Risk Assessment Method for Flooding Incident Emergency Operating Procedure Considering Mutual Dependence Between Human Error and Available Time

Abstract

An emergency operating procedure (EOP) for flooding incidents is used to assist crews in preventing ships from capsizing. However, under a flooding scenario, failure to complete the EOP within a limited time may result in the risk of capsizing. Human performance is the major factor in the EOP execution process, which is influenced by available time. There is a mutual dependence between human error and available time: (a) shorter available time will increase time pressure and the human error probability (HEP); (b) human error will either be recovered, which may require more response time and result in shortened available time, or be uncorrected, which may worsen the system state and reduce the time limitation, thereby shortening the available time. This mutual dependence can affect EOP risk, which is not considered in current studies. This paper proposes a method based on a Dynamic Bayesian Network (DBN) to assess EOP risk considering this mutual dependence. To model the mutual dependence, a continuous SPAR-H method is proposed in the intra-slice network to determine the conditional probability distribution of human error for dependence (a), and a dynamic available time model is proposed in the inter-slice network to determine the conditional probability distribution of available time for dependence (b). The Ro-Ro flooding incident is used to illustrate the proposed method.

1. Introduction

Flooding is one of the largest contributors to marine accidents, accounting for 23% of all casualties between 2014 and 2020 [1,2]. In order to ensure the rapid and effective implementation of emergency response actions in flooding incidents, an emergency operating procedure (EOP) is usually pre-established. The EOP makes prearrangements for emergency personnel, equipment, actions, etc. [3], which can guide crew members to prevent the escalation of flood incidents and mitigate the consequences of such accidents. However, time is limited when implementing the EOP for flooding incidents, usually between 20 and 30 min [4,5]. As the flooding time increases, the water will create a large free surface inside the ship, which can significantly affect the stability of the vessel and cause it to list [6]. Therefore, failure to complete the EOP within the limited time may lead to serious financial loss and casualties [7]. For example, in the MV Estonia accident, the crew failed to complete the EOP within the limited time, resulting in 852 fatalities [4]. In the Sewol accident, the captain made inappropriate decisions and failed to promptly implement the EOP, ultimately causing the Ro-Ro passenger ship to capsize within 18 min [6]. As a result, it is important to incorporate the limited time into the risk assessment of an EOP for flooding incidents.

In the execution of an EOP for flooding incidents, human error is a significant contributor to EOP failure [8,9]. When human error occurs, personnel may spend additional recovery time (e.g., when personnel open the wrong emergency bilge valve, they need to spend additional time closing the wrong valve and opening the correct one), or the error may not be recovered in time, which can result in the ineffectiveness of the necessary emergency functions, thereby worsening the system state and decreasing the time limitation for EOP execution (e.g., failure to open the emergency pump may reduce the outflow velocity, thus accelerating the ship’s capsizing). The increased personnel response time and the decreased time limitation can dynamically shorten the available time for subsequent tasks, thereby increasing the time pressure on personnel. Time pressure is a significant factor influencing human error, as it can facilitate the occurrence of mistakes. In some human reliability methods such as the Cognitive Reliability and Error Analysis Method [10,11,12,13] and the Standardized Plant Analysis of Risk–Human Reliability Analysis (SPAR-H) [14,15], it is considered as one of the performance shaping factors (PSFs). Time pressure will become greater as the available time decreases, which in turn increases the human error probability (HEP). Therefore, there is a mutual dependence between human error and available time: (a) shorter available time may increase time pressure and thus increase the occurrence probability of human error; (b) human error may increase the response time or shorten the time limitation, thereby shortening the available time for subsequent tasks. This mutual dependence can cyclically increase the EOP risk and should be incorporated into the risk assessment of flooding incident EOPs.

Currently, the assessment of EOPs has been widely studied. Some studies have focused on subjective assessment by constructing indicators. They developed a series of models to evaluate an EOP in terms of effectiveness, robustness, and so on, to subjectively assess the elements of the EOP [16,17]. Such studies are based on expert experience and historical data, enabling the multidimensional analysis of EOPs. Some studies have employed methods such as the System-Theoretic Accident Model and Process (STAMP) [18] and the Functional Resonance Analysis Method (FRAM) [19] to conduct qualitative evaluations of emergency response. By developing systematic frameworks, these studies identify potential risks and vulnerabilities in emergency response processes. Other studies have focused on the temporal analysis of EOP. In these studies, the effectiveness of the EOP is highly dependent on the response time of the action [20], and emergency actions are considered as continuous processes. They have redefined time as the assessment criterion, and used methods such as Monte Carlo [3,21], Markov [22] and Petri-net [23,24,25,26] to simulate the personnel response time and assess the probability of the EOP being completed within the limited time. These studies effectively capture the importance of time; however, they have yet to consider the impact of time on human errors and the human–machine interaction process.

In order to consider the impact of human and machine factors on the system, some studies have used probabilistic risk assessment (PRA) methods to analyze the EOP risk. Conventional PRA methods characterize the deterministic relationships between risk factors that combine to form various risk scenarios. This is achieved using Boolean logic methods, such as event trees (ETs) and fault trees (FTs) [27]. The Boolean logic-based ET-FT approaches have proven to be very effective in analyzing risks in complex systems with deterministic causal relationships [28]. To model complex systems with non-deterministic causal factors, Mosleh et al. [29] proposed the Hybrid Causal Logic (HCL) modeling method. The HCL method combines the Boolean logic-based PRA methods with the Bayesian Network (BN) approach as a multi-layer modeling approach. Wang et al. [30] applied the HCL method to the emergency response in ship collision accidents. Zhang et al. [31] used the HCL method to assess the emergency response in contact scenarios involving maritime autonomous surface ships. However, the BN in HCL is unable to capture the dynamic changes of variables over time [32], making it incapable of modeling the mutual dependence present in emergency response processes.

Dynamic Bayesian Network (DBN) is an extension of BN over time, addressing the limitations of BN in dynamic analysis. This method allows the incorporation of events, conditions, and interrelationships that may change over time [32]. Currently, DBN is widely applied in the emergency response assessment of marine accidents. Wang et al. [33] assessed the dynamic risk of riserless well intervention systems performing the plugging and abandonment action based on DBN. Liu et al. [34] comprehensively considered the risk factors leading to blowout accidents and established a DBN model for emergency operation assessment. An et al. [35] integrated the STAMP with DBN to evaluate emergency operations for deepwater blowout accidents. Liu et al. [36] proposed a hybrid approach that incorporates DBN with the Graphical Evaluation and Review Technique to achieve hybrid assessment and optimization of emergency plans. Guo et al. [37] combined the FRAM with DBN to assess the risk of emergency response processes in ship collision scenarios.

