Formal Safety Assessment for Ammonia Fuel Storage Onboard Ships Using Bayesian Network

Abstract

In line with the IMO strategy on the reduction in GHG emissions from ships, many alternative fuels are being studied to phase out fossil fuels. Among these new fuel candidates, ammonia has gained significant attention because of its capability to hugely reduce CO₂ emissions. With the introduction of ammonia as a deep-sea vessel fuel, there are growing concerns about ammonia leakage and its influence on crew, ship, and environmental safety. In this study, an innovative formal safety assessment (FSA) framework integrating a hazard and operability study (HAZOP) and Bayesian network was developed to assess the leakage risks of ammonia fuel storage onboard ships. The proposed risk assessment framework was demonstrated by a case study in which refrigerated ammonia was stored in an independent fuel tank underneath the main deck. Three specific risk control options (RCOs) and their combinations were compared based on the cost–benefit analysis. The results indicate that decision-makers may have the option to execute a risk control option from a cost–benefit perspective. This research provides users of onboard ammonia fuel with an approach for assessing storage and usage hazards and estimating and managing their risks.

1. Introduction

Awareness of climate change has increased over the past few decades, and the adverse effects have become more apparent. The idea of decarbonizing the shipping industry would be a massive undertaking, as a significant amount of greenhouse emissions originate from ship operations. The challenge is multifaceted and leans on four key pillars: energy efficiency; clean energy sources; carbon capture, utilization, and storage; and low-carbon fuels, feedstocks, and green energy. However, there are concerns about the slow progress of decarbonization in the shipping sector. Moreover, the maritime industry is scrutinized for its significant contribution to air pollution, mainly because of large engines and international trade within delicate ecosystems. If the current trend continues, GHG emissions from maritime transportation are expected to increase by 130% by 2050 compared to the 2008 baseline [1]. To address this issue, the International Maritime Organization (IMO) has set targets to reduce GHG emissions by at least 40% by 2030, compared to 2008, and to reach net-zero GHG emissions by or around 2050 [1].

Introducing alternative fuels is expected to significantly reduce ship emissions from fossil fuels and the resulting environmental damage [2]. Several green fuel options exist in the maritime industry, such as ammonia [3], biodiesel [4], methanol [2], liquified natural gas (LNG) [5], and hydrogen fuel cells [6]. Among these options, hydrogen is considered as a superior and eco-friendly fuel choice, with carbon-free combustion properties. However, hydrogen energy usage faces challenges due to storage limitations, low energy density, and fire hazards. Alternative ways to use hydrogen have been explored, among which ammonia has emerged as a practical option for adequate hydrogen transportation.

Ammonia has a well-established infrastructure and known properties, making it attractive for use as a zero-carbon hydrogen carrier in the energy industry. The advantages of ammonia over pure hydrogen include its lower cost of storage and transportation per unit of energy and easier handling and distribution, as well as its better commercial viability. The maritime industry has seen pioneering efforts in ammonia propulsion. A tugboat powered by clean ammonia sailed for the first time on a Hudson River tributary, marking a significant step toward reducing carbon emissions in shipping. The rise in green ammonia production using renewable energy sources has further bolstered its sustainability.

However, challenges remain in addressing ammonia’s toxicity, handling risks, and cost competitiveness, prompting regulatory and safety framework developments essential for its broader adoption in the shipping market. Ammonia fuel leakage due to pipeline breakage and other reasons may cause specific hazards to the environment and the health of seafarers. Ammonia leakage can disrupt marine ecosystems by causing eutrophication, algal blooms, and oxygen depletion in seawater. Exposure to ammonia gas can cause severe respiratory damage, skin burns, and eye irritation, with concentrations above 300 ppm considered as life-threatening. These hazards make effective leak prevention, containment, and mitigation critical for ammonia-powered maritime vessels. Research on mitigating ammonia fuel impacts has focused on technological innovations and operational strategies, and advances in leak detection technology, spill containment systems, and emission reduction techniques have paved the way for safer ammonia-based shipping [7].

Safety is of utmost importance in marine operations, and the IMO has introduced formal safety assessment (FSA) as a primary tool to evaluate safety on board ships. However, assessing onboard ship safety is complex because of the various operations involving different groups, such as bunkering, cargo operations, fuel transfer, maintenance, and maneuvering, which change over time. Furthermore, the probabilities of operational hazards change dramatically due to simultaneous operations and observed evidence. Traditional quantitative FSA structures use generic risk probabilities for calculations, which are insufficient for highlighting specific issues in dynamic conditions. Therefore, this study presents an FSA framework for marine ammonia fuel storage that uses the well-known Bayesian network (BN) to evaluate newly observed data and continuously update assessment. Influencing factors dependent on each other to impact the safety of using ammonia as an alternative fuel are rationally dealt with. The proposed methodology resolves some of the problems in traditional FSA structures, and the major contributions of this study include (1) developing a framework to deal with a wide range of risks that may vary based on location, weather, and other factors; (2) discussing the role of the BN in the FSA framework and applications to the risk assessment of ammonia fuel storage onboard ships, demonstrated by a case study; (3) providing a broad overview of recommendations and their optimal benefits by integrating various combinations of risk control options (RCOs), which are taken into account individually and in combination. This study is of great significance to the field of marine fuel safety in terms of providing guidance on the design of ammonia fuel storage onboard ships and providing a theoretical basis for formulating management regulations and industry standards for ships powered by ammonia.

2. Literature Review

2.1. Ammonia as a Marine Fuel

The evidence of human impact on the environment is growing, prompting many societies to adopt eco-friendly energy sources. For example, the European Union stated that Europe’s goals are to become climate-neutral by 2050, as well as setting a target of 55% fewer emissions by 2030, in comparison to 1990, and the Paris Agreement aims to limit global warming to below 2 °C compared to pre-industrialization levels [8,9]. As the main governing body of the maritime sector, the IMO has initiated several projects to enhance low-carbon fuel technology and build the maritime industry’s capacity for climate mitigation measures [10,11].

