Oil Spill Risk Analysis

Safety Science 76 (2015) 42–66
Contents lists available at ScienceDirect
Safety Science
journal homepage: www.elsevier.com/locate/ssci
A framework for risk analysis of maritime transportation systems: A case

study for oil spill from tankers in a ship–ship collision
Floris Goerlandt ⇑, Jakub Montewka
Aalto University, School of Engineering, Department of Applied Mechanics, Marine Technology, Research Group on Maritime Risk and Safety, P.O. Box 15300, FI-00076 AALTO, Finland
a r t i c l e i n f o a b s t r a c t
Article history: This paper proposes a framework for risk analysis of maritime transportation systems, where risk analy-
Received 13 August 2014 sis is understood as a tool for argumentative decision support. Uncertainty is given a more prominent role
Received in revised form 12 January 2015 than in the current state of art in the maritime transportation application area, and various tools are pre-
Accepted 12 February 2015
sented for analyzing uncertainty. A two-stage risk description is applied. In the first stage, Bayesian
Available online 12 March 2015
Network (BN) modeling is applied for probabilistic risk quantification. The model functions as a commu-
nication and argumentation tool, serving as an aid to thinking in a qualitative evidence and assumption
Keywords:
effect assessment. The evidence assessment is used together with a sensitivity analysis to select alterna-
Risk analysis framework
Ship–ship collision
tive hypotheses for the risk quantification, while the assumption effect assessment is used to convey an
Bayesian Network argumentation beyond the model. Based on this, a deliberative uncertainty judgment is made in the sec-
Maritime safety ond risk analysis stage, which is supplemented with a global strength of evidence assessment. The frame-
Risk analysis evaluation work is applied to a case study of oil spill from tanker collisions, aimed at response capacity planning and
ecological risk assessment. The BN-model is a proactive and transferable tool for assessing the occurrence
of various spill sizes in a sea area. While the case study uses evidence specific to the Gulf of Finland, the
model and risk analysis approach can be applied to other areas. Based on evaluation criteria and tests for
the risk model and risk analysis, it is found that the model is a plausible representation of tanker collision
oil spill risk.
Ó 2015 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license
(http://creativecommons.org/licenses/by-nc-nd/4.0/).
1. Introduction given a more prominent role than in the current state of the art in
the application area. Specific attention is given to the risk-theore-
In risk research, there is a recent focus on foundational issues. tical basis (risk concept, perspective and use of risk analysis in
Calls have been made for devising risk analysis frameworks, focus- decision making), and to the tools for analyzing uncertainties and
ing on issues such as how to understand and describe risk, and how biases beyond the model-based quantification. Bayesian Networks
to use risk analysis in decision making (Aven and Zio, 2014). Fur- are applied as a modeling tool.
thermore, there have been calls for devising methods for commu- Subsequently, the framework is applied to a case study involv-
nicating uncertainty in risk analysis (Psaraftis, 2012). ing the oil spill risk from tankers in a ship–ship collision, aimed at
In the maritime transportation application area, some theoreti- providing insight in the possible occurrence of given spill sizes in
cal frameworks exist, e.g. based on system simulation (Harrald this accident type in a given sea area. Such information is useful
et al., 1998), traffic conflict technique (Debnath and Chin, 2010) for response capacity and fleet organization planning (COWI,
and Bayesian Networks (BNs) (Montewka et al., 2014a). Recent 2011; Jolma and Haapasaari, 2014; Lehikoinen et al., 2013) and
research has however shown that a wide range of definitions, per- for assessing the risk of biological impacts of oil spills (Lecklin
spectives and approaches to risk analysis co-exist, whereas typical- et al., 2011).
ly little or no attention is given to risk-theoretic issues in While major oil spills from tankers are rare occurrences, the
applications. Furthermore, uncertainty typically is not considered transportation of oil remains one of the main concerns for the var-
(Goerlandt and Montewka, 2015). ious stakeholders in marine environmental protection (Dalton and
In light of the above, this paper introduces a framework for risk Jin, 2010). This is due to their potentially major impact on marine
analysis of maritime transportation systems, where uncertainty is ecosystems (Bi and Si, 2012), important socio-economic impacts
on communities dependent on coastal resources (Garcia Negro
⇑ Corresponding author. Tel.: +358 9 470 23476; fax: +358 9 470 23493. et al., 2009; Miraglia, 2002) and high acute costs involved in
E-mail address: floris.goerlandt@aalto.fi (F. Goerlandt). clean-up operations (Montewka et al., 2013). Oil spills in harbor
http://dx.doi.org/10.1016/j.ssci.2015.02.009
0925-7535/Ó 2015 The Authors. Published by Elsevier Ltd.
