New Quantitative Risk Criteria for US LNG Facilities

Ellen H. McInerney,a Ryan J. Hart,a Delmar Trey Morrison III,a and Harri K. Kyt
omaab
a
Exponent Inc., 4580 Weaver Parkway, Suite 100, Warrenville, IL 60555; emcinerney@exponent.com (for correspondence)
b
Exponent Inc., Natick, MA
Published online 27 January 2014 in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/prs.11657

The recent increase in natural gas production has

expanded the outlook for exporting domestically produced
natural gas. As a result, many existing liquefied natural gas
(LNG) import facilities in the United States are proposing to
construct liquefaction facilities collocated with existing import
terminals. The Federal Energy Regulatory Commission (FERC)
reviews and approves applications for construction. As part of
this process, the applicant must perform specific hazardous
release consequence analyses to demonstrate flammable
vapor dispersion exclusion zones, thermal radiation exclusion zones, and explosion overpressure exclusion zones to
meet criteria established in 49 CFR 193 and NFPA 59A.
Over the last few years, FERC has refined the risk analysis
criteria for LNG facility construction projects. While the current regulations do not specify quantitative risk assessment
(QRA) as a necessary hazard analysis tool, FERC has
recently issued guidance for the selection of leak sizes based
upon failure frequencies for piping systems. In particular,
scenarios with failure frequencies greater than 3 3 1025 per
year must be considered. The underlying studies that FERC
relied upon to derive the failure frequency criterion for single
accidental leak source size determination (i.e., 3 3 1025 to
5 3 1025 per year) are largely based on generic industry
data not LNG-specific data. The net result of this criterion
has been to require elements of QRA as part of LNG facility
permitting process to identify the scenarios that need to be
considered and those that do not. This is a shift in the paradigm away from prescriptive leak sizes and single accidental
release scenarios that had been used for receiving terminals
constructed over the last decade.
This shift in paradigm coincides with and was likely motivated by the North American transition from receiving terminals to liquefaction export terminals. Receiving terminals are
considerably simpler in their design than export terminals,
which require refrigeration units to liquefy the gas. This article aims to provide an analysis and discussion of the FERC
failure frequency arguments grounded in the strength and
weaknesses of the underlying databases. An open question is
whether this new criterion provides a reasonable improvement in safety over the prior requirements. The underlying
historic databases and studies do not reflect the major differences on the safety records between the LNG industry and
general industry. More specifically, they do not necessarily
take into consideration the effects of cryogenic processes,
management systems, materials of construction, or failure
This paper has been revised but was originally presented in the
47th annual Loss Prevention Symposium at the 9th Global Congress
on Process Safety in San Antonio, Texas, April 28 to May 1, 2013.
C 2014 American Institute of Chemical Engineers
V

Process Safety Progress (Vol.33, No.3)

modes on the failure rate data. Given the basis of generic

industry failure rates, the question arises as to whether the
failure rate thresholds that trigger the requirement to consider
C 2014 American Institute of
certain scenarios are appropriate. V
Chemical Engineers Process Saf Prog 33: 237246, 2014

Keywords: quantitative risk assessment; liquefied natural

gas; failure rate
INTRODUCTION

Many US liquefied natural gas (LNG) import facilities

were proposed during the early 2000s in anticipation of the
need to import natural gas; and some of those facilities were
built over the past decade. However, the anticipated natural
gas import demand did not materialize. The recent increase
in domestic natural gas production from nonconventional
sources has reversed the expected import trend and become
a driver for exporting domestically produced natural gas. As
a consequence, many existing import facilities are proposing
to construct liquefaction facilities collocated with existing
import terminals, and new export only projects are also
being proposed [1]. Figure 1 is a graphic provided by the
Federal Energy Regulatory Commission (FERC), which illustrates locations and identifies the existing and proposed
North American LNG facilities.
Hazards of LNG
LNG is processed and conveyed through piping systems
as a cryogenic liquid at temperatures of approximately 260 F
and moderate to high pressures (e.g., 50 psig up to 1000
psig) depending upon the location in the liquefaction or
vaporization process. Import facilities unload LNG from
marine tanker ships, store LNG in insulated atmospheric storage tanks, then vaporize LNG to supply to natural gas pipelines. Export facilities take natural gas in the opposite
direction. Facilities refrigerate natural gas to liquefy it, store
it, and then load the liquid onto marine tanker ships. The
large-scale cryogenic refrigeration process (liquefaction) units
typically contain large inventories of flammable pressurized
liquid and/or cryogenic refrigerants. These may be present
in the liquefaction units at very low temperatures and moderate to high pressures. Depending upon the type of refrigeration process employed, refrigerants may include ethylene,
propane, butane, pentane, and higher molecular weight
hydrocarbons, or they may be mixed in unique combinations
to produce a mixed refrigerant [2]. A loss of containment
(LOC) of LNG or flammable refrigerant liquids may lead to
pressurized jetting and flashing, liquid sprays, and liquid
spills. Flammable vapor cloud formation due to evaporation
and the subsequent dispersion of the cloud away from the
release source pose significant hazards to be considered in
the siting of process equipment and buildings at the facility.
September 2014

237

Figure 1. Summary of proposed and potential LNG terminals in North America, provided by the United States Department of
Energy FERC [1]. [Color figure can be viewed in the online issue, which is available at wileyonlinelibrary.com.]

