DeRisk_beta: Comparative quantitative risk assessment of fuel oil, LNG, methanol, and hydrogen on a 170 m RoPax ferry

2.1 World RoPax Fleet

Understanding the safety levels of alternatively fuelled RoPax ships requires a baseline risk based on a conventional vessel. This study examines the global RoPax fleet over 1,000 gross tonnage (GT) from 2014 to 2023 using S&P Sea-Web data [12]. Figure 1 shows the number of the RoPax fleet over 1,000 GT in service between 1 January 2014 and 31 December 2023. Smaller vessels under 1,000 GT were excluded due to their typically shorter voyages and open configurations that are not representative of larger passenger operations. Total exposure over this ten-year period was 18,192 ship-years.

Figure 1:

Global RoPax fleet development (2014 – 2023)

2.2 Historical Casualty Data

Table 1 summarises reported casualty data for RoPax vessels over 1,000 GT between 2014 and 2023 [12]. Hull and machinery damage accounted for the largest share of casualties (37.2%), followed by contact (26.6%) and collision (15.2%). Fires and explosions represented 12.0% of all casualties. Some hull and machinery incidents escalated into secondary events such as fire, explosion and foundering. Overall, incident frequency during this period was 6.90E-02 per ship per year (i.e. per ship-year).

Table 1:

Number of incidents and incident frequencies between 2014 and 2023, RoPax (over 1,000 GT)

Table 2 lists 14 fatal incidents during the same period [12] as the casualties listed in Table 1. Notably, Table 2 includes the SEWOL disaster, which resulted in 304 fatalities due to the sinking of the vessel.

Table 2:

Fatal incidents between 2014 and 2023, RoPax (over 1,000 GT)

2.3 Individual Risk

Table 3 provides the historical Potential Loss of Life (PLL) for RoPax operations over the ten-year period (2014-2023). The overall PLL is calculated as 2.13E-02 fatalities per year, indicating a significant improvement from 9.53E-02 fatalities per year reported for the period 1994–2004 [13] [14] [15].

Table 3:

Potential Loss of Life between 2014 and 2023, RoPax (over 1,000 GT)

Assuming a typical RoPax ferry carrying 600 persons on board (550 passengers and 50 crew), indicative Individual Risk (IR) levels can be calculated as follows:

• • Crew (onboard 75% of the year): 2.67E-05 fatality per year
• • Passenger (4-day/year exposure): 3.90E-07 fatality per year

2.4 Societal Risk

Figure 2 presents the societal risk for RoPax vessels over the period 2014-2023. A Frequency-Number (FN) curve is used [16], which plots the cumulative frequency (F) of events resulting in N or more fatalities.

Figure 2:

FN curve of RoPax fleet worldwide, over 1,000 GT (2014–2023)

3.1 Vessel Design

A 170 m RoPax ferry accommodating 550 passengers and 50 crew members was selected as the reference vessel (Figure 3). The main particulars of the vessel are summarised in Table 4. The vessel is equipped with two electric propulsion trains, powered by either six 5,760kW dual-fuel generators for fuel oil, LNG, and methanol or by 154 x 225 kW proton-exchange membrane (PEM) fuel cells for hydrogen.

Figure 3:

Profile of a 170 m RoPax

Table 4:

Main particulars

Figure 4 illustrates the general arrangements of the RoPax using fuel oil, LNG, methanol, and hydrogen as fuel. The fuel oil, LNG, and methanol designs incorporate two engine rooms, each housing three generator sets and auxiliaries. The hydrogen fuelled design replaces engine rooms with Fuel Cell Rooms (FCR) each containing 77 fuel cell cabinets.

Figure 4:

General arrangements of fuel oil, LNG, methanol, and hydrogen fuelled designs (RoPax reference vessel)*FO: Fuel Oil. TCS: Tank Connection Space. FPR: Fuel Preparation Room. MEOH: Methanol. LH2: Liquid Hydrogen

Two dedicated fuel tanks are located forward of the engine rooms (or FCR), sized to offer equivalent energy storage across different fuels (Table 5). Tanks for fuel oil and methanol are integral to the ship’s structure, whereas LNG and hydrogen tanks are independent cylindrical tanks, referred to by IMO as ‘Type C’ tanks.

