Ship-To-Ship Liquefied Natural Gas Bunkering Risk Assessment by Integrating Fuzzy Failure Mode and Effect Analysis and the Technique for Order Preference by Similarity to an Ideal Solution

Abstract

An increasing demand can be observed in ship-to-ship (STS) liquefied natural gas (LNG) bunkering operations, and the failures involved may lead to considerable casualties or environmental damage. For this purpose, a comprehensive methodology is proposed in this study to identify and assess these failure modes. In detail, the STS LNG bunkering process is first decomposed to develop a hierarchical structure according to systems-theoretic process analysis (STPA), the results of which serve to identify potential failure modes and their causes. Then, all the failure modes are evaluated by experts in terms of occurrence, severity, and detectability to develop a fuzzy confidential matrix, which is then transferred as an explicit confidential matrix to be weighted and normalized. Finally, the risk levels of these failure modes are analyzed by relative closeness obtained from the technique for order preference by similarity to an ideal solution (TOPSIS). This study determines nine failure modes, all of which are ranked in terms of risk level. “High pressure in vapor return line”, and “High flow rate and leakage of LNG” are determined as the top two failure modes, with risk closeness values of 0.5791 and 0.5728, respectively. “Power failure for emergency valves” is ranked as the last one, with the risk closeness value being 0.5444. Finally, suggestions are proposed according to bunkering operation guidelines to prevent or control these failure modes.

1. Introduction

1.1. Background

The effective mitigation of energy characterized by heavy carbon emissions is a common concern in international communities and individual countries. The utilization of low-carbon, green, and clear energy has become an irreversible trend in the energy domain under the pressure of achieving carbon emission targets and environmental protection [1]. Natural gas is generally regarded as a competitive alternative energy replacing oil in future energy systems [2]. As is known to all, most of the international natural gas trade is completed through ocean-going ships in the form of liquefied natural gas (LNG). Global seaborne LNG has maintained strong demand in recent years. According to statistics published by the United Nations Conference on Trade and Development (UNCTAD), the total dead weight tons (in millions) of global gas carriers in the last five years is presented in Figure 1a; an increasing trend can be easily observed from 2019 to 2023 [3]. Meanwhile, according to Clarksons Research (2023), the orders for LNG carriers reached 46% of the existing global LNG carrier fleet in May 2023 [4]. In addition, LNG is regarded as a competitive alternative fuel in the maritime domain. To satisfy the requirement of the International Maritime Organization (IMO) in terms of carbon emissions and environmental protection [5], different alternative fuels are offered in the maritime domain, excluding LNG: these are methanol [6], liquefied petroleum gas (LPG) [7], and batteries [8]. According to the investigation conducted by UNCTAD (2023), the practical application of alternative fuels in the maritime shipping domain is presented in Figure 1b, which obviously indicates that the dominant alternative fuel is LNG [3]. Furthermore, the largest share in orders of new-building ships fueled by alternative fuels in 2023 is still LNG fuel [4].

The cargo handling associated with LNG carriers is mainly represented by the bunkering or transmission of LNG. Generally, there are three LNG bunkering modes adopted in practical engineering: port-to-ship (PTS), truck-to-ship (TTS), and ship-to-ship (STS) [9]. PTS is usually applicable to the cargo handling of large LNG carriers, while the TTS is suitable for small ports bunkering LNG to ships, especially inland ports. The STS is a kind of flexible mode used to transfer LNG from one ship to another [10], which is adopted in more and more application scenarios, such as bunkering LNG to an LNG-fueled ship, bunkering LNG from a small ship to a larger LNG carrier, and bunkering LNG from a floating liquefied natural gas unit (FLNG) to a shuttle LNG carrier. The above-mentioned scenarios are attributed to normal operations; in the case of emergency situations, the STS mode can also be used to implement the emergency transfer of LNG [11]. Actually, STS LNG bunkering operations are challenging because casualties or significant environmental damage may be caused by the risk events involved in the operational process. The demands for LNG shipping transportation are continuously increasing, which leads to frequent STS LNG bunkering [12]. The flammability of natural gas makes the bunkering operation risky, especially during emergency STS LNG bunkering [13,14]. LNG loading and unloading operations, including STS bunkering, are regarded as having the highest LNG leakage risks according to statistics from the e-MARS database [15]. Therefore, it is necessary to conduct research to assess various risks and propose managerial implications to prevent and control potential failures, which is exactly the purpose of this study.

1.2. Contribution of This Study

To identify the potential failure modes involved in STS LNG bunkering operations, and then propose managerial implications, the STS LNG bunkering operation procedure is first carefully studied with reference to Arnet [16] and Gullberg and Gahnstrom [17]. In addition, the guidelines issued by some communities are also collected in this study, such as IAPH [18], Swedish Marine Technology Forum (SMTF) [19], American Bureau of Shipping (ABS) [20], Korean Register of Shipping (KR) [21], and China Classification Society (CCS) [22]. Then, the operational procedure of STS LNG bunkering is transferred into a hierarchical structure in the present study according to the principle of systems-theoretic process analysis (STPA) to determine all the potential failure modes and their causes. The fuzzy confidential method is applied to evaluate all the identified failure modes in terms of occurrence, severity, and detectability by means of eliciting a group of experts. As a result, a fuzzy confidential structure is developed, which is then transferred into an explicit confidential matrix. Finally, based on the principle of TOPSIS, the explicit confidential matrix is weighted and normalized to calculate the risk levels of different failure modes, based on which managerial implications are subsequently proposed. The innovative contributions of this study are represented as follows.

(1)

A comprehensive methodology integrating fuzzy FMEA and TOPSIS is proposed in this study to conduct a risk assessment in the case of an STS LNG bunkering operation, during which the semi-quantitative expert opinion aggregation and quantitative entropy weight method are integrated to achieve as rational results as possible.

(2)

The potential failure modes involved in STS LNG bunkering operations are identified, and then their risk levels are quantitatively assessed, the results of which may be helpful for failure prevention in practical engineering.

(3)

The results of the risk assessment in this study for STS LNG bunkering operations are analyzed with the safety checklist taken from the STS LNG bunkering operation guidelines. As a result, some managerial implications regarding on-site operations are proposed, which facilitate risk management for simultaneous operations (SIMOPs) during LNG bunkering.

1.3. Organization

The remainder of this paper is organized as follows. The methodology proposed in this study is explained in detail in Section 2. Then, in Section 3, the STS LNG bunkering operational procedure is taken as an example to illustrate the application of the proposed methodology, and the findings and extended discussions are presented in Section 4. Finally, the paper is concluded in Section 5.

2. Literature Review

Risk management and failure prevention are core components of LNG bunkering, especially for the STS mode. As a result, risk analysis for LNG bunkering operations has attracted much attention from both scholars and practitioners recently. Vairo et al. [23] investigated operational perturbations during the LNG bunkering process by integrating dynamic Bayesian network and Markov models; a similar time-varying BN was also applied by Fan et al. [24] to capture dynamic risks involved in simultaneous LNG bunkering operations; and Wu et al. [25] studied the causal relationship of LNG risks by means of a dynamic BN. Fan et al. [26] reviewed and summarized the risk analysis methods for LNG bunkering simultaneous operations, the reliability of which was also emphasized by Uflaz et al. [27], who investigated the operational reliability during the STS LNG bunkering process. Similarly, Vairo et al. [28] proposed a resilience model to improve the reliability of LNG bunkering operations. Obviously, operational risks caused by human-related factors are also the concern of many scholars in maritime risk analysis [29]; similar studies in the field of LNG bunkering include Stokes et al. [30], Wu et al. [25], and Fan et al. [31]. In addition, there are many studies focusing on LNG leakage risk assessment, the determination of safety distances, and boil-off gas (BOG) management for risk assessment regarding LNG bunkering.

(1)

LNG leakage risk assessment. The causes contributing to leakage during LNG bunkering were investigated by Arnet [16] with traditional risk analysis tools, and Gerbec and Aneziris [32] comprehensively analyzed the risks involved in bunkering arms and hoses during LNG bunkering by means of a literature review. Nubli et al. [33] analyzed the consequences of accidental LNG leakage for bunkering ships, and later, this accidental LNG leakage was also investigated in terms of its consequence by Nubli et al. [9] about the cryogenic risk on the hull structure. Zhang et al. [34] conducted a risk assessment for the leakage risk of STS LNG bunkering by fuzzy Bayesian network (FBN). Furthermore, small-diameter leaks were modeled by Lim and Ng [35] using computational fluid dynamics (CFD) simulation, which was also applied by Nguyen et al. [36] to analyze the influence of external factors on the LNG leakage.

(2)

Determination of safety zone. The methods to establish a safety zone during STS LNG bunkering operations have been comprehensively reviewed by Duong et al. [37]. Accidental release during LNG bunkering is the main factor considered to determine the safety zone [38], and according to Jeong et al. [39], the safety exclusion zones for LNG bunkering were also practically influenced by the number of operators on-site; furthermore, Park et al. [40] tried to identify various factors affecting the design of safety zone during LNG bunkering. Park and Paik [41] proposed a methodology to design the safety zone for TTS LNG bunkering operations. Similarly, the safety zone for another LNG bunkering process scenario for a floating LNG-fueled power plant was designed earlier by Park et al. [42]. Jeong et al. [43] took an LNG carrier as an example to discuss the establishment of a safety zone by analyzing potential LNG gas dispersion; for a similar study, the reader can also be referred to Duong et al. [44].