The principal hazards of LOC of refrigerant or LNG relate

to flammable vapor cloud formation and dispersion, flammability of the cloud, radiant heat flux from pool fires, flash
fires, and damaging overpressures due to ignition of a flammable vapor cloud that exists in a congested or confined
portion of the facility. The most hazardous scenarios to consider are those that produce large, high momentum flammable vapor clouds (as opposed to flammable liquid pools in
conveyance and impoundment systems, which produce only
wind-driven vapor clouds). For LNG and refrigerants, these
clouds consist of cold, dense vapor that disperses near the
surface of the terrain in the direction of the prevailing wind.
The location of existing or new proposed facilities and
the liquefaction, vaporization, storage, and transfer systems
on a plant site must be considered in relation to the potential
hazards posed by the processes [3]. This evaluation process
is termed as facility siting, and the general intent is to limit
or reduce the risk to on-site and off-site populations (i.e.,
on-site workers, neighboring facilities, and the general public) to the hazards if a LOC incident occurs. Existing LNG
regulations only address prescribed off-site consequences
and will be discussed in detail below. Two alternative methods of evaluating the risk posed by processes at a facility
include (1) the use of prescriptive requirements in standards
and (2) risk-based analysis [4]. US regulations and safety
standards for on-shore LNG terminals impose a prescriptive
methodology for defining and evaluating hazard scenarios to
satisfy the requirements of the authority having jurisdiction
(in this case, FERC as discussed below). In many ways, this
is a different approach than traditional risk-based analyses
such as Quantitative Risk Assessment (QRA). However, in
the current US regulatory environment governing LNG facilities, there has been a gradual shift toward alignment of the
traditional prescriptive requirements with risk-based concepts. One reason is likely the significant increase in complexity of liquefaction trains compared to import terminals
238

September 2014

Published on behalf of the AIChE

Figure 2. Example of IR contours overlaid on a facility map.

[Color figure can be viewed in the online issue, which is
available at wileyonlinelibrary.com.]

that were being developed in the mid 2000s. This topic is

discussed further in this article by evaluating the current regulatory requirements for hazard scenario selection and comparing it to traditional QRA selection methods.
US REGULATIONS FOR LNG FACILITIES

Currently, LNG facilities involved in interstate or international commerce must comply with US Federal regulations
DOI 10.1002/prs

Process Safety Progress (Vol.33, No.3)

in regards to facility siting considerations [5, 6]. Capital projects must undergo a review and approval process to receive
construction authorization for new operations, facilities, or
infrastructure. The process is regulated by the FERC, an
agency which ultimately authorizes construction and operation. As part of the process, facilities must demonstrate that
they comply with Federal safety standards for LNG facilities
that have been promulgated by the Pipeline and Hazardous
Materials Administration, part of the US Department of Transportation (DOT), according to Title 49 of the Code of Federal
Regulations (CFR)Part 193. Facility owners will document
and communicate the results of site safety analyses through
Resource Report 11 and Resource Report 13, which are submitted to FERC as part of the environmental review process.
More detail on the substance of these reports is provided in
Ref. [7].
The CFR provides broad requirements for safety and
incorporates NFPA 59A (2001) [8], by reference to supplemental technical requirements (see [5], part 193.2051). It
should be noted that most of the CFR references the 2001
edition of NFPA 59A. Facility siting analyses required by the
regulations are focused on the concept of an exclusion
zone. An exclusion zone is defined as an area surrounding
an LNG facility in which an operator or government agency
legally controls all activities. . . (see [5], part 193.2007). Flammable vapor dispersion distances due to LOC (e.g., spills,
ruptures, and leaks) must not yield vapor clouds with a natural gas (typically considered as methane) concentration in air
of greater than 2.5% that pass beyond the facilitys exclusion
zone (see [5], part 193.2059). Natural gas is not pure methane; and assuming that it usually provides conservatively
larger vapor clouds.
NFPA 59A (2001) requires that the 50% LFL cloud from
LNG spills be confined to the property in accordance with
2.2.3.3. However, as will be discussed in the following section, liquid spills into the trenches which flow to the main
impounding area and the main impounding area itself typically do not cause the worst case flammable vapor clouds.
NFPA 59A (2001) provides an additional, more broadly stated
criterion for the flammable vapor dispersion distance due to
a design spill by stating the following in 2.2.3.4:
Provisions shall be made to minimize the possibility of a
flammable mixture of vapors from a design spill specified in
2.2.3.5, as appropriate, reaching a property line that can be
built upon and that would result in a distinct hazard.
This distinct hazard is not specific and provides a catchall requirement. Although the regulations prescribe a boundary for the potential hazard50% LFL cannot cross the
property line that can be built uponthey do not prescribe
all of the scenarios that must be considered to generate a
flammable vapor source term. In the context of typical risk
analyses, accidental release scenarios may be identified by a
hazard analysis team or experts according to process hazard
analysis (PHA) techniques, standard sets of scenarios for a
given type of unit/operation, or through other routes. PHA
techniques include Fault Tree Analysis, Hazard Identification
(HAZID), Hazard and Operability (HAZOP) study, and/or
What-if to identify the potential hazard scenarios. These are
typical expert- or team-driven hazard analysis techniques
that are used to develop scenarios for consideration through
formal QRA. In practice, PHA techniques may identify singleevent failures (e.g., leak from a flange, pipe rupture, or operator error) or they may describe more complex failures
including cascading or knock-on type events. The LNG regulations only explicitly consider single-event failures, that is,
single accidental leakage sources. This would seem to simplify the set of analyses that must be considered through the
regulatory facility siting process; but that is not the case, as
the following sections will discuss.
Process Safety Progress (Vol.33, No.3)

