Risk Assessment of a Battery-Powered High-Speed Ferry Using Formal Safety Assessment

: Fully electric ships have been widely developed, investigated and evaluated by the maritime industry as a potential solution to respond to the emissions control required according to the International Maritime Organization (IMO). This study aims at presenting a novel approach to evaluate the safety level of a battery-powered high speed catamaran. Following the Formal Safety Assessment procedure, the risk assessment of the considered ship was conducted leading to the identiﬁcation of the involved hazards along with the estimation of their frequency and consequences thus allowing for the identiﬁcation of the most severe hazards. Fault tree analysis is carried out for and the identiﬁed top events followed by an event tree analysis to estimate the risk and safety level of the vessel. Furthermore, a cost-beneﬁt assessment is conducted to evaluate the ﬁnancial impact of selected risk control options. The derived results indicate that the application of battery power systems for high speed ferries exhibits low and acceptable accident frequencies. It is also supported the current regulation to carry out mandatory risk assessment for battery-powered ships.


Introduction
International shipping has made a huge effort to achieve sustainable operations and reduce its environmental footprint including gaseous emissions. According to International Maritime Organization's (IMO's) third Greenhouse Gas (GHG) study, 80% of global transportation by volume is delivered by international shipping, whereas the carbon dioxide emissions generated from shipping activities only amounts to 2.2% of the global emissions [1]. However, to meet the ultimate goal of eliminating GHGs, the IMO has set up its agenda to control the GHG emissions in phases. By the year of 2030, it targets to reduce 40% of carbon dioxide emissions from the maritime sector, whereas by the year of 2050, at least 50% of the total GHG emissions from marine industry must be mitigated. To address this challenge, many technologies have been emerging and are under development targeting to completely eliminate the gaseous emissions. One of these technologies is the fully electric ship, which employs energy storage systems as the power source, such as battery and super-capacitors.
Battery-powered systems have been investigated by a number of researchers as delineated in the following. Galloway and Hustmann [2] investigated the material cost and recycling of batteries for the automotive industry. Dai et al. [3] analysed the lithium-ion battery for automotive applications

Methodology
This study employs a series of methods to quantitatively assess the safety and risk level of a fully electric ferry. A general formal safety assessment (FSA) is carried out supported with HAZID, fault tree analysis and event tree analysis.

Formal Safety Assessment
A formal safety assessment (FSA) is a risk assessment approach approved by IMO to evaluate the risks associated with shipping industry as well as to determine the cost and benefits of risk control options (RCOs) to reduce the potential risks [21]. It comprises six steps as shown in Error! Reference source not found.. In this study, Step 1 will be supported by HAZID in Section 2.2; Step 2 will be provided in fault tree (FT) and event tree (ET) in Sections 2.3 and 2.4; the approach of cost-benefit assessment will be presented in Section 2.4.

Hazard Identification and Risk Assessment
Hazard identification (HAZID) [21] is an essential part of the risk assessment where participants, including ship operators, technology inventors, manufacturers, assessment investigators and regulation makers, sit down and brainstorm all the possible hazards during the ship's holistic life span. It also need to consider the existing database, reports, latest regulations and guidance. The HAZID will confirm the most concerned hazards for the ferry and provide frequencies and consequence levels for each hazards so that a quantitative risk assessment could determine the risk levels from risk matrix. A risk matrix could be developed using defined consequence and probability indices by a logarithmic scale. A risk index can be established by adding the probability/frequency and consequence indices. The logarithmic scale of the risk index for ranking purposes of an event can be presented in (1) According to IMO's FSA guideline [21], the frequency and consequence are defined and categorized as shown in Tables 1 and 2. The possibility index ranges from 1 to 7 presenting the

