Reconfiguring Passenger Ship Internal Environment for Damage Stability Enhancement

The traditional risk control option adopted in naval architecture to meet safety-related objectives is by regulations, targeting damage limitation, nominally instigated in the wake of maritime accidents claiming heavy loss of life. These primarily concern the introduction of watertight bulkheads, i.e., permanent (passive) reconfiguration of the internal ship environment to enhance damage stability. This has been the most common measure, manifesting itself in the wake of every serious flooding accident since the beginning, back in the 19th century. However, traditional flooding protection through watertight subdivision, to an extent dictated by IMO regulations, has a physical limit which, if exceeded, a safety plateau is reached. This is currently the case and with damage stability standards progressively increasing, the safety gap between existing and new ships is dangerously widening and with design stability margins progressively eroding, stability management is unsustainable, leading to loss of earnings at best. The need for managing the residual risk through active intervention/protection over the life-cycle of the vessel drives industry to searching and adopting a new normal. This new normal is the innovation being explained in this paper by addressing safety enchantment through a systematic reconfiguration of the ship environment for passive and active protection in flooding accidents. In this respect, the “design-optimal” internal arrangement of a vessel, is adapted and reconfigured, using passive and active containment systems for flooding incidents, in the form of high-expansion foam products. The innovation is briefly explained, claiming transformational reduction in flooding risk in the most cost-effective way available. To support wider understanding and appreciation for the latter, the paper critically reviews the whole evolution of internal ship space reconfiguration, chronologically and systematically, concluding that new technological developments and breakthroughs will bring sustainable changes to the traditional evolutionary maritime safety enhancement.


Introduction
The term "reconfiguration" is meant to imply the evolutionary process involved in passive and active damage protection, following accidental damage of the ship hull by reconfiguring the internal space of a ship. This, in turn, is linked inextricably to ship stability quantification and provision and, in particular, stability when the ship hull is damaged as a result of collision or grounding accidents. The question as to how to quantify ship stability has been addressed since ca 250 B.C. by Archimedes [1,2], although the first attempts to crystallize these principles were only made in the 17th/18th centuries, when a concept of ship stability measure, the metacentric height, or GM as it is known today, was introduced by Paul Hoste in 1698 [3,4]. This concept was later elaborated further in a more widely acknowledged exposition by Pierre Bouguer [5], who introduced in 1746 the actual term "metacenter". Leonhard Euler focused in 1749 on the righting moment at a particular angle of the heel

Background
The need for an internal watertight subdivision of the hull in compartments to resist the effect of damage (breach) of the hull, or loss of water tightness and subsequent flooding is in itself evident, as the Hammurabi Code already sanctioned 38 centuries ago (Babylon, eighteenth century BC). The need for provisions against this extremely dangerous phenomenon became more urgent, however, with the transition from ships made of wood to ships made of iron, and when the ship size and number of persons on-board increased, both out of expectations. Unfortunately, what is now considered scientifically evident in itself was not always so and came into practice very slowly, too often as a late response to dramatic accidents. Having said this, there have always been many people of practice with vision, some call it "gut feeling", who paved the way to reconfiguring the ship internal space in ways that we still struggle to master today. The Great Eastern was for her time a giant ship (with a length of 207 m, displacing 22,352 tons, and with a speed of 14 knots) designed by the great English engineer Isambard Kingdom Brunel. With a capacity of 4000 passengers in comfort or 10,000 troops "squeezed" together, she was at the time of her launch in 1858 the largest ship in the world. The latest technological achievements in naval architecture and marine engineering were integrated at the time that she was built from iron, riveted, steam powered, and propelled by two side paddle wheels and one stern propeller. Remarkably, she had not only watertight subdivision, but also a "double hull" and thus a "safety belt" inside the wetted part of the ship hull, ensuring that, if the outer shell were breached in the case of a "shallow" grounding ('raking"), the flooding of water would be confined to the space between the outer hull and the inner hull, thus enhancing her survivability. This, by today's standards, the very modern double-hull concept, appears to have saved the ship from foundering in one of her transatlantic voyages, after she had rubbed against the later-named Great Eastern Rocks off New York, sustaining a damage of over 2.7 width and 25 m length.
However, what may appear obvious and straightforward needs to be contrasted against other design requirements pertaining to performance, functionality, and cost. Internal reconfiguration impedes functionality (reduces ergonomy and space), performance (flow of people and goods), and comes at a cost (construction and maintenance). On the other hand, structural strength and reliability [17][18][19][20], as well as the basic need for structures to be crashworthy [21], bring more constraints, which are added to those pertaining to safety, leading to a complex design optimization problem. Vectorization (turning constraints into objectives-design for X) has been a vehicle to design optimization, namely design for safety and risk-based design, facilitating rational decision making in the design process, in general, and reconfiguration, in particular [15]. More importantly, however, it brought competition through interference with ship functionality (for example with evacuation routes), so the problem became not only multi-disciplinary optimization [22], but also multi-objective [23]. During the SAFEDOR Project [24], a number of steps were taken towards multi-objective and multi-disciplinary optimization. However, the focus in this paper, from a design perspective, will be on various requisite ingredients leading to cost-effective reconfiguration of the ship's internal environment for damage stability protection/enhancement by considering pertinent design constraints/objectives in the form of general rules and regulations. Many times, safety-minded practitioners in the maritime industry feel that compliance and evasion cover the whole safety spectrum but a critical review will demonstrate that safety has always been the largest single factor affecting the evolution of ship design and operation with reconfiguration of the internal ship environment the most treaded and contested avenue to enhancing maritime safety.

