DET NORSKE VERITAS TM

DET NORSKE VERITAS TM APPENDIX B HAZID REPORT NO./DNV REG NO.: 2013-4091 / 17TLT29-5 REV 1, 11.06.2013

DET NORSKE VERITAS Table of Contents Page 1 BACKGROUND AND SCOPE OF WORK... 2 2 METHODOLOGY... 4 3 PARTICIPANTS... 6 4 SUMMARY OF HAZARDS IDENTIFIED... 6 5 HAZID LOG... 7 6 REFERENCES... 11 Date : 11.06.2013 Page 1 of 12

DET NORSKE VERITAS Conclusion of the review on the 17.05.2013: After review of the HAZID inputs and conclusion delivered on the 18.05.2012, DNV assessed that no update is required as the concept design used as basis for the HAZID has not changed in the detail engineering phase. 1 BACKGROUND AND SCOPE OF WORK A one day HAZID workshop was carried out in June 2011 for the design at that stage of LNG bunkering station in Risavika, ref. /1/. As the design has changed considerably since then, an update of the HAZID was carried out on February 16 2012. The objective was to identify and assess potential hazards for the LNG bunkering station, with focus on safety. Risks reducing measures were identified and assessed where possible. Like the HAZID in 2011, this update focuses only on hazards associated with bunkering of LNG to ferries on jetty 38. This includes equipment and operations both inside and outside the LNG Base Load Plant, ref. Figure B - 1 and Figure B - 2, respectively. For remaining hazards associated with the LNG Base Load Plant, reference is made to the QRA from 2009, ref. /2/. The HAZID does not take into account the risks due to ship or truck LNG loading to the ferry. Date : 11.06.2013 Page 2 of 11

DET NORSKE VERITAS Figure B - 1 Equipment associated with the bunkering system located inside the plant Date : 11.06.2013 Page 3 of 11

DET NORSKE VERITAS Figure B - 2 Route of the underground pipe and bunkering station on jetty 38 2 METHODOLOGY HAZID (Hazard Identification) is a systematic review of installations and/or operations in order to screen potential hazards. The HAZID review on February 16 2012 was run in a workshop with participants from Skangass, Fjordline and DNV. Each hazard was assigned a likelihood and consequence category, so that each hazard could be ranked in accordance with a predefined risk matrix, see Table B - 1. This risk matrix is the same as the one used in HAZID in June 2011. Date : 11.06.2013 Page 4 of 11

Severity People Environment Delay / Downtime Reputation DET NORSKE VERITAS Table B - 1 Risk matrix 1 2 3 4 5 No or superficial injuries Slight injury, a few lost work days Major injury, long term absence Single fatality or permanent disability Multiple fatalities Consequence Categories Slight effect on environment, < 1 BBL Minor effect Noncompliance. < 5 BBL Localized effect Spill response required. < 50 BBL Major Effect Significant spill response, <100 BBL Massive effect Damage over large area, >100 BBL < 2 hours < 1 day 1-10 days 10-60 days > 60 days Slight impact; local public awareness but no public concern Limited impact; local public concern may include media Considerable impact; regional public/slight national media attention National impact and public concern; mobilization of action groups Extensive negative attention in international media Likelihood 1 2 3 4 5 6 Failure is not expected < 10-5 Never heard of in Industry 10-4 - 10-5 An incident has occurred in Industry 10-3 - 10-4 Has been experienced by most Operators 10-2 - 10-3 Occurs several times per year per Operator 10-1 - 10-2 Occurs several times per year per facility >10-1 L L L M M M L L M M M H L M M M H H M M M H H H M M H H H H Risk Definition: High Actions must be taken to reduce risk to at least the medium level Risk reduction measures must be taken if their respective costs are not disproportionately high as compared to their Medium attained benefits (ALARP principal); actions need to be taken to manage and measure risk. Low Monitoring actions required to identify whether the risk rises to medium level Date : 11.06.2013 Page 5 of 11