QUANTITATIVE RISK ASSESSMENT

QRA is a valuable technical risk assessment method for

understanding the risks associated with industrial processes.
QRA is widely used in many industries. International regulations commonly require QRA as a component in the
decision-making process for siting of industrial facilities [9].
QRA is not commonly a required element of US regulations;
EPAs Risk Management Program (RMP) defines a single
worst-case scenario (and an alternative release scenario for
RMP Program 2 and 3 sites) used for regulatory permitting
[10]. In contrast, OSHAs Process Safety Management
standard only requires that one of many appropriate PHAs
be performed on qualifying processes.
The European Standard EN-1473: Installation and
equipment for LNGDesign of onshore installations provides guidance for performing QRAs at LNG facilities [11],
but the standard is not enforceable in the United States.
The standard provides details on selecting hazard scenarios,
assigning probability, and quantifying the risk associated
with various releases. Further, the consequences are
considered for both on-site and off-site property and
personnel.
NFPA 59A (2013) includes a new chapter on applying risk
assessment for LNG plant siting [12]. However, the risk
assessment guidelines are provided as an alternative to the
existing facility siting requirements. Furthermore, the objective of NFPA 59A (2013) risk assessment guidance is to assess
the risks posed outside of the LNG facility boundaries by
releases of LNG or other hazardous substances stored or
processed on site. The standard cites several references for
performing QRAs and provides general QRA guidelines,
including an Example Component Failure Database. However, the standard does not provide a reference for the listed
failure probabilities (only references where complementary
data may be retrieved).
QRA is an analytical process that systematically evaluates
LOC scenarios, their hazardous consequences, and the risk
of injury or fatality posed by the scenarios. The risk is calculated as the likelihood of injury on an individual risk (IR)
and societal risk (SR) basis. IR is the frequency per year that
an individual with continuous potential exposure may be
expected to sustain a serious or fatal injury (see [13], p. 408).
SR is the cumulative risk to all persons in a population sustaining a serious or fatal injury (see [13], p. 433). IR is typically presented as contours of constant IR values, for
example, 1 3 1025/yr likelihood of fatality. Figure 2 shows
an example of such a rendering that can be used to evaluate
the risk to surrounding individuals. SR is typically depicted
on an F-N curve, comparing the frequency of fatality (F) to
the number of fatalities to be expected (N). A comparison of
the tolerance criteria for SR is provided in Figure 3. As part
of the QRA, each individual scenario outcome would be
compared against the tolerance criteria presented by the
authority having jurisdiction.
The risk, as determined by QRA, is a result of the individual scenarios that are evaluated. However, it is conceivable
that analyzing the risks for any given facility could be a
never-ending task if guidance for selecting scenarios is not
provided. The first cut at reducing scenarios to a manageable
and representative set is to remove duplicates and low-risk
processes. For example, a facility may have several identical
process units; thus, they do not pose distinctly different hazard scenarios. A facility may also have specific process units
that are of much lower hazard in terms of off-site populations, such as an on-site power plant or water treatment
plant. These also may not be included in the selection of
units to study due to the lower risk posed by them. A company or the authority having jurisdiction may have guidelines
for what process units and types of LOC events must be

Published on behalf of the AIChE

DOI 10.1002/prs

September 2014

239

considered that are based upon the nature of the chemical,

process conditions, or type of process.
Once the types of LOC scenarios and the process units are
decided, the detailed analysis of the release events is performed. The risk, as identified on the F-N or IR contours, is
composed of the likelihood of the severe outcome (here taken
as fatality) versus the size of the population who are affected.
Determination of the scenarios requires a complementary
analysis of the frequency (e.g., rate or probability) of the type
of equipment failure along with the size/type of the LOC
event. NFPA 59A (2013) provides a table illustrating example
failure rates, see Table 1 which has been condensed to include
only the aboveground piping and components [12]. It should
be noted that the annual probability of failure provided for
aboveground piping is not reported as a function of pipe
length; thus, it is unclear whether such a probability should be
applied to an individual section of piping, the piping in a process unit, or all piping at the facility. Additionally, the standard
does not reference the exact source of the failure rate data and
simply provides other resources containing complementary
data. Although there are several industry failure rate databases,
none of the databases are specific to the LNG or cryogenic liquid industries. The existing databases will be further explored
in subsequent sections.

upon NFPA 59A (2001), which is a prescriptive standard.

NFPA 59A (2001) 2.2.3.5 identifies single accidental leakage
scenarios based solely upon the LNG storage tank and not
other associated processes. These are referred to as design
spills in the standard. The design spills are defined as the
largest flow rate (of LNG) from any single line that could be
pumped when the LNG storage tanks pumps are considered
to be delivering the full rated capacity. This could mean that
the maximum flow rate for a series of in-tank transfer pumps
through an open line should be analyzed. In practice, this
yields a liquid spill, which will produce a well-defined vapor
cloud based on evaporation in trenches and the main
impounding area.
Over the last few years, FERC has developed and refined
its requirements for design spills. In 2005, FERC with affirmation from the US DOT defined the single accidental leakage
source (not including the LNG tank fill lines) to include consideration of all small diameter piping connections such as
take-off lines, instrumentation taps, flanges, and valve packing [14]. FERC has employed interpretations, letters, and
engineering data requests to refine the specified criteria for
selecting release scenarios. In 2012, FERC provided a quantitative justification for selection of a consistent set of design
spills [6, 15]. Currently, FERC requires selection of release
scenarios based upon analysis of the proposed piping sizes,
piping lengths, and vessels on-site. FERC has developed a
basis for selecting these scenarios that is ostensibly based on
LNG plant failure data. The May 7, 2012 memo stated that
based on published failure rates for LNG facilities, the rupture of a storage tank outlet line is on the order of one failure every 20,00030,000 years (5 3 10243 3 1024 failures
per year) [15]. This criterion serves as the basis for selecting
single accidental leakage scenarios.
In the memo, FERC provided a table containing piping
and equipment failure rates, which is partially reproduced in
Table 2 and 3. In the case of piping failure rates, the data
are based on the likelihood of failure per unit length of piping. This type of failure rate value is commonly used in riskbased analyses for facility siting. It should be noted that the
failure rates of piping do not exactly match the cited references (specifically the Failure Rate and Event Data (FRED) provided by the Health and Safety Executive) [25]. Apparently,
FERC has applied some judgment to create the table.
A flow diagram illustrating the application of the failure
rate guidance is provided in Figure 4. The process area piping systems are first catalogued to identify distinct sections of
piping and describe their length and diameter. The available
guidance does not provide direction on distinguishing the
boundaries of a given system of piping. For example, automatic closing valves or check valves may be used to define
distinct sections of lines for a given analysis; however, FERC
must ultimately approve the selection of system boundaries

FERC SINGLE ACCIDENTAL LEAKAGE SOURCE CRITERIA

49 CFR Part 193 does not explicitly define the set of single
accidental leakage scenarios to consider even though it relies

Figure 3. Societal risk tolerance criteria for different international jurisdictions. The frequency of fatality (F) is shown on
the vertical axis, and the number of fatalities (N) is shown on
the horizontal axis. Reproduced from NFPA59A (2013) [12].

