Risk Assessment of a Battery-Powered High-Speed Ferry Using Formal Safety Assessment

Abstract

Fully electric ships have been widely developed, investigated and evaluated by the maritime industry as a potential solution to respond to the emissions control required according to the International Maritime Organization (IMO). This study aims at presenting a novel approach to evaluate the safety level of a battery-powered high speed catamaran. Following the Formal Safety Assessment procedure, the risk assessment of the considered ship was conducted leading to the identification of the involved hazards along with the estimation of their frequency and consequences thus allowing for the identification of the most severe hazards. Fault tree analysis is carried out for and the identified top events followed by an event tree analysis to estimate the risk and safety level of the vessel. Furthermore, a cost-benefit assessment is conducted to evaluate the financial impact of selected risk control options. The derived results indicate that the application of battery power systems for high speed ferries exhibits low and acceptable accident frequencies. It is also supported the current regulation to carry out mandatory risk assessment for battery-powered ships.

1. Introduction

International shipping has made a huge effort to achieve sustainable operations and reduce its environmental footprint including gaseous emissions. According to International Maritime Organization’s (IMO’s) third Greenhouse Gas (GHG) study, 80% of global transportation by volume is delivered by international shipping, whereas the carbon dioxide emissions generated from shipping activities only amounts to 2.2% of the global emissions [1]. However, to meet the ultimate goal of eliminating GHGs, the IMO has set up its agenda to control the GHG emissions in phases. By the year of 2030, it targets to reduce 40% of carbon dioxide emissions from the maritime sector, whereas by the year of 2050, at least 50% of the total GHG emissions from marine industry must be mitigated. To address this challenge, many technologies have been emerging and are under development targeting to completely eliminate the gaseous emissions. One of these technologies is the fully electric ship, which employs energy storage systems as the power source, such as battery and super-capacitors.

Battery-powered systems have been investigated by a number of researchers as delineated in the following. Galloway and Hustmann [2] investigated the material cost and recycling of batteries for the automotive industry. Dai et al. [3] analysed the lithium-ion battery for automotive applications using the life cycle approach, which indicates that the emissions generated of the battery come from the manufacturing phase, but depend on the production location and the material sources. It proved the research results from Dunn et al. [4], who presented the life cycle assessment summary for li-ion battery production and recycling. The LCA of battery is further investigated by Raugei and Windfield [5]. Zhao and You [6] carried out a comparative study on Li-ion battery through a process based and integrated hybrid life cycle assessment (LCA) approach, comparing the GHG emissions and the energy consumption of two types of batteries (LiMn₂O₄ (LMO) and Li(NixCoyMnz)O₂ (NCM)). Hiremath et al. [7] investigated and compared different battery storage systems applied for stationary applications using the LCA approach. Matheys et al. [8] evaluated the environmental impacts of five electric vehicle battery systems to find out the preferred one for the automotive industry.

A number of studies focused on the maritime transportation, most of which dealt with hybrid systems consisting of batteries and marine diesel engines. Kluiters et al. [9] investigated a battery-powered marine vessel employing the sodium/nickel chloride zero emissions batteries research activity (ZEBRA). The battery was tested and investigated for navy vessels by simulating the charge and discharge processes based on the ships practical operation. Lan et al. [10] conducted an optimisation of a ship hybrid power system including a photovoltaic system, a diesel engine and a battery, concluding on the optimal system sizing to minimize the CO₂ emissions, as well as the capital and fuel costs. Misyris et al. [11] investigated the use of battery on marine vessels (including hybrid and fully electric ships) and developed a parameter identification method for the battery state estimation to support the battery performance evaluation during the on-board operation. Yu et al. [12] investigated the potential of combining a photovoltaic (PV)/battery/generator for short route ferries operated in inland waters considering charging in ports. Another assessment on fully electric ships was carried out by Zahedi et al. [13], who investigated a system including diesel engines, synchronous generator-rectifier units, a full-bridge bidirectional converter, and a Li-Ion battery bank as energy storage, estimating the potential fuel savings for an offshore support vessel. Jones et al. [14] investigated the application of a battery system in PV applications to estimate the performance of the system from the perspective of CO₂ emissions reduction in order to meet the requirement from Paris Climate Change Agreement.

However, although the benefits of battery power systems have been broadly evaluated, specifically from the perspectives of the fuel cost savings and environmental footprint, studies on the system safety assessment that greatly affects the applicability of these systems on-board ships have not been reported in the pertinent literature. A number of accidents have been reported for battery powered vessels, which indicates that the safety assessments, the employed risk mitigation measures and the safety system design for such vessels may not be adequate [15]. Existing risk assessments for battery systems focus on automotive or stationary applications. Wang et al. [16] carried out a review on a li-ion battery and its failure mode and fire prevention strategies for electric vehicles and energy storage system. In [17], a risk assessment was carried out for stationary li-ion batteries to reduce the probability of frequency/consequences of all the risks related to the battery life cycle to acceptable or tolerable levels.

However, there exist a few studies carrying out risk assessments on marine battery power plants. Jeong et al. [18] developed a multi-criteria decision making approach for a hybrid battery-engine system and focused on cost-environment-risk issues. The risk assessment carried out could be further expanded to include more detailed hazard identification. Classification societies provide guidelines for the batteries application on-board ships [19,20]. This study aims at investigating the safety level of the battery-powered high speed catamaran. This is accomplished by employing an approach, which combines hazard identification (HAZID), fault tree analysis (FTA), event tree analysis (ETA) and cost-benefit assessment to identify the potential hazards and top events during the life span of the considered vessel and to quantitatively estimate their risk impacts (including frequency, consequences, risk and the cost of risk control options). The approach will be applied on passenger ships for validation and then tailored for ferries, which can be compared to the respective results for passenger ships and provided a general view on ferries’ safety and risk levels.