To address the mutual dependence between human error and available time in the EOP, this paper proposes a mutual dependence model based on DBN. This model includes dependence (a) and dependence (b). To model dependence (a), this paper proposes a continuous SPAR-H method, which models the HEP as a linear function due to the continuous time pressure caused by the available time. To model dependence (b), this paper proposes a dynamic available time model, where the response time is regarded as a continuous variable, and the response time and time limitation depend on whether human error occurs or is recovered. In DBN, each time-slice represents the failure logic of a subtask in the EOP, and the connections between time-slices represent the failure evolution logic between subtasks. The continuous SPAR-H method is used to determine the conditional probability distribution (CPD) of human error in the intra-slice network of DBN, and the dynamic available time model is used to determine the CPD of available time in the inter-slice network of DBN. Based on the mutual dependence model, this paper proposes a risk assessment method for EOP and takes the Ro-Ro ship Estonia flooding incident as an example to establish the DBN model for analysis and discussion.

The contributions of this study are summarized as follows. This is the first work to investigate the mutual dependence between human error and available time in the risk assessment of flooding incident EOP, and a mutual dependence model is proposed based on the DBN. In the mutual dependence model, a continuous SPAR-H method is proposed to determine the CPD of human error for dependence (a), and a dynamic available time model is proposed to determine the CPD of available time in the next time-slice for dependence (b).

The paper is organized as follows. Section 2 introduces the DBN model and the SPAR-H method. Section 3 describes the mutual dependence between human error and available time in the EOP, and proposes the mutual dependence model based on DBN and the risk assessment method for EOP. Section 4 takes the Ro-Ro ship flooding incident EOP as an example to develop and discuss the proposed method. Section 5 presents the conclusions of this study.

2. Background of Research Methods

This paper focuses on the mutual dependence between human error and available time, and the impact of this mutual dependence on the EOP risk. Before presenting the proposed risk assessment method, this section gives a brief introduction to the DBN with continuous variables, which is used to describe the mutual dependence and dynamics of the system, and the SPAR-H method, which is used to quantify the HEP.

2.1. DBN

A DBN is a stochastic model with the ability to handle time series data, taking full account of the effect of time in the study of uncertainty problems [38]. Similar to BNs, DBNs are represented as a set of variables and their conditional dependencies by directed acyclic graphs. A DBN consists of multiple BNs, and each BN corresponds to a time-slice [39]. Compared with BN, the conditional probabilities of DBN are more complex. BNs can only be used to represent relationships between variables in the same time-slice, whereas DBNs can be used to represent relationships between variables in different time-slices [33]. DBN can be represented as $\left(B_0,B_{\to }\right)$, where $B_0$ is the initial Bayesian network, defining the prior distribution $P\left(X_{t=1}\right)$ of the variables; $B_{\to }$ is the transfer network, defining the transfer model from time-slice $t-1$ to $t$ with conditional probabilities of

$$P\left(X_t|X_{t-1}\right)={\displaystyle {\prod }_{i=1}^{n}P\left(X_i^t|pa\left(X_t^i\right)\right)},$$

(1)

where $X_t^i$ is the node of time-slice $t$; $pa\left(X_t^i\right)$ is the parent node of $X_t^i$, which may be the node of the same time-slice or the node of the previous time-slice. When the nodes in a DBN are discrete variables, the network is referred to as a discrete DBN; when the nodes in a DBN are continuous variables, the network is referred to as a continuous DBN. For a simple network containing three nodes ($X_1$ and $X_2$ are the parents of $Y$), when the nodes are continuous variables, the marginal probability distributions of the parents $X_1$ and $X_2$ can be directly specified according to experience, and the CPD of the child nodes Y can be determined through linear or nonlinear regression analysis. The CPD can be represented in two ways: (1) $Y=f\left(X_1,X_2\right)+\epsilon$, where $f\left(·\right)$ represents a linear or nonlinear function of $X_1$ and $X_2$, and $\epsilon$ represents a random variable; (2) $Y|X_1,X_2~N\left(\mu ,{\sigma }^2\right)$, where $\mu =f\left(X_1,X_2,\alpha \right)$ with coefficients $\alpha$ [40]. In this paper, a continuous DBN is used for modelling the network, and the first way is applied to represent the CPD.

2.2. SPAR-H

The SPAR-H method has been developed to estimate the HEP associated with the diagnosis and actions of crews. The method sets the nominal human error probability (NHEP) for two tasks, with NHEP = 0.01 for the diagnostic task and NHEP = 0.001 for the action task. Based on the NHEP, the PSFs will modify the HEP. Time is used as one of the PSFs in the SPAR-H method and will directly affect the HEP. In addition, stressors, experience and training, complexity, ergonomics, including human–mechanical interfaces, procedures, fitness for duty, and work processes, are all considered as PSFs to modify the HEP [41]. When the levels of the eight PSFs are determined, the final HEP is the product of the nominal HEP and the multipliers of the PSFs, which is expressed as

$$HEP=NHEP\times {\displaystyle {\prod }_{i=1}^{8}PS{F}_i},$$

(2)

$$HEP={\displaystyle \frac{NHEP\times {\displaystyle {\prod }_{i=1}^{8}PS{F}_i}}{NHEP\times \left({\displaystyle {\prod }_{i=1}^{8}PS{F}_i}-1\right)+1}}.$$

(3)

The calculation of HEP depends on the number of negative PSFs (i.e., the PSF with a multiplier greater than 1). When the number of negative PSFs is less than three, HEP is calculated with Equation (2). When three or more negative PSFs are present, HEP is calculated with Equation (3).

SPAR-H has been widely used to assess human reliability in marine emergency tasks. For example, Ahn et al. [41] evaluated the reliability of the human involved in the emergency task of the rescue boat drill based on SPAR-H with a fuzzy multiple attribute group decision-making method. Parhizkar et al. [42] applied the SPAR-H method to estimate the effect of PSFs on the HEP to assess the risk of decision making in emergency situations of dynamically positioned drilling units.

3. Methodology

This section analyzes the mutual dependence between human error and available time in EOP, and develops a mutual dependence model based on DBN. In the mutual dependence model, a continuous SPAR-H method and a dynamic available time model are proposed to model the dependence (a) and the dependence (b), respectively. To evaluate the EOP risk considering the mutual dependence, this section introduces the framework of the risk assessment method based on the established model.

3.1. Modeling the Mutual Dependence in the Execution of EOP

To effectively prevent the escalation of the incident, EOP is usually developed in advance and takes the form of a brief flowchart or checklist to help the crew understand the required emergency tasks during the response process, thus reducing errors of the crew [43]. Typically, EOP is required to include (1) operating procedures for the full range of possible accident scenarios, including methods to protect life, the marine environment, and property; (2) the responsibilities of personnel, including master, chief engineer, chief officer, etc.; (3) information on the availability and location of response equipment; (4) procedures for reporting and communicating on board and so on [43]. However, the operating procedures in EOP need to be executed within a limited time, i.e., personnel have a defined amount of available time to perform the operation. Human factors play an important role in the execution of EOP, and there is a mutual dependence between human error and available time.