Table 5:

Comparison of fuel tank capacity

Each fuel tank has its dedicated Tank Connection Space (TCS) and Fuel Preparation Room (FPR), providing fuel to the associated engine room (or FCR). The hydrogen fuelled design only includes TCSs due to its simpler configuration utilising a pressure build-up unit in lieu of fuel pumps. All fuel handling spaces are below deck, ventilated at 30 air changes per hour, and equipped with airlocks. Inerting is not applied.

Schematics for each fuel supply system are illustrated in Figure 5 to Figure 7. Each design incorporates two independent fuel supply systems, one for each engine room, to meet Safe Return to Port (SRtP) requirements [17]. It was assumed that hydrogen fuel cells are housed individually in gastight cabinets (1.2 m × 1.0 m × 2.1 m), each ventilated at 30 air changes per hour.

Figure 5:

LNG fuel supply system*BOG: Boil-Off Gas. FVT: Fuel Valve Train. GE: Generator Engine. TCS: Tank Connection Space. FPR: Fuel Preparation Room. E/R: Engine Room

Figure 6:

Methanol fuel supply system*LP: Low Pressure. HP: High Pressure. TCS: Tank Connection Space. FPR: Fuel Preparation Room. E/R: Engine Room

Figure 7:

Liquid hydrogen fuel supply system*FCR: Fuel Cell Room. TCS: Tank Connection Space. LH2: Liquid Hydrogen

Bunkering operations and associated equipment are not considered in the study.

3.2 Crew and Passenger Distribution

To determine individual risk, an assumed location and residence time for crew and passengers is required, as shown in Table 6. Table 7 presents the distribution for various operating scenarios assumed for the societal risk calculations. It was assumed that the vessel operates at sea on alternative fuel for 77% of the time, with the remaining 23% spent in port also using alternative fuels. The presented data are indicative and may vary by operator and vessel.

Table 6:

Number of persons onboard, time onboard, and time distribution assumed for individual risk

Table 7:

Distribution of persons assumed for societal risk

3.3 QRA Methodology

The Quantitative Risk Assessment (QRA) was performed using DeRisk_beta [11]. DeRisk_beta is an in-house tool that integrates a generic risk model for non-fuel risks with fuel-specific hazard modelling, together with data on the number and distribution of crew and passengers. This enables the calculation of fuel-specific risk and overall ship risk, expressed in terms of both individual risk (fatalities per year) and societal risk (Potential Loss of Life and FN curves).

The methodology comprises likelihood and consequence analyses as described below.

3.3.1 Likelihood Analysis:

The following data and models were used to estimate the likelihood of hazardous events associated with alternative fuels.

• • Leak frequency data: IOGP data for 1992–2015 period [18]
• • Ignition probability model: CCPS Level 3 [19] with 0.25 ignition strength for unclassified spaces [20], and MISOF data [21] for classified spaces.
• • Isolation failure: assumed probability of isolation failure, 3.16E-02 [22]; Manual isolation assumed within 30 minutes upon isolation failure [23].
• • Event tree model: Generic event tree encompassing jet fire, pool fire, flash fire, explosion, and toxic exposure scenarios (Table 8).

Table 8:

Event tree model used to estimate fuel risks

3.4 Limitations

The QRA methodology is subject to several uncertainties and limitations. These stem from the lack of operating experience and marine-specific data, uncertainties in the models, and simplifying assumptions. In particular, the current estimation of explosion consequences is based on simplified models that do not account for structural responses or complex geometry. These limitations mean the results should be interpreted as order-of-magnitude estimates for comparative purposes rather than precise risk values.

3.5 Risk Measures

Based on the likelihood and consequence analyses, the risk was calculated and aggregated using the following measures:

• • Individual Risk (IR): a risk experienced by an individual, measured in the chance of fatality per year
• • Societal Risk (SR): risk experienced by a whole group, measured in Potential Loss of Life (PLL) and also illustrated as a FN curve.