Table 1. Selected entries in NFPA 59A (2013) table describing failure rate data for various aboveground piping and components in LNG facilities [12].
Aboveground Piping and Component Failure Type

Annual Probability of Failure

Rupture for nominal diameter < 75mm

Rupture for 75mm < nominal diameter < 150 mm
Rupture for nominal diameter > 150 mm
Pressure relief valvesoutflow at max. rate
Pumpscatastrophic failure
Compressors with gasketcatastrophic failure
Heat Exchangerinstantaneous release of entire
contents from plate heat exchanger
Transfer equipmentrupture of loading/unloading arm

240

September 2014

Published on behalf of the AIChE

Mean Time between Failures

1026
1027
1027
1025
1024
1024
1025

1,000,000
3,000,000
1,000,000
50,000
10,000
10,000
20,000

3 3 1028

30,000,000

1
3
1
2
1
1
5

3
3
3
3
3
3
3

DOI 10.1002/prs

Process Safety Progress (Vol.33, No.3)

Table 2. Nominal FERC failure rates for storage tanks and piping [15]
Type of Failure
Cryogenic Storage Tanks (General)
Piping (General)

Description

FERC Nominal Failure Rate

Rupture of storage tank outlet/withdrawal line

Rupture at valve
Rupture at expansion joint
Failure of gasket

3 3 1024 /yr (Failure Rate Criterion)

9 3 1026 /yr per valve
4 3 1023 /yr per expansion joint
3 3 1022 /yr per gasket

Table 3. Nominal FERC failure rates per unit length for piping [15]
Failure Likelihood (Failures/yr/m)
Pipe Diameter

Catastrophic
Rupture

dhole 5 1/3
dpipe

dhole 5 10% dpipe,

up to 50 mm (2-inch)

dhole 5 25 mm
(1-inch)

dpipe < 50 mm (2-inch)

50 mm (2-inch) < dpipe < 149 mm (6-inch)
150 mm (6-inch) < dpipe < 299 mm (12-inch)
300 mm (12-inch) < dpipe < 499 mm (20-inch)
500 mm (20-inch) < dpipe < 1000 mm (40-inch)

10 3 1027
5 3 1027
2 3 1027
0.7 3 1027
0.2 3 1027

4 3 1027
2 3 1027
1 3 1027

4 3 1027
2 3 1027

50 3 1027
20 3 1027
7 3 1027
5 3 1027
4 3 1027

Figure 4. Flowchart for determining if a scenario should be

analyzed. [Color figure can be viewed in the online issue,
which is available at wileyonlinelibrary.com.]

in the analysis. In past submissions to FERC, applicants have

successfully argued that the system boundaries will span sections of piping with constant diameter. For example, a 3-inch
diameter pipe may be considered to be a distinct section
from its origination at a larger pipe and termination at a
vessel.
Figure 5 shows an example calculation for a distinct section of LNG piping. In the example, the 328-feet long, 8-inch
diameter pipe passes the criterion for catastrophic rupture
but not for a 1/3 diameter hole or 1-inch hole. Given the
nature of the LNG and refrigeration processes, FERC requires
analysis for each of the two latter cases because the characteristics of a pressurized release may change from a liquid
spill to a two-phase liquid rain-out to a pressurized flashing
jet depending upon the hole size and process conditions.
Process Safety Progress (Vol.33, No.3)

Figure 5. Example failure rate calculation.

Each case may give a different flammable vapor hazard

boundary.
Typical QRA approaches provide guidance on release scenarios to be considered and strictly define the allowable consequence. The consequence may apply to both on-site and
off-site properties, which intimately links the release scenario
to the consequence. For example, when examining the risk
of a particular release scenario using FERC guidelines it may
be determined that the 1=2-LFL flammable cloud approaches
the property boundary but does not pass the boundary. The
risk according to FERC is, therefore, acceptable. But when
examining the same type of release using a QRA approach,
it may be found that although the 1=2-LFL does stay within
the boundary, the consequence from ignition of the flammable cloud may or may not be considered acceptable depending on the nearby structures, their intended use and the
intensity of the resulting fire. Additionally, the QRA approach
results in consideration of all potential release scenarios

Published on behalf of the AIChE

DOI 10.1002/prs

September 2014

241

Table 4. Summary of selected piping system failure rate data.

Failure Rate
(per meter per year)

Pipe Diameter

Definition of Failure

Welker (1979)
Welker and Johnson (1981)

3 3 1024
2 3 1024

Pelto et al. (1982)

2 3 1027

>300

1 3 1027
0.4 3 1027
1 3 1027
5 3 1027
0.9 3 1027
0.2 3 1027

>300
2000 < d < 4000
>600
N/A for large diameter
>600
20 < d < 4000

Major and minor failures

Major and minor failures
combined w/Welker (1979)
Pipe rupture (single component)
Section 5 100 ft, t 5 20 days/yr
Pipe rupture (single component)
Guillotine/catastrophic rupture
Full bore rupture
Rupture and leakage
Catastrophic rupture
Catastrophic rupture

Source

USNRC (1975)
FRED (2010)
RIVM Purple Book (2005)
Bevi (2009)
COVO (1981)
FERC (2012)

given a defined failureliquid pool, two-phase liquid rainout, or pressurized flashing jet. Each of these releases has a
unique consequence associated with ignition of the flammable cloud, dependent on the size and shape of the cloud as
well as the fuel characteristics. This relationship between
release characteristics and consequence is not captured using
the FERC prescription.
There are no explicit on-site or off-site population injury
or fatality considerations mentioned in the 49CFR193 or
NFPA 59A for ignition of a flammable vapor cloud. In contrast to ignition of liquid spills in impounding areas (see [8]
2.2.3.2), there is no requirement for evaluating the radiant
heat flux from a natural gas or refrigerant vapor cloud flash
fire. Thus, the regulatory approach does not consider the
risks in the same manner as a standard QRA.