2. Methodology

This study employs a series of methods to quantitatively assess the safety and risk level of a fully electric ferry. A general formal safety assessment (FSA) is carried out supported with HAZID, fault tree analysis and event tree analysis.

2.1. Formal Safety Assessment

A formal safety assessment (FSA) is a risk assessment approach approved by IMO to evaluate the risks associated with shipping industry as well as to determine the cost and benefits of risk control options (RCOs) to reduce the potential risks [21]. It comprises six steps as shown in Figure 1. In this study, Step 1 will be supported by HAZID in Section 2.2; Step 2 will be provided in fault tree (FT) and event tree (ET) in Section 2.3 and Section 2.4; the approach of cost-benefit assessment will be presented in Section 2.4.

Figure 1. General approach of a formal safety assessment (FSA) [21].

2.2. Hazard Identification and Risk Assessment

Hazard identification (HAZID) [21] is an essential part of the risk assessment where participants, including ship operators, technology inventors, manufacturers, assessment investigators and regulation makers, sit down and brainstorm all the possible hazards during the ship’s holistic life span. It also need to consider the existing database, reports, latest regulations and guidance. The HAZID will confirm the most concerned hazards for the ferry and provide frequencies and consequence levels for each hazards so that a quantitative risk assessment could determine the risk levels from risk matrix. A risk matrix could be developed using defined consequence and probability indices by a logarithmic scale. A risk index can be established by adding the probability/frequency and consequence indices. The logarithmic scale of the risk index for ranking purposes of an event can be presented in (1):

Risk = Frequency × Consequence,
log (Risk) = log (Frequency) + log (Consequence),
RI = FI + CI,

(1)

According to IMO’s FSA guideline [21], the frequency and consequence are defined and categorized as shown in Table 1 and Table 2. The possibility index ranges from 1 to 7 presenting the likelihood of hazard happening in one ship year. The consequence index ranges from 1 to 5 showing the severity of the consequence based on the impact of hazards on cost or human life. In this step, the experience and judgement from the participant of shipping industry will be adapted. All the indices will be filled in to the risk analysis table and then the risk impacts/results will be calculated directly (see Table 3). With the definition of risk levels, the levels of hazards will be determined. There are many different hazard impacts justifying the consequence level, such as effects on ship and effects on potential loss of human life. However, in one study, one appropriate effect should be selected. In this study, effects on ships will be firstly considered and in the following steps, the impacts on assets, human life and environment will be considered.

Table 1. Definition of frequency index [21].

FI	Frequency	Definition	F (per Ship Year)
7	Frequent	Likely to occur once per month on one ship	10
5	Reasonably probable	Likely to occur once per year in a fleet of 10 ships, i.e., likely to occur a few times during a ship’s life	0.1
3	Remote	Likely to occur once per year in a fleet of 1000 ships, i.e., likely to occur in the total life of several similar ships	1 × 10−3
1	Extremely remote	Likely to occur once in the lifetime (20 years) of a world fleet of 5000 ships	1× 10−5

Table 2. Definition of consequence index [21].

SI	Severity	Ship Safety & Technology	Equivalent Fatalities
1	Minor	Local equipment damage (repair on board possible, downtime negligible)	0.01
2	Significant	Non-severe ship damage—(port stay required, downtime 1 day)	0.1
3	Severe	Severe damage—(yard repair required, downtime < 1 week)	1
4	Catastrophic	Total loss (of, e.g., a medium size merchant ship)	10

Table 3. Risk matrix [21].

PI Probability		SI Severity
		1	2	3	4
		Minor	Significant	Severe	Catastrophic
7	Frequent	8	9	10	11
6	Probable	7	8	9	10
5	Reasonably probable	6	7	8	9
4	Little probable	5	6	7	8
3	Remote	4	5	6	7
2	Very remote	3	4	5	6
1	Extremely remote	2	3	4	5

2.3. Fault Tree Analysis

Fault tree analysis is applied to determine the probabilities of top events in order to identify the most concerned events. A fault tree analysis (FTA) will be based on the hazard identified in the HAZID and applying Bayes’ Theorem to determine the final probabilities of top events [22]. The Bayes’ Theorem is stated in (2):

P(A|B) = P(A) P(B|A)/P(B)

(2)

where,

• A, B are events under consideration;
• P(A), P(B) presents the independent probabilities of A and B;
• P(A|B) presents the probability of A given B is true;
• P(B|A) presents the probability of B given A is true.

All the identified hazards will be sorted based on the consequences in order to categorize them into different top events which will help to build the event tree and carry our event tree analysis afterwards.

2.4. Event Tree Analysis

Event tree analysis is an inductive way to show all possible outcomes from an initiating event which could be sub system failure, external event (like flood, fire, and earthquake) or operator error. An event tree can be used to model the sequences including the relationships among initiating event, subsequent responses and final states. Various accident sequences will be identified and probability of occurrence of each sequence will be further quantified in an event tree analysis. The procedures for event development are shown in Figure 2.

Figure 2. Fault tree assessment approach.

