Recommendations

for Design and

Operation of
Ammonia-Fuelled
Vessels Based on
Multi-disciplinary
Risk Analysis
 2

Executive
summary
The implementation of alternatives to
conventional fossil-based fuels is key to
decarbonization of the global shipping
industry. Ammonia is currently one
of the frontrunners among alternative
shipping fuels, as it can be combusted
with almost no carbon dioxide
emissions. However, using ammonia as
a shipping fuel involves safety hazards:
primarily toxicity, but also onboard fires
and explosions. Therefore, it is crucial
to understand these risks and the
safeguards that can be implemented to
reduce them to tolerable levels.
 Executive summary 3

To this end, we have pioneered an innovative multi-disciplinary approach to

assess and address the onboard safety risks to a ship’s crew of ammonia as a
shipping fuel. Our project is a collaboration between the Lloyd’s Register Maritime
Decarbonisation Hub (MDH) and the Mærsk Mc-Kinney Møller Center for Zero
Carbon Shipping (MMMCZCS), with contributions from other partners. This report
outlines the results of this project.

The first main section of this report summarizes the results of an iterative
quantitative risk assessment (QRA) analysis applied to three reference designs for
ammonia-fuelled vessels. QRA is a powerful data-driven method that allows users
to assess risk in a quantitative and granular manner. Importantly, QRA can be used
to quantitatively estimate the effectiveness of risk mitigations by adding different
modifications to the QRA model and observing their impact on the risk calculation.
In our project, we used this capability of QRA to characterize risk levels across
different vessel types, place these in the context of existing risk criteria, and identify
design and operational measures that would reduce risk to crew to a tolerable level.

Based on our analysis, we highlight several recommendations and findings for

the design and operation of ammonia-fuelled vessels. We divided these into
three groups: high-priority recommendations relating to measures that contribute
significantly to reduction of risk to crew; findings that demonstrate the importance
of existing good practice, guidelines, or rules; and other recommendations.

High-priority recommendations:

À Lower storage temperature reduces the safety risk from ammonia fuel.

À Divide the fuel preparation room into two or more separate spaces
containing different groups of equipment that could leak ammonia.

À Access to and length of time spent in spaces containing ammonia

equipment should be minimized, monitored, and controlled.

À Ventilation outlets from spaces containing ammonia equipment should

be placed in a safe location adequately separated from areas accessed
by crew, in order to avoid accidental release of toxic concentrations of
ammonia affecting personnel.

À Multiple sensors of different types to detect ammonia leaks should

be installed.
 Executive summary 4

Findings:

À Secondary containment mechanisms, such as double-walled piping, used

for ammonia-related equipment outside of already-restricted areas have
been proven to significantly reduce risk.

À Ventilated gas-tight enclosures installed around any gas valve units in

engine rooms also reduce risk.

À Ventilation of spaces containing ammonia equipment provides mitigation

of toxic effects for many smaller, but not all, potential ammonia leaks.
This mitigation is particularly efficient for smaller leaks. Consideration of
additional precautions is required for personnel entering these spaces.

À Ventilation of spaces containing ammonia equipment reduces the risk of

ammonia concentrations reaching a flammable level. Although ammonia
is much less flammable than some other fuels, the flammability hazard
should not be ignored.

À Ammonia leak alarms should be installed both in controlled areas (for

example, the fuel preparation room) and near potential leak sources.

À The fuel system should be subject to rapid and reliable manual and
automated shutdown in the event of an ammonia leak.

Other recommendations:

À Depending on storage conditions and ammonia tank location, shutdown

of the ventilation for crew accommodation should be made possible in the
event of an ammonia leak.

À A distinctive, vessel-wide audible toxicity alarm for ammonia leaks should

be implemented.
 Executive summary 5

To complement this quantitative analysis, the second main section of this report
summarizes insights from an analysis of human factors considerations, such as
training and work practices, that will be impacted by a transition to ammonia fuel
use. Through a series of collaborative workshops, we identified relevant human
factors considerations based on the three reference designs used for QRA and
rated their impact as low, medium, or high. This report explains and discusses ways
to address the highest-impact human factors considerations based on our analysis.
These factors relate to the following areas:

À Competence and training: specific training and upskilling will be needed to

prepare crew for operation and maintenance on ammonia-fuelled vessels.

À Process and procedures: safe work practices and standard procedures

need to be updated and should be implemented through systematic
change management programs.

À Occupational health hazards: effective occupational health safeguards,

such as personal protective equipment (PPE), need to be developed and
implemented .

À Process safety hazards: appropriate safety management procedures for

emergency response and other events need to be developed.

Taken together, we conclude that the risks to crew of using ammonia as an

alternative maritime fuel can be kept to a tolerable level, provided that the maritime
industry can:

À Ensure suitable and sufficient technical barriers and administrative

safeguards are implemented to protect the crew against various
ammonia risks;

À Address human factors considerations, such as those outlined above; and

À Build upon existing maritime industry experience with gas as fuels and
cargo and carry over learnings from other industries with considerable
experience in safely handling, transferring, and storing ammonia.

The recommendations and results from this report can and should be used to
further inform specific regulations, guidelines, and best practices that will allow
ammonia-fuelled vessels to be acceptably safe for the crew.
 Contents 6

Contents
Executive summary 2
Acknowledgements 8

1. Introduction: Ammonia is a potential solution to shipping’s

decarbonization, but new risks must be addressed 9

2. Quantitative risk assessment (QRA) provides an innovative

approach to evaluate and reduce risk in ship design 13
2.1 Quantitative risk assessment can enable safer design 14
2.1.1 Study definition and scope 16
2.1.2 Preliminary data gathering 16
2.1.3 Hazard identification 17
2.1.4 Analysis 18
2.1.5 Risk reduction 19
2.2 Crew risk can be substantially reduced through stepwise mitigation 21
2.2.1 Successive application of targeted measures can drive down risk
to crew 21
2.2.2 Risks can be kept within tolerable limits 25
2.3 New vessel designs and additional equipment are needed 26
2.3.1 User-centred design will be a key principle 26
2.3.2 Lower storage temperature reduces the safety risk from
ammonia fuel 26
2.3.3 Secondary containment is an important risk mitigator 27
2.3.4 Control of ventilation is a key risk mitigator 29
2.3.5 Focused attention should be paid to key spaces 30
2.3.6 Rapid and reliable shutdown in the event of a leak is required 34
2.3.7 Care is needed in the design and positioning of ventilation exhausts 34
2.4 Summary of quantitative risk assessment 36
 Contents 7

3. Human factors considerations must be addressed 37

3.1 Introduction to human factors analysis and key findings 38
3.2 Many roles will require new skills and knowledge, driving a need for
upskilling and training 41
3.3 There will be numerous changes to, and increased reliance upon,
functional work practices and procedures 42
3.4 Ammonia-fuelled vessels will introduce new occupational health hazards 43
3.5 Managing process safety hazards requires continued improvement
in standards 44

4. Conclusion: Use of appropriate risk mitigations can bring the

safety risks of ammonia fuel to within tolerable limits 45

Abbreviations 47

Appendix 1: Application of risk criteria and targets for QRA 49

Measures of risk 49
The HSE tolerability of risk framework 49
Risk criteria for seafarers 50
Current risks to seafarers 52
Equivalent level of safety 53
Individual risk of fatality criteria for the project 54

Appendix 2: Description and results of additional studies used to

inform or supplement QRA 55
Review of HAZID studies and accident experience 55
Vessel impact study 55
Computerized fluid dynamics (CFD) dispersion study 56
Dispersion from vent masts and ventilation exhausts 58

Appendix 3 – Human factors impact on operational phases 59

Acknowledgements
The findings of this report are built on extensive cross-sector collaboration between organizations in the maritime industry and
beyond. Initially, the project team comprised the MDH, the MMMCZCS, A. P. Moller - Maersk (Maersk), Mitsubishi Heavy Industries
(MHI), NYK Line (NYK), TotalEnergies, and MAN Energy Solutions (MAN ES). The American Bureau of Shipping (ABS), BP, Cargill, CF
Industries, Stolt Tankers, and [Link] were subsequently added to the team.

Drawing on resources available across these organizations, experts in risk assessment, maritime safety, human factors, ship design,
ship operation, engine design, and ammonia production contributed their knowledge to the project.

Opinions found in this report do not necessarily represent those of each partner.

Detailed acknowledgements:

Project managers: Claus Rud Hansen (Maersk*) and Andrew Franks (MDH).
Assisting project manager: Martin Eriksen (MMMCZCS)
Project steering committee: Claus Winter Graugaard (MMMCZCS), Sebastien Roche (TotalEnergies), Benny Hilstrom (Maersk),
Tomoo Kuzu (MHI), and Masafumi Okajima (NYK).
Preparation of reference designs: Peter Nerenst (MAN ES*), Claus Rud Hansen (Maersk*), Viviane Philippe (TotalEnergies*), Robert
Bridges (TotalEnergies*), Jun Kato (NYK*), Takashi Unseki (MHI), Hiroyuki Yanagisawa (MHI*), Koichi Matsushita (MHI*), Daisuke
Yamada (MHI), Jun Ito (NYK*), Koichi Sato (MHI*), and Shinichi Iwamoto (NYK*).
Quantitative risk assessment: Andrew Franks (MDH), Samie Parkar (MDH), and Paul Davies (LR).
Risk reduction workshops: Andrew Franks (MDH), Samie Parkar (MDH), Matt Dunlop ([Link]*), Toby Garner (LR), Ilie Juravle
(Cargill*), Joshua Padeti (ABS), Shinichi Iwamoto (NYK*), Koichi Sato (MHI*), Jun Kato (NYK*), Takashi Mishima (NYK), Koichi
Matsushita (MHI*), Takashi Unseki (MHI), Andrew McNally (BP), Mike Parker (BP), Peter Nerenst (MAN ES*), Pierre Domine (Stolt
Tankers), Viviane Philippe (TotalEnergies*), and Claus Rud Hansen (Maersk*).
Human factors study: Matt Dunlop ([Link]*), Denise McCafferty (LR), Toby Garner (LR), and Martin Eriksen (MMMCZCS).
Review of HAZID studies and accident experience: Andrew Franks (MDH), Claus Rud Hansen (Maersk*), Joshua Padeti (ABS),
Giorgio Guadagna (Stolt Tankers*), Pierre Domine (Stolt Tankers), Matt Dunlop ([Link]*), Andrew McNally (BP), Hiroyuki Yanagisawa
(MHI*), Denis McCafferty (LR), Jun Ito (NYK*), Shinichi Iwamoto (NYK*), Ilie Juravle (Cargill*), Peter Nerenst (MAN ES*), Robert Bridges
(TotalEnergies*), and Koichi Matsushita (MHI*).
Finite Element Analysis: Yong Chen and Bo Wang (ABS).
Computerized Fluid Dynamics Analysis: Zhongfu Ge (ABS).
Dispersion from vent masts and ventilation exhausts: Koichi Matsushita (MHI*), Marwan Elnesr and Samie Parkar (MDH).
(*): Seconded to MMMCZCS.
1.