(3)

BOG management. For LNG bunkering operations, the BOG is inevitable due to heat ingress; the BOG generation in the receiving tanks at the beginning of the bunkering operation is mainly due to to heat ingress within the bunkering pipelines [45]. According to Benito [46], the generation of BOG during LNG bunkering is approximately 8–10 times more than that generated during storage. As a result, STS LNG bunkering operations were greatly challenged by effective BOG management according to Lee et al. [47]. Shao et al. [48] found that the BOG generated in the receiving tanks directly increase the pressure, which was greatly induced by the temperature difference between the receiving tank and the bunkering tank; later, Shao et al. [49] proposed a method to suppress BOG by optimizing the bunkering time. Meanwhile, Kim et al. [50] also addressed this issue by proposing an energy storage system on LNG bunkering ships.

According to the abovementioned literature, the previous studies are mainly focused on specific aspects, such as LNG leakage risks, safety zone design, and BOG management, the results of which are beneficial to control some specific risks. However, there are many potential risks or failures involved in the LNG bunkering operation, and in many cases, the risks may be different under different failure modes. Based on the literature review aforementioned, there are few studies focusing on the identification and evaluation of potential failure modes and their risk factors. In addition, it can be observed that LNG leakage is frequently studied, and various risk factors are identified and evaluated by scholars. In fact, most LNG leakage is practically caused by human-related factors, which are paid little attention in the previous studies; the human-related operational risks involved in the LNG bunkering process are addressed in this study. Furthermore, although studies about risk assessment for LNG bunkering operations can be found, these risk assessment works pay little attention to the potential failure mode involved in the bunkering process. This study takes a more comprehensive approach by evaluating the entire STS LNG bunkering process.

Failure mode and effect analysis (FMEA) has recently attracted broad attention in the maritime domain. FMEA analysis is focused on quantifying the risk priorities of different failure modes by considering the occurrence, severity, and detectability of each failure mode [51]. Essentially, FMEA is widely regarded as a qualitative approach; to compensate for its shortcomings in terms of quantitative analysis, some scholars integrate different quantitative tools into FMEA to conduct a maritime risk assessment. For instance, Bayesian networks (BNs) were combined with FMEA by Park et al. [52] and Wan et al. [53] to assess maritime cybersecurity risks and maritime supply chain risks, respectively. Liu et al. [54] embedded an expert trust network into the FMEA framework to investigate the risks involved in the maritime oil spill. In addition, Liu et al. [55] integrated probabilistic double hierarchy linguistic term sets into FMEA to assess maritime risks involved in the development of the marine economy. In the field of LNG bunkering, Kang et al. [56] investigated the accidental LNG leakage in the scenario of offshore transfer and delivery system by CFD method based on the principle of FMEA. Another important improvement of the traditional FMEA method is the use of fuzzy expert systems. Goksu and Arslan [57] proposed a rule-based fuzzy FMEA to study the risks involved in ship berthing/unberthing operations. Similar studies include Ceylan et al. [58] and Ceylan [59]. In addition, the fuzzy FMEA method was applied by Akyuz and Celik [60] and Akyuz [61] to analyze the oil spill risks and the hatch cover failures, respectively. As discussed above, the FMEA successfully identifies the potential failure modes and their causes. However, the shortcomings of FMEA are also obvious [62,63]. The technique for order preference by similarity to an ideal solution (TOPSIS) is considered a rational technology to overcome the shortcomings of FMEA [7], especially for the scenario of being characterized by high uncertainty, such as the application scenario studied in this study (STS LNG bunkering); fuzzy TOPSIS is applicable [64]. In addition, the FMEA-based TOPSIS method has been applied by Bashan et al. [65] in the maritime domain to identify various risk factors involved in the navigation process.

The abovementioned studies have well verified the applicability and superiority of the FMEA method in the maritime domain, and FMEA is characterized by great potential to be extended to LNG bunkering risk assessment. The results of the literature review about risk assessment for LNG bunkering operations show that the existing methods are mainly focused on some typical failure modes, such as LNG leakage and the design of safety zones; few studies have addressed a risk assessment covering all operational processes. In addition, due to the operational data about the STS LNG bunkering being limited, previous studies on LNG bunkering risk assessment have mainly been conducted by means of expert elicitation, which essentially is a subjective approach. In this study, the objective entropy-based weight is also considered to eliminate the objective influence to some extent. Therefore, in the present study, the fuzzy confidential method and TOPSIS are integrated into the traditional FMEA to improve the performance of traditional FMEA, the results of which are aimed at improving the safety management for STS LNG bunkering operations.

3. Principle of the Methodology

3.1. Overview of the Methodology

The comprehensive methodology proposed in this study is presented in Figure 2, which can be generally divided into two parts. The first part is mainly focused on the integration of STPA and FMEA. In detail, the output of STPA is used to model the FMEA; for this purpose, the operational scenario of the STS LNG bunkering process is modeled according to the principle of STPA, the results of which serve as the input of FMEA. For instance, some unsafe control actions may be considered as failure modes in the FMEA. The second part of this methodology is to quantitatively analyze the developed FMEA with the help of fuzzy theory and the TOPSIS method, which is the main body of this study. The fuzzy theory is mainly used to assess the occurrence, severity, and detection of each failure mode in the FMEA because the data volume of the STS LNG bunkering operation is too small to conduct risk assessment. In addition, the TOPSIS method is used in this study to quantify the comprehensive influence of occurrence (O), severity (S), and detectability (D) regarding the failure modes, which is more reasonable than the traditional practice of just multiplying O, S, and D [7,50].

3.2. Fuzzy FMEA Modeling

3.2.1. Failure Mode Analysis of STS LNG Bunkering Operations by STPA

To identify the failure modes, failure causes, and consequences of the STS LNG bunkering operations, STPA is applied to describe qualitatively the operation process, based on which to model the FMEA. The general principle of mapping STPA into FMEA is illustrated in Figure 3.

According to Figure 3, the operational scenario of the STS LNG bunkering process comes first to determine the system boundary and the components involved in the bunkering operation. Then, according to the basic principle of STPA [66,67], the bunkering operation is analyzed qualitatively at the system level and operational level. At the system level, the objective is to identify the potential accidents and major hazards, both of which correspond to the consequences and failure modes, respectively, under the framework of FMEA. When it comes to the operational level, the hierarchical safety control structure is extracted on the basis of the bunkering operation process, which is a critical content of the STPA [68]. To develop the safety control structure, the controllers, controlled bodies, actuators, and sensors are identified to establish a loop—various disruptions from the external environment may affect this loop, such as mechanical failures and human-related factors—which is conducted according to Figure 4.

The unsafe control actions stem from the following four aspects, according to Qiao et al. [67]: safe control actions are absent, some risks may be involved in the control actions, the control actions are provided inappropriately in terms of time or sequence, and the duration of the control actions is improper. The causation analysis for the unsafe control actions is crucial for the safety constraint; these causes may be involved in the abovementioned controllers, actuators, and sensors. The results stemmed from the unsafe control actions and their causes contribute to the failure causes under the framework of FMEA.

3.2.2. Development of Fuzzy Confidence Structure

In this study, a group of maritime experts were employed to give their professional judgment regarding the identified failure modes. For this purpose, fuzzy theory was applied to facilitate the expert elicitation, and presenting the qualitative expression of experts in the form of the corresponding fuzzy numbers was critical to obtaining meaningful information. Based on the methodology proposed by Chen and Hwang [69], five verbal terms were used to conduct expert elicitation, and they are VL (Very low), L (Low), M (Medium), H (High), and VH (Very high) [29]. As a result, the evaluation set containing fuzzy linguistic expressions is presented as

$$H=\left\{H_{11},H_{22},H_{33},H_{44},H_{55}\right\}=\left\{\mathrm{VL},\mathrm{L},\mathrm{M},\mathrm{H},\mathrm{VH}\right\}$$

(1)

However, when it comes to the operational process of LNG bunkering, in many cases, professional maritime experts may not be able to explicit judgment due to their knowledge limitation. Therefore, it is necessary to introduce some linguistic expression between the neighboring verbal terms; for instance, a judgment may be between VL and L, which is represented by $H_{12}$. As a result, another group of fuzzy linguistic variables is also contained in the evaluation set: $H_{12}$, $H_{23}$, $H_{34}$ and $H_{45}$.

The trapezoidal fuzzy number is applied, and the relationships between the explicit fuzzy judgment and trapezoidal fuzzy number are listed in

Table 1. Fuzzy linguistic variables used in this study.

Fuzzy Term	Occurrence	Severity	Detectability	Fuzzy Numbers
$\mathrm{VL}(H_{11}$)	Probability of failure is very low	The failure has no influence on the normal operation	Failure can be found directly	(0,1,1,2)
$\mathrm{L}(H_{22}$)	Probability of failure is low	The failure can be fixed well on-site	Failure can be found after a simple inspection	(1,2,3,4)
$\mathrm{M}(H_{33}$)	Probability of failure is medium	Equipment performance would be affected by the failure	Failure can be found after using portable instruments	(3,4,6,7)
$\mathrm{H}(H_{44}$)	Probability of failure is high	Equipment performance would be affected greatly	It is difficult to find the failure after using portable instruments	(6,7,8,9)
$\mathrm{VH}(H_{55}$)	Probability of failure is very high	Equipment is severely damaged or casualties	Failure cannot be found using portable instruments	(8,9,10,10)

, which is used to collect the professional judgment in terms of Occurrence, Severity, and Detection.

In addition, the abovementioned fuzzy variables of $H_{12}$, $H_{23}$, $H_{34}$ and $H_{45}$ correspond to trapezoidal fuzzy numbers of (0,1,2,3), (2,3,4,5), (4,5,7,8), and (7,8,9,10). In this study, maritime professional experts were employed to evaluate each failure mode involved in the LNG bunkering operation in terms of O, S, and D, and the results are represented by the following fuzzy belief structure,

$$\left\{\left(H_{ij},{\alpha }_{ij}^k(F_n,{\Gamma }_l)\right)\right\},(i,j=1,2,3,4,5;k=1,2,\dots ,K;n=1,2,\dots ,N;l=1,2,3)$$

(2)

where $F_n$ is the $n$th failure mode, ${\Gamma }_l$ denotes the O ($l=1$), S ($l=2$), and D ($l=3$), respectively; ${\alpha }_{ij}^k(F_n,{\Gamma }_l)$ is the confidential given by the $k$th expert with the objective of a fuzzy variable $H_{ij}$. Some cases are given as examples to illustrate the application of the fuzzy belief structure when it comes to expert elicitation.