General Outlook on Evolution of Damage Stability "Tools"
Against a background, where everything is principally empirical and statistical, it is widely believed that the prevailing situation could be drastically improved through understanding of the underlying mechanisms leading to vessel loss and to identification of governing design and operational parameters to target flooding risk reduction cost-effectively. This, in turn, necessitated the development of appropriate methods, tools, and techniques capable of meaningfully addressing the physical phenomena involved. Having said this, it was not until the 1990s when damage survivability, pertaining to ship dynamics in a damaged condition in a seaway, was addressed by simplified numerical models [25][26][27][28][29]. The subject of damage survivability in waves (with the ship hull breached), received particular attention following the tragic accident of Estonia, to the extent that this led to a step change in the way damage stability and survivability are addressed, namely by assessing the performance of a vessel in a given environment and loading condition on the basis of the first principles. In parallel, motivated by the compelling need to understand the impact of the then imminent introduction of probabilistic damage stability regulations on the design of cargo and passenger ships and the growing appreciation of deeply-embedded problems in both the rules and the harmonization process itself, an in-depth evaluation and re-engineering of the whole probabilistic framework was launched through the EC-funded project HARDER [30]. In this respect, the HARDER-project became an IMO vehicle carrying a major load of the regulation development process, fostering international collaboration at its best. This was a major factor, contributing to the eventual success in achieving harmonization and in proposing a workable framework for damage stability calculations in IMO SLF 47. Deriving from developments at fundamental and applied levels in this project as well as other EC-funded projects, such as [31][32][33] and other international collaborative efforts (work by the Stability in Waves Committee at the International Towing Tank Conference from 1996 onwards, e.g., [34]), a clearer understanding of damage stability and survivability started to emerge. Application and verification of the developing numerical tools helped raise confidence in the available knowledge to address the subject matter effectively and with sufficient engineering accuracy. All this effort provided the inspiration and the foundation for the EC-funded large-scale Integrated Project SAFEDOR [24], which offered the opportunity to consolidate contemporary developments on damage stability and survivability, thus rendering implementation possible even with severe time limitations, such as at concept design stage. The knowledge gained has been used to critically address contemporary regulatory instruments and to foster new and better methodologies, primarily to safeguard against known design deficiencies in respect to passive damage protection. This facilitated the evolution of safer designs, reflecting this knowledge [35]. However, the cultural "shock" of adopting probabilistic rules in the maritime industry has had a more profound effect. Surprisingly, the biggest influence has been seen at the birthplace of prescription, namely IMO as indicated earlier, with goal-setting-performance-based approaches becoming the new face of safety. What is known as Safe Return to Port (SRtP) of SOLAS 2009, enforceable on every passenger newbuilding vessel and on special purpose ships over 120 m in length, has paved the way for holistic approaches to risk, specifically fire and flooding risks. These regulations represent a step change from the deterministic methods of assessing subdivision and damage stability. The old concepts of floodable length, criterion numeral, margin line, 1-and 2-compartment standards, and the B/5 line have disappeared from new building projects, which now adopt a more holistic approach to addressing damage stability and survivability, leading to safer and more ergonomic designs (for the first time in the history of hull configuration for flooding protection). With some safety-minded ship owners, the possibility exists and it is being exploited to address and undertake design and operational measures to manage flooding risk, ranging from consideration of all conceivable (statistical, experiential, judgmental) damage scenarios, loading conditions, and environments to deal with subdivision, damage survivability in waves, and residual functionality of essential systems post-damage, including evacuation and rescue and decision support systems on board, targeting cost-effective safety as a key design objective, alongside other conventional design objectives, [16]. With consideration of damage survivability analysis, using numerical time-domain simulation tools in new building projects, the survivability of passenger ships, particularly cruise vessels, has indicated considerable (positive) differences in comparison with SOLAS II-1, essentially static calculations [36]. The direct method (use of time-domain numerical simulations of damage survivability in waves) indicates higher survivability for all cruise ship sizes by removing the need for conservative assumptions and irrational generalizations. In addition, this provides considerable additional valuable information for ship design and operation for damage protection (especially extreme cases-emergencies).
Notwithstanding the above, with probabilistic damage stability regulations having originally been developed on the basis of cargo ship damage statistics, serious concerns have been raised regarding the adopted formulation for the calculation of the survival probability of passenger ships and the associated required subdivision indices, particularly for RoPax and large cruise ships [37]. Due to disquiet in industry and academia and concern deriving from the escalation of passenger ships to megaships, research focus on damage stability has shifted towards large passenger ships [38,39]. In this respect, a series of projects investigated this problem and laid down the foundation for a passenger ship-specific damage stability framework, process and criteria [40][41][42][43][44]. Becoming more closely involved with passenger ships brought to light another important and material problem. Namely, in the quest for damage stability improvement, design (passive protection, i.e., internal volume configuration) measures have traditionally been the only means to achieve this in a measurable/auditable way (SOLAS 2009, Ch. II-1). However, in principle, the consequences from inadequate damage stability can also be reduced by operational (active) measures (active protection), which may be very effective in reducing loss of life (the residual risk). There are two reasons for this. The first relates to the traditional understanding that operational measures safeguard against erosion of the design safety envelop (increase of residual risk over time). The second derives from lack of measurement and verification of the risk reduction potential of any active measures. In simple terms, what is needed is the means to account for risk reduction by operational (active protection) means as well as measures that may be taken during emergencies (again active protection). Such risk reduction may then be considered alongside risk reduction deriving from design measures. Therefore, new measures for risk reduction (operational and in emergencies) should be considered in addition to design measures. What needs to be demonstrated and justified is the level of risk reduction and a way to account for it, the latter by adopting a formal process and taking requisite steps to institutionalize it. Efforts in this direction has led to setting up a large-scale EC-funded research project, FLARE [45].

The Birth and Reign of Subdivision-A Record of Disasters
The first deviation from metacenter and static stability considerations, addressing flooding risk mitigation in the form of internal ship space reconfiguration, was introduced through the first Merchant Shipping Act in 1854 by way of introducing watertight bulkheads in the hull space and leading eventually and after heavy loss of life to the adoption of the first internationally agreed system of subdivision in SOLAS 1929 (Table 1).

1854
The first Merchant Shipping Act of 1854 is the first known legal requirement addressing safety at sea and concerning watertight bulkheads. It was enacted as a direct result of the rapid foundering of the Birkenhead in 1852 after striking a rock off South Africa, drowning some 500 women and children. The loss was rapid because the cavalry officers on board had holes cut in the transverse bulkheads in order to exercise their horses [46].

1862
Pressure in parliament by the ship owners succeeded in repelling the Act because it was simply based on "mischievous" behavior. Within three years the London and the Amelia both sank in the same storm because of inadequate subdivision, with 233 people drowning in the London alone. It is frightening that from 1876-1892, 10,381 vessels belonging to the UK were totally lost, with 27,010 seamen and 3543 passengers drowning, with losses attributed to "Acts of God". It is also worth noting that in 1878, HMS "Eurydice" was lost with nearly 400 lives lost as the ship was caught by a strong squall unprepared with some of her upper half-ports on the main deck open for ventilation and as she heeled under the force of the wind, water entered the open ports causing a sudden and complete loss of the ship.

1883
The Daphne capsized with the loss of 124 lives immediately after being launched in the Clyde. Sir Edward Reed, the commissioner of inquiry into the accident recommended that consideration should be given of the extent to which stability entered into design, construction, stowage, load line, and freeboard of ships.

1891
The Bulkhead Committee of the British Board of Trade recommended a 2-compartment standard for passenger ships, but the recommendations were not adopted. Unbelievably, in many parts of the world, one-compartment ships still exist, in spite of clear understanding today that the risk is completely "off the scale".

1895
Germany introduced a 2-compartment standard, following the rapid loss of the Elbe with the death of 340 people.

1913
Following the Titanic catastrophe in April 1912 with a loss of 1430 lives, the first International Conference on the Safety of Life at Sea (SOLAS) took place in London to consider proposals by the UK, Germany, and France. The regulations formulated did not come into effect due to World War I.

1914
The Empress of Ireland capsized in the Gulf of St. Lawrence with 1024 lives lost. The need for subdivision, it was stated "gathers momentum", but it was not until 1929 when a full International Conference was convened to consider this matter. However, the system of subdivision devised fell short of that agreed in 1913, evidence that IMO regulations reflect not experiential knowledge, as it is widely believed, but the compromise reached in each convention.

1928
The loss of the Vestris inspired proposals at the SOLAS Conference in 1930 for more secure engine room deck openings.

1929
The United States ratified the 1929 SOLAS Convention but only after the loss of the Mohawk by collision and of Morro Castle by fire.

1948
Loss of the Sankey with all hands and the Flying Enterprise in 1952 inspired legislation to prevent shifting cargoes.

1948
The SOLAS Convention and the first specific criterion on residual stability standards with the requirement for a minimum residual GM of 0.05 m. This represented an attempt to introduce a margin to compensate for the upsetting environmental forces.

1987/ 1988
Following the Herald of Free Enterprise accident in 1987 with the loss of 193 lives and a public outcry, SOLAS'90 came into effect for new ships build after 1990, introducing a considerable increase in damage stability standards [47]. Proposals by the UK to phase-in upgrading of existing ships to SOLAS'90 was rejected by IMO but a regional agreement was reached by the North West European Nations.

