FSA-Based Fire Risk Assessment of Electric Vehicles on Korean Coastal Car Ferries: Expert-Elicited FTA–ETA Analysis with Vessel-Specific Cost–Benefit Evaluation

Abstract

Electric vehicle (EV) transport by ship is expanding beyond industrial logistics centred on automobile production, trade, and pure car and truck carriers (PCTCs) into daily transportation for island tourism, commuting, and essential mobility. According to Korea Maritime Transportation Safety Authority (KOMSA) vessel status data as of March 2026, 104 of 146 domestic passenger ships were car-ferry passenger ships, accounting for 71.2% of the fleet and operating on 75 of 99 designated routes nationwide. Korea Shipping Association (KSA) operational records show that the EV transport rate on these routes increased from 0.76% in 2024 to 1.21% in 2025, with some routes exceeding 2.0–4.7%. Unlike enclosed multi-deck PCTC vehicle spaces, Korean coastal car-ferry passenger ships generally have single-tier open vehicle decks and bow ramp gates. Crosswinds on open decks may reduce smoke detector activation probability by 60–75%. Although Article 97 of the Standard for Ship Fire-Fighting Appliance newly requires dedicated EV fire-fighting equipment for car-ferry ships, it remains primarily equipment-prescriptive and does not yet provide open-deck-specific performance requirements for wind-resistant detection, fixed EV-zone cooling, EV-designated stowage arrangements, or passenger–operator safety management obligations. This study applies the five-step International Maritime Organization (IMO) Formal Safety Assessment (FSA) procedure to support improvements to EV fire-fighting equipment standards for coastal car-ferry passenger ships. Hazard identification (HAZID) was conducted with a 15-member advisory panel, and probability elicitation was performed through a Delphi survey with 10 core experts, showing strong consensus (Kendall’s W = 0.74, p < 0.01). Fault tree analysis (FTA) and event tree analysis (ETA) probabilities were derived from the Delphi results and the international literature. H-07, representing wind-induced smoke dilution, was identified as the dominant single-point vulnerability within the detection-failure branch. Monte Carlo-based FTA–ETA analysis (n = 10,000) estimated annual fire frequencies of 5.9 × 10⁻², 1.8 × 10⁻¹, and 2.9 × 10⁻¹ yr⁻¹ at EV loading ratios of 10%, 30%, and 50%, respectively, with 2.47 expected fatalities per fire. Risk entered the IMO ALARP band above a 30% EV loading ratio and exceeded the maximum tolerable crew risk above 50%. The combined application of risk control options (RCOs) 2, 3, and 4 reduced annual expected fatalities by 85.6%. Based on these results, six RCOs and institutional recommendations are proposed, including strengthened safety management obligations for passenger ship operators.

1. Introduction

Global EV stock exceeded 40 million in 2023 and is projected to surpass 250 million by 2030 [1]. In the Republic of Korea, cumulative EV registrations exceeded 1.5 million in early 2026 under the 5th Basic Plan for Eco-Friendly Vehicles [2]. Car-ferry passenger ships are a key means of transportation for residents of island areas. According to vessel status data managed by the Korea Maritime Transportation Safety Authority (KOMSA) as of March 2026, 104 of the 146 domestic passenger ships were car-ferry passenger ships, accounting for 71.2% of the fleet, and they operated on 75 of the 99 designated routes nationwide [3]. According to nationwide domestic passenger ship vehicle transport records compiled by the Korea Shipping Association (KSA), the EV transport rate on these 75 car-ferry passenger ship routes increased from 0.76% in 2024, with 18,424 EVs out of 2,417,310 total vehicles, to 1.21% in 2025, with 14,596 EVs out of 1,209,159 total vehicles [4,5]. Several routes exceeded 2%, including Singi–Yeocheon (2.60%), Incheon–Deokjeok (2.59%), and Gaochi–Saryang (2.43%), while some routes, such as Gunsan–Gaeya (4.70%), exceeded 4%. The 2025 dataset covers the same 75 routes as the 2024 dataset and was extracted on 5 January 2026, before the annual reconciliation audit was completed; the substantial reduction in the recorded total vehicle volume therefore reflects an incomplete year-end tally rather than an actual decline in ferry traffic. The unit of analysis in this study is the EV penetration rate (EVs as a fraction of total transported vehicles), not the absolute EV count. Despite the reduction in recorded total vehicle volume noted above, the EV penetration rate rose from 0.76% to 1.21%, confirming robust EV demand growth on a rate basis. The penetration rate is therefore the appropriate and internally consistent metric for the forward-looking risk scenarios analysed here.

EV fire prevention has historically been researched and designed around the supply-chain—manufacturing quality control, cargo logistics protocols, and pre-delivery inspection—but is now expanding into user-operation contexts: island tourism and daily commuting via coastal car ferries [6,7,8,9,10]. This paradigm shift has three regulatory implications: (i) pre-boarding EV inspections must be redesigned as passenger safety procedures, (ii) ferry operators must bear direct responsibility for passenger–EV interactions on board, and (iii) safety management obligations must be strengthened.

The Formal Safety Assessment (FSA) of the International Maritime Organization (IMO; MSC-MEPC.2/Circ.12/Rev.2 [11]) is an international standard methodology for developing maritime regulatory improvements. It converts hazard identification and quantitative risk estimation into cost-adjusted recommendations and produces outputs that can be directly submitted as information documents to the Maritime Safety Committee (MSC) in the IMO rule-making process. However, in FSA studies based on expert judgement without accident data, methodological integrity requires that the resulting numerical values be clearly identified as expert-based estimates. In accordance with this principle, this study applies the FSA methodology to achieve two objectives: (i) to provide baseline evidence for revising Article 97 of the Standard for Ship Fire-Fighting Appliance [12]; and (ii) to generate international reference material for improving fire-fighting equipment standards in countries with coastal car-ferry passenger ships of similar structural characteristics, such as Japan, Greece, Norway, Indonesia, and the Philippines. Previous FSA studies have addressed Ro-Ro ships [13], fishing vessels [14], general cargo ships [15], LNG carriers [16], and passenger ships [17,18]. Jiang et al. [19] applied an FTA–fuzzy Bayesian network approach to EV fire risk on enclosed Ro-Pax routes, but their outputs were relative risk indices rather than regulatory decision metrics such as ALARP boundaries, F–N curves, and GCAF/NCAF. In addition, enclosed Ro-Pax vehicle spaces differ fundamentally from Korean open-deck coastal car ferries in terms of smoke dispersion, detector reliability, passenger proximity, and emergency response conditions. Therefore, a vessel-type-specific FSA is required for open-deck car-ferry passenger ships. The IMO FSA framework remains a valid and active risk-based tool for maritime rule-making. The Revised FSA Guidelines require that uncertainty, assumptions, and data limitations be explicitly reported, which is consistent with the expert-informed treatment adopted in this study. Recent IMO discussions on fire safety for battery-electric and new-energy vehicles, including the SSE 10 roadmap and fire-safety work for vehicle spaces, further confirm the regulatory relevance of structured hazard identification and risk-control evaluation. Accordingly, this study provides the first complete five-step IMO FSA for EV fire risk on Korean open-deck coastal car ferries. It integrates GA/VLP structural analysis, KSA route-level EV transport data, HAZID–Delphi elicitation, and FTA–ETA quantification to produce ALARP/F–N/GCAF outputs and cost-screened RCOs. The contribution is not an empirically validated absolute accident-frequency model, but a regulation-ready, expert-informed risk-prioritisation framework for Article 97 revision, Korean Register (KR) technical guidance, and future IMO discussion.