Introduction:
Ammonia is
a potential
solution to
shipping’s
decarbonization,
but new risks
must be
addressed
 1. 10

As efforts intensify to limit global temperature

rise to 1.5°C in line with the Paris Agreement,1
governments and regulators are setting
increasingly ambitious greenhouse gas (GHG)
reduction targets. Accordingly, the maritime
industry is moving forward with short-, medium-
and long-term measures to achieve year-on-
year emissions reductions. Long-term solutions
require alternative fuels with zero GHG emissions
across the whole fuel supply chain, from
resource and production through to distribution
and consumption.

No single alternative fuel is likely to fulfil the needs of the entire maritime industry.
This is due to many factors, including feedstock supply, technology limitations, price
competitiveness, stakeholder acceptance, and the requirements of different vessel
types and operating profiles. Several alternative fuels are under consideration,
including methane, hydrogen, methanol, biofuels, and ammonia.2,3 Each fuel has
different characteristics and advantages but also different hurdles, including safety
hazards that must be overcome before widespread adoption.

Importantly, ammonia offers the potential for zero-carbon propulsion, as its

combustion does not produce carbon dioxide (CO2). In practice, pilot fuel is
required to achieve ammonia combustion, resulting in some CO2 emissions.
Furthermore, emissions of the potent greenhouse gas nitrous oxide (N2O) from
ammonia-powered vessels would need to be managed, and the energy used for
ammonia production must also be zero-carbon to avoid upstream CO2 emissions.
The well-to-wake GHG emissions of green ammonia (i.e., ammonia produced using
renewable electricity) have been estimated to be 97% lower than those of low-
sulphur fuel oil (LSFO).4

As such, ammonia’s potential for near-zero carbon emissions has attracted

considerable interest from the shipping industry. A recent survey of shipping sector
stakeholders by Lloyd’s List and Lloyd’s Register (LR) identified ammonia as one
of the top three fuels with potential for zero carbon shipping by 2050.5 Analysis by
the MMMCZCS also indicates that ammonia could play a notable role in shipping’s
green transition, representing up to half of the industry’s fuel needs in 2050.6

1 The Paris Agreement, UNFCCC, 2015.

2 Maritime Decarbonization Strategy 2022, Mærsk Mc-Kinney Møller Center for Zero Carbon Shipping, 2022.
3 Zero Carbon Fuel Monitor, Lloyd’s Register Maritime Decarbonisation Hub, 2023.
4 Maritime Decarbonization Strategy 2022, Mærsk Mc-Kinney Møller Center for Zero Carbon Shipping, 2022.
5 Regulation is key to shipping’s green push, Lloyd’s List survey finds, Lloyd’s List, 2021.
6 Industry Transition Strategy 2021, Mærsk Mc-Kinney Møller Center for Zero Carbon Shipping, 2022.
 1. 11

However, ammonia is hazardous to both humans and the environment.7

Ammonia is toxic, and leaks resulting in air concentrations as low as 2,700 parts
per million (0.27%) can cause fatalities after 10 minutes’ exposure.8 Ammonia is
also flammable, but much less flammable than other fuels such as natural gas
or hydrogen. While the shipping industry is already experienced in designing
vessels powered by hazardous fuels such as heavy fuel oil and liquified natural gas
(LNG), ammonia’s physical properties differ considerably from these established
fuels. The industry also has experience in handling ammonia, as it is currently
carried onboard ships as cargo. However, using ammonia as a fuel comes with
many additional considerations, including bunkering, fuel preparation, piping, and
ventilation, which lead to increased risks of leaks and exposure compared with
carriage as cargo. As a result, safety, including crew safety, is a key hurdle for the
use of ammonia as a fuel in the maritime industry.

The risks to crew of ammonia as a fuel should be assessed in the context of the
current risks to seafarers. The main hazard associated with traditional oil-based
fuels is fires in the engine room. A 2011 study on fire safety in engine rooms
reported 73 such fires over a 13-year period in a fleet of 6,000 merchant vessels.
Around 60% of these fires arose from the fuel oil or diesel oil part of the system.9
Seafarers are also exposed to numerous other hazards, including container fires,
collisions, and non-fuel fires. A 2014 study of fatalities in the British merchant fleet
records 49 seafarer fatalities in marine accidents over the period 2003 – 2012.10
The causes of death included vessel capsize, asphyxiation in enclosed spaces, falls
overboard and onboard, and being struck by ropes and other objects. Although a
more recent study is available,11 it provides less detail on the causes of fatalities and
which crew groups were affected (see Appendix 1).

Hence, introduction of ammonia as a shipping fuel without implementation of

appropriate controls would increase the level of hazard in an already hazardous
environment, leading to two fundamental questions:

À What are the risks to crew in using ammonia as a shipping fuel?

À What safety measures can be implemented to reduce these risks?

The industry must reach a consensus on these questions to develop safety

concepts and enable the use of ammonia as a marine fuel.

7 Ammonia at sea: Studying the potential impact of ammonia as a shipping fuel on marine ecosystems,
Environmental Defense Fund, Lloyd’s Register and Ricardo, 2022.
8 Table 2 -1, Acute Exposure Guideline Levels for Selected Airborne Chemicals: Volume 6. National Research
Council (US) Committee on Acute Exposure Guideline Levels, 2008.
9 Charchalis A and Czyz S (2011). Journal of KONES Powertrain and Transport, Vol. 18, No.2, 49-56.
10 Fatal accidents and injuries among merchant seafarers worldwide; S. E. Roberts, D. Nielsen, A. Kotłowski and B.
Jaremin; Occupational Medicine, 2014.
11 European Maritime Safety Agency (2022). Annual Overview of Marine Casualties and Incidents 2022. Ares (2022)
8241169 – 29/11/2022.
 1. 12

This report summarizes a novel multi-disciplinary project to address the safety

challenges of ammonia fuel. It presents the results of a quantitative risk assessment
study carried out in partnership between the MDH and the MMMCZCS. A
collaborative team of over 15 experts drawn from the participating organizations
contributed to this project over a two-year period.

We begin this report with a brief overview of the methodology used to evaluate
and reduce the risks of using ammonia as a fuel and present the findings of the
study in the context of existing risks and published risk guidelines. We summarize
the key sources of risk to crew and provide practical guidance to reduce this
risk on ammonia-fuelled vessels, including advice on vessel design and layout.
Furthermore, we provide an overview of key human factors considerations that
must be addressed to enable safe use of ammonia as a marine fuel, including
competence and training needs across segments, changes to work practices and
procedures, and knowledge and guidance on occupational health and process
safety hazards.
2.

Quantitative
risk assessment
(QRA) provides
an innovative
approach to
evaluate and
reduce risk in
ship design
 2. 14

2.1 Quantitative risk

assessment can enable
safer design
Before new technologies are introduced, the risks must be fully understood and
reduced to be “as low as reasonably practicable” (ALARP). The shipping industry
typically uses qualitative risk assessment methods, such as hazard identification
(HAZID) studies, as part of the process of assessing and certifying the design of
new ships, onboard systems, and components ahead of any manufacturing. These
risk assessments typically determine risk by estimating 1) how likely an undesired
event is, and 2) how severe the consequences of the event could be. These
estimates are made based on the subjective judgement of experts in the field,
often working in teams through workshops. Risk likelihood and consequences are
typically rated using categories such as low, medium, and high.

Qualitative studies of engineered systems provide useful insights but have known
limitations (although there are other applications, such as human factors, where
a qualitative approach is often preferable). Specifically, in the engineering context,
the subjective nature of qualitative studies can introduce inconsistencies, the lack
of precision can reduce the understanding of risk, they may be too coarse to
show changes in risk level following risk mitigation, and comparison of different
risks is difficult. Together, these factors limit our ability to fully understand risks
using a qualitative approach. This challenge increases further as systems become
more complex, making prediction of outcomes more difficult. When applied
to a ship, qualitative studies cannot define the total risk to the crew and tend to
be quite insensitive to all but the largest design changes. What do we do when
we want to compare the total risk to a vessel’s crew with published criteria or
similar technologies, or when we want to test the effectiveness of different risk
mitigation measures?

Quantitative risk assessment (QRA) is an analytical tool that has been widely used
to assess risk in other industries, including oil and gas and onshore chemicals,12,13
but has seen only limited use in the maritime sector to date. Compared to
qualitative approaches, QRA provides a more objective and granular understanding
of risk, enabling the use of numerical risk criteria and benchmarks. However, QRA
is time-consuming and requires both specialist expertise and a large volume of
input data. In addition, the outputs of QRA can be sensitive to the assumptions
made during the assessment. An overview of QRA methodology is shown in
Figure 1.

12 Spouge, J, A Guide to Quantitative Risk Assessment for Offshore Installations (1999).

13 Center for Chemical Process Safety, Guidelines for Chemical Process Quantitative Risk Analysis. 2nd ed (1999).
 2. 15

When applied to a vessel design before construction, QRA allows us to identify,

assess and reduce risks to the crew, thereby improving safety without the costs of
physical manufacture and testing. QRA provides decision-makers in shipping with
the information required to choose between fuel options and designs. It can also
provide the insights needed to develop rules and guidelines for vessel certification
and to test the effectiveness of proposed mitigations: for example, the International
Maritime Organization (IMO) Formal Safety Assessment (FSA) guidelines for
shipping include a form of QRA.14

Study Definition

Data Gathering

Hazard Identification

Scenario Definition

Analysis

Risk Reduction

Figure 1: Overview of quantitative risk assessment (QRA) methodology.

14 IMO, Revised Guidelines for Formal Safety Assessment (FSA) for Use in the IMO Rule-Making Process. MSC-
MEPC.2/Circ.12/Rev 2 (2018).
 2. 16

2.1.1 Study definition and scope

This project is the first part of an ongoing study of ammonia safety in the maritime
industry. Our objectives were to:

À Provide an estimate of the risk of fatality to crew members working on

board ammonia-fuelled cargo ships

À Determine the acceptability of these risks in relation to established criteria

À Propose measures to reduce the risks where needed

While planning our work, we were aware of other completed and planned safety
studies, several of which focused on ammonia bunkering and the accompanying
risk to third parties.15,16,17,18 However, we identified an absence of similar studies
addressing ammonia fuel and crew safety, which we consider an important area
worthy of detailed attention. Therefore, we decided to focus the scope of our project
on onboard risks to the crew.

Hence, this study covers the ammonia systems on board, starting at the bunkering
manifold. It also addresses fuel storage, preparation, and supply to the main engine,
auxiliary engines, boilers, and other consumers. The study does not cover risk to
shore personnel, personnel on adjacent vessels, or other third parties.

The ammonia systems on the engine, boilers, auxiliary engines, and other
integrated units themselves are not included in the QRA modelling. This is because
the design of these items is still evolving, and final details are not yet available.
However, these items are addressed in a review of HAZID studies and accident
experience described in Appendix 2. In addition, such equipment is subject to a
separate and rigorous approval process.