(1)

If an expert’s judgment is a certain linguistic expression for sure, such as L, then the confidential structure is expressed as $\left\{(H_{22},1.0)\right\}$;

(2)

If an expert’s judgment is uncertain between two adjacent linguistic expressions, such as between VL and L, and the probability of VL is 70%, while the probability of L is 30%, then the confidential structure can be expressed as $\left\{(H_{11},0.7),(H_{22},0.3)\right\}$.

(3)

Another uncommon case is presented as when the expert’s judgment is between two adjacent linguistic expressions without probability, such as the evaluation result being between VL and L; in this case, the confidential structure is expressed as $\left\{(H_{12},1.0)\right\}$.

The evaluation results of the failure mode $F_n$ in terms of ${\Gamma }_l$ from all the maritime professional experts can be summarized and represented by

$$x_n^{\prime }(l)=\left\{\left(H_{ij},{\alpha }_{ij}(F_n,{\Gamma }_l)\right)\right\}$$

(3)

where $x_n^{\prime }(l)$ is the fuzzy comprehensive confidential structure, and ${\alpha }_{ij}(F_n,{\Gamma }_l)$ is the comprehensive confidential of $F_n$ in terms of ${\Gamma }_l$, which is valued by

$${\alpha }_{ij}(F_n,{\Gamma }_l)={\displaystyle \sum _{k=1}^K{\lambda }_k{\alpha }_{ij}^k(F_n,{\Gamma }_l)}$$

(4)

where ${\lambda }_k$ is the weight of the $k$th expert, and the sum of ${\lambda }_k$ is equal to 1.

3.2.3. Determining the Weights of Experts

Expert elicitation is an effective way for the situation of this study where the data about the failure mode of LNG bunkering operation are difficult to be obtained. The competence of the employed experts is critical for the correct results [70], and the selection criteria can be referred to Qiao et al. [29]. Furthermore, to eliminate the potential biases, the expert team is heterogeneous in this study. After selecting the experts, the capacity of these experts is evaluated to obtain their weights. For this purpose, several indicators for professional capacity and the score rating should be established. Then, pairwise comparison matrices are developed on the basis of capacity comparison between two experts in terms of the determined capacity indicators. Finally, the weights for these experts are determined by processing the developed matrices [29], and the calculation process is presented as follows.

(1)

Pairwise comparisons among these experts are conducted in terms of the evaluation indicators, the results of which are presented as pairwise comparison matrices; for instance, the results of pairwise comparisons in terms of the $m$th evaluation indicator can be denoted by $B_m^{\prime }$, which is presented as

$$B_m^{\prime }=\left[\begin{array}{llll}1\hfill & b_{12}\hfill & \dots \hfill & b_{1n}\hfill \\ b_{21}\hfill & 1\hfill & \dots \hfill & b_n\hfill \\ \begin{array}{l}.\\ .\\ .\end{array}\hfill & \begin{array}{l}.\\ .\\ .\end{array}\hfill & \begin{array}{l}.\\ .\\ .\end{array}\hfill & \begin{array}{l}.\\ .\\ .\end{array}\hfill \\ b_{n1}\hfill & b_{n2}\hfill & \dots \hfill & 1\hfill \end{array}\right]$$

(5)

where $b_{ij}$ denotes the comparison result between the $i$th expert and the $j$th expert, expressed by a fuzzy number. Actually, $B_m^{\prime }$ is a symmetrical matrix with diagonal elements being equal to 1.

(2)

The synthetic pairwise comparison matrix for these experts is then established on the basis of pairwise comparison matrices $B_m^{\prime }$, and the results are presented as

$$F^{\prime }={\left[f_{ij}\right]}_{N\times N}$$

(6)

where $N$ denotes the number of experts, and $f_{ij}$ can be obtained by

$$f_{ij}={\left(B_1^{\prime }(ij)\otimes B_2^{\prime }(ij)\otimes \dots B_M^{\prime }(ij)\right)}^{-M}$$

(7)

where $B_m^{\prime }(ij)$ is the element in the pairwise comparison matrices, and $M$ denotes the number of evaluation indicators.

(3)

The geometric mean method is used to obtain fuzzy weights of the indicators for each expert, which are calculated by

$${\omega }_i^{\prime }={\left(f_{i1}\otimes f_{i2}\otimes \dots \otimes f_{iN}\right)}^{-N}$$

(8)

(4)

The fuzzy weight of each expert is defined as follows,

$$w_i^{\prime }={\omega }_i^{\prime }\otimes {\left({\omega }_1^{\prime }\oplus {\omega }_2^{\prime }\oplus \dots \oplus {\omega }_N^{\prime }\right)}^{-1}$$

(9)

where $w_i^{\prime }\left(l{w}_i,m{w}_i,u{w}_i\right)$ denotes the fuzzy weight of the $i$th criterion.

(5)

The weight of the $i$th expert can be obtained using the center of area method, which is expressed as,

$${\lambda }_i=\left(1/3\right)\left[(u{w}_i-l{w}_i)+(m{w}_i-l{w}_i)\right]+l{w}_i$$

(10)

3.3. Defuzzification to Obtain an Explicit Confidential Matrix

The defuzzification is focused on the transmission of a comprehensive fuzzy confidential structure $x_n^{\prime }(l)$ to the explicit confidential structure. For this purpose, the fuzzy linguistic variables $H_{ij}$ is first transferred to the explicit variables, and the methodology proposed by Chen and Klein [71] is applied in this study to transfer a trapezoidal fuzzy number of $(a,b,c,d)$ into an explicit value, which can be obtained by

$$h_{ij}={\displaystyle \frac{{\displaystyle \sum _{p=0}^1(b_p-c)}}{{\displaystyle \sum _{p=0}^1(b_p-c)}-{\displaystyle \sum _{p=0}^1(a_p-d)}}}$$

(11)

where $h_{ij}$ is the explicit value of the fuzzy linguistic expression $H_{ij}$. As with the trapezoidal fuzzy number used in this study, $c$ and $d$ are valued as 0 and 10, respectively. $a_0$ and $b_0$ are the marginal values when the membership function of $H_{ij}$ is valued as 0, while $a_1$ and $b_1$ are the marginal values when the membership function of $H_{ij}$ is valued as 1. The membership function is illustrated in Figure 5.

To illustrate the calculation process, the fuzzy linguistic expression of $H_{55}$ is taken as an example. The trapezoidal fuzzy number for $H_{55}$ is (8,9,10,10) according to Table 1; then, $a_0=8$, $a_1=9$, and $b_0=b_1=10$. As a result,

$$h_{55}={\displaystyle \frac{(b_0-c)+(b_1-c)}{(b_0-c)+(b_1-c)-\left[(a_0-d)+(a_1-d)\right]}}=0.870$$

(12)

Similarly, all the $H_{ij}$ can be transferred to their explicit values of $h_{ij}$, which are summarized as follows.

$${\left(h_{ij}\right)}_{5\times 5}=\left[\begin{array}{lllll}0.130\hfill & 0.295\hfill & 0.394\hfill & 0.459\hfill & 0.500\hfill \\ 0.295\hfill & 0.292\hfill & 0.433\hfill & 0.500\hfill & 0.541\hfill \\ 0.394\hfill & 0.433\hfill & 0.500\hfill & 0.567\hfill & 0.606\hfill \\ 0.459\hfill & 0.500\hfill & 0.567\hfill & 0.708\hfill & 0.741\hfill \\ 0.500\hfill & 0.541\hfill & 0.606\hfill & 0.741\hfill & 0.870\hfill \end{array}\right]$$

(13)

Next, the explicit comprehensive confidential structure can be obtained by

$$x_n(l)={\displaystyle \sum _{i=1}^5{\displaystyle \sum _{j=1}^5{h}_{ij}{\alpha }_{ij}(F_n,{\Gamma }_l)}}={\displaystyle \sum _{i=1}^5{\displaystyle \sum _{j=1}^5{h}_{ij}{\displaystyle \sum _{k=1}^5{\lambda }_k}{\alpha }_{ij}^k(F_n,{\Gamma }_l)}}$$

(14)

Finally, the explicit confidential matrix containing $x_n(l)$ can be established in the form of

$$X=\left[\begin{array}{lll}{x}_1(1)\hfill & x_1(2)\hfill & x_1(3)\hfill \\ x_2(1)\hfill & x_2(2)\hfill & x_2(3)\hfill \\ \begin{array}{l}.\\ .\\ .\end{array}\hfill & \begin{array}{l}.\\ .\\ .\end{array}\hfill & \begin{array}{l}.\\ .\\ .\end{array}\hfill \\ x_N(1)\hfill & x_N(2)\hfill & x_N(3)\hfill \end{array}\right]$$

(15)

3.4. Application of TOPSIS to Rank Failure Modes

3.4.1. Explicit Confidential Matrix to Be Normalized and Weighted

To rank the identified failure modes based on the method introduced in Section 3.2.1 with consideration of O, S, and D using the TOPSIS method, the obtained explicit confidential matrix $X$ is first normalized by means of vector normalization [72], and the normalized explicit confidential matrix is represented by

$$R={\left(r_n(l)\right)}_{N\times 3}$$

(16)

where $r_n(l)$ can be obtained according to $x_n(l)$ by

$$r_n(l)={\displaystyle \frac{x_n(l)}{\sqrt{{\displaystyle \sum _{n=1}^9{\left(x_n(l)\right)}^2}}}}$$

(17)

Then, the normalized explicit confidential matrix is weighted with the consideration of the weights of O, S, and D, and the weighted matrix is expressed as

$$T={\left(t_n(l)\right)}_{N\times 3}$$

(18)

where $t_n(l)$ is the weighted $r_n(l)$,

$$t_n(l)={\kappa }_l\times r_n(l)$$

(19)

where ${\kappa }_l$ denotes the comprehensive weights of O, S, and D. The determination of ${\kappa }_l$ in this study considers the integration of subjective and objective methods: the former is achieved by the expert elicitation, and the latter is presented by the entropy-weight method. The multiplicative synthesis method is employed in this study to integrate the results of subjective and objective calculation, which is calculated by

$${\kappa }_l=f({\delta }_l,{\eta }_l)={\displaystyle \frac{{\delta }_l\times {\eta }_l}{{\displaystyle \sum _{l=1}^3{\delta }_l\times {\eta }_l}}}$$

(20)

where ${\delta }_l$ is the weights obtained by the subjective method, and ${\eta }_l$ is the weights obtained from the objective calculation.