2. Background

2.1. LIB Fire Characteristics: The Criticality of Early Detection

EV fires have five characteristics that distinguish them from fires involving conventional internal combustion engine (ICE) vehicles, and these characteristics are directly relevant to risk assessment for open-deck car-ferry passenger ships. First, lithium-ion battery (LIB) thermal runaway begins through internal electrochemical decomposition without visible smoke or flame. By the time visible smoke appears, the cell temperature may already exceed 400 °C and propagation to adjacent cells may be under way [20]. Because of this symptom-free latent phase, early detection within 1–3 min after the initial gas release becomes the critical intervention point, which explains why early smoke detection is essential in EV fire response. Second, once thermal runaway is established, gas release and smoke generation increase rapidly within seconds, and the 1–3 min interval from the first detectable smoke to full cell involvement is the only practicable response window [21]. Third, full-scale fire tests of BEVs have shown peak HRRs in the range of 4–8 MW, comparable to those of ICE vehicle fires of similar size; however, BEV fires present additional hazards including re-ignition risk for up to 24 h after initial suppression and elevated emissions of toxic gases, particularly hydrogen fluoride (HF) [21,22,23]. Fourth, hydrogen fluoride (HF) concentrations of up to 5000 ppm, equivalent to 167 times the immediately-dangerous-to-life-and-health (IDLH) concentration, can be released together with CO and HCN [23]. Since passenger areas are located only 3–6 m from deck openings, IDLH conditions may be reached within 1–2 min under crosswind conditions. Fifth, CO₂ and aqueous film-forming foam (AFFF) cannot suppress internal oxidation within battery cells, and re-ignition has been reported up to 24 h after initial extinguishment [24,25]. Continuous water cooling is the only verified method for controlling such fires.

The key implication for open-deck car-ferry passenger ships has been experimentally verified by the European Maritime Safety Agency (EMSA) FIRESAFE II project [26]: on open Ro-Ro (Roll-on/Roll-off) decks, wind speeds of ≥5 m/s reduce the activation probability of photoelectric smoke detectors by 60–75% compared with enclosed spaces. Because the narrow detection window of LIB thermal runaway is further compressed by the open-deck structure, only an integrated detection system combining infrared cameras (IR cameras), linear heat detectors, and HF gas sensors can secure a practicable response window. This conclusion justifies the identification of H-07 in Section 4.1 and the prioritisation of risk control option (RCO) 2 in Section 4.4.

2.2. Regulatory Context

Article 97 of the Republic of Korea’s Standard for Ship Fire-Fighting Appliance, concerning fire-fighting equipment for ships carrying electric vehicles, prescribes fire-fighting equipment requirements for “ships equipped with decks on which vehicles can be loaded and transported in the same condition as they are used for land transportation, etc., including pure car and truck carriers (PCTCs)” [12]. Although Article 97 of the Standard for Ship Fire-Fighting Appliance newly requires dedicated EV fire-fighting equipment for car-ferry ships, it remains primarily equipment-prescriptive and does not yet provide open-deck-specific performance requirements for wind-resistant detection, fixed EV-zone cooling, EV-designated stowage arrangements, or passenger–operator safety management obligations. Meanwhile, the IMO Sub-Committee on Ship Systems and Equipment (SSE) 10 in 2024 is aiming to amend the SOLAS Convention and the Fire Safety Systems (FSS) Code by 2027, mainly focusing on enclosed decks of PCTCs [27]. The Maritime & Coastguard Agency (MCA) Marine Guidance Note (MGN) 653 Amendment 1 of the United Kingdom [28] and the European Maritime Safety Agency (EMSA) 2025 guidelines on alternative-fuelled vehicles (AFVs) on Ro-Ro ships [13] provide best-practice guidance for EV transport on Ro-Ro passenger ships. However, they do not sufficiently reflect the unique operating conditions of coastal open-deck car-ferry passenger ships, including short route durations, open vehicle decks, mixed passenger–vehicle operations, and the statutory 25-year age limit. In addition, no ship-type-specific fire-fighting equipment standards for EV fires have been identified in countries operating similar vessels, such as Japan, Greece, Norway, Indonesia, and the Philippines.

The findings of this study can therefore serve as baseline evidence for revising Article 97 of the Republic of Korea’s Standard for Ship Fire-Fighting Appliance [12] and as international reference material for improving regulatory frameworks in countries operating open-deck coastal car-ferry passenger ships. Direct numerical transfer is not claimed: vessel designs, route durations, weather exposure, and regulatory baselines differ across jurisdictions, and the quantitative results are specific to the Korean fleet analysed here. The transferable element is the FSA application structure rather than the country-specific risk values.

3. Methodology

3.1. Data Sources

Table 1 summarises principal data sources. EV transport statistics are unpublished data from the Korea Shipping Association (KSA), collected on an inbound one-way basis. Probability values for FTA/ETA basic events are expert-elicited (Delphi panel) and literature-based, not empirically observed. Aggregated and anonymised versions of the KSA transport dataset and the Delphi elicitation responses are provided in Supplementary Materials Tables S1–S3; route-identifiable raw records are available from the corresponding author on reasonable request, subject to KSA data-use conditions.

Table 1. Principal data sources and nature of data.

Data Source	Key Variables	Use	Nature
2024 EV transport data [4]	Route/month: total vehicles, EVs	Annual exposure baseline	Empirical (unpublished)
2025 EV transport data [5]	Route/month: total vehicles, EVs	EV rate, route concentration	Empirical (unpublished)
Current status of domestic passenger ships [3]	Vessel type, route, distance, speed, GT, cargo capacity	Fleet composition, cluster analysis	Empirical
Expert Delphi panel (core 10, W = 0.74)	FTA/ETA probability values	FTA-ETA probability assignment	Expert-elicited
EMSA FIRESAFE II [26]; RISE report [23]	Open-deck detector reliability, HRR, re-ignition	FTA probability calibration	Literature-based

3.2. Fleet Composition and EV Transport Statistics

3.2.1. Fleet Composition

According to an analysis of the status of domestic passenger ships managed by KOMSA as of 8 March 2026 [3], open-deck car-ferry passenger ships accounted for 71.2% of the domestic passenger ship fleet in the Republic of Korea, comprising 104 of 146 vessels, and operated on 75 of the 99 designated routes, equivalent to 77.8% of all routes (Table 2). These vessels ranged from 69 to 997 GT in gross tonnage and had vehicle loading capacities of 2 to 86 vehicles.

Table 2. Status of domestic passenger ships by vessel type in the Republic of Korea based on KOMSA-managed vessel data as of 8 March 2026. Study target: 104 open-deck car-ferry passenger ships, accounting for 71.2% of the fleet. Ten enclosed-deck car-ferry passenger ships operating on the Jeju and Ulleungdo routes were excluded from the scope of this study.

Vessel Type	Vessels (n)	Share (%)	Vehicle Capacity	Passenger Capacity	Study Scope
Car ferry (open deck)	104	71.2	2–86	~50–700	Included
Car ferry (closed deck)	10	6.9	45–487	~150–700	Excluded *
Passenger-only ferry	32	21.9	None	—	—
Total	146	100.0	—	—	—

Note: * Car ferries excluded: large long-distance vessels (GT 2103–27,391; 45–487 vehicles) operating on distant routes (e.g., Jeju, Wando). Structural and operational characteristics differ fundamentally from open-deck car ferries [3].

3.2.2. EV Transport Statistics

Table 3 presents EV transport statistics from KSA unpublished data [4,5]. The car-ferry route EV transport rate rose from 0.76% in 2024 to 1.21% in 2025. Table 4 lists the top 10 routes by EV proportion; all exceed 2% and are priority candidates for early RCO implementation.

Table 3. EV transport statistics on car-ferry routes. Δpp: change in percentage points.

Year	Total Vehicles	EV Transported	EV Rate (%)	Year-on-Year Change
2024	2,417,310	18,424	0.76	—
2025	1,209,159	14,596	1.21	+0.45 pp (+58%)

Table 4. Top 10 car-ferry routes by EV proportion in 2025. Priority routes for early RCO deployment.