3.1.1. The Mutual Dependence Between Human Error and Available Time

In the execution of EOP, human error and available time are mutually dependent, as shown in Figure 1: (a) shorter available time may increase time pressure and thus increase the occurrence probability of human error, as shown by the blue arrows; (b) human error may increase personnel response time or shorten time limitation, further shortening the available time for subsequent tasks, as shown by the red arrows.

(1)

Dependence (a): Available time affects human error. During the execution of the EOP, the available time for a task can be defined as the difference between the time limitation of all tasks in the EOP and the response time spent on preceding tasks. Shorter available time can induce emotions such as tension and anxiety, serving as factors triggering time pressure [40]. Time pressure is a significant factor influencing human error [41] and is incorporated as one of the PSFs in many HRA methods to adjust the HEP. It will become higher as the available time decreases. Higher time pressure can have a negative impact on personnel’s psychological state, triggering emotions such as anxiety and stress, which in turn weaken cognitive functions and operational performance [42]. HRA methods, such as SPAR-H, categorize time pressure into several levels to evaluate its effect on human error. At the highest level of time pressure, it is assumed that operators have no time to carry out the required actions, making human error nearly unavoidable. Conversely, at the lowest level, it is assumed that the operator has sufficient time to complete the task and that the time pressure has no effect on the task execution [38].

(2)

Dependence (b): Human error affects available time. Human error can dynamically affect available time in two ways, depending on whether the error is recovered. On the one hand, when human error occurs, personnel may discover and recover the error [43]. This requires personnel to respond again and spend more time on the task. For example, in the EOP of the flooding incident, if a crew member opens the wrong valve when opening the emergency bilge pump and notices the error, the crew needs to spend additional time closing the wrong valve and opening the correct one. The longer the response time for the current task, the shorter the available time for subsequent tasks. On the other hand, if the personnel fail to detect the error, the required emergency function will not be activated effectively. This will worsen the system state and shorten the time limitation for EOP execution, which in turn will shorten the available time for subsequent tasks. For example, according to SOLAS regulations, when adjacent compartments or multiple compartments are flooded simultaneously, a roll angle of 12° can be tolerated, while a single compartment flooding allows a roll angle of 15° [44]. Failure to close the watertight door will reduce the maximum tolerable heeling angle of the ship and accelerate the capsizing of the ship, thus shortening the time limitation and the time available for personnel to execute subsequent emergency tasks.

3.1.2. Modeling Dependence (a)

As described in Section 3.1.1, available time affects human error by influencing time pressure. Available time determines the level of time pressure. To quantify time pressure, researchers generally (1) compare the required time to complete the task with the available time to maintain system safety, or (2) calculate the time interval between the required time and the available time [44]. In this study, Siegel et al.’s time pressure formula [45] is employed to calculate time pressure, which can be expressed as

$$T_P=T_R/T_A,$$

(4)

where $T_P$ is time pressure, the time required $T_R$ is the time needed to execute subsequent subtasks and the available time $T_A$ is the time available to execute the subsequent subtasks.

Considering that time pressure may be a continuous variable under the influence of continuous available time, HEP should follow a linear function [42] to make it continuous with time pressure. Therefore, this paper proposes a continuous SPAR-H method to model the dependence (a). In the continuous SPAR-H method, the HEP at each level is connected to follow a linear function [42], as shown in Figure 2. The multipliers of time at different levels in the SPAR-H method are shown in

Table 1. SPAR-H time multipliers for action tasks.

SPAR-H Levels	Multipliers
Inadequate time	-
Barely adequate time: 1/3 the average time	50
Barely adequate time: 2/3 the average time	10
Nominal time	1

[14]. Based on Equations (2) and (3) in Section 2.2, it can be seen that the calculation of HEP depends on the number of negative PSFs. In this paper, the continuous variation of HEP with time pressure is analyzed for different amounts of negative PSF. Detailed formulas for calculating HEP at different numbers of negative PSFs are shown in Appendix A.

3.1.3. Modeling Dependence (b)

As described in Section 3.1.1, human error may increase personnel response time or shorten time limitation, causing the available time to dynamically change as the task progresses. Therefore, this paper proposes a dynamic available time model to model the dependence (b). On the one hand, when human error occurs, personnel may recover the error, which increases the personnel response time. Due to the uncertainty of human behavior [46], the personnel response time is regarded as a continuous variable [42]. According to the literature review, the normal response time $R_T$ follows the gamma distribution [47], as shown in Figure 3. The gamma distribution is a two-parameter category of continuous probability distributions, and the response time $R_T$ without human error for the i-th subtask can be expressed as

$$R_{T,i}\left(x|\neg H{E}_i\right)={\displaystyle \frac{{\beta }^{\alpha }{x}^{\alpha -1}{e}^{-\beta x}}{\Gamma \left(\alpha \right)}},$$

(5)

where $\alpha$ is the shape parameter, usually taking values between 2 and 3 [47], $\beta$ is the inverse scale parameter, $\neg H{E}_i$ represents that no human error occurs in the i-th subtask. After a human error occurs, personnel need to detect and take corrective action, which may result in the time required for the current subtask doubling or even more, thereby affecting the response time parameters. The response time when the i-th subtask experiences human error and the error is recovered can be expressed as

$$R_{T,i}\left(x|H{E}_i,D_i\right)={\displaystyle \frac{{\beta }^{\alpha }{x}^{\alpha -1}{e}^{-\beta x}}{\Gamma \left(\alpha \right)}}+{\displaystyle \frac{{\left(\lambda \beta \right)}^{\alpha }{x}^{\alpha -1}{e}^{-\lambda \beta x}}{\Gamma \left(\alpha \right)}},$$

(6)

where $H{E}_i$ represents that a human error occurs in the i-th subtask, $D_i$ represents that the human error is detected and recovered, and $\lambda$ represents the parameter coefficient of the response time used to recover the error, depending on the personnel and environmental characteristics.