This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
F. Goerlandt, J. Montewka / Safety Science 76 (2015) 42–66 43
approaches or in narrow shipping waterways can also lead to a 2.2. Risk perspective: how risk is described
blockade, which can incur high costs to the world economy (Qu
and Meng, 2012). Thus, adequate accident prevention measures Understanding risk as above, a risk description is a reflection of
(Hänninen et al., 2014; van Dorp and Merrick, 2011) and oil spill a mind construct of analysts and experts (Aven and Guikema,
preparedness planning are important to enhance maritime safety 2011; Rosqvist, 2010; Watson, 1994), which may be more or less
and for marine environmental protection (IMO, 2010; Taylor intersubjectively objective (Aven, 2010b). There is no reference to
et al., 2008). an underlying ‘‘true’’ risk, opposed to other risk description frame-
Several methods and analyses have been proposed for assess- works, such as the one presented by Kaplan (1997). In this section,
ing the oil spill risk from shipping activities in a sea area. Lee the systematic manner to describe risk, i.e. the risk perspective, is
and Jung (2013) combine historic data with qualitative risk outlined.
matrices for ranking likeliness and consequences. Quantitative It is well-established that in the complex, distributed maritime
methods for analyzing oil spill risk include event-trees and transportation system, knowledge is not equally available about all
traffic flow theory or system simulation combined with ship parts of the system (Montewka et al., 2014b; Yan et al., 2014).
collision damage modeling or accident statistics (Akhtar et al., Relying on poor evidence may lead to erroneous conclusions and
2012; COWI, 2011; Gucma and Przywarty, 2008; Li et al., misguided decisions, e.g. about risk acceptability or the choice
2012; Montewka et al., 2010b; van Dorp and Merrick, 2011). between risk control alternatives. Because scientists have the
The work presented in this paper extends this literature by responsibility to consider the consequences of error (Douglas,
presenting a ship–ship collision oil spill risk analysis based on 2009), uncertainty has a central role in the current framework.
a Bayesian Network model. Moreover, in many analysis and modeling contexts, it is
This paper is organized as follows: In Section 2, a descrip- unavoidable to make simplifying assumptions which lead to con-
tion of the applied understanding of the risk concept and the servative or optimistic biases in the analysis (Vareman and
adopted two-stage risk perspective is given. A reflection is Persson, 2010). Such assumptions ultimately rely on value judg-
made on the intended use of the risk analysis. In Section 3, ments (Diekmann and Peterson, 2013; Wandall, 2004). Because
the methodological basis for the risk analysis framework is such value judgments may not be acceptable to all stakeholders
briefly outlined, focusing on the tools applied to describe risk. (Hermansson, 2012), their effect is considered in the framework
In Section 4, the case study to which the risk analysis frame- through considering biases.
work is applied is introduced. The first risk analysis stage for Another issue is that the information presented to stakeholders
the case study is presented in Section 5, and the second stage and decision makers should be interpretable, i.e. it should be pos-
in Section 6. In Section 7, a discussion is given on the evalua- sible to explain what the presented numbers and descriptions
tion of the results, both concerning the risk model and the risk mean (Aven, 2011a).
analysis as such. The utility of the tools for contextualizing the Based on the above, the current framework applies a two-stage
risk quantification is discussed in Section 8, and Section 9 con- risk description, as illustrated in Fig. 1. The general method and
cludes. For reasons of brevity, much of the data and models perspectives for analyzing risk is presented in the following sec-
underlying the risk model and analysis is presented in tions. The intended use of the risk analysis in decision making is
Appendices. discussed in Section 2.3. The methodological aspects of the tools
for analyzing risk are presented in Section 3.
2. Framework for risk analysis: risk-theoretic foundations

2.2.1. Stage 1: Quantitative risk modeling with extended uncertainty/
Risk analysis is an established tool for informing decisions.
bias evaluation
However, there are many different views on what risk is and
In the first risk analysis stage, case-specific background knowl-
how to define it (Aven, 2012; Hampel, 2006), how to measure/
edge is established. This concerns data, information, models and
describe it (Aven, 2010a; Kaplan, 1997), and how to use risk
judgments and is conditional to a decision context, which sets lim-
analysis in decision making (Apostolakis, 2004; Aven, 2009).
its to the available resources (time, money, expertise) and may act
Therefore, this section provides a brief overview of the adopted
as a guide to selecting conservative or optimistic modeling choices
conceptual understanding of risk, which systematic perspective
(Vareman and Persson, 2010).
is taken to describe risk and how to use the risk analysis results
Using the evidence, a risk model is constructed to quantify risk,
in decision making.
using the established background knowledge. This is supplement-
ed with an extended qualitative assessment of uncertainties and
2.1. Risk concept: how risk is understood biases. Together with a sensitivity analysis, model variables for
which to prioritize alternative hypotheses are identified and their
Many definitions of the risk concept exist, involving con- effect quantified using the risk model. The effect of assumptions
stituents such as probability, uncertainty, possibility, events on the quantitative risk results is finally qualitatively assessed.
and/or consequences (Aven, 2012; Hampel, 2006). In the current The perspective applied in the first stage of the risk analysis is
application, risk is understood as referring to the possible but based on a combination of the precautionary perspective
uncertain occurrence of a situation where something of human (Rosqvist and Tuominen, 2004) and the uncertainty-based per-
value is at stake. The terminological diversity of risk has philo- spective (Aven, 2010a; Aven and Zio, 2011; Flage and Aven,
sophical roots, with opposing views on the nature of risk rooted 2009). In the precautionary perspective, frequentist probability Pf
in realism or constructivism (Shrader-Frechette, 1991). In the and subjective probability Ps are used to describe events and con-
current understanding, risk is not considered a reality existing sequences. This is supplemented by a qualitative assessment of
in itself, but a construct shared by a social group, informed by model biases B, i.e. whether conservative or optimistic modeling
available evidence (Aven and Renn, 2009; Thompson and Dean, choices are made. In the uncertainty-based perspective, the occur-
1996). It is thus not a physical attribute of a system, existing rence of events and consequences is quantified using subjective
by itself, but a concept attributed to a system in the mind of probabilities Ps. Structural uncertainty is quantified using alterna-
an assessor (Goerlandt and Montewka, 2015; Solberg and Njå, tive hypotheses in the model construction UAH and/or through a
2012). qualitative assessment of uncertainties UQL.