Route	Total Vehicles	EVs	EV Rate (%)
Gunsan–Gaeya	2298	108	4.70
Singi–Yeocheon	62,527	1623	2.60
Incheon–Deokjeok	7253	188	2.59
Gaochi–Saryang	39,358	956	2.43
Hari–Seogeom	4704	114	2.42
Seonsu–Jumun	22,686	510	2.25
Junghwa–Yokji	27,019	591	2.19
Dobi–Sonanji	7984	173	2.17
Sammok–Jangbong	73,089	1503	2.06
Mokpo–Sangdaeseri	19,136	392	2.05

3.2.3. Route Cluster Analysis

K-means cluster analysis was applied to 75 route observations using standardised route distance, estimated operation time, vehicle loading capacity, passenger capacity, and gross tonnage. The analysis identified three operationally interpretable clusters: short-distance medium-capacity routes (Cluster 1, n = 34), short-distance high-capacity commuter routes (Cluster 2, n = 25), and long-distance island routes (Cluster 3, n = 16). The silhouette coefficient was 0.425, indicating moderate but acceptable cluster separation.

The number of clusters was selected by jointly examining the elbow of the within-cluster sum of squares and the mean silhouette coefficient for k = 2–5; k = 3 yielded the most operationally interpretable partition while retaining acceptable separation. All five input variables were standardised to zero mean and unit variance (z-score) before clustering to remove scale effects. The silhouette coefficient of 0.425 indicates moderate—not strong—separation; the clusters are therefore interpreted as operational tendencies for differentiated regulation rather than as sharply bounded vessel classes. The standardisation parameters and the k = 2–5 comparison are reported in Supplementary Table S5.

The resulting route-cluster distribution is shown in Figure 1.

Figure 1. Route-cluster distribution of Korean open-deck coastal car ferries.

The detailed cluster statistics are presented in Table 5.

Table 5. K-means route cluster analysis of Korean open-deck coastal car-ferry routes (k = 3; silhouette coefficient = 0.425; 75 route observations; KOMSA passenger ship registry, 8 March 2026).

Cluster	Routes (n)	Mean Distance (NM)	Mean Operation Time (h)	Mean Speed (kts)	Mean Vehicle Capacity	Mean Passenger Capacity	Mean GT	Representative Routes
Cluster 1: short-distance, medium-capacity routes	34	11.09	0.90	12.3	19.5	233	187.1	Haui–Docho; Songgong–Byeongpung; Wando–Modo
Cluster 2: short-distance, high-capacity commuter routes	25	16.06	1.15	14.0	53.2	244	535.4	Daecheon–Janggo; Daebu–Ijak; Yulmok–Jindo
Cluster 3: long-distance island routes	16	36.96	2.78	13.3	10.8	158	183.3	Tongyeong–Samcheonpo; Ungok–Sindo; Gyema–Anma

Note: K-means clustering was performed for 75 route observations using standardised route distance, estimated operation time, vehicle capacity, passenger capacity, and gross tonnage. The silhouette coefficient was 0.425, indicating moderate but acceptable cluster separation.

The regulatory implications of the route clusters are as follows. Cluster 1 comprises 34 routes with a mean route distance of 11.09 NM, mean estimated operation time of 0.90 h (approximately 54 min), and mean vehicle loading capacity of 19.5 vehicles. At a 30% EV loading fraction, this corresponds to approximately six EVs per voyage on average. Therefore, Cluster 1 is characterised less by large-scale EV accumulation than by repeated short-haul operation, making early onboard detection, passenger control, and pre-departure inspection by voyage supervisors the primary control measures. Cluster 2 comprises 25 routes and has the highest mean vehicle loading capacity among the three clusters, at 53.2 vehicles. At a 30% EV loading fraction, approximately 16 EVs may be carried per voyage on average, with a maximum of approximately 23 EVs. Accordingly, Cluster 2 should be prioritised for hardware and operational RCOs, including designated EV stowage zones, multi-sensor detection, and strengthened ferry-operator safety management obligations. Cluster 3 comprises 16 routes with the longest mean route distance of 36.96 NM and mean estimated operation time of 2.78 h (approximately 167 min), but its mean vehicle loading capacity is relatively small at 10.8 vehicles. Therefore, Cluster 3 requires emphasis on re-ignition monitoring during longer voyages, autonomous onboard response capability, and coordinated port–fire department emergency planning rather than large-volume EV stowage control.

3.3. Structural Characteristics

An analysis of the General Arrangement drawings (GAs) and Vehicle Loading Plans (VLPs) of 15 representative vessels, ranging from 217 to 811 GT and 49.9 to 81.9 m in length overall, identified six structural characteristics common to all vessels (Table 6). These characteristics provide the physical basis for identifying open-deck-specific hazards and assigning probabilities in the FTA.

The approximately 0.5–0.6 m inter-vehicle spacing observed in the analysed vehicle loading plans was treated as a closely spaced configuration rather than as a deterministic fire-propagation threshold. RISE full-scale Ro-Ro fire tests used a 0.6 m separation between a vehicle mock-up and adjacent-vehicle simulators as representative of typical Ro-Ro vehicle spacing [29]. In a recent full-scale NCM battery electric vehicle fire test, peak radiative heat fluxes of approximately 30–35 kW/m² were measured at 1.0 m from the vehicle edge, indicating that adjacent vehicles may experience substantial thermal exposure even at this distance [30,31]. Accordingly, the present study uses sub-1.0 m spacing as a conservative screening condition for H-10, while recognising that actual fire spread depends on vehicle geometry, fire size, wind, vehicle orientation, combustible materials, and fire-fighting intervention.

Table 6. Structural characteristics of car ferries (GA/VLP analysis). Individual vessel data withheld for confidentiality.

Feature	Description	Primary Hazard Link	FSA Reference
Vehicle deck	Single layer; open sides (all vessels)	H-07 detection-barrier vulnerability, H-10, H-14	FTA top event; ETA node N1
Deck head clearance	2.5–3.8 m (mean 3.1 m)	H-14 (CO2 ineffective)	FTA q = 0.78
Ramp gate	Width 8–12 m; incline 6–10°	H-02, H-14	FTA λ = 2.4 × 10−4 voyage−1
Mixed passenger-vehicle	Passenger spaces 3–6 m from deck openings	H-11, H-18–H-21	ETA node N4
Vehicle spacing	~500–600 mm, representing a closely spaced vehicle arrangement.	H-10 fire spread	ETA grade C, p = 0.44
Statutory hull life	25 yr (Enforcement Rules of the Marine Transportation Act + Age-extension survey) [32]	CBA amortisation period	CRF (n = 5) = 0.2246 vs. CRF (n = 20) = 0.0736

Note: The observed 0.5–0.6 m spacing is comparable to the 0.6 m separation used in RISE full-scale Ro-Ro fire tests to represent typical vehicle spacing. Rather than applying a universal propagation threshold, this study treats sub-1.0 m spacing as a conservative screening condition associated with elevated thermal exposure to adjacent vehicles.

Table 6. Structural characteristics of car ferries (GA/VLP analysis). Individual vessel data withheld for confidentiality.

Feature	Description	Primary Hazard Link	FSA Reference
Vehicle deck	Single layer; open sides (all vessels)	H-07 detection-barrier vulnerability, H-10, H-14	FTA top event; ETA node N1
Deck head clearance	2.5–3.8 m (mean 3.1 m)	H-14 (CO2 ineffective)	FTA q = 0.78
Ramp gate	Width 8–12 m; incline 6–10°	H-02, H-14	FTA λ = 2.4 × 10−4 voyage−1
Mixed passenger-vehicle	Passenger spaces 3–6 m from deck openings	H-11, H-18–H-21	ETA node N4
Vehicle spacing	~500–600 mm, representing a closely spaced vehicle arrangement.	H-10 fire spread	ETA grade C, p = 0.44
Statutory hull life	25 yr (Enforcement Rules of the Marine Transportation Act + Age-extension survey) [32]	CBA amortisation period	CRF (n = 5) = 0.2246 vs. CRF (n = 20) = 0.0736

Note: The observed 0.5–0.6 m spacing is comparable to the 0.6 m separation used in RISE full-scale Ro-Ro fire tests to represent typical vehicle spacing. Rather than applying a universal propagation threshold, this study treats sub-1.0 m spacing as a conservative screening condition associated with elevated thermal exposure to adjacent vehicles.