DET NORSKE VERITAS 3 PARTICIPANTS Table B - 2 Participants at the HAZID workshop March 16 2012 Name Company Position / role in HAZID Camilla Gautestad Skangass Process Manager, Gas & LNG projects Gunnar Helmen Skangass Key Account Manager, LNG Industry & Marine Åsbjørn Folvik Skangass Process engineer, LNG Industry & Regulations Morten Larsen Fjordline Technical & Nautical Director Erik Skramstad DNV HAZID facilitator Jon Magne Ofte DNV QRA Project Manager Jean-Baptiste Berthomieu DNV Scribe 4 SUMMARY OF HAZARDS IDENTIFIED The new design of Skangass bunkering system is considered an improvement in terms of safety, as it mitigates or eliminates some of the hazards identified in the HAZID from June 2011: The likelihood of a leak is reduced by introducing underground, double wall pipeline and by eliminating buffer tanks and flare. Since the HAZID in 2011, the number of hazards with criticality High is reduced to one: 1-4 Leaks from the loading arm during bunkering operations, caused by fabrication or material defects; weld defects, leaking seals and swivels. Possible consequences are fires if ignition sources on and around bunkering ferry (under ro-ro operation) are present; risks to ship passengers. The main changes include the lower criticality of the following hazards, due to reduction of likelihood and/or consequence: Criticality changed from Medium to Low: o 1-1 Release of N2 and HC from vents on the ship (ship-side) o 1-2 Inability of purging N2 from the loading arms o 1-12 Damage to loading arms with possible release of LNG (New: No crane operations during bunkering operations.) o 3-1 Loss of LNG supply capacity o 3-2 Damage to piping system inside the LNG plant Criticality changed from High to Medium: o 1-10 Loss of control during filling of ship (New: ESD has been provided; the system will fail in a safe position.) Other changes since the HAZID in 2011 do not move hazards from one criticality level to the next. All changes are marked with text in red in the HAZID log in the next chapter. Date : 11.06.2013 Page 6 of 11

Category Consequence Likelihood Criticality DET NORSKE VERITAS 5 HAZID LOG (Text in red has been revised since HAZID June 2011) ID HAZARD CAUSE POSSIBLE CONSEQUENCES DETECTION SAFEGUARDS / CONTROL MEASURES COMMENTS 1-0 Loading area loading arm from LNG Base Load Pant to ship 1-1 Release of N2 and HC from vents on the ship (ship-side) N2 purging of loading arms into the ship's main header vent system Fire hazard if ignition sources on and around bunkering ferry (under roro operation) are present 1-2 Inability of purging N2 from the loading arms 1-3 Release of N2 and HC from the loading arms (shore-side) Unintended releases during connection and preparation for the LNG transfer Pollution of fuel in the ship's fuel tank Minor fire with HC release Design of cold vent; minimise purging through better control of the process; design of fire fighting system (foam etc.) Control of the purging process Demonstration to authorities on this (safe?) design 1 3 L This could be a problem when simultaneous passenger and cargo "offloading" are being carried out 1 2 L 1 3 L Neighbouring pressure relief valves can be connected to this onshore header vent system. With the current procedure, the release is small, then the consequences will be small as well. 1-4 Leaks from the loading arm during bunkering operations Fabrication or material defects; weld defects; leaking seals and swivels Gas dispersion Manual detection possible but not reliable (due to surrounding noise pollution during work) Gas detectors and immediate / automatic shutdown 2 3 M Consider visual indication of closed connections; hydraulic backup system of the loading arms should be considered Date : 11.06.2013 Page 7 of 11

Category Consequence Likelihood Criticality DET NORSKE VERITAS ID HAZARD CAUSE POSSIBLE CONSEQUENCES DETECTION SAFEGUARDS / CONTROL MEASURES COMMENTS 1-5 Fires if ignition sources on and around bunkering ferry (under ro-ro operation) are present; risks to ship passengers Visual detection (continuously operated during ship loading) Immediate / automatic shutdown; elimination of ignition sources in classified areas; fire-fighting 4 4 H Address radiation level and fire effects on personnel and passengers on the open-bridge and open decks during the bunkering; Consider access control to the open-deck and fire protection on the bridge. 1-6 Embrittlement Spill protection (for the steel on the deck) 3 3 M 1-7 Frost burns PPE mandatory 3 3 M 1-8 Unplanned disconnection of the loading arms, with possible damage to equipment and release of LNG Excessive ship motions due to failure in engine control system on the ship; failure in mooring; passing ships; weather Refer to consequences in ID 1.04,1.05,1.06,1.07 Manual detection Berthing control of the ship; weak link/quick release coupling will minimise damages to the loading arm 1-9 Overfilling of fuel tank (ship) 1-10 Loss of control during filling of ship 1-11 Damage to loading arms with possible release of LNG Control failure (instrument; operational etc.) Loss of power Impacts from trucks and crane arms Release of LNG through tank relief valves, and NG through pressure relief valves. Refer to consequences in ID 1.04,1.05,1.06,1.07 Abortion of the filling process in an unsafe state Fire hazards (trucks acting as potential ignition sources). Injuries to facility operators and ferry Level alarm controls Loss of power / black-out should be easily detected Manual detection Operational procedures and tank protection system (level indicators) This has to be addressed in the ESD philosophy (including the back-up of power supply) Concrete or other protective barriers and traffic rules (speed limits etc.); no traffic during bunkering operation 3 3 M Emergency procedures to be addressed in the overall operation procedures as well as during training etc. 4 3 M This is linked to the ship design, it will be designed according to the IMO guidelines (ESD link will be provided) 2 3 M ESD has been provided; the system will fail in a safe position. 4 1 M Date : 11.06.2013 Page 8 of 11