1991
After a madman set fire on the Scandinavian Star causing the death of 169 people, retrospective legislation was introduced for the first time in respect of enhanced "Structural Fire Protection".

1994
The Estonia was lost involving the loss of 852 lives. IMO rejected proposals for capability of withstanding water on deck of Ro-Ro passenger ships. A regional agreement was reached ("Stockholm Agreement") by the North West European Nations and later by the whole EU, Australia, and Canada [48].

1995
In the 1995 SOLAS Diplomatic Conference SOLAS'90 was adopted as a global safety standard of damage stability. A proposal to IMO of a new damage stability framework based on probabilistic methods by the North West European Nations, following intensive research in the wake of Estonia, was tabled as an item for long term discussion. The proposal considered explicitly the effect of waves and water on deck (performance-based criteria) deriving from the work undertaken by the Strathclyde Stability Research Group and allowed for various safety nets, aiming to ensure that the Estonia disaster would never happen again. A probabilistic framework was also developed and proposed [49], which formed the foundation for the EU Project HARDER [30], where the foundation of the probabilistic regulations for damage stability was developed and brought to IMO, leading eventually to SOLAS 2009. Most of the accidents referred to above have led to improved legislation just on subdivision, evidence not only of the disaster-triggered mode of regulation but also of the incident-specific approach religiously adopted. Obviously, subdivision worked and the norm in the maritime industry, "If something works don't fix it", prevailed and it is still being pursued as the primary risk control option for flooding risk mitigation and control to this day. However, every development on damage stability regulations for passenger ships does not address internal space reconfiguration explicitly, despite this being such an obvious, predominantly influencing, feature. The key reason for this, perhaps another influence of Rahola's formulation, is the fact that modern damage stability criteria, derived from model tests by Bird and Browne [50], used global parameters to define survivability in waves, as shown below and everybody subsequently followed their lead.

First Signs of Resistance-The Industry Strikes Back
Whilst evolutionary safety developments leading to hull reconfiguration are, undoubtedly, accident-triggered, there are other forces at work shaping and controlling this evolution, as the following list of recurring accidents demonstrates, see Table 2. The fact of the matter is that whilst accidents with water on deck as the common loss mechanism have contributed to the evolutionary change of legislation, Figure 1, recurrence of such accidents clearly demonstrated that lessons learned did not go far enough. The Ro-Ro concept in RoPax ship designs is fundamental to the economic viability of such concepts, thus triggering a struggle in this evolution between safety of passengers and viability of business. Therefore, whilst large open spaces in RoPax vessels is an obvious design vulnerability to large scale flooding, reconfiguring this space to enhance safety is not obvious. Key reasons for this inertia include: (1) It will consume deck and hull space and affect ergonomy; (2) It will erode earning potential (cargo space, internal logistics, deadweight); (3) It will affect negatively loss of income. Whilst evolutionary safety developments leading to hull reconfiguration are, undoubtedly, accident-triggered, there are other forces at work shaping and controlling this evolution, as the following list of recurring accidents demonstrates, see Table 2.  Damage stability evolutionary changes (initial diagram from [51] with SOLAS 2020 added for comparison purposes); see also [37,44].
The fact of the matter is that whilst accidents with water on deck as the common loss mechanism have contributed to the evolutionary change of legislation, Figure 1, recurrence of such accidents clearly demonstrated that lessons learned did not go far enough. The Ro-Ro concept in RoPax ship designs is fundamental to the economic viability of such concepts, thus triggering a struggle in this evolution between safety of passengers and viability of business. Therefore, whilst large open spaces  [51] with SOLAS 2020 added for comparison purposes); see also [37,44].

Reconfiguration Going on Overdrive
It has taken the largest modern day catastrophe, namely the Estonia disaster, claiming 853 lives, to shake the foundations of the industry and to bring economic and other barriers down, leading to a hull space reconfiguration onslaught, both external and internal to the ship hull, as summarized in Table 3 below pertaining to North West European Nations Ro-Ro fleet [52]. Research post-Estonia marks the first attempt to escape from the regulatory "trap" laid by Rahola and Bird, namely focusing on global design parameters. Describing their proposal of the static equivalent method [53], the main target was the reconfiguration of the Ro-Ro deck in RoPax ships, in addition to the traditional subdivision below the bulkhead deck, as shown in (2).
where both the Hs crit and h are taken as median values of the respective random quantities. The critical significant wave height can be then used in the s-factor formulation adopting the cumulative distribution of waves from IMO. In project HARDER [30], the formulation was updated following a statistical relationship between dynamic water head (h), the freeboard (f), and the critical heel angle, and the mean significant survival wave height ( Figure 2).

Reconfiguration Going on Overdrive
It has taken the largest modern day catastrophe, namely the Estonia disaster, claiming 853 lives, to shake the foundations of the industry and to bring economic and other barriers down, leading to a hull space reconfiguration onslaught, both external and internal to the ship hull, as summarized in Table 3 below pertaining to North West European Nations Ro-Ro fleet [52]. Research post-Estonia marks the first attempt to escape from the regulatory "trap" laid by Rahola and Bird, namely focusing on global design parameters. Describing their proposal of the static equivalent method [53], the main target was the reconfiguration of the Ro-Ro deck in RoPax ships, in addition to the traditional subdivision below the bulkhead deck, as shown in (2).
where both the and h are taken as median values of the respective random quantities. The critical significant wave height can be then used in the s-factor formulation adopting the cumulative distribution of waves from IMO. In project HARDER [30], the formulation was updated following a statistical relationship between dynamic water head (h), the freeboard (f), and the critical heel angle, and the mean significant survival wave height ( Figure 2). Observing the various risk control options used, the tendency for cluttering of the internal spaces becomes obvious, basically due to the fact that attention was focused around mid-ship, namely the middle 1/3 of the ship, as the Stockholm Agreement targeted SOLAS'90 2-compartment damages in this region. Notwithstanding this, the Stockholm Agreement was the first performance-based standard, accounting for water on deck and environmental conditions in the area of operation as well as the dynamic process of the vessel, the environment, and their interaction for the first time in maritime history.
It is noteworthy that no RoPax vessel has been lost since the introduction of this legislation due to water on deck problems. In fact, the Stockholm Agreement was in force in parallel with probabilistic regulations for damage stability, until it gave way to a fully probabilistic approach for RoPax vessels, namely SOLAS 2020, following a pertinent DGMOVE-funded study [44]. Part of this success is also owing to the fact that for the first time in the regulation history of damage stability, the Stockholm Agreement has been applied retrospectively. In the maritime industry, new legislation applies only to new buildings, thus leaving the majority of ships (90% of all the ships are already in operation) operating at inferior standards. This is known as the Grandfather's Clause, a serious Observing the various risk control options used, the tendency for cluttering of the internal spaces becomes obvious, basically due to the fact that attention was focused around mid-ship, namely the middle 1/3 of the ship, as the Stockholm Agreement targeted SOLAS'90 2-compartment damages in this region. Notwithstanding this, the Stockholm Agreement was the first performance-based standard, accounting for water on deck and environmental conditions in the area of operation as well as the dynamic process of the vessel, the environment, and their interaction for the first time in maritime history.
It is noteworthy that no RoPax vessel has been lost since the introduction of this legislation due to water on deck problems. In fact, the Stockholm Agreement was in force in parallel with probabilistic regulations for damage stability, until it gave way to a fully probabilistic approach for RoPax vessels, namely SOLAS 2020, following a pertinent DGMOVE-funded study [44]. Part of this success is also owing to the fact that for the first time in the regulation history of damage stability, the Stockholm Agreement has been applied retrospectively. In the maritime industry, new legislation applies only to new buildings, thus leaving the majority of ships (90% of all the ships are already in operation) operating at inferior standards. This is known as the Grandfather's Clause, a serious drawback in maritime safety and its evolution (Grandfather's Clause is the legal term used to describe a situation in which an old rule continues to apply to some existing situations, while a new rule will apply to all future situations). Table 3. Technical information on retrofitted Ro-Ro passenger ships for Stockholm Agreement compliance [52].