2.1.2 Preliminary data gathering

Data gathering forms the groundwork for risk assessment. In addition to creating
reference ship designs, this step included definition of fuel and safety systems,
crew distribution, and vessel operating modes.

In this project, we considered three ammonia-fuelled vessel reference designs:

a container ship, tanker, and bulk carrier, each with a different storage system
(fully refrigerated, semi-refrigerated, and fully pressurized, respectively). In fully
refrigerated storage, ammonia is cooled to its boiling point and kept at pressures
close to atmospheric. In fully pressurized storage, ammonia is compressed until it
becomes a liquid at ambient temperature and then kept under these conditions.
Semi-refrigerated refers to a combination of refrigeration and pressurization.

15 DNV (2021). External safety study – bunkering of alternative marine fuel for seagoing vessels. Report No.
10288905-1, Rev. 0; Document No.: 11J5ON0R-1.
16 European Project for Smart Green Ports – MAGPIE. [Link]
17 Global Centre for Maritime Decarbonisation – Ammonia Bunkering Safety Study. [Link]
release-ammonia-bunkering-safety-study-award.
18 Yara Clean Ammonia, Pilbara Ports Authority and Lloyd’s Register – Feasibility Studies into Using Ammonia to
Refuel Ships. [Link]
pilbara-potential-for-ammonia-as-a-clean-shipping-fuel/.
 2. 17

Figure 2: Simplified schematic of container ship reference design FPR (fuel preparation room)
(fully refrigerated). Fuel storage tank

Figure 3: Simplified schematic of tanker reference design FPR (fuel preparation room)
Fuel storage tank
(semi-refrigerated).

Figure 4: Simplified schematic of bulk carrier reference design FPR (fuel preparation room)
Fuel storage tank
(fully pressurized).

2.1.3 Hazard identification

Given the scope of our project on the safety of ammonia as a marine fuel, we
considered the following specific hazard events in our analysis:

À Fuel system leaks leading to toxic exposure, fire, or explosion (in the case
of ammonia)

À Fires (in the case of low-sulphur fuel oil (LSFO) and marine gas oil (MGO))
 2. 18

2.1.4 Analysis

Leaks arise from fuel system components such as pipes, filters, pumps, valves, and
flanges. We used data on leak rates for these components from other industries19,20
to estimate the likelihood of ammonia leaks for each ship design. Consequence
analysis was mainly carried out using DNV Process Hazard Analysis Software
Tool (PHAST), an industry-standard process hazard software. Recognizing that
PHAST has limitations when modelling leaks in enclosed spaces, this analysis
was supplemented by computerized fluid dynamics (CFD) studies of leaks in a
vessel engine room conducted by ABS. An example of the CFD output is shown in
Figure 5.

Magenta: 75,000 ppm (50% LEL)

Red: 15,000 ppm (10% LEL)
Yellow: 1000 ppm
Green: 160 ppm
Gray: 30 ppm.

Figure 5: CFD simulation of 0.23 kg/second leak of ammonia for 300 seconds into an
engine room ventilated at 30 air changes per hour, against the ventilation air flow.

Collision with another vessel was identified as a potential cause of an ammonia

leak, particularly when the fuel tank is below the deck, as with the container
ship reference design in Figure 2. Therefore, ABS also conducted finite element
computer simulations of the reference container ship being struck by a much larger
19,000-TEU vessel, finding that leaks due to collisions between these two vessels
in open water would be extremely unlikely. Further details of both the CFD and finite
element analyses are included in Appendix 2.

19 International Association of Oil & Gas Producers (2019). Risk Assessment Data Directory – Process Release
Frequencies. Report 434-01 September 2019.
20 Health & Safety Executive (2017). Failure Rate and Event Data for use within Risk Assessments. Planning Case
Assessment Guide Chapter 6K.
 2. 19

A QRA model developed by LR was subsequently used to combine likelihood

and consequence results into a calculation of risk. The main numerical risk output
discussed in this report is individual risk per annum (IRPA). This is the risk of fatality
per year for an individual with defined characteristics. In our case, the individual is
a member of a specified crew group. The IRPA figures were calculated for each
of the different crew groups on a vessel (bridge team, deck officers, deck ratings,
support crew, engineering officers, engineering ratings, and cadets).

2.1.5 Risk reduction

We then conducted an iterative QRA process, which can be summarized as follows:

À Using the QRA results, scrutinize the breakdown in risk to determine the
main contributors

À Propose design or operational modifications that aim to reduce the risk,

targeting these contributors

À Implement the proposed mitigations in the QRA model

À Re-run the model and observe the change in results

This process was repeated multiple times during the project. In total, the model
was run in excess of 50 times across the three reference designs. In addition,
over 20 runs were performed to test the model’s sensitivity to different inputs
and assumptions.

The principles used in the application of risk criteria and ALARP are explained
further in Appendix 1. The risk criteria framework and target set for the project
are illustrated in Figure 6. The overall risk criteria framework is that published by
the UK Health & Safety Executive21 and referenced by the International Maritime
Organization (IMO). The risk target for the project (purple dashed line in Figure 6)
was based on a published guideline from the IMO.22

21 HSE (2001), Reducing Risks, Protecting People – HSE’s decision-making process. C100.
22 IMO (2018), Revised Guidelines for Formal Safety Assessment (FSA) for Use in the IMO Rule-Making Process.
MSC-MEPC.2/Circ.12/Rev 2, Appendix 5.
 2. 20

Unacceptable Region

1 in 1,000 risk of fatality

IRPA (risk of fatality per year)

per year total risk

PROJECT TARGET
1 in 10,000 risk of
fatality per year
Risks are tolerable if ALARP
target for fuel risk

1 in 1,000,000 risk of
fatality per year total risk

Acceptable Region

Figure 6: IRPA criteria framework and project target.

A fuller description of the QRA process for this study was presented at the Royal
Institute of Naval Architects (RINA) conference ‘Scaling Decarbonisation Solutions –
Reducing Emissions 2030’ in November 2022.23

Overall, we applied a variety of methods to investigate various aspects of ammonia

safety. The results of some analyses, including modelling of vessel impact and gas
dispersion scenarios, were used to improve or complement the main QRA. These
additional studies are described in greater detail in Appendix 2, and we expect that
some will be the subject of separate detailed publications in due course.

23 Quantitative Risk Assessment of Ammonia Fuelled Vessels, AP Franks, C Graugaard, RINA Scaling
Decarbonisation Solutions: Reducing Emissions by 2030, 2022.
 2. 21

2.2 Crew risk can be

substantially reduced
through stepwise mitigation
2.2.1 Successive application of targeted measures can
drive down risk to crew

One of the most powerful uses of QRA is to test the effectiveness of proposed risk
mitigations in driving risk downwards. In this project, we applied an iterative QRA
process as described in the previous section to explore the best approaches to
reduce risk to the crew on board ammonia-powered vessels.

This section summarizes key QRA results and illustrates how the analysis has
been used to reduce risk. The results presented here are those for the engineering
ratings, as this crew group was consistently found to have the highest IRPA
from ammonia.

Appendix 1 provides a detailed description of the IRPA criteria and target value
adopted for the study. For the purposes of this section, it is sufficient to note that an
IRPA of 1 in 10,000 risk of fatality per year (represented by the purple dashed line)
was set for the project target for crew IRPA from fuel hazards.

The graphs below show a series of columns. In each case, the first column
(working from left to right) shows the initial QRA result for ammonia as a fuel
(together with the pilot fuel), which we term the ammonia base case. The remaining
columns show the change in risk following the application of risk mitigation
measures and other design changes (orange), followed by the final total IRPA value
from ammonia as fuel after application of these changes (blue right-most column).
 2. 22

Container ship/fully refrigerated storage

2.5
IRPA (risk of fatality N in 10,000 per year)

2.0
2

1.5

-0.8
1
0.7
-0.5
0.5

0
Ammonia Base Ammonia RR1 Ammonia RR2 Total IRPA from fuel

Target IRPA from fuel

Key

Label Description Comment

Ammonia Base First iteration of QRA results for
this design.
Ammonia RR1 Risk Reduction 1: Single fuel preparation 40% reduction in ammonia
room (FPR) divided into three risk relative to base case
separate spaces.
Ammonia RR2 Risk Reduction 2: Increasing ventilation Further 25% reduction in
rates in FPRs and re-liquefaction room ammonia risk relative to base
from 30 to 45 air changes per hour, case
together with modifications to the fuel
system design.

Figure 7: Changes in total IRPA for engineering ratings on a container ship with fully
refrigerated ammonia fuel storage.
 2. 23

Semi-Refrigerated Storage / Tanker

3.5
IRPA (risk of fatality N in 10,000 per year)

3.1
3

2.5

1.5
-1.7
-0.1
-0.1 0.9
1
-0.3
0.5

0
Ammonia Ammonia Ammonia Ammonia Ammonia Total IRPA
Base RR1 RR2 RR3 RR4 from fuel

Target IRPA from fuel

Key

Label Description Comment

Ammonia Base First iteration of QRA results for
this design.
Ammonia RR1 Risk Reduction 1: Single fuel preparation 56% reduction in ammonia
room (FPR) divided into three risk relative to base case
separate spaces.
Ammonia RR2 Risk Reduction 2: Increasing ventilation Further 5% reduction in
rates in FPRs and re-liquefaction room ammonia risk relative to base
from 30 to 45 air changes per hour, case
together with modifications to the fuel
system design.
Ammonia RR3 Risk Reduction 3: Shut-off of the Further 3% reduction in
ventilation in the accommodation (as ammonia risk relative to base
opposed to switching to recycle) upon case
gas detection in the ventilation intake.
Ammonia RR4 Risk Reduction 4: Further subdivision of Further 9% reduction in
the FPR to provide a separate room for ammonia risk relative to base
duplex filters. case

Figure 8: Changes in total IRPA for engineering ratings on a tanker with semi-refrigerated
ammonia fuel storage.
 2. 24

Pressurized Storage / Bulk Carrier

3
IRPA (risk of fatality N in 10,000 per year)

2.6
2.5

2
-0.7

1.5

1
-0.8
0.7
-0.4
0.5

0
Ammonia Base Ammonia RR1 Ammonia RR2 Ammonia RR3 Total IRPA from
fuel

Target IRPA from fuel

Key

Label Description Comment

Ammonia Base First iteration of QRA results for this
design (fully pressurized storage).
Ammonia RR1 Risk Reduction 1: Switch to semi- 26% reduction in ammonia
refrigerated storage and extensive risk relative to base case
redesign of fuel system.
Ammonia RR2 Risk Reduction 2: Addition of a Further 29% reduction in
scrubber on the ventilation intake to the ammonia risk relative to base
accommodation, which operates on gas case
detection in the ventilation intake.
Ammonia RR3 Risk Reduction 3: Further refinement of Further 17% reduction in
fuel system design (changes in fuel flow ammonia risk relative to base
rates and pipe diameters). case

Note: In the case of the bulk carrier, a sub-divided FPR was implemented at the outset.