The maritime industry will inevitably shift to alternative fuels to meet these standards and regulations. One of the most thoroughly researched alternatives is hydrogen energy due to its carbon-free properties. It can be used in internal combustion engines [12] and gas turbines. Hydrogen is a simple molecule that promises cleaner and sustainable energy and can decarbonize both transportation and power generation industries [13,14,15]. However, there are many challenges associated with using hydrogen as an energy source, such as difficulties in storing, distributing, and using it due to its high liquid pressure (>700 bar), exceptionally low cryogenic temperatures (<−253 °C), high reactivity, high diffusivity, and low volumetric energy (3 Wh/L compared to gasoline’s 9500 Wh/L) [16]. According to Parkinson, Tabatabaei, Upham, Ballinger, Greig, Smart, and McFarland [17], elevating to such pressures and temperatures requires significant energy consumption and increases the risk of leakage (6.0 kWh/kg-H2 to increase the pressure to 700 bar). Therefore, while the potential of hydrogen as an energy-storing medium is well understood, there is a need for feasible methods for storing hydrogen energy.

In this context, ammonia can be used as an indirect method for storing and transporting hydrogen energy safely and overcoming the disadvantages of storing and transporting hydrogen at higher pressure or lower temperatures. In recent years, ammonia has gained much attention as an alternate fuel due to both its role as a hydrogen carrier and its direct applicability [18]. Ammonia characteristics, such as being more accessible and less expensive to transport, its higher volumetric energy density and higher hydrogen storage capacity (121 kg-H2/m³), and the established infrastructure and mature operational experience, have increased interest in ammonia as an alternate fuel [19]. Naturally, ammonia is available as salt, which is essential for plant growth. Ammonia is used to produce fertilizer, steel products, refrigerants, nitric acids, and many more products [20]. Most global ammonia is created through the Haber–Bosch process, where a 3:1 hydrogen and nitrogen combination is made through an exothermic process (723–873 K and 100–250 bar) [15]. The diatomic nitrogen bond breaks using an iron catalyst under high pressure and temperature during this process. The nitrogen atoms absorb hydrogen atoms in these conditions to produce ammonia [15].

Moreover, many studies have shown that, while fossil-based ammonia does not reduce emissions from a well-to-wake perspective, it does result in a significant decrease in CO₂ emissions from a tank-to-wake perspective. It has been found that the production of 1 ton of ammonia releases 1.5 tons of CO₂ [21,22]. Huang et al. [23] studied the well-to-wake life cycle assessment (LCA) of a very large crude carrier (VLCC). They discovered that fossil-fuel-based ammonia contributes significantly more GHG emissions than fossil fuels. However, according to the LCA approach, total-renewable-energy-based ammonia can significantly reduce GHG emissions. Zhang et al. [24] also compared the LCA of various ammonia production methods.

Additionally, there is a growing concern over the high NO_x emissions from ammonia combustion, a significant cause of acid rain that can harm human health and agriculture. NO_x is a primary contributor to photochemical pollution, which has severe consequences for human health and the environment. Furthermore, N₂O is considered to have almost 300 times greater potential as a greenhouse gas than CO₂, indicating a significant underestimation of GHG emissions [25]. It is obvious that efforts must be made to mitigate GHG emissions from an LCA perspective.

The main drawback of using ammonia as a fuel is its high toxicity and properties, which exacerbate this issue. Saika, Nakamura, Nohara, and Ishimatsu [26] explained that the ammonia toxicity can cause serious health problems if individuals are exposed to it for extended periods, such as respiratory difficulties, blindness, burns, blisters, and even death. As a corrosive substance, it dissolves in water and can irritate the mucous membranes of both humans and animals [27]. Moreover, the vapor cloud of ammonia is denser than normal air and can travel through the ground, posing a significant risk to people in its vicinity [28]. To guarantee the safe utilization of ammonia as fuel, it is essential to examine previous industrial accidents and learn from them. It was found that external, structural, and operational events have contributed to 7%, 32%, and 61% of past incidents involving ammonia, respectively [29,30].

2.2. Formal Safety Assessment Methodology

Safety is the ability of a system not to cause undesirable consequences, and risk assessment is a crucial tool for understanding the potential risks that operators, systems, and processes may face [31]. A novel safety assessment was required to deal with maritime uncertainties, ship varieties, and very changeable environmental conditions. FSA was developed initially partly as a response to the Piper Alpha disaster, and was then proposed by the UK Maritime and Coastguard Agency (MCA) to the IMO. This framework is being used as a guide for the IMO rulemaking process to effectively supply a proactive approach to the risks involved with maritime activities [32]. As shown in Figure 1, FSA is a structured, systematic methodology described as a rational and systematic process for assessing risks in shipping activities and evaluating the cost–benefits of RCOs. FSA aims to enhance maritime safety by protecting human life, the environment, and property. This contains five steps, namely, what might go wrong, how bad it is, how the matter can be improved, the cost to enhance, and actions to be taken [33].

This guidance is used to confirm that the risks associated with each case are within or below the ALARP (as low as reasonably practical) region and to verify the cost-effectiveness of the RCOs. Applications of formal safety assessment on specific ships or offshore installations were addressed in the safety assessment of hazards and risks [35]. The IMO has published several ship-specific FSA models submitted by Denmark, namely MSC (Maritime Safety Committee) 83/21/1 FSA for LNG carriers [36], MSC 83/21/2 FSA for container vessels [37], MEPC (Marine Environment Protection Committee) 58/17/2 FSA for crude oil tankers [38], MSC 85/17/1 FSA for cruise ships [39], MSC 85/17/2 FSA for Ro-Pax ships [40], and MSC 87/18/1 FSA for the transport of hazardous cargoes for open-top containerships [41]. Moreover, several FSA structures that cover a specific vessel or design can be found in the recent literature. Yeo, Jeong, and Lee [42] constructed an improved FSA methodology using a fuzzy order of preference by similarity to ideal solution (TOPSIS) approach for liquefied petroleum gas (LPG) marine propulsion systems, and they enhanced the effectiveness of the process by reducing the extended time consumed for the FSA procedure.

Agamy, Youssef, and Abdelkader [43] established a suitable FSA foundation for self-loading bulk carriers by reviewing available accident data and identifying most hazards triggered by unloading, navigation, and ship-to-ship (STS) operational phases. This shows that using the FSA structure provides a solid background-incorporating technique for TOPSIS and the BN for effective risk assessment.

In contrast, Psaraftis [44] underlined some deficiencies, such as the lack of guidance in the FSA framework, non-transparency, and the higher reliance on experts’ opinions. Moreover, Njumo [45] explained the extended time and the data input inconsistency as the main drawbacks of FSA. Considering the above statements, the FSA structure should be improved and must use reliable data sources to enhance the quality of its product.