FERC provided a table of failure rates to use in identifying

single accidental leakage scenarios and a citation list of piping failure rate studies. FERC has stated that the guidance is
based on published failure rates for LNG facilities [15].
However, the underlying studies that FERC relied upon to
derive the threshold failure frequency criteria for LNG facilities for single accidental leak source size determination (i.e.,
3 3 10245 3 1024 per year) are largely based on generic
industry data not LNG-specific data [1625]. Since historical
data of LNG failure events are very rare, there is a lack of
available historical data within the industry. Therefore, FERC
cites generic failure rate databases, which cannot be easily
traced back to the original data sources used to create the
databases, and it remains unclear as to how the failure frequencies were derived. For the cases where evidence supporting the failure rates can be established, the studies often
refer to historical data from other industries in the 1970s
1980s. These studies and databases typically analyzed a small
number of failures, systems, and equipment which may differ
from modern LNG facility design. For example, one of the
key sources is the US Nuclear Regulatory Commission
(USNRC) reactor safety study, which analyzes nuclear industry data. The underlying historic databases and studies do
not necessarily reveal the effects of process conditions, management systems, maintenance and inspection practices, construction materials, or failure modes on the failure rate data.
Generic failure rate data may be called upon as the basis
for estimating the likelihood of various LOC events at LNG
facilities during risk assessments. Generic failure rates used
in risk assessment are derived from various sources of available component failure rates and historical data. When averaging failure frequencies of similar components from other
industries, this generic data is not always entirely applicable
for LNG facilities while some components of LNG facilities

do not have generic counterparts in other industries. For

example, stainless steel fully welded, vacuum insulated piping is not as common as Schedule 80 mild carbon steel piping in the process industries; thus, the question arises as to
whether the same failure rates should apply. Since the frequencies are generic and the data is frequently used outside
of the context for which it was originally collected, the data
is only an approximation for any site-specific application.
Even for LNG components with similar generic counterparts
in other industries, such as the nuclear and chemical processing industries, the available historical data is often limited
to derive failure rates with any degree of confidence.
Although such historical system operating data can be used
to estimate the frequency of future failures, the limited operating history of LNG facilities and the small number of incidents is insufficient to establish meaningful failure rate
information.
In the absence of failure rate data specific to a particular
facility or industry, the generic values determined are used
as a starting point and can be further modified by expert
judgment to account for site-specific and industry-specific
factors. Reportedly, generic failure frequencies based on real
historical data were blended with earlier sources, whose origins are now practically untraceable and difficult to validate.
The current FERC-established failure frequencies for LNG
facilities tend to be based on outdated, generic data sources
of unknown origin, which further creates uncertainty in
application and adaptation of such data to modern LNG
facilities. Uncertainty also arises from imprecision of using
engineering judgment rather than raw data, which subjectively chooses the component failure rate data.
Table 4 and 5 present the failure rate data from FERCcited sources that FERC appeared to rely upon to derive the
threshold failure frequency criteria for LNG facilities. Existing
failure rate data appear in a multitude of sources including
those cited by FERC and other referenced industry databases
[1640]. A sampling of relevant data to LNG facilities is summarized below.
USNRC pipe rupture failure rate assessed is based on
nuclear experience for pipes over 3-inches in diameter,
where a section is defined as an average length between
major discontinuities, such as valves, pumps, etc. (10100
feet). Given the range for the length of a pipe section,
nuclear experience also suggested a range of failure
frequency.
FERC established a criterion of 3 3 10255 3 1025 failures per year (yr21) as the tolerable limit for selecting an
individual pipe segment for release scenario consequence
analysis. Although FERC provided a list of references, they
did not cite a source for these values. Based on a review of
the references, this target value range was apparently drawn

242

DOI 10.1002/prs

DISCUSSION OF FAILURE RATES AND DATABASES

September 2014

Published on behalf of the AIChE

Process Safety Progress (Vol.33, No.3)

Table 5. Summary of failure rate data for nuclear facilities.

Source
Pelto et al. (1982)

Pelto and baker (1984)

Failure Rate (per year)

Definition of Failure

25

(FERC upper bound)

7 3 1027
9 3 1024
1 3 1025
4 3 1023
3 3 1025 (FERC lower bound)

5 3 10

Rupture of tank outlet (fault tree)

Pipe rupture (excluding expansion joint)
Operating 365 days/yr (fault tree)
Operating 365 days/yr (single component)
Operating 365 days/yr (FERC criteria-component)
Rupture of tank outlet

Figure 7. Fault tree representing release from an LNG storage tank outlet line.
Figure 6. Sketch of system that Pelto and Baker (1984) used
for the Fault Tree Analysis.

from two technical articles authored by Pelto et al. (1982)

and Pelto and Baker (1984) [1625]. The first article focused
on LNG peakshaving facilities and the effects of release prevention systems. The second article broadened the analysis
to address LNG import and export facilities as well.
Pelto et al. (1982) provided a detailed failure analysis of
several different systems at an LNG peakshaving facility by
applying fault tree analysis. Their objective was to calculate
the likelihood of an LNG release both with and without mitigation by safety shutdown systems. The likelihood of an
unmitigated release due to full guillotine rupture from the
model storage tank outlet line was found to be 5 3 1025 per
year. In Pelto and Baker (1984), the authors provided the
results of fault tree analyses of systems at import and export
facilities, where they listed a likelihood value of 3 3 1025
events per year for rupture of a storage tank outlet line. The
authors did not provide the underlying basis or fault tree
analysis supporting this value; however, the similarity to the
calculated failure rate from the detailed Pelto et al. (1982)
paper supports an inference that a similar approach was
used to calculate the new value (Figure 6).
The detailed Pelto et al. (1982) paper provided a design
basis for the LNG storage tank outlet system that the authors
analyzed. The authors assumed that a 12-inch diameter storage tank outlet line exited through the bottom of the inner
storage tank and that the line only operated 20 days (or 480
h) per year. The operational time was based on the assumption of intermittent transfer of LNG in a peakshaving facility.
Their analysis for a bottom outlet tank also called for an
expansion joint and an outlet valve as depicted in the sketch
in Figure 8. The unmitigated release scenario called for a full
guillotine rupture of the line and a spill rate of 28,000 gallons
per minute. The paper did not provide analysis of the consequences of either the mitigated or unmitigated release.
The likelihood of a large release of LNG from a storage
tank outlet line was estimated by Pelto et al. (1982) using
Process Safety Progress (Vol.33, No.3)

Figure 8. Fault Tree Analysis from Pelto et al. (1982) representing release from an LNG storage tank outlet line. [Color
figure can be viewed in the online issue, which is available
at wileyonlinelibrary.com.]

fault tree analysis. The Pelto et al. (1982) study provides the
underlying fault trees; thus, the design basis can be further
discussed. The likelihood was estimated by summing the failure frequency of three basic events: outlet line (i.e., pipe)
rupture, outlet line expansion joint rupture, and outlet line
block valve rupture. The fault tree is depicted in Figure 7.