Figure 9: Changes in total IRPA for engineering ratings on a bulk carrier with fully
pressurized and semi-refrigerated ammonia fuel storage.

Conclusion: risks from fuel

The project IRPA target for fuel hazards was achieved for all three vessel designs.
 2. 25

2.2.2 Risks can be kept within tolerable limits

As well as showing that the project IRPA target for fuel hazards is met, it is also
necessary to verify that the total IRPA from all hazards is below the ‘Unacceptable’
boundary (as shown in Figure 6).

For all vessels and fuel system designs assessed, the introduction of ammonia as
fuel increases the total risk to the crew. However, the application of risk mitigation
measures can minimize this increase and keep the total risk within tolerable limits.
Figure 10 shows the total IRPA for engineering ratings following the application of
risk mitigation measures for each of the three vessel types. This total IRPA is broken
down into contributions from fuel (ammonia and pilot fuel) and other hazards.
Appendix 1 covers our definition of tolerable risk limits and how they are applied in
the current study.

Unacceptable Region
10
IRPA (risk of fatality N in 10,000 per year)

 Other hazards  Fuel hazards

9

0
Containership Tanker Bulk carrier

Figure 10: Comparison of total IRPA on board ammonia-fuelled reference vessels with
risk criteria.

There were some risk mitigation measures (such as the separate duplex filter
room modelled for the tanker) which could, in principle, be applied to the other
vessel designs also. However, time did not allow all of the possible combinations of
measures to be studied for all three designs.

In addition, innovative risk reduction measures outside the scope of the current
study could reduce the safety risk still further. For example, our results showed
that the amount of time spent in rooms where ammonia equipment is present,
such as the fuel preparation room (FPR), has a significant effect on the IRPA of the
engineering team. Therefore, using remote monitoring or automated technology to
reduce the need for crew to enter these spaces would have a major safety benefit.
This is an example of an area that we may investigate in future projects.
 2. 26

2.3 New vessel designs

and additional equipment
are needed
2.3.1 User-centred design will be a key principle

Moving from fuel oil only to dual-fuel engines using both ammonia and fuel oil
will require not only new equipment and systems, but also new procedures,
work processes, and maintenance regimes. Application of specific user-centred
ergonomic design would benefit the operability and maintainability of new
ammonia-related systems, equipment, components, and spaces. These include
specific critical work areas such as the engine control room (to accommodate
novel technology) and the ease with which crew can perform maintenance and
access certain areas such as the FPR. The application of human factors design
criteria and principles could reduce potential crew exposure to ammonia through
ensuring usability, efficiency, and safety. Human factors considerations are
discussed in greater detail in the next section of this report.

2.3.2 Lower storage temperature reduces the safety risk

from ammonia fuel

The safety impacts of an ammonia leak differ depending on the ammonia’s storage
pressure and temperature. When stored in a non-pressurized condition at -33°C, a
leak of ammonia will form a pool that will evaporate as it heats up. This evaporation
is relatively slow compared to a pressurized and warm condition, where the leaked
ammonia evaporates immediately when the pressure is released. This means that
the ammonia from a leak in warm and pressurized containment enters the gas
cloud more rapidly, leading to a bigger cloud.

This principle is illustrated in Figure 11, which shows the IRPA from ammonia for
engineering ratings for each of the vessel designs. In this case, the FPR is sub-
divided but no additional mitigation measures have been implemented (although
further risk reduction efforts subsequently brought all three designs to very similar
IRPA values). Direct comparison between the vessels is difficult due to other
differences in design, but storage of ammonia as a fully refrigerated liquid has
the lowest IRPA, followed by the semi-refrigerated options, with fully pressurized
liquified gas being the riskiest storage type. In particular, the change from fully
pressurized to semi-refrigerated storage on the bulk carrier (where other aspects of
the design are similar) resulted in a 26% reduction in IRPA.
 2. 27

Unacceptable Region
IRPA (risk of fatality N in 10,000 per year) 10

0
Fully refrigerated Semi-refrigerated Semi-refrigerated Pressurised (Bulker)
(Container) (Tanker) (Bulker)

Figure 11: IRPA from ammonia for engineering ratings by type of fuel storage.

Therefore, from a safety perspective, we recommend that ammonia fuel should be

stored at as low a temperature as possible. The higher the storage temperature, the
more mitigation measures need to be implemented to bring the safety risk from
ammonia leaks to a tolerable level.

2.3.3 Secondary containment is an important

risk mitigator

Use of secondary containment for pipes outside controlled spaces

reduces risk

IRPA is significantly reduced when a secondary barrier is applied around pipes that
contain ammonia. For example, double-walled pipe is a pipe within a pipe, which
provides a second containment barrier. The space between the pipes can be
purged with another gas such as nitrogen or dry air and can be monitored for leaks
from the inner pipe.

The risk levels for the reference vessels reported in our study assume that all
pipes are double-walled, except for those at the bunker station, pipes on open
deck, and pipes in the FPR and tank connection space. Piping without secondary
containment (but with impact protection) is currently permitted on open deck under
the International Code of Safety for Ships using Gases or other Low-flashpoint Fuels
(IGF Code) for LNG.24

24 IGF Code – International Code of Safety for Ships Using Gases or Other Low-Flashpoint Fuels – Part A-1 – Specific
requirements for Ships using Natural Gas as Fuel – Section 5.3 – Regulations – General.
 2. 28

As the FPR and tank connection space are separated from other machinery
spaces, the structure around these spaces is considered a secondary barrier.
Access to these areas must therefore be restricted and controlled.

The value of double-walled piping in reducing risk is illustrated by a sensitivity

study in which we modelled liquid ammonia pipe in the container ship engine room
as single-walled instead of double-walled. In this study, the IRPA for engineering
ratings from ammonia was more than four times higher when using single-walled
pipe compared to double-walled, as illustrated in Figure 12.

2.5
Unacceptable Region
10
IRPA (risk of fatality N in 10,000 per year)

2
9
-77%
8
1.5
7

6 1

5
0.5
4

3
0
2
No DWP on liquid pipes

With DWP on liquid pipes

1

0
No DWP on liquid pipes With DWP on liquid pipes

Figure 12: IRPA from ammonia for engineering ratings with and without double-walled pipe
(DWP) on liquid lines in the container ship engine room. Left: IRPA results shown in relation to
unacceptable region; right: magnified view to show scale of change in IRPA.

Risk can be reduced by gas-tight enclosures around gas valve units in

engine rooms

Another effective risk mitigation measure can be to install ventilated, gas-tight

enclosures around gas valve units (GVUs) on the inlets to gas-fuelled auxiliary
engines and on valves and instruments on the inlets to other gas-fed equipment,
such as supply to boilers or selective catalytic reduction (SCR) units.

We investigated this measure using another sensitivity study that compared

the IRPA from ammonia for the engineering ratings with and without secondary
containment on the GVUs in the tanker engine room. With secondary containment,
the IRPA from ammonia for the engineering ratings is 8% lower, as illustrated in
Figure 13.
 2. 29

1
Unacceptable Region
10 -8% 0.9
IRPA (risk of fatality N in 10,000 per year)
0.8
9
0.7
8
0.6
7
0.5

6 0.4

5 0.3

0.2
4
0.1
3
0
2

No secondary containment

With secondary containment

1

0
No secondary containment With secondary containment

Figure 13: IRPA from ammonia for engineering ratings with and without secondary
containment on GVUs in the tanker engine room. Left: IRPA results shown in relation to
unacceptable region; right: magnified view to show scale of change in IRPA.

2.3.4 Control of ventilation is a key risk mitigator

Ventilation is important in spaces where ammonia equipment is located

A high ventilation rate of 45 air changes per hour can help reduce the concentration
of ammonia in a given space in the event of a leak.25 We have found that:

À Ventilation is only partly effective at preventing ammonia concentrations

from reaching levels that may be fatally toxic. Even at short exposure
times, the concentration threshold for ammonia toxicity is much lower than
the threshold for flammability. This means that, in addition to ventilation,
other precautions will need to be considered for personnel entering
these spaces.

À Ventilation is more effective at preventing ammonia concentrations from

reaching a flammable level. Although the flammability of ammonia should
not be ignored, it is considerably less flammable than other fuels such as
natural gas or hydrogen.

À Room size also has an effect on IRPA, with larger rooms being better than
smaller rooms since the ammonia concentration in case of a leak will be
more diluted. However, the room size must be substantially increased for
this effect to be noticeable.

25 [Link]
fuelled-vessels/[Link], ABS class requirements 2022.
 2. 30

Consider measures to limit ventilation in the accommodation

Most time on board is spent in the crew accommodation, and this space should
be protected from ammonia ingress as far as possible. In the event of an ammonia
leak on deck (e.g., during bunkering), one option is that detection of ammonia close
to the leak source or in the ventilation intake triggers both an auto-stop function
for all accommodation fans and an auto-shut concept for all accommodation air
inlet dampers.

Alternative or additional measures could include the use of scrubber systems or

chemical filters on the ventilation intakes, although such technology would need to
be proven fit for maritime application. Scrubbers work by bringing the contaminated
air in contact with a substance (usually in liquid form) that dissolves or reacts with
the ammonia, removing it from the air. Including a measure of this type reduced the
IRPA from ammonia for the engineering ratings by 29% in our QRA, as shown in
Figure 9 (RR2).

We further recommend establishing an emergency response procedure in case

of ammonia detection at the accommodation’s air inlet. The procedure should
consider how long the crew can remain ‘shut in’ in the accommodation, bearing in
mind crew numbers, oxygen and humidity levels, and the potential for ammonia
ingress, albeit at a much lower rate than under normal ventilation conditions.
It may also be necessary to consider how the crew can safely evacuate the
accommodation while ammonia is still present outside (e.g., if the gas-tightness of
the accommodation is impaired). This is likely to require the provision of suitable
PPE, including respiratory protection. Enhancements to work practices and
procedures are further outlined within our human factors study.

2.3.5 Focused attention should be paid to key spaces

Limit the number of leak sources in a single space

When a crew member enters a space, they are exposed to any of the ammonia
leak sources in that space. This means that the amount of ammonia-containing
equipment in a given space affects the IRPA for individuals who spend time in that
space. The IRPA can therefore be reduced by dividing this equipment between
two or three spaces, so that a crew member entering one of these spaces is only
exposed to the equipment in that space rather than to all the equipment at once.