Many analytical techniques, such as fault tree analysis, can help to facilitate the application of FSA in maritime design and operation. To apply such techniques in maritime applications, a lack of quantitative failure data is often a challenging issue in terms of obtaining reliable assessment results for rational decision making. This is particularly the case when the assessment of ammonia as an alternative fuel in marine applications is concerned due to limited failure data available. Many conventional analytical techniques are not capable of analyzing failures that are dependent on each other, and cannot analyze their causal relationships in a dynamic way such that any observed evidence can update the estimation of all relevant failure events so as to take measures accordingly. In light of such research challenges, a Bayesian network approach is selected for use in order to implement FSA for ammonia fuel storage onboard ships. Diverse data from sources such as failure databases, expert judgement, and subjective reasoning can be used in a Bayesian network.

2.3. Gap Analysis

Although the toxicity and properties of ammonia have been studied in several publications, there is no available systematic analysis of the risks of onboard ammonia fuel storage. Moreover, RCOs that are of great significance for stakeholders to make logical decisions have rarely been discussed in previous studies. Recognizing these research gaps, this study proposes a formal safety assessment model integrating a hazard and operability study (HAZOP) and Bayesian network, aiming to systematically assess the risks of onboard ammonia fuel storage and provide the most cost-effective RCOs. The contributions of this study are as follows:

• A formal safety assessment framework integrating an HAZOP and BN was proposed to identify and assess the hazards associated with ammonia storage and utilization in ship operations.
• A list of hazards that may result in ammonia fuel leakage was identified and the level of risk was accurately modeled, reflecting the criticality of various risks.
• The methodological framework of this study provides a new perspective for the risk assessment of ammonia storage, enabling decision-makers to make wiser decisions in complex navigational environments, thereby ensuring the safety and reliability of ammonia storage and utilization onboard ships.

3. Research Methodology

As shown in Figure 2, this methodology follows the IMO’s FSA structure. However, the main added feature of this methodology is the use of the Bayesian network for flexible risk assessment.

3.1. Formal Safety Assessment

Before embarking on the FSA process, it is imperative to identify the specific system that requires assessment. This initial step is of utmost importance because it enables a comprehensive analysis of the system and its surrounding environment. Without a clear and accurate understanding of the system, there is a risk of missing significant risk categories and providing recommendations that may not adequately address the risks. By meticulously defining the system, the assessment goal becomes more precise and achievable.

By considering the main characteristics of ammonia storage onboard ships, an FSA framework for ammonia fuel storage onboard ships is proposed as follows.

3.1.1. Hazard Identification

A physical situation or a condition that can potentially harm humans, the environment, or properties is known as a hazard. The goal of this phase is to create a list of hazards and related scenarios arranged by their level of risk, specific to the system. This is achieved by utilizing standard techniques to recognize potential hazards that can lead to accidents, and then screening them. It is important to carry out the hazard identification exercise. In this study, an HAZOP [46] will be used to identify and analyze the potential hazards associated with ammonia storage and utilization in ship operations.

Hazard identification is conducted to identify the hazards arising from the novel ammonia fuel design, which may assist in taking adequate measures to lower the risks in the ALARP region. The principal hazard contained with ammonia fuel is leakage, which may escalate to toxic exposure, fire, explosion, or pollution. Therefore, this study identifies hazards that may result in ammonia fuel leakage, such as bunkering, external effects, equipment defects, human error, and structural failure.

3.1.2. Risk Estimation

Effective risk estimation can be accomplished by utilizing appropriate techniques that can accurately model the level of risk. It is important to address various types of risks, such as personal and environmental risks, as they pertain to the specific problem being considered. There are several methods that can be used to perform a risk estimation. The selection of a specific method is influenced by types of hazards identified and the level of failure data available. Compared with fault tree analysis and other methods, the BN has a stronger capability to deal with dependencies of events and also an easy updating of estimation once new evidence is observed. Therefore, a BN will be used to model the risk dynamically in this study in order to fully leverage its data fusion ability and dynamic analysis capabilities in dealing with risks in ammonia storage onboard ships.

3.1.3. Risk Acceptance Criteria RCOs

This step aims to create RCOs to address both existing and newly identified hazards. These RCOs bring down the severity, occurrence frequency, or both to the accepted or ALARP region.

3.1.4. Cost–Benefit Analysis Toward Decision Making

In this step, the costs and financial benefits of each RCO are analyzed and compared. This helps to provide a fair comparison between the RCOs, which aids in better understanding and making recommendations regarding the implementation of these criteria. When evaluating RCOs, it is important to estimate the costs and benefits that may arise due to uncertain factors such as future inflation, regulatory changes, technological advancements, and social and political changes.

3.1.5. Recommendation and Decision Making

After careful consideration of the above steps, logical recommendations can be proposed. This helps the stakeholders to take the most appropriate decisions.

3.2. Bayesian Network

The BN, named after Thomas Bayes (1702-1761), emerged after a few mathematical research studies in the 1980s. The BN is a directed acyclic graph (DAG) that encodes conditional probabilities at its nodes. This describes the effect of the likelihood given with the observations.

Bayes’ theorem rule:

$$\mathrm{P}\left(\mathrm{B}|\mathrm{A}\right)={\displaystyle \frac{\mathrm{P}\left(\mathrm{A}|\mathrm{B}\right)\times \mathrm{P}\left(\mathrm{B}\right)}{\mathrm{P}\left(\mathrm{A}\right)}}$$

(1)

where

• P(A): Probability of A;
• P(B): Probability of B;
• P(A|B): Probability of A given that B already happened;
• P(B|A): Probability of B given that A already happened.

3.2.1. Marginalization of Probabilities

The BN uses a directed acyclic graph (DAG) to describe the dependencies of random variables. Marginalization sums up all the possible values of one variable to determine the marginal contribution of another.

Suppose that we have two variables A and B, with their joint probability distribution P(A,B). The marginal probability of A is obtained by summing over all values of B, as indicated in the following formula:

$$P(A)={\displaystyle \sum _{b}P(A,B=b)}$$

(2)

If the joint probability is expressed using conditional probabilities (from a Bayesian network structure), the marginal probability becomes the following:

$$\mathrm{P}\left({\mathrm{A}}_{\mathrm{M}}\right)={{\displaystyle \sum }}_{\mathrm{j}=1}^{\mathrm{N}}\mathrm{P}\left({\mathrm{A}}_{\mathrm{M}}{|\mathrm{B}}_{\mathrm{j}}\right)\mathrm{P}\left({\mathrm{B}}_{\mathrm{j}}\right)$$

(3)

where N is the number of states of B and A_M is state m of A.