To carry out an ETA, based on the FSA report for cruise ship and data from goal based damage ship stability (GOALDS), event trees are established first. With the sequences, event trees for the case ferry could be developed. Assumptions are made to determine the financial and fatality cost impacts:

• Cruise ship and ferry have construction prices of €700M and €5M respectively;
• Cost of averting fatality (CAF) is €7.45M according to GOALDS project, although previous FSAs have used a value of €3M;
• Maximum number (capacity) of passengers and crews on board cruise ship and ferry are 8000 and 150, respectively;
• Average numbers of people on board cruise ship and ferry at peak hours are 5493 and 103 respectively;
• The environmental impact due to the sinking of the vessel is considered as: a deep sea salvage will cost €5M and a near shore (shallow water) salvage will cost €1M.

The probabilities for two ships are different and based on experts’ recommendations the following assumptions are made:

• The probability of getting struck and striking other ships is 50–50 for high-speed battery driven ferry; it is 37.5% and 62.5% for larger passenger ships;
• In this project, the probability of water ingress under condition of getting struck in limited waters is 12% which is 42% for larger passenger ships;
• The probability of sinking under condition of water ingress after getting struck in limited waters is 15% in this study and it is 27% for larger passenger ships;
• The rest highlighted are agreed to have the same probability for both types of vessels.

In this study, to determine the impact on asset, human life and environment due to hazard occurrence, the following assumptions were made:

• Collision:
  • The financial loss factor is 10% for water ingress only and 1% for non-water ingress;
  • The fatality rate is 30% under fast capsizing and 5% for slowly capsizing;
  • A deep-sea salvage will cost €5M and a near shore (shallow water) one will cost €1M;
• Grounding:
  • The financial loss factor is 10% for water ingress only and 1% for non-water ingress;
  • The fatality rate is 5% for water ingress; the fatality rate is 30% under fast capsizing and 18% for slowly capsizing;
  • There will be only near shore salvage which will cost €1M;
• Contact:
  • The financial loss factor is 10% for water ingress only and 1% for non-water ingress;
  • The fatality rate is 30% under fast capsizing and 5% for slowly capsizing;
  • A deep-sea salvage will cost €5M and a near shore (shallow water) one will cost €1M;
• Fire
  • High, medium and low damage degree fire have financial loss factor of 70%, 50%, and 30%, respectively;
  • Restrict fire inside the ignition compartment but rapidly suppressed will have fatality rates of 5% and 0% for high and low damage degree; for slow fire suppression situation, the fatality rates rise to 30% and 5%.
  • For fire expanded to the other compartment, when the fire is suppressed fast, the fatality rates are 5%, 0% and 0% for high, medium and low damage degree; for slow fire suppression, the rates rise to 30%, 18% and 5%;
  • No salvage required.

From the event tree analysis, the probabilities of identified and developed scenarios will be estimated based on the collected data of fleet at risk and accidents. A general approach to connect all these methods will be presented in the next section to present an overall view of the methodology.

The method applied to determine the individual risk is based on IMO’s FSA and the equation is shown below (3):

IR = F × P × E

(3)

where,

• IR is the individual risk;
• F is the frequency;
• P is the resulting casualty probability;
• E is the factional exposure to that risk.

2.5. Cost-Benefit Analysis of Risk Control Options

Although the findings of quantitative risk assessment can be determined using above mentioned approaches, it is necessary to investigate measures which could improve the design further. According to the methodology used, a cost-benefit assessment (CBA) is required in order to rank the appropriateness of the proposed risk control options (RCOs). The gross cost to avert a fatality and the net cost to avert a fatality are used as indicators. The definitions of GrossCAF and NetCAF are given here below in (4) and (5):

GrossCAF = ΔC/ΔR

(4)

NetCAF = (ΔC − ΔB)/ΔR

(5)

where:

• ΔC is the cost per ship of the risk control option during the lifetime of the vessel.
• ΔB is the economic benefit per ship resulting from the implementation of the risk control option during the lifetime of the vessel.
• ΔR is the risk reduction per ship, in terms of the number of fatalities averted, implied by the risk control option during the lifetime of the vessel.

2.6. General Approach

This paper will follow the procedure of FSA to evaluate the risk impact of full electric ferry. HAZID will identify potential hazards during the design, construction and operation of the ferry and the installation and usage of the battery power system. A schematic diagram was shown in Figure 3. to present the overall and collaboration of approaches in this study. Within the identification processes, the frequency and consequence levels will be estimated based on experts’ experience and judgement in order to determine the risk impacts of the hazards. It will also help to identify a list of most concerned top events which will be analysed using ETA to determine the frequencies of a series of accident scenarios. The impacts under different scenarios will be further evaluated from the perspective of asset financial cost, fatality cost and environmental recycle cost. To make sure the data collected providing reasonable and acceptable results, a validation process will be used to test the data collected for passenger ships before applying to high-speed inland waterway ferries. The validation will be conducted by comparing the determined accident frequencies with other projects: GOALDS, design, operation and regulation for safety (SAFEDOR) and the study investigating cost effective measures for reducing the risk from fires on ro-ro passenger ships (FIRESAFE) [23,24,25,26]. Until the model is valid, the same approach will be carried out for ferries in order to determine the accident frequencies for this type of ship. It will also indicate the accident frequency variation from passenger ships to ferries after comparison. A list of risk control options with cost and their potential to reduce the accident frequencies will be provided based on the recommendations of HAZID members (experts from shipyard, ship operators, technology providers and research institutes). Eventually, the risk assessment will be quantified from risk levels to financial costs which provides a straightforward approach to shipping industry to evaluate the performance of full electric vessels from the perspective of risk.

Figure 3. Overview of approaches relationships: hazard identification (HAZID), fault tree analysis (FTA), event tree analysis (ETA) and cost benefit analysis (CBA).