44 F. Goerlandt, J. Montewka / Safety Science 76 (2015) 42–66
Fig. 1. 2-Stage framework for risk analysis: methods and perspectives.
The elements of the adopted risk perspective can be summa- tion to select the proposed decision, see e.g. Kaplan (1997). Exam-
rized as follows (where ‘‘’’ signifies ‘‘is described by’’) ples of such views on risk analysis in the context of maritime oil
spills are found in e.g. Klanac and Varsta (2011) and Lehikoinen
R1 ðC; E; Sf ; Pf ; Ps ; U AH ; S; Ev QL ; BjBKÞ ð1Þ
et al. (2013).
The focus is on consequences C, the occurrence of which is con- The framework presented here does not focus on the probabil-
ditional to events E. Instead of focusing on the events per se, their ities per se, i.e. these are not used to ‘prove’ that the risk is accept-
occurrence can also be described through a set of situational fac- able or that a certain risk management action should be performed.
tors Sf. As measurement tools, frequentist and subjective probabil- The aim is rather to concisely communicate evidence from analysts
ities Pf and Ps are used. Uncertainties and biases underlying the risk and experts to decision makers, which is used further in a broad
model construction are qualitatively assessed using an evidence decision making process (Aven, 2009), where other aspects rele-
assessment scheme (EvQL and B). Together with a sensitivity analy- vant to the decision, e.g. the availability of resources and strategic
sis S on the probabilistic risk model, this evidence assessment is or socio-economic concerns are considered. Thus, risk analysis is
used to select alternative hypotheses in the risk model, the effect understood as risk-informed, not risk-based (Apostolakis, 2004).
of which are quantified using the risk model (UAH). The risk analy- This follows from the envisaged functions of the risk model con-
sis is conditional to a specific background knowledge BK, which structed in the first risk analysis stage, namely to (i) convey an
consists of data, information, models, judgments and assumptions. argumentation based on available evidence, (ii) provide a basis
for communication between stakeholders, and (iii) serve as an
2.2.2. Stage 2: Deliberation, judgment-based quantification and aid to thinking. Such functions are acceptable for non-predictive
qualification based on results obtained from Stage 1 models (Hodges, 1991). Thus, the risk model does not in itself lead
In the second risk analysis stage, the information obtained from to a risk characterization, but is essentially connected with the
the first stage is used to quantify the uncertainty about the occur- qualitative evidence and assumption effect assessments. The pur-
pose of these qualitative assessments is to moderate the argument
rence of consequences C using interval probabilities P s and Ps and a
made by the risk quantification using the model, and to provide
qualitative assessment of the underlying evidence UQL:
transparency about the risk analysis and its underlying evidence,

R C; Ps ; Ps ; U QL jR1 ð2Þ which are key aspects of risk-informed decision making (Aven,
2011b; Watson, 1994).
The probability interval ½PS ; Ps is a judgment of a (group of) The first risk analysis stage leads to a quite elaborate charac-
expert(s), expressing imprecision regarding the uncertainty about terization, which aims to provide full transparency about the risk
the occurrence of consequences C. These can be interpreted by ref- analysis. One possible challenge of this extensive assessment is
erence to an uncertainty standard, i.e. as a lower and upper bound that decision makers may in practical settings not have time to
of the degree of belief of drawing a particular ball from an urn go through all the material. Hence, the primary intended users of
(Aven, 2011a; Lindley, 2006). These judgments are based on the the first analysis phase are a panel of expert-reviewers, such as
evidence as obtained from the first risk analysis stage, in particular the FSA1 Expert Group in IMO2 decision making (Psaraftis, 2012).
the probabilistic results including the quantitative uncertainty The second risk analysis stage provides a simplified and concise
bounds using the alternative hypotheses, the qualitative evidence insight in the risk and the strength of evidence, as a kind of summary
assessment and the assumption effect assessment. of the findings of the first stage. Thus, the intended users of this ana-
lysis phase are the actual decision makers, who likely do not have
2.3. Use of risk analysis in decision making the expertise nor the time to review the complete risk analysis.
An important issue is how the risk analysis is meant to be 3. Framework for risk analysis: methodological aspects
applied in decision making. Some frameworks use risk analysis
as a tool for calculating probabilities, which are compared with a In this section, the methodological aspects of the framework of
risk acceptability criterion for making the decision in a quasi-auto- Fig. 1 are presented, i.e. the tools for measuring risk. The following
matic manner, see e.g. de Rocquigny et al. (2008). Other frame-
works codify the value judgments over the outcomes through a 1
FSA: Formal Safety Assessment.
utility function, and may apply a form of mathematical optimiza- 2
IMO: International Maritime Organization.
items are addressed concerning the first risk analysis phase: (i) applied. A sensitivity function is defined which describes a specific
Bayesian Networks as a tool for propagating uncertainty, including risk metric RM as a function of the parameter z = p(RM = RMi|p),
its functionality for parameter sensitivity analysis, (ii) the alterna- where RMi is one state of the risk metric, and p is a combination
tive hypotheses approach for accounting for epistemic uncertainty, of states for the parent nodes of RM. For a network with no obser-
(iii) the method for qualitatively assessing the evidence base, (iv) vations on any of the network variables, a linear sensitivity func-
the procedure for selecting alternative hypotheses and (v) the tion is found:
method for assessing the effect of assumptions on the model out-
put. For the second risk analysis phase, the method for global RMðzÞ ¼ u1 z þ u2 ð4Þ
uncertainty evaluation is shown.
where the constants u1 and u2 are identified based on the model.