Our approach in this project was to split fuel preparation equipment and re-
liquefaction equipment (where present) across up to three separate, albeit smaller,
spaces. One space contains the fuel supply system for the main engine, another
space the fuel supply system for the auxiliary engines and auxiliary boiler, and a
third room the re-liquefaction units. The effectiveness of this measure can be seen
in Figures 7 and 8, where this measure reduced the IRPA from ammonia to the
engineering ratings by 40% and 56%, respectively. This benefit far outweighs any
risk increase from reducing the volume of the rooms.
 2. 31

Minimize entry to the extent practicable and control access to

restricted spaces

A crew member’s IRPA is strongly dependent on their time spent in spaces

containing ammonia equipment, especially when secondary containment
measures are not applied to the equipment. Such locations – such as the
FPR(s), re-liquefaction room, and tank connection space (TCS) – should be
treated as restricted areas. Minimizing, monitoring, and controlling access to and
length of time spent in these areas should be considered. We also recommend
consideration of the following specific safety measures for these restricted areas:

À Requiring individuals entering these areas to wear appropriate personal

protective equipment (PPE) and carry personal gas detectors

À Managing entry to the restricted space as part of the onboard control of

safe work practices

À Registering the presence of personnel in the room, who it is, and when the
room is left unattended again every time a restricted space is entered

À Giving a clear visual and audible warning at the room entrance on

detection of ammonia in the restricted space, stating that ammonia is
present above the acceptable threshold

Our study has assumed that maintenance of ammonia-containing equipment will

be subject to strict procedural control and, wherever possible, will be performed
when the equipment has been purged of ammonia and isolated. However, it may
still be necessary to enter rooms containing ammonia equipment for short periods
(around 8-9 minutes per day on average) when equipment is ‘live’, in order to
conduct inspections. This time was determined by careful consideration of what
would be required by experts in the team with operational experience on chemical
tankers and gas carriers.

We conducted a sensitivity study that demonstrates the importance of controlling

the time spent in these restricted spaces. The study considered the effect of
increasing the time spent in these spaces on a container ship by 50%, from 8
minutes to 12 minutes per day. As Figure 14 indicates, this results in a 25% increase
in IRPA from ammonia for the engineering ratings. Therefore, any additional control
measures that reduce the need for personnel to physically enter these spaces for
routine inspections, such as remote monitoring or CCTV, would help to reduce risk.
 2. 32

1
Unacceptable Region
IRPA (risk of fatality N in 10,000 per year) 10 0.9

0.8
9 +25%
0.7
8
0.6
7
0.5

6 0.4

5 0.3

0.2
4
0.1
3
0
2

8 minutes per
space per day

12 minutes per
space per day
1

0
8 minutes per space per day 12 minutes per space per day

Figure 14: Change in IRPA from ammonia for engineering ratings by time spent in high-risk
spaces. Left: IRPA results shown in relation to unacceptable region; right: magnified view to
show scale of change in IRPA.

Additionally, it is important to ensure that leaks in one space cannot find a path
to other areas. Integrity of high-risk spaces needs to be maintained: for example,
doors should be self-closing and seals should be inspected regularly as per
maintenance regime and replaced as necessary.

During bunkering, bunker stations are also potentially hazardous locations –

therefore, crew presence should be avoided or minimized during this process. For
our reference vessel designs, we have proposed a semi-enclosed, ventilated design
for the bunker station, with the open side towards the bunker vessel and protected
with a water curtain. This should allow mitigation of small leaks. However, we are
not aware of any experimental work that demonstrates the effectiveness of such
a system.

A water curtain system can provide effective mitigation, provided that it is

well-designed and correctly installed and maintained. However, the system’s
effectiveness depends on several factors, including the weather conditions and the
size of the leak.26 As with any active protection system, there is also the possibility
that it may not work when required. Therefore, a water curtain should not be
regarded as an impenetrable barrier.

26 Mukherjee S et al (2017). Effectiveness of Water Sprays in Mitigating Toxic Releases. Process Safety Progress
37(2), 256-262.
 2. 33

Additional alarm mechanisms will be required

Ammonia leak alarms with visual indications should be present not only in control
locations (engine control room (ECR), deck office, and bridge) but also local to
potential leak sources. It should not be possible to enter a space where ammonia
gas could be present and be unaware of whether ammonia is present in that space.

Audible toxicity alarms should be distinct from other alarms on board and should
give warning to all personnel on board – including any who are not members of the
vessel’s crew, such as stevedores.

Detection of gas leaks may require a combination of sensors

Depending on their arrangement and location, a combination of gas detectors,

temperature sensors, and liquid detection may be used to detect ammonia leaks.
The location and number of gas detectors used in a given space should take into
account the size of the room, the pattern of air flow around the room, and the likely
behaviour of the leaked ammonia.

Gas detection is most challenging in a large space, such as an engine room. Our
CFD study (Appendix 2) showed that dispersion of leaked ammonia is highly
dependent on the direction of the leak flow compared to the ventilation flow.
Furthermore, a high ventilation rate may divert the flow of a gas leak away from a
gas sensor, and the high airflow may dilute the gas to a level where a leak is not
detected. Therefore, an array of detectors will be needed and could be of a variety
of types (e.g., concentration, temperature, acoustic) to improve reliability.

The human nose is very sensitive to ammonia, but smell should not be relied upon
as a leak detection method. After a period of exposure to even low concentrations
of ammonia, smell sensitivity decreases, and smaller leaks may not be noticed.
Requirement of personal gas detectors could help address this problem.

Low- and high-level ammonia detection limits need to be specified

Detection of both low and high levels of leaked ammonia should trigger alarms
associated with a specific safety response procedure. Although the ammonia
detection limits proposed by class societies are similar, they are not identical.
An aligned set of values would be beneficial to the industry and would help to
standardize appropriate safety procedures.
 2. 34

2.3.6 Rapid and reliable shutdown in the event of a leak

is required

The volume of leaked gas depends on the volume of the leaking system, the time
taken to detect the leak, and the time until the leak is stopped. Rapid detection
combined with fast shutdown of the leaking section is key. Larger systems should
be sectionalized to enable sectional shut-off and to limit the volume released in the
event of leakage.

Shutdown should be automatic where possible

To achieve rapid and reliable shutdown, shutdown should also be automated where
feasible. However, the option to shut down manually is still required. Voting systems,
such as ‘two out of three’ voting on the output of a set of gas detectors, can help
reduce the number of spurious shutdowns.

2.3.7 Care is needed in the design and positioning of

ventilation exhausts

Forced ventilation of a space containing ammonia equipment, such as the FPR,

carries any leaking ammonia in that space out through the ventilation exhaust. For
the largest leaks, this process could generate potentially lethal toxic concentrations
of ammonia at deck level unless the exhaust is positioned with care. We carried
out gas dispersion modelling using PHAST to study this effect. We found that,
depending on the weather conditions, such concentrations can be experienced
tens of meters downwind of the space containing the ammonia leak. While leaks
of this scale are comparatively unlikely, the risk still needs to be mitigated. If spaces
containing ammonia equipment are located at deck level, this mitigation can be
achieved by directing the exhaust vertically upwards through the roof of the space
and up a vent pipe, so that the toxic cloud is lifted off the deck. Figure 15 gives a
simplified illustration of the toxic cloud from an exhaust on the roof of the tanker
FPR; Figure 16 shows the same scenario, but with the exhaust channelled through
a three-meter vent pipe on top of the FPR.
 2. 35

15

Cloud height (m)

10

2,200 ppm
5 gas contour

FPR
structure

0
0 10 20 30 40 50 60 70 80 90
Distance downwind (m)

Figure 15: Side view of ammonia cloud 2,200ppm contour from a 2kg/second leak into
a FPR on deck ventilated at 45 air changes per hour in low wind (1.5 meters/second)
conditions. Exhaust is directly through the building roof (e.g., via a mushroom vent).

35

30

25
Cloud height (m)

2,200 ppm
20 gas contour

15

10

5
FPR
structure
0
0 10 20 30 40 50 60 70 80 90
Distance downwind (m)
Figure 16: The same case as in Figure 15, but now released via a three-meter stack
(chimney) on the roof of the FPR.
 2. 36

2.4 Summary of quantitative

risk assessment
Through application of iterative QRA and risk mitigation measures, the risks to the
crew from ammonia fuel hazards have been reduced to below the project target.
When hazards from other sources are included, the total risks have been shown
to be well below the ‘unacceptable’ level. The outputs of these analyses have been
used to derive a number of useful insights and recommendations for the design of
ammonia-fuelled vessels.
3. 37

3.

Human factors
considerations
must be
addressed
 3. 38

3.1 Introduction to human

factors analysis and
key findings
As ammonia is a novel fuel for the maritime industry, it is critical to identify and
understand the various ammonia risks associated with human factors. Human
factors is a concept that is commonly applied in the design and management
of work systems across high-hazard sectors such as the maritime, oil and gas,
nuclear, and aviation industries. Human factors is defined as “the scientific
discipline concerned with the understanding of interactions among humans and
other elements of a system, and the profession that applies theory, principles, data,
and methods to design in order to optimize human well-being and overall system
performance.”27

In this section, we supplement the QRA by applying a human factors perspective to

the use of ammonia as a fuel in the shipping industry. In this way, we can help the
industry to identify and implement appropriate operational and design safeguards
to reduce ammonia risk to tolerable levels.

MMMCZCS and LR’s human factors advisory department jointly conducted a

range of human factors workshops as part of this project. Insights and guidance
regarding the principal human factors considerations related to the use of ammonia
as fuel were developed through workshops. The workshops considered the three
project reference designs for container, tanker, and bulk carrier vessels. The
following activities were conducted:

À Early human factors analysis (EHFA): identification of human

factors safety challenges associated with industry preparedness for using
ammonia fuel, used to establish further risk assessment approaches

À Risk reduction workshops: participation in safety workshops to

explore human factors considerations and challenge assumptions of risk
associated with various design risk nodes

À Safety critical task analysis (SCTA): application of a qualitative risk

assessment method method used to assess human error opportunities
contributing to process safety for various scenarios

À Working environment health risk assessment (WEHRA):

assessment of conceptual vessel designs to address the health and safety
of persons for bunkering, maintenance, and fuel preparation activities

À Competency needs analysis: identification of key areas for upskilling

based on a high-level concept of new operations

27 International Ergonomics Association: [Link]

 3. 39

The results of our human factors analysis are summarized in Table 1, which
provides an overview of human factors considerations regarding ammonia fuel
use and rates their impact level as low, medium, or high. Our results highlight the
need for companies and the maritime industry to apply human factors engineering
principles when designing and managing ammonia-fuelled vessels.

As a supplement to the overall human factors considerations shown in Table 1,

we developed an overview of the anticipated human factors impact on a range
of specific operational-phase processes such as bunkering, fuel storage and
transfers, and general maintenance. These are illustrated in Appendix 3.

Table 1: Human factors considerations for ammonia-fuelled vessels.