Item
Technical Information In project HARDER [30], tradition once again helped overrule deviation from convention and the physics-based formulation given in (2), leading to the formulation given in (3) for the survivability factor that formed the basis of SOLAS 2009 damage stability probabilistic rules, linking critical significant wave height (Hs crit ) to parameters of the residual stability curve, namely GZmax and Range.
On the other hand, decluttering of internal reconfiguration through structural changes was significantly eased up with the introduction of the SOLAS 2009 probabilistic rules for damage stability as attention has been shifted from around the middle 1/3 of the ship and, in principle, below the ship hull to the whole ship, including penetration of damages up to the ship center line (instead of B/5) and up to 18 m from baseline, rather than up to the freeboard deck. However, being able to follow a rational approach to subdivision and flooding protection brought new problems of its own. Namely, with probabilistic damage stability rules having originally been developed on the basis of cargo ship damage statistics, serious concerns have been raised regarding the adopted formulation for the calculation of the survival probability of passenger ships and the associated required subdivision indices, particularly for RoPax and large cruise ships [36,39]. Due to disquiet in industry and academia and concern deriving from the escalation of passenger ships to megaships, research focus on damage stability has shifted towards large passenger ships and to a more holistic approach to flooding and fire incidents, known as "Safe Return to Port".

A New Wave of Reconfiguration-Safe Return to Port
In May 2000, the IMO Secretary General called for a critical review of the safety of large passenger ships noting that "what merits due consideration is whether SOLAS requirements, several of which were drafted before some of these large ships were built, duly address all the safety aspects of their operation-in particular, in emergency situations". This visionary prompt led the IMO Maritime Safety Committee (MSC) to adopt a new "philosophy" and a working approach for developing safety standards for passenger ships. In this approach, illustrated in Figure 3 (SLF 47/48), modern safety expectations are expressed as a set of specific safety goals and objectives, addressing design (prevention), operation (mitigation), and decision-making in emergency situations (emergency response) with an overarching safety goal, commensurate with no loss of human life due to ship-related accidents. This quest, in principle, a life-cycle risk management framework, has climaxed to the "zero tolerance" concept of safe return to port, introduced in July 2009 and the ensuing developments pertaining to "Safety Level", "Alternative Design and Arrangements", "Risk-Based Design", and "Goal-Based Standards". This prompted an open proclamation (April 2012) by the Secretary General of the International Maritime Organisation Koji Sekimizou, in addressing guests in the annual dinner of the royal institution of naval architects, of which deterministic requirements have no future. The term "Safe Return to Port" (SRtP) has been widely adopted in discussing this framework, which addresses all the basic elements pre-requisite to quantifying the safety level (life-cycle risk) of a ship at sea and providing an approach for de-risking all related fire and flooding casualties. the ship hull to the whole ship, including penetration of damages up to the ship center line (instead of B/5) and up to 18 m from baseline, rather than up to the freeboard deck. However, being able to follow a rational approach to subdivision and flooding protection brought new problems of its own. Namely, with probabilistic damage stability rules having originally been developed on the basis of cargo ship damage statistics, serious concerns have been raised regarding the adopted formulation for the calculation of the survival probability of passenger ships and the associated required subdivision indices, particularly for RoPax and large cruise ships [36,39]. Due to disquiet in industry and academia and concern deriving from the escalation of passenger ships to megaships, research focus on damage stability has shifted towards large passenger ships and to a more holistic approach to flooding and fire incidents, known as "Safe Return to Port".

A New Wave of Reconfiguration-Safe Return to Port
In May 2000, the IMO Secretary General called for a critical review of the safety of large passenger ships noting that "what merits due consideration is whether SOLAS requirements, several of which were drafted before some of these large ships were built, duly address all the safety aspects of their operation-in particular, in emergency situations". This visionary prompt led the IMO Maritime Safety Committee (MSC) to adopt a new "philosophy" and a working approach for developing safety standards for passenger ships. In this approach, illustrated in Figure 3 (SLF 47/48), modern safety expectations are expressed as a set of specific safety goals and objectives, addressing design (prevention), operation (mitigation), and decision-making in emergency situations (emergency response) with an overarching safety goal, commensurate with no loss of human life due to ship-related accidents. This quest, in principle, a life-cycle risk management framework, has climaxed to the "zero tolerance" concept of safe return to port, introduced in July 2009 and the ensuing developments pertaining to "Safety Level", "Alternative Design and Arrangements", "Risk-Based Design", and "Goal-Based Standards". This prompted an open proclamation (April 2012) by the Secretary General of the International Maritime Organisation Koji Sekimizou, in addressing guests in the annual dinner of the royal institution of naval architects, of which deterministic requirements have no future. The term "Safe Return to Port" (SRtP) has been widely adopted in discussing this framework, which addresses all the basic elements pre-requisite to quantifying the safety level (life-cycle risk) of a ship at sea and providing an approach for de-risking all related fire and flooding casualties. Casualty Threshold: This advocates the fact that the ship should be designed for improved survivability so that, in the event of a casualty, persons can stay safely on board as the ship proceeds to port. In this respect and for design purposes (only), a casualty threshold needs to be defined whereby a ship suffering a casualty below the defined threshold is expected to stay upright and afloat and be habitable for as long as necessary (it constitutes part of the design work to determine this value rationally, as it greatly influences the design arrangements (ship environment reconfiguration)) Casualty Threshold: This advocates the fact that the ship should be designed for improved survivability so that, in the event of a casualty, persons can stay safely on board as the ship proceeds to port. In this respect and for design purposes (only), a casualty threshold needs to be defined whereby a ship suffering a casualty below the defined threshold is expected to stay upright and afloat and be habitable for as long as necessary (it constitutes part of the design work to determine this value rationally, as it greatly influences the design arrangements (ship environment reconfiguration)) in order to return to port under its own power or wait for assistance. This, in turn, has introduced a new wave of internal ship space reconfiguration for protection of the ship prime movers with longitudinal B/10 bulkheads by way of the engine room as well as internal reconfiguration for redundancy provision by partitioning the engine room itself or other redundancy arrangements, involving segregation of essential systems.
Emergency Systems Availability/Evacuation and Rescue: Should the casualty threshold be exceeded, the ship must remain stable and afloat for sufficiently long time (3 h recommended) to allow safe and orderly evacuation (assembly, disembarkation, and abandoning) of passengers and crew. Emergency system availability to perform all requisite functions in any of the scenarios considered is, therefore, implicit in the framework. In addition, the ship should be crewed, equipped, and have arrangements in place to ensure the health, safety, medical care, and security of persons on-board in the area of operation, taking into account climatic conditions and the availability of SAR functions until more specialized assistance is available. This, in turn, introduced an array of changes in the internal ship environment as well as new spaces (safety areas) to enhance requisite functionality post-casualty, including: Safety centers, redundant safety systems, new evacuation routes, muster stations, new LSA; many of the latter within the internal ship envelop.

