
since the first LNG cargo was transported by an LNG of accidents into accident categories is presented in Table 3,
tanker in 1959 and the first purpose-built LNG tanker was and Table 4 presents the breakdown into accident
engaged in commercial trade in 1964. Thus, more than 40 categories and different periods of time.
years of operational experience with LNG carriers has This categorization of accidents is in general agreement
accumulated over the years. with the scenarios identified during the hazard identifica-
A literature survey on the history of LNG shipping tion [18]. Some of the accident categories are not believed
reveals information of 182 events, with or without LNG to be associated with severe consequences in terms of
spillage, involving LNG carriers larger than 6000 GRT fatalities. For example, the accident category equipment
[17]. Of these, 24 occurred to ships out of regular service and machinery failure is associated with incidents where the
(e.g. in yard during construction or repair or while in tow failure did not lead to any subsequent events such as
or during sea trials) and are considered out of scope. Thus, collision, grounding or fire. For incidents where subsequent
previous experience amounts to 158 known relevant events occurred, e.g. for rudder failures leading to collision
accidents involving LNG carriers. The breakdown of or grounding, it has been sorted under the accident
LNG events on ship types according to these accidents is category corresponding to this subsequent event. Hence,
illustrated in Fig. 4. It is emphasized that this only even though equipment and machinery failure is associated
illustrates the total number of accidents without consider- with the highest incident frequency, this accident category
 ARTICLE IN PRESS
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344 1333

Table 3 Collision risk

Distribution of historic LNG accidents on categories

Accident category Accidents Frequency Grounding risk

(#) (per shipyear)

Collision 19 6.7  103 Contact risk

Grounding 8 2.8  103 Total risk
Contact 8 2.8  103
Fire and explosion 10 3.5  103 Fire/explosion risk
Equipment and machinery failure 55 1.9  102
Heavy weather 9 3.2  103
Events while loading/unloading cargo 22 7.8  103 Loading/Unloading risk
Failure of cargo containment system 27 9.5  103
Total 158 5.6  102 Fig. 5. Overall risk model for LNG carriers.

and the possible further escalation of the scenarios are

Table 4
specific to LNG carriers due to the characteristics of its
Breakdown of historic accident data based on accident categories and
periods of time cargo.

64–75 76–85 86–95 96–05 64–05

Exposure (accumulated 116 585 770 1367 2838 5. Risk models
shipyears)

Collision 1 10 4 4 19 Selection of accident scenarios for further analysis

Grounding 1 6 – 1 8 corresponds to the overall risk model for LNG carriers
Contact – 4 – 4 8 as illustrated in Fig. 5. In the following, overall risk models
Fire and explosion 2 5 – 3 10 for each accident category will be developed and the
Equipment and – 39 7 9 55
machinery failure
frequencies and consequences associated with each of the
Heavy weather – 6 3 – 9 sub-models will be further investigated.
Events while loading/ 4 13 3 2 22
unloading cargo
Failure of cargo 7 15 5 – 27 5.1. Frequency assessment
containment system

Total 15 98 22 23 158 The frequency of an initiating event for each of the risk
sub-models is based on the historic frequencies in Table 3.
However, some adjustments to the estimates for the fire
is not believed to be very critical to crew safety. Also, and explosion scenario and the loading/unloading scenario
incidents due to bad weather and failure of cargo contain- are made.
ment system that are not leading to subsequent accidents In all, 50% of the experienced fire and explosion
such as collision, grounding and fire are considered to accidents were vent riser fires and these do not constitute
constitute a small risk compared with the remaining any significant hazard to the crew or the ship. Hence, these
accident scenarios. Thus, the following five generic accident incidents were not regarded and the initiating frequency of
scenarios were selected for further study in the risk fire and explosion is reduced accordingly, i.e. to 1.8  103
analysis: per shipyear. A total of 22 loading/unloading incidents
have been reported. However, only 9 of these reported any
 Collision leakage of LNG, and only these events are assumed critical
 Grounding to safety. This corresponds to a frequency of 3.2  103 for
 Contact3 loading/unloading accidents, resulting in leakage of
 Fire or explosion LNG, and this frequency will be used in the risk
 Incidents while loading/unloading of cargo assessment. The initial frequencies used for each accident
scenario are presented in Table 5. Comparing these
These are regarded as the main risk contributors, and frequencies with statistics for other generic vessel types,
risks from other scenarios are assumed to be negligible in such as oil tankers, chemical tankers, LPG tankers and
comparison. It is noted that the accident categories listed bulk carriers, they are found to agree reasonably well. In
above are general maritime accident scenarios that can general, the accident frequencies are found to be somewhat
occur for all types of ships, but the potential consequences lower for LNG carriers than for these other types of
vessels, but this was expected considering the high focus
3
Striking or being struck by any fixed or floating objects other than on safety on these ships and the generally high competence
another ship or the sea bottom. of LNG crew.
 ARTICLE IN PRESS
1334 E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