Stages Description Impact Ammonia-fuelled vessels

are anticipated to impact the
following areas:
Ergonomic Workspace Medium • Deck and bunker stations
design arrangements • Local engine and tank spaces (e.g.,
and human- FPR, TCS)
machine • Systems process command, control,
interface and remote monitoring
Roles and Organizational Low • Changes to organizational structure
responsibilities structure and with new accountabilities
assigned roles • Updated responsibilities related to
risk assessment, safe work practices,
and emergency response
• Contractor interfaces, tasks, and
actions
Competence Technical and High • New technical skills for specific
and training non-technical operations and maintenance
skills, knowledge, • General ammonia risk awareness
understanding across crew
and application • Emergency response
• Increased importance of non-
technical skills
Resourcing Workload Low • Maintaining the structural integrity of
and personnel distribution fuel machinery and spaces through
and number of safe systems of working
personnel • Tasks associated with overseeing
process control
• Preparedness for onboard
emergencies
Process and Documented High • New ammonia-specific policies,
procedures processes and procedures, and processes
work practices • Updates to operational and
maintenance work practices,
procedures, and plans
• Increased requirements for
managing safety risks and
employment of formal safe work
practices
• Review and, where necessary,
change of emergency response
processes
 3. 40

Stages Description Impact Ammonia-fuelled vessels

are anticipated to impact the
following areas:
Occupational Exposure High • Mechanical (energy of components
health hazards to toxicity, of a mechanical system e.g.,
fire, noise, crushing, motion, falling)
musculoskeletal • Thermal
risks, trips and • Materials / substance exposure
falls, etc. (e.g., toxicity)
• Fatigue
Process safety Human High • Changes to and management of
hazards involvement in ammonia system parameters such
the contribution, as those associated with tanks
exacerbation, and the system including level,
and recovery of a temperature, and pressure
major accident • New skills related to ammonia leak
detection, isolation, and repair
• New explosivity and flammability
atmospheric conditions
• Corrosivity potential
• Updates to gas and chemical
management
• New supply and maintenance
precautions with metals and
materials
Management Organizational, Medium • Change management program to
of change operational, address ammonia operations and
and technical risks at company level
changes • Modified approaches to vessel
that must be operations and maintenance
managed to • Increased awareness of when vessel
achieve final management of change processes
ammonia may be required
preparedness • Potential changes to planning and
and the process communications involving entities
of change itself outside the vessel and company

Impact Criteria Description

Low Small changes to seafarer tasks where vessel design/operational practices
addressed through industry practiced guidance and requirements.
Medium Changes to seafarer tasks through additional complexity, time-consuming
nature, and/or increased reliance on human reliability. Vessel design/
operational practices addressed through further application of human
factors principles.
High Significant changes to seafarer tasks through additional complexity, time-
consuming nature, and/or increased reliance on human reliability. Specific
human factors studies required to address implications and involvement of
human actions in accidents.

In the following sections, we provide a synopsis of key human factors

considerations that we expect to have the greatest impact during transition from
conventional to ammonia fuel. These factors relate to the areas of competence
and training, process and procedures, occupational health hazards, and process
safety hazards.
 3. 41

3.2 Many roles will require

new skills and knowledge,
driving a need for upskilling
and training
A safe and just transition to net zero emissions by 2050 must safeguard the shipping
industry’s ability to ensure that the skills and competencies of the future workforce
match what is required to successfully switch to alternative fuels within the designated
timeline. A recent analysis suggests that to align with the Paris 1.5°C emissions
reduction trajectory, an estimated 450,000 seafarers will require essential training or
re- and upskilling by 2030, and 800,000 will require training by the mid-2030s.28

As part of this transition, the novelty of ammonia fuel and associated new systems
and equipment will present new technical and system complexity. New and
modified technical skills will be required for those directly involved in managing the
transfer or handling of ammonia. All personnel will need to be aware of ammonia’s
properties and hazards, and relevant officers will need to increase their knowledge
of relevant regulations and any special requirements, such as those for interfacing
with flag administrations, contractors, and port personnel. There will also be further
need for enhanced non-technical skills for all crew, such as maintaining situational
awareness and recognizing potential hazards that will affect decision-making,
communication, and leadership. These skills are especially important to prepare
crew for potential high-risk operations, including emergencies.

We expect that the impact of competency updates needed for ammonia fuels will
differ based on vessel type and on previous experience with low-flashpoint gases
and with use of computerized systems or automation. Regulations currently require
personnel on tanker vessels to undertake additional training and certification,
and the same is true for crews interfacing with low-flashpoint gases. As a result,
additional training or upskilling will likely be less for gas-tanker personnel, particularly
those who have experience with gas fuel or cargo, compared to crew on bulk or
container vessels. Shoreside company personnel, such as fleet or ship managers,
superintendents, and support functions, will also need to be cognizant of any specific
requirements and changes needed to accommodate ammonia bunkering, carriage,
fuel operations, maintenance, and emergency response support.

The Standards of Training, Certification & Watchkeeping for Seafarers (STCW)

Code will be developed together with the IGF Code to provide enhanced or
additional rules for training. The onus will then be placed upon the operating
companies to establish the competencies necessary and demonstrate that crew
have appropriate training and certification for ammonia fuel use.

We recommend that further training needs analysis should be undertaken for

seafarers across segments to identify key competency requirements for operations
and maintenance. Specific attention should be paid not only to developing the
technical competencies of those personnel who undertake safety-critical tasks (e.g.,
engineering team), but also to the non-technical competencies of all crew members
in sharing and motivating others to communicate hazard-related information.

28 ‘Mapping a Just Transition for the Global Maritime Workforce,’ The Just Transition Task Force (UNGC), 2022.
 3. 42

3.3 There will be

numerous changes to, and
increased reliance upon,
functional work practices
and procedures
Ammonia fuel and its associated systems present numerous changes to work
practices, procedures, and plans. On board ammonia-fuelled vessels, there will be a
more frequent need to use risk management practices such as risk assessments,
permits, confined space, lock-out tag-out, and toolbox talks. Applying these
measures will require operators to review how procedures and work practices are
adhered to and incorporated in competence and training development.

Ammonia fuel and associated systems use will require change and adaptation
across the industry for safe decision-making. The move from engines using fuel
oil to dual-fuel engines using both ammonia and fuel oil results in not just new
equipment and automated systems, but also new procedures, work processes,
and maintenance regimes. The aggregation of these changes will present different
challenges depending on the industry sector’s maturity, experience, and current
methods of working.

Companies operating ammonia-fuelled vessels should implement a change

management program that systematically addresses changes needed throughout
the organization as well as at the ship level. A mature approach to safety practices
incorporating good leadership, communication, learning, crew engagement,
and work practice adherence will be key to successfully maintaining a high level
of safety.

We recommend that further guidance should be produced to assist companies

in determining which operations would benefit from explicit procedures, based on
operational complexity, crew experience, and task frequency. This is particularly
important for procedures that relate to safety-critical operations and maintenance
tasks where reliable human behaviour is a critical control.
 3. 43

3.4 Ammonia-fuelled
vessels will introduce new
occupational health hazards
Providing safeguards for occupational health and safety hazards is a necessity
for any industrial workplace. Ammonia can cause a range of occupational health
effects based on the nature, duration, and level of ammonia exposure; storage
method; and combination with other chemicals.

We have identified a range of occupational health hazards considerations, which

can serve as a basis for further assessment of appropriate safeguards to control
and manage effects from:

À Material and substance hazards e.g., acute and chronic toxicity

À Thermal hazards e.g., hot and cold surfaces, cold stress

À Mechanical hazards e.g., energy of components of a mechanical system,

crushing, motion, falling

Additionally, it is important to anticipate potential side effects of some safeguards

on task performance and timing. For example, donning additional PPE such as
respirators for maintenance tasks may physically encumber the crew.

The introduction of ammonia-fuelled vessels may also change how the vessel
interfaces with other organizations, such as ports, vendors, contractors, and other
ships. Appropriate safeguards must be in place during these interactions to protect
all involved in case of events such as leaks.

We recommend that further guidance on specific PPE requirements be developed

to define recommended PPE and other occupational safeguards for various
expected operating and maintenance scenarios.
 3. 44

3.5 Managing process

safety hazards requires
continued improvement
in standards
Managing high standards of safety will require companies to further develop
their standards of planning, emergency preparedness, and maintenance as
guided by the ISM Code. The sustainable operation of shipping companies relies
fundamentally on how well the operational risks are understood and the degree of
commitment to continuously seeking and implementing appropriate safeguards to
reduce the risk.

Most process hazards related to ammonia fuel revolve around control of storage
and handling pressures and temperatures to prevent loss of containment
and reduce effects of unwanted consequences of any leaks or spills. Such
consequences include accelerated corrosion, displacement of oxygen, fire,
and explosions. Effective and reliable safeguards, including engineering and
administrative controls, must be present in the work environment to prevent or,
if necessary, reduce the potential impact of such consequences. Adoption of
analytical tools will be required for the identification and assessment of ammonia
releases and for evaluation of resulting impacts that may extend beyond the
boundaries of the ship.

Delivering effective and continuous assurance of safety performance requires the

development of a thorough safety management system to document and assign
responsibility for the completion of critical activities relating to planning and control
of work, maintenance of safeguards, and emergency preparedness. To ensure
the competency and preparedness of crew, contractors, and external emergency
agencies, the shipping industry as a whole and individual companies will need
to tailor existing (or develop new) safety and emergency arrangements. These
arrangements should be guided by the IMO’s International Safety Management
(ISM) Code and should address all reasonably foreseeable unwanted events
involving ammonia-fuelled shipping operations, including the necessary steps to
avoid or address negative outcomes.

Risks associated with ammonia storage and handling are well understood and
effectively managed in related industries today. However, we emphasize that the
success of ammonia-fuelled vessel operations will rely on all personnel supporting
ammonia operations, both shipboard and shoreside, having an appropriate
understanding of potential ammonia process hazards and the means to reduce or
eliminate their impacts. In addition, safety management processes and procedures
must outline necessary steps to avoid or address negative outcomes such as
ammonia exposures, releases, leaks, or spills.
4. 45

4.

Conclusion: Use
of appropriate
risk mitigations
can bring the
safety risks
of ammonia
fuel to within
tolerable limits
 4. 46

We conclude that the risks to crew of using

ammonia as an alternative maritime fuel can
be kept within tolerable limits, provided that the
maritime industry can:

À Ensure suitable and sufficient technical barriers and administrative

safeguards are implemented to protect the crew against various
ammonia risks;

À Address human factors considerations, such as those outlined above; and

À Build upon existing maritime industry experience with gas as fuels and
cargo and carry over learnings from other industries with considerable
experience in safely handling, transferring, and storing ammonia.

Our analysis highlighted the importance of several key design and operational
factors that can improve safety on board ammonia-fuelled vessels. These include
the choice of ammonia fuel storage system, secondary containment mechanisms,
ventilation, division of risk of ammonia exposure across multiple areas, tightly
controlling access to and time spent in high-risk spaces, appropriate sensors
and alarms for ammonia leaks, rapid and reliable shutdown of fuel systems, and
positioning of ventilation exhausts.