3.1. Bayesian Networks The first derivative of the sensitivity function at the base value
describes the effect of minor changes in the original parameter val-
Bayesian Networks are selected as a risk modeling tool as these ue on the value of the output, leading to a numerical sensitivity
have a number of favorable characteristics. BNs can contextualize value:
of the occurrence of specific consequences through situational fac-
tors, which represent observable aspects of the studied system. RM0 ðzÞ ¼ u1 ð5Þ
They furthermore allow integration of different types of evidence
through various types of probabilities and provide a means for per- The sensitivity of a BN-variable V on the risk metric RM is con-
forming sensitivity analysis. It is also rather straightforward to sidered by max|u1|.
incorporate alternative hypotheses in the model. Bayesian Net-
works are relatively widely used tools for risk modeling (Aven,
2008; Fenton and Neil, 2012). 3.2. Alternative hypothesis approach
3.1.1. Mathematical basis If the evidence base for a situational factor is poor and if alter-
BNs represent a class of probabilistic graphical models, defined as native plausible alternatives are available, one theoretical method-
a pair D = {G(V, A), P} (Koller and Friedman, 2009), where G(V, A) is ology to consider evidential uncertainty is to apply alternative
the graphical component and P the probabilistic component of the hypotheses (Zio and Apostolakis, 1996). The rationale can be sum-
model. G(V, A) is in the form of a directed acyclic graph (DAG), where marized as follows. Consider EBi one alternative from the evidence
the nodes represent the variables V = {V1, . . ., Vn} and the arcs (A) base. Conditional to EBi, probabilities for a situational factor Sf are
represent the conditional (in)dependence relationships between derived: Pi(Sf|EBi), for i = 1, . . ., n. These probabilities are weighed
P
these. P consists of a set of conditional probability tables (CPTs) using subjective probabilities pi, with ni pi ¼ 1. Weighed probabil-
P(Vi|Pa(Vi)) for each variable Vi, i = 1, . . ., n in the network. Pa(Vi) ities are obtained as follows:
signifies the set of parents of Vi in G: Pa(Vi) = {Y 2 V|(Y, Vi) 2 A}.
Thus: P ¼ fPðV i jPaðV i ÞÞ; i ¼ 1; . . . ; ng. A BN encodes a factorization X
n
P¼ Pi ðSf jEBi Þpi ð6Þ
of the joint probability distribution (JDP) over all variables in V: i
Y
n
Thus, the effect of alternative hypotheses on the probabilities
PðVÞ ¼ PðV i jPaðV i ÞÞ ð3Þ
i¼1
over the consequence space can be quantified, providing insight
in the stability of the results in light of uncertain evidence.
3.1.2. Interpretation of BNs in context of risk analysis

In the risk analysis, the variables V may represent the events E, 3.3. Qualitative multi-criteria evidence assessment
situational factors Sf, the consequences C, the nodes for weighing
the alternative hypotheses AH and the risk metrics AR. The arcs The qualitative assessment of the evidence base, which commu-
A represent the relations between these. The CPTs for the situation- nicates which elements of the model are based on strong or poor
al factors Sf are derived from the evidence base. These consist of evidence, is performed using an adapted version of a method pro-
frequentist probabilities Pf if a population of similar conditions posed by Kloprogge et al. (2011). Various aspects of each data
can be meaningfully defined and if the knowledge base contains source or model are rated by an assessor using a qualitative scale,
data or models from which relative frequencies can be calculated, as shown in Table 1. The ratings range from 1 to 5, with interme-
and of subjective probabilities Ps if these are judgments by an diate values for conditions between the extremes. These are sub-
assessor (Aven and Reniers, 2013). Thus, Pf can be understood to jective judgments by an assessor. They are intended to
describe aleatory uncertainty, representing the inherent variation contextualize the quantitative argument put forward by the risk
in a system. Ps can be understood as a degree of belief, a measure model, increasing the transparency about its evidence base. The
of epistemic uncertainty, which results from lack of knowledge assessment also has a role in prioritizing the selection of alterna-
(Faber, 2005). The CPTs for AH are based on judgments of an asses- tive hypotheses.
sor, and are best understood as a weight of credibility of a model to Three types of evidential characteristics are considered. First,
appropriately reflect the underlying mechanisms the model the knowledge dimension addresses how strong the evidence base
attempts to cover (Aven, 2010c). is, and concerns the quality, completeness and amount of available
data and the empirical adequacy and theoretical viability of mod-
3.1.3. Sensitivity analysis els. Second, the influence of value-laden choices is considered
The purpose of a sensitivity analysis is to investigate the effect through evaluating the direction of bias, assessing how conserva-
of changes in the assigned probabilities of the network variables on tive or optimistic the model output is compared with its unknown
the probabilities of a specific outcome variable. In a one-way sen- true value. Third, the contextual dimension considers the choice
sitivity analysis, every conditional and prior probability in the net- space and the influence of contextual limitations on the modeling
work is varied in turn, keeping the others unchanged. A sensitivity- choices made by the analyst. These characteristics are interpreted
value approach presented by Coupé and van der Gaag (2002) is as in Table 1.