5.2. Consequence assessment collision bulkhead. Furthermore, the collision might occur
when the LNG carrier is in ballast or when it is fully
The expected consequences for each of the selected loaded. When the LNG carrier is the struck ship, the
scenarios will be assessed by utilizing event tree techniques. collision might cause a damage that penetrates the outer
First, a set of event trees will be constructed, one for each and inner hulls. If penetrating the inner hull, it might cause
accident scenario, based on conceptual risk models. Then, leakage of cargo. This might result in materialization of an
these event trees will be quantified using a variety of LNG hazard such as pool fire. Cryogenic temperatures of
different techniques for different branches. The estimates in LNG or heat generated from a pool fire might deteriorate
Table 5 will be used as frequencies for the initiating events. the strength of the ship and may eventually lead to sinking.
If LNG hazards materialize or the ship sinks, failure to
5.2.1. Constructing event trees evacuate in time may lead to a number of fatalities among
As the event trees tend to grow complex, it is not feasible the crew. Finally, for some of the possible LNG hazards,
to describe them in detail within the format of this paper. fatalities may occur among crew or passengers onboard the
However, the conceptual risk model for each accident other vessel. Hence, the risk model illustrated in Fig. 6
scenario will be presented in the following. describes a typical collision accident, and an event tree is
A typical collision scenario with an LNG carrier might constructed based on this.
develop in the following way. First, a collision occurs. The The grounding and contact scenarios will resemble the
LNG vessel might be the struck or the striking ship. If the collision scenario in many ways. First, a grounding/contact
LNG vessel is the striking ship, the likelihood of further event might occur in either loaded or ballast condition. The
escalation of the accident is regarded as small as it will grounding or contact will result in a certain extent of ship
receive the collision impact in the bow in front of the damage, and this damage might cause leakage of cargo
and/or loss of stability. If LNG is released, one or more
Table 5
LNG hazards might materialize. Again, the LNG carrier
Frequency estimates for selected accident scenarios might sink due to the damage or due to deteriorating
strength caused by LNG leakage. Finally, if the crew is not
Accident category Initial frequency able to evacuate in time, there might be fatalities due to
(per shipyear)
LNG hazards or the sinking of the ship. The grounding
Collision 6.7  103 and contact risk models that form the basis for event trees
Grounding 2.8  103 are illustrated in Fig. 7.
Contact 2.8  103 The fire or explosion scenario describes an accident
Fire and explosion 1.8  103
where a fire or an explosion is the initiating event. It is
Leakage of LNG while loading/unloading 3.2  103
distinguished between three types of fire scenarios, namely,

Collision
Collision frequency
frequency

Loading Probability of being loaded/in ballast

condition model

Damage extent Probability distribution of damage

model

Cargo leakage
Probability of cargo release
frequency

LNG hazard Probability distribution of

model LNG hazards materializing

Survivability Probability of
model sinking

Third parties Evacuation

model model

Number of Number of
fatalities, other fatalities, LNG
vessel

Consequence

Fig. 6. Risk model for collision of LNG carriers.

 ARTICLE IN PRESS
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344 1335

Grounding /contact
Grounding or contact frequency
frequency model

Loading Probability of being loaded /in ballast

condition model

Damage extent Probability distribution of damage

model

Cargo leakage
Probability of cargo release
frequency

LNG hazard Probability distribution of

model LNG hazards materializing

Survivability Probability of
model sinking

Evacuation
model
Number of
fatalities, LNG

Consequence

Fig. 7. Risk model for grounding or contact of LNG carriers.

