DeRisk_beta: Comparative Quantitative Risk Assessment (QRA) of fuel oil, LNG, methanol, and ammonia on a 15,000 TEU containership

As part of an EU-funded research project titled SAFEDOR (Design, Operation, and Regulation for Safety), high-level Formal Safety Assessment (FSA) studies were conducted on various ship types, including containerships, in accordance with the FSA guideline [7]. The FSA is a structured and systematic methodology aimed at enhancing maritime safety through the assistance of risk assessment. It assists in evaluating new regulations or comparing existing and proposed regulations, providing a basis for the IMO’s decision-making.

The FSA on containerships was undertaken and submitted by Denmark as MSC 83/21/2 and MSC 83/INF.8 [8][9]. The study developed a generic risk model to provide an overview of the risk and calculated that the risk can be considered to be within the As Low As Reasonably Practicable (ALARP) region. However, the casualty statistics and accident frequencies used are outdated (1993-2004) so it may not represent the safety risk of the vessels currently operating at sea. To update the IMO FSA risk model, the recent casualty data and ship data for containerships were analysed using Sea-Web [10], resulting in revised incident frequencies for the major accident categories.

Table 3 summarises these updated incident frequencies for the period 2014-2023. The original event trees in the risk model and their branch probabilities were retained but, the model now reflects recent data. The number of crew was also adjusted to 23 to align with the vessels studied.

Table 3:

Incident frequencies for containerships(>500 GT)

The updated FSA risk values are shown in Table 4, estimating the Potential Loss of Life (PLL) of a containership at 4.69E-03 fatalities per year per ship (i.e. per ship-year).

Table 4:

Potential loss of life for containerships

Individual risk (IR) represents the annual likelihood of fatality for a specified individual. Based on the updated FSA risk model, the average individual risk for containership crew is approximately 1.02E-04 fatality per year, assuming uniform exposure to the incidents in Table 4, and a crew of 23 working on 50:50 rotation scheme (i.e. 4.69E-03/23*0.5). This figure is broadly comparable with those reported by EMSA for all ship types, which have varied between 4.5E-05 fatality per year and 9.7E-05 fatality per year over the period 2018-2022, with a five year average of 7.58E-05 [11].

Figure 2 presents the individual risks for containership crew along with the individual risk criteria proposed in MSC 72/16 [12]. These criteria are consistent with those published by the UK Health & Safety Executive (HSE) [13] which are widely adopted by governments and other industries:

Figure 2:

Individual risk for crews in containerships

• • Maximum tolerable IR for crew member: 1E-03 per year
• • Negligible IR for crew member: 1E-06 per year
• • Target IR for crew member (new ships): 1E-04 per year

Figure 2 shows that the individual risk for containership crew is within the ‘Tolerable (if ALARP)’ region and aligns well with the target individual risk for new

Societal risk, also known as group risk, is the average risk experienced by a group of people exposed to accidents. It accounts for the number of people at risk and the potential for multiple fatalities from hazardous events. The societal risk is typically depicted using a Frequency-Number (FN) curve.

The societal risk to the containership crew is presented in Figure 3 alongside the societal risk acceptance criteria proposed by the UK HSE. The UK HSE suggested that the risk of an accident causing 50 or more fatalities in a single event should be regarded as intolerable if it occurs more than once every 5,000 years [13]. Additionally, a risk of two orders of magnitude below the intolerable region is considered broadly acceptable [14][15]. These criteria provide a useful reference for illustrating societal risk.

Figure 3:

Societal risk for a containership with risk criteria proposed by UK HSE

IMO MSC 72/16 [12] also proposed societal risk acceptance criteria, however, the criteria incorporated (unlike most criteria) the financial value of activities. This study chose not to adopt IMO MSC 72/16, as these criteria are not widely adopted by industry and regulators.

Historical data on fuel leaks in the maritime industry are limited. Consequently, data from the oil and gas industry were utilised, following Moon [21], who concluded that such data provide a reasonable basis for initial risk calculation. Leak frequency data from the International Association of Oil & Gas Producers (IOGP), covering events from 1992 to 2015 [22], were used.

While the IOGP offers two data sets—1992–2015 and 2006–2015—the more conservative data set (1992–2015) was selected to address uncertainty in leak frequency.

The alternative fuel system was divided into isolatable sections, and the fuel release frequencies estimated for each section based on the following leak hole size ranges, using the IOGP data:

• • hole diameter: 1–3 mm;
• • hole diameter: 3–10 mm;
• • hole diameter: 10–50 mm; and
• • hole diameter: 50 mm to full-bore rupture.