For the expert elicitation to obtain the subjective weights, the linguistic expressions and their corresponding fuzzy numbers are summarized in

Table 2. Linguistic expressions and their fuzzy numbers.

Linguistic Expression	Fuzzy Number
Very important	(0.8,0.9,1,1)
Important	(0.6,0.75,0.75,0.9)
Medium	(0.3,0.5,0.5,0.7)
Less important	(0.1,0.25,0.25,0.4)
Much less important	(0,0,0.1,0.2)

.

The experts’ judgments are collected and then processed by the fuzzy aggregation method [29]; the general principle is presented in Figure 6. The subjective weights by means of expert elicitation can be obtained as the normalized values of $R_A$, which are obtained by

$${\delta }_l={\displaystyle \frac{R_A(l)}{{\displaystyle \sum _{l=1}^3{R}_A(l)}}}$$

(21)

The objective weights in Equation (20) are calculated by the entropy-weight method. Generally, the lower the information entropy determined by the data associated with the influencing factor, the greater the utility value of this information; thus, the weight of this influencing factor is greater. The information entropy of the O, S, and D can be defined as

$$H_l=-\mu {\displaystyle \sum _{n=1}^N\left(f_n(l)\ln (f_n(l))\right)}$$

(22)

where $\mu$ and $f_n(l)$ can be determined by

$$f_n(l)={\displaystyle \frac{r_n(l)}{{\displaystyle \sum _{n=1}^N{r}_n(l)}}}$$

(23)

$$\mu ={\left(\ln (N)\right)}^{-1}$$

(24)

Finally, the entropy-weight can be obtained by

$${\eta }_l={\displaystyle \frac{1-H_l}{3-{\displaystyle \sum _{l=1}^3{H}_l}}}$$

(25)

3.4.2. Calculating Relative Closeness

According to the principle of TOPSIS [73], the positive ideal solution and negative ideal solution are presented as follows on the basis of the normalized and weighted explicit confidential matrix.

$$A^{+}=\left(t_1^{+},t_2^{+},t_3^{+}\right)$$

(26a)

$$A^{-}=\left(t_1^{-},t_2^{-},t_3^{-}\right)$$

(26b)

where $t_l^{+}$ and $t_l^{-}$ ($l=1,2,3$) are determined by

$$t_l^{+}=\max \left\{t_n(l)\right\};t_l^{-}=\min \left\{t_n(l)\right\}$$

(27)

The distance between each failure mode and positive ideal solution/negative ideal solution can be calculated, respectively, by

$$d_n^{+}=‖r_n(l)-A^{+}‖=\sqrt{{\displaystyle \sum _{l=1}^3{\left(r_n(l)-t_l^{+}\right)}^2}}$$

(28a)

$$d_n^{-}=‖r_n(l)-A^{-}‖=\sqrt{{\displaystyle \sum _{l=1}^3{\left(r_n(l)-t_l^{-}\right)}^2}}$$

(28b)

Finally, the relative closeness of each failure mode can be obtained by

$$C_n={\displaystyle \frac{d_n^{-}}{d_n^{+}+d_n^{+}}}$$

(29)

where $C_n$ is the relative closeness of the $n$th failure mode. The higher value of relative closeness, the risk of the failure mode is higher, which should be paid much attention during safety management.

4. Application of the Proposed Methodology

4.1. Modeling the STS LNG Operational Process by STPA

According to the report issued by Gullberg and Gahnstrom [17], the feasible technical solutions for STS LNG bunkering are characterized by flexible transfer hoses with different dimensions and numbers, and the simplified bunkering process is illustrated in Figure 6. It should be noted that some fittings on the pipelines are not included in this figure.

Figure 7b is the conceptual STS LNG bunkering process extracted from the industrial practice, which may be observed in Figure 7a. After all the preparation work, such as various inspections, purging the pipeline, and pre-cooling of the pipelines, the submerged pump in the LNG tanks of the bunker vessel starts to pump the LNG through the flexible hose to the LNG tanks on the receiving vessel. In addition to the main shut-off valves on the output of tank A and input of tank B, there are two emergency shut-down valves (ESDs) fitted close to the flexible hose connection flanges on both the vessels. The ESDs are actuated automatically or manually if leakage is detected, or any deviation from the normal operation. In addition, there is emergency release coupling (ERC) on the flexible hose, which is used to provide a “weak link” in the LNG pipeline. If the relative motions between the receiving vessel and bunker vessel exceed the limits of the flexible hose, then the ERC is actuated to disconnect the LNG pipeline and close both ends of the separated coupling. Practically, the dry disconnect couplings (DDCs) are arranged at the flexible hose connection flanges to prevent any spill from the hose when stowed away on the bunker vessel after bunkering. During the LNG bunkering process, the boil-off gas (BOG) from tank B on the receiving vessel is directed to tank A on the bunkering vessel through the vapor return hose, and ESDs, ERCs, and DDCs are also fitted on the vapor return hose as that of the LNG hose.

According to Figure 7b, before developing the control structure, potential accident types and various hazards at the system level should be determined. In this study, the potential accident types are defined as casualty event (A1), hull damage (A2), and bunkering system damage (A3) with reference to studies about STPA in the maritime industry [67,74], which are regarded as the consequences of various hazards. The identification of potential hazards at the system level in this study is mainly dependent on the literature review, including the relevant studies from Zhu et al. [74], Ahn et al. [75], Sultana et al. [68], and Gerbec and Aneziris [32]. In addition, some STS LNG bunkering guidelines issued by IAPH [18], the Swedish Marine Technology Forum (SMTF) [19], American Bureau of Shipping (ABS) [20], Korean Register of Shipping (KR) [21], and China Classification Society (CCS) [22] are also collected and analyzed in this study to facilitate the identification of various hazards involved in the STS LNG bunkering operation. As a result, the potential hazards are summarized in

Table 3. Hazards involved in the STS LNG bunkering operation.

Code	Hazard	Description
H1	Natural gas is detected in machinery space for cargo handling	The gas density is higher than 60% of the low exposure limit (LEL)
H2	LNG Leakage in the flexible hose	Detection of natural gas is detected around the bunkering hose, and density is higher than 60% of the LEL
H3	High pressure in LNG hose	Detection of high pressure in flexible LNG hose
H4	High-high pressure in vapor return line	Detection of high-high pressure in the vapor return line
H5	Power failure for emergency valves	These emergency valves refer to ESDs, DDCs, and ERC
H6	Liquid level of the receiving tank is at high-high level	The LNG is continuously pumped into the receiving tank even though the high level is alarmed, or the liquid sensor is malfunctioned
H7	High-high pressure in the receiving tank	It is usually caused by the high temperature in the LNG hose, which facilitates the evaporation of the LNG
H8	High temperature in the LNG hose	It is usually caused by leakage or poor insulation of LNG hose, in case of high temperature, the bunkering operation should be suspended immediately
H9	High flow rate of LNG in pipelines	The flow rate in pipelines is controlled by the logic controller under normal operation conditions based on the information from flow rate sensor, and the flow rate can also be controlled manually under abnormal or emergency situations

.

The nine hazards identified at the system level are considered the failure mode from the perspective of FMEA. Then, the causes contributing to these hazards are further investigated with the help of unsafe control actions analysis in terms of the four aspects mentioned in Section 3.2.1, which is illustrated in Figure 3. For this purpose, the safety control structure corresponding to the STS LNG bunkering should be first established according to the basic principle of STPA, the results of which are illustrated in Figure 7c. Finally, all the failure modes and their consequences and causes are determined, which are summarized in

Table 4. Failure modes, causes, and consequences involved in STS LNG bunkering.

Hazards	Consequences	Causes
H1	A1, A2	Leakage appeared in the cargo machinery space
H2	A1, A2, A3	Poor seal of the flanges; ERS and ESD fail to be activated after leakage; the fire-fighting system fails to be activated or activated too late in case of fire; no effective inspection in terms of leakage; no protective measures for the slight leakage
H3	A1, A2, A3	Relief valve fails to be activated in case of high-high pressure/temperature; ERS and ESD fail to be activated after leakage; valves are not maintained/inspected periodically
H4	A1, A3	High pressure/temperature in the receiving tank; poor insulation of the vapor line; failure of ESD or ERS; failure of the control valve on the vapor line
H5	A3	Human-related operational errors; black-out of the ship
H6	A1, A2	ERS and ESD fail to be activated after leakage; sensors fail to be maintained properly
H7	A1, A2	High temperature of bunkering system; failure of pressure sensor in tank; failure of logic controller; mechanical failure of submerged pump
H8	A1, A2, A3	Sensors fail to be maintained properly; the fire-fighting system fails to be activated or activated too late in case of fire
H9	A1, A2, A3	The actions of ERS and ESD are inappropriate after leakage; sensors fail to detect the abnormal flow rate; The action of frequency converter on the submerge pump is inappropriate; The functionality of the flow rate control valve is abnormal

.