If we are to reach consensus on the safe implementation of ammonia as an

alternative fuel, the industry will also need further detail on the high-impact human
factors areas identified in this report. Future work towards this goal includes
mapping of competence and training requirements across segments, specification
of necessary changes to work practices and procedures, increasing understanding
of occupational health hazards, and conveyance of process safety hazards
knowledge and guidance. The introduction of ammonia fuel will be accompanied by
various technical innovations including automation, new maintenance regimes, and
modernization of process control. As part of this process, the industry as a whole
and seafarers in particular will encounter challenges that require further attention to
human factors themes.

It is critical that the recommendations identified in this study are further investigated
and developed into tangible guidance and actions for the industry. Detailed
guidance addressing the technical, engineering, and human factors aspects
of these requirements is needed to help the industry move forward with the
implementation of low-carbon fuel alternatives.
Abbreviations 47

Abbreviations
Abbreviation Definition
ABS American Bureau of Shipping
ALARP As Low as Reasonably Practicable
CCTV Closed-Circuit Television
CFD Computerized Fluid Dynamics
CO2 Carbon Dioxide
ECR Engine Control Room
EHFA Early Human Factors Analysis
EMSA European Maritime Safety Agency
EU European Union
FAR Fatal Accident Rate
FPR Fuel Preparation Room
FSA Formal Safety Assessment
GHG Greenhouse Gas
GVU Gas Valve Unit
HAZID Hazard Identification
HSE Health & Safety Executive
IGF (Code) International Code of Safety for Ships Using Gases or Other Low-
Flashpoint Fuels
IMO International Maritime Organization
IRPA Individual Risk per Annum
ISM (Code) International Safety Management Code
LEL Lower Explosive Limit
LNG Liquified Natural Gas
LPG Liquified Petroleum Gas
LR Lloyd’s Register
LSFO Low-Sulphur Fuel Oil
MDH LR Maritime Decarbonisation Hub
MGO Marine Gas Oil
MMMCZCS Mærsk Mc-Kinney Møller Center for Zero Carbon Shipping
N2O Nitrous Oxide
PPE Personal Protective Equipment
QRA Quantitative Risk Assessment
Abbreviations 48

Abbreviation Definition
RINA Royal Institute of Naval Architects
SCR Selective Catalytic Reduction
SCTA Safety Critical Task Analysis
STCW Standards of Training, Certification & Watchkeeping for Seafarers
STS Ship-to-Ship
TCS Tank Connection Space
TEMPSC Totally Enclosed Motor-Propelled Survival Craft
TEU Twenty-foot (container) Equivalent Units
WEHRA Working Environment Health Risk Assessment
 Appendices 49

Appendix 1: Application
of risk criteria and targets
for QRA
Measures of risk

The risk criteria discussed in this report relate to the individual risk of fatality per
annum (or IRPA) for members of a ship’s crew.

In studies of occurrences of fatalities in worker groups, a slightly different risk

metric is used – the Fatal Accident Rate (FAR), which is the number of fatalities per
100,000 worker years.

It is relatively easy to convert FAR numbers to IRPA values and vice versa (e.g.,
a FAR of 14.5 equates to an IRPA of 1.45 in 10,000). To avoid confusion, the
discussion below only uses IRPA – any FAR values have been converted.

The HSE tolerability of risk framework

Perhaps the best known and one of the most widely adopted set of risk criteria are
found in the UK Health and Safety Executive (HSE) tolerability of risk framework.29

The HSE divides levels of risk into three bands or regions:

À A high ‘unacceptable’ region, in which the risks are so high that they are
unacceptable whatever the level of benefits associated with the activity.
Activities producing risks falling into this region must be ruled out or
modified so that the risks fall into one of the lower regions.

À An intermediate ‘tolerable’ region, where the risk is tolerable if the level of

risk has been properly assessed and the results used to determine control
measures. The level of risk remaining after control measures have been
applied (the residual risk) is not regarded as unduly high if the risks are
kept as low as reasonably practicable (ALARP).

À A very low ‘broadly acceptable’ region, where the risks are generally
accepted as insignificant and adequately controlled.

Risk can be regarded as ALARP when the cost (i.e., to use the legal terminology, the
‘sacrifice’ in terms of money, time, or trouble) of any further measure to reduce the
risk would be very high (‘grossly disproportionate’) compared to the risk reduction
benefit that would be gained.

The framework is illustrated in Figure 17.

29 HSE (2001), Reducing Risks, Protecting People – HSE’s decision-making process. C100.
 Appendices 50

Unacceptable Region

1 in 1,000 risk of fatality

IRPA (risk of fatality per year)

per year total risk

Risks are tolerable if ALARP

1 in 1,000,000 risk of
fatality per year total risk

Acceptable Region

Figure 17: HSE tolerability of risk framework.

The HSE has established numerical values for the IRPA values at the boundaries, as
shown in Figure 16. It should be noted, however, that the HSE framework does not
propose boundary values for new facilities or activities.

Risk criteria for seafarers

Relevant IMO guidelines30 present a discussion of risk criteria and cite the UK HSE
framework as an example. The following points are made:

“The lower and upper bound risk acceptance criteria … are provided for illustrative
purposes only. The specific values selected as appropriate should be explicitly
defined in FSA studies.” (Appendix 5, para. 5.1.6)

“It is important to understand that the above risk acceptance criteria always refer to
the total risk to the individual and/or group of persons. Total risk means the sum of
all risks, e.g. that a person on board a ship is exposed to.” (Appendix 5, para 5.3.2)

30 IMO (2018), Revised Guidelines for Formal Safety Assessment (FSA) for Use in the IMO Rule-Making Process.
MSC-MEPC.2/Circ.12/Rev 2, Appendix 5.
 Appendices 51

The document also introduces a target IRPA value of 1 in 10,000 risk of fatality
per year as a “target value for new ships” (Appendix 5, Table 1). A note to the
table states:

“While it is recommended that the maximum tolerable criteria for Individual Risk
as listed should apply to all ships, it is proposed, in accordance with MSC 72/16,
that for comprehensive FSA studies for new ships a more demanding target
is appropriate.”

Figure 18 shows this target value in the context of the HSE tolerability of
risk framework.

Unacceptable Region

1 in 1,000 risk of fatality

IRPA (risk of fatality per year)

per year total risk

1 in 10,000 risk of
fatality per year target
for new vessels

Risks are tolerable if ALARP

1 in 1,000,000 risk of
fatality per year total risk

Acceptable Region

Figure 18: HSE tolerability of risk framework and IMO target value for new ships.

The QRA study presented in this report only looks at one component of the risk
to the crew (risks from ammonia as a fuel). Therefore, in order to compare our
findings with these criteria, it would be necessary to add the risk result produced by
the QRA to the risk from all other hazards to which seafarers are exposed. These
other hazards include potential serious accidents (such as collision, grounding, and
accommodation fires) and occupational hazards (such as falls from height, being
struck by falling or moving objects, or electric shock).
 Appendices 52

Current risks to seafarers

Some values of the risk to which seafarers are currently exposed are available
in recent studies as FARs (which have been converted to IRPA values for the
purposes of this discussion).

One study presents a detailed analysis of fatalities in the British merchant fleet
over the period 2003-2012.31 The paper also collates FAR data from several
countries dating back to 1945. The IRPA for seafarers in British shipping for 2003-
2012 is given as 1.45 in 10,000 risk of fatality per year for all accidents, averaged
over all ranks and all merchant vessel types. This does not include suicides or
deaths by “undetermined intent”. The paper also shows that the risk varies widely
across ranks, being highest amongst deck ratings, with 24 of the 49 recorded
fatalities being in this group. In contrast, four fatalities were experienced amongst
engineering ratings, and the lowest numbers of fatalities were amongst captains
and cadets. An overall downward trend in fatal accident risk was observed when
considering the historical data across several nations.

A European Maritime Safety Agency (EMSA) report presents statistics on marine

casualties and incidents which involved ships flying a flag of one of the European
Union (EU) member states and those which occurred within EU member states’
territorial seas or internal waters.32 The report gives an IRPA for crew for 2019 of
1.04 in 10,000 risk of fatality per year across all ranks and all vessel types (cargo,
passenger, fishing, service, and other). It is not possible to break down this value
by rank or by vessel type from the data presented. This analysis also observed a
decreasing trend in fatality risk over time.

From the information in these sources, it is not possible to determine how much
of the current fatality risk is due to fuel-related accidents. It is also not possible to
determine how the risk varies between newer and older vessels.

The IRPA values for seafarers from these studies are shown in Figure 19, together
with the HSE framework and the IMO target value for new ships. Note the
logarithmic scale on the Y-axis of the graph.

31 Roberts S E et al. (2014), Fatal accidents and injuries among merchant seafarers worldwide. Occupational
Medicine 2014; 64:259-266.
32 European Maritime Safety Agency (2022). Annual Overview of Marine Casualties and Incidents 2022. Ares (2022)
8241169 – 29/11/2022.
 Appendices 53

100

Unacceptable
IRPA (risk of fatality 1 in N per year)
1,000
1 in 1,000 risk of
fatality per year

10,000
1 in 10,000 risk
of fatality per year
target

100,000

1,000,000
1 in 1,000,000 risk of
fatality per year
Broadly acceptable

10,000,000
British fleet, 2003-12 European, 2019

Figure 19: IRPA values for seafarers from two recent studies of fatalities in shipping,
compared to HSE tolerability of risk framework and IMO target value for new ships.

It is clear from Figure 19 that recent real-world values of fatality risk to seafarers
exceed the IMO target value for new ships. This presents an issue when using
the target value in the context of the QRA study. Because the IRPA arising from
ammonia in the QRA would need to be added to the IRPA from other hazards,
the total estimated IRPA for ammonia-fuelled vessels would in all likelihood always
exceed the target for new ships set by the IMO. In fact, to get below the target, an
alternative fuel would have to present a lower risk to the crew than current oil-based
fuels, and/or there would need to be a reduction in the risk to seafarers from the
other hazards to which they are exposed.

Equivalent level of safety

For a new, novel, or alternative design, there is a requirement in the relevant

Codes33 that the ‘safety level’ (i.e., risk) is equivalent to an established design.
It is important to recognize that ‘equivalent’ does not necessarily mean ‘equal’.
Generally, ‘equal’ means things are the same, whereas ‘equivalent’ means things
are similar.

The risk of fatality from fuel oil is accepted; there are risks, but they are not so high
as to be considered unacceptable. In terms of Figure 17, they probably sit in the
‘tolerable if ALARP’ band. For an alternative design using ammonia as fuel, it is a
reasonable requirement that the risk of fatality be equivalent, but not equal, to that
from fuel oil. This is because ammonia is toxic and fuel oil is not, and so ammonia
fuel presents a greater a priori risk than fuel oil. However, the design may be such
that the risk from ammonia is equivalent to that from fuel oil, because they both fall
within the ‘tolerable if ALARP’ band.