3.6 Risk Criteria: Individual Risk

IMO MSC 72/16 [39] defines the following acceptance criteria for individual risk:

• • Maximum tolerable individual risk: 1.00E-03 fatality per year
• • Negligible individual risk: 1.00E-06 fatality per year

Additionally, IMO proposes the following target criteria for new ships:

• • Crew: 1.00E-04 fatality per year
• • Passenger: 1.00E-05 fatality per year.

As noted, in Section 2.3, for RoPax vessels (all operating on fuel oil), the individual risk was 2.67E-05 fatality per year for crew, and 3.90E-07 fatality per year for passengers during the period 2014 to 2023.

3.7 Risk Criteria: Societal Risk

IMO MSC 72/16 [39] suggested a benchmark method to set the societal risk criteria using an average acceptable Potential Loss of Life (PLL_A). PLL_A is derived from an aggregated indicator (𝑟) observed in the aviation sector and is defined as fatalities per contribution to Gross National Product (GNP). Using this approach, PLL_A is calculated as:

• EV Economic Value (EV) of the activity

From recent data noted in Table 9, PLL_A is calculated as 7.38E-03 fatalities per ship-year for the reference RoPax vessel.

Table 9:

Values used to establish societal risk criteria for reference RoPax vessel

With the calculated PLL_A and adoption of risk aversion factor (b) of 1, as suggested by IMO MSC 72/16, the FN curve intercept at N=1 (F₁) can be determined as 1.06E-03 using Equation (2)-(4), which is further rounded down to 1.00E-03.

In Equation (3), setting b=1 yields:

Equation (4) can be rearranged with regard to F₁:

• PLL_A Average acceptable Potential Loss of Life
• f_n Frequency of an accident involving N fatalities.
• N Number of fatalities
• N_Max Maximum number of fatalities that may occur
• F₁ Acceptable cumulative frequency of an accident involving 1 or more fatalities
• b Risk aversion factor

This results in the following societal risk criteria:

• • Maximum tolerable risk : 10∙F₁∙N^-1 = 1.00E-2∙N^-1 fatalities per ship-year
• • Negligible risk : 0.1 F₁ N^-1= 1.00E-4∙N^-1 fatalities per ship-year

These criteria closely align with those proposed by UK HSE [42].

Figure 8 shows the FN curve for RoPax vessels over 1,000 GT from 2014 to 2023, derived in Section 2, overlaid with both original and revised societal risk criteria. While the curve mostly remains within the tolerable region, it exceeds the maximum tolerable limit at fatality levels above 100. This is due to the SEWOL disaster, which caused 304 fatalities and had profound social and political consequences in Korea [43], [44], [45]. It led to regulatory reforms, widespread distrust in authorities, and national demands for accountability.

Figure 8:

FN curve of RoPax fleet worldwide, over 1,000 GT (2014 – 2023) with societal risk criteria

4.1 QRA Result: Fuel Oil Risk - PLL

The fuel specific Potential Loss of Life (PLL) for fuel oil is shown in Figure 9. Owing to its high flash point, fuel oil does not readily produce flammable vapour under normal conditions, resulting in low ignition probabilities (0.02%–0.03%). Consequently, scenarios involving jet fires, flash fires, or explosions are not anticipated. The dominant risk is thus pool fires, with a total fuel-related PLL of 3.02E-05 fatalities per ship-year.

Figure 9:

Fuel oil PLL by hazardous event type

To validate the QRA, the estimated PLL for fuel oil was compared with historical records. Between 2014 and 2023, one engine room fire/explosion was reported. Assuming that 60% of machinery-related fire and explosion events are fuel-related [46] [47], the historical PLL is roughly estimated at 3.30E-05 fatalities per ship-year, which closely aligns with the QRA estimate. Despite this similarity, uncertainties remain due to limited data, simplifying assumptions, and inherent model limitations. The results should therefore be interpreted with caution and regarded as an indicative estimate. This fuel oil PLL (baseline) establishes the reference point for evaluating the relative risk increases introduced by alternative fuel systems.