3.2.2. Conditional Probability

The BN model uses a DAG to represent the conditional probability relationship between a variable set. These distributions mathematically describe the effect on the probability under specific evident observations. To use the BN model accurately, it is essential to sort out conditional probabilities (CPs) accurately. The CP is the probability of an event where evidence is observed given the occurrence of another event affecting the first.

3.2.3. Noisy-Or Approach

This is an effective model that deals with problems both quantitatively and qualitatively. The “Noisy-Or” approach is also referred to as the independence of casual influence model (ICI) [47]. This model is based on strong assumptions that a child node will be present given the appearance of any parent node and a child node will be absent if all the parent nodes are absent.

This model follows the following assumptions [48]:

I.

Casual inhibition: If the effect is present, the cause should also be present except when the system is disabled.

II.

Independence of exception: Causes (parent nodes) are independent of each other.

III.

Accountability: Child nodes only exist if any of the parent nodes are present.

If “Y” is a child of “X₁”, “X₂”, …….., “X_n”, as per Assumption III above,

P(Y = Yes|X₁ = No, X₂ = No, …, X_n = No) = 0

(4)

In the situation of Noisy-Or, the probability of the binary node “Y” conditional upon “n” binary parent nodes X_r, where r = 1, 2, 3, …, n, is estimated as follows:

$$\mathrm{P}\left(\mathrm{Y}\right|{\mathrm{X}}_1, {\mathrm{X}}_2, \dots , {\mathrm{X}}_{\mathrm{n}})=1-{{\displaystyle \prod }}_{r=1}^n\left(1-P\left(Y|X_r\right)\right)$$

(5)

In this study, only two states of each node are considered, where Y stands for the evidence status of happening and N not happening, respectively.

4. Case Study

4.1. System Description

The ammonia fuel storage systems on ships provided by current mainstream marine energy suppliers are designed in a generic way to store ammonia safely while maintaining its stability under controlled temperature and pressure. These systems supply ammonia as fuel to ship propulsion engines or power generation units, making them a key component of ammonia-fueled vessels aimed at achieving zero-carbon emissions. These systems consist of several critical components that work together to maintain fuel stability, prevent leaks, and ensure safe and efficient combustion. Storage tanks are cryogenic or pressurized type C containers made of corrosion-resistant materials, equipped with insulation, pressure relief valves, and sensors for temperature, pressure, and fuel levels. The fuel supply system includes pumps, pipelines, flow control valves, and cooling units to regulate fuel transfer. The fuel transfer system connects storage tanks to engines or fuel cells, supported by filters and leak detection sensors. Safety systems such as gas detectors, emergency shutoff valves, fire suppression, and ventilation systems manage potential hazards. Centralized monitoring and control systems provide real-time data and predictive maintenance capabilities. Spill containment and environmental protection systems prevent fuel leaks from contaminating marine environments through containment basins, chemical neutralizers, and waste management protocols.

This research aims to develop a formal safety assessment for ammonia as a fuel, stored in an independent fuel tank underneath the main deck. The re-liquefying unit, valve train, LFFS (low flashpoint fuel supply) room, and associated pipes and equipment are located on the deck. A schematic diagram of the model proposed by the researchers of this work is shown in Figure 3. Given ammonia’s high toxicity, flammability under specific conditions, and corrosiveness, the ammonia fuel storage system must meet strict safety, environmental, and operational standards. While constructing the design, many aspects are to be considered, as mentioned below.

Several locations were considered for the ammonia storage tanks, including the engine room, aft of accommodation, adjacent to accommodation, midship area, and forward of the ship. A few fundamental considerations are to avoid long piping on deck, passing ammonia piping through the cargo area, and preventing proximity to the accommodation block. After considering all these together with the fact that below-deck storage in insulated tanks is often an option for many ships, such as container ships, as a prioritizing space, it was decided to locate the tanks inside the aft cargo hold.

Moreover, several aspects must be considered in the tank design phase:

• Refrigeration systems. To ensure safety and reliability, it is advised to incorporate two separate reliquefying systems when using ammonia, as it is highly sensitive to temperature as described previously. It is also crucial to have two sets of suction pipes and pumps, as well as a dedicated pump room. This will prevent a single failure from causing a complete breakdown.
• Ammonia detection sensors.
• Ventilation.
• Pressure relief.
• Remote operation and isolation valves.
• Piping with sufficient distance.
• Locating piping in unmanned space.

Identifying the system is essential for understanding subdivisions and nodes of the failure points.

4.2. Hazard Identification

Ammonia fuel storage systems onboard ships pose several hazards due to ammonia’s toxicity, flammability, corrosiveness, and environmental impact. Toxic gas exposure can cause severe respiratory and skin damage, while vapor leaks may result in explosions when mixed with air. Ammonia’s corrosive nature can degrade storage tanks and pipelines, leading to system failures. Over-pressurization of cryogenic tanks and spills can cause serious environmental harm, including water pollution, eutrophication, and marine ecosystem disruption. Operational risks such as human error and equipment malfunctions further heighten safety concerns.

The HAZOP technique was applied in this study to identify potential hazards in ammonia fuel storage systems onboard ships. The process started by defining the system’s scope, setting clear objectives, and assembling a multidisciplinary team, including marine engineers, safety experts, environmental scientists, and ship operators. System diagrams such as P&IDs and technical manuals were reviewed, and the system was divided into key sections (nodes) like storage tanks, fuel pipelines, and combustion systems. For each node, standard HAZOP guide words (e.g., “No”, “More of”, “Less of”, “Reverse”) were applied to identify deviations from intended operations, such as fuel over-pressure, leaks, or valve failures.

For each identified deviation, the team assessed its causes, consequences, and existing safeguards, such as emergency shutoff valves, gas detectors, or pressure relief systems. Where safeguards are insufficient, additional safety measures were recommended, including installing advanced monitoring systems, upgrading materials, and improving crew training. The findings were documented in an HAZOP report, using a risk matrix to rank hazards by severity and likelihood. The team concluded the process with a review meeting, assigning responsibilities for implementing improvements and scheduling regular follow-up assessments to maintain system safety. The results of hazard identification are tabulated in

Table 1. Hazard identification demonstration.

Deviation	Cause	Consequences	Actions Required
External Events	Collision Grounding Falling heavy object from the shore crane Terrorist attack	Damage to the storage tank, pipes, and fittings	All ammonia piping on the deck should be fitted with guards to avoid external damage
Structural failure	Material failures Defects in the fittings Design failures	Damage to the storage tank, pipes, and fittings	All piping on the deck is covered with a gas-tight enclosure
Operational error	Overfilling Wrong valve setting Maintaining incorrect temperatures	Damage to the storage tank, pipes, and fittings	Carry out regular crew training Maintain sufficient competent crew onboard Follow ship-specific procedures

.