fires that start in the machinery spaces, in accommodation sequences associated with each scenario, a set of different
areas or day rooms, and in the cargo area. For fires starting approaches and techniques have been used. For each sub-
in machinery spaces or in accommodation areas, it is model and for each branch of the event three, the method
deemed highly unlikely that it will spread to the cargo area that was found to be most practical was utilized and the
and no LNG-specific hazards are assumed. Thus, these information source that was assumed to be most relevant
scenarios will resemble similar fire accidents on other cargo was exploited. Detailed descriptions of all these are not
ships such as oil tankers. The compressor room is the most possible within the scope of this paper, but an outline
likely place in the cargo area for a fire to break out, and describing the main approaches will be provided in the
such fires will be specific to LNG carriers. For a following.
compressor room fire, the following scenario is assumed: The event tree for the collision scenario was quantified
the fire protection systems might fail in preventing or based on various techniques. First, some obvious general
extinguishing the fire or explosion, which might lead to a assumptions were made, e.g. the probability of being the
breach in the cargo containment system and subsequent striking or struck ship was assumed to be 0.5, and the
leakage of LNG. If there is leakage of LNG, an LNG probability of being loaded and in ballast was assumed to
hazard might materialize, and there will be a possibility be 0.5 (since LNG shipping is principally unilateral in
that the ship will not survive. Finally, in the event of an nature). The damage extent model contains several parts,
escalating fire, the crew needs to evacuate and failure to do describing the probability distribution of damage location,
so in time might result in a number of fatalities. The fire depth, length and height that again determines the
and explosion risk model adopted in this study is illustrated probabilities of water ingress, receiving the damage in the
in Fig. 8. cargo area, etc. For these probabilities, results from
Spillage events during loading or unloading of cargo previous studies have been utilized, e.g. Olufsen et al. [19]
while in port are generally assumed to be of small scale, and Skjong and Vanem [20], and in particular the damage
where only a limited number of the crew are exposed to database developed by the HARDER project have been
risks of injuries or death. Fatal accidents are only deemed exploited [21,22]. The extent of collision damage will
likely for crew members directly exposed to the cryogenic determine the probability of cargo leakage. The remaining
LNG. The resulting risk model is illustrated in Fig. 9, parts of the risk model, related to materialization of LNG
which was used to construct event trees for this scenario. hazards, survivability and evacuation, are associated with
significant uncertainties and no amount of relevant data
5.2.2. Quantifying the event trees exist. Therefore, a workshop was arranged where expert
In order to assign probabilities for the various escalating opinion was elicited and incorporated in the event tree.
events, and thereby quantify the probabilities and con- A separate Delphi session was arranged in order to arrive
 ARTICLE IN PRESS
1336 E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

Fire/explosion frequency model Fire/explosion frequency

Engine room fire Accommodation area fire Compressor room fire

Loading Probability of being loaded/in

condition model ballast, at sea/port

Fire protection Probability of fire protection

model system failing

Cargo leakage Probability of cargo

model release

Probability
LNG hazard
distribution of LNG
model
hazards materializing

Survivability Probability of
model sinking

Evacuation
model

Number of
fatalities

Consequence

Fig. 8. Risk model for fire and explosion on LNG carriers.

Loading/unloading
spill frequency model Probability of loading/unloading incident with spillage

Spillage extent Probability distribution of spillage extent

model

LNG hazard Probability distribution of

model LNG hazards materializing

Accident model Number of fatalities, LNG

crew, terminal workers

Consequence

Fig. 9. Risk model for spill events during loading or unloading of LNG carriers.

at consequence estimates related to number of fatalities on information were exploited. The event trees were quanti-
the LNG vessel as well as on the other vessel involved in fied accordingly, as illustrated in Fig. 11 (grounding) and
the collision. All the estimates were inserted into the event Fig. 12 (contact).
tree in order to estimate the overall risk related to the Due to its relatively small fleet, sufficient data on LNG
collision scenario. The event tree for collision scenarios is carrier fires are not readily available. In the accident
illustrated in Fig. 10. statistics for LNG carriers only five fires were reported
For the grounding and contact scenarios, similar (disregarding vent riser fires), and, of these, 3 started in the
approaches for quantification of the event trees were used machinery spaces. This would correspond to 60% of the
as in the collision scenario, and the same sources of fires originating in the engine rooms, but it is realised that
 A crew of 30 is assumed Risk contribution
Loading Cargo
Collision frequency Survivability
condition Damage extent model leakage LNG Hazaard model Evacuation model Third party model LNG crew Third parties
model model
model model

Damage No drifting Probability Other Not large

No cryogenic Probability of # fatalities
Striking In ballast outside critical No leakage vapour No pool of fatalities vessel not passenger
Collision damage to Surviving fatalities # fatalities on other Consequence Frequency Risk Consequence Frequency Risk
ship (no LNG) cargo area damage of LNG cloud fire on other passenger ship (
hull among crew vessel
only ignition vessel vessel 20.000 GRT)