For the components with double barriers, such as double walled pipes, the leak frequencies were adjusted with reduction factors of 100, 75, and 10 for the respective ranges of 1–3 mm, 3–10 mm and over 10 mm hole diameters [23][24].

Collision and grounding incidents at the fuel tank location can also lead to fuel releases. The likelihood of such occurrences has been derived by rearranging the collision and grounding event trees from the IMO FSA containership study [9]. In addition to the likelihood of critical damage by collisions and groundings, the likelihood of collision within the vicinity of the fuel tank was assumed to be 10%, considering the ratio of the fuel tank length and vessel length. This resulted in 1.8% of collisions and 2.2% of groundings leading to a fuel release.

If a fuel release is to escalate into a fire or explosion, ignition must occur. The probability of ignition is a critical factor. However, there are a limited number of ignition probability models that can cover the alternative fuels considered in this study. In this study, the ignition probability model proposed by CCPS [25] was adopted as it accounts for different characteristics of fuels and release locations. The CCPS level 3 model provides the probabilities of immediate ignition, delayed ignition, and explosion given delayed ignition, considering the following factors:

• • immediate ignition
•  o Minimum Ignition Energy (MIE)
•  o Pressure
•  o Temperature
•  o Auto Ignition Temperature (AIT)

• • delayed ignition
•  o Ignition strength
•  o MIE
•  o Release rate and duration
•  o Phase (gas / liquid)
•  o Flash / boiling point
•  o Degree of enclosure (open / enclosed)
•  o Room volume
•  o Ventilation rate

• • explosion given delayed ignition
•  o Fundamental burning velocity
•  o Release location
•  o Release rate

Fuel release rates were estimated using formulas from IEC 60079-10-1 [26] for liquid, gas, and evaporating pool scenarios. Conservatively, the fuel release rate was assumed constant at the maximum flow rate.

The geometric mean diameter of each leak size range was selected as a representative hole size for calculating the release rate as recommended by IOGP [22].

The fuel piping in the tank connection spaces and fuel preparation rooms was assumed to have drip trays [5][6] and that released fuel could overflow onto the floor if drip tray volumetric capacity was exceeded.

For releases of superheated liquid, the flash and spraying fraction were calculated using Equation (3) [18] and Equation (4) [27] to estimate the total air born mass.

F_flash flash fraction of released liquid (unitless).
C_p average heat capacity of the liquid over T to T_b (J/kg⋅^oC).
T initial temperature (^oC).
T_b atmospheric boiling temperature (^oC).
h_fg latent heat of vaporisation of the liquid at T_b (J/kg).

F_spray spraying fraction of released liquid (unitless).

In the calculations, fuel properties from CoolProp library [28] were used.

For fuel leakages in enclosed spaces, it was assumed the isolation valve closed within 30 seconds after the average gas concentration reached shutdown limits, indicating gas detection activation. In open spaces, the isolation time was assumed to be 2 minutes, and the fuel inventory within the isolated section was assumed to continue releasing until fully depleted.

An isolation failure probability of 3.16E-02 was used, assuming that the isolation system has safety integrity equivalent to Safety Integrity Level (SIL) 1 [29][30]. This value is the geometric mean of the average probability of dangerous failure on demand (PFD_avg) values of 0.1 and 0.01, which are boundary limits for SIL 1. Given isolation failure, operators were assumed to manually isolate the leak within 30 minutes.

The effects of jet fires, pool fires, flash fires, explosions, and toxic gas dispersions in open spaces were modelled using GEX-CON RiskCurves software (version 12.2.0) [31][32]. The results were then imported into DeRisk_beta to estimate fatality probabilities. The fatality probabilities were calculated based on the size and direction of the lethal effect zone, the proportion of the receptor’s area affected, and whether people were indoors or outdoors.

For jet fires and pool fires in enclosed spaces, the fatality probabilities were estimated based on the ratio of the room area to the lethal effect zone area.

When determining the lethality and boundary failure by fires, the heat radiation levels recommended by IOGP [33][34] were adopted.

Typically, fuel handling equipment is located within enclosed spaces. Gas releases in enclosed spaces behave differently compared to those in open environments, necessitating a distinct modelling approach. Gas concentration in enclosed spaces was calculated using Equations (5) and (6) from Harris [35], which assumes perfect and instantaneous mixing of the released gas with air.

For gas concentration at time (t) after a leak,

For gas concentration at time (t) after leak isolation,

C(t) gas concentration in an enclosure at time, t (s).
C₀ gas concentration at the isolation (unitless).
Q_g release rate of flammable gas (m³/s).
Q₂ flow rate of air-gas mixture leaving the room (m³/s).
f ventilation inefficiency factor, assumed 1.5.
V effective volume of the enclosure (m³).