Table 1 account for all assumptions by considering alternative hypotheses.

Assessment scheme for evidence qualities. In the current risk perspective, assumptions have a prominent role.
Evidence base Score = 1 Score = 5 Considering the role of the risk model as a tool for argumentation, a
Data means of communication and a platform for thinking, assumptions
Quality High number of errors Low number of errors provide focal points in the deliberation about the results of the risk
Low accuracy of High accuracy of model as obtained from the first stage in the analysis. These
recording recording assumptions may relate to the relations between the model vari-
Low reliability of data High reliability of data
source source
ables, the parameterization of the probability tables underlying
Amount of data Little available data Much relevant data the variables or address factors not included in the model.
available The information obtained from an assumption effect assessment
Completeness High number of Low number of is used in the second stage of the risk analysis, through a delibera-
missing data fields missing data fields
tive process where it is assessed whether the assumptions are plau-
High level of Low level of
underreporting underreporting sible, and if not, how the risk model results would be affected.
To evaluate the influence of assumptions, an assessment
Models
Empirical validation No experimental Many different method is developed, adapting ideas presented by Aven (2013).
confirmation available experimental tests The assumption is evaluated by considering (i) the magnitude of
performed the deviation due to the incorrectness of the assumption, (ii) the
Existing experimental Existing experimental direction of this deviation, (iii) consequence range where the devi-
tests show large tests agree well with
ation has effect and (iv) the strength of justification for making the
discrepancy with model output
model output assumption assessment. A crude, qualitative assessment is applied
Theoretical viability Model expected to Model is expected to for these characteristics, see Table 2.
lead to poor provide good
predictions predictions 3.6. Global assessment of evidence
Bias The model leads to The model leads to
optimistic predictions conservative
compared with the predictions compared
In the second risk analysis stage, a global evidence assessment
real values with the real values accompanies the risk quantification. This is performed using a
All types
crude scheme proposed by Flage and Aven (2009). A direct grading
Contextual limitations Totally different BK The same BK would of the importance of the uncertainty is performed through a
would have been have been used, judgment of an assessor of four criteria. A justification for the
used, were more irrespective of assessment of each criterion can be provided. The strength of the
time/money/ available time/money/
evidence underlying the risk quantification can be visualized using
resources available resources available
Choice space Few alternatives Many alternatives a color code, with strong, medium and poor quality of evidence
available in BK available in BK represented by green, yellow and red. The assessment scheme uses
a classification as in the ‘‘strength of justification’’ of Table 2.
3.4. Evidence importance ranking and selection of alternative
4. Case study: introduction
hypotheses
The aim of the risk analysis is to provide insight in the possi-

As outlined in Section 3.2, alternative hypotheses can be includ-
bility of occurrence of oil spills from collisions with oil tankers.
ed in the risk model. Even though several authors have suggested
The focus is on how likely spills of certain sizes are expected to
this method (Aven and Zio, 2011; Zio and Apostolakis, 1996), no
occur. This information is useful for response capacity planning
guidance is provided as to which model elements to prioritize for
and response fleet organization as well as for assessing the biologi-
considering alternative hypotheses.
cal impacts of oil spills (COWI, 2011; Helle et al., 2011; Lehikoinen
In the current framework, this is done by tabulating the
et al., 2013).
strength of evidence and the direction of bias along with the
In the application presented here, the considered area is the
results of the sensitivity analysis performed on the Bayesian Net-
part of the Gulf of Finland covered by the GOFREP4 system and
work, as illustrated in Fig. 2. The interpretation of the ratings is
the Russian national VTS5 sector, see Fig. 3. This area contains most
shown in the figure as well, based on ideas presented in Flage
of the traffic in the area, as ships are required to follow the sea lanes
and Aven (2009) and Rosqvist and Tuominen (2004).
of the Traffic Separation Scheme (TSS). As the current response capa-
Situational factors with high sensitivity and low evidential sup-
city (30,000 tonnes) is based on a plausible worst case accident
port and/or strongly biased evidence (shown in red3) are consid-
(Jolma and Haapasaari, 2014), a precautionary decision maker is
ered more important from a decision maker’s point of view. This is
assumed. Thus, where required in the analysis, conservative assump-
because poor evidence can lead to poorly justified probability assign-
tions are preferred over optimistic ones.
ments, while the analysis outcome is sensitive to changes in the
parameterization. If biased variables significantly affect the outcome,
this is important to consider as the aggregate effect of various value 5. Case study: risk analysis stage 1
judgments may not be in line with stakeholder values. Thus, model
variables with high importance scores in Fig. 2 are prioritized for In this section, the first stage of the risk analysis framework pre-
selecting alternative hypotheses. sented in Sections 2 and 3 is shown for the case study.
3.5. Assessment of effect of assumptions 5.1. Bayesian Network model
In risk analyses, assumptions often constitute an important part The structure of the BN-model is defined in Fig. 4. The focus of
of the background knowledge, and it is typically not possible to the analysis is the collision consequence, i.e. the amount of oil
3 4
For interpretation of color in Fig. 2 and 4, the reader is referred to the web version GOFREP: Gulf of Finland reporting system.
5
of this article. VTS: Vessel Traffic Service.