3. Case Study

3.1. Case Ship

To investigate the safety level of battery power plants on marine vessels, one case ship study was carried out on a high-speed battery powered ferry operated in Norwegian Sea which area covers many small islands and requires frequent passenger transportation between islands and mainland. The specification of the case ship has been presented in Table 4.

Table 4. Case ship specifications and general arrangement.

Main Dimensions
Length	29.32 m	Number of stops	up to 12
Breadth	9 m	Passengers	147
Demihull breadth	2.44 m	Crew	3
Draft	1.26 m	Motor	2 × 550 kW
Lightship	200 tones	Battery capacity	1.3 MWh
Operational speed	23 knots	Route length	23 nm
Service hours per day	Up to 20.5	Serviced per day	14 times

3.2. Battery System

The battery power system includes two packs of batteries, located on port and starboard sides of the case study ferry. The battery power plant on the vessel comprises two identical battery packs connected to the direct current (DC) hubs and through the power module (DC/alternating current (AC convertors) they can provide energy to motors, driving propellers and thrusters, and hotel loads. The battery packs will be charged while in port from local grid power or existing auxiliary power supply in the shore changing station. The capacity of a Wartsila approved battery pack is 653 kWh and the output voltage ranges from 672 to 896 V. There are two battery packs onboard (port and starboard). To identify the hazards among the battery system, the systems of innovative battery and conventional engine power plant are simplified as shown in Figure 4 and Figure 5. Inside the dash line area, the deviations between two power plants are highlighted so that the risk assessment will be focused in these components.

Figure 4. System diagram of battery power plant.

Figure 5. System diagram of engine power plant.

3.3. Scope of This Study

The scope of this study will be confined and confirmed so that the risk assessment directly evaluates the most concerned issues to the stakeholders. Figure 6 presents the scopes of the risk assessment including mainly three phases: (1) design, construction and installation; (2) operation: voyage and approaching/leaving port; and (3) emergency situations. Different activities will be considered while assessing these phases. In this study, the first phase will take into account of ship design, ship production processes, battery design, battery room arrangement (in a general ship arrangement), battery installation and operation in the shipyard. Phase two will mainly focus on the operational activities so the route and schedule, load case conditions, operational profile, arrangement, maintenance and crew operations will be under consideration. In the last phase, the operation during emergency will be evaluated including crew operation, training, manoeuvring capacity, evacuation route, lifesaving equipment and safety systems (fire suppression and fire alarming systems).

Figure 6. Scope of risk assessment study.

4. Risk Assessment Results and Discussion

According to the methodology in Section 2, the risk assessment has been carried out and results were determined and presented in the following sections including hazard identification, accident statistic, event tree analysis and cost-benefit assessment of identified RCOs.

4.1. HAZID

A risk register was developed during the HAZID meeting (shown in Appendix A: Risk Register) and the consequent follow-up work and discussions on estimating probabilities and consequences of the identified hazards and their ranking were carried out to determine the most concerned top events: collision, contact, grounding and fire. The fault trees of them are presented in Figure 7, Figure 8, Figure 9 and Figure 10. The HAZID questionnaire is summarized in the following tables (Table 5, Table 6, Table 7 and Table 8). The risk register containing a total of 55 hazards whose frequencies and consequences were evaluated. The following number of hazards was identified:

Figure 7. Fault tree analysis on hazard associate with collision.

Figure 8. Fault tree analysis on hazard associate with contact.

Figure 9. Fault tree analysis on hazard associate with grounding.

Figure 10. Fault tree analysis on hazard associate with fire: (a) design; (b) operation; (c) emergency.

Table 5. HAZID questionnaire results—design, construction and installation.

No	Hazard Description	Frequency	Consequence
1	Ferry overheight—contact with bridge	1.27	4.10
2	Too big battery—structural failure	1.00	4.20
3	Steel overweight—structural failure	1.10	4.60
4	Battery breach—fire, corrosion, asphyxia	1.40	4.60
5	Battery fail to start—battery unavailability during critical operations	1.64	4.10
6	Thermal runaway—fire	1.33	4.66
7	Battery room damaged—flooding, ship power loss	1.09	2.10
8	Loss of propulsion or steering—ship power loss	1.17	3.34
9	Battery room damaged—flooding	1.09	2.10
10	Loss of essential services—other essential services failed	1.64	2.64
11	Fire and explosion in battery room—fire and explosion	1.18	3.00
12	Gas development (toxic, flammable, corrosive)—asphyxia; fire	1.09	4.64
13	Release of flammable/toxic gases—fire and explosion	1.09	4.82
14	Fire and explosion in battery room—fire and explosion	1.09	6.10
15	Short circuit in battery or power system—power loss; fatality	1.42	4.50
16	Overvoltage and undervoltage—potentially fire	1.25	3.34
17	Battery system unavailable—battery damaged	1.67	3.00
18	Battery out of power—other essential services failed	1.50	3.00
19	Battery fall—battery damaged; injury	1.17	3.00
20	Discharge rate too low—power unavailability	1.08	2.34
21	Evacuation obstructed	1.00	3.00

Table 6. HAZID questionnaire results—operation: voyage.