RoPax vs. Cruise Ships: Hitting a "Wall"
In support of the aforementioned developments and in the pursuit to de-risk large passenger ships, a series of projects investigated this problem and laid down the foundation for a passenger ship-specific damage stability framework, process, and criteria [40][41][42][43][44]. The outcomes of two of these projects are shown in Figures 4 and 5 in order to return to port under its own power or wait for assistance. This, in turn, has introduced a new wave of internal ship space reconfiguration for protection of the ship prime movers with longitudinal B/10 bulkheads by way of the engine room as well as internal reconfiguration for redundancy provision by partitioning the engine room itself or other redundancy arrangements, involving segregation of essential systems. Emergency Systems Availability/Evacuation and Rescue: Should the casualty threshold be exceeded, the ship must remain stable and afloat for sufficiently long time (3 h recommended) to allow safe and orderly evacuation (assembly, disembarkation, and abandoning) of passengers and crew. Emergency system availability to perform all requisite functions in any of the scenarios considered is, therefore, implicit in the framework. In addition, the ship should be crewed, equipped, and have arrangements in place to ensure the health, safety, medical care, and security of persons onboard in the area of operation, taking into account climatic conditions and the availability of SAR functions until more specialized assistance is available. This, in turn, introduced an array of changes in the internal ship environment as well as new spaces (safety areas) to enhance requisite functionality post-casualty, including: Safety centers, redundant safety systems, new evacuation routes, muster stations, new LSA; many of the latter within the internal ship envelop.

RoPax vs. Cruise Ships: Hitting a "Wall"
In support of the aforementioned developments and in the pursuit to de-risk large passenger ships, a series of projects investigated this problem and laid down the foundation for a passenger ship-specific damage stability framework, process, and criteria [40][41][42][43][44]. The outcomes of two of these projects are shown in Figures 4 and 5.   Another outcome relates to alternative s-factor formulations accounting for the reconfiguration of the internal ship space, even above the strength deck, a real novelty, which for the first time was taken further in Project GOALDS [53,54].
where VR is a measure of the residual volume (scaled appropriately). The scene was set properly for this concept to be further considered in the project eSAFE where Atzampos has developed a formulation for the Hscrit [36].
where, TGZmax = 0.30 m target value for residual GZmax, TRange = 30 degrees target value for residual range, λ = scaling factor accounting for ship and damage size. However, despite achieving better estimate of survivability, the fact that the general formulation failed to account for the complex internal environment of cruise ships, which undoubtedly determines the evolution of flooding and the eventual outcome, it was concluded that the only way forward in determining the damage survivability of cruise ships is by using the direct method of assessment, as explained in Section 5, which is also being adopted in EU-Project FLARE [45].
However, the strong suggestion by these research projects on increasing the damage stability standards, specifically for RoPax vessels and in general for passenger ships has met with strong resistance by industry, ultimately reaching a compromise at IMO for much modest damage stability standards. Key reasons for this relates to the industry having reached a conclusion that design measures to improve damage stability standards, primarily through further reconfiguration of the internal environment, has reached saturation and a crucial point where viability of business has to be compromised in favor of passenger safety. Something had to give and sacrificing the viability of the business will never be the route leading to a solution. Hence, the shift to a new perspective became inevitable. 4.2.6. Widening the Reconfiguration Perspective: Passive and Active Protection Another outcome relates to alternative s-factor formulations accounting for the reconfiguration of the internal ship space, even above the strength deck, a real novelty, which for the first time was taken further in Project GOALDS [53,54].
where V R is a measure of the residual volume (scaled appropriately). The scene was set properly for this concept to be further considered in the project eSAFE where Atzampos has developed a formulation for the Hscrit [36].

Hs crit = 7·
MIN(λ·Range, TRange) TRange · MIN(λ·GZ max , TGZ max ) TGZ max 1.05 (5) where, TGZ max = 0.30 m target value for residual GZmax, TRange = 30 degrees target value for residual range, λ = scaling factor accounting for ship and damage size. However, despite achieving better estimate of survivability, the fact that the general formulation failed to account for the complex internal environment of cruise ships, which undoubtedly determines the evolution of flooding and the eventual outcome, it was concluded that the only way forward in determining the damage survivability of cruise ships is by using the direct method of assessment, as explained in Section 5, which is also being adopted in EU-Project FLARE [45].
However, the strong suggestion by these research projects on increasing the damage stability standards, specifically for RoPax vessels and in general for passenger ships has met with strong resistance by industry, ultimately reaching a compromise at IMO for much modest damage stability standards. Key reasons for this relates to the industry having reached a conclusion that design measures to improve damage stability standards, primarily through further reconfiguration of the internal environment, has reached saturation and a crucial point where viability of business has to be compromised in favor of passenger safety. Something had to give and sacrificing the viability of the business will never be the route leading to a solution. Hence, the shift to a new perspective became inevitable.

Widening the Reconfiguration Perspective: Passive and Active Protection
The "necessity is the mother of all invention" dogma has one again offered a way forward. Namely, in the quest for damage stability improvement, design (passive) protection has traditionally been the only means to achieve this in a measurable/auditable way (SOLAS 2009, Ch. II-1). However, in principle, the consequences from inadequate damage stability can also be reduced by operational (active) measures, which may be very effective in reducing loss of life (the residual risk). There are two reasons for this. The first relates to the traditional understanding that operational measures safeguard against erosion of the design safety envelop (increase of residual risk over time). The second derives from lack of measurement and verification of the risk reduction potential by any active measures. In simple terms, what is needed is the means to account for risk reduction by operational (interventional) means as well as measures that may be taken during emergencies. Such risk reduction may then be considered alongside risk reduction deriving from design measures. Therefore, new measures for risk reduction (operational and in emergencies) should be considered in addition to design measures. What needs to be demonstrated and justified is the level of risk reduction and a way to account for it, the latter by adopting a formal process and taking requisite steps to institutionalize it. Efforts in this direction is the focus of ongoing large-scale EC-funded research project, FLARE [45]. The key facilitator in this respect is the regulation for Alternative Design and Arrangements (AD&A) [55,56], which opens the door to innovation.

The Way forward: Technological Innovation Is the Key
Notwithstanding the lack of a life-cycle regulatory framework complete with passive and active measures of damage stability protection, the regulation for "alternatives" provides the requisite platform for the first important steps. As indicated in the foregoing, with accidents providing the main motivation, emphasis has primarily been placed on reducing consequences, i.e., on cure rather than prevention. The key reason for this derives from the fact that the residual risk post flooding accidents is unacceptably high, meaning that the most-cost-effective way to reducing flooding risk is to reduce the residual risk, namely on technological innovation, targeting cost-effective solutions to damage stability problem.