0.0067 0.5 0.5 1 1 1 1 1 1 1 0 0 0 0

0.5 1 1 1 1 1 1 1 0 0 0 0

0.5 0.5 0.35 0.95 1 1 1 1 1 0 0 0 0

0.05 1 1 1 1 0 0 0 0 0

1 0.978 12.9 0 0 12.9 2.8668E-05 0.00036981

0.65 0.914 1 1 1 0 0 0 0

0.086 1 1 0 0 0 0 0

1 0.978 12.9 0 0 12.9 9.1573E-05 0.00118129

0.5 0.35 0.95 1 1 1 0 0 0 0

0.05 1 1 0 0 0 0

1 0.978 12.9 0 0 12.9 2.8668E-05 0.00036981

0.65 0.856 1 1 1 0 0 0 0

0.144 0

1 0

Yes 1 0.9 0.89 0

No 1 0.978 12.9 0.98 0.87 3.11 12.9 0.00012282 0.00158435 3.11 0.0001071 0.00033299

0.13 0.97 62.7 62.7 1.552E-05 0.00097304

0.03 627 627 4.8E-07 0.00030094

ARTICLE IN PRESS

0.11 0

1 0.989 16 0.98 0.87 3.11 16 1.535E-05 0.00024561 3.11 1.323E-05 4.1156E-05

0.13 0.97 62.7 62.7 1.918E-06 0.00012026

0.03 627 627 5.932E-08 3.7195E-05

0.1 0
TOTAL RISK
1 0
For Crew 0.004415 fatalities per shipyear
1 0.989 16 0.98 0.87 3.11 16 1.5506E-05 0.00024809 3.11 1.337E-05 4.1572E-05
3rd party 0.00159 fatalities per shipyear
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

0.13 0.97 62.7 62.7 1.937E-06 0.00012148

0.03 627 627 5.992E-08 3.7571E-05

Sum Risk LNG Crew 0.00399896 3rd party 0.00159049 fatalities per shipyear

Other Crew 0.00041572 fatalities per shipyear

Fig. 10. Event tree: collision of LNG carriers.

1337
 1338
A crew of 30 is assumed
Grounding Loading Cargo
Survivability
frequency condition Damage extent model leakage LNG Hazard model Evacuation m odel
model
model model model

Damage
No cryogenic No drifting Probabilities of
In ballast outside No leakage No pool Risk
Grounding critical damage damage to vapour cloud Surviving fatalities among # fatalities Consequence Frequency
(no LNG) cargo area of LNG fire contribution
hull ignition crew

E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

only

0.0028 0.5 0.3 0.924 1 1 1 1 1 0 0

0.076 1 1 1 1 0

1 0.978 12.9 12.9 3.1218E-05 0.000402709

0.7 0.924 1 1 1 1 1 0

ARTICLE IN PRESS
0.076 1 1 1 1 0

1 0.978 12.9 12.9 7.2841E-05 0.000939655

0.5 0.3 0.924 1 1 1 1 1 0

0.076 1 1 1 1 0

1 0.978 12.9 12.9 3.1218E-05 0.000402709

0.7 0.924 1 1 1 1 1 0

0.076 0

1 0

Yes 1 0.9 0.89 0

No 1 0.989 16 16 5.9002E-05 0.000944036

0.11 0

1 0.989 16 16 7.2924E-06 0.000116679

0.1 0

1 0

1 0.989 16 16 7.3661E-06 0.000117857

Sum Risk 0.002923644 Fatalities per shipyear

Fig. 11. Event tree: grounding of LNG carriers.

 A crew of 30 is assumed
Grounding Loading Cargo
Survivability
frequency condition Damage extent model leakage LNG Hazard model Evacuation model
model
model model model

Damage No No drifting
Probabilities
In ballast outside No leakage cryogenic vapour No pool Risk
Contact critical damage Surviving of fatalities # fatalities Consequence Frequency
(no LNG) cargo area of LNG damage to cloud fire contribution
among crew