No	Hazard Description	Frequency	Consequence
1	Battery breach—fire, corrosion, asphyxia	1.00	5.00
2	Thermal runaway—fire, corrosion, asphyxia	1.20	5.20
3	Battery on fire—fire, total loss	1.64	5.18
4	Short circuit—short circuit, fatalities	1.55	3.36
5	Gas off the battery (toxic, flammable, corrosive)—fire, corrosion, asphyxia	1.09	4.28
6	Battery fail to disconnect—fire	1.10	3.90
7	Internal thermal incident—battery damaged	1.60	2.80
8	External fire—fire and explosion	1.27	4.28
9	System failed—battery damaged	1.55	2.64
10	Fire and explosion—fire and explosion	1.30	5.80
11	Battery fall—battery damaged; injury	1.00	3.20
12	No cooling of battery—battery damaged	1.73	2.26
13	Passenger get in the battery room—battery damaged; injury	1.09	1.18
14	Terrorism—loss of ship, fatalities	1.00	5.90
15	Cyber-attack—loss of ship	1.27	3.90
16	Damage to the hull—corrosion	1.00	5.00
17	Battery life span shortened—battery damaged	1.00	3.00

Table 7. HAZID questionnaire results—operation: arrive and leave port.

No	Hazard Description	Frequency	Consequence
1	Battery overcharging—battery damaged	1.30	2.40
2	Battery fail to start—battery damaged	1.70	2.00
3	Battery management system failed—fire	1.64	3.18
4	Human error—collision, contact, grounding	2.55	3.36
5	Collision—total loss	1.00	7.00
6	Contact—hull damaged	2.00	1.00
7	Grounding—hull damaged	2.00	3.00
8	Charging station damaged—system/equipment damaged	1.00	5.00

Table 8. HAZID questionnaire results—emergency operation.

No	Hazard Description	Frequency	Consequence
1	Fire propagation—total loss	1.10	5.40
2	Evacuation failed—fatalities	1.00	5.60
3	Collision—total loss	1.50	6.60
4	Contact—hull damaged	2.40	2.40
5	Thermal runaway—fire	1.10	3.80
6	Crew unsafe when entering the room—asphyxia	1.10	5.20
7	Crew unsafe when removing damaged equipment—asphyxia	1.10	5.00
8	Grounding—hull damaged	2.00	3.00
9	Flooding—capsizing	1.00	5.00

• Design, construction, installation (21 hazards);
• Operation (25 hazards);
• Emergency (9 hazards).

4.2. Uncertainty Analysis

To provide a trustworthy decision on the hazard identified and the associate risk levels, the uncertainty analysis on the frequency and consequence index were carried out. The index of frequency and consequence are resulted of HAZID meeting and determined based on engineer judgement and estimations. Goerlandt and Reniers [27] proposed a qualitative approach to apply strength-of-evidence to develop three-level of data confidences based on expert judgments and assumptions. Three levels are colour coded as green/yellow/red, which presents strong/medium/low data confidences (Table 9).

Table 9. Definition of data confidence levels [27].

Evidence Type	Confidence Level
	Strong	Medium	Weak
Judgments supported by experts	Over 75%	25~75%	Less than 25%
Assumptions agreed by experts	Over 75%	25~75%	Less than 25%

Based on the confidence level and the HAZID questionnaires reports, the confidence levels of the frequency and consequence of the identified hazard are derived and shown in the Table 10. It indicates that 25% of the determined frequency indices (FI) and consequence indices (CI) are strongly trustworthy and about 71% of them have a medium level of data confidence. Therefore, the overall strength-of-evidence is medium.

Table 10. Determination of data confidence levels (Three levels are colour coded as green/yellow/red, which presents strong/medium/low data confidences).

Hazard Number	Design, Construction & Installation		Operation		Emergency
	Frequency	Consequence	Frequency	Consequence	Frequency	Consequence
1	75%	42%	75%	75%	90%	20%
2	83%	42%	75%	58%	100%	40%
3	75%	67%	42%	50%	50%	80%
4	50%	25%	33%	58%	40%	70%
5	58%	50%	83%	25%	90%	50%
6	67%	50%	83%	50%	90%	50%
7	83%	17%	92%	42%	90%	60%
8	83%	42%	50%	58%
9	83%	50%	67%	8%
10	42%	58%	33%	58%
11	75%	75%	58%	25%
12	83%	58%	50%	58%
13	83%	83%	83%	58%
14	83%	50%	50%	58%
15	58%	42%	83%	83%
16	75%	42%	92%	8%
17	50%	83%	67%	50%
18	50%	67%	58%	58%
19	83%	67%	42%	42%
20	92%	50%	58%	33%
21			58%	58%

4.3. Accident Statistics

One of the challenges with the qualitative risk assessment is the collection of reliable data regarding past accidents. The challenge in this case is that the previous FSAs have not addressed inland/protected water and high-speed vessels similar to our designs. In this respect, new data had to be collected. The accident data derived from the Global Integrated Shipping Information System (GISIS): Marine Casualties and Incidents (IMO). Passenger ship accident data were collected and there are 337 accidents in the database, and the numbers of accidents in different categories were determined and listed [28]. According to data provided by Sea-Web [29], the number of passenger vessels in the world merchant fleet in a yearly base were derived in Table 11 and the ship-year for global passenger ships is 4872. The accident frequencies for global passenger ship fleet are derived and presented in Table 12 and Figure 11.

Table 11. Number of passenger ships in service vs. year.

Year	1999	2000	2001	2002	2003	2004	2005	2006	2007	2008	2009
Ships in service	132	152	162	143	142	162	158	124	158	204	213
Year	2010	2011	2012	2013	2014	2015	2016	2017	2018	2019	Total
Ships in service	247	219	244	224	265	259	271	343	448	602	4872

Table 12. Number of incidents and frequencies for global passenger ship fleet.