Fig. 2. Evidence assessment scheme for selecting alternative hypotheses.
encounter speed, bow angle and loading condition) and tanker

Table 2
(length, width, mass, deadweight, encounter speed and loading
Assessment scheme for assumption effect.
condition). These situational factors are included as model vari-
Magnitude of deviation ables S Ef . In Fig. 4, the green nodes relate to variables of the encoun-
L Low Maximum plausible changes in base values result in
outcome changes less than an order of magnitude tering vessels, the light blue nodes of the tankers and the pink
M Medium Maximum plausible changes in base values result in nodes of the encounter conditions between both vessels.
outcome changes of about an order of magnitude The impact situation addresses the conditions under which tan-
H High Maximum plausible changes in base values result in
kers may collide with other vessels. As vessels typically perform
outcome changes of two orders of magnitude or more
evasive action prior to collision (Cahill, 2002; Wang et al., 2013),
Direction of deviation
impact conditions differ from conditions at encounter. Impact
+ Increase The deviations result in an outcome which is higher than
the risk model suggests
situations are described using a set of situational factors, condi-
± Increase/ The deviations result in an outcome which is higher or tional and/or additional to the encounter situational factors. These
decrease lower than the risk model suggests include both vessels’ impact speeds, the impact angle, the location
Decrease The deviations result in an outcome which is lower than of impact along the hull and the probability that the tanker is the
the risk model suggests
struck vessel. The occurrence of a collision where a tanker is the
Consequence range where deviation has effect struck vessel is also considered in the impact situation, conditional
L Low Deviations have effect in lower third of the consequence
to the occurrence of a collision and the event that the tanker is the
range considered in the quantification
M Medium Deviations have effect around the middle of the struck vessel. These situational factors are included as model vari-
consequence range considered in the quantification ables S If . In Fig. 4, these are the yellow nodes.
H High Deviations have effect in the upper third of the
Conditional to the impact conditions, a plastic deformation
consequence range considered in the quantification
B Beyond Deviations have effect beyond the maximum occurs in the contact area between the two vessels, resulting in
maximum quantitatively considered consequence range damage to the struck vessel’s hull. Depending on location and
Strength of justification extent of this damage, cargo or bunker oil tanks may be breached,
L Low All of the following conditions are met: resulting in a spill. The occurrence of a hull breach and subsequent
(a) Data is not available, or is unreliable
oil spill is the consequence C. In Fig. 4, alternative models for the
(b) The assertion is seen as unreasonable
(c) There is lack of consensus among experts
damage extent and spill are grouped in the orange node.
(d) The phenomena involved are not well under- The risk metric RM is the discrete probability distribution
stood; models are non-existing or are known/be- describing the occurrence of various spill sizes, indicated in dark
lieved to give poor predictions gray in Fig. 4. The model also contains alternative hypotheses,
M Medium Conditions between those characterizing low and high
denoted as model variables AH, indicated in light gray in Fig. 4.
strength of justification
H High All of the following conditions are met:
(a) A lot of reliable data is available
5.2. Outline of the evidence base
(b) The assertion is seen as very reasonable
(c) There is broad agreement among experts
(d) The phenomena involved are well understood; In this section, a brief outline is given of the evidence base used
existing models are known to give good to calculate or assess probabilities for the probability tables under-
predictions lying the Bayesian Network. This outline is made on a generic level,
focusing on the data and models required for the parameterization,
see Table 3. This is done for reasons of brevity and to make the pre-
spilled. The occurrence of a spill of a certain size is conditional to sented BN-model more accessible for possible users concerned
two situations: encounter and impact between vessels. with other sea areas.6 Reference is made to Appendix A, where the
The encounter situation addresses the conditions under which
tankers encounter other vessels in the area. This is described 6
One benefit of BNs is that the parameterization of the probability tables can in
through a set of situational factors, including the location of principle be done using different types of evidence. In particular, where data or
encounter in the sea area, direction of travel, encounter type, and models are not available to derive probabilities for a specific sea area, the probability
characteristics of the encountering vessel (ship type, length, mass, tables can be populated using knowledge-based probabilities Ps.
Fig. 3. Definition of the considered area, adapted from FTA (FTA, 2010).
Fig. 4. Structure of the oil spill risk BN-model, the labels next to the nodes refer to the sections where the supporting evidence is described.
BN-variables and their discretization is listed. Appendix B summa- 5.3. Qualitative multi-criteria evidence assessment
rizes the evidence applied in this case study, providing deeper
insight in the specific meaning of the required evidence and how The evidence is qualitatively assessed using the rating scheme
these are combined to derive probabilities. presented in Section 3.3. Results are shown in Tables 4 and 5. As
Table 3 an illustration of the feasibility of justifying the ratings, some

Outline of evidence underlying the BN model. examples of elements in the evidence are considered below. The
Factor group Required evidence (data, Ref. data and models referred to are more elaborately described in
Variable models) Appendix B.