Hazard Identification and Risk Assessment
Hazard identification (HAZID) [21] is an essential part of the risk assessment where participants, including ship operators, technology inventors, manufacturers, assessment investigators and regulation makers, sit down and brainstorm all the possible hazards during the ship's holistic life span. It also need to consider the existing database, reports, latest regulations and guidance. The HAZID will confirm the most concerned hazards for the ferry and provide frequencies and consequence levels for each hazards so that a quantitative risk assessment could determine the risk levels from risk matrix. A risk matrix could be developed using defined consequence and probability indices by a logarithmic scale. A risk index can be established by adding the probability/frequency and consequence indices. The logarithmic scale of the risk index for ranking purposes of an event can be presented in (1): Risk = Frequency × Consequence, log (Risk) = log (Frequency) + log (Consequence), RI = FI + CI, According to IMO's FSA guideline [21], the frequency and consequence are defined and categorized as shown in Tables 1 and 2. The possibility index ranges from 1 to 7 presenting the likelihood of hazard happening in one ship year. The consequence index ranges from 1 to 5 showing the severity of the consequence based on the impact of hazards on cost or human life. In this step, the experience and judgement from the participant of shipping industry will be adapted. All the indices will be filled in to the risk analysis table and then the risk impacts/results will be calculated directly (see Table 3). With the definition of risk levels, the levels of hazards will be determined. There are many different hazard impacts justifying the consequence level, such as effects on ship and effects on potential loss of human life. However, in one study, one appropriate effect should be selected. In this study, effects on ships will be firstly considered and in the following steps, the impacts on assets, human life and environment will be considered. Table 1. Definition of frequency index [21].    7  Frequent  8  9  10  11  6  Probable  7  8  9  10   5  Reasonably  probable  6  7  8  9   4  Little probable  5  6  7  8  3  Remote  4  5  6  7  2  Very remote  3  4  5  6  1  Extremely remote  2  3  4  5 Safety 2020, 6, 39 5 of 38

Fault Tree Analysis
Fault tree analysis is applied to determine the probabilities of top events in order to identify the most concerned events. A fault tree analysis (FTA) will be based on the hazard identified in the HAZID and applying Bayes' Theorem to determine the final probabilities of top events [22]. The Bayes' Theorem is stated in (2): where, A, B are events under consideration; P(A), P(B) presents the independent probabilities of A and B; P(A|B) presents the probability of A given B is true; P(B|A) presents the probability of B given A is true.
All the identified hazards will be sorted based on the consequences in order to categorize them into different top events which will help to build the event tree and carry our event tree analysis afterwards.

Event Tree Analysis
Event tree analysis is an inductive way to show all possible outcomes from an initiating event which could be sub system failure, external event (like flood, fire, and earthquake) or operator error. An event tree can be used to model the sequences including the relationships among initiating event, subsequent responses and final states. Various accident sequences will be identified and probability of occurrence of each sequence will be further quantified in an event tree analysis. The procedures for event development are shown in Figure 2.
Safety 2020, 7, x FOR PEER REVIEW 6 of 37 a. High, medium and low damage degree fire have financial loss factor of 70%, 50%, and 30%, respectively; b. Restrict fire inside the ignition compartment but rapidly suppressed will have fatality rates of 5% and 0% for high and low damage degree; for slow fire suppression situation, the fatality rates rise to 30% and 5%. c. For fire expanded to the other compartment, when the fire is suppressed fast, the fatality rates are 5%, 0% and 0% for high, medium and low damage degree; for slow fire suppression, the rates rise to 30%, 18% and 5%; d. No salvage required.
From the event tree analysis, the probabilities of identified and developed scenarios will be estimated based on the collected data of fleet at risk and accidents. A general approach to connect all these methods will be presented in the next section to present an overall view of the methodology. The method applied to determine the individual risk is based on IMO's FSA and the equation is shown below (3): where, IR is the individual risk; F is the frequency; To carry out an ETA, based on the FSA report for cruise ship and data from goal based damage ship stability (GOALDS), event trees are established first. With the sequences, event trees for the case ferry could be developed. Assumptions are made to determine the financial and fatality cost impacts:

1.
Cruise ship and ferry have construction prices of €700M and €5M respectively; 2.
Cost of averting fatality (CAF) is €7.45M according to GOALDS project, although previous FSAs have used a value of €3M; 3.
Maximum number (capacity) of passengers and crews on board cruise ship and ferry are 8000 and 150, respectively; 4.
Average numbers of people on board cruise ship and ferry at peak hours are 5493 and 103 respectively; 5.
The environmental impact due to the sinking of the vessel is considered as: a deep sea salvage will cost €5M and a near shore (shallow water) salvage will cost €1M.
The probabilities for two ships are different and based on experts' recommendations the following assumptions are made: 1.
The probability of getting struck and striking other ships is 50-50 for high-speed battery driven ferry; it is 37.5% and 62.5% for larger passenger ships; 2.
In this project, the probability of water ingress under condition of getting struck in limited waters is 12% which is 42% for larger passenger ships; 3.
The probability of sinking under condition of water ingress after getting struck in limited waters is 15% in this study and it is 27% for larger passenger ships; 4.
The rest highlighted are agreed to have the same probability for both types of vessels.
In this study, to determine the impact on asset, human life and environment due to hazard occurrence, the following assumptions were made:

1.
Collision: a. The financial loss factor is 10% for water ingress only and 1% for non-water ingress; b.
The fatality rate is 30% under fast capsizing and 5% for slowly capsizing; c.
A deep-sea salvage will cost €5M and a near shore (shallow water) one will cost €1M;

2.
Grounding: a. The financial loss factor is 10% for water ingress only and 1% for non-water ingress; b.
The fatality rate is 5% for water ingress; the fatality rate is 30% under fast capsizing and 18% for slowly capsizing; c.
There will be only near shore salvage which will cost €1M;

3.
Contact: a. The financial loss factor is 10% for water ingress only and 1% for non-water ingress; b.
The fatality rate is 30% under fast capsizing and 5% for slowly capsizing; c.
A deep-sea salvage will cost €5M and a near shore (shallow water) one will cost €1M; 4. Fire a.
High, medium and low damage degree fire have financial loss factor of 70%, 50%, and 30%, respectively; b.
Restrict fire inside the ignition compartment but rapidly suppressed will have fatality rates of 5% and 0% for high and low damage degree; for slow fire suppression situation, the fatality rates rise to 30% and 5%. For fire expanded to the other compartment, when the fire is suppressed fast, the fatality rates are 5%, 0% and 0% for high, medium and low damage degree; for slow fire suppression, the rates rise to 30%, 18% and 5%; d.
No salvage required.
From the event tree analysis, the probabilities of identified and developed scenarios will be estimated based on the collected data of fleet at risk and accidents. A general approach to connect all these methods will be presented in the next section to present an overall view of the methodology.
The method applied to determine the individual risk is based on IMO's FSA and the equation is shown below (3): where, IR is the individual risk; F is the frequency; P is the resulting casualty probability; E is the factional exposure to that risk.

Cost-Benefit Analysis of Risk Control Options
Although the findings of quantitative risk assessment can be determined using above mentioned approaches, it is necessary to investigate measures which could improve the design further. According to the methodology used, a cost-benefit assessment (CBA) is required in order to rank the appropriateness of the proposed risk control options (RCOs). The gross cost to avert a fatality and the net cost to avert a fatality are used as indicators. The definitions of GrossCAF and NetCAF are given here below in (4) and (5): where: ∆C is the cost per ship of the risk control option during the lifetime of the vessel. ∆B is the economic benefit per ship resulting from the implementation of the risk control option during the lifetime of the vessel. ∆R is the risk reduction per ship, in terms of the number of fatalities averted, implied by the risk control option during the lifetime of the vessel.

General Approach
This paper will follow the procedure of FSA to evaluate the risk impact of full electric ferry. HAZID will identify potential hazards during the design, construction and operation of the ferry and the installation and usage of the battery power system. A schematic diagram was shown in Figure 3. to present the overall and collaboration of approaches in this study. Within the identification processes, the frequency and consequence levels will be estimated based on experts' experience and judgement in order to determine the risk impacts of the hazards. It will also help to identify a list of most concerned top events which will be analysed using ETA to determine the frequencies of a series of accident scenarios. The impacts under different scenarios will be further evaluated from the perspective of asset financial cost, fatality cost and environmental recycle cost. To make sure the data collected providing reasonable and acceptable results, a validation process will be used to test the data collected for passenger ships before applying to high-speed inland waterway ferries. The validation will be conducted by comparing the determined accident frequencies with other projects: GOALDS, design, operation and regulation for safety (SAFEDOR) and the study investigating cost effective measures for reducing the risk from fires on ro-ro passenger ships (FIRESAFE) [23][24][25][26]. Until the model is valid, the same approach will be carried out for ferries in order to determine the accident frequencies for this type of ship. It will also indicate the accident frequency variation from passenger ships to ferries after comparison. A list of risk control options with cost and their potential to reduce the accident frequencies will be provided based on the recommendations of HAZID members (experts from shipyard, ship operators, technology providers and research institutes). Eventually, the risk assessment will be quantified from risk levels to financial costs which provides a straightforward approach to shipping industry to evaluate the performance of full electric vessels from the perspective of risk. Safety 2020, 7, x FOR PEER REVIEW 8 of 37