Damage Stability Is Still the Highest Risk Contributor in the Maritime Industry
Within half a century, progress in damage stability research and application has been unprecedented, from a subject barely understood and largely unscientific to considering real-time flooding risk assessment on-board. Moreover, the divide between research and application has been narrowing over the years, with an array of safety systems and emergency response systems on-board some of the modern passenger ships that can challenge any other transport industry. This has put ship safety in perspective and with flooding post collision and grounding accidents continuing to be the key risk contributor for passenger ships, resolving this problem remains a priority ( Figure 6). In particular, for cruise ships, Figure 7 shows that the maximum numbers of passengers carried by the largest cruise ships each year has risen dramatically, almost doubling to 6800 in 2019 compared to 1999 (Clarkson, 2020). This means that there is now a far greater risk of passenger fatality from any given single accident.
Moreover, the realization that risk is inextricably linked to operation and a derivative of exposure has driven the industry to life-cycle considerations for effective risk management. This, in turn, has provided the motivation and the platform for wider industry inculcation.

The Concept
Safety is normally a compromise to vessel earning potential and, as public demand for higher safety standards grows, industry is forced to choose between viability of business and safety of customers. To address this for flooding risk the "in-operation" optimal internal arrangement of the vessel is adapted and reconfigured, using passive (in-built) and active (controlled) containment systems, comprising the use of high expansion foam to restrict and contain the amount of floodwater entering the ship hull post flooding accidents, to provide the most effective protection possible, when in crisis from any flooding events [57]. With passive/active foam protection, flooding risk is all but eradicated. This leads to transformational reduction in flooding risk in the most cost-effective way available.

Damage Stability is Still the Highest Risk Contributor in the Maritime Industry
Within half a century, progress in damage stability research and application has been unprecedented, from a subject barely understood and largely unscientific to considering real-time flooding risk assessment on-board. Moreover, the divide between research and application has been narrowing over the years, with an array of safety systems and emergency response systems on-board some of the modern passenger ships that can challenge any other transport industry. This has put ship safety in perspective and with flooding post collision and grounding accidents continuing to be the key risk contributor for passenger ships, resolving this problem remains a priority ( Figure 6). In particular, for cruise ships, Figure 7 shows that the maximum numbers of passengers carried by the largest cruise ships each year has risen dramatically, almost doubling to 6800 in 2019 compared to 1999 (Clarkson, 2020). This means that there is now a far greater risk of passenger fatality from any given single accident.   Moreover, the realization that risk is inextricably linked to operation and a derivative of exposure has driven the industry to life-cycle considerations for effective risk management. This, in turn, has provided the motivation and the platform for wider industry inculcation.

The Concept
Safety is normally a compromise to vessel earning potential and, as public demand for higher safety standards grows, industry is forced to choose between viability of business and safety of customers. To address this for flooding risk the "in-operation" optimal internal arrangement of the vessel is adapted and reconfigured, using passive (in-built) and active (controlled) containment systems, comprising the use of high expansion foam to restrict and contain the amount of floodwater entering the ship hull post flooding accidents, to provide the most effective protection possible, when in crisis from any flooding events [57]. With passive/active foam protection, flooding risk is all but eradicated. This leads to transformational reduction in flooding risk in the most cost-effective way available.

Loss Modalities of a Damaged Ship
To contain and control the outcome of a ship hull breach in the event of collision and grounding accidents, particularly in ships with complex internal architecture, such as passenger ships, it is important to be able to understand and assess quickly whether the ship will survive the damage or not and in the latter case, how long it will take. In either case, it will be prudent to have all this knowledge a priori (e.g., during the design phase by exploring all feasible damage cases, identifying loss scenarios, and taking measures to either contain and control all such scenarios or allow for safe

Loss Modalities of a Damaged Ship
To contain and control the outcome of a ship hull breach in the event of collision and grounding accidents, particularly in ships with complex internal architecture, such as passenger ships, it is important to be able to understand and assess quickly whether the ship will survive the damage or not and in the latter case, how long it will take. In either case, it will be prudent to have all this knowledge a priori (e.g., during the design phase by exploring all feasible damage cases, identifying loss scenarios, and taking measures to either contain and control all such scenarios or allow for safe evacuation of all the people on-board). This, in turn, entails understanding of loss modalities and a forensic detail of floodwater progression. A brief explanation of the former is warranted here to allow for an educated introduction of the various flooding risk control options being introduced in the next section.
Following hull breach of a ship in a seaway that leads to flooding of internal ship spaces, the ship will first undergo a transient response as a result of the inrush of floodwater, which may lead to the vessel capsizing without equilibrium being restored (transient asymmetric flooding), such response resulting normally with the ship heeling towards the oncoming waves, but depending on the latter and the ship response, the ship may heel towards the leeside, which, depending on the size of the breach and the internal ship arrangement, may be beneficial. As a general conclusion, the multitude of parameters affecting the initial response and the evolution of flooding and ship behavior means that one cannot address these prescriptively. Here a generalized description is presented in Figure 8 to facilitate better understanding of the risk control options being advocated.
Transient Flooding: Inrush of floodwater through hull breach, causing rapid heel into/away from breach side, in a time interval shorter than the natural period of the ship.
Progressive Flooding: Floodwater propagates through unprotected openings within the vessel, slowly diminishing stability until either a stationary state is reached, or the vessel succumbs to capsize/sinking; general duration from several minutes to hours.
Stationary State: The vessel reaches quasi-dynamic equilibrium (average roll is constant). The first reported transient capsize was for European Gateway [59]. For cruise ships, the transient capsize phenomenon was first noticed and studied in [58,60] but the observations and derived results did not make any significant inroads into the regulation-making process. This is rather unfortunate, as time limitations, relating to transient flooding loss, render this the most dangerous loss mode. Some attempts have been made to consider the effect of transient flooding on stability by focusing on different stages of this process in a quasi-static manner and, in this respect, an intermediate stage s-factor has been adopted at IMO (SOLAS 2009 Regulations). Figure 9, relating to a large-scale model experiment and to numerical simulation results of the same, demonstrate that transient capsize of a typical cruise ship 2-compartment SOLAS damage could take place rather quickly for a ship in full compliance with statutory damage stability regulations [58]. Similarly, Figure 10, where time-domain simulation software for damage survivability in waves is used to identify different loss modalities, demonstrates that transient capsizes for 2-compartment damages of a very good SOLAS'90 cruise ship design is quite common. The first reported transient capsize was for European Gateway [59]. For cruise ships, the transient capsize phenomenon was first noticed and studied in [58,60] but the observations and derived results did not make any significant inroads into the regulation-making process. This is rather unfortunate, as time limitations, relating to transient flooding loss, render this the most dangerous loss mode. Some attempts have been made to consider the effect of transient flooding on stability by focusing on different stages of this process in a quasi-static manner and, in this respect, an intermediate stage s-factor has been adopted at IMO (SOLAS 2009 Regulations). Figure 9, relating to a large-scale model experiment and to numerical simulation results of the same, demonstrate that transient capsize of a typical cruise ship 2-compartment SOLAS damage could take place rather quickly for a ship in full compliance with statutory damage stability regulations [58]. Transient Flooding: Inrush of floodwater through hull breach, causing rapid heel into/away from breach side, in a time interval shorter than the natural period of the ship.
Progressive Flooding: Floodwater propagates through unprotected openings within the vessel, slowly diminishing stability until either a stationary state is reached, or the vessel succumbs to capsize/sinking; general duration from several minutes to hours.
Stationary State: The vessel reaches quasi-dynamic equilibrium (average roll is constant). The first reported transient capsize was for European Gateway [59]. For cruise ships, the transient capsize phenomenon was first noticed and studied in [58,60] but the observations and derived results did not make any significant inroads into the regulation-making process. This is rather unfortunate, as time limitations, relating to transient flooding loss, render this the most dangerous loss mode. Some attempts have been made to consider the effect of transient flooding on stability by focusing on different stages of this process in a quasi-static manner and, in this respect, an intermediate stage s-factor has been adopted at IMO (SOLAS 2009 Regulations). Figure 9, relating to a large-scale model experiment and to numerical simulation results of the same, demonstrate that transient capsize of a typical cruise ship 2-compartment SOLAS damage could take place rather quickly for a ship in full compliance with statutory damage stability regulations [58]. Similarly, Figure 10, where time-domain simulation software for damage survivability in waves is used to identify different loss modalities, demonstrates that transient capsizes for 2-compartment damages of a very good SOLAS'90 cruise ship design is quite common. Similarly, Figure 10, where time-domain simulation software for damage survivability in waves is used to identify different loss modalities, demonstrates that transient capsizes for 2-compartment damages of a very good SOLAS'90 cruise ship design is quite common.
Progressive flooding capsizes have been studied more systematically in the various EC-funded and other projects and have been made the basis for the current SOLAS (SOLAS 2009 and SOLAS 2020) requirements. However, even in these regulations, this loss modality is considered on the basis of mainly experimental results of RoPax vessels in waves up to 4 m Hs with the effect of the latter considered as an average influence on survivability, captured by correlating GZ-curve properties (GZmax and Range) to Hs, as explained earlier. Typical RoPax vessel test set up and results in progressive flooding loss modality are shown in Figures 11 and 12, respectively. This is a mode of capsize that was made the basis for all contemporary developments, particularly pertaining to probabilistic regulations, adopted at IMO. The rapidly escalating trace of water on deck in Figure 11 designates the time instant, which is normally referred to in the literature as the "point of no return", at which the mass of floodwater on the car deck increases exponentially and the vessel capsizes very rapidly. Of course, in the presence of superstructure, this may delay considerably as in the case of the RoPax vessel Estonia where it has taken 50 min for the vessel to "turn turtle" and eventually sink. Moreover, water accumulation on the car deck is not entirely deterministic as it depends on many stochastic influences; hence, it is rather difficult to estimate the amount of water on deck, leading to vessel capsize. In cruise ships, a similar mechanism may lead to vessel loss, in this case related to the service corridor on the main deck, which provides the conduit for water to spread longitudinally in the vessel as well as up-flooding via the vertical service trunks and stairwells.