3.4. FSA Methodology and Expert Panel

3.4.1. FSA Application

The five-step IMO FSA procedure was applied as shown in Table 7. The outputs of each step were structured so that they could be directly used as technical evidence for regulatory submissions to the Minister of Oceans and Fisheries (MOF), Korean Register (KR), and IMO SSE 11. All quantitative FTA–ETA values are explicitly indicated in each result item as expert panel-based scenario probabilities.

Table 7. IMO FSA five-step procedure application (MSC-MEPC.2/Circ.12/Rev.2 [11]). Expert-elicited values: based on Delphi panel and the literature. Empirical values: derived directly from KOMSA/KSA source data.

Step	Category	Method	Car-Ferry-Specific Application
1	HAZID	Literature review + 15-member broad advisory panel dedicated to HAZID	Additional identification of open-deck and ramp-related hazards based on GA drawing analysis; review of structural fire-characteristics studies and reported domestic and international vehicle-deck fire experience.
2	Risk estimation	FTA–ETA; Monte Carlo n = 10,000; F-N curve	H-07 unreliability q = 0.72 (EMSA FIRESAFE II calibration); EV loading 10/30/50% scenarios; All FTA/ETA values are expert-elicited, not observed frequencies
3	Risk evaluation	IMO ALARP thresholds; crew/passenger IR; F-N comparison	Derivation of the ALARP threshold at a 30% EV loading ratio; the ALARP boundary was used to identify priorities for institutional improvement.
4	RCO evaluation	6 RCOs; GCAF/NCAF; CRF (i = 4%; n = 5/10/20 yr, Ship Safety Act basis); dual VSL	CRF (n = 5) = 0.2246 vs. CRF (n = 20) = 0.0736 (3.05 × penalty); GCAF is a relative cost metric based on expert-elicited probabilities
5	Decision	MOF/KR recommendations; IMO SSE 11 information document	Article 97 revision items (a)–(e); ferry operator SMS obligation; timeline: 2026/2027–2028

The IMO five-step FSA was selected over relative-index approaches such as the FTA–fuzzy Bayesian network of Jiang et al. [19] for four reasons: (i) the FSA structure (HAZID → quantified risk → ALARP → RCO cost–benefit → decision) is prescribed for regulatory submission, whereas FBN yields relative indices not directly usable for GCAF/NCAF or F–N assessment; (ii) the 25-year statutory hull-life ceiling requires explicit CRF-adjusted cost–benefit analysis across vessel-age classes; (iii) submission to MOF, KR, and IMO SSE requires ALARP-benchmarked F–N curves; and (iv) FSA outputs map directly onto the Article 97 revision items.

HAZID was conducted as a structured workshop combining (a) a review of the relevant international full-scale fire-test literature (EMSA FIRESAFE II [26]; RISE [23]), (b) a qualitative review of reported domestic and international marine vehicle-deck fire experience, and (c) GA/VLP-based structural review, with the 15-member advisory panel. Each identified hazard was explicitly mapped to a fault tree basic event or an event tree node, establishing the structural link between HAZID and the subsequent FTA–ETA quantification.

3.4.2. Expert Panel

Expert involvement was divided into a broad HAZID advisory panel of 15 members and a core Delphi panel of 10 members (Table 8). The broad advisory panel was responsible for ensuring diversity in hazard identification, whereas the core panel focused on achieving consensus in probability elicitation.

Table 8. Expert panel composition: 15-member broad HAZID advisory panel and 10-member core Delphi panel. Proportion of user-oriented expertise, including passenger ship operators and ship design experts: 11/15 in the broad panel (73.3%) and 6/10 in the core panel (60.0%). Kendall’s W = 0.74 for the core panel, p < 0.01, χ² test, df = 22.

Category	Role	HAZID Advisory (n = 15)	Delphi Core (n = 10)	Selection Basis
Ship surveyors	HAZID identification	2	2	10+ yr; car ferry/fire equipment survey
Passenger ship voyage supervisors	HAZID + Probability	2	1	10+ yr; safety inspection and control of passenger ship arrivals and departures
Ferry masters	HAZID + Probability	4 (including 1 person per cluster)	3	10+ yr; active command on car ferries
Ferry safety managers	HAZID + Probability	4	3	10+ yr; ISM (International Safety Management) SMS, emergency response
Naval architects	HAZID-dedicated	2	—	Vehicle deck, ramp gate, fire-prevention layout
Fire specialists	HAZID + Probability	1	1	Marine/battery fire suppression experience
Total		15	10	User perspective (ferry operator): 60% of core panel

Probability elicitation followed a two-round Delphi process. In Round 1, the 10-member core panel independently scored each candidate’s basic-event likelihood on a structured scale; responses were aggregated and the anonymised group distribution, with summary statistics, was returned to the panel. In Round 2, panellists revised their estimates in light of the group distribution, and final point values with 5th–95th percentile ranges were elicited. Consensus reached Kendall’s W = 0.74 (p < 0.01; χ², df = 22), exceeding the conventional W ≥ 0.70 threshold; the questionnaires and per-round convergence statistics are provided in Supplementary Table S1. The core panel was intentionally weighted toward ferry operators and maritime practitioners (60%) to maximise operational and regulatory relevance for the targeted Article 97 revision; technical parameters (open-deck detector reliability, HRR, re-ignition behaviour, HF release) were not left to operator judgement alone but were calibrated against EMSA FIRESAFE II and the RISE test literature. The limited representation of battery engineers, fire-dynamics and toxic-gas specialists, and human-factors researchers is acknowledged as a limitation (Section 5.6).

3.4.3. Accident Database

Reported domestic and international vehicle-deck fire experience and the international literature, including EMSA FIRESAFE II [26] and RISE reports [23], were reviewed to analyse structural fire characteristics relevant to car-ferry passenger ships. The probabilities of EV-specific FTA basic-events were derived from the expert Delphi panel (W = 0.74) and the international literature, including EMSA FIRESAFE II [26] and RISE reports [23]. The invariance of the ALARP classification under the 5th–95th percentile confidence intervals of basic event probabilities and simultaneous ±50% variation conditions was confirmed through sensitivity analysis, and the detailed results are provided in Section 4.2.1.

Because EV-specific shipboard fire incidents remain very rare worldwide (fewer than 20 reported as of 2025), no domestic accident-frequency dataset of sufficient size for statistical estimation is available. The FTA/ETA basic-event probabilities were therefore derived from expert Delphi elicitation and calibrated against the international full-scale fire-test literature (EMSA FIRESAFE II [26]; RISE [23]) rather than from domestic accident-frequency data, and are reported as expert-informed estimates (Section 5.6). Supplementary Table S2 documents this evidence base and the rationale for expert elicitation.

4. Results

4.1. Step 1—HAZID: 23 EV Fire Hazards

Hazard identification (HAZID) conducted by the 15-member broad advisory panel identified 23 hazards across four operational phases: loading, navigation, fire suppression, and evacuation (Table 9). Among them, 12 hazards are amplified by the open-deck structure (*). H-07, representing smoke detection failure due to wind-induced smoke dilution, was identified as the dominant single-point vulnerability within the detection-failure branch in the fault tree (Section 4.2.1). This demonstrates that the open-deck structure can structurally undermine the critical early detection window for LIB thermal runaway identified in Section 2.1.

Table 9. HAZID results: 23 EV fire hazards on car-ferry passenger ships identified by the 15-member broad advisory panel. (*): hazard amplified by the open-deck structure. Quantitative descriptors in the “Open-Deck Amplification/Regulatory Note” column are indicative screening values based on the cited literature and expert judgement; they are not vessel-specific engineering calculations. SOC: state of charge; IR: infrared camera for open-deck monitoring; IDLH: immediately dangerous to life or health.