For dense gas, the effective volume from the ‘bottom’ of the space to 5 m height was assumed.

Explosion overpressure in enclosed spaces is primarily due to the expansion of burned gases, rather than a blast wave. The maximum overpressure at any boundary was estimated using Equation (7) [36]. This calculation assumes a well-sealed enclosure without explosion relief panels and the maximum gas concentration observed during fuel releases was used to determine the amount of fuel (from Equations (5) and (6)).

∆p peak overpressure at walls.
P₀ atmospheric pressure.
V volume of the enclosure (m³).
V_Fuel expanded volume of the released fuel (m³).
V_Stoich volume of the stoichiometric mixture of the fuel (m³).
σ expansion ratio of the stoichiometric mixture of the fuel.
γ specific heat ratio of air.

It was assumed that the enclosures are designed to withstand a maximum overpressure of 0.5 bar and where an explosion scenario exceeds this limit, escalation to adjacent spaces was assumed.

Fatality probabilities from toxic gas releases were estimated using a probit function, given in Equation (8) [20][37].

Pr probit value.
C gas concentration (mg/m³).
t exposure time (minutes).
a -15.6 for ammonia and -20.83 for methanol.
b 1 for both ammonia and methanol.
n 2 for both ammonia and methanol.

For open spaces, the size of a 50% lethal toxic dose zone was calculated using RiskCurves and then imported into De-Risk_beta to estimate the number of fatalities. For indoor receptors, the fatality probability was recalculated based on the average toxic concentration in the room, using Equation (9) [38] over the release period and the associated toxic dose.

C_Indoor(t) concentration at time, t (s).
n_v ventilation frequency of the room (s^-1).

For enclosed spaces, the gas concentrations from Equations (5) and (6) were used to calculate the toxic dose and the corresponding fatality probability was derived using Equation (8). It was assumed that crew members have a 40% chance of failing to escape Error! Reference source not found. with complete escape impairment if a 1% lethal toxic dose occurs within two minutes.

Toxic gas release through ventilation outlets was also modelled as an open-space gas release with average concentration determined by in Equations (5) and (6) along with the relevant ventilation rate.

Figure 13 illustrates the individual risk from LNG as fuel. Engineering Officers and Engineering Ratings have the greatest fuel risk. Compared to the conventional fuel, the individual risks for these personnel have increased more than three times. Other crew members are also exposed to the fuel risk due to potential explosion events in the FPR, which is located beneath the accommodation.

Figure 13:

Fuel-specific individual risk for LNG as fuel

Figure 14 presents the societal risk from LNG as fuel. The FN curve shows the cumulative frequencies (F) of accidents involving N or more fatalities and that LNG introduces a greater chance of multiple fatalities compared to conventional fuel.

Figure 14:

Fuel-specific societal risk for LNG as fuel

Table 11 compares the risk levels between LNG and conventional fuel oil in terms of PLL. LNG fuel risk is approximately five times greater than for conventional fuel oil and is attributable to potential explosions and jet fires.

Table 11:

Fuel-specific risk for LNG as fuel

Figure 15 illustrates the risk profile for LNG as fuel. The greatest PLL is associated with explosion events, suggesting that potential explosion events require priority for risk mitigation. Although the likelihood of an explosion is less than that of fire events, such incidents can involve multiple fatalities, resulting in a relatively ‘high’ PLL. Jet fires also pose a significant risk due to the presence of high-pressure LNG piping (up to 300 bars in the fuel supply system).

Figure 15:

Fuel risk profile for LNG as fuel

Figure 16 presents the overall individual risks to crew members in the LNG-fuelled containership. Although all crew groups face greater fuel risks than for a conventionally fuelled vessel, the overall increase in individual risk is marginal with a maximum increase of 14% for Engineering Officers.

Figure 16:

Individual risk (overall) for LNG as fuel

Figure 17 presents the overall societal risk for LNG. The five-fold increase in fuel-specific risk, discussed in Table 11, results in a 4.4% increase in the overall societal risk (PLL), as shown in Table 12.

Figure 17:

Societal risk (overall) for LNG as fuel

Table 12:

Overall risk for LNG

Figure 18 and Figure 19 display the fuel-specific individual and societal risks for the methanol-fuelled containership. As detailed in Table 13, the adoption of methanol as a fuel has led to a 19% increase in the fuel risk for PLL. Compared to conventional fuel oil, methanol exhibits higher ignition probabilities and a greater explosion potential, which could lead to multiple fatalities. However, additional safety measures, such as use of double-walled pipework and ignition source control, help manage these risks.