Encounter situation – tankers (SEf ) The data assessment in Table 4 indicates that the data used for
V1 Tanker length AIS data, encounter detection B.1.1, describing the encounter situation is generally good. For instance,
method, alternative hypothesis B.1.3, the applied AIS data (D1) is very extensive: over 5 months of high-
B.2 resolution data is used, covering the entire study area. AIS data
V2 Tanker width Ship characteristics database B.1.3
quality has been mediocre in earlier years (Graveson, 2004), but
V3 Tanker mass Ship characteristics database, B.1.3,
tanker tank configuration B.1.4 has improved significantly (Felski and Jaskolski, 2013). For the
models bow angle of encountering vessels (D3), only very limited data is
V4 Tanker AIS data, encounter detection B.1.1, available. The quality is good, but it is based on a limited review
encounter method, alternative hypothesis B.2 of ship drawings. It is uncertain in how far this data is representa-
speed
V5 Tanker type AIS data, encounter detection B.1.3
tive to the vessels operating in the studied area. It would in princi-
method, cargo flow analysis ple be possible to repeat such a review of drawings for vessels in
V6 Tanker Ship dimensions database B.1.3 the area, i.e. there are alternative ways to gather evidence. Howev-
deadweight er, due to contextual limitations, this is not considered a high
V7 Tanker loading Cargo flow analysis B.1.3
priority.
condition
The data concerning the layout and size of the cargo tanks (D5)
Encounter situation – encountering vessel (SEf ) is considered extensive, of good quality and accurately reflecting
V8 Encountering AIS data, encounter detection B.1.1, the conditions in the studied area. However, there is only very lim-
vessel length method, alternative hypothesis B.2
V9 Encountering Ship characteristics database, B.1.2,
ited data for the bunker tanks available (D6), with low quality. As
vessel mass ship dimension regression B.1.3 this data is gathered for ships operating in the waters of the United
models States, it is not known in how far the bunker data is representative
V10 Encountering AIS data, encounter detection B.1.1, for vessels operating in the Gulf of Finland. However, the exact
vessel type method, alternative hypothesis B.2
bunker tank sizes are less important than the cargo tank sizes, as
(AIS)
V11 Encountering Cargo flow analysis B.1.1 the former concern the lower consequence ranges and because of
vessel type the crudeness of the applied discretization of the consequence
(detailed) variable, see Table 4. Thus, improving the bunker tank data is pos-
V12 Encountering AIS data, encounter detection B.1.1, sible e.g. by reviewing ship drawings, but this is not considered a
vessel method, alternative hypothesis B.2
encounter
priority to improve the analysis. This is generally the case for the
speed data: better data may exist, but priority for improving the analysis
V13 Encountering Cargo flow analysis B.1.2, lays elsewhere.
vessel loading B.1.3 The assessment of the applied models in the analysis shows that
condition
most models have not, or not extensively, been empirically validat-
V14 Encountering Ship characteristics database, B.1.2
vessel bow ship dimension regression ed, see Table 5. The model for the tank sizes (M5) has been com-
entrance angle models pared with a set of tanker designs typical for the Baltic Sea,
showing good agreement (Smailys and Česnauskis, 2006). The
Encounter situation – context (SEf )
V15 Area in Gulf of AIS data, encounter detection B.1.1,
regression model for mass of encountering vessels (M2) is also
Finland method, alternative hypothesis B.2 validated through application of statistical tests (Brown, 2002),
V16 Direction of AIS data, encounter detection B.1.1, with good agreement. For tankers, the model for tank sizes is
tanker travel method, alternative hypothesis B.2 applied to derive a mass, and is validated as mentioned above.
V17 Encounter type AIS data, encounter detection B.1.1,
The damage extent model (M6) is compared with a limited number
and classification method, B.2
alternative hypothesis of damage cases, indicating conservative damage estimates (Chen,
2000). This is mainly due to the application of the collision damage
Impact situation (SIf )
model to midship sections, whereas it is known that the hull struc-
V18 Encountering Accident data, expert judgment, B.3
vessel impact alternative hypothesis tural capacity near bulkheads is greater than near the midpoint
speed between bulkheads (Klanac et al., 2010).
V19 Impact angle Accident data, expert judgment, B.3 Most models are considered theoretically plausible for the aims
alternative hypothesis of the risk analysis. The encounter detection method (M1) requires
V20 Tanker impact Accident data, expert judgment, B.3
the specification of an inspection domain. Many choices are possi-
speed alternative hypothesis
V21 Impact location Accident data, expert judgment, B.3 ble, but the circular domain is considered reasonably plausible to
along struck alternative hypothesis derive the characteristics of vessels which tankers encounter in
tanker hull the area. The encounter type classification model (M3) is consid-
V22 Tanker striking Accident data, expert judgment, B.3
ered justified as it follows the rationale of the COLREGs.7 The statis-
or struck alternative hypothesis
V23 Tanker Accident data, accident B.4 tical damage extent model (M6) is based on damage cases calculated
collision underreporting studies AIS data, using a three degree of freedom time-domain simulation model
occurrence alternative hypothesis (Brown and Chen, 2002; van de Wiel and van Dorp, 2011). It is less
V24 Tanker as – B.4 accurate than state-of-the art models for ship design purposes
struck vessel
(Ehlers and Tabri, 2012), but because it explicitly accounts for the
Consequences – oil spills from damaged compartment (C) coupling of outer and inner dynamics, it outperforms decoupled
V25–V29 Oil spill mass Collision damage extent model, B.5,
approaches especially for non-perpendicular impacts (Tabri, 2010).
tank layout model, oil outflow B.1.3,
model, bunker tank layout B.1.4,
model, bunker tank size data, B.1.5
alternative hypotheses 7
COLREGs: Collision regulations, i.e. Convention of the International Regulations
for Preventing Collisions at Sea.
Table 4 5.4. Evidence importance ranking and selection of alternative

Assessment of qualities of data underlying the analysis, using the rating scheme of hypotheses
Table 1.