No of Accidents		Percentage	Accident Frequency
			This Study	Other Projects
Capsizing	23	16.08%	4.72 × 10−3
Collision	26	18.18%	5.34 × 10−3	(a) 6.99 × 10−3 (GOALDS) (b) 4.6 × 10−3 (MSC_85-17-1 *) (c) 1.25 × 10−2 (MSC_85-17-2) (d) 3.65 × 10−2 (Endrina et al. 2018 [30])
Contact	15	10.49%	3.08 × 10−3	(a) 1.2 × 10−3 (MSC_85-17-1) (b) 1.25 × 10−2 (MSC_85-17-2) (c) 1.04 × 10−2 (Endrina et al. 2018 [30])
Fire	35	24.48%	7.18 × 10−3	(a) 8.9 × 10−3 (MSC_85-17-1) (b) 8.28 × 10−3 (MSC_85-17-2) (c) 5.21 × 10−3 (Endrina et al. 2018 [30])
Grounding	36	25.17%	7.39 × 10−3	(a) 1.07 × 10−2 (GOALDS) (b) 9.8 × 10−3 (MSC_85-17-1) (c) 9.57 × 10−3 (MSC_85-17-2)
Flooding	2	1.40%	4.11 × 10−4
Machinery damage	6	4.20%	1.23 × 10−3	(a) 1.87 × 10−2 (MSC_85-17-2) (b) 1.04 × 10−2 (Endrina et al. 2018 [30])
Total	143	100%	2.94 × 10−2	(a) 4.4 × 10−2 (MSC_85-17-1) (b) 6.80 × 10−2 (MSC_85-17-2) (c) 6.25 × 10−2 (Endrina et al. 2018 [30])

* MSC_85-17-1 & MSC_85-17-2 reported the FSA study on cruise and ro-ro passenger ship (RoPax) ships within the research project SAFEDOR respectively.

Figure 11. Comparison of accident frequency results between this study and existing projects.

The newly collected data are compared for verification purposes with the frequencies found in previous projects, namely GOALDS and SAFEDOR. GOALDS reported the accident frequencies (collision and grounding) for the cruise ship and ro-ro passenger ship (RoPax) from 1994 to 2010; SAFEDOR reported the accident frequencies (collision, contact, grounding and fire) for cruise ships and RoPax respectively from 1994 to 2004. Another research carried out by Endrina et al. ([30]) was presented in Table 12 comparing with the accident frequency from this study. It is observed that the results from this study, are at the same exponential level with the previously reported figures.

For the fire accident frequency, the results from FIRESAFE project were used which indicates that the fires on ro-ro vessels have a frequency (per ship year) of 5.79 × 10⁻³. In this report, it mentioned the fire accident frequencies from DNV GL are 5.83 × 10⁻⁴ (year 1990–2003) and 2.00 × 10⁻³ (year 2005–2016). According to SAFEDOR, it is about 1.02 × 10⁻³. Therefore, the fire accident frequency is expected to be in the order of 10⁻³.

Following the same approach, the number of accidents for the inland waterways ferries is derived based on the accident database (GISIS) and the number of inland waterways ferries in the world from 2006 to 2018 are determined from Sea-web database which in total has 1178 existing (Table 13). The incident frequencies are determined and shown in Table 14.

Table 13. Number of inland waterways ferries in service vs. year.

Year	2006	2007	2008	2009	2010	2011	2012	2013	2014	2015	2016	2017	2018	Sum
Ferry in service	52	69	76	84	85	78	98	84	102	97	101	108	144	1178

Table 14. Number of incidents and frequencies for inland waterways ferries.

Accident	No of Accidents	Percentage	Accident Frequency
Capsizing/listing	2	22.22%	1.70 × 10−3
Collision	2	22.22%	1.70 × 10−3
Contact	1	11.11%	8.49 × 10−4
Fire	2	22.22%	1.70 × 10−3
Stranding/grounding	2	22.22%	1.70 × 10−3
Flooding	0	0%	0
Machinery damage	0	0%	0
Total	9	100%	7.64 × 10−3

It is reasonable to have much lower accident frequencies since ferries are usually operation in the conditions of rapid response to extreme weather conditions, better manoeuvring characteristics of these vessels and the propulsion redundancy, and human factors (e.g., better training, less fatigue etc.).

After determining these data, an event tree analysis has been conducted to determine the impact of the different accident scenarios.

4.4. Event Tree Analysis

Based on the results from the HAZID session and the analysis of available accident statistics, the following top events were selected for event tree analysis and the sequences are described and presented in the following section:

• Collision

  ○

  Struck/Striking = > Operational state = > Water Ingress = >Sinking = > Consequences

• Contact

  ○

  Contact Objects = > Water Ingress = >Sinking = > Fatalities = > Consequences

• Fire

  ○

  Escalation = > Extinguishing speed = > Damage degree = > Consequences

• Grounding

  ○

  Navigation = > Sea Bed = > Water Ingress = > Staying Aground = > Afloat = > Consequences

With the assumptions in Section 2.4., the following event trees with cost impacts are derived in the following figures. Figure 12, Figure 13, Figure 14 and Figure 15 correspond to the ET developed for larger passenger ships in previous studies (GOALDS and cruise ship FSA). The ET in Figure 16, Figure 17, Figure 18 and Figure 19 are purposely developed for this study.

Figure 12. Event tree analysis of collision for passenger ships.

Figure 13. Event tree analysis of grounding for passenger ships.

Figure 14. Event tree analysis of contact for passenger ships.

Figure 15. Event tree analysis of fire for passenger ships.

Figure 16. Event tree analysis of a collision for the ferry in this study.

Figure 17. Event tree analysis of grounding for the ferry in this study.