Published on behalf of the AIChE

DOI 10.1002/prs

September 2014

243

Table 6. Pelto et al. (1982) component failure rates.

Component

Component Failure Frequency

210

21

1 3 10
hr per section
1 3 1027 hr21 per joint
1 3 1029 hr21 per valve

Pipe, F1
Expansion Joint, F2
Valve, F3

Source [1640]
USNRC 1975
Welker 1976, SAI 1975
USNRC 1975, Welker 1979

Table 7. Pelto et al. (1982) annual system failure rates.

Component

Quantity

Component Failure Frequency

Total Component Failure Frequency

5
1
1

8.8 3 1027 yr21 per section

8.8 3 1024 yr21 per joint
8.8 3 1026 yr21 per valve

4.4 3 1026 yr21

8.8 3 1024 yr21
8.8 3 1026 yr21
9 3 1024 yr21

Pipe, F1
Expansion Joint, F2
Valve, F3
Top Event Failure Rate, Ftop

The likelihood of the top event is the aggregate of the likelihood values for each basic event that feeds the OR gate.

Given their assumptions, Pelto et al. (1982) estimated that

the outlet line will rupture about 5 3 1025 times per year, which
corresponds to the upper bound of FERCs threshold failure
rate criterion. As a comparison, Welker and Johnson provided a
summary of LNG industry failure rates in 1981 based on an
industry survey [18]. For cryogenic piping, they reported a
Mean Time Between Failures of 582 3 106 foot-hours, which is
equivalent to a nominal failure rate of 5 3 1025 m21 yr21. The

corresponding failure rate for an equivalent 100-feet length

pipe to the Pelto et al. case would be 2 3 1023 yr21.
The original Pelto et al. (1982) failure rate derivations
included an operational duty cycle adjustment factor. The
peakshaver storage tank LNG outlet line analysis explicitly
identified this factor as an assumption of 20 days per year
for operation. This leads to a duty cycle factor of 0.055.
Although the 1984 paper does not provide the fault tree
details, it can be inferred that the duty cycle factor of 0.034
(i.e., 12 days per year) was applied to that case.
Given their assumptions, the authors estimated that the
outlet line will rupture about 5.0 3 1025 times per year,
which corresponds to the upper bound of FERCs failure rate
criterion. The authors couched their analysis and conclusions
with the following reasonable evaluation:
Unfortunately, the operating history of LNG tanks is too
short to provide meaningful failure information. These tanks
are unique to the point that generic data for other lowpressure storage tanks is not entirely applicable; however, we
were able to make some comparisons with this information.
Based on the information available, large releases from LNG
storage tanks are estimated to occur about 1025 per year.
The failure frequency is based on fault tree analysis combining the chance of three basic events: outlet line rupture,
outlet line expansion joint rupture, and outlet line block
valve rupture. Of the basic events, the frequency of outlet
expansion joint rupture of 4.8 3 1025 failures per year was
dominant in the calculations, which is two orders of magnitude higher than the failure frequency of either outlet line
rupture or outlet valve rupture. The failure frequency of a
single component outlet line rupture is 2.4 3 1027 failures
per year (per five sections of piping or assuming approximately 100 feet), which converts to 7.9 3 1029 failures per
meter of piping per year. LNG import/export terminal facilities, unlike peak shaving facilities, do not contain the relatively lower reliability expansion joints in their design.
The source database for Pelto and Bakers failure frequency of outlet line rupture was derived from the rupture
of a pipe section greater than 3 in diameter according to
nuclear industry historical data. The failure frequency of
expansion joint rupture was derived in a study by Welker
(1976), where the failure rate ranges from 1.0 3 1025 to 1.0
3 1028 failures per hour. This range of failure rates was also
derived from the USNRC safety study similar to the failure
frequency of outlet line rupture. The concluded failure rate
of 1.0 3 1027 failures per hour was based on the authors
engineering judgment and failure rates of similar equipment.

244

DOI 10.1002/prs

(1)

Ftop 5F1 1F2 1F3

The individual component failure frequencies used by Pelto

et al. (1982) are provided in Table 6 with their sources cited.
The pipe failure frequency value was taken from the WASH1400 study conducted by USNRC [19, 20]. The database
grouped all failures for piping greater than 3-inches in diameter. The failure frequency for expansion joint rupture also
appears to be partly based on the same nuclear industry study
and engineering judgment by the authors. These failure rates
were derived from nuclear industry data not from LNG industry data.
In the analysis, the authors assumed that the design
contained five sections of piping with a total length of
100-feet (520-feet sections), one valve, and one expansion
joint. Table 7 contains the component failure rates and
provides the aggregate annual failure rate estimate for the
system.
Pelto et al. (1982) assumed that the potential for a rupture
of the outlet line causing a release was limited due to intermittent operation of the liquid outlet line. The authors did
not provide a detailed discussion for the basis, but they
assumed that the outlet line was in use for only 20 days per
year. Application of this assumption neglects circulation to
keep the outlet line cold and implicitly assumes that the line
is isolated from the tank. If there is no isolation at the tank,
then the risk of rupture would be present for the entire year.
With the assumed duty cycle of 20 days per year, the top
failure rate is reduced by application of a duty factor, Pduty,
as shown in the below equations.
Pduty 5

20days=yr 324hr=day
50:055
8760hr=yr


FTop
5Pduty FTop 50:055 8:931024 yr

September 2014

(2)