4.2. Fuzzy FMEA Analysis

4.2.1. Expert Weights and Elicitation

To evaluate these nine failure modes in terms of O, S, and D, according to the aforementioned selection criteria in Section 3.2.3, a heterogeneous group of experts was selected in this study to conduct the expert elicitation. The weights of these experts is evaluated according to their age, professional position, educational level, experience, as well as their certificate rank [29]. To ensure the professional and heterogeneity of the experts employed in this study, all the experts are characterized by experience of maritime shipping industry; meanwhile, these experts are from different sections, such as academic institutes, shipping companies, seafarers on LNG-Fueled ships, and port state control officers. Finally, five maritime professional experts are selected in this study, and their general information is summarized in

Table 5. General information of the experts employed in this study.

No.	Age	Occupation	Educational Level	Certificate Rank	Job Tenure
Expert1 (E1)	53	Marine manager	Master in navigation	Senior Captain	He has been working in maritime industry for nearly 30 years; currently, he is an experienced maritime accident investigator employed by MSA with equivalent to junior academic position.
Expert2 (E2)	39	2nd engineer on board a ship	Bachelor in marine engineering	Second engineer	He has been working on board a LNG carrier since 2007, beginning as a cadet and eventually becoming a second engineer; he is familiar with LNG operation.
Expert3 (E3)	50	Port state control officer (PSCO)	Master in navigation	Senior Captain	He has been working in maritime industry since 1996; currently, he is a PSCO with equivalent to senior academic position.
Expert4 (E4)	44	Professor at Maritime University	PhD. in navigation technology	Captain	He has been working in maritime industry since 2004; currently, he is a professor focusing on maritime risk evaluation.
Expert5 (E5)	46	Marine superintendent	Master in marine engineering	Senior chief engineer	He has been working on board a ship since 2000; he is familiar with LNG operations and hold a position with equivalent to the junior academic.

.

The capacity of these experts is then evaluated to value their weights. For this purpose, the methodology proposed in Section 3.2.3 is used in this study. To establish pairwise comparison matrices, a set of rating criteria is developed in terms of professional position, age, experience, education level, and certificate rank. Each indicator is scaled from 1 to 5: the higher the score, the more important the expert is. The score ratings are summarized in

Table 6. Rating criteria for the capacity evaluation.

Indicator	Professional position
	Senior academic	Junior academic	Engineer	Technician	Worker
Score	5	4	3	2	1
Indicator	Age/year
	≥50	45~50	40~45	30~39	≤30
Score	5	4	3	2	1
Indicator	Job experience/year
	≥30	20–29	10–19	6–9	≤5
Score	5	4	3	2	1
Indicator	Education level
	Ph.D.	Master	B.S or B.E	Junior college	High school
Score	5	4	3	2	1
Indicator	Certificate rank
	Senior Cap. or C/E	Cap. or C/E	C/O or 2/E	Operational officer/engineer	ratings
Score	5	4	3	2	1

.

To obtain the pairwise comparison matrices with the elements being fuzzy numbers, the difference in scores between two experts in terms of a specific evaluation indicator is represented by a fuzzy number, and the corresponding relationships between the difference in scores and fuzzy number are defined as in

Table 7. Relationships between difference in scores and fuzzy number.

Diff. in Score	0	1	2	3	4	−1	−2	−3	−4
Sym.	$1^{\prime }$	$3^{\prime }$	$5^{\prime }$	$7^{\prime }$	$9^{\prime }$	${(1/3)}^{\prime }$	${(1/5)}^{\prime }$	${(1/7)}^{\prime }$	${(1/9)}^{\prime }$
Fuzzy number	(1,1,3)	(1,3,5)	(3,5,7)	(5,7,9)	(7,9,9)	(1,1/3,1/5)	(1/3,1/5,1/7)	(1/5,1/7,1/9)	(1/7,1/9,1/9)

with reference to Yazdi [70].

Based on the contents presented in Table 4, Table 5 and Table 6, the pairwise comparison matrices for the expert capacity evaluation can be obtained in terms of age, education level, certificate rank, job experience, and professional position, which are denoted by $A,E,C,J$, and $P$, respectively.

$$A=\left[\begin{array}{lllll}1\hfill & 7^{\prime }\hfill & 1^{\prime }\hfill & 5^{\prime }\hfill & 3^{\prime }\hfill \\ {(1/7)}^{\prime }\hfill & 1\hfill & {(1/7)}^{\prime }\hfill & {(1/3)}^{\prime }\hfill & {(1/5)}^{\prime }\hfill \\ 1^{\prime }\hfill & 7^{\prime }\hfill & 1\hfill & 5^{\prime }\hfill & 3^{\prime }\hfill \\ {(1/5)}^{\prime }\hfill & {(1/3)}^{\prime }\hfill & {(1/5)}^{\prime }\hfill & 1\hfill & {(1/3)}^{\prime }\hfill \\ {(1/3)}^{\prime }\hfill & 5^{\prime }\hfill & {(1/3)}^{\prime }\hfill & 3^{\prime }\hfill & 1\hfill \end{array}\right]$$

(30a)

$$E=\left[\begin{array}{lllll}1\hfill & 3^{\prime }\hfill & 1^{\prime }\hfill & {(1/3)}^{\prime }\hfill & 1^{\prime }\hfill \\ {(1/3)}^{\prime }\hfill & 1\hfill & {(1/3)}^{\prime }\hfill & {(1/5)}^{\prime }\hfill & {(1/3)}^{\prime }\hfill \\ 1^{\prime }\hfill & 3^{\prime }\hfill & 1\hfill & {(1/3)}^{\prime }\hfill & 1^{\prime }\hfill \\ 3^{\prime }\hfill & 5^{\prime }\hfill & 3^{\prime }\hfill & 1\hfill & 3^{\prime }\hfill \\ 1^{\prime }\hfill & 3^{\prime }\hfill & 1^{\prime }\hfill & {(1/3)}^{\prime }\hfill & 1\hfill \end{array}\right]$$

(30b)

$$C=\left[\begin{array}{ccccc}1& 5^{\prime }& 1^{\prime }& 3^{\prime }& 1^{\prime }\\ {(1/5)}^{\prime }& 1& {(1/5)}^{\prime }& {\tilde{3}}^{-1}& {(1/5)}^{\prime }\\ 1^{\prime }& 5^{\prime }& 1& 3^{\prime }& 1^{\prime }\\ {(1/3)}^{\prime }& 3^{\prime }& {(1/3)}^{\prime }& 1& {(1/3)}^{\prime }\\ 1^{\prime }& 5^{\prime }& 1^{\prime }& 3^{\prime }& 1\end{array}\right]$$

(30c)

$$J=\left[\begin{array}{ccccc}1& 5^{\prime }& 3^{\prime }& 5^{\prime }& 3^{\prime }\\ {(1/5)}^{\prime }& 1& {(1/3)}^{\prime }& 1^{\prime }& {(1/3)}^{\prime }\\ {(1/3)}^{\prime }& 3^{\prime }& 1& 3^{\prime }& \tilde{1}\\ {(1/5)}^{\prime }& 1^{\prime }& {(1/3)}^{\prime }& 1& {(1/3)}^{\prime }\\ {(1/3)}^{\prime }& 3^{\prime }& 1^{\prime }& 3^{\prime }& 1\end{array}\right]$$

(30d)

$$P=\left[\begin{array}{ccccc}1& 3^{\prime }& {(1/3)}^{\prime }& {(1/3)}^{\prime }& 1^{\prime }\\ {(1/3)}^{\prime }& 1& {(1/5)}^{\prime }& {(1/5)}^{\prime }& {(1/3)}^{\prime }\\ 3^{\prime }& 5^{\prime }& 1& 1^{\prime }& 3^{\prime }\\ 3^{\prime }& 5^{\prime }& 1^{\prime }& 1& 3^{\prime }\\ 1^{\prime }& 3^{\prime }& {(1/3)}^{\prime }& {(1/3)}^{\prime }& 1\end{array}\right]$$

(30e)

Based on Equations (5)–(7), the synthetic pairwise comparison matrix $F^{\prime }$ can be determined as

$$F^{\prime }=\left[\begin{array}{lllll}(1.000,1.000,1.000)\hfill & (2.141,4.360,6.434)\hfill & (0.803,1.000,1.933)\hfill & (1.552,1.528,1.580)\hfill & (1.000,1.552,3.680)\hfill \\ (0.467,0.229,0.155)\hfill & (1.000,1.000,1.000)\hfill & (0.467,0.229,0.155)\hfill & (0.644,0.467,0.300)\hfill & (0.644,0.272,0.175)\hfill \\ (1.000,1.000,1.933)\hfill & (2.141,4.360,6.434)\hfill & (1.000,1.000,1.000)\hfill & (1.246,1.719,2.537)\hfill & (1.000,1.552,3.680)\hfill \\ (0.644,0.654,0.634)\hfill & (1.552,2.954,5.165)\hfill & (0.803,0.582,0.612)\hfill & (1.000,1.000,1.000)\hfill & (1.000,0.803,0.725)\hfill \\ (1.000,0.644,1.012)\hfill & (1.552,3.680,5.720)\hfill & (1.000,0.644,1.012)\hfill & (1.000,1.246,1.380)\hfill & (1.000,1.000,1.000)\hfill \end{array}\right]$$

(31)

The fuzzy weights of these five experts can be obtained according to Equation (8), the results of which are presented as

$$\Re ={\left[\begin{array}{c}(1.217,1.596,2.354)\\ (0.618,0.367,0.263)\\ (1.073,1.634,2.588)\\ (1.092,1.137,1.519)\end{array}\right]}^{\mathrm{T}}$$

(32)

According to Equation (9), the fuzzy weight of each expert can be determined, the results of which are summarized as

$${\lambda }^{\prime }={\left[\begin{array}{c}(0.246,0.279,0.303)\\ (0.125,0.064,0.034)\\ (0.193,0.172,0.138)\\ (0.221,0.199,0.194)\end{array}\right]}^{\mathrm{T}}$$

(33)

Finally, the explicit weights for these experts can be determined by Equation (10), and the results are obtained as

$$\lambda ={\left[{\lambda }_i\right]}_{1\times 5}=\left[0.275,0.074,0.278,0.168,0.205\right]$$

(34)

These five maritime professional experts are then required to evaluate the identified failure modes in terms of their occurrence (O), severe (S), and detectability (D) in the form of safety meetings and questionnaires. The results are summarized in

Table 8. Results of expert elicitation for the failure modes evaluation.