Case Ship
To investigate the safety level of battery power plants on marine vessels, one case ship study was carried out on a high-speed battery powered ferry operated in Norwegian Sea which area covers many small islands and requires frequent passenger transportation between islands and mainland. The specification of the case ship has been presented in Error! Reference source not found..

Battery System
The battery power system includes two packs of batteries, located on port and starboard sides of the case study ferry. The battery power plant on the vessel comprises two identical battery packs connected to the direct current (DC) hubs and through the power module (DC/alternating current (AC convertors) they can provide energy to motors, driving propellers and thrusters, and hotel loads. The battery packs will be charged while in port from local grid power or existing auxiliary power

Case Ship
To investigate the safety level of battery power plants on marine vessels, one case ship study was carried out on a high-speed battery powered ferry operated in Norwegian Sea which area covers many small islands and requires frequent passenger transportation between islands and mainland. The specification of the case ship has been presented in Table 4.

Battery System
The battery power system includes two packs of batteries, located on port and starboard sides of the case study ferry. The battery power plant on the vessel comprises two identical battery packs connected to the direct current (DC) hubs and through the power module (DC/alternating current (AC convertors) they can provide energy to motors, driving propellers and thrusters, and hotel loads. The battery packs will be charged while in port from local grid power or existing auxiliary power supply in the shore changing station. The capacity of a Wartsila approved battery pack is 653 kWh and the output voltage ranges from 672 to 896 V. There are two battery packs onboard (port and starboard). To identify the hazards among the battery system, the systems of innovative battery and conventional engine power plant are simplified as shown in Figures 4 and 5. Inside the dash line area, the deviations between two power plants are highlighted so that the risk assessment will be focused in these components.
Safety 2020, 7, x FOR PEER REVIEW 9 of 37 the deviations between two power plants are highlighted so that the risk assessment will be focused in these components.

Scope of This Study
The scope of this study will be confined and confirmed so that the risk assessment directly evaluates the most concerned issues to the stakeholders. Figure 6 presents the scopes of the risk assessment including mainly three phases: (1) design, construction and installation; (2) operation: voyage and approaching/leaving port; and (3) emergency situations. Different activities will be considered while assessing these phases. In this study, the first phase will take into account of ship design, ship production processes, battery design, battery room arrangement (in a general ship arrangement), battery installation and operation in the shipyard. Phase two will mainly focus on the operational activities so the route and schedule, load case conditions, operational profile, arrangement, maintenance and crew operations will be under consideration. In the last phase, the operation during emergency will be evaluated including crew operation, training, manoeuvring capacity, evacuation route, lifesaving equipment and safety systems (fire suppression and fire alarming systems).

Scope of This Study
The scope of this study will be confined and confirmed so that the risk assessment directly evaluates the most concerned issues to the stakeholders. Error! Reference source not found. presents the scopes of the risk assessment including mainly three phases: (1) design, construction and installation; (2) operation: voyage and approaching/leaving port; and (3) emergency situations. Different activities will be considered while assessing these phases. In this study, the first phase will take into account of ship design, ship production processes, battery design, battery room arrangement (in a general ship arrangement), battery installation and operation in the shipyard. Phase two will mainly focus on the operational activities so the route and schedule, load case conditions, operational profile, arrangement, maintenance and crew operations will be under consideration. In the last phase, the operation during emergency will be evaluated including crew operation, training, manoeuvring capacity, evacuation route, lifesaving equipment and safety systems (fire suppression and fire alarming systems).

Risk Assessment Results and Discussion
According to the methodology in Section 2, the risk assessment has been carried out and results were determined and presented in the following sections including hazard identification, accident statistic, event tree analysis and cost-benefit assessment of identified RCOs.