4.2 QRA Result: LNG Risk - PLL

Building upon the fuel oil baseline, the assessment of LNG reveals a markedly different risk profile. The risk profile for LNG is summarised in Figure 10, and compared to fuel oil indicates a significantly greater fuel-specific PLL of 2.06E-03 fatalities per ship-year. The primary risk contributors are explosions, flash fires, and jet fires.

Figure 10:

LNG – PLL by hazardous event type

As the vessel design locates fuel handling compartments below the main deck, LNG explosions could compromise hull integrity, potentially causing flooding and foundering of the vessel. Explosion scenarios thus dominate, with a PLL of 1.97E-03 fatalities per ship-year (i.e. explosions and large explosions shown in Figure 10.

4.3 QRA Result: Methanol Risk - PLL

The QRA results for methanol are presented in Figure 11, indicating a total fuel related PLL of 1.17E-04 fatalities per ship-year. This is substantially less than LNG but is still a notable increase over fuel oil. Methanol, unlike LNG or hydrogen, has a high boiling point and remains in the liquid phase after release, forming a pool. Although vapour is generated through pool evaporation, its emission rate is much lower than that of LNG or hydrogen, which tend to flash immediately upon release. The use of drip trays further reduces methanol vapour release by limiting the surface area of the pool. As a result, gas concentrations rarely reached flammable or toxic thresholds, and pool fire is identified as the primary hazard associated with methanol. Nonetheless, under certain extreme conditions, methanol vapour may form a flammable atmosphere, potentially resulting in an explosion. The methanol results demonstrate that fuel physical properties significantly influence risk profiles, with liquid fuels generally presenting lower risk than gaseous fuels.

Figure 11:

Methanol – PLL by hazardous event type

4.4 QRA Result: Hydrogen Risk - PLL

Figure 12 illustrates that hydrogen presents the ‘highest’ fuel-specific PLL with 5.41E-03 fatalities per ship-year. This is because of hydrogen’s inherent high reactivity, significantly increasing ignition probability and explosion potential under delayed-ignition scenarios.

Figure 12:

Hydrogen – PLL by hazardous event type

Hydrogen’s distinctively low minimum ignition energy (0.02 mJ), wide flammability range (4%–75%), and rapid combustion velocity (2.37 m/s) results in extensive explosion zones. These are significantly amplified when equipment items containing hydrogen are located within enclosed spaces. Whilst hydrogen's low density and high diffusion coefficient favour rapid dilution in open environments, where its buoyant properties allow it to disperse quickly into the atmosphere, enclosed spaces present markedly different challenges. Consequently, hydrogen explosions below deck dominate the risk profile, highlighting a crucial area for risk management.

The hydrogen results underscore the fundamental challenge of managing highly reactive fuels in marine environments; where the combination of confined spaces and potential ignition sources create particularly hazardous conditions.

4.5 Comparison of PLL by fuel type

Figure 13 summarises the PLL for fuel oil, LNG, methanol, and hydrogen.

Figure 13:

Comparison of PLL by fuel and event type

Hydrogen demonstrates the ‘highest’ fuel-specific PLL of 5.41E-03 fatalities per ship-year. This elevated risk is due to hydrogen’s high reactivity, resulting in a relatively greater probability of ignition and subsequent explosion. LNG follows with a PLL of 2.06E-03, also driven by explosion scenarios. Methanol shows limited explosion and flash fire risks but still exhibits a notable pool fire risk, resulting in a PLL of 1.17E-04 fatalities per ship-year.

Figure 14 presents a comparative overview of fuel-related risks by event category and can be used to help prioritise risk mitigation. It is evident that explosion hazards show the ‘highest’ PLL; therefore, preventing explosion is a key priority in the design of a RoPax utilising LNG or hydrogen as fuel.