On the other hand, if human error is not detected and recovered, the response time distribution will be the same as when no human error occurs, i.e., $R_{T,i}\left(x|H{E}_i,\neg D_i\right)={\displaystyle \frac{{\beta }^{\alpha }{x}^{\alpha -1}{e}^{-\beta x}}{\Gamma \left(\alpha \right)}}$. If the human error is an omission, the personnel will not spend time on this task, which also results in $R_{T,i}\left(x|H{E}_i\right)=0$. As described in Section 3.1.1, human error or machine failure can result in the ineffectiveness of necessary emergency response functions, which will worsen the system state and shorten the time limitation for the execution of the EOP. The shortened time limitation can be expressed as

$$\Delta f_{L,i}=\begin{array}{cc}{f}_{L,i}\left({\Theta }_i|1_{i-1}=1\right)-f_{L,i}\left({\Theta }_i|1_{i-1}\right)& i=\left\{2,\dots ,n\right\}\end{array},$$

(7)

where $1_{i-1}$ represents the state of the i − 1-th subtask. $1_{i-1}=1$ and $1_{i-1}=0$ represent the successful and failed execution of the i − 1-th subtask, respectively. The success or failure of the subtask depends on the impacts of human errors and machine failures. $\Theta$ represents a set of parameters that influence the time limitation, and the values of these parameters change based on the execution state of the subtask. Different values of the parameters will result in variations in the calculated time limitation. $f_{L,i}\left(·\right)$ measures the time limitation $T_{L,i}$, and the function needs to be analyzed according to the specific incident scenario and can be determined through methods such as analytical calculations, simulations or experiments. According to Equation (7), it can be inferred that when the i − 1-th subtask is successfully executed, the variation of the time limitation is zero.

For the first task, the time limitation of EOP execution is the personnel’s available time. For subsequent tasks, the available time continues to change dynamically. If no human error occurs, the time limitation for EOP execution remains unchanged, and the personnel’s available time is the difference between the personnel’s available time and the response time in the previous task. In contrast, if a human error occurs, the time limitation for EOP execution will change, and the personnel’s available time will need to be further adjusted by calculating the shortening of the time limitation. If the response time of the previous task exceeds the available time, the available time for subsequent tasks will be set to zero. Therefore, the personnel’s available time for the i-th subtask can be expressed as

$$T_{A,i}=\left\{\begin{array}{cc}{T}_{L,i}& ifi=1\\ \max \left(T_{A,i-1}-R_{T,i-1}-\Delta f_{L,i},0\right)& ifi=\left\{2,\dots ,n\right\}\end{array}\right..$$

(8)

3.1.4. Modeling Mutual Dependence Based on DBN

To model the mutual dependence within EOP, this paper establishes a DBN model that incorporates both dependence (a) and dependence (b), as shown in Figure 4.

EOP often consists of multiple subtasks that are performed with multiple risk factors, including human error, machine failure, etc. In the DBN model of EOP, each time-slice represents the failure logic of a subtask in the EOP, and the risk factors such as human error and machine failure in the subtask are represented as nodes in the intra-slice network. The connections between subtasks across time-slices represent the fault evolution logic between emergency response tasks and are modeled as inter-slice networks within the DBN. The logical relationship between risk factors can be defined through conditional probability tables (CPTs). The probability modeling process of the DBN is illustrated in Figure 5.

For dependence (a), shorter available time will increase the occurrence probability of human errors within the same time-slice by increasing the time pressure. Therefore, this paper adds the nodes pointed to by the blue arrows into DBN’s intra-slice network to model dependence (a). Among them, the continuous variation of time pressure is influenced by the available time and time required, while time pressure and the levels of other PSFs can affect the occurrence of human error. The continuous SPAR-H method proposed in Section 3.1.2 can be used to quantify dependence (a). The CPD of time pressure can be determined according to Equation (4), and the CPD of human error can be determined according to Equations (A1) and (A2).

For dependence (b), human error can shorten the available time in the next time-slice by increasing the personnel response time or decreasing the time limitation. Therefore, this paper adds the nodes pointed to by the red arrows into DBN’s inter-slice network to model dependence (b). On the one hand, human error affects the response time within the current time-slice, and thus affects the available time within the next time-slice. On the other hand, human error affects the progression of the incident by affecting the state of the subtasks, which in turn affects the available time by affecting the time limitation of the EOP within the next time-slice. The dynamic available time model proposed in Section 3.1.3 can be used to quantify dependence (b). The CPDs of the personnel response time and the time limitation can be determined by Equations (5) and (6) and Equation (7), respectively, with their CPDs influenced by human errors and subtask states. The CPD of the available time can be determined by Equation (8).

3.2. The Framework of the Risk Assessment Method for EOP with the Mutual Dependence

This paper proposes a DBN-based method for the risk assessment of EOP with the mutual dependence. The framework of the method is shown in Figure 6, and consists of four main steps. The details of each step are presented in this section.

Step 1: EOP analysis. Analyze the accident scenario and EOP to determine the risk factors associated with each subtask in the EOP, and the operational sequence between subtasks, which can provide the basis for subsequent modelling. By analyzing each subtask, various failure modes can be identified and their impact on the EOP can be assessed. In addition, subtasks in the EOP are not isolated, but follow a strict sequence or interdependence, i.e., the success or failure of one subtask can significantly impact subsequent tasks. When a subtask fails, other alternative subtasks usually need to be quickly adopted to prevent the incident.

Step 2: Qualitative modelling. The DBN includes both an intra-slice network and an inter-slice network. The intra-slice network describes the logical relationships between risk factors within each subtask, and the inter-slice network describes the sequential relationship between subtasks. The dependency structure of the network is established by linking nodes with directed edges, reflecting the logical relationships between risk factors. Considering the mutual dependence between human error and available time, dependence (a) is modelled in the intra-slice network to describe the effect of available time on human error, and dependence (b) is modelled in the inter-slice network to describe the effect of human error in the previous subtask on the available time in the next subtask.

Step 3: Quantitative modelling. In order to assess the EOP risk, the prior probabilities as well as the conditional probabilities in the DBN need to be determined. The prior probability of the root node can be set by consulting relevant literature, handbooks, or domain experts [48]. The CPTs for nodes without considering mutual dependence can be determined based on the system failure logic. The continuous SPAR-H method presented in Section 3.1.2 can be used to quantify the CPD of human error in dependence (a), and the dynamic available time model presented in Section 3.1.3 can be used to quantify the CPD of available time in dependence (b).

Step 4: Risk assessment. This study focuses on analyzing how the upstream and downstream coupling relationships [37], arising from continuous operations, influence the successful completion of all tasks within the specified time frame. As a result, the EOP risk can be reflected by evaluating the success probability of the final operation in the EOP. Based on the results of the assessment, sensitivity analysis of the elements involved in the EOP can be performed.

4. Case Study

The proposed risk assessment method for EOP with mutual dependence is demonstrated within the context of the Ro-Ro passenger ship Estonia flooding incident. Ro-Ro passenger ships tend to carry a large number of passengers and have fewer transverse bulkheads to facilitate the rolling of cargo [49]. They have poor sink resistance, and present more urgency in flooding incidents. In September 1994, the Ro-Ro passenger ship Estonia sank in the Baltic Sea, and the accident resulted in 852 deaths [4]. In order to apply the proposed method, this paper uses the data from this Ro-Ro passenger ship case to assess the EOP risk.