33 IGF Code – International Code of Safety for Ships Using Gases or Other Low-Flashpoint Fuels – Part A - General,
Section 2.3.
 Appendices 54

Individual risk of fatality criteria for the project

In view of the discussion above, for the purposes of the project, the following criteria
have been adopted:

The IRPA values specified in the HSE tolerability of risk framework are used to
define the upper (tolerable/unacceptable) and lower (tolerable/broadly acceptable)
boundaries. These are 1 in 1,000 risk of fatality per year and 1 in 1,000,000 risk of
fatality per year, respectively.

A total IRPA (ammonia risk plus risk from other hazards) that exceeds the upper
bound value will be considered unacceptable. The total will be calculated using the
data presented by Roberts et al. Since this reference gives a slightly higher value
than the EMSA report, this is a conservative approach.

A target IRPA value of 1 in 10,000 risk of fatality per year is used for the IRPA from
ammonia to the crew group at highest risk (noting that the average risk across the
whole crew will be lower). Where the IRPA to the crew group at highest risk exceeds
the target, risk mitigation measures will be applied to reduce the value.
 Appendices 55

Appendix 2: Description
and results of additional
studies used to inform or
supplement QRA
This appendix outlines details of specific analyses we conducted to improve or
supplement our central QRA.

Review of HAZID studies and accident experience

We conducted a review of existing hazard identification (HAZID) findings and

marine accident reports to capture additional leak scenarios and consider
implications for the design of ammonia-fuelled vessels. The range of events
covered included fires and explosions (both cargo-related and non-cargo-related),
dropped objects, loss of services, collisions, and groundings. The results were used
to update and extend the QRA model. In addition, vessel collision was investigated
in more detail using finite element analysis.

Vessel impact study

A vessel collision scenario was modelled using finite element analysis, with the
reference ammonia-fuelled container feeder vessel with a Type-A fuel tank in the
hold (see Figure 2) being struck by a larger (19,000-TEU) container vessel. The
collision we modelled was perpendicular to the side of the ammonia-fuelled vessel
and at the location of the ammonia tank. We wanted to determine how much speed
the incoming vessel would need to not only penetrate the outer hull and inner
hull, but also reach the ammonia tank. The location of the tank was determined in
accordance with current requirements for ships using natural gas as fuel, applying
the B/5 rule.34

The results showed that if the reference vessel was moored at quay (‘clamped’), the
colliding vessel needed to be travelling at 0.58 knots in order to penetrate the outer
hull. However, to reach the ammonia tank, the colliding vessel’s speed needed to
increase by 6.5 times to 3.78 knots.

In case of the vessel being struck while at sea, the impact would be reduced due to
hydrodynamic effects. In this situation, the speed of the colliding vessel required to
penetrate the outer hull is 1.2 knots, but the ammonia tank will not be reached even
with speeds up to 25 knots. Therefore, a major leak due to a collision between the
two vessels in open water is considered extremely unlikely.

34 IGF Code – International Code of Safety for Ships Using Gases or Other Low-Flashpoint Fuels – Part A-1 – Specific
Requirements for Ships Using Natural Gas as Fuel, Section 5.
 Appendices 56

Collision scenarios have been included in the QRA. Based on the collisions and
allisions (impacts between a moving ship and a fixed object) we have seen over
the years, it is not unlikely to have a collision at a speed of 4 knots in port. It is,
however, deemed unlikely that the colliding vessel will strike the moored vessel at
right angles, which is the worst case. To fully understand the risk of leakage due to
a collision, further impact studies should be made with varying angles of impact
and draft.

Note that our analysis studied a fuel tank in the vessel’s hold. We consider that a
tank on deck would be less likely to be impacted by a striking ship.

Computerized fluid dynamics (CFD) dispersion study

Initially, the QRA used the results of a simple model to assess the build-up of
ammonia in a room following a leak. However, the simple calculation assumes
that the gas from a leak is evenly dispersed in the room where the leak occurs.
Whilst this is a reasonable assumption for small rooms, there is a concern that
this assumption might give non-conservative results for larger rooms such as an
engine room.

Therefore, we conducted a computerized fluid dynamics (CFD) study of different

leak scenarios in the main engine room of our reference vessels. Examples of the
CFD output are given in Figures 20-22, for the cases where the leak is against,
along, and perpendicular to the air flow in the room.

Magenta: 75,000 ppm (50% LEL)

Red: 15,000 ppm (10% LEL)
Yellow: 1000 ppm
Green: 160 ppm
Gray: 30 ppm.

Figure 20: CFD simulation of 0.23 kg/second leak of ammonia for 300 seconds into an
engine room ventilated at 30 air changes per hour, against the ventilation air flow.
 Appendices 57

Magenta: 75,000 ppm (50% LEL)

Red: 15,000 ppm (10% LEL)
Yellow: 1000 ppm
Green: 160 ppm
Gray: 30 ppm.

Figure 21: CFD simulation of 0.23 kg/second leak of ammonia for 300 second into an
engine room ventilated at 30 air changes per hour, along the ventilation air flow.

Magenta: 75,000 ppm (50% LEL)

Red: 15,000 ppm (10% LEL)
Yellow: 1000 ppm
Green: 160 ppm
Gray: 30 ppm.

Figure 22: CFD simulation of 0.23 kg/second leak of ammonia for 300 seconds into an
engine room ventilated at 30 air changes per hour, perpendicular to the ventilation air flow.
 Appendices 58

The results show that leaked ammonia in a larger engine room is not evenly
dispersed, and that there may be areas within the room where toxic concentrations
are reached or exceeded even for relatively small leaks. The QRA model has been
modified to accommodate this finding. There are also regions where the ammonia
concentrations are quite low (below 30 ppm) so there is a possibility that gas
detectors in such locations would not be activated.

Dispersion from vent masts and ventilation exhausts

We also conducted a dispersion analysis of ammonia releases from vent masts

and from ventilation exhausts of spaces. The objective was to provide inputs to the
design process so as to minimize the toxicity hazard to the crew.
 Appendices 59

Appendix 3 – Human
factors impact on
operational phases
This appendix provides a synopsis of anticipated human factors impacts of
ammonia fuel on various operational and maintenance phases (Table 2). Impact
is measured through criteria such as task novelty, frequency of human interaction,
criticality, and known issues.

Table 2: Anticipated human factors impacts of ammonia fuel on maritime operational and
maintenance stages.

Stages Impact Ammonia-fuelled vessels are anticipated to impact the

following areas:
Port approach Low Minimal additional impact to crew activities when
compared with existing industry practices. There could
be changes to planning and communications with port
authorities, marine pilots, and other organizations.
Mooring Low For standard mooring practices, minimal impact is
expected. For ship-to-ship (STS) mooring associated with
bunkering, there would be changes, especially related to
potential ammonia hazards. This impact would be greatest
for vessel personnel without past STS mooring experience.
Bunkering / High Ammonia bunkering will introduce new hazards,
transfer safeguards, and crew activities, including changes to
interactions with other organizations. For example, the
method for ammonia fuel sampling will differ from that for
conventional fuel. The overall impact of the changes would
be lower for those personnel with LNG / LPG (liquified
petroleum gas), bunkering, or ammonia cargo experience.
Fuel storage Medium There will be a moderate level of new challenges related
to ammonia storage for those with conventional fuel oil
experience. New tasks would relate to monitoring and
control of pressure and temperature as well as tank levels.
System start-up Low The process for system start-up will be largely automated,
with crew initiating the process and overseeing its
performance and safe working. This is not expected
to present a significant change to those with similar
automation experience.
Fuel transfer Medium The transfer of ammonia fuel will be initiated / monitored /
intervened with in the ECR. Although the transfer operation
will differ between vessel types depending upon the fuel
condition and process methods, the activity is projected
to be automatic with control room operatives overseeing
the transfer, as per conventional operations. As with other
automated operations, personnel will need to understand
required actions if automation is lost. New knowledge of
ammonia and its characteristics will be paramount.
Appendices 60

Stages Impact Ammonia-fuelled vessels are anticipated to impact the

following areas:
Steady state Medium The introduction of ammonia fuel is expected to impact
human factors moderately when compared to current
industry practice. The novelty of engine processes, such
as dual fuel use, combined with general exposure to
safe working around ammonia fuel, would impact job /
task characteristics.
System Low As with system start-up, automated system shutdown,
shutdown including automated fuel switchover, would present minor
(automatic) changes to overall operations. The main impact would
be additional monitoring of the automated aspect and
responding to relevant alarms.
System High Manual shutdown could significantly impact the need
shutdown for monitoring and intervention from various personnel.
(manual) ECR personnel would need to control / monitor ammonia
systems along with conventional systems. Personnel may
need to take actions locally and ensure precautions are
taken to safely allow such interventions.
Leak detection, High While personnel on conventional fuel oil vessels already
isolation, and undertake leak detection, this task would become more
repair complex and require additional safeguards due to
ammonia’s toxicity, explosivity, and flammability. Personnel
with LNG / LPG or ammonia cargo experience would
require less upskilling. Understanding of ammonia and its
characteristics will influence all actions related to leaks.
General Medium The introduction of ammonia for fuel use will increase
maintenance the complexity of planning, conducting, and recording
maintenance. New skills will be required for working with
ammonia systems / equipment / components, as well
as the potential for using new tools and maintenance
techniques. Metal and materials incompatibilities will need
to be understood.
Emergency High Emergency response processes and procedures will
response need to be updated to ensure that the novelty of dealing
with occupational and process safety hazards and the
characteristics of ammonia fuel have been addressed.
The complexity and criticality of decision-making under
new circumstances will need to be taken into account. For
example, firefighting regimes may need alteration where
ammonia could be present or if the ammonia systems
could be affected. Changes to spill response would be
required, and activities where outside organizations may
be involved or impacted would have to be rethought
and addressed.
Mustering and High Due to toxicity risks, mustering and abandonment
abandonment procedures would need to be revised to reduce the
potential for exposure of personnel to ammonia. Safe
havens for sheltering and mustering would need to be
engineered to account for potential ammonia impacts.
To this point, the totally enclosed motor-propelled survival
craft (TEMPSC) may need to be changed to a type similar
to that used on chemical tankers.
Appendices 61

Stages Impact Ammonia-fuelled vessels are anticipated to impact the

following areas:
Personnel High Various considerations would need to be addressed
rescue to ensure that personnel could be safely rescued after
exposure to ammonia. This would include a review of
high-risk space limitations (FRP, TCS), the use of PPE,
and suitability of rescue equipment and first aid items.
Personnel participating in this operation would need
understanding of ammonia and its characteristics
and hazards.

Impact Criteria Description

Low Small changes to seafarer tasks where vessel design/operational practices
addressed through industry practiced guidance and requirements.
Medium Changes to seafarer tasks through additional complexity, time-consuming
nature, and/or increased reliance on human reliability. Vessel design/
operational practices addressed through further application of human
factors principles.
High Significant changes to seafarer tasks through additional complexity, time-
consuming nature, and/or increased reliance on human reliability. Specific
human factors studies required to address implications and involvement of
human actions in accidents.
Appendices 62