E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

only hull ignition

0.0028 0.5 0.3 0.962 1 1 1 1 1 0 0

0.038 1 1 1 1 0

1 0.978 12.9 12.9 1.5609E-05 0.00020135

0.7 0.962 1 1 1 1 1 0

ARTICLE IN PRESS
0.038 1 1 1 1 0

1 0.978 12.9 12.9 3.6421E-05 0.00046983

0.5 0.3 0.962 1 1 1 1 1 0

0.038 1 1 1 1 0

1 0.978 12.9 12.9 1.5609E-05 0.00020135

0.7 0.962 1 1 1 1 1 0

0.038 0

1 0

1 0.9 0.89 0

1 0.989 16 16 2.9501E-05 0.00047202

Yes 0.11 0

No 1 0.989 16 16 3.6462E-06 5.8339E-05

0.1 0

1 0

1 0.989 16 16 3.683E-06 5.8929E-05

Sum Risk 0.00146182 Fatalities per shipyear

Fig. 12. Event tree: contacts of LNG carriers.

1339
 1340
A crew of 30 is assumed

Fire Cargo LNG

Loading condition Survivability
Fire / explosion Model protection leakage Hazard Evacuation model
model model
model model model

Fire Fighting Probability of

Fire / Fire and explosion In ballast No leakage no pool Risk
at port systems Surviving fatalities # fatalities Consequence Frequency

E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

Explosion distribution (no LNG) of LNG fire contribution
successful among crew

Compressor room
0.03 0.5 0.1 0.85 1 1 1 0.37 1 1 8.4915E-07 8.4915E-07 Yes

0.15 1 1 1 0.37 1 1 1.4985E-07 1.4985E-07 No

0.9 0.85 1 1 1 0.37 1 1 7.6424E-06 7.64235E-06

0.15 1 1 1 0.37 1 1 1.3487E-06 1.34865E-06

ARTICLE IN PRESS
0.5 0.1 0.85 1 1 1 0.37 1 1 8.4915E-07 8.4915E-07

0.15 0.9 1 1 0.37 1 1 1.4985E-07 1.4985E-07

0.1 0

1 0

1 0.989 8 8 4.0055E-08 3.20436E-07

0.9 0.85 1 1 1 0.37 1 1 7.6424E-06 7.64235E-06

0.15 0.9 1 1 0.37 1 1 1.3487E-06 1.34865E-06

0.0018
0.1 0

1 0

1 0.989 16 16 3.6049E-07 5.76785E-06

Machinery space
0.81 0.37 1 1 0.00053946 0.00053946

Accommodation area
0.16 0.37 1 1 0.00010656 0.00010656

Sum Risk 0.000672088 fatalities per ship year

Fig. 13. Event tree: fire and explosion of LNG carriers.

 ARTICLE IN PRESS
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344 1341

the statistical base for this estimate is very weak. It was 6. Risk summation
therefore assumed that the relative distribution of fires
starting in machinery spaces, accommodation areas and The risk modelling outlined in the previous sections
cargo areas is similar to that of oil tankers, and recent results in the contributions from the various scenarios to
results from a study on aframax tankers were utilized [23]. the total potential loss of lives per shipyear from LNG
It may be argued that both the cargo area and the shipping operations. This is presented in Table 6.
machinery spaces are very different for LNG tankers and
oil tankers, and this suggests that probabilities arrived at 6.1. Individual risk
from such comparison are not very accurate. Notwith-
standing, fire statistics for LNG carriers are too scarce to Intuitively, the individual risk for passengers onboard
be useful, and statistics from oil tankers are believed to be other vessels is not an issue in this context, and only the
the best available source of information. The estimates individual risk to LNG crew will be considered. Assuming
used for the relative distribution of fires should be regar- a crew of 30 for a typical LNG carrier and a 50–50 rotation
ded with a high degree of uncertainty, but it is noted scheme (meaning that two complete crews are needed for
that the overall results are not overly sensitive to these continuous operation of the vessel), the individual risk to
uncertainties. crew is assessed to be 1.6  104 per person year.
Furthermore, for fires in machinery spaces and accom- Compared with the individual risk acceptance criteria
modation areas, statistics from oil tanker accidents were established in this study, it is seen that the individual risk
assumed appropriate for LNG tankers and no further risk falls within the ALARP area.
modelling was deemed necessary with regard to how these It should be noted, however, that this is the individual
fires would potentially escalate. For quantification of the risk from ship accidents, and contributions from occupa-
risk model for compressor room fires, different sources of tional accidents are not considered. Occupational accidents
information were used. For example, the assumed failure were not considered in the present study, but previous
rate of the fire protection system was based on results from estimates of occupational fatality risks onboard gas tankers
previous studies on other ship types [24,25]. Estimates on are presented by Hansen et al. [26] as 2.7  102 fatalities
probabilities related to LNG leakage, LNG hazards per 10,000 days onboard. Assuming a 50–50 rotation
survivability and evacuation performance were again based
on expert judgement. The event tree for fire and explosion
is illustrated in Fig. 13. Table 6
The event tree for spillage events during loading and Potential loss of lives from LNG carrier operations per shipyear
unloading of cargo was quantified based on assumptions Accident category PLL (crew) PLL (passengers)
related to typical LNG trading patterns and normal cargo
transfer operations. Furthermore, it was assumed that only Collision 4.42  103 1.59  103
Grounding 2.93  103 0
relatively small-scale spillages would occur during loading
Contact 1.46  103 0
and unloading, with the potential to harm only those Fire and explosion 6.72  104 0
members of the crew directly exposed to the spilled LNG. Loading/unloading events 2.64  104 0
The event tree for loading and unloading events is
Total 9.74  103 1.59  103
illustrated in Fig. 14.