ID	Phase	Hazard	Open-Deck Amplification/Regulatory Note
H-01	Loading	Undetected damaged LIB EV loaded	Voyage supervisor inspection time limited by ramp-gate bottleneck
H-02 *	Loading	Mechanical shock to LIB during ramp passage	Ramp geometry increases battery pack impact risk; no mandatory EV-only lane
H-03	Loading	Undisclosed high-SOC (>80%) EV loaded	No SOC (State of Charge) declaration obligation; remote verification not possible
H-04 *	Loading	Insufficient EV–ICE vehicle separation	Single-layer lane layout limits zoning flexibility
H-05	Loading	No pre-boarding IR thermal screening	No IR equipment issued to voyage supervisors
H-06	Voyage	LIB internal short circuit (manufacturing defect)	Equal probability in open/enclosed environments
H-07 *	Voyage	Detection failure—smoke dispersed by open-deck wind	EMSA: P(activation) reduced 60–75% at wind ≥5 m/s; single barrier collapse without co-failure
H-08 *	Voyage	No fixed thermal imaging surveillance	Article 97 (MOF Notification) does not require IR cameras on open decks
H-09	Voyage	Crew unfamiliar with LIB suppression procedures	No domestic EV-specific crew competency standard
H-10 *	Voyage	Wind-driven lateral fire spread to adjacent EVs	No transverse fire barriers; open deck provides sustained O2 supply
H-11 *	Voyage	Toxic gas migration to passenger spaces	HF up to 5000 ppm; IDLH may be reached in 1–2 min in crosswind
H-12	Voyage	Insufficient cooling water supply	Fire mains sized for ICE fires; no dedicated EV cooling circuit
H-13	Voyage	Degraded passive fire resistance due to corrosion	High-frequency short-haul operation with cumulative salt exposure
H-14 *	Suppression	CO2/AFFF ineffective on open deck	CO2 requires enclosed space; AFFF dispersed at wind ≥5 m/s
H-15 *	Suppression	Water mist effectiveness reduced in crosswind	Mist cloud cannot be sustained at wind >5–8 m/s
H-16 *	Suppression	No fixed automatic cooling system	Article 97 (MOF Notification) does not require fixed cooling on open decks
H-17	Suppression	Re-ignition risk 12–24 h after initial suppression	No post-incident LIB monitoring protocol on short-haul routes
H-18 *	Evacuation	Passenger evacuation route passes through vehicle deck	Single stairway structure: conflict between suppression and evacuation
H-19	Evacuation	Toxic gas infiltration into passenger spaces	Open deck shortens gas propagation path to upper decks
H-20 *	Evacuation	Limited evacuation time on selected very-short Cluster 1 routes	Shore fire dept cannot dock before IDLH exposure on short routes
H-21	Evacuation	Insufficient crew for simultaneous suppression and evacuation	Minimum crew sized for normal operations; SMS obligations not explicit
H-22 *	Evacuation	Stability loss from cooling water accumulation	Accumulated cooling water may degrade stability through free-surface effects, asymmetric loading, and possible vehicle shift; the consequence is vessel-specific and depends on deck geometry, drainage capacity, loading condition, water distribution, and vehicle-securing condition.
H-23	Evacuation	Restricted vehicle deck visibility at night	Reduced patrol effectiveness on long-haul night routes (Clusters 2/3)

For H-11, the cited HF concentration of up to 5000 ppm [23] is benchmarked against the NIOSH-established immediately-dangerous-to-life-or-health (IDLH) threshold of 30 ppm for hydrogen fluoride [33], which is the basis for the 167× -IDLH figure stated in Section 2.1; the 1–2 min exposure-time estimate is an order-of-magnitude expert judgement for crosswind transport across the 3–6 m gap to the passenger zone, not a CFD-validated calculation. For H-20, the shore-response margin follows directly from comparing this 1–2 min IDLH window with the mean transit time of Cluster 1 routes (0.90 h; Table 5): on the shortest routes, shore-based responders cannot reasonably reach a vessel under way before the window closes. For H-22, accumulated cooling water is treated as a vessel-specific stability-screening hazard rather than as a fixed mass threshold. Firewater accumulation may degrade stability through free-surface effects, asymmetric loading, and possible vehicle shift, as discussed in the Ro-Pax firewater-accumulation framework of Wang and Wu [34]. The consequence depends on deck geometry, drainage capacity, loading condition, water distribution, and vehicle-securing condition. Accordingly, the H-22 description is presented as an indicative screening value, not as a vessel-specific engineering calculation.

4.2. Step 2—Risk Estimation

4.2.1. Fault Tree Analysis

The top event is defined as a “sustained and spreading EV fire on the vehicle deck of a car-ferry passenger ship.” The resulting fault-tree structure is shown in Figure 2. The top event occurs only when three intermediate branches occur simultaneously through the upper AND gate. Branch B1, ignition, consists of LIB internal short circuit, λ = 8.5 × 10⁻⁵ EV⁻¹ voyage⁻¹; ramp impact, λ = 2.4 × 10⁻⁴ voyage⁻¹; and pre-existing damage, λ = 1.1 × 10⁻⁴ EV⁻¹ voyage⁻¹. Branch B2, detection failure, consists of H-07 unreliability, q = 0.72, with open-deck correction based on EMSA FIRESAFE II [26]; absence of thermal imaging, q = 0.91; and limited night-time visibility, q = 0.45, conditional. Branch B3, suppression failure, consists of lack of cooling capability, q = 0.89; ineffectiveness of CO₂/foam, q = 0.78; and insufficient crew familiarity, q = 0.31. The probability distributions of the basic events, including the 5th–95th percentile confidence intervals, are provided in Table 10.

Figure 2. Fault tree analysis of an EV fire on the vehicle deck of a car-ferry passenger ship. Top event: sustained and spreading EV fire. Three branches combine through a top AND gate: B1, ignition; B2, detection failure; B3, suppression failure; each branch is an OR of its basic events. Because the top gate is an AND of three OR branches, every minimal cut set is of order 3 (27 in total); H-07 (q = 0.72) is highlighted not as a single-event cut set but as the only basic event within B2 that is both unconditional and not addressable by a single RCO (see Section 4.2.1). Probability values with 5th–95th percentile ranges are reported in Table 10. AND: logical conjunction gate; OR: logical disjunction gate; q: unreliability; λ: occurrence rate. Basis: expert Delphi survey (W = 0.74) and EMSA [26].

Table 10. Summary of FTA basic-event probability values, based on the expert Delphi panel (W = 0.74), EMSA FIRESAFE II [26], and RISE Report [23]. q: unreliability, defined as the probability of failure on demand. λ: occurrence rate per voyage. Right-hand column: invariance of the ALARP classification under simultaneous ±50% variation in all basic events.

Basic Event	ID	Point Estimate	5th Pctile	95th Pctile	Primary Source	ALARP ±50% Invariant
LIB internal short circuit (per EV per voyage)	H-06	λ = 8.5 × 10−5	5.2 × 10−5	1.4 × 10−4	Literature [20,24] + Delphi	✓
Pre-damaged EV loaded (per EV per voyage)	H-01	λ = 1.1 × 10−4	6.8 × 10−5	1.8 × 10−4	Delphi (W = 0.74)	✓
Ramp mechanical impact (per voyage)	H-02	λ = 2.4 × 10−4	1.5 × 10−4	3.9 × 10−4	Domestic incidents + Delphi	✓
Open-deck smoke dispersion/detection-barrier vulnerability	H-07	q = 0.72	0.58	0.83	EMSA FIRESAFE II [26]	✓
No fixed thermal imaging	H-08	q = 0.91	0.85	0.96	Current status of domestic passenger ships [3]	✓
Night visibility limitation (conditional)	H-23	q = 0.45	0.31	0.59	Delphi	✓
No fixed cooling system	H-16	q = 0.89	0.82	0.95	Article 97 (MOF) status	✓
CO2/AFFF ineffective (open deck)	H-14	q = 0.78	0.65	0.88	EMSA FIRESAFE II + Delphi	✓
Crew unfamiliar with LIB procedures	H-09	q = 0.31	0.18	0.45	Delphi	✓

Note: 1. ALARP classification (crew IR enters ALARP band at 30% EV loading) is invariant under ±50% simultaneous variation in all basic-event probabilities. 2. ✓ indicates that the ALARP classification remains unchanged under ±50% simultaneous variation.