Figure 18:

Fuel-specific individual risk for Methanol as fuel

Figure 19:

Fuel-specific societal risk for Methanol as fuel

Table 13:

Fuel-specific risk for Methanol as fuel

As depicted in Figure 20, the main risk contributors for methanol as fuel are pool fires in the FPR and engine room. Although methanol also presents explosion and toxic risks, their contribution to the overall fuel risk is relatively minor. Since methanol remains in a liquid state under normal conditions, only evaporated vapour from the methanol pool and aerosolised particles during a release contribute to the formation of a flammable or toxic atmosphere. Consequently, explosions or toxic effects are expected only in the event of large methanol spills. This also indicates that gas detection may be challenging, highlighting the importance of liquid leakage detection measures for early warning of a leak.

Figure 20:

Fuel risk profile for Methanol as fuel

Since the methanol fuel risk shows only a marginal increase compared to conventional fuel, it does not result in significant changes to individual and societal risks, as shown in Figure 21 and Figure 22.

Figure 21:

Individual risk (overall) for Methanol as fuel

Figure 22:

Societal risk (overall) for Methanol as fuel

As indicated in Table 14, the calculated overall risk is 4.70E-03 fatalities per year in PLL, which is comparable to 4.69E-03 fatalities per year for the conventionally fuelled containership, clearly demonstrating an equivalent level of safety.

Table 14:

Overall risk for Methanol as fuel

Ammonia as a fuel exhibits a significantly elevated risk profile. As shown in Figure 23, the fuel-specific individual risk exceeds the target for new ships of 1.00E-04 fatality per year for engineering department personnel. Although it is assumed that engineering personnel spend less than 25 minutes per day on average in the FPR, this significantly contributes to the elevated risk. Minimising time spent in the FPR is therefore crucial. This could be achieved through increased automation (i.e. remote monitoring and operation) of the fuel supply system. The individual risk would also reduce with rigorous safety procedures for FPR entry. Additionally, the risk reduction measures suggested by Franks [3] could be considered, such as subdivision of the FPR and increased ventilation rates in the FPR.

Figure 23:

Fuel-specific individual risk for Ammonia as fuel

Figure 24 shows a significant increase in the frequency of accidents involving one or more fatalities compared to conventional fuel. This is because ammonia poses an immediate threat upon release, unlike conventional fuels that primarily require ignition to create fatal consequences. As a result, ignition source control, a common mitigation measure for flammable hazards, is ineffective in reducing ammonia-related risks. Furthermore, ammonia poses a substantial risk of multiple fatalities, particularly with potential leaks in the engine room. As summarised in Table 15, ammonia as fuel presents a PLL that is more than 22 times higher than that of conventional fuel oil.

Figure 24:

Fuel-specific societal risk for Ammonia as fuel

Table 15:

Fuel-specific risk for Ammonia as fuel

As shown in Figure 25, the predominant contributors to this increased fuel risk are ammonia releases and subsequent toxic effects. Leaks from the pressurised liquid segments resulted in ‘high’ fatality probabilities regardless of leak sizes due to the dense gas behaviour of the released ammonia.

Figure 25:

Fuel risk profile for Ammonia as fuel

Upon release of ammonia in the FPR, toxic gas clouds formed by vented ammonia can spread to other parts of the vessel, potentially affecting those in the engine room or accommodation. However, fatalities from these releases were rare due to safety measures, such as the assumed automatic closing devices at the accommodation air intakes, the separation between the ammonia handling spaces and accommodation areas, and the mitigating effects of indoor conditions.

Figure 26 highlights a substantial increase in individual risks for Engineering Officers and Ratings. These individual risk levels significantly exceed the target criterion for new ships, approaching the ‘unacceptable risk’ threshold. This emphasises the necessity for additional risk mitigation measures to achieve the target criterion.

Figure 26:

Individual risk (overall) for Ammonia as fuel

Figure 27 illustrates the societal risk for ammonia as fuel. There is a notable increase in the likelihood of incidents involving more than one to two fatalities compared to conventional fuel use.

Figure 27:

Societal risk (overall) for Ammonia as fuel

As summarised in Table 16, the overall risk (PLL) has risen by more than 20%. Although the estimated risk, both in individual and societal terms, remains within the tolerable region, substantial efforts are required to ensure onboard safety through adequate ALARP demonstration, application of inherently safer design and provision of additional meaningful protection [42].

Table 16:

Overall risk for Ammonia as fuel