A crew of 30 is assumed Yes

No

L/U incident
Spillage LNG Hazard Accident
frequency
extent model model model
model

No cryogenic
No spillage
Freq of L/U damage to Risk
near to crew # fatalities Consequence Frequency
incident crew contribution
operation
members

0.00317 0.9167 1 0

0.0833 0 0

1 1 1 0.000264167 0.000264167

Sum Risk 0.000264167 Fatalities per shipyear

Fig. 14. Event tree: spillage during loading or unloading operations of LNG carriers.
 ARTICLE IN PRESS
1342 E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

scheme, a crewmember will be on board for approximately passenger (Figs. 15 and 16). Compared with the established
182 days per year, and 10,000 days onboard corresponds to risk acceptance criteria, it is found that also the societal
55 person years for a typical crewmember. Hence, risks lie within the ALARP region. An FN curve that
according to the estimates presented by Hansen et al. shows the contribution from each of the main accident
[26], the occupational fatality rate onboard gas tankers is scenarios may also be produced (Fig. 17), and it is readily
around 4.9  104 per person year. Assuming this estimate seen that the overall risk level is dominated by the collision,
and adding this to the individual risk from ship accidents, grounding and contact scenarios. However, fire and
the total individual risk for crewmembers is estimated to be explosion are dominating the low-consequence risk con-
approximately 6.5  104 per person year. This estimate is tributions in the order of one fatality. The frequencies in all
still within the ALARP area according to the risk 3 figures are in terms of per shipyear.
acceptance criteria established in this study. On a final It is observed that the FN curves resulting from this
note, it is observed that the individual risk to crewmembers study lie slightly above the FN curves for gas tankers
onboard LNG carriers is dominated by occupational presented in MSC 72/16 [16], but in general the FN curves
accidents, with a ratio of 3 occupational fatalities to every are found to be in reasonable agreement.
fatality due to ship accidents according to the estimates
above. 7. Uncertainties and suggestions for further research

6.2. Societal risk expressed by FN curves When the various assumptions and other sources of
uncertainties are reviewed, it becomes evident that some
Detailed results from the risk analysis can be used to are conservative while others might be optimistic. Thus, the
produce FN curves for the overall risk to crew and overall results might in principle be skewed in either way.

Risk level - LNG carriers

0.01
F - frequency of N or more fatalities

0.001

0.0001

0.00001
1 10 100
N - number of fatalities

Fig. 15. FN curve for crew.

Risk to passengers from LNG carrier operations

1.E-04
F - frequency of N or more fatalities

1.E-05

1.E-06

1.E-07

1.E-08
1 10 100 1000 10000
N - Number of fatalities

Fig. 16. FN curve for passengers.

 ARTICLE IN PRESS
E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344 1343

Risk level - LNG carriers

Broken down on accident categories
1.E-02

F - frequency of N or more fatalities

1.E-03

1.E-04

1.E-05

1.E-06

1.E-07
1 10 100
N - number of fatalities

Risk level - LNG Collision Grounding

Contact Fire/Explosion Loading/Unloading

Fig. 17. FN curve for crew, broken down into accident types.