HAZID
A risk register was developed during the HAZID meeting (shown in Appendix A: Risk Register) and the consequent follow-up work and discussions on estimating probabilities and consequences of the identified hazards and their ranking were carried out to determine the most concerned top events: collision, contact, grounding and fire. The fault trees of them are presented in Figures 7-10. The HAZID questionnaire is summarized in the following tables (Tables 5-8). The risk register containing a total of 55 hazards whose frequencies and consequences were evaluated. The following number of hazards was identified: • Design, construction, installation (21 hazards); • Operation (25 hazards);

Risk Assessment Results and Discussion
According to the methodology in Section 2, the risk assessment has been carried out and results were determined and presented in the following sections including hazard identification, accident statistic, event tree analysis and cost-benefit assessment of identified RCOs.

HAZID
A risk register was developed during the HAZID meeting (shown in Appendix A: Risk Register) and the consequent follow-up work and discussions on estimating probabilities and consequences of the identified hazards and their ranking were carried out to determine the most concerned top events: collision, contact, grounding and fire. The fault trees of them are presented in Figures 7-10. The HAZID questionnaire is summarized in the following tables (Tables 5-8). The risk register containing a total of Safety 2020, 6, 39 11 of 38 55 hazards whose frequencies and consequences were evaluated. The following number of hazards was identified: • Design, construction, installation (21 hazards); • Operation (25 hazards); • Emergency (9 hazards).

Uncertainty Analysis
To provide a trustworthy decision on the hazard identified and the associate risk levels, the uncertainty analysis on the frequency and consequence index were carried out. The index of frequency and consequence are resulted of HAZID meeting and determined based on engineer judgement and estimations. Goerlandt and Reniers [27] proposed a qualitative approach to apply strength-of-evidence to develop three-level of data confidences based on expert judgments and assumptions. Three levels are colour coded as green/yellow/red, which presents strong/medium/low data confidences (Error! Reference source not found.). Table 9. Definition of data confidence levels [27].  Flooding-capsizing 1.00 5.00

Uncertainty Analysis
To provide a trustworthy decision on the hazard identified and the associate risk levels, the uncertainty analysis on the frequency and consequence index were carried out. The index of frequency and consequence are resulted of HAZID meeting and determined based on engineer judgement and estimations. Goerlandt and Reniers [27] proposed a qualitative approach to apply strength-of-evidence to develop three-level of data confidences based on expert judgments and assumptions. Three levels are colour coded as green/yellow/red, which presents strong/medium/low data confidences (Table 9). Table 9. Definition of data confidence levels [27].

Evidence Type
Confidence Level

Strong Medium Weak
Judgments supported by experts Over 75% 25~75% Less than 25% Assumptions agreed by experts Over 75% 25~75% Less than 25% Based on the confidence level and the HAZID questionnaires reports, the confidence levels of the frequency and consequence of the identified hazard are derived and shown in the Table 10. It indicates that 25% of the determined frequency indices (FI) and consequence indices (CI) are strongly trustworthy and about 71% of them have a medium level of data confidence. Therefore, the overall strength-of-evidence is medium.