21

5531025 yr 21

(3)

Published on behalf of the AIChE

Process Safety Progress (Vol.33, No.3)

CONCLUSIONS

Several factors can impact the derivation of failure rates

from historical data including inconsistent definitions of
failure, differing criteria for reporting failures, inconsistent
contribution of failure modes, the use of unknown sources
of historical data, and a lack of convincing support for
applied corrective factors and assumptions. Given these
uncertainties, it is difficult to compare failure frequency studies and average failure rates. To account for this imprecision,
estimates of parameters are often developed on a worst
case basis. The combination of the imprecision and the use
of a worst case approach can result in inappropriately conservative statistics.
It can be expected that the failure rates may vary considerably depending on how the failure rate is defined. Studies
of historical data often define failure differently. Some studies characterize a failure as a shutdown of operations that
was not accompanied by a liquid spill or gas leak. Other
studies do not clearly distinguish to what extent potential
failures were taken into account, including defects found
during visual inspections and nondestructive testing. It
should be noted that potential failures do not necessarily
lead to a release, and if appropriate action is taken to reveal
such defects prior to a LOC event, future releases can be
prevented.
Failure frequency data is often reported as being independent of differences in inspection and maintenance practices, quality of management, age of construction,
operational parameters, and design specifications where historical data is derived from compiling all available reported
incidents from various facilities regardless of site conditions
and modes of failure. Since these parameters are expected to
vary considerably among sites and industries, the failure rates
are likewise expected to differ. Furthermore, since the
derived failure frequency and studies are outdated and the
data does not account for changes in design, maintenance,
operation, and management practices, improvements would
reduce the likelihood of LOC events for modern LNG
facilities.
Studies suggest that a potential risk correction factor can
be applied to the base failure rate data for site-specific cases
where the magnitude of the correction factor depends on
inspection and scheduled maintenance frequency, construction materials, and process conditions. Studies indicate that
the failure rate may frequently vary by a factor of 10 or more
between individual LNG facilities, which is not an uncommon feature of failure analysis studies. Nevertheless, failure
frequency studies available need to provide a better understanding of the actual failure data and the underlying
assumptions because site-specific modification factors for
release frequencies should not be applied unless the relation
is known to the original data to which the modification is
made, which is not well-defined.
The accuracy of any QRA is dependent on the quality of
the historical data and expert judgment from which the failure rates are derived, and therefore, failure data needs to be
up-to-date, reliable, and fully justifiable. The derived values
represent outdated studies of historical data and expert judgments at a fixed point in time, which have long-term applications regarding current guidelines. The LNG industry
operates in a continuously changing and evolving environment with respect to technology and regulations, where only
the most recent operating history may be applicable to future
considerations. Therefore, these studies need to be updated
regularly using current data. The Gas Research Institute suggests that the failure rate databases should be periodically
updated at about 5-year intervals according to Welker [18].
Updating the failure frequencies would require an extensive investigation into the original data sources to determine
Process Safety Progress (Vol.33, No.3)

the validity of the data and applicability to current practice.

Since FERCs failure rate criteria are based on confidential
information and several of the sources of failure rates are not
available to the public, it is unclear how these failure frequencies were derived, what the source of the data was, and
what assumptions were made. Unless the data becomes
available, along with justification as to how the failure frequencies were derived, the failure rate criteria cannot be
verified, and therefore, should be cautiously considered
when making decisions regarding facility siting.
The conclusions of our study can be summarized as the
following bullets:
 QRA can be a useful tool for siting new LNG export
terminals.
 The inherent uncertainty that exists with published failure
rate data must be considered when assigning a threshold
failure rate for determining release scenarios to be
considered.
 Based on analysis of the reliable failure rate data for
industrial facilities, the highest degree of certainty that can
be assigned to the failure rate data when applied to LNG
terminals is one order-of-magnitude.
 The FERC failure rate criterion for single accidental
release scenario selection of 3 3 1025531025/yr is not
based on LNG industry data and does not appear to be
representative of LNG system failure rates.
 The FERC failure rate criterion provides a false sense of
confidence in the quantified data, which is not justified
based on generic failure rates.
 Better LNG industry failure rate databases should be
developed and made available to provide useful data for
risk assessment that is verifiable.
 Given the weaknesses and uncertainties of the underlying
data, an order of magnitude approach for scenario selection criteria, for example, 1 3 1024, 1 3 1025, or 1 3
1026/yr should be developed.

LITERATURE CITED

1. North American LNG Import/Export Terminals Proposed/Potential, US Department of Energy Federal

Energy Regulatory Commission, February 21, 2013, Available at <ferc.gov/industries/gas/indus-act/lng.asp>.
2. R.J. Hart, D.R. Morrison, A.F. Ibarreta, and H.K. Kytomaa,
Guidelines for Relative Hazard Ranking of Refrigerants
and Siting Considerations for LNG Liquefaction Units,
2013 Spring National Meeting, 13th Topical Conference
on Gas Utilization, American Institute of Chemical Engineers, San Antonio, TX, April 28May 2, 2013.
3. Center for Chemical Process Safety, Guidelines for Facility Siting and Layout, Center for Chemical Process Safety/
AIChE, 2003.
4. J.L. Woodward and R.M. Pitblado, LNG Risk Based Safety:
Modeling and Consequence Analysis, Wiley, 2010.
5. Liquefied Natural Gas Facilities: Federal Safety Standards.
Code of Federal Regulations Title 49, Pt. 193, 2011
edition.
6. A. Kohout, U.S. Regulatory Framework and Guidance for
Siting Liquefied Natural Gas Facilities A Lifecycle
Approach. Proceedings of Mary Kay OConnor Process
Safety Center, 15th International Symposium, College Station, Texas, October 2325, 2012.
7. Draft Guidance for Filing Resource Reports 11 & 13 for
LNG Facility Applications, Federal Energy Regulatory
Commission, 2005. Resource Report 13: Draft Preferred
Submittal Format Guidance, Federal Energy Regulatory
Commission, 2006.