Reconfiguration by AREST Systems
AREST Systems relate to a University of Strathclyde Patent (Patent No.PCT/GB2017/050681) pertaining to a series of active and passive patented systems, comprising the use of high expansion foam to restrict and contain the floodwater entering the hull post flooding accidents. The deployable systems also offer fire protection as per SOLAS. An illustration and brief description for the various systems is provided in the following. Progressive flooding capsizes have been studied more systematically in the various EC-funded and other projects and have been made the basis for the current SOLAS (SOLAS 2009 and SOLAS 2020) requirements. However, even in these regulations, this loss modality is considered on the basis of mainly experimental results of RoPax vessels in waves up to 4 m Hs with the effect of the latter considered as an average influence on survivability, captured by correlating GZ-curve properties (GZmax and Range) to Hs, as explained earlier. Typical RoPax vessel test set up and results in progressive flooding loss modality are shown in Figures 11 and 12, respectively. This is a mode of capsize that was made the basis for all contemporary developments, particularly pertaining to probabilistic regulations, adopted at IMO. The rapidly escalating trace of water on deck in Figure 11 designates the time instant, which is normally referred to in the literature as the "point of no return", at which the mass of floodwater on the car deck increases exponentially and the vessel capsizes very rapidly. Of course, in the presence of superstructure, this may delay considerably as in the case of the RoPax vessel Estonia where it has taken 50 min for the vessel to "turn turtle" and eventually sink. Moreover, water accumulation on the car deck is not entirely deterministic as it depends on many stochastic influences; hence, it is rather difficult to estimate the amount of water on deck, leading to vessel capsize. In cruise ships, a similar mechanism may lead to vessel loss, in this case related to the service corridor on the main deck, which provides the conduit for water to spread longitudinally in the vessel as well as up-flooding via the vertical service trunks and stairwells.  Figures 11 and 12, respectively. This is a mode of capsize that was made the basis for all contemporary developments, particularly pertaining to probabilistic regulations, adopted at IMO. The rapidly escalating trace of water on deck in Figure 11 designates the time instant, which is normally referred to in the literature as the "point of no return", at which the mass of floodwater on the car deck increases exponentially and the vessel capsizes very rapidly. Of course, in the presence of superstructure, this may delay considerably as in the case of the RoPax vessel Estonia where it has taken 50 min for the vessel to "turn turtle" and eventually sink. Moreover, water accumulation on the car deck is not entirely deterministic as it depends on many stochastic influences; hence, it is rather difficult to estimate the amount of water on deck, leading to vessel capsize. In cruise ships, a similar mechanism may lead to vessel loss, in this case related to the service corridor on the main deck, which provides the conduit for water to spread longitudinally in the vessel as well as up-flooding via the vertical service trunks and stairwells.

Reconfiguration by AREST Systems
AREST Systems relate to a University of Strathclyde Patent (Patent No.PCT/GB2017/050681) pertaining to a series of active and passive patented systems, comprising the use of high expansion foam to restrict and contain the floodwater entering the hull post flooding accidents. The deployable systems also offer fire protection as per SOLAS. An illustration and brief description for the various systems is provided in the following.

AREST P1: Crashworthy Vulnerable Areas with Permanent Void Foam Filling
The AREST P1 system focuses on vulnerable areas where improved structural crashworthiness (favorable redistribution of the p-factor/reduction of the crash probability, Figure 13) will lead to improved survivability. This is a design (passive) measure, independent of loss modality. The crashworthy structural design alternative that is being considered is the addition of a longitudinal B/10 bulkhead (covering only the vulnerable area extent) with the void in between filled with high expansion foam. Risk reduction (improved survivability) and cost of this risk control option will support a cost-effectiveness analysis using gross cost of averting a fatality (GCAF) for ship survivability enhancement. Approval through the alternative design and arrangements (AD&A) process is required. Improvement on survivability is significant (depending on the protected area) and this is further enhanced by filling the void with high expansion foam to reduce asymmetry and to further enhance crashworthiness [61]. The AREST P1 system focuses on vulnerable areas where improved structural crashworthiness (favorable redistribution of the p-factor/reduction of the crash probability, Figure 13) will lead to improved survivability. This is a design (passive) measure, independent of loss modality. The crashworthy structural design alternative that is being considered is the addition of a longitudinal B/10 bulkhead (covering only the vulnerable area extent) with the void in between filled with high expansion foam. Risk reduction (improved survivability) and cost of this risk control option will support a cost-effectiveness analysis using gross cost of averting a fatality (GCAF) for ship survivability enhancement. Approval through the alternative design and arrangements (AD&A) process is required. Improvement on survivability is significant (depending on the protected area) and this is further enhanced by filling the void with high expansion foam to reduce asymmetry and to further enhance crashworthiness [61]. This is a passive flooding protection system pertaining to the installation of permanent foam in void spaces, see Figure 14, to provide additional reserve buoyancy when these spaces are damaged following a flooding incident, thus increasing GM. Such installations act much like buoyancy tanks with impermeable volume to provide buoyancy when damaged within the immediate damaged area. Upon installation, the foam adheres to the vessel steel structure and acts as a protective/anti-corrosive This is a passive flooding protection system pertaining to the installation of permanent foam in void spaces, see Figure 14, to provide additional reserve buoyancy when these spaces are damaged following a flooding incident, thus increasing GM. Such installations act much like buoyancy tanks with impermeable volume to provide buoyancy when damaged within the immediate damaged area. Upon installation, the foam adheres to the vessel steel structure and acts as a protective/anti-corrosive coating, prohibiting build-up of moisture between foam and the ship structure, offering effective insulation. The foam is resilient and will last, without degradation, for the vessel's life span. This is a passive flooding protection system pertaining to the installation of permanent foam in void spaces, see Figure 14, to provide additional reserve buoyancy when these spaces are damaged following a flooding incident, thus increasing GM. Such installations act much like buoyancy tanks with impermeable volume to provide buoyancy when damaged within the immediate damaged area. Upon installation, the foam adheres to the vessel steel structure and acts as a protective/anti-corrosive coating, prohibiting build-up of moisture between foam and the ship structure, offering effective insulation. The foam is resilient and will last, without degradation, for the vessel's life span.