Figure 14:

Comparison of PLL by fuel type

4.6 Overall PLL - Fuel Oil, LNG, Methanol, and Hydrogen

The overall PLL for each fuel, integrating fuel-specific and historical non-fuel risks, is summarised in Table 10. To avoid double-counting of fuel risks, the fuel oil risk presented in Section 4.1 was excluded when calculating the overall risk for RoPax vessels using LNG, methanol, and hydrogen.

Table 10:

PLL - 170 m RoPax using fuel oil, LNG, Methanol, and Hydrogen

The methanol fuelled design exhibits a comparable overall PLL (2.14E-02 fatalities per ship-year) to that of fuel oil (2.13E-02), with only a marginal increase of 8.40E-05 fatalities per ship-year. The LNG fuelled design shows a greater increase in overall PLL (2.33E-02 fatalities per ship-year) with LNG contributing almost 9% of the calculated PLL (2.06E-03 fatalities per ship-year). In contrast, the hydrogen fuelled design significantly elevates the overall PLL (2.67E-02) with hydrogen explosions contributing 20.3% of the total.

4.7 Individual Risks

Individual risks are calculated using onboard time distributions given in Table 6 with the results presented in Figure 15.

Figure 15:

Comparison of Individual Risk by crew category and fuel type

Compared to fuel oil, the use of alternative fuels introduces additional risks to both crew and passengers. In particular, the individual risks for Engine Officers and Engine Ratings - who routinely access compartments containing fuel handling equipment - experience notable increases in individual risk. For example, the individual risks for an Engine Officer are:

• • Fuel Oil design: 2.9E-05 fatalities per year
• • LNG fuelled design: 4.9E-05 fatalities per year
• • Methanol fuelled design: 5.0E-05 fatalities per year
• • Hydrogen fuelled design: 6.0E-05 fatalities per year

Despite these increases, all individual risks for crew remain below the maximum IMO target thresholds and passenger individual risks remain negligible (<1.0E-06 fatalities per year based on an assumed passenger exposure of four days/year).

4.8 Societal Risks

Figure 16 presents fuel-specific risks as FN curves. The FN curves for fuel oil and methanol show negligible potential for high-fatality events. In contrast, those of LNG and hydrogen reveal clear potential for high-fatality events. According to the International Code of Safety for Ship Using Gases or Other Low-flashpoint Fuels (IGF Code) [48], the safety level of an alternative fuel system should be equivalent (that is, similar) to that of fuel oil systems. However, Figure 16 illustrates that both LNG and hydrogen pose considerably greater risks. Particularly, the hydrogen fuel system shows the greatest frequency of high fatality scenarios, highlighting the need for risk-reduction measures targeted at hydrogen’s unique hazards.

Figure 16:

Comparison of Societal Risk by fuel type (attributable to fuel hazards only)

Figure 17 illustrates the overall risk FN curves, incorporating both fuel-related and non-fuel hazards. While all FN curves surpass the maximum tolerable criterion at the point of 304 fatalities (attributable to the SEWOL ferry disaster), this particular event stems from non-fuel-related factors such as compromised stability and insufficient emergency response. As such, it should not be attributed to fuel system design but rather addressed through improvements in ship stability, operational procedures, and emergency responses. Figure 18 additionally presents FN curves without the SEWOL disaster to help interpret its influence on the overall risk distribution.

Figure 17:

Comparison of societal risk by fuel type (attributable to fuel and non-fuel hazards)

Figure 18:

Comparison of societal risk by fuel type, excluding SEWOL disaster

Nevertheless, hydrogen introduces a distinctly elevated societal risk in the high-fatality range (approximately 20–300 fatalities), largely due to its explosion potential and the associated risk of foundering due to explosion. This could raise concerns about societal acceptability of hydrogen as fuel. Therefore, these risks should be addressed in the design and minimised (an example of this is given in Section 4.10).

4.9 Sensitivity study on QRA results

As noted in Section 3.4, QRA results are subject to significant uncertainties, particularly with limited operating experience. To manage these uncertainties, the study adopted conservative parameters and approaches wherever possible. Especially, assumptions used to estimate the consequences associated with hydrogen involve considerable conservatism. To test the sensitivity of the QRA results on hydrogen fuelled RoPax to key parameters, sensitivity analysis has been performed. The results of the sensitivity study can be found in Table 11.