4.3. Dynamic Risk Assessment

4.3.1. Bayesian Network

As categorized in the hazard identification study, external events, structural failures, and operational errors were identified as the reasons for ammonia leakage events. They were used as the parent nodes of the leakage node, as shown in Figure 4. On the other hand, once the leakage has already happened, there are chances of people getting intoxicated, spill overboard, or escalation to the fire situation.

In Figure 4, the occurrence probabilities of E, S, O, and L (ammonia leakage) are 0.00090, 0.003902, 0.00210, and 0.00539 [29,30].

4.3.2. Conditional Probability

In order to build up the Bayesian network, it is required to determine conditional probabilities.

$$\mathrm{P}\left(\mathrm{L}|\mathrm{S}\right)={\displaystyle \frac{\mathrm{P}\left(\mathrm{S}|\mathrm{L}\right)\times \mathrm{P}\left(\mathrm{L}\right)}{\mathrm{P}\left(\mathrm{S}\right)}}={\displaystyle \frac{0.32\times 5.39\times {10}^{-3} }{3.902\times {10}^{-3}}}=0.4420$$

$$\mathrm{P}\left(\mathrm{L}|\mathrm{E}\right)={\displaystyle \frac{\mathrm{P}\left(\mathrm{E}|\mathrm{L}\right)\times \mathrm{P}\left(\mathrm{L}\right)}{\mathrm{P}\left(\mathrm{E}\right)}}={\displaystyle \frac{0.04806\times 5.39\times {10}^{-3} }{9.000\times {10}^{-4}}}=0.2878$$

$$\mathrm{P}\left(\mathrm{L}|\mathrm{O}\right)={\displaystyle \frac{\mathrm{P}\left(\mathrm{O}|\mathrm{L}\right)\times \mathrm{P}\left(\mathrm{L}\right)}{\mathrm{P}\left(\mathrm{O}\right)}}={\displaystyle \frac{0.05104\times 5.39\times {10}^{-3} }{2.1\times {10}^{-3}}}=0.1310$$

where P(S|L) = 0.32, P(E|L) = 0.04806, and P(O|L) = 0.005104. Such values are obtained from historical accident data [29,30].

The above results are also shown in

Table 2. Conditional probability value.

CP	Probability
P(leakage = ‘yes’|Structural fail = ‘yes’), P(L|S)	0.4420
P(leakage = ‘yes’|External event = ‘yes’), P(L|E)	0.2878
P(leakage = ‘yes’|Operational error = ‘yes’), P(L|O)	0.1310

.

Noisy-Or Approach

Based on the values obtained in Table 2, the conditional probability table (CPT) can be calculated, as shown in the procedure below.

As per the “Noisy-Or” Assumption III, child nodes cannot be present without any parental node. Therefore,

$$\mathrm{P}\left(\mathrm{L}\right|\overline{S}\left) \approx \mathrm{P}\right(\mathrm{L}\left|\overline{E}\right) \approx \mathrm{P}\left(\mathrm{L}\right|\overline{O}) \approx 0$$

(6)

Let us take the following representations for leakage conditional probabilities.

P (L|E) ≡ X

(7)

P (L|S) ≡ Y

(8)

P (L|O) ≡ Z

(9)

From Equations (3)–(9),

Scenario 1: Events E, S, and O observed have happened.

According to Equation (3), the leakage conditional probability of Scenario 1 can be calculated as follows:

P (1) = 1 − [(1 − X) (1 − Y) (1 − Z)]

(10)

In the same manner, the CPT under different scenarios can be completed as shown in

Table 3. Each conditional probability calculation.

Scenario 1	P (1)	= 1 − [(1 − X) (1 − Y) (1 − Z)]
	P (2)	= 1 − P (1)
Scenario 2	P (3)	=1 − [(1 − X) (1 − Y) (1 − 0)]
	P (4)	= 1 − P (3)
Scenario 3	P (5)	= 1 − [(1 − X) (1 − 0) (1 − Z)] = X + Z − X×Z
	P (6)	= 1 − P (5)
Scenario 4	P (7)	= 1 − [(1 − X) (1 − 0) (1 − 0)] = X
	P (8)	= 1 − P (7)
Scenario 5	P (9)	= 1 − [(1 − 0) (1 − Y) (1 − Z)] = Y + Z − Y × Z
	P (10)	= 1 − P (9)
Scenario 6	P (11)	= 1 − [(1 − 0) (1 − Y) (1 − 0)] = Y
	P (12)	= 1 − P (11)
Scenario 7	P (13)	= 1 − [(1 − 0) (1 − 0) (1 − Z)] = P (Z)
	P (14)	= 1 − P (13)
Scenario 8	P (15)	= 1 − [(1 − 0) (1 − 0) (1 − 0)] = 0
	P (16)	= 1

.

As shown in

Table 4. Calculated conditional probabilities.

External (E)		Yes				No
Structure (S)		Yes		No		Yes		No
Operational (O)		Yes	No	Yes	No	Yes	No	Yes	No
Leakage (L)	Yes	P(1) 0.6547	P(3) 0.6026	P(5) 0.3811	P(7) 0.2878	P(9) 0.5151	P(11) 0.4420	P(13) 0.1310	P(15) 0.0000
	No	P(2) 0.3453	P(4) 0.3974	P(6) 0.6189	P(8) 0.7122	P(10) 0.4849	P(12) 0.5580	P(14) 0.8690	P(16) 1.0000

, conditional probability values can be calculated to complete the proposed Bayesian network using the equations in Table 3 and the values in Table 2.

In a similar way, the CPTs for the other nodes in the BN can be obtained. In such a process, objective data, calculated data, and historical data obtained from the literature were used. The Bayesian network was then constructed using Hugin software [49], as shown in Figure 5.

In the constructed BN structure, there is always a 0.23% probability of leakage even when there is no observation seen. In the same manner, there are slightly lower probabilities for the consequences, as shown in Figure 5.

Figure 6 shows the effects of each parent node of the leakage node and, consequently, the probabilities of toxicity, spillage, and fire. The highest probability of leakage is expected when a structural failure occurs, while the lowest is due to operational error.