Figure 18. Event tree analysis of contact for the ferry in this study.

Figure 19. Event tree analysis of fire for the ferry in this study.

The ETs developed includes both the fatalities per year and the financial impacts of incidents per year. For cruise ships, the fatalities per year due to collision accidents are 8.22 × 10⁻² which is much higher than that for high-speed ferries (4.90 × 10⁻⁴). The fatalities per year are 1.12 and 4.82 × 10⁻³ (large cruise ships and small ferries) due to grounding accidents; they are 6.06 × 10⁻² and 2.36 × 10⁻⁴ due to contact, and 3.43 × 10⁻¹ and 1.52 × 10⁻³ due to fire. The total fatalities per year due to accidents for cruise ships are much higher than small ferries. The financial impacts of incidents per year were determined: for cruise ships, the impacts for four categories (collision, grounding, contact and fire) are €130,706, €521,777, €100,106, and €2,132,184 respectively; for small ferries, the impacts are much lower than cruise ships, which are €297, €856, €165 and €3599. The costs for cruise ships are significantly higher, which are resulted from the total loss prices (i.e., construction costs) of large cruise ships and small ferries. The total loss prices used in the calculation for cruise ship and ferry are €700M and €5M. Therefore, the financial impacts are determined to be 4.1‰ and 1‰ of the total loss prices of cruise ship and ferry respectively which indicates the financial impacts on cruise ships are still higher than small ferries. To compare the risk impacts for these two types of ships, further calculations and discussions will be carried out next.

The overall risk calculation is shown in Table 15 and Table 16. For the large passenger ships (8000 PoB), these assumptions are made: 16 knots, sailing 358 days per year, 23.45 h and 695 km per sailing. For high-speed battery-driven ferry in this project, the assumptions are: 23 knots, sailing 330 days per year, 15 h per day, 1 h per sailing and 23 nm per sailing. The following results are derived, compared and presented it in Table 17: individual risk per sailing, maximum sailing per year for crew member, maximum sailing per year for any passenger, maximum individual risk for crew member, maximum individual risk for passenger the fatalities per 10⁸ person hours (fatality accident rate, FAR), the fatalities per 10⁸ person km and the fatalities per 10⁸ person sailings.

Table 15. Overall risk calculation for all passenger ships.

Hazard Category	Ind. Risk	Fatalities	Incidents	Fatal Accidents	Total Loss	8000 People on Board
	(per Year)	(per Year)	(per Year)	(per Year)	(per Year)	FAR	%
Collision	1.03 × 10−5	8.22 × 10−2	5.34 × 10−3	1.08 × 10−4	1.08 × 10−4	0.18	5.12
Grounding	1.40 × 10−4	1.12	7.39 × 10−3	6.74 × 10−3	7.19 × 10−5	2.44	69.72
Contact	7.58 × 10−6	6.06 × 10−2	3.08 × 10−3	9.08 × 10−5	9.08 × 10−5	0.13	3.78
Fire/Explosion	4.29 × 10−5	3.43 × 10−1	7.18 × 10−3	2.65 × 10−3	1.44 × 10−5	0.75	21.38
Total	2.01 × 10−4	1.61	2.30 × 10−2	9.60 × 10−3	2.85 × 10−4	3.505	100.00

Table 16. Overall risk calculation for ferry.

Hazard Category	Ind. Risk	Fatalities	Incidents	Fatal Accidents	Total Loss	150 People on Board
	(per Year)	(per Year)	(per Year)	(per Year)	(per Year)	FAR	%
Collision	3.27 × 10−6	4.90 × 10−4	1.70 × 10−3	3.44 × 10−5	3.44 × 10−5	0.004	6.93
Grounding	3.22 × 10−5	4.82 × 10−3	1.70 × 10−3	1.55 × 10−3	1.65 × 10−5	0.035	68.21
Contact	1.57 × 10−6	2.36 × 10−4	8.49 × 10−4	1.95 × 10−5	1.95 × 10−5	0.002	3.34
Fire/Explosion	1.01 × 10−5	1.52 × 10−3	1.70 × 10−3	6.27 × 10−4	3.40 × 10−6	0.011	21.52
Total	4.72 × 10−5	7.07 × 10−3	5.94 × 10−3	2.23 × 10−3	7.38 × 10−5	0.052	100

Table 17. Results comparison for all passenger ship and high-speed battery-driven ferry.

Results	Large Passenger Ship	Ferry (This Study)
Individual risk per sailing	5.61 × 10−7	1.19 × 10−8
Max sailing per year for crew member	180	1650 *
Max sailing per year for any passenger	20	600 **
Max individual risk for crew member	1.01 × 10−4	1.96 × 10−5
Max individual risk for passenger	1.12 × 10−5	7.14 × 10−6
Fatalities per 108 person hours (FAR)	3.505	0.052
Fatalities per 108 person km	0.081	0.028
Fatalities per 108 person sailings	56.080	1.191

* With 5 sailings per day and 330 working days per year, the crew should have 1650 sailings of 1 h; ** People live on the islands need to commute using the ferry so it assumes 2 sailings per day for 300 days. That means 600 sailings of 1 h.

According to [22], the fatalities per 10⁸ passenger-km and Fatalities per 10⁸ passenger hours (FAR) of waterways travelling are 0.6 and 12 respectively. In this study, they are considerably lower. They are 0.081 and 3.505 for typical large passenger ships and 0.028 and 0.052 for the high-speed battery-driven ferry in this study. Based on this findings, the ferry in this study meets the expectation to be “as safe as the existing ships”.