4.1. The Flooding Scenario

The flooding scenarios for ships are generally categorized into three types [50]: (1) no free surface water inside the flooded compartment; (2) the presence of a free surface inside the flooded compartment that is not connected to the external environment; (3) water level inside the flooded compartment remains at the same level as the sea outside the ship. Different flooding scenarios have different effects on ships. This paper takes the second type of flooded compartment as an example and assesses the case. The schematic diagram for the second type of flooded compartment is shown in Figure 7.

In Figure 7, $WL$ and $W{L}_1$ represent the waterline before and after flooding, respectively. $c\left(x,y,z\right)$ is the gravity center of the flooded compartment, and $\delta d$ represents the average draft increment of the ship after flooding. In flooding incidents, the ship will experience a heeling angle caused by the water ingress. The stability of the ship will be destroyed when the ship reaches a certain heeling angle, which is defined as the maximum tolerable heeling angle $\varphi$ [51]. Personnel need to successfully execute the EOP before the ship reaches this angle; otherwise, they will be required to evacuate the ship quickly due to the destroyed stability of the ship. Therefore, the time interval from the occurrence of the opening to the ship reaching its maximum heeling angle $\varphi$ is regarded as the time limitation for implementing the EOP [52]. Besides being related to the maximum tolerable heeling angle $\varphi$, the time limitation is also related to the inflow velocity $Q_{in}$ and the outflow velocity $Q_{out}$ of the ship [50]. A higher inflow velocity $Q_{in}$ or a lower outflow velocity $Q_{out}$ will accelerate the capsizing of the ship and shorten the time limitation [4]. Many scholars have explored flooding scenarios from different perspectives. Some have employed system dynamics approaches to simulate the evolution of system states over time [53,54,55], while others have used analytical methods to perform deterministic calculations of flooding processes [56]. In this study, the primary focus is on the mutual dependence between human error and available time. Therefore, the analysis of the flooding scenario is simplified to an estimation of water ingress into the compartment using Bernoulli’s theorem. A detailed explanation of this estimation process is provided in Section 4.2.

4.2. Application of Proposed Method

4.2.1. EOP Analysis

The EOP for Ro-Ro flooding incidents is intended to provide the crew with clear information on the operating procedures so that, in the event of damage to the ship causing flooding, proper and effective actions can be taken to mitigate and recover the ship’s loss of stability. At present, several organizations have issued EOPs for flooding incidents. For example, the Australian Maritime Safety Authority states the emergency procedure for ship flooding, and SQE Marine issued the flooding emergency checklist. The guidance document for damage control plans proposed by the International Maritime Organization states that all watertight devices should be closed immediately after damage occurs, the safety of persons on board should be established and the main water pump should be initiated to control the ingress of water [57]. Based on these, this paper only considers the main operating procedures of the master in the flooding incident EOP:

(i)

detect the alarm;

(ii)

close watertight doors remotely;

(iii)

close watertight doors on site if (ii) fails;

(iv)

open the emergency bilge pump;

(v)

plug the leak.

During the execution of subtask (i), if the alarm device malfunctions [10], the crew will be unable to detect emergencies, resulting in a direct failure of emergency response. If the alarm device works properly but the crew does not detect the alarm in time, it will increase the response time of the subtask and affect the process of the emergency operation task.

During the execution of subtasks (ii) and (iii), if there is an electrical system failure (occurring during the remote closing process) or a structural failure (occurring during the onsite closing process), the crew will be unable to close the watertight doors to prevent flooding from spreading to other compartments [51,58]. If the relevant machine is working properly but the crew neglects to close the watertight doors, flooding will also spread to other compartments. Therefore, in both of these subtasks, the consequences of human error and machine failure are consistent. Personnel will no longer spend response time in these tasks when human error and machine failure occur.

During the execution of subtask (iv), if there is a mechanical failure or electrical system failure in the pump [59], the crew will be unable to activate the pump to drain floodwater from the vessel. At this point, the crew is no longer spending response time on this subtask, but the time limitation is also relatively short. If the equipment associated with the emergency pumps is in normal condition, the crew may also mistakenly turn on the wrong pump due to the proximity of the valve, resulting in additional response time to compensate for the error.

During the execution of subtask (v), if the plugging equipment is missing or damaged [60], and the rate of water inflow exceeds the rate of water outflow, the emergency response will fail and the crew will need to evacuate the damaged vessel quickly. If the plugging equipment is intact but the crew plugs the leak incorrectly, resulting in the response time exceeding the time limitation, the consequences are the same as the former.

4.2.2. Qualitative Modeling

Based on the EOP analysis in Section 4.2.1, machine failures and human errors for each subtask are modelled as nodes in the DBN’s intra-slice network, with directed edges representing the relationships between these nodes. The occurrence of either human error or machine failure can lead to the failure of the subtask. In addition, according to dependence (a), the available time affects the human error by influencing the time pressure along with the required time. For the first time-slice, the time limitation for EOP execution is the personnel’s available time. As the task progresses, available time gradually decreases.

The connections between time-slices represent the failure evolution logic between subtasks and are modeled as inter-slice networks within the DBN. Due to the uncertainty in the execution of EOP subtasks, the failure of one subtask may necessitate compensatory actions by other subtasks, while the successful execution of that subtask might render these additional tasks unnecessary. Therefore, in addition to the typical “Success” and “Failure” states, each subtask should also include a “Null” state to account for situations where the task is not executed. In the flooding incident EOP, if “close watertight doors remotely” is successfully executed, “close watertight doors on site” is not required, and the state of this action is “Null”. In addition, according to dependence (b), the human error affects the time limitation and the available time in the next time-slice by affecting the task state as well as the response time in the previous time-slice.

Based on the modelling steps provided in Section 3, the DBN for the flooding incident EOP can be constructed as shown in Figure 8. The blue nodes and arrows indicate dependence (a), while the red nodes and arrows indicate dependence (b). The EOP risk is defined as the failure probability of “plug the leak”.

4.2.3. Quantitative Modeling

In order to quantify the DBN model, this paper determines the prior probabilities of the root nodes, and establishes the continuous SPAR-H method and the dynamic available time model for flooding incidents to determine the CPDs of the nodes in dependence (a) and dependence (b), respectively. The occurrence probability of the nodes related to the machine failures is shown in

Table 2. The occurrence probability of the machine failures.