Once the occurrence of an event is observed, the BN can be updated, as shown in Figure 7. This can be used as a diagnostic tool to find the cause of the consequences. For instance, when there is an obvious consequence of toxication, it can be deduced that the probability of structural damage causing that consequence is 76.18% and the probability of operational error is 12.23%.

4.3.3. Model Validation

This is a way to determine whether the uncertainty in the proposed model’s output can be influenced by various input uncertainties [50].

Sensitivity Analysis (SA)

The following three axioms must satisfy the validation requirements of the developed model [51].

Axiom 1: A slight increase or decrease in the prior subjective probabilities of each parent node should result in a relative increase or decrease in the posterior probabilities of the child node.

Axiom 2: The variation in the subjective probability distribution of each parent node’s influence magnitude on the child node should be consistent.

Axiom 3: The total influence magnitude of the combined probability variations from evidence on the values should be greater than single evidence.

Table 5. Leakage probability changes with parent nodes.

	80%	90%	100%	110%	120%
P(L|E)	0.0021	0.0022	0.0023	0.0024	0.0025
P(L|S)	0.0019	0.0021	0.0023	0.0025	0.0027
P(L|O)	0.0022	0.0023	0.0023	0.0024	0.0024

and Figure 8 highlight the output changes (child node values) associated with changes in parent node values. The child node value differences are proportional to the parent node deviations, satisfying the first axiom. Moreover, the influence of each parent node on the child nodes is consistent, which satisfies the second axiom.

As shown in Figure 9, the child node probability is the minimum original value if no parental failure is observed. Once the structural failure is observed, the leakage probability shoots up to 0.1131 and increases to 0.1784 when the operational error is also observed. The leakage probability continues to grow to 0.2059 when all three parent nodes are in the failure state. This trend continues when considering other parent nodes with similar configurations, which satisfies the third axiom.

D-Separation

The correspondence of the structure of the BN and the conditional independence relationship represented in the graph is explained by the directional separation [52]. Three configurations will be discussed to confirm the satisfactory conditions [53].

i.

Serial type (Axiom i)

When evidence is observed in sharing node (Y), nodes X and Z become D-separated.

X ⏊ Z|Y = yes

For the multiple scenarios shown in Figure 10, there is no effect from the parent nodes of the sharing node (leakage) toward its child nodes when evidence is observed in the sharing node. These conditions satisfy the first hypothesis of the D-separation principle.

ii.

Diverging type (Axiom ii)

When a piece of evidence is observed in sharing node (Y), X and Z nodes become D-separated.

X ⏊ Z|Y = yes

As for the combinations of diverging type scenarios in Figure 11, there is no effect from one child node to another when the sharing node’s (parent node) state is observed. In contrast, when no observation is noted in the sharing node, child nodes are not D-separated, and any child node’s change affects other sibling nodes. This is in line with the diverging principle above; that is, when there is evidence in the sharing node, its child nodes are D-separated.

iii.

Converging type (Axiom iii)

When no evidence is observed in sharing node (Y), X and Z nodes become D-separated.

X ⏊ Z

Figure 12 illustrates that the proposed BN network has a satisfactory condition of the converging principle of D-separation since there is no effect from the parent nodes of the leakage node toward the other parent nodes when no evidence is observed in the leakage node.

4.3.4. Risk Control Options

RCOs aim to minimize the occurrence and impact of significant events. Based on the hazards identified and the outputs of the BN, three specific RCOs are proposed in this study, namely fitting guards for ammonia piping on the deck, crew training, and equipping air-tight enclosure for the piping on the deck. These RCOs are further analyzed to demonstrate the effectiveness of the proposed FSA methodology as follows.

RCO 1: All the piping on the deck should be covered with an air-tight enclosure. This can be aligned with the upcoming drydock, which includes removing all deck piping and refitting with double-walled ones. Since the diameter of the complete piping increases, the supports and the related frameworks must also be modified. Moreover, the administration should approve a proposed plan, and all the new installations should undergo required non-destructive tests, such as X-ray and pressure testing.

RCO 2: Workshop-based crew training should be carried out more frequently. This RCO includes the training of 25 crew members, including workshop chargers, instructors’ wages, crew wages, crew traveling expenses, and crew accommodation for one week.

RCO 3: All the ammonia piping on the deck should be fitted with guards to avoid external damage. This job can be performed when the ship is in floating condition. However, external workshops should be employed, and the classification society involvement should be considered to ensure modification approval. For job completion, 10 mm thickness metal plates, welding rods, 50 mm L-angle bars, 12 mm stainless steel nuts and bolts, and 100 man-hours are estimated.

4.4. Cost–Benefit Analysis

This stage aims to provide a reasonable comparison between the RCOs, which helps to better understand and make recommendations for the application of these criteria [34]. In the calculations, the criteria used for calculating cost-effectiveness in relation to safety of life and evaluating environmental risks are acquired from the IMO’s FSA guidance. It is worth noting that, in the evaluation of RCOs, subjective judgement is necessary to estimate the magnitude of the costs and benefits arising due to uncertain factors such as inflation, regulatory changes, technological revolution, and social and political changes. Therefore, experts were consulted in this study to deal with uncertainties in cost–benefit analysis.

The approximate cost of the RCOs was estimated through consulting with five domain experts in the form of a questionnaire survey and interview. All experts are from the maritime field and are very familiar with FSA and ammonia storage onboard ships. Statistical analysis on the expert opinions was then conducted to check the consistency of the expert opinions. The result shows that the experts’ opinions are highly consistent, indicating that these opinions have strong reliability and representativeness.

As shown in Figure 13, network values have changed over five years of operation due to degradation and aging.

Table 6. Estimated probability reduction due to proposed RCO.

Failure Mode	Prior Failure Rate	RCO Application	Posterior Failure Rate
Structural	0.0205	RCO 1	0.0176
Operational	0.0205	RCO 2	0.0114
External	0.0092	RCO 3	0.0067

shows the failure probabilities before applying the RCOs and the posterior failure probabilities after successfully applying specific RCOs. A new set of data was acquired after consultation with marine domain experts. Of the three RCOs, RCO 1 has the highest risk reduction value because it acts as the secondary wall of the piping. On the other hand, RCO 3 is expected to be the least effective since it provides protection only from falling heavy objects. After consultation with a number of selected marine chief engineers and ship superintendents with knowledge and experience in the topic area, the probabilities of structural, operational, and external failures were reduced after the implementation of each RCO as shown in Table 6.

As shown in the above updates of the BN with combinations of RCO application scenarios, there are noticeable effects toward the consequences of ammonia leakage.