Within each branch, the basic events combine through an OR gate, and the three branches combine through the top AND gate. Because the top gate requires B1 and B2 and B3 to occur jointly, every minimal cut set (MCS) of the top event consists of exactly one basic event from each branch (3 × 3 × 3 = 27 minimal cut sets in total), each of order 3; no single basic event can, by itself, cause the top event. Applying the standard OR-gate combination rule to the elicited point estimates (Table 10): q(B2) = 1 − (1 − 0.72)(1 − 0.91)(1 − 0.45) ≈ 0.986, and q(B3) = 1 − (1 − 0.89)(1 − 0.78)(1 − 0.31) ≈ 0.983, for B1, whose basic events are voyage-normalised occurrence rates rather than conditional probabilities, the rare-event approximation gives λ(B1) ≈ 8.5 × 10⁻⁵ + 1.1 × 10⁻⁴ + 2.4 × 10⁻⁴ ≈ 4.35 × 10⁻⁴ voyage⁻¹. Combining these branch values with the EV-loading-dependent exposure factor used in the Monte Carlo model (n = 10,000) yields the annual fire-frequency estimates reported in Table 11. Within branch B2, H-08 (q = 0.91) has the highest individual unreliability, not H-07 (q = 0.72); H-07 is instead distinguished by being the only one of the three B2 events that is both unconditional (unlike H-23, which applies only at night) and not attributable to an equipment gap addressable by a single RCO (unlike H-08, which RCO-2 directly targets by installing fixed thermal-imaging cameras). H-07 reflects an inherent environmental constraint of the open-deck design—wind-driven dilution of smoke before it reaches a detector—that persists even after RCO-2 is implemented, and is therefore the principal reason RCO-2 must be paired with RCO-3 (fixed cooling) rather than deployed alone (Section 4.4.2).

Table 11. Annual fire frequency by EV loading ratio, based on a reference vessel with a vehicle loading capacity of 63 vehicles and approximately 1500 voyages yr⁻¹.

EV Shipment Ratio	EV per Voyage (Reference: 63 Units)	Annual Fire Frequency f (yr−1)	Cluster 1 Context (Average 19.5 Units)	Cluster 2 Context (Average 53.2 Units)	Cluster 3 Context (Average 10.8 Units)
10%	~6	5.9 × 10−2	~2	~5	~1
30%	~19	1.8 × 10−1	~6	~16	~3
50%	~32	2.9 × 10−1	~10	~27	~5

Table 11 reports the resulting annual fire-frequency estimates from the Monte Carlo simulation.

4.2.2. Event Tree Analysis

Four binary decision nodes follow the fault tree initiating event. N1: effective detection within 5 min, P(N1) = 0.30 on open deck (61% reduction from 0.78 in enclosed space; EMSA [26]). N2: effective cooling, P(N2|N1+) = 0.55, P(N2|N1−) = 0.28. N3: vehicle isolation, p = 0.58. N4: passenger evacuation complete before IDLH, p = 0.92 under a longer-voyage reference condition; shorter routes may have lower effective response margins. The resulting ETA outcome grades, outcome probabilities, representative paths, and expected fatalities are summarised in Table 12.

Table 12. ETA outcome grades, outcome probabilities, and expected fatalities. E[N]: expected fatalities per fire incident. Outcome probabilities sum to 1.00.

Grade	Description	Outcome Probability	E[Fatalities]	Representative Path
A	Fire suppressed; no fatalities	0.22	0	N1+ → N2+
B	Localised fire; crew-controlled	0.29	~0.8	N1+ → N2− and/or N3−
C	Large multi-vehicle fire	0.44	~3.5	N1− → N2+ and/or N3±
D	Major incident—abandon ship	0.05	~14.0	N1− → N2−
Sum	E[N] = 0 × 0.22 + 0.8 × 0.29 + 3.5 × 0.44 + 14.0 × 0.05	1.00	2.47	—

4.2.3. Individual Risk and Societal Risk

Based on the annual fire frequencies and expected fatalities per incident, individual risk values were calculated for each EV loading fraction. The results are summarised in Table 13.

Table 13. Calculated individual risk values by EV loading ratio. IMO maximum tolerable crew individual risk criterion: 10⁻³ yr⁻¹ [11].

EV Loading Fraction	f (yr−1)	AEF (yr−1)	IR_Crew (yr−1)	IR_Pax (yr−1)
10% (~6 vehicles)	5.9 × 10−2	0.146	2.90 × 10−4	3.87 × 10−7
30% (~19 vehicles)	1.8 × 10−1	0.445	8.87 × 10−4	1.18 × 10−6
50% (~32 vehicles)	2.9 × 10−1	0.716	1.43 × 10−3 †	1.91 × 10−6

Note: † indicates that the value exceeds the IMO maximum tolerable crew individual risk criterion of 10⁻³ yr⁻¹ [11].

4.3. Step 3—ALARP Evaluation

Figure 3 presents F–N curves for the three EV loading ratio scenarios together with the IMO ALARP limit lines defined in MSC-MEPC.2/Circ.12/Rev.2 [11]. Because the ALARP determination is based on expert panel probability values, it should be interpreted not as evidence of actual exceedance of ship-specific risk levels, but as a tool for identifying priorities for institutional improvement (Table 14).

Figure 3. F–N (frequency–number of fatalities) societal risk curves for EV fires on car-ferry passenger ships. Reference vessel: 63-vehicle loading capacity, approximately 1500 voyages yr⁻¹, and 505 persons exposed to risk. Three curves represent EV loading ratios of 10%, 30%, and 50%. When the EV loading ratio exceeds 30%, the crew individual risk (IR) enters the ALARP band. ALARP limit lines: IMO MSC-MEPC.2/Circ.12/Rev.2 [11]; probability values: expert Delphi survey (W = 0.74).

Table 14. ALARP evaluation summary. IR: individual risk (yr⁻¹). †: exceeds the IMO maximum tolerable crew IR criterion of 10⁻³ yr⁻¹ [11].

EV Loading Fraction	IR_Crew (yr−1)	IR_Pax (yr−1)	F-N Position	ALARP Determination
10%	2.90 × 10−4	3.87 × 10−7	Below lower limit	ALARP (crew); broadly acceptable (pax) → RCO-4,5 preventive
30%	8.87 × 10−4	1.18 × 10−6	ALARP band	ALARP—risk reduction required → RCO-1–4
50%	1.43 × 10−3 †	1.91 × 10−6	Exceeds upper limit	Intolerable (crew) †; ALARP (pax) → RCO-2 + 3 + 4 priority

4.4. Step 4—RCO Evaluation

4.4.1. Capital Recovery Factor and VSL Benchmarks

Capital costs are annualised using the Capital Recovery Factor (CRF) in Equation (1), and the Gross Cost of Averting a Fatality (GCAF) is calculated using Equation (2). Since GCAF is a relative cost indicator derived from expert panel probability values, it is more meaningful for comparing priorities among risk control options (RCOs) than for interpreting absolute values.

$$CRF\left(i,n\right)={\displaystyle \frac{\left[i{\left(1+i\right)}^n\right]}{{[\left(1+i\right)}^n-1]}}$$

(1)

$$GCAF={\displaystyle \frac{[CAPEX\times CRF\left(i,n\right)+OPEX]}{[∆f\times E\left[N\right]]}}$$

(2)

where i = 0.04 is the real discount rate and n is the remaining service life of the vessel in years. Two value of statistical life (VSL) benchmarks are applied: VSL_Korea = KRW 4.43 billion, approximately USD 3.16 million [35], and VSL_IMO = USD 3.00 million [11]. Table 15 presents the CRF values by remaining service life, based on the Enforcement Rules of the Marine Transportation Act and the age-extension survey system [32].

Table 15. Capital Recovery Factor (CRF) by remaining service life based on the Marine Transportation Act. Legal basis: Marine Transportation Act, which sets the maximum service life at 20 years, and the age-extension survey system, which allows an additional extension of up to 5 years [32], resulting in a total maximum service life of 25 years. i: real discount rate (4%); n: remaining service life in years. $CRF\left(i,n\right)=i{\left(1+i\right)}^n/[{\left(1+i\right)}^n-1]$.