Operating Procedure	Machine Failure	Probability	Sources
Detect the alarm	Sensor failure	1.22 × 10−7	[61]
	Hardware component failure	1.22 × 10−7	[61]
Close the watertight door remotely	Controller failure	1.22 × 10−7	[61]
	Switch failure	1.22 × 10−7	[61]
Close the watertight door on site	Bulkhead deformation	2.44 × 10−7	Assumed
	Deck deformation	2.44 × 10−7	Assumed
Open the emergency bilge pump	Hardware component failure	1.22 × 10−7	[61]
	Blocked pipe	1.22 × 10−7	[61]
	Controller failure	1.22 × 10−7	[61]
	Switch failure	1.22 × 10−7	[61]
Plug the leak	Lack of equipment	2.44 × 10−7	Assumed
	Leak plugging equipment breakdown	2.44 × 10−7	Assumed

.

(a)

Quantify dependence (a) with the continuous SPAR-H method

In the continuous SPAR-H method to quantify dependence (a), the available time and the required time determine the time pressure, while the time pressure and the level of other PSFs determine the HEP. In this paper, it is assumed that the multipliers of other PSFs are all set to 1. Under this condition, the CPD of the human error can be calculated using the following equations:

$$HEP=\left\{\begin{array}{ll}1-{\displaystyle \frac{2.85}{T_P}},\hfill & {\displaystyle \frac{1}{T_P}}<{\displaystyle \frac{1}{3}},\hfill \\ 0.09-{\displaystyle \frac{0.12}{T_P}},\hfill & {\displaystyle \frac{1}{3}}\le {\displaystyle \frac{1}{T_P}}<{\displaystyle \frac{2}{3}}.\hfill \\ 0.028-{\displaystyle \frac{0.027}{T_P}},\hfill & {\displaystyle \frac{2}{3}}\le {\displaystyle \frac{1}{T_P}}<1,\hfill \end{array}\right.$$

(9)

(b)

Quantify dependence (b) with the dynamic available time model

In the dynamic available time model to quantify dependence (b), human error on the one hand affects the available time by influencing the response time. Based on Section 3.1, it is known that the response time follows a gamma distribution [47]. This study collects the assessments of three experts in the field on the response time of each emergency response program. The Dempster–Shafer (D-S) theory of evidence is used to integrate the assessments of the three experts. The experts’ assessments of the response times for different emergency actions are presented in

Table 3. The experts’ assessments of the response times for different emergency actions.

Operating Procedure	Experts
	P1	P2	P3
Detect the alarm	[17, 21]	[18, 22]	[19, 23]
Close the watertight door remotely	[10, 12]	[9, 13]	[8, 11]
Close the watertight door on site	[56, 61]	[58, 64]	[59, 65]
Open the emergency bilge pump	[15, 18]	[16, 19]	[18, 21]
Plug the leak	[287, 302]	[292, 312]	[300, 307]

. The basic probability assessments (BPAs) provided by the three experts are 0.85, 0.8, and 0.95. The detailed calculation procedure of D-S evidence theory can be obtained from the literature [62]. By applying the D-S theory of evidence to the integration of the experts’ data, we have obtained the mean values and associated parameters [47] of each emergency response procedure in the flood scenario, as shown in

Table 4. Parameters of the response time distribution.

Operating Procedure	Mean Value	$\mathit{\alpha }$
Detect the alarm	20	2.5
Close the watertight door remotely	10	2
Close the watertight door on site	60	2.5
Open the emergency bilge pump	18	2.4
Plug the leak	300	3

, and the corresponding gamma-distributed shapes of these response times as shown in Figure 9. This paper assumes that the recovery time is the same as the time taken for the initial execution of the task, i.e., the parameter coefficient $\lambda =1$.

On the other hand, human error can work with machine failures to cause the failure of subtasks and make necessary emergency functions ineffective, thereby reducing the time limitation for EOP execution and shortening the available time. According to Section 4.1, the maximum tolerable heeling angle $\varphi$, the inflow velocity $Q_{in}$ and the outflow velocity $Q_{out}$ can affect the time limitation [50]. Among these capsizing parameters, whether the watertight door is closed will affect the maximum tolerable heeling angle $\varphi$, and can be represented as [51]

$${\varphi }_j=\left\{\begin{array}{cc}12°,\hfill & 1_{j-1}=0\\ 15°,\hfill & 1_{j-1}=1\end{array}\right.,$$

(10)

where ${\varphi }_j$ represents the maximum tolerable heeling angle after the execution of the j − 1-th subtask “Close the watertight door”. The maximum tolerable heeling angle $\varphi$ determines the amount of water that the ship can tolerate [56], thereby determining the maximum tolerable water level $h_L$ that the flooded compartments can tolerate. The outflow velocity $Q_{out}$ depends on the power of the emergency bilge pump. Whether the emergency bilge pump is opened will affect the outflow velocity $Q_{out}$, and can be expressed as

$$Q_{out,m}=\left\{\begin{array}{cc}0,\hfill & 1_{m-1}=0\\ \mu ,\hfill & 1_{m-1}=1\end{array}\right.,$$

(11)

where $Q_{ou{t}_m}$ represents the outflow velocity after the execution of the m − 1-th subtask “Open the emergency bilge pump”. $\mu$ represents the power of the emergency bilge pump. Whether the leak is plugged will affect the inflow velocity $Q_{in}$, and can be expressed as

$$Q_{in,k}=\left\{\begin{array}{cc}{C}_{d}S\sqrt{2g\Delta H},& 1_{k-1}=0\\ 0,& 1_{k-1}=1\end{array}\right.,$$

(12)

where $Q_{i{n}_k}$ represents the inflow velocity after the execution of k − 1-th subtask “Plug the leak”. $C_d$ is the effective discharge coefficient of the opening, which is usually 0.66. $S$ is the area of the opening. $g$ is the acceleration of gravity. $\Delta H$ is the difference of water level on both sides of the opening [4,63]. The inflow velocity $Q_{in}$ and outflow velocity $Q_{out}$ determine the rising rate of the water level inside the flooded compartments, which can be expressed as $q={\displaystyle \frac{dh}{dt}}={\displaystyle \frac{Q_{in}-Q_{out}}{A\prime \mu }}$. Therefore, the time limitation for the flooding scenario can be expressed as

$$T_{L,i}={\displaystyle {\int }_0^{h_L\left({\varphi }_i\right)}\frac{A\prime \mu }{Q_{in,i}-Q_{out,i}}}dh,$$

(13)

where $h_L\left({\varphi }_i\right)$ represents the maximum water level height that the flooded compartment can tolerate under the condition of the maximum tolerable heeling angle of ${\varphi }_i$. The detailed calculation process is provided in Appendix B. Equation (13) can be substituted into Equation (8) to calculate the CPD of the available time. The main dimensions for the passenger ship Estonia are given in

Table 5. The main dimensions of the passenger Ro-Ro ship Estonia.