As shown in Figure 14, the structural failure probability after the application of RCO 1 calculated and shown in Table 6 was updated in the Bayesian network to obtain the change in each consequence. It is evident that the leakage probability reduced to 0.013 due to the application of RCO 1, leading to the probability reduction of the toxic, spill, and fire consequences being 0.0033, 0.0036, and 0.0009, respectively. In the same manner, the effects of each RCO and their combined effects were calculated, as shown in

Table 7. Posterior probabilities of consequences.

		Posterior Probability of Consequences with RCOs
Consequences of Leakage	Prior Probability	RCO 1	RCO 2	RCO 3	RCOs 1 and 2	RCOs 1 and 3	RCOs 2 and 3	RCOs 1, 2, and 3
Toxic	0.0055	0.0033	0.0052	0.0053	0.0030	0.0031	0.0050	0.0028
Spill	0.0060	0.0036	0.0057	0.0058	0.0033	0.0034	0.0055	0.0031
Fire	0.0016	0.0009	0.0015	0.0015	0.0009	0.0009	0.0014	0.0008

. All the values in Table 7 were obtained after updating each value in the constructed Bayesian network.

The posterior probabilities of consequences were distracted from the prior probabilities to obtain the values of the risk reduction. This is valuable information for calculating the financial benefits after successfully applying RCOs. All the values in

Table 8. Reduction in consequences due to RCOs.

	Probability Reduction Due to RCO
Consequences of Leakage	RCO 1	RCO 2	RCO 3	RCOs 1 and 2	RCOs 1 and 3	RCOs 2 and 3	RCOs 1, 2, and 3
Toxic	0.0022	0.0003	0.0002	0.0025	0.0024	0.0005	0.0027
Spill	0.0024	0.0003	0.0002	0.0027	0.0026	0.0005	0.0029
Fire	0.0007	0.0001	0.0001	0.0007	0.0007	0.0002	0.0008

were calculated using the formula below:

Probability reduction due to the implementation of an RCO = Prior probability − Posterior probability

(11)

Using this equation, the effects of RCO 1 can be calculated as follows:

Toxicity probability reduction due to RCO 1 = 0.0055 − 0.0033 = 0.0022;

Spill probability reduction due to RCO 1 = 0.0060 − 0.0036 = 0.0024;

Fire probability reduction due to RCO 1 = 0.0016 − 0.0009 = 0.0007.

In the same way, all the effects of the RCOs and their combinations were calculated using the data in Table 7. The results are shown in Table 8.

Figure 15 illustrates three implementation cases: RCO 1, RCOs 1 and 2, and ROCs 1 and 3. Significant effects can be observed after applying each RCO or their combination. Such data will be utilized for the cost–benefit analysis.

The value of the risk reduction resulting from implemented RCOs must be converted into the value of the financial loss. Let us take the case of the top event (ammonia leakage), where there was a loss of one person and 10 tons of fuel leaked into the sea.

• Human fatality: USD 3,000,000 [34];
• Spill: USD 67,275 × V^0.5893 = USD 261,308 (USD 260,000);
• Fire damage: USD 5,000,000 (typical cost estimation of a major fire).

After accounting for the above values, each RCO’s gained benefit can be calculated by multiplying the probability reduction value with the estimated costs of consequences.

Benefit due to implementation of RCO = Cost of consequences × Probability reduction due to RCO

(12)

Firstly, the financial benefit of RCO 1 is calculated as follows:

Benefit due to toxicity reduction= USD 3000,000 × 0.0022 = USD 6600;

Benefit due to spill reduction = USD 260,000 × 0.0024 = USD 624;

Benefit due to fire reduction = USD 5,000,000 × 0.0007 = USD 3500;

Total benefit = USD 6600 + USD 624 + USD 3500 = USD 10,724.

All the relevant benefit values shown in

Table 9. Annual cost–benefit due to RCOs.

Consequences of Leakage	Financial Benefit per Year Due to RCOs
	RCO 1	RCO 2	RCO 3	RCO 1 and 2	RCO 1 and 3	RCO 2 and 3	RCO 1, 2, and 3
Toxic	USD 6600	USD 900	USD 600	USD 7500	USD 7200	USD 1500	USD 8100
Spill	USD 624	USD 78	USD 52	USD 702	USD 676	USD 130	USD 754
Fire	USD 3500	USD 500	USD 500	USD 3500	USD 3500	USD 1000	USD 4000
Total benefit	USD 10,724	USD 1478	USD 1152	USD 11,702	USD 11,376	USD 2630	USD 12,854

were calculated using the above-mentioned method. Among all consequences, toxicity is the most deciding factor in the benefit analysis, followed by fire and spill. Among all three ROCs, the highest benefit can be obtained from implementing ROC 1.

After that, the RCOs’ benefits must be compared with the implementation costs to determine cost-effectiveness. The estimated total costs of each RCO for 20 years are considered as follows.

• Cost of RCO 1: USD 200,000;
• Cost of RCO 2: USD 25,000;
• Cost of RCO 3: USD 25,000.

As shown in

Table 10. Cost–benefit analysis.

	RCO 1	RCO 2	RCO 3	RCO 1 and 2	RCO 1 and 3	RCO 2 and 3	RCO 1, 2, and 3
Total RCO cost for 20 years	USD 200,000	USD 25,000	USD 25,000	USD 225,000	USD 225,000	USD 50,000	USD 250,000
Cost per year	USD 10,000	USD 1250	USD 1250	USD 11,250	USD 11,250	USD 2500	USD 12,500
Benefit per year	USD 10,724	USD 1478	USD 1152	USD 11,702	USD 11,376	USD 2630	USD 12,854
Actual benefit per year	USD 724	USD 228	USD 98	USD 452	USD 126	USD 130	USD 354
Cost effectiveness	7.2%	18.2%	−7.8%	4.0%	1.1%	5.2%	2.8%

, the annual cost–benefit can be computed by subtracting annual benefits from costs. If the value is positive, then the particular RCO is cost-effective. However, comparing each RCO’s cost–benefit with others’ is not a sensible way to judge since the total costs for each RCO are different. For instance, RCO 1 delivers almost three times higher net benefits than RCO 2. However, RCO 1 requires eight times higher the cost than RCO 2 to achieve those benefits. Therefore, it is advisable to compare the cost-effectiveness of each RCO to obtain an overview of the benefits that may be acquired from the cost spent on each.