Accident Statistics
One of the challenges with the qualitative risk assessment is the collection of reliable data regarding past accidents. The challenge in this case is that the previous FSAs have not addressed inland/protected water and high-speed vessels similar to our designs. In this respect, new data had to be collected.
The accident data derived from the Global Integrated Shipping Information System (GISIS): Marine Casualties and Incidents (IMO). Passenger ship accident data were collected and there are 337 accidents in the database, and the numbers of accidents in different categories were determined and listed [28]. According to data provided by Sea-Web [29], the number of passenger vessels in the world merchant fleet in a yearly base were derived in Table 11 and the ship-year for global passenger ships is 4872. The accident frequencies for global passenger ship fleet are derived and presented in Table 12 and Figure 11.   The newly collected data are compared for verification purposes with the frequencies found in previous projects, namely GOALDS and SAFEDOR. GOALDS reported the accident frequencies (collision and grounding) for the cruise ship and ro-ro passenger ship (RoPax) from 1994 to 2010; SAFEDOR reported the accident frequencies (collision, contact, grounding and fire) for cruise ships and RoPax respectively from 1994 to 2004. Another research carried out by Endrina et al. ([30]) was presented in Table 12 comparing with the accident frequency from this study. It is observed that the results from this study, are at the same exponential level with the previously reported figures.     Figure 11. Comparison of accident frequency results between this study and existing projects.
For the fire accident frequency, the results from FIRESAFE project were used which indicates that the fires on ro-ro vessels have a frequency (per ship year) of 5.79 × 10 −3 . In this report, it mentioned the fire accident frequencies from DNV GL are 5.83 × 10 −4 (year 1990-2003) and 2.00 × 10 −3 (year 2005-2016). According to SAFEDOR, it is about 1.02 × 10 −3 . Therefore, the fire accident frequency is expected to be in the order of 10 −3 .
Following the same approach, the number of accidents for the inland waterways ferries is derived based on the accident database (GISIS) and the number of inland waterways ferries in the world from 2006 to 2018 are determined from Sea-web database which in total has 1178 existing ( Table 13). The incident frequencies are determined and shown in Table 14. It is reasonable to have much lower accident frequencies since ferries are usually operation in the conditions of rapid response to extreme weather conditions, better manoeuvring characteristics of these vessels and the propulsion redundancy, and human factors (e.g., better training, less fatigue etc.).
After determining these data, an event tree analysis has been conducted to determine the impact of the different accident scenarios.

Event Tree Analysis
Based on the results from the HAZID session and the analysis of available accident statistics, the following top events were selected for event tree analysis and the sequences are described and presented in the following section: The ETs developed includes both the fatalities per year and the financial impacts of incidents per year. For cruise ships, the fatalities per year due to collision accidents are 8.22 × 10 −2 which is much higher than that for high-speed ferries (4.90 × 10 −4 ). The fatalities per year are 1.12 and 4.82 × 10 −3 (large cruise ships and small ferries) due to grounding accidents; they are 6.06 × 10 −2 and 2.36 × 10 −4 due to contact, and 3.43 × 10 −1 and 1.52 × 10 −3 due to fire. The total fatalities per year due to accidents for cruise ships are much higher than small ferries. The financial impacts of incidents per year were determined: for cruise ships, the impacts for four categories (collision, grounding, contact and fire) are €130,706, €521,777, €100,106, and €2,132,184 respectively; for small ferries, the impacts are much lower than cruise ships, which are €297, €856, €165 and €3599. The costs for cruise ships are significantly higher, which are resulted from the total loss prices (i.e., construction costs) of large cruise ships and small ferries. The total loss prices used in the calculation for cruise ship and ferry are €700M and €5M. Therefore, the financial impacts are determined to be 4.1% and 1% of the total loss prices of cruise ship and ferry respectively which indicates the financial impacts on cruise ships are still higher than small ferries. To compare the risk impacts for these two types of ships, further calculations and discussions will be carried out next.
The overall risk calculation is shown in Tables Figure 18. Event tree analysis of contact for the ferry in this study.
Safety 2020, 7, x FOR PEER REVIEW 8 of 37 Figure 18. Event tree analysis of contact for the ferry in this study.  Figure 19. Event tree analysis of fire for the ferry in this study.   Table 17. Results comparison for all passenger ship and high-speed battery-driven ferry.

Large Passenger Ship Ferry (This Study)
Individual According to [22], the fatalities per 10 8 passenger-km and Fatalities per 10 8 passenger hours (FAR) of waterways travelling are 0.6 and 12 respectively. In this study, they are considerably lower. They are 0.081 and 3.505 for typical large passenger ships and 0.028 and 0.052 for the high-speed battery-driven ferry in this study. Based on this findings, the ferry in this study meets the expectation to be "as safe as the existing ships".