Remaining Hull Life n (yr)	CRF (i = 4%)	Penalty vs. n = 20	Legal Basis/Policy Interpretation
20	0.0736	1.00× (baseline)	Newbuild—Maximum remaining service life within the statutory service age under the Marine Transportation Act; RCOs can be incorporated into the design at the newbuilding stage.
10	0.1233	1.68×	Mid-life vessels, approximately 10 years of age: vessels that have reached about half of the statutory service age and are within a technically and economically feasible period for retrofit implementation.
5	0.2246	3.05×	Age-extension survey regime (hull age 20–25 yr); prioritised application of non-equipment-based RCOs is recommended.

Note: Article 5 of the Enforcement Rule of the Marine Transportation Act sets the maximum service age of domestic passenger ships at 20 years [32]. Under the age-extension survey system, when a vessel exceeds the statutory service age of 20 years, its operation may be extended in one-year increments within a maximum additional period of 5 years, subject to enhanced inspection standards, allowing operation for up to 25 years in total. For vessels in the n = 5 remaining service life category, prioritising RCO-4, RCO-5, and RCO-6, which are low-cost and non-equipment-based measures, is economically and practically more appropriate than applying RCO-3, a high-cost water-spray cooling measure.

4.4.2. Six Risk Control Options

Based on the HAZID results and structural analysis, six risk control options (RCOs) tailored to the characteristics of car-ferry passenger ships were developed (Table 16). RCO-6, a joint port–fire-fighting response plan, can be implemented immediately without additional equipment investment and is recommended for priority application on routes with high EV transport ratios, as shown in Table 4.

Table 16. Risk control options (RCOs). GCAF: USD million. CAPEX/OPEX: KRW million (M). Cost-effective: GCAF < VSL_IMO (USD 3.0M). All RCOs cost-effective across all hull-life stages. 1 USD = 1400 KRW.

RCO	Description	Target Hazards	CAPEX (KRW M)	OPEX (M yr−1)	GCAF n = 20	GCAF n = 5	Cost-Effective?
RCO-1 EV-DSZ	EV Designated Stowage Zone (EV-DSZ): Layout A (mid-ship, routes > 3 h); Layout B (sentinel band at ramp gate, routes ≤ 3 h). Layout B enables direct hose access by shore fire dept.	H-04,10,18	80–150	3–5	0.09–0.17	0.22–0.40	○ all
RCO-2 Detection	Multi-sensor open-deck detection: IR camera + linear heat detector + HF gas sensor per EV bay. Target: H-07/H-08 detection-barrier vulnerabilities. Design criterion: P(activation) ≥ 0.80 at wind ≤ 15 m/s.	H-07,08	40–80	2–4	0.02–0.05	0.05–0.11	○ all
RCO-3 Cooling	Fixed automatic water-spray cooling in EV-DSZ: application rate ≥ 10 L min−1 m−2; sustained capacity ≥ 10 min.	H-12,14–17	120–200	4–7	0.19–0.33	0.47–0.79	○ all
RCO-4 Inspection	Mandatory EV pre-boarding inspection (Voyage supervisor statutory duty): SOC ≤ 80% declaration; IR thermal camera at ramp gate; checklist as permit-to-carry condition.	H-01–03,05	3–8	8–15	0.11–0.21	0.11–0.22	○ all
RCO-5 Training	EV crew competency programme (ferry operator SMS (Safety Management System, SMS) obligation): 4 h annual drill; LIB recognition, open-deck cooling, passenger evacuation. Subject to MOF/KR audit.	H-09,21	1–3	2–5	0.03–0.08	0.04–0.09	○ all
RCO-6 Joint response	Port authority–fire dept joint EV fire plan for routes with EV fraction > 2% (Table 4): annual joint drill; EV-specific response procedures. No capital outlay required.	H-11,09,22	0–5	0–2	0.00–0.05	0.00–0.06	○ all

Note: 1. At a 30% EV loading fraction, RCO-2 + 3+4 reduces AEF from 0.445 to 0.064 yr⁻¹ (−85.6%). The combined GCAF is USD 0.05–0.16 million across n = 20, 10, and 5 years, remaining below both Korean and IMO VSL benchmarks. RCO-6 can be implemented immediately on high-EV-ratio routes (>2%; Table 4) because it requires no fixed hardware investment and provides additional emergency-response capacity at negligible capital cost. 2. The ΔAEF values used for the GCAF calculations were 0.069, 0.143, 0.047, 0.054, 0.044, and 0.037 yr⁻¹ for RCO-1 to RCO-6, respectively. For the combined implementation of RCO-2, RCO-3, and RCO-4, ΔAEF was 0.381 yr⁻¹. 3. ○ indicates that the RCO is cost-effective, i.e., GCAF < VSL_IMO.

4.5. Step 5—Regulatory Recommendations

Based on the FSA outputs, the following regulatory recommendations are proposed. For the Ministry of Oceans and Fisheries (MOF), revision of Article 97 of the Standard for Ship Fire-Fighting Appliance is recommended, specifically: (a) mandatory installation of EV-designated safety zones (EV-DSZs) on all car-ferry passenger ships permitted to carry EVs; (b) installation of open-deck integrated detection systems on EV-permitted vessels, with an operating probability of P(operation) ≥ 0.80 under wind speeds of ≤15 m/s; (c) installation of fixed EV-DSZ cooling systems on vessels with more than 10 years of remaining service life, with a capacity of ≥10 L min⁻¹ m⁻² for 10 min; (d) codification of pre-loading EV inspection as a statutory condition for carriage approval, with explicit authority assigned to passenger ship operation managers; and (e) strengthening of passenger ship operators’ safety management obligations. Specifically, passenger ship operators running car-ferry services should establish and implement internal EV handling procedures, crew EV training records, and passenger–EV interaction protocols as mandatory elements of their safety management system (SMS), subject to periodic operational audits by the MOF. The proposed implementation schedule is 2026 for RCO-4, RCO-5, and RCO-6, and 2027–2028 for RCO-1, RCO-2, and RCO-3.

For the Korean Register (KR), the issuance of a technical circular is recommended. This circular should include the P(operation) ≥ 0.80 performance criterion, design criteria for water-spray cooling, EV-DSZ arrangement criteria by cluster type, and SMS documentation requirements for passenger ship operators.

For IMO SSE 11, the ALARP threshold, indicating that crew individual risk enters the ALARP band when the EV loading ratio exceeds 30%, the EV-DSZ design framework, and the results related to strengthened passenger ship operators’ safety management obligations should be structured as quantitative evidence for the amendment of SOLAS Chapter II-2 and the FSS Code, following the work initiated at SSE 10.

5. Discussion

5.1. Open-Deck Detection Vulnerability and Probability Robustness

The FTA–ETA results based on expert panel-derived probability values can have regulatory implications for two reasons. First, H-07 functions as a single basic event in the B2 branch of the fault tree and, at the assigned unreliability value of q = 0.72, can substantially weaken the early-detection barrier under open-deck wind conditions. However, because this status depends on the probability value, the sensitivity analysis in Table 10 confirmed that the conclusion remains valid even under a ±50% variation range. Second, the ALARP classification was also confirmed to be invariant within the same sensitivity range, indicating that the conclusion regarding institutional improvement priorities has a considerable level of robustness against uncertainty in probability estimation.

5.2. Connection Between Open-Deck Detection Vulnerability and LIB Fire Characteristics and the LIB Fire Characteristics Discussed in Section 2.1

The identification of H-07 as the dominant vulnerability in the detection-failure branch structurally validates the central proposition in Section 2.1: early smoke detection during LIB thermal runaway is the critical point of intervention. This dual challenge, in which the 1–3 min detection window is further compressed on open decks, reveals a regulatory gap, as detector certification under the ISO 7240 series is conducted in semi-enclosed environments and may therefore overestimate reliability on open decks. It is therefore urgent to establish EV detection performance standards specifically for open decks, including a minimum operating probability under actual wind-speed conditions. In addition, EV-DSZ Layout B is a novel design concept that enables direct hose access by land-based fire brigades during berthing, and this concept has not yet been reflected in any existing classification society guidelines.