Published on behalf of the AIChE

DOI 10.1002/prs

September 2014

245

8. NFPA 59A, Standard for the Production, Storage, and

Handling of Liquefied Natural Gas (LNG), 2001 Edition.
9. Guideline for Quantitative Rise Assessment (RIVM Purple
Book), Committee for the Prevention of Disasters (CPR),
National Institute of Public Health and the Environment
(RIVM), December 2005.
10. Chapter 4: Offsite Consequence Analysis, EPA General
Risk Management Program Guidance, April 2004, Available at <www.epa.gov>.
11. EN-1473, Installation and Equipment for Liquefied Natural
Gas Design of Onshore Installations, BSI Standards,
1997.
12. NFPA 59A, Standard for the Production, Storage, and
Handling of Liquefied Natural Gas (LNG), 2013 Edition.
13. Center for Chemical Process Safety, Guidelines for Chemical Process Quantitative Risk Analysis, 2nd Edition, Center for Chemical Process Safety/AIChE, 2000.
14. Interagency correspondence, FERC Document Accession
Nos. 20050615-0175, 20050615-0176, and 20050615-0177,
June 15, 2006.
15. Meeting Summary, Corpus Christi Project, Docket No.
PF12-3-000, LNG Engineering Conference Call, May 7,
2012, FERC Document Accession No. 20120507-4014.
16. NFPA 59A, Standard for the Production, Storage, and
Handling of Liquefied Natural Gas (LNG), 2009 Edition.
17. J.R. Welker and H.P. Schorr, LNG Plant Experience Database, AGA Transmission Conference, New Orleans, May
2123, 1979.
18. J.R. Welker and P.W. Johnson, Development of an
Improved LNG Plant Failure Rate Database, Gas Research
Institute, GRI-80/0093, September 1981.
19. P.J. Pelto, E. G. Baker, T. B. Powers, A. M. Schreiber, J.
M. Hobbs, P. M. Daling, Analysis of LNG Peakshaving
Facility Release Prevention Systems, PNL-4153, Pacific
Northwest Laboratory, Richland, Washington, May 1982.
20. P.J. Pelto and E.G. Baker, Analysis of Liquefied Natural
Gas (LNG) Release Prevention Systems, PNL-SA-12278,
August 1984.
21. K.R. Mniszewski, Fire Protection Planning for LNG Facilities, AGA Distribution Transmission Conference, San
Francisco, CA, May 79, 1984.
22. S. Mannan, Lees Loss Prevention in the Process Industries, Third Edition, Vol. 3, Appendix 14, 2005.
23. Guidelines for Quantitative Rise Assessment (TNO Purple
Book), Committee for the Prevention of Disasters (CPR),
National Institute of Public Health and Environment
(RIVM), The Netherlands Organization for Applied Scientific Research (TNO), December 2005.
24. Reference Manual BEVI Risk Assessments, Version 3.2,
Module C, National Institute of Public Health and Environment, January 2009.
25. Failure Rate and Event Data (FRED) for use within Land
Use Planning Risk Assessments, United Kingdom (UK)
Health and Safety Executive (HSE), 2010.

26. H.I. Beerens, J.G. Post, and P.A. Uijt de Haag, The use of
generic failure frequencies in QRA: The quality and use
of failure frequencies and how to bring them up-to-date,
J Hazard Mater 130 (2006), 265270.
27. S.H. Bush, Statistics of pressure vessel and piping failures, J Pressure Vessel Technol 110 (1988), 225233.
28. COVO Commission, Risk analysis of six potentially hazardous industrial objects in the Rijnmond area, a pilot
study, A report to the Rijnmond public authority, Central
Environmental Control Agency Rijnmond, Schiedam,
1981.
29. R.F. De la Mare, Y.L. Bakouros, and G. Tagaras, Understanding pipeline failures using discriminant analysis: The
North Sea application, Reliab Eng Syst Safe 39 (1993),
7180.
30. N.W. Hurst, L.J. Bellamy, T.A.W. Geyer, and J.A. Astley, A
classification scheme for pipework failures to include
human and sociotechnical errors and their contribution
to pipework failure frequencies, J Hazard Mater 26
(1991), 159186.
31. N. W. Hurst, C. Nussey, and R.P. Pape, Development and
application of a risk assessment tool (RISKAT) in the
health and safety executive, Chem Eng Res Design 67
(1989), 362372.
32. N. W. Hurst, R. K. S. Hankin, J. A. Wilkinson, C. Nussey,
J. C. Williams, Failure Rate and Incident Databases for
Major Hazards, Proceedings of the 7th International Symposium on Loss Prevention and Safety Promotion in the
Process Industry, Taormina, Italy, May 1992.
33. D. Keeley, S. Turner, P. Harper, Management of the UK
HSE failure rate and event data, J Loss Prev Process Ind
24 (2011), 237241.
34. J.H. Pasman, History of Dutch process equipment failure
frequencies and the purple book, J Loss Prev Process Ind
24 (2011), 208213.
35. C.A.G. Phillips and R.G. Warwick, A survey of defects in
pressure vessels built to high standards of construction
and its relevance of nuclear primary circuit envelopes,
UKAEA AHSB R162, 1968.
36. G. Simpson, Review of Failure Rate Data used in Risk
Assessment, Department of Civil and Offshore Engineering, Heriot-Watt University, Edinburgh, September 1993.
37. T.A. Smith and R.G. Warwick, The second survey of
defects in pressure vessels built to high standards of construction and its relevance to nuclear primary circuits,
Safety and Reliability Directorate, SRD R30, 1974.
38. J. Spouge, New generic leak frequencies for process
equipment, Process Safe Prog 24 (2005), 249257.
39. U.S. Nuclear Regulatory Commission (USNRC), Reactor
Safety Study, WASH-1400, Appendix III-Failure Data, 1975.
40. J.R. Welker, L.E. Brown, J.N. Ice, W.E. Martinsen, H.H.
West, Fire Safety Aboard LNG Vessels, Prepared for the
U.S. Coast Guard under Contract No. DOT-CG-42, 355,
1976.

246

DOI 10.1002/prs

September 2014

Published on behalf of the AIChE

Process Safety Progress (Vol.33, No.3)