$$\mathrm{Cost-effectiveness}={\displaystyle \frac{\mathrm{Actual} \mathrm{benefit} \mathrm{from} \mathrm{RCO}}{\mathrm{Actual} \mathrm{cost} \mathrm{of} \mathrm{the} \mathrm{RCO}}} \%$$

Cost-effectiveness of RCO 1 = USD 724/USD 10,000 × 100% = 7.24%

As shown in Table 10, RCO 3 is the only one that does not have a positive cost–benefit among all RCOs and combinations of RCOs. RCO 1 has the highest actual annual benefit, followed by the RCOs 1-2 combination and RCOs 1-2-3 combination. However, after considering the cost-effectiveness, the results significantly change with the above statement. RCO 2 leads the way with 18.2% cost-effectiveness, while RCO 1 delivers 7.2% cost-effectiveness. RCO 1, which has the highest actual benefit per annum, indicates less than half the cost-effectiveness compared to RCO 2. However, all the combinations of RCOs display positive effectiveness, which varies between 1.1% and 5.2%. It is indicated that RCO 2 is the best option. With the available budget, it is also advisable to implement RCO 1 or the combination of RCOs 2 and 3.

It must be pointed out that cost–benefit analysis is merely a method of assessment, and it has limitations. Its results are largely influenced by the quality of data, as well as by uncertainties involved in the whole process of the assessment. Moreover, acceptable numerical risk criteria may vary among individuals due to disparities in culture, experience, and mindset. Therefore, it can only serve as a consultative tool in decision making, while keeping in mind the existence of uncertainties.

4.5. Decision Making

This step aims to provide recommendations that can be used to make logical decisions. Moreover, the cost–benefit analysis and the cost-effective demonstration make it easier to convince the stakeholders to follow the recommended RCOs. The budget and uncertainty about the expected benefits often constrain organizations.

As shown in Figure 16, though RCO 1 provides the maximum benefit, RCOs 2 and 3 give reasonable benefits for the budget spent. Therefore, decision-makers may have the option to execute RCO 2 at earlier stages or even execute RCO 3 to reduce risk while postponing RCO 1 to the dry dock since it requires a considerable amount of time, budget, and technical assistance.

Once the expected outcomes are presented to decision-makers in a comparative manner, they can visualize the effects and the percentage of benefits that they can expect by investing their budget. As shown in Figure 17, RCO 2 has the highest cost–benefit effectiveness, RCO 1 scores the next, and RCO 3 offers negative effectiveness. However, a combination of RCOs fluctuates their effectiveness between 1.1% and 5.2%.

The BN model designed for estimating occurrence probabilities has been validated through sensitivity analysis and the application of the set axioms. The formal safety assessment framework for ammonia fuel storage on ships has been demonstrated using quantitative estimates of costs, benefits, and risk reduction related to RCOs. It is important to note that these quantitative estimates are subject to uncertainties, which must be carefully considered in practical applications.

Ammonia is considered as one of the most promising alternative fuels for maritime energy transition due to its ability to combust with minimal carbon dioxide (CO₂) emissions. However, its use as a shipping fuel presents potential safety risks, including toxicity. It is essential for stakeholders in the shipping industry to fully understand the risks associated with ammonia as a fuel and to implement safeguards that can mitigate these risks to acceptable levels. Technologies that already have infrastructure in place and align with market needs are more likely to gain acceptance and see rapid adoption. If ammonia can be proven to be a cost-effective fuel option with manageable risks, it is expected to be widely adopted due to its low or zero emissions.

In addition, the relevant regulations and standards of the IMO and other international organizations regarding ammonia fuel have also exerted a significant influence on the application of ammonia on ships. Like many other net-zero technologies, the pace of green ammonia innovation is outpacing legislation and, currently, no specific regulations govern its use as a fuel. During this period of a legislative vacuum, the shipping-industry-related associations and enterprises are encouraged to take the lead in guiding the industry’s development and, at the same time, provide practical experience and references for legislation. The results of this study can provide valuable inputs for them to formulate industry self-discipline norms and standards.

5. Conclusions

This research aimed to create a formal safety assessment (FSA) system for ammonia fuel storage and usage on ships, providing insight into consequential events. Various aspects of ammonia fuel have been examined, and it is evident from the literature that research is needed to regulate ammonia life cycle emissions. Technologies should be improved to reduce NOx emissions from ammonia combustion while decreasing the nitrogen footprint. Furthermore, this particular compound has a high level of toxicity, which poses a significant risk not only to human beings but also to aquatic life.

At the same time, operations change the probability of an accident, which requires additional safety measures to maintain the risk in acceptable regions. The utilization of FSA is a practical approach to adapting to a wide range of risks that may vary based on location, weather, port congestion, and other factors. This methodology is recommended for decision making, enabling stakeholders to make logical decisions. Its flexibility also allows for integrating various combinations of RCOs, providing a broad overview of recommendations and their optimal benefits.

There are limitations in the use of the developed approach. One limitation is that only the significant events that are considered in the Bayesian network contribute to the analysis that is conducted, with those not included in the network having no effect in the decision-making process. Another limitation is that, in order to obtain CPTs of child nodes with multiple parent nodes, it is often time-consuming, and simplifications of the associated complexities that often compromise the assessment accuracy would be needed. Furthermore, the reliance of expert judgment to estimate conditional probabilities and define dependencies between variables, especially when empirical data are limited, usually introduces bias, subjectivity, and inconsistency. Lastly, while the framework has been validated in a number of ways, it cannot be fully validated by comparison with proven benchmarks, as such benchmarks are not available. It is widely acknowledged that new models should ideally be introduced into a commercially stable environment, allowing the application to become established and prove feasible; otherwise, there is a risk that its full potential may not be realized.

Further studies are necessary to improve the BN structure for prognostic and diagnostic analysis. This involves applying all failure data and the relationship between events from credible sources, as numerous studies suggest that minimizing dependency on expert judgment is essential during the development of the BN modules. It is also recommended that the current onboard risk assessment domain be substituted with a digital FSA structure based on a Bayesian network. This is a more advanced alternative to the traditional paper-based risk assessments currently used aboard most ships. With this, operators can edit ongoing operations and assess the changing risk factors of each particular operation. Moreover, in order to adapt to changing risk factors in real time and make more accurate and efficient assessments of potential hazards, real-time data integration technologies, especially IoT sensors and shipboard monitoring systems, should be considered in dynamic risk assessment. The BN can be used to monitor the performance of the system on a real-time basis. When any observation or evidence is collected or obtained, the BN can help to update the estimation of risks.