Dimension	Value	Sources
$\mathrm{The\; permeability\; of\; the\; compartment}\mu$	0.85	[51]
$\mathrm{The}\mathrm{transverse}\mathrm{stability}\overline{GM}$	1.17 m	[64,65]
$\mathrm{Length\; of\; the\; ship}L$	137.4 m	[64,65]
$\mathrm{Width\; of\; the\; ship}B$	24.2 m	[64,65]
$\mathrm{Draught\; depth}H$	5.4 m	[64,65]
$\mathrm{Length\; of\; the\; watertight\; compartment}l$	6 m	Assumed
$\mathrm{Width\; of\; the\; watertight\; compartment}b$	5 m	Assumed
$\mathrm{Area\; of\; the\; openings}S$	0.08 m2	Assumed
Flow rate of the emergency bilge pump	0.15 m3/s	[66]
$\mathrm{Maximum\; transverse\; heeling\; angle}\varphi$ (flooding in single compartment)	15°	[51]
$\mathrm{Maximum\; transverse\; heeling\; angle}\varphi$ (flooding in adjacent compartments)	12°	[51]

.

4.3. Result Analysis and Discussion

4.3.1. The Result of the Assessment

To simplify the calculation, this paper uses the commercially available software GeNIe developed by the Decision Systems Laboratory, University of Pittsburgh, Pittsburgh, PA, USA to quantify the joint distribution of DBN [67]. Based on the DBN model established in Section 4.2 and the relevant data from the case ship, the EOP risk is calculated as 9.4%.

Based on Section 3.1, it is clear that human error has mutual dependence on available time in the EOP for flooding incidents. This study compares the calculation results considering the mutual dependence with those of the existing method, which usually ignores the time limitation and the ensuing mutual dependence. The comparison of the results is presented in

Table 6. The EOP risk under different scenarios.

Scenario	The EOP Risk
With mutual dependence	9.4%
Without mutual dependence	4.1%

. When the time limitation and the ensuing mutual dependence are not considered, the EOP risk is 4.1%, which is 56% lower than the result with such considerations. This is because when the mutual dependence is not considered, the HEP will not change as the task progresses, i.e., the HEP will no longer increase as the task deadline approaches. Therefore, not considering the mutual dependence is not beneficial to the assessment of the EOP and may result in the crew underestimating the risk and missing the optimal escape time.

4.3.2. Sensitivity Analysis

Factors such as the size of the openings, the transverse stability, and the type of the flooded compartment can affect the time limitation for executing the EOP. The crew’s experience level can affect both the HEP and the personnel response time. This paper discusses the effect of these factors on the EOP risk and compares the differences with and without considering the mutual dependence.

(1)

Effect of the opening size

Openings in Ro-Ro ships can be classified as small openings, medium openings, large openings and cracks. Small openings usually refer to holes with an area of less than 0.05 m², and medium openings are usually between 0.05 m² and 0.2 m². Large openings are mainly caused by torpedoes, missiles, bombs, and other attacks, and are generally larger than 0.2 m². Among these, medium and large openings can cause a rapid loss of buoyancy [60]. This paper mainly analyzes the effect of the medium opening size on EOP execution, and the EOP risk under different opening sizes is shown in Figure 10.

The black and red lines in Figure 10 represent the EOP risk with and without considering the mutual dependence, respectively. Since the size of the opening in the damaged Ro-Ro ship will directly affect the inflow velocity Q_in of the floodwater, the EOP risk will increase as the opening becomes larger. However, it is worth noting that when the mutual dependence is considered, the EOP risk increases more rapidly, whereas without considering the time limitation and the ensuing mutual dependence, the risk increases more slowly. This is because, under the influence of the mutual dependence, human errors in the previous task influence the available time for the next task, thereby affecting the likelihood of human error in the subsequent task. As the size of the opening increases, the time limitation and the available time for personnel shorten, making human errors more likely and their impact on subsequent tasks more significant. When the mutual dependence is not taken into account, the slow increase in EOP risk is primarily due to the increased opening area affecting the stress levels of personnel at their initial state, leading to an increase in HEP. At the same time, without the mutual dependence, tasks become independent of each other, meaning that human errors in the previous task do not influence the likelihood of errors in subsequent tasks. When the opening area is less than 0.07 m², personnel have sufficient available time, resulting in lower time pressure and minimal impact from mutual dependence. Consequently, the differences in results between considering and ignoring mutual dependence are relatively small. As the opening area increases, the available time for personnel gradually decreases, and the effects of mutual dependence become more pronounced, leading to a growing difference in the results between the two methods.

(2)

Effect of the transverse stability

The initial transverse stability is one of the most important aspects of ship design, determining the vessel’s stability and resistance to heeling during lateral motion, directly impacting its safety during navigation. The influence of transverse stability is not only evident during the vessel’s normal operation but also becomes particularly significant when encountering unexpected situations. For instance, in adverse weather conditions or instances of water ingress, good transverse stability helps maintain vessel stability, reducing the risk of heeling and minimizing the likelihood of accidents. In general, large marine vessels usually have a high degree of transverse stability in order to remain stable in harsh sea conditions. However, some vessels may compromise a certain degree of transverse stability in exchange for increased cargo capacity or speed.

This paper compares the EOP risk under different initial transverse stability, as shown in Figure 11. The black and red lines in Figure 11 represent the EOP risk with and without considering the mutual dependence, respectively. It is evident that the EOP risk decreases with the improvement of transverse stability. Designers can maximize transportation efficiency while ensuring safety during the design process. However, it can be observed that when mutual dependence is considered, the EOP risk decreases more rapidly, while without considering the time limitation and the ensuing mutual dependence, the risk decreases more slowly. Consequently, as transverse stability decreases, the differences between the results with and without the mutual dependence become progressively smaller. This is because, with greater transverse stability, the available time for personnel increases, leading to a reduction in the HEP, which in turn lowers the likelihood of triggering interdependencies between tasks. When the transverse stability exceeds 1.3 m, personnel have relatively sufficient available time, and the impact of mutual dependence on task interdependencies becomes less significant for EOP risk. As a result, the difference between the two scenarios is minimal.

(3)

Effect of the compartment type

The compartments of the ship contain various components, equipment, machinery, and cargo, which already occupy a certain amount of space within the compartments. Therefore, the actual volume of water in the compartment is always less than the volume of the empty compartment. The ratio of them is referred to as the permeability. The size of the permeability depends on the purpose and configuration of the compartments, and the permeability of various compartments is listed in

Table 7. The permeability of various compartments.

Compartment Type	Permeability
Appropriated to stores	0.6
Occupied by machinery	0.85
Occupied by accommodation	0.95
Void spaces	0.95

[51].

This paper analyzes different scenarios of water leakage in various ship compartments and presents the EOP risk as shown in

Table 8. Comparison of EOP risk assessment results under different compartment types.