Table 7
Conservative and optimistic assumptions made in the presented study

Assumption Effect Relevant scenario

HARDER data have been used for damage distributions Conservative Collision, grounding and contact
Consequential cryogenic damages due to LNG released assumed to sink the ship Conservative Collision, grounding, contact and fire and explosion
Probability of crack in tanks in case of compressor room fire ¼ 0.1 Conservative Fire and explosion
Fire frequency compared with oil tankers Conservative Fire and explosion
Fire-fighting systems assumed similar as for HSC and passenger ships Conservative Fire and explosion
No leakage of LNG in ballast condition Optimistic Collision, grounding, contact and fire and explosion
Critical damage penetration in grounding scenarios is 3.4 m Optimistic Grounding
No cryogenic damages to crew Optimistic Collision, grounding and contact
High probability (0.8) of no pool fire in the event of LNG leakage Optimistic Collision, grounding and contact

However, upon further evaluation of the various assump- areas of the analysis there have been sufficient statistical
tions, it is believed that the net effect tends to be data available to draw meaningful conclusions, whereas in
conservative, and it is believed that the overall results are other areas no sources of information have been available.
more likely to be conservative than optimistic. Hence, the In the latter areas, quantitative estimates have been based
risk analysis presented in this paper might be regarded as on qualitative considerations and expert judgement,
somewhat conservative. Table 7 lists some of the assump- although it is acknowledged that this is generally associated
tions made in this study that might be conservative or with a certain degree of subjectivity [27]. However, this risk
optimistic. analysis is modular by design and, if new knowledge
All in all, there are a number of uncertainties associated becomes available in any area, it should be rather straight-
with this study, and improvements in any areas would forward to replace or update relevant modules accordingly.
always be favourable. It is also emphasized that a generic It is therefore recommended that such amendments to the
FSA such as this should be considered as an on-going risk models should be made when appropriate.
process where the results are continuously updated Uncertainties have been particularly salient in some
according to new knowledge, developments in technology, areas of this analysis, and it is suggested that further
environment and trading patterns, refinements of under- studies should be carried out in order to bridge the gaps in
lying assumptions, etc. Nevertheless, in spite of the fundamental knowledge and available statistics pertaining
subjectivity and inherit uncertainties, on a high level, the to hazards and risks related to LNG shipping. These are in
results from the current study are believed to be meaningful most cases represented towards the right-hand side of the
and robust for the world fleet of LNG carriers. event trees, describing events in the later stages of a
Even though the risk assessment presented in this paper scenario. In particular, it is suggested that further studies
is believed to be based on the best available information, related to the following parts of the risk model are
approaches and estimates, parts of the study should initiated: LNG hazard model, damage extent models,
undoubtedly be regarded as somewhat subjective. In some survivability model, evacuation model and third-party
 ARTICLE IN PRESS
1344 E. Vanem et al. / Reliability Engineering and System Safety 93 (2008) 1328–1344