		F1	F2	F3	F4	F5	F6	F7	F8	F9
O	E1	(H12,1.0)	(H22,0.2), (H33,0.8)	(H21,1)	(H33,1)	(H11,1.0)	(H22,1.0)	(H34,1.0)	(H23,1.0)	(H12, 1.0)
	E2	(H23,1.0)	(H22,0.75), (H33,0.25)	(H23,1.0)	(H11,0.3), (H22,0.7)	(H23,1.0)	(H22,0.6),(H33,0.4)	(H23,1.0)	(H11,0.2), (H22,0.8)	(H12,1.0)
	E3	(H11,0.7), (H22,0.3)	(H34,1.0)	(H11,0.8), (H22,0.2)	(H33,1.0)	(H22,1.0)	(H12,1.0)	(H11,0.6), (H22,0.4)	(H11,0.7), (H22,0.3)	(H11,1.0)
	E4	(H11,0.4),(H22,0.6)	(H34,1.0)	(H11,1.0)	(H12,1.0)	(H22,0.7), (H33,0.3)	(H12,1.0)	(H22,0.7), (H33,0.3)	(H22,0.4), (H33,0.6)	(H12,1.0)
	E5	(H23,1.0)	(H22,0.6), (H33,0.4)	(H23,1.0)	(H12,1.0)	(H22,1.0)	(H23,1.0)	(H22,0.6), (H33,0.4)	(H22,1.0)	(H12,1.0)
S	E1	(H33,0.4),(H44,0.6)	(H34, 1.0)	(H44,1.0)	(H22,0.7), (H33,0.3)	(H44,1.0)	(H22,0.1),(H33,0.9)	(H33,0.7), (H44,0.3)	(H34,1.0)	(H23,1.0)
	E2	(H44,1.0)	(H33,0.4), (H44,0.6)	(H45,1.0)	(H34,1.0)	(H44,1.0)	(H22,0.3),(H33,0.7)	(H33,0.8) ,(H44,0.2)	(H44,1.0)	(H33,1.0)
	E3	(H33,0.2),(H44,0.8)	(H22,0.7), (H33,0.3)	(H44,1.0)	(H23,1.0)	(H44,1.0)	(H22,0.4),(H33,0.6)	(H33,0.7), (H44,0.3)	(H44,1.0)	(H22,0.8), (H33,0.2)
	E4	(H45,1.0)	(H44,1.0)	(H44,0.7), (H45,0.3)	(H33,0.6), (H44,0.4)	(H44,1.0)	(H33,0.2),(H44,0.8)	(H44,0.8), (H55,0.2)	(H34,1.0)	(H23,1.0)
	E5	(H33,0.3),(H44,0.7)	(H33,0.6), (H44,0.4)	(H44,1.0)	(H22,0.4), (H33,0.6)	(H44,1.0)	(H22,0.2),(H33,0.8)	(H33,0.7), (H44,0.3)	(H33,0.4), (H44,0.6)	(H22,0.8), (H33,0.2)
D	E1	(H33,0.7),(H44,0.3)	(H33,0.9), (H44,0.1)	(H34,1.0)	(H22,1.0)	(H22,0.7), (H33,0.3)	(H34,1.0)	(H34,0.2), (H44,0.8)	(H34,1.0)	(H33,1.0)
	E2	(H34,1.0)	(H23,1.0)	(H33,1.0)	(H22,1.0)	(H33,0.6), (H44,0.4)	(H22,0.8),(H33,0.2)	(H34,1.0)	(H44,1.0)	(H23,1.0)
	E3	(H33,1.0)	(H23,1.0)	(H45,1.0)	(H45,1)	(H34,1.0)	(H34,1.0)	(H33,0.6), (H44,0.4)	(H33,0.6), (H44,0.4)	(H34,1.0)
	E4	(H22,0.2),(H33,0.8)	(H33,0.8), (H44,0.2)	(H34,1.0)	(H22,0.4), (H33,0.6)	(H22,0.3), (H33,0.7)	(H23,1.0)	(H33,1.0)	(H33,0.6), (H44,0.4)	(H23,1.0)
	E5	(H22,0.8),(H33,0.2)	(H22,1.0)	(H23,1.0)	(H22,0.9), (H33,0.1)	(H23,1.0)	(H33,0.9),(H44,0.1)	(H33,0.7), (H44,0.3)	(H33,0.6), (H44,0.4)	(H22,1.0)

.

4.2.2. Explicit Confidential Structure

The data contained in Table 8 are considered the input of Equation (14), and the results calculated from Equation (14) are used to develop an explicit confidential matrix, which is expressed as

$$X=\begin{array}{l}\hfill \\ F1\hfill \\ F2\hfill \\ F3\hfill \\ F4\hfill \\ F5\hfill \\ F6\hfill \\ F7\hfill \\ F8\hfill \\ F9\hfill \end{array}\begin{array}{l}O\hfill \\ 0.2898\hfill \\ 0.4813\hfill \\ 0.2689\hfill \\ 0.4045\hfill \\ 0.2684\hfill \\ 0.3284\hfill \\ 0.3786\hfill \\ 0.3178\hfill \\ 0.2491\hfill \end{array}\begin{array}{l}S\hfill \\ 0.6663\hfill \\ 0.5392\hfill \\ 0.7121\hfill \\ 0.4432\hfill \\ 0.7080\hfill \\ 0.4860\hfill \\ 0.5908\hfill \\ 0.6285\hfill \\ 0.3899\hfill \end{array}\begin{array}{l}D\hfill \\ 0.4810\hfill \\ 0.4465\hfill \\ 0.5829\hfill \\ 0.4421\hfill \\ 0.6491\hfill \\ 0.5177\hfill \\ 0.5903\hfill \\ 0.5880\hfill \\ 0.4598\hfill \end{array}$$

(35)

$x_1(1)$ in this study illustrates the calculation process of the elements in the explicit confidential matrix, and the calculation process is shown as

$$\begin{array}{l}{x}_1(1)={\lambda }_1\left\{H_{12},1.0\right\}+{\lambda }_2\left\{H_{23},1.0\right\}+{\lambda }_3\left\{(H_{11},0.7),(H_{22},0.3)\right\}+{\lambda }_4\left\{(H_{11},0.4),(H_{22},0.6)\right\}+{\lambda }_5\left\{H_{23},1.0\right\}\\ =0.275\ast 0.295\ast 1.0+0.074\ast 0.433\ast 1.0+0.278\ast (0.13\ast 0.7+0.292\ast 0.3)+0.168\ast (0.13\ast 0.4+0.292\ast 0.6)+0.205\ast 0.433\ast 1.0\\ =0.2889\end{array}$$

(36)

Then, the explicit confidential matrix is normalized with the application of Equation (17), the results of which are presented as

$$R=\begin{array}{l}\hfill \\ F1\hfill \\ F2\hfill \\ F3\hfill \\ F4\hfill \\ F5\hfill \\ F6\hfill \\ F7\hfill \\ F8\hfill \\ F9\hfill \end{array}\begin{array}{l}O\hfill \\ 0.2844\hfill \\ 0.4725\hfill \\ 0.2640\hfill \\ 0.3971\hfill \\ 0.2634\hfill \\ 0.3224\hfill \\ 0.3716\hfill \\ 0.3120\hfill \\ 0.2445\hfill \end{array}\begin{array}{l}S\hfill \\ 0.3802\hfill \\ 0.3076\hfill \\ 0.4063\hfill \\ 0.2529\hfill \\ 0.4040\hfill \\ 0.2773\hfill \\ 0.3371\hfill \\ 0.3586\hfill \\ 0.2225\hfill \end{array}\begin{array}{l}D\hfill \\ 0.3006\hfill \\ 0.2790\hfill \\ 0.3643\hfill \\ 0.2762\hfill \\ 0.4056\hfill \\ 0.3235\hfill \\ 0.3689\hfill \\ 0.3674\hfill \\ 0.2873\hfill \end{array}$$

(37)

To weight the elements contained in the normalized confidential matrix $R$, the weights of O, S, and D are valued with the application of Equations (18)–(24). Firstly, the subjective weights of O, S, and D are determined through the method described in Figure 3 on the basis of the expert elicitation, which are summarized in

Table 9. Expert elicitation results to determine weights of O, S, and D.

	E1	E2	E3	E4	E5
O	Very important	Important	Medium	Important	Important
S	Important	Medium	Very important	Important	Very important
D	Medium	Important	Important	Very important	Medium

. The results are 0.3272, 0.3566, and 0.3162, respectively.

Then, the objective weights of O, S, and D can be determined on the basis of the normalized confidential matrix $R$ with the application of Equations (22)–(25); as a result, the objective weights of O, S, and D are valued as 0.4608, 0.3505, and 0.1877, respectively. Therefore, based on the abovementioned subjective weights and objective weights of O, S, and D, the comprehensive weights of O, S, and D can be calculated by Equation (20), the results of which are presented in

Table 10. Weights of O, S, and D.