Compartment Type	With Mutual Dependence	Without Mutual Dependence
Appropriated to stores	4.5%	3.5%
Occupied by machinery	9.4%	4.1%
Occupied by accommodation	10.6%	4.2%
Void spaces	10.6%	4.2%

. Based on Table 8, it can be seen that the accident probability after water ingress in storage compartments is significantly less than the remaining three types of compartments. This is because the water level rises at a faster rate when the permeability is small. According to Bernoulli’s theorem, the inflow velocity $Q_{in}$ will become smaller as the water level rises. In the same amount of time, the volume of water ingress in compartments with lower permeability is less than in compartments with higher permeability, thereby providing more available time. In the event of a flooding incident, the crew can make an initial assessment of the incident based on the type of water ingress compartment. In addition, it is evident that the risk assessment results for the EOP are significantly lower when mutual dependence is not considered, compared to when it is accounted for. Moreover, this difference becomes more pronounced as permeability increases.

(4)

Effect of the crew’s experience level

Experienced crews often possess stronger adaptability and decision-making ability, enabling them to remain calm under pressure and respond quickly and correctly. Conversely, inexperienced crews may get into trouble due to a lack of experience, resulting in an inefficient emergency response and even causing the incident to expand. In the SPAR-H method, the experience level of the personnel is classified as high, normal, and low, with weights of 0.5, 1, and 3, respectively [68]. In this paper, the experience level of crew members is assumed to be normal in the case calculations. Different experience levels will have different effects on HEP. In addition, the experience level of the personnel will affect the response time, with weights of 0.78, 1, and 1.44 [69] corresponding to high, moderate, and low levels, respectively. Therefore, the mean response times of personnel under different experience levels are shown in

Table 9. Mean values of the response time distribution at different experience levels.

Operating Procedure	High	Normal	Low
Detect the alarm	15.6	20	28.8
Close the watertight door remotely	7.8	10	14.4
Close the watertight door on site	46.8	60	86.4
Open the emergency bilge pump	14.04	18	25.92
Plug the leak	234	300	432

. The response time distributions of personnel executing each operational procedure at different experience levels are shown in Figure 12.

By incorporating the above parameters into the model, the EOP risk under different crew experience levels can be obtained, as shown in

Table 10. Comparison of EOP risk assessment results at different crew experience levels.

Scenario	High	Normal	Low
With mutual dependence	1.3%	9.4%	55.7%
Without mutual dependence	1.1%	4.1%	25.9%

. The EOP risk is found to be 1.3% when crew experience is at a high level, representing an 8.1% reduction compared to the normal level. Conversely, when crew experience is at a low level, the EOP risk rises to 55.7%, an increase of 46.3% relative to the normal level. Therefore, enhancing the experience level of emergency personnel through regular training, simulation exercises, and knowledge updates is crucial for decreasing the risk of emergency response.

In addition, Table 10 demonstrates the EOP risk with and without considering the mutual dependence. It can be observed that when crew members have a high level of experience, the results exhibit negligible differences; when the experience level is normal, the differences are small; and when the experience level is low, the differences are more significant. This is because, when the mutual dependence is considered, the experience level influences both the HEP and the response time of personnel. In the case of lower experience levels, personnel tend to spend more time responding and are more prone to making errors, which will reduce the available time for subsequent tasks. When the time limitation and the ensuing mutual dependence are not considered, the experience level only considers the effect on HEP and the performance of the previous task has no effect on the next task.

4.3.3. Findings and Discussion

The method proposed in this paper takes into account the mutual dependence between human error and available time, and presents the EOP risk of a flooding incident obtained by the DBN-based method. The main difference between the proposed method and the existing method lies in the risk factors affecting the EOP risk, i.e., human error and available time, which are mutually dependent. This will result in (a) time pressure continuously changing over time under the influence of available time and increasing the HEP, and (b) human error resulting in uncertain response time and variable time limitation, which may decrease the available time. In the existing model, the influence relationships between risk factors are unidirectional, and the states of risk factors do not change over time [25,28,29]. Therefore, it cannot describe the mutual dependence. By comparing with the result obtained by the existing method, it can be found that the mutual dependence significantly affects the EOP risk. The proposed method can help crew members more accurately assess risk in emergency situations, avoiding delays in evacuation timing. It can also provide guidance in ship design or EOP design to ensure safe navigation.

The results of the assessment by the proposed method are probabilistic and can be updated by obtaining relevant information. The model presented in this paper is a generic form that can be easily extended to other time-limited tasks. It should be noted that the DBN in the model should be adapted to each system accordingly. However, the concepts and the steps to be followed should remain the same as in the proposed method, as described in Section 3. To further enhance the depth and accuracy of future research, advanced techniques such as machine learning and neural networks [70,71,72] could be integrated to improve the model’s capability in capturing complex patterns and dynamic dependencies in emergency scenarios.

5. Conclusions

This study considers the mutual dependence between human error and available time in the risk assessment of flooding incident EOP, and a mutual dependence model is proposed based on the DBN. To quantify the mutual dependence, this paper proposes a continuous SPAR-H method to determine the HEP given time pressure caused by available time, and a dynamic available time model to determine the available time of the subsequent tasks after calculating the increased response times or decreased time limitation caused by human error in the previous task. The continuous SPAR-H method and the dynamic available time model are used in DBN to calculate the CPD of human error and available time, respectively. To quantify the EOP risk, this paper proposes a framework for the assessment process, and builds a DBN model with the example of the Ro-Ro ship Estonia flooding incident. The model can be integrated into a crew decision support system to provide real-time risk assessment and decision-making assistance in the event of a flood. At the same time, the model can also help authorities evaluate existing emergency response procedures by simulating different scenarios and can provide support for developing more effective regulations and training programs.

To the best of our knowledge, this work is the first attempt to use the DBN model to assess the EOP risk considering the mutual dependence between human error and available time. Taking into account the effects caused by the mutual dependence, the EOP risk can be effectively studied, which is more realistic. However, there are limitations in this work. Firstly, the flooding rate modeling is relatively simple and does not take into account complex factors such as ship motion or dynamic environmental conditions. Future work may incorporate advanced techniques to enable more precise and dynamic modeling of flooding scenarios. Secondly, this paper only considers the dynamic effect of the time pressure on HEP. Consideration of multiple PSFs that change over time could improve the effectiveness of the risk assessment, so a further extension of the model could take into account the effect of fatigue, stress and other factors on HEP. Moreover, the 1994 Estonia Ro-Ro ship accident is selected due to the completeness and richness of the available accident investigation data. In future work, we plan to apply the proposed assessment method to modernized ships with more complex automation, enhanced safety systems, and updated operating procedures that would exhibit different human–machine interaction characteristics.