5.3. EV Transport Growth Trend and Route-Level ALARP Threshold

The EV transport rate on car-ferry passenger ship routes reached 1.21% in 2025, with high concentrations on specific routes such as Gunsan–Gaeya (4.70%) and Singi–Yeocheon (2.60%). The 30% and 50% EV loading fractions are not forecasts of near-term annual route-average EV penetration. They are regulatory stress-test scenarios designed to identify the loading level at which the calculated expert-informed risk enters the ALARP band or exceeds the tolerability criterion. The observed 2025 EV rate of 1.21% and the high-route values above 2–4.7% support early implementation of low-cost preventive RCOs, particularly RCO-4, RCO-5, and RCO-6, but they should not be interpreted as a deterministic forecast of 30% route-average penetration within a fixed time horizon.

5.4. Institutional Basis for Passenger Ship Operators’ Safety Management Obligations

The paradigm shift from supply chain-centred transport to user-operated transport positions passenger ship operators as the final line of defence between EV-using passengers and shipboard safety. Strengthening the SMS obligations of passenger ship operators is an institutional response corresponding to this shift. The proposed mandatory elements—including internal EV handling procedures, records of crew training for EV-specific emergency response, EV boarding guidance for passengers, and reporting obligations for abnormal signs during navigation—would form a dual-authority framework when combined with the statutory pre-loading authority of passenger ship operation managers under RCO-4. This dual framework, consisting of pre-loading authority and onboard SMS obligations of passenger ship operators, represents a structurally improved safety management model compared with the current single-authority framework.

5.5. Comparison with Jiang et al. [19]

Table 17 presents a structural comparison with the most relevant previous study. The two studies are complementary: Jiang et al. [19] demonstrate that prevention of ignition triggers is the primary priority for PCTCs and enclosed Ro-Pax ships, whereas in the open-deck car-ferry passenger ship environment, detection failure becomes the dominant risk factor, making integrated detection (RCO-2) the highest-priority intervention.

Table 17. Structural comparison with Jiang et al. [19].

Item	Jiang et al. [19]—FTA-FBN	This Study—IMO FSA
Vessel type	Enclosed Ro-Pax (single route)	Open-deck car ferries (104 vessels, 3 clusters)
Data basis	Route operating knowledge	KOMSA registry + KSA EV data + GA/VLP drawings
Accident data	Undisclosed	Review of domestic marine accident cases and the international literature; EV-specific probabilities are based on expert panel estimates.
Expert panel	5 members; supply-chain perspective	HAZID 15 + Delphi core 10 (W = 0.74); 60% ferry-operator perspective
Primary risk driver	Ignition triggers	Detection-barrier vulnerability driven by H-07/H-08
Suppression context	CO2/foam partially effective (enclosed)	CO2/foam ineffective (open deck, wind ≥ 5 m/s)
Regulatory output	General prevention recommendations	ALARP/F-N/GCAF + MOF/KR/IMO actionable recommendations

5.6. Limitations

First, the FTA basic-event probabilities were based on the expert Delphi panel (W = 0.74) and the international literature; therefore, they were not validated against empirical accident-frequency data. The robustness of the conclusions was confirmed through sensitivity analysis (Table 10). The ALARP classification remained unchanged even under simultaneous ±50% variation in all basic-event probabilities (Table 10). Second, fire spread validation on open decks using Computational Fluid Dynamics (CFD) or Fire Dynamics Simulator (FDS) was not conducted and should be treated as a priority for future research. Third, the 2025 EV transport data, extracted on 5 January 2026, should be interpreted with caution because they were collected before the completion of the final annual audit. Fourth, although the cluster analysis result, with a silhouette value of 0.425, indicates acceptable separation, further validation could be strengthened using AIS-based actual voyage trajectory data.

Fifth, the expert panel, although satisfying the Kendall’s W ≥ 0.70 consensus criterion, was relatively small (core n = 10) and weighted toward ferry operators and maritime practitioners; broader inclusion of battery engineers, fire-dynamics and toxic-gas specialists, and human-factors researchers in future elicitation would further strengthen the technical reliability of the estimates. Sixth, basic-event independence within fault tree branches was assumed; potential dependencies may affect absolute probabilities, although the ALARP classification was invariant under ±50% variation. Accordingly, all quantitative results in this study should be interpreted as expert-informed risk estimates intended to prioritise institutional improvement, not as empirically validated absolute risk levels.

6. Conclusions

This study systematically applied the five-step IMO Formal Safety Assessment (FSA) procedure to EV fire risk on domestic coastal car-ferry passenger ships and derived the following eight key conclusions.

(1)

H-07, representing smoke dilution caused by wind on open decks, was identified as the dominant single-point vulnerability within the detection-failure branch. The critical 1–3 min detection window for LIB thermal runaway can be substantially weakened by open-deck wind conditions, making integrated detection (RCO-2) a priority intervention. This conclusion is robust to uncertainty in probability estimates, and integrated detection (RCO-2) is identified as the single highest-priority intervention.

(2)

Car-ferry passenger ships account for 104 of the 146 domestic passenger ships in the Republic of Korea, representing 71.2% of the fleet, and operate on 75 routes. The EV transport rate on car-ferry passenger ship routes increased from 0.76% in 2024 to 1.21% in 2025. Routes with high EV ratios, such as Gunsan–Gaeya (4.70%) and Singi–Yeocheon (2.60%), are priority candidates for early RCO implementation.

(3)

K-means clustering analysis (k = 3, silhouette coefficient = 0.425) of 75 route observations identified three operational clusters: Cluster 1, short-distance medium-capacity routes (n = 34; mean operation time = 0.90 h); Cluster 2, short-distance high-capacity commuter routes (n = 25; mean operation time = 1.15 h); and Cluster 3, long-distance island routes (n = 16; mean operation time = 2.78 h). Cluster 2 should be prioritised for hardware-based RCOs because it has the highest mean vehicle capacity, whereas Cluster 3 requires emphasis on re-ignition monitoring and coordinated port–fire department response planning.

(4)

Hazard identification (HAZID), conducted by a 15-member broad advisory panel, identified 23 hazards, of which 12 were amplified by the open-deck structure. The level of expert consensus satisfied the statistical agreement criterion, with Kendall’s W = 0.74 and p < 0.01. The FTA–ETA probability values were derived from the expert panel and the international literature, and sensitivity analysis confirmed that the ALARP classification remained unchanged under simultaneous ±50% variation.

(5)

When the EV loading ratio exceeds 30%, the risk enters the IMO ALARP band; when it exceeds 50%, the maximum tolerable crew individual risk is exceeded. The ALARP classification remained invariant under simultaneous ±50% variation, as shown in Table 10.

(6)

RCO-4, pre-loading inspection by passenger ship operation managers; RCO-5, crew training by passenger ship operators; and RCO-6, joint port–fire-fighting response planning, all showed GCAF values below VSL_IMO for all remaining service life categories and can be implemented immediately. The combined application of RCO-2, RCO-3, and RCO-4 reduced the calculated annual expected fatalities (AEF) by 85.6%.

(7)

The regulatory recommendations include revision of Article 97 of the MOF Standard for Ship Fire-Fighting Appliance, including strengthened safety management obligations for passenger ship operators; issuance of a KR technical circular; and submission of an MSC information document to IMO SSE 11. The findings can also serve as international reference material for improving fire-fighting equipment standards for coastal car-ferry passenger ships in other countries.

(8)

Future research should include CFD/FDS-based validation of fire spread on open decks, re-estimation of the FTA model using accumulated EV accident data, validation of the clustering results using AIS-based voyage trajectory data, and cross-validation with countries operating similar vessels, such as Japan, Greece, and Norway.

Overall, the principal contribution of this study is a transferable, regulation-ready FSA structure that converts the open-deck EV-fire problem into prioritised, cost-screened control options and a ferry-operator SMS framework. The numerical findings are expert-informed risk estimates rather than empirically validated frequencies; they are intended to direct regulatory attention and sequencing, and should be updated as EV-specific shipboard accident data accumulate.