Table 11:

Sensitivity analysis results

4.10 Potential Risk Reduction Measures for the Hydrogen Fuelled RoPax

The QRA identified significant risks associated with explosions and subsequent foundering events for the hydrogen fuelled RoPax design. Furthermore, Section 4.3 (“Limitation of explosion consequences”) of the IGF Code stipulates that an explosion in any space containing any potential source of release and ignition shall not damage the ship in such a way that flooding of water below the main deck occurs. As the RoPax design places fuel handling compartments below the main deck, certain explosion scenarios have the potential to cause hull breaches, resulting in flooding and vessel foundering.

To reduce these risks and achieve a safety level comparable to conventional fuels, two potential risk reduction measures, also known as risk control options (RCOs), were evaluated using the DeRisk_beta tool.

RCO 1 – atmosphere control in the TCS (to minimise ignition potential)

• • TCS atmospheres are inerted (i.e. nitrogen-enriched), maintaining oxygen levels below 4.6% [49].
• • Oxygen concentration is continuously monitored. Alarms and automated safety actions (fuel shutdown and ventilation extraction) activate before oxygen levels reach 4.6%.
• • The oxygen monitoring and safety system is designed to Safety Integrity Level (SIL) 2, with a Probability of Failure on Demand (PFD) of 3.16E-03 [22].
• • Access to TCS areas is strictly controlled; therefore, the risk of asphyxiation due to inerting has not been considered.

RCO 2 – Explosion-Proof Equipment in FCR (to minimise ignition potential)

• • FCR spaces are classified as hazardous zones, with appropriate explosion-proof equipment installed throughout. Reduction of the ignition strength of FCR from 0.25 to 0.01 is assumed.

As shown in Table 12, both RCOs achieve notable risk reductions compared to the baseline hydrogen fuelled design.

Table 12:

PLL – with and without Risk Control Options

Assuming approximate implementation costs of USD 250,000 for RCO1 and RCO2, respectively, and considering a typical vessel lifespan of 30 years, the Gross Cost of Averting a Fatality (GCAF) is estimated at USD 2.1 million for RCO 1, USD 6.4 million for RCO 2, and 3.2 million for the combined measures (RCO 1&2), as summarised in Table 13.

Table 13:

GCAF by implementing RCO1 and RCO1&2

Given that IMO recommends a CAF threshold of USD 8.7 million [50], the adoption of these risk control measures could be considered justified. However, it is important to acknowledge that these calculations rely upon broad and indicative assumptions. In practice, detailed project-specific assessments considering precise cost data, vessel-specific operational profiles, and engineering feasibility must be conducted prior to deciding upon implementation.

The societal risk improvements resulting from implementing the RCOs are illustrated in Figure 19 (overall) and Figure 20 (fuel-specific). Although the overall FN curves exceed the maximum tolerable criterion owing to the SEWOL disaster, both RCO 1 and the combined RCO 1 + RCO 2 configurations demonstrate clear risk-reduction benefits in the high-fatality range, as seen in Figure 20.

Figure 19:

Comparison of overall societal risk: hydrogen base-case design (fuel and non-fuel), and hydrogen design with RCO1, and RCO1 and 2

Figure 20:

Comparison of fuel-specific societal risk - hydrogen base-case design, and hydrogen design with RCO1, and RCO1 and 2

Author Contributions

Conceptualization, P. Davies and K. T. Moon; Methodology, K. T. Moon; Software, K. T. Moon; Formal Analysis, K. T. Moon; Investigation, K. T. Moon; Data Curation K. T. Moon; Writing-Original Draft Preparation, K. T. Moon; Writing-Review & Editing, P. Davies and L. Wright; Visualization, K. T. Moon; Supervision, P. Davies and L. Wright; Project Administration, P. Davies and K. T. Moon; Funding Acquisition, P. Davies.