4.5. RCOs and Cost Assessment

The risk reductions, costs and benefits brought by the different RCOs were estimated based on the feedback from the experts in the consortium so that the cost-benefit impacts can be determined after applying the RCOs. Their values will be updated when more details about the design are available and market prices are confirmed. There are seven potential RCOs identified after HAZID indicating the most severe hazards:

1.

Move the battery room on the main deck:

Moving the battery room of the case study vessel on the main deck will reduce the risks associated with potential fire in that room. This is in line with Norwegian Maritime Authority’s (NMA’s) recommendations. This measure will also have the benefit of reducing the allowable minimum breadth of the demihulls, resulting to potential total resistance reductions which will produce capital expenditures (CAPEX, battery costs) and operating expenses (OPEX, recharging costs) reduction. On the other hand, it will raise the vertical centre of gravity (VCG) and affect the stability, but due to the catamaran design, this will not affect adversely its collision, contact and grounding risks.

2.

Select proper firefighting system:

A firefighting system will be equipped with a minor modification of the ferry, and the operation and maintenance cost of the system shall be considered.

3.

Add alarm system:

An alarm system will be coupled with the ferry and the operation and maintenance cost of the system shall be considered.

4.

Pre-test system/equipment:

Pre-test any new system and equipment before the installation will avoid incidents/accidents while operating. It will require system/equipment inspection and checking where labours and testing equipment will be necessary.

5.

Supply protection for crew:

Protections such as goggles, gloves and jackets should be provided to crews while working on board and repairing faulty systems. The associated costs are investment of these protections and might be replacing them every a few years to keep the quality to be well functioning.

6.

Regular inspection and maintenance:

This is necessary to prevent accident and incident from happening. This requires labour investment as well as replacement of aging spare parts.

7.

Crew training:

Crew training should be included in all phases, i.e., construction, operation and maintenance phases, in order to avoid unskilled persons who might mis-operate and cause accidents.

The costs, benefits and risks associated to the application of RCOs are estimated and presented in Table 18. The cost data based on experts’ recommendation, judgment and experience. The costs of the RCOs include the investment (CAPEX) and operational cost (OPEX). The potential reduction rate on accident frequencies (collision, contact, grounding and fire) of each RCO was estimated. With an assumption of 20 years ferry life span and 5% interest rate, the gross and net cost-benefits were determined. This indicates that RCO 1 (relocation of the battery room on the main deck) brings the highest benefits. For RCO 1, this corresponds to €112.3K savings while averting a fatality but other RCOs require capital investment to help to reduce the potential loss of life (RCOs 2 and 3 require capital investment of €25.6K; RCO 4 requires €12.5K; RCO 5 needs to invest €10.9K; RCO 6 requires €25.9K; and RCO 7 needs a capital investment of €9.3K).

Table 18. Cost and benefit assessment of risk control options (RCOs).

RCOs	1	2	3	4	5	6	7
PLL (fatalities/ship-year)	1.61
Reduction	10%	10%	5%	5%	5%	7.5%	7.5%
ΔPLL (fatalities/ship-year)	0.161	0.161	0.080	0.080	0.080	0.120	0.120
Cost (€)	−30,000	20,000	10,000	20,000	5000	0	10,000
Annual Maintenance Cost (€)	0	5000	2500	0	1000	5000	1000
ΔC (€)	−30,000	82,311	41,156	20,000	17,462	62,311	22,462
Gross CAF (€)	−9339	25,624	25,624	12,452	10,872	25,864	9323
Annual Benefit (€)	26,544 *	0	0	0	0	0	0
ΔB (€)	330,802	0	0	0	0	0	0
NetCAF (€)	−112,319	25,624	25,624	12,452	10,872	25,864	9323

* Energy saving due to moving battery room on the main deck which brings improvement of ship hull form and reduces the resistance.

5. Conclusions and Recommendations

In this study, we presented an approach to assess the risk and safety level for a battery-powered high-speed catamaran ferry using HAZID, fault tree, event tree and cost-benefit assessment. The conducted HAZID session provided experts’ judgement and experience on the identified hazards to determine the levels of frequency and consequence of these hazards. A supplement was made to the hazard register to include more concerned risk incidents in the register. In addition, based on the expertise of the HAZID session experts, some hazards were eliminated and are not necessary to be included. Based on the HAZID results, four most severe top events were identified: collision, contact, grounding and fire. With data collected from IMO and the Sea-Web database, the accident frequencies of these top events were determined for passenger ships and then tailored for ferries. Referring to the GOALDS project and the FSA report (IMO), event trees were firstly established for all types of passenger ships in this study. The event trees were modified based on experts’ suggestion to fit for HSC ferries. With consideration of financial, potential loss of life and environmental impacts, eventually the total risk and its impact were determined for the considered ferry and were compared to large passenger ships as well as other types of ferries.

The main findings of the risk and safety assessment are the following:

• The accident frequencies for vessels, and high-speed battery-driven ferries, are not significantly different from the ones for larger passenger ships;
• The system architecture (Figure 4), especially the battery management system, does not raise any concerns regarding higher accident frequencies. This needs to be confirmed with the final battery management system (BMS) design and the more detailed analysis the manufacturer will perform as the ship design progresses;
• The updated event trees and the quantitative risk assessment show that the vessel’s design is as safe as existing ships.
• Risk control options for further reduction of the risk have been examined. Among all the proposed risk control options, the relocation of the battery room on the main deck is the most cost-effective RCO.

The results from this study could be updated along with a more complete battery system and ferry design. With further detail information about the system and the ferry, a more accurate assessment will be achieved in future studies.