RCOs and Cost Assessment
The risk reductions, costs and benefits brought by the different RCOs were estimated based on the feedback from the experts in the consortium so that the cost-benefit impacts can be determined after applying the RCOs. Their values will be updated when more details about the design are available and market prices are confirmed. There are seven potential RCOs identified after HAZID indicating the most severe hazards:

1.
Move the battery room on the main deck: Moving the battery room of the case study vessel on the main deck will reduce the risks associated with potential fire in that room. This is in line with Norwegian Maritime Authority's (NMA's) recommendations. This measure will also have the benefit of reducing the allowable minimum breadth of the demihulls, resulting to potential total resistance reductions which will produce capital expenditures (CAPEX, battery costs) and operating expenses (OPEX, recharging costs) reduction.
On the other hand, it will raise the vertical centre of gravity (VCG) and affect the stability, but due to the catamaran design, this will not affect adversely its collision, contact and grounding risks.

2.
Select proper firefighting system: A firefighting system will be equipped with a minor modification of the ferry, and the operation and maintenance cost of the system shall be considered. 3.
Add alarm system: An alarm system will be coupled with the ferry and the operation and maintenance cost of the system shall be considered.

4.
Pre-test system/equipment: Pre-test any new system and equipment before the installation will avoid incidents/accidents while operating. It will require system/equipment inspection and checking where labours and testing equipment will be necessary.

5.
Supply protection for crew: Protections such as goggles, gloves and jackets should be provided to crews while working on board and repairing faulty systems. The associated costs are investment of these protections and might be replacing them every a few years to keep the quality to be well functioning.

Regular inspection and maintenance:
This is necessary to prevent accident and incident from happening. This requires labour investment as well as replacement of aging spare parts.

7.
Crew training: Crew training should be included in all phases, i.e., construction, operation and maintenance phases, in order to avoid unskilled persons who might mis-operate and cause accidents.
The costs, benefits and risks associated to the application of RCOs are estimated and presented in Table 18. The cost data based on experts' recommendation, judgment and experience. The costs of the RCOs include the investment (CAPEX) and operational cost (OPEX). The potential reduction rate on accident frequencies (collision, contact, grounding and fire) of each RCO was estimated. With an assumption of 20 years ferry life span and 5% interest rate, the gross and net cost-benefits were determined. This indicates that RCO 1 (relocation of the battery room on the main deck) brings the highest benefits. For RCO 1, this corresponds to €112.3K savings while averting a fatality but other RCOs require capital investment to help to reduce the potential loss of life (RCOs 2 and 3 require capital investment of €25.6K; RCO 4 requires €12.5K; RCO 5 needs to invest €10.9K; RCO 6 requires €25.9K; and RCO 7 needs a capital investment of €9.3K).

Conclusions and Recommendations
In this study, we presented an approach to assess the risk and safety level for a battery-powered high-speed catamaran ferry using HAZID, fault tree, event tree and cost-benefit assessment. The conducted HAZID session provided experts' judgement and experience on the identified hazards to determine the levels of frequency and consequence of these hazards. A supplement was made to the hazard register to include more concerned risk incidents in the register. In addition, based on the expertise of the HAZID session experts, some hazards were eliminated and are not necessary to be included. Based on the HAZID results, four most severe top events were identified: collision, contact, grounding and fire. With data collected from IMO and the Sea-Web database, the accident frequencies of these top events were determined for passenger ships and then tailored for ferries. Referring to the GOALDS project and the FSA report (IMO), event trees were firstly established for all types of passenger ships in this study. The event trees were modified based on experts' suggestion to fit for HSC ferries. With consideration of financial, potential loss of life and environmental impacts, eventually the total risk and its impact were determined for the considered ferry and were compared to large passenger ships as well as other types of ferries.
The main findings of the risk and safety assessment are the following: • The accident frequencies for vessels, and high-speed battery-driven ferries, are not significantly different from the ones for larger passenger ships;

•
The system architecture (Figure 4), especially the battery management system, does not raise any concerns regarding higher accident frequencies. This needs to be confirmed with the final battery management system (BMS) design and the more detailed analysis the manufacturer will perform as the ship design progresses; • The updated event trees and the quantitative risk assessment show that the vessel's design is as safe as existing ships. • Risk control options for further reduction of the risk have been examined. Among all the proposed risk control options, the relocation of the battery room on the main deck is the most cost-effective RCO.
The results from this study could be updated along with a more complete battery system and ferry design. With further detail information about the system and the ferry, a more accurate assessment will be achieved in future studies.   * Different colours were used to show the levels of frequency, consequences and risks: green = low; yellow = medium; red = high.