	O	S	D
Subjective weight	0.3272	0.3566	0.3162
Objective weight	0.4608	0.3505	0.1877
Comprehensive weight	0.4499	0.3730	0.1771

.

As a result, the normalized explicit confidential matrix can be weighted, with the weights presented in Table 9, by Equation (19), the results of which are expressed as

$$T=\left[\begin{array}{lll}0.1280\hfill & 0.1418\hfill & 0.0532\hfill \\ 0.2126\hfill & 0.1147\hfill & 0.0494\hfill \\ 0.1188\hfill & 0.1515\hfill & 0.0645\hfill \\ 0.1787\hfill & 0.0943\hfill & 0.0489\hfill \\ 0.1185\hfill & 0.1507\hfill & 0.0718\hfill \\ 0.1450\hfill & 0.1034\hfill & 0.0573\hfill \\ 0.1672\hfill & 0.1257\hfill & 0.0653\hfill \\ 0.1404\hfill & 0.1338\hfill & 0.0651\hfill \\ 0.1100\hfill & 0.0830\hfill & 0.0509\hfill \end{array}\right]$$

(38)

4.3. Risk Assessment by TOPSIS

Both the positive ideal and negative ideal solutions of the issue solved in this study can be obtained through the weighted and normalized explicit confidential matrix according to Equation (25), the results of which are presented as follows.

$$A^{+}=\left(0.2126,0.1515,0.0718\right),A^{-}=\left(0.1100,0.0830,0.0489\right)$$

(39)

Then, the distance between each failure mode and the positive/negative ideal solution can be calculated with the application of Equation (28a,b), and the results are summarized in

Table 11. Distance to positive/negative ideal solution and relative closeness of each failure mode.

Failure Mode	${\mathit{d}}^{\mathbf{+}}$	${\mathit{d}}^{\mathbf{-}}$	$\mathit{C}$
F1	0.3314	0.4267	0.5629
F2	0.3672	0.4846	0.5689
F3	0.3913	0.4772	0.5495
F4	0.2934	0.4037	0.5791
F5	0.4216	0.5038	0.5444
F6	0.3021	0.3978	0.5684
F7	0.3847	0.4852	0.5578
F8	0.3744	0.4671	0.5551
F9	0.2291	0.3072	0.5728

. In addition, the results of relative closeness are also summarized in Table 11.

According to the principle of FMEA-TOPSIS in this study, the relative closeness of the failure mode can be used to describe the risk level of each failure mode: the higher the relative closeness, the higher the risk level of the failure mode. It can be observed that the deviation between the highest and lowest relative closeness values of the failure modes summarized in Table 11 is 0.0347, which indicates that the risk levels of all the identified failure modes in this study should be paid considerable attention to. Furthermore, if all the relative closeness values are regarded as a series of numbers, then the variance of the relative closeness values can be obtained as

$${\sigma }^2={\displaystyle \sum _{n=1}^N{\left(C_n-\mu \right)}^2}/N=1.144\times {10}^{-4}$$

(40)

where $\mu$ is the average of relative closeness, and $N$ is the total number of failure modes in this study. Meanwhile, the standard deviation is valued as 0.0107 according to the variance. The results of variance and standard deviation imply that STS LNG bunkering operation should be implemented carefully because there are no prominent risks among all the identified risks.

5. Findings and Extended Discussions

According to the results presented in Table 11, H4 (high-high pressure in vapor return line) should be prioritized in terms of risk management during STS LNG bunkering. High pressure in vapor return line is also regarded as an important indicator to pause the bunkering operation [75]. The size of the vapor return line is much smaller than that of the LNG hose [16], and the temperature is higher due to natural gas flowing within. Actually, the prevention of high pressure in the vapor return line is the critical content for boil-off gas (BOG) management, which is an obvious challenge of STS LNG bunkering operation [47,50]. The high risks involved in high pressure in the vapor return line mainly lie in the complexity of its causes, which may cover many factors, such as pressure of the receiving tank, temperature difference between bunker tank and receiving tank, bunkering flow rate, and insulation of the return line. According to the study conducted by Lee et al. [47], the pressure of the receiving tank is the most important factor influencing pressure in the vapor return line, and the flow rate of LNG is also an important contributing factor. Therefore, it is advised to reasonably determine the bunkering flow rate considering the bunkering operation time and return vapor flow rate, which are limited mainly by the heat ingress and pressure fluctuation. Practically, at the beginning of the bunkering operation, the pressure in the vapor return line should be paid much attention because overpressure in the vapor return line is likely to occur under conditions of insufficient pre-cooling or heat ingress. In addition, it is interesting to find H9 (high flow rate of LNG in pipelines) is ranked as the second most important risk signal following H4. Under normal operational conditions, the flow rate of bunkering LNG is well controlled by the logic controller, control valve, and the frequency converter based on the feedback signals from flow rate sensors. The reasons for the high flow rate of bunkering LNG are complex, and the most obvious reason is the mechanical failure of the control valve and flow rate sensors. Actually, the high flow rate of bunkering LNG can also be caused by the malfunctioning of the ERS after the occurrence of bunkering LNG leakage, such as the ERS failing to be actuated or actuated too late in case of bunkering LNG leakage. Therefore, it is necessary to pay close attention to the flow rate of the bunkering LNG during the STS LNG bunkering operation.

LNG leakage in the flexible hose (H2) is ranked as the third most important risk signal according to the results presented in Table 11. The main reason may lie in the fact that LNG leakage is paid the most attention by the operator during STS LNG bunkering. Leaky LNG may lead to fire in case of ignition, and under normal operational conditions, the ESD system may actuated by the LNG leakage. In the field of practical engineering, LNG leakage occurs during bunkering operations; particularly, leakage occurring in the flexible hose or the hose arm has attracted much attention, and a lot of available data about hose failure have been reported or published according to the review study made by Gerbec and Aneziris [32], such as DNV GL [76]. LNG leakage in the hose may occur at the location of coupling and connecting flanges, or other joints. The external or internal causes contributing to the LNG hose leakage are not well investigated due to the lack of a practical dataset; they may be attributed to hose quality issues, fatigue damage, low temperature damage, and human-related error [56]. The general operational reliability of the operators on-site during STS LNG bunkering is assessed in the study conducted by Ahn et al. [75] and Uflaz et al. [27]. Generally, the probability of hose leakage is determined by many factors, such as the failure rate of joints (couplings, and connecting flanges), and the fatigue of the bunkering hose (duration and number of bunkering operations). Even though there are rarely reports that LNG hose leakage is directly caused by the inappropriate operation of the crew on-site, the control and management of hose quality issues and fatigue damage are greatly dependent on the responsible operation of the crew on-site, such as careful inspection before bunkering operations, and the proper maintenance of LNG hose.

Even though the failure modes investigated in this study are mainly focused on the LNG bunkering operation process, the causes or prevention measures may stem from the preparation and after bunkering activities. Therefore, it is necessary to overview all the operational procedures of the STS LNG bunkering operation, which have been addressed by an advisory committee on LNG-fueled ships of the IAPH. For this purpose, the abovementioned operational procedures are clarified in this study with reference to Uflaz et al. [27] and IAPH [18], during which hierarchical task analysis (HTA) is applied to decompose the whole operation process, and the results can be found in the Appendix A. As a result, the prevention and management of the failure modes in this study may be beneficial by means of paying much attention to some sub-tasks listed in

Table A1. Checklist of STS LNG bunkering operation (pre-bunkering, during bunkering, and after bunkering).