model. These studies could be in the form of experiments, References

calculations or simulations.
[1] Christensen H, Hensel W, Perez de Lucas A, Sames PC, Skjong R,
Strang T, et al. SAFEDOR—risk-based ship design, operation and
8. Conclusions and recommendations
regulation. In: Proceedings of IMAM 05, 2005.
[2] Scheibach K, Noble P, Broman C. The next generation of large LNG
The overall risk associated with LNG carriers was found carriers. In: Proceedings of the 9th International Marine Design
to be in the ALARP area. Thus, all risks should be made As Conference, 2006.
Low As Reasonable Practicable by implementing any cost- [3] Fang Q, Yang Z, Hu S, Wang J. Formal safety assessment and
application of the navigation simulators for preventing human error
effective risk reduction measures that may be identified.
in ship operations. J Mar Sci Appl 2005;4(3):5–12.
Further work on identifying, selecting and assessing pro- [4] Hu S, Fang Q, Xia H, Xi Y. Formal safety assessment based on
spective risk control options in terms of cost effectiveness is relative risks model in ship navigation. Reliab Eng Syst Saf 2007;
therefore a logical continuation of this risk analysis. These 92(3):369–77.
issues will be addressed in subsequent SAFEDOR tasks. [5] Lee J-O, Yeo I-C, Yang Y-S. A trial application of FSA methodology
to the hatchway watertight integrity of bulk carriers. Mar Struct
Three generic accident scenarios are together responsible
2001;14(6):651–67.
for about 90% of the total risk related to LNG carriers, i.e. [6] Rosqvist T, Tuominen R. Qualification of formal safety assessment:
collision, grounding and contact. These scenarios are an exploratory study. Saf Sci 2004;42(2):99–120.
related in that they all describe a situation where an [7] Soares CG, Teixeira AP. Risk assessment in maritime transportation.
LNG vessel is damaged because of an external impact Reliab Eng Syst Saf 2001;74(3):299–309.
[8] Wang J. The current status and future aspects in formal ship safety
from, e.g., another vessel, floating objects, the sea floor,
assessment. Saf Sci 2001;38(1):19–30.
submerged objects, the quay or other structures. Upon [9] Wang J, Foinikis P. Formal safety assessment of containerships. Mar
closer investigation of the risk models associated with these Policy 2001;25:143–57.
scenarios, four sub-models in particular stand out where [10] IMO. Guidelines for Formal Safety Assessment (FSA) for use in the
further risk reduction could be effective. These are the IMO rule-making process. MSC/Circ.1023-MEPC/Circ.392, IMO,
2002.
accident frequency model, the cargo leakage frequency
[11] IACS. Experience with Formal Safety Assessment at IMO. MSC 78/
model, the survivability model and the evacuation model. 19/1, IMO, 2004.
Therefore, it is recommended that further efforts in the [12] Skjong R. Experience with the use of risk assessment in IMO. In:
next steps of this on-going FSA on LNG carriers focus on Proceedings of the ESREL 2003, 2003.
measures related to: [13] Le Trung B. The game, mem and alarp principles of safety. Rech
Transports Secur 2000;2000(68):48–65.
[14] Melchers RE. On the ALARP approach to risk management. Reliab
 Navigational safety Eng Syst Saf 2001;71(2):201–8.
 Manoeuvrability [15] Skjong R, Vanem E, Endresen Ø. Risk evaluation criteria. SAFE-
 Collision avoidance DOR report D.4.5.2, 2005.
 Cargo protection [16] Norway. Decision parameters including risk acceptance criteria.
MSC 72/16, IMO, 2000.
 Damage stability
[17] Vanem E, Østvik I, Antão P. Risk analysis of LNG tankers.
 Evacuation arrangements. SAFEDOR report D.4.3.2, 2006.
[18] Østvik I, Vanem E, Castello F. HAZID for LNG tankers. SAFE-
The above list should by no means be considered as DOR report D.4.3.1, 2005.
exclusive, and possible cost-effective risk control options [19] Olufsen O, Spouge J, Hovem L. The formal safety assess-
ment methodology applied to the survival capability of passenger
related to, e.g., cargo handling and fire protection should ships. In: Proceedings of the RINA Passenger Ship Conference 2003,
also be investigated. However, it is believed that the most 2003.
cost-effective risk control options will be those addressing [20] Skjong R, Vanem E. Damage stability evaluation in collision of bulk
the high-risk areas identified in this risk analysis. carriers. In: Proceedings of the ICCGS 2004, 2004.
[21] Denmark, Germany, Norway, United Kingdom. Updated statistics
for extent of damage—report from the research project HARDER.
Acknowledgements SLF 44/INF.11, IMO, 2001.
[22] Laubenstein L, Mains C, Jost A, Tagg R, Bjørneboe NK. In:
The work reported in this paper has been carried out Proceedings of the ICCGS 2001, 2001.
under the SAFEDOR project, IP-516278, with partial [23] Apostolos P, Eleftheria E, Aimilia A, Seref A, Cantekin T, Severion
funding from the European Commission. The opinions D, et al. Critical review of Aframax tankers incidents. In: Proceedings
of the ENSUS 2005, 2005.
expressed are those of the authors and should not be [24] MCA. MCA Research Project—FSA of shipping—Phase 2—Trial
construed to represent the views of the SAFEDOR application to HSC. Deliverable 9—Summary report. UK: Maritime
partnership or that of DNV, IST, LMG Marin or Navantia. and Coastguard Agency; 1998.
The authors wish to acknowledge valuable contributions [25] Vanem E, Skjong R. Fire and evacuation risk assessment for
passenger ships. In: Proceedings of the Interflam 2004, 2004.
to this study in the form of discussions, expert opinion,
[26] Hansen HL, Nielsen D, Frydenberg M. Occupational accidents
management or general support from the following aboard merchant ships. Occup Environ Med 2002;59:85–91.
individuals: R. Skjong, S. Valsgård and S.E. Jacobsen [27] Skjong R, Wentworth BH. Expert judgement and risk perception. In:
(DNV) and C. Suedes Soares (IST). Proceedings of the ISOPE-2001, 2001.