AREST A1: Active Foam Application-Filling Voids in Flooded Compartments
This is an active foam deployment system comprising modular, standard "kit of parts" in the form of bottled foaming agents, dedicated pump and piping system, and centralized distribution as may be requited. It is located in a non-intrusive location within the vessel and is fully integrated into

AREST A1: Active Foam Application-Filling Voids in Flooded Compartments
This is an active foam deployment system comprising modular, standard "kit of parts" in the form of bottled foaming agents, dedicated pump and piping system, and centralized distribution as may be requited. It is located in a non-intrusive location within the vessel and is fully integrated into the ship safety management system with dedicated decision support. Foam is deployed in high-risk ship compartments on top of the floodwater entering the ship to suppress, contain, and control its progression and potentially to push floodwater out, see Figure 15. This results in a reduction in lost buoyancy, free surface effects and progressive flooding, thus leading to enhanced damage stability. The foam being used is closed cell with 1-2% permeability, 1:40 expansion ratio, 1 bar expanding pressure, and 2 bar compressive strength. the ship safety management system with dedicated decision support. Foam is deployed in high-risk ship compartments on top of the floodwater entering the ship to suppress, contain, and control its progression and potentially to push floodwater out, see Figure 15. This results in a reduction in lost buoyancy, free surface effects and progressive flooding, thus leading to enhanced damage stability. The foam being used is closed cell with 1-2% permeability, 1:40 expansion ratio, 1 bar expanding pressure, and 2 bar compressive strength.  AREST A3/A3F: Deployable Watertight Bulkheads for Flooding/Fire Protection During the flooding process of a complex internal environment, like that of a modern cruise ship, the progressive flooding paths therein can be likened to the cardiovascular system of the human anatomy. Thus, there exist minor progressive flooding paths, acting like veins and major progressive floodwater paths like arteries. In order to most effectively deal with progressive flooding, it is best to focus on blocking these arteries ( Figure 16). In this schematic representation of a complex internal ship environment, it can be observed that although the progressive flooding process can take on a multitude of routes through many openings, if it is simply cut off at its source, the problem can be dealt with in a simple, yet highly effective manner. This is facilitated through forensic examination of all flooding scenarios to identify critical openings and flooding pathways. AREST A3/A3F: Deployable Watertight Bulkheads for Flooding/Fire Protection During the flooding process of a complex internal environment, like that of a modern cruise ship, the progressive flooding paths therein can be likened to the cardiovascular system of the human anatomy. Thus, there exist minor progressive flooding paths, acting like veins and major progressive floodwater paths like arteries. In order to most effectively deal with progressive flooding, it is best to focus on blocking these arteries ( Figure 16). In this schematic representation of a complex internal ship environment, it can be observed that although the progressive flooding process can take on a multitude of routes through many openings, if it is simply cut off at its source, the problem can be dealt with in a simple, yet highly effective manner. This is facilitated through forensic examination of all flooding scenarios to identify critical openings and flooding pathways.  Deployable barriers comprise two lightweight shutters made of fire-resistant flexible textile, 30 cm thick (normally A-class fire rated). Shutters are only deployed in case of fire casualties. In the case of flooding, the cavity between shutters is filled with expanding foam delivered from a compressed foam canister. As demonstrated in the schematic arrangements in Figure 17, the shutters are mechanically operated to be deployed vertically or horizontally to suit local structural details and arrangements. The watertight integrity ascertained is typically rated up to 2 bar (20 m water head). The barrier can span distances up to 30 m, with stiffening rods present within the textile, and can be deployed within minutes to curtail and control previously identified critical floodwater pathways. In this respect, drawing on the results of the time-domain flooding simulations, an effective damage control plan could be set up and suitably executed with the aid, for example, of a purposely-developed decision support system linked to the ship safety management system. This process can be guided in the most effective way, thus providing the vessel damage response team with the ability to actively suppress floodwater propagation by isolating the damage area following any foreseeable critical flooding event where progressive flooding is responsible for loss. This offers a distinct advantage over existing damage control plans, which are limited in that they rely entirely on fixed design measures in order to contain the spread of floodwater. As such, they have limited flexibility and cannot effectively deal with all probable loss scenarios. In addition, there are a number of areas within any vessel in which watertight integrity must be sacrificed in order to allow for effective operation of the vessel, i.e., lift trunks, service corridors, non-watertight doors.
critical flooding event where progressive flooding is responsible for loss. This offers a distinct advantage over existing damage control plans, which are limited in that they rely entirely on fixed design measures in order to contain the spread of floodwater. As such, they have limited flexibility and cannot effectively deal with all probable loss scenarios. In addition, there are a number of areas within any vessel in which watertight integrity must be sacrificed in order to allow for effective operation of the vessel, i.e., lift trunks, service corridors, non-watertight doors.

Concluding Remarks
Deriving from the work described in the foregoing, the following concluding remarks may be drawn: (1) The internal environment of a passenger ship is complex and the bigger and more modern the ship is, the more complex the internal environment becomes. There are many reasons for this relating to functionality (hotel, entertainment), performance (flow of people and goods), and cost (construction and maintenance). On the other hand, structural strength and reliability, as well as the basic need for structures to be crashworthy, add more constraints, on top of those pertaining to safety, leading to a complex design optimization problem and to compromise. Given this, and despite many claims in the literature that in this array of competing objectives safety is more often than not compromised, this paper clearly demonstrates that safety has had the biggest influence in shaping the reconfiguration of the internal environment; (2) However, the aforementioned influence has not always been rational or timely, mostly a reaction to disasters with focus on damage limitation and passive protection in ways that more often than not lacks rationale and justification; (3) Having said this, safety enhancement, despite the slow evolutionary process being followed, has been impressive and continuous and, insofar as new build passenger ships are concerned, one may say remarkable; (4) However, existing ships, which represent the majority of ships in service have been compromised through a regulatory anomaly (Grandfather's Clause), thus putting at unwarranted risk the majority of the traveling public. Lack of knowledge and technological know-how to address this problem lead to it being quietly ignored; (5) This need not be the case any longer. Technological innovation and a knowledge fund built on this facilitate the development of tools, processes, safety products, and frameworks that would enable all-embracing and rational approaches to safety and to reconfiguration of the internal ship environment to raise safety standards to the level modern society expects and demands.