1. Pre-bunkering
1.1.	According to the local regulations, the competent authorities and bunker ship are notified of the start of bunkering operations
1.2.	Both the ships should confirm the weather and sea condition, as well as the limitations for aborting the operation
1.3.	Ensure a secure mooring connection between your vessel and the LNG bunker vessel in compliance with regulatory requirements, considering proper mooring arrangements, adequate tensioning, and safe rendering
1.4.	Ensure the provision of a safe and secure means of access between your vessel and the LNG bunker vessel
1.5.	Ensure all required firefighting equipment is prepared for immediate use, and coordinate smoking regulations along with other fire prevention measures
1.6.	Ensure the bunkering operation area is adequately illuminated
1.7.	Verify that both your vessel and the LNG bunker vessel can maneuver safely under their own power without obstructions
1.8.	Ensure responsible officers on both your vessel and the LNG bunker vessel provide adequate supervision throughout the bunkering operation
1.9.	Establish, test, and confirm an effective primary and emergency communication system between the responsible operators and supervisors on both your vessel and the LNG bunker vessel. Ensure agreement on the communication language
1.10.	Agree upon, test, and clearly explain the emergency stop signal and shut-down procedures to all relevant personnel
1.11.	Ensure that those in charge are familiar with emergency procedures, response plans, and contact numbers
1.12.	Establish a predefined restricted area, clearly marked with appropriate sign-age. Ensure the area is free from other vessels, unauthorized personnel, objects, and potential ignition sources
1.13.	Establish and agree on safety procedures and mitigation measures to prevent falling objects, ensuring all parties involved adhere to them
1.14.	Maintain an active deck watch on the ship. Maintain an effective LNG bunker watch, both on board and on board the LNG bunker
1.15.	Close all external doors, portholes, and accommodation ventilation inlets in accordance with the operating manual
1.16.	Conduct an operational test of the gas detection equipment to ensure it is functioning properly and in good working condition
1.17.	Material Safety Data Sheets (MSDS) for delivered LNG fuel must be on board
1.18.	Enforce regulations regarding ignition sources
1.19.	Ensure that suitable and sufficient protective clothing and equipment are readily available. Personnel involved in connecting and disconnecting bunker hoses, as well as those in the immediate vicinity, must wear appropriate protective gear
1.20.	Install a [powered] emergency release coupling (ERC) and ensure it is ready for immediate activation
1.21.	Conduct a functional test of the water spray system and ensure it is prepared for immediate deployment
1.22.	Verify that Spill containment arrangements are properly set up, equipped with suitable materials, have adequate capacity, and are empty
1.23.	Verify that hull and deck protection against low temperature is present
1.24.	Verify that bunker pumps and compressors are in good working order
1.25.	Verify that all control valves are in good condition and in good working order
1.26.	Ensure that the bunker system gauges, high-level alarms, and high-pressure alarms are operational, properly calibrated, and in good working condition
1.27.	Ensure the ship’s bunker tanks are safeguarded against accidental overflow, continuously monitor tank contents, and verify that alarms are correctly set
1.28.	Inspect, test, and confirm that all safety and control devices in the LNG installations are fully operational and in good working condition
1.29.	Ensure that pressure control equipment, as well as boil-off and re-liquefaction systems, are functioning properly and in good working condition
1.30.	Properly connect and securely support the vapor connections
1.31.	Confirm that Emergency Shutdown Systems (ESDs), automatic valves, or equivalent devices have been tested, are fully operational, and ready for use on both your vessel and the LNG bunker vessel. Ensure agreement on the closing rates of the ESDs
1.32.	Inspect the initial LNG bunker line up. Close unused connections, blank and bolt completely
1.33.	Verify that LNG bunker hoses, fixed pipelines, and manifolds are in good condition, correctly equipped and supported, properly connected, leak-tested, and certified for LNG transfer
1.34.	Establish the LNG bunker connection between the vessel and the LNG bunker ship using dry disconnection couplings
1.35.	Ensure the LNG bunker connection between the own ship and the LNG bunker ship is equipped with sufficient electrical isolation measures
1.36.	Ensure that dry breakaway couplings are installed on LNG bunker connections, and visually inspect them to confirm they are functioning properly and in good working condition
1.37.	Locate the ship’s emergency fire control plans externally
1.38.	Provide an International Shore Connection
1.39.	Conduct an information exchange regarding pre-cooling, inerting, cooling down, vapor management, transfer rates during the initial, bulk, topping stages, and the filling sequence
1.40.	Perform the initial pre-cooling of the LNG transfer systems on both vessels that can be completed either with the use of nitrogen or with LNG. Aware of the risks of cryogenic hazards, introducing oxygen in confined spaces, and boil-off-gas (if inerting with LNG) during this activity
1.41.	Inform coastal maritime authorities of the starting of bunkering operations, as well as the other vessels in the vicinity
2. During bunkering activities
2.1.	Confirm and agree on the starting temperatures, pressures, as well as the available tank capacity before commencing operations
2.2.	Establish an agreement on the transfer quantity, initial manifold pressure, starting transfer rate, maximum transfer rate, topping-up rate, and maximum allowable manifold pressure
2.3.	Agree on the maximum and minimum limits for bunkering pressures, LNG bunker tank pressures, LNG temperatures, and the filling limit of the LNG bunker tanks
2.4.	Commence operations at the agreed transfer rates, ensuring compliance with the specified temperatures, pressures, and tank capacity
2.5.	Continuously monitor the bunker transfer quantities, temperatures, pressures, and tank capacity throughout the operation
2.6.	Handle vented and boil-off gas in accordance with the agreed-upon plan
2.7.	Continuously monitor weather conditions and remain alert for any unexpected deterioration
2.8.	Make necessary adjustments to mooring lines, bunker hoses, and arms
2.9.	Periodically test the communication equipment and methods
3. After bunkering activities
3.1.	Purge the LNG bunker hoses, stationary pipelines, and manifolds, ensuring they are properly prepared and maintained for disconnection
3.2.	Close both remote and manually operated valves, ensuring they are properly prepared and maintained for disconnection
3.3.	Inspect all pressure relief valves and vents to ensure they are functioning properly and to prevent the risk of overpressurization
3.4.	Inert the bunker transfer pipeline and hose using nitrogen before proceeding with the disconnection
3.5.	Deactivate the restricted area following the disconnection procedure
3.6.	Notify competent authorities and terminal that LNG bunker operations have been completed and other vessels in the vicinity have been notified as required
3.7.	Report near misses and incidents to competent authorities if applicable

in Appendix A, which are summarized in

Table 12. Sub-tasks in STS LNG bunkering operation contributing to failure mode prevention.

Failure Mode	Risk Level	Sub-Tasks Code
[F4] High-high pressure in vapor return line	0.5791	1.14, 1.26, 1.27, 1.29, 1.40, 2.3, 2.6, 3.3
[F9] High flow rate of LNG in pipelines	0.5728	1.8, 1.14, 1.24, 1.25, 1.28, 1.31, 2.1, 2.2, 2.4, 2.5
[F2] LNG Leakage in the flexible hose	0.5689	1.3, 1.5, 1.8, 1.10, 1.14, 1.16, 1.18, 1.19, 1.20, 1.30, 1.31, 1.32, 1.33
[F6] Liquid level of the receiving tank is at high-high level	0.5684	1.8, 1.25, 1.26, 1.27, 1.31, 2.3, 2.5
[F1] Natural gas is detected in machinery space for cargo handling	0.5629	1.5, 1.8, 1.14, 1.18, 1.28, 1.35
[F7] High-high pressure in the receiving tank	0.5578	1.8, 1.26, 1.27, 1.29, 2.3, 2.5, 3.3
[F8] High temperature in the LNG hose	0.5551	1.10, 1.14, 1.33, 1.40, 2.1
[F3] High pressure in LNG hose	0.5495	1.8, 1.10, 1.26, 1.28, 1.29, 1.31, 2.1, 2.3, 3.3
[F5] Power failure for emergency valves	0.5444	1.20, 1.25, 1.28, 1.29, 1.31

.

Based on the contents presented in Table 12, it can clearly be observed that each failure mode identified in this study can be prevented or controlled by a group of sub-tasks, which causes a change by means of AND or OR gate. In addition, according to Table 12, 77.14% of the total sub-tasks are attributed to pre-bunkering activities, which indicates the criticality of the various inspections before bunkering operations, and interestingly, there are three failure modes, namely, F1, F2, and F5, all of which can be effectively prevented or controlled by measures before bunkering operations according to Table 12. Anyway, all the failure modes can be prevented or controlled by means of taking measures recommended in the STS LNG bunkering checklist. It should be kept in mind that the specific checklists for bunkering scenarios may differ due to different safety constraints or requirements. Therefore, in practical engineering, a specific STS LNG bunkering checklist is prepared with accordance to LNG bunkering guidelines, which may include but is not limited to IAPH [18], Swedish Marine Technology Forum [19], American Bureau of Shipping [20], Korean Register of Shipping [21], and China Classification Society [22].

6. Conclusions

The hazardous events involved in STS LNG bunkering operations are quantitatively assessed by a comprehensive methodology integrating fuzzy FMEA and TOPSIS proposed in this study. In detail, the STS LNG bunkering process is first decomposed according to the principle of STPA to identify potential failure modes and their causes and consequences; then, the occurrence, severity, and detectability of these failure modes are assessed by a group of heterogeneous experts with application of fuzzy confidential structure analysis. Consequently, the developed fuzzy confidential matrix is transferred into the explicit confidential matrix, which is regarded as the input of TOPSIS to rank the risk level of these failure modes. The findings and managerial implications of this study are summarized as follows.

(1)

There are a total of nine failure modes identified in this study during the STS LNG bunkering operation process, and the results show that “high-high pressure in vapor return line” (F4) is valued as the highest risk level, while “High flow rate of LNG in pipelines” (F9) and “LNG leakage in the flexible hose” (F2) are ranked as the second and the third highest risk level, respectively.

(2)

The safety checklist developed by IAPH [18] is used in this study to match the identified failure modes, and the results show that all these failure modes can be well prevented or controlled by the preventive measures listed in the safety checklist. It is interesting to find that 77.14% of these selected preventive measures are attributed to pre-bunkering activities. Furthermore, both the “Detection of natural gas in cargo machinery space” (F1) and “Power failure for emergency valves” (F9) can be well prevented by means of conducting pre-bunkering activities. This finding verifies the criticality of implementing a safety checklist.

(3)

In this study, both the “high-high pressure in vapor line” and “LNG leakage in the flexible hose” are valued by high risk level, which indicates the importance of BOG management and leakage management during the STS LNG bunkering. Even though LNG leakage and BOG management have been paid much attention to in different versions of operational guidelines, they can be further emphasized by means of developing specific operational manuals. Meanwhile, emergency plans can be further detailed by implementing simulation.

(4)

It is necessary to prepare a specific tailored safety checklist for an individual STS LNG bunkering operation with a concentration on the potential failure modes identified in this study. It should be noted that there are different versions of STS LNG bunkering operation guidelines; the suitable one should be selected according to the operational scenarios. The identified inspection items listed in Table 11 may be helpful for the preparation and monitoring of the bunkering operation on-site.

Even though the results of the present study can be potentially applied to improve the safety of STS LNG bunkering operations, there are still aspects that can be further improved. Since this study is based on expert evaluations, it may be subject to bias, and the lack of real-world LNG bunkering failure data could impact the generalizability of the findings. Ideally, the failure modes involved in the bunkering process should be identified by means of failure data analysis or text mining. However, there are limited data about the failure of bunkering operations. In addition, the results are obtained on the basis of a group of experts whose knowledge may be limited, which may lead to slight deviation from a specific engineering scenario. To address these two issues, in the near future, the methodology proposed in this study should be integrated in the form of pseudo-code, which can be further processed to develop an applet being suitable to a specific operational scenario and a specific group of experts. In addition, to improve the accuracy of this methodology, failure data about LNG bunkering should be accumulated by means of practical collection and simulation.