Category Consequence Likelihood Criticality DET NORSKE VERITAS ID HAZARD CAUSE POSSIBLE CONSEQUENCES DETECTION SAFEGUARDS / CONTROL MEASURES COMMENTS 1-12 Dropped objects on loading arms from cranes loading the ship 1-13 Ship collision / impact from other passing vessels 1-14 Damage to loading arms when disconnected Human error and / or technical failures, leading to loss of navigational control Truck traffic; dropped containers; collision impact from other vessels passengers. Refer also to consequences in ID 1.04,1.05,1.06,1.07 Structural damage to the ship. Possible damage to the loading arms cannot be disregarded. Material damage to the (normal stainless steel) arm and possible release of LNG (before LNG has evaporated) Manual detection No crane operations during bunkering operations 3 1 L Crane activities should be carried out at a safe distance from loading manifold (or vice versa) Manual detection Port traffic controls 3 2 M Harbour traffic control (especially due to the increased sea traffic opposite to LNG bunkering facility) - Refer to DNV Risk Analysis on Risavika Harbour Visual observation / inspection Shut-down valves at both the ship-side and onshore tank-side of the filling line; consider possibility to empty loading arm after disconnection 2 3 M Low probability (and minimal spillage of LNG); Loading arm will contain LNG shortly after loading; safety zone around the loading arm; access is restricted to limited (trained) personnel; protection equipment by personnel present at that area 1-15 Unplanned abortion of fuelling operation 1-16 Sabotage and terrorist attacks 1-17 Failure of the vacuuminsulated transfer line External fire (on ship, building and truck) Material fabrication defects Damage to equipment (including escalation); delay Shut down and need for repairs Visual observation Loss of vacuum (detected in the control room) Fire detection and firefighting; ESD and emergency plans Design of culvert, pipe support and draining system of the culvert, ventilation system if culvert is closed 3 3 M To be addressed as part of the ESD procedures 3 3 M Covered as part of meeting the international regulation requirements (ISPS) Date : 11.06.2013 Page 9 of 11

Category Consequence Likelihood Criticality DET NORSKE VERITAS ID HAZARD CAUSE POSSIBLE CONSEQUENCES DETECTION SAFEGUARDS / CONTROL MEASURES COMMENTS 1-18 LNG releases in the culvert Double barriers failure; digging activities; flooding; Fatigue; improper installation; excessive loads of traffic activities; vibrations; settlement. Fire and explosion Gas detectors (if flanges are present inside the culvert); otherwise vacuum detectors / monitoring should be adequate Minimise valves / flange connections inside the culvert 4 1 M Valves / flange connections should preferably be outside the culvert 2.0 LNG Buffer Tank(s) (top and bottom filling inlets) & its filling lines No longer part of the design 3-0 Main LNG plant - 42-TR-101 tank & truck loading bay 3-1 Loss of LNG supply capacity Visual 1 3 L 3-2 Damage to piping system inside the LNG plant 3-3 Failure of liquid lines from pump 42-PS-101B Increased frequency of use Loss of fuelling capacity, i.e. breakdown of facility's reliability Release of LNG in Truck Loading Bay; fire and explosion (due to ignition sources from the trucks) Process control and gas detectors at the Truck Loading Bay Revise the operational manual so as to consider the reliability of the truck and Buffer tank(s) filling Ensure that piping system is designed for situation with back-flow in the system 1 3 L Vapour return line to be considered? The increased use of this pump should be reflected in the QRA Date : 11.06.2013 Page 10 of 11

DET NORSKE VERITAS 6 REFERENCES /1/ Risikovurdering av LNG bunkring av RoPax ferje i Risavika havn, DNV reg. no. 12PABXZ- 21, 26.08.2011 /2/ QRA for Skangass LNG plant, DNV report no. 2009-0068, rev 1, 08.05.2009 Date : 11.06.2013 Page 11 of 11

Det Norske Veritas: DNV is a global provider of knowledge for managing risk. Today, safe and responsible business conduct is both a license to operate and a competitive advantage. Our core competence is to identify, assess, and advise on risk management, and so turn risks into rewards for our customers. From our leading position in certification, classification, verification, and training, we develop and apply standards and best practices. This helps our customers to safely and responsibly improve their business performance. Our technology expertise, industry knowledge, and risk management approach, has been used to successfully manage numerous high-profile projects around the world. DNV is an independent organisation with dedicated risk professionals in more than 100 countries. Our purpose is to safeguard life, property and the environment. DNV serves a range of industries, with a special focus on the maritime and energy sectors. Since 1864, DNV has balanced the needs of business and society based on our independence and integrity. Today, we have a global presence with a network of 300 offices in 100 countries, with headquarters in Oslo, Norway. Global impact for a safe and sustainable future: Learn more on www.dnv.com