Characteristic D1 D2 D3 D4 D5 D6 D7 The parameter sensitivity analysis is performed on the BN with

Quality 4 5 4 4 5 1 5 the alternative hypotheses listed in Table A1 (Appendix A) set at
Amount of data 5 4 1 5 5 1 1 their most likely value, or at the first alternative for equiprobable
Completeness 4 4 2 4 5 1 5 cases. Application of the procedure in Section 3.1.3 shows that
Contextual limitations 5 5 3 5 5 4 5
Choice space 2 2 3 1 2 1 1
the model is most sensitive to changes in variables listed in Table 6.
It is seen that the model output is most sensitive to the probabil-
Label Data Section
ities assigned to the variables describing whether a collision
involving a tanker occurs, and whether it is the struck vessel. Fur-
D1 Data Automatic Information System B.1.1
thermore, the model is sensitive to the oil spill mass in the dam-
D2 Data from traffic flow analysis B.1.1, B.1.3
D3 Bow angle of encountering vessels B.1.2 aged tanks and to variables describing the struck tanker, in
D4 Loading condition oil tanker B.1.3 particular the deadweight, loading condition and impact location
D5 Tanker tank layout B.1.3 along the struck hull and impact angle. The output is somewhat
D6 Bunker tank size and layout B.1.5
sensitive to parent variables to these situational factors: the direc-
D7 Collision probability B.4
tion of tanker travel and the area in the Gulf of Finland affect the
loading condition and tanker length, whereas the tanker length
As many impact models lead to non-perpendicular impacts, see and width affect the tanker deadweight.
Table B7, this is a desirable model feature. The statistical meta-mod- The strength and bias of the evidential support are further
el for the damage extent is reported with a good statistical fit for the mapped in relation to the parameter sensitivity, providing insight
variables xi, based on an assessment of probability plots, which show in the importance of the weaknesses of the evidence base and
an overprediction of the damage sizes. The quality of the regression the priorities of evaluating the effect of alternative hypotheses on
models of Eq. (B7) and Eq. (B8) is good with reported R2-values of the quantitative results. This is performed in Fig. 5, for a precau-
70.6% for yL and 73.6% for yT and also the model for the damage tionary decision maker (i.e. preferring conservative modeling
direction h is reported with good statistical fit with the damage cases choices over optimistic ones). For each variable, it is considered
reported by NRC (2001). However, the damage extent model is based which data and/or models underlie the probability assignments,
on a limited number of ship designs, whereas it is known that the as indicated in the graphical BN-representation of Fig. 4. This in
specific structural design of the struck ship’s hull has an influence turn is used to inspect the evidence assessment scores in Tables
on the collision damage (Hogström, 2012; Klanac et al., 2010). More- 4 and 5, from which a rating of low, medium or high strength of
over, the damage extent model does not account for yaw and sway evidential support is obtained as in Fig. 2. Similarly, the ratings
velocities at the moment of impact, even though it is known that of the evidence base lead to a rating in terms of conservative, neu-
these affect the collision energy (Ståhlberg, 2010) and damage tral or optimistic bias underlying the variable parameterization.
extent (Wiśniewski and Kołakowski, 2003). The oil spill model The rather rough assessment indicates that the overall risk ana-
(M7) is very crude. The assumption that all oil is spilled is plausible lysis is based on reasonably good evidence, but that for some
if the tanker is struck near and below the waterline. However, for important parts of the model, the evidence is relatively poor. It is
double hull tankers, the ballast tank will retain some oil and depend- also evident that most of the model elements are value-neutral,
ing on the opening size and damage height, the duration of the oil and that conservative choices lead to an overall conservative mod-
outflow can take several hours or even days. Hence, not necessarily el bias. The following variables should be prioritized for evaluating
all oil from a tank is spilled (Tavakoli et al., 2010). This supports the alternative hypotheses: tanker collision occurrence (V23), tanker
assessment that M7 is conservative, i.e. that the actual oil outflow being striking or struck (V22), size of the oil spill conditional to
will be lower. impact (V28), tanker deadweight (V6), impact angle (V19) and
Both M6 and M7 are conservative models, which is acceptable impact location along tanker hull (V21). Alternative hypotheses
for precautionary decision-making. However, their conservative- for following variables are less important, but can still be consid-
ness precludes a more detailed insight in the oil spill sizes. Consid- ered: tanker length (V1), tanker mass (V3), area in GoF (V15), direc-
ering the assessment of the contextual limitations, it is thus found tion of tanker travel (V16), models for oil spill mass (V25, V26 and
most beneficial to use more detailed damage extent models (M6) V27) and the impact speeds of encountering vessel (V18) and tanker
and oil outflow models (M7) to improve the analysis. (V20). For these variables, alternative hypotheses are defined in the
preceding sections. Their effects on the risk quantification are con-
Table 5 sidered in Section 6.1.
Assessment of qualities of models underlying the analysis, using the rating scheme of
Table 1.
5.5. Assumption effect assessment
M1 M2 M3 M4 M5 M6 M7
Empirical validation 1 3 1 1 3 2 1 An assumption assessment is performed in Table 7 using the
Theoretical viability 3 3 5 2 4 3 2 method of Section 3.5, to assess how stable the risk quantification
Bias 3 5 3 3 3 5 5 is with respect to assumptions made in the risk model construc-
Contextual limitations 5 3 5 4 5 1 1
tion. The use of the assumption assessment in the risk analysis
Choice space 5 2 3 5 1 3 3
can be understood by recalling the functions of the risk model as
outlined in Section 2.3, especially the function to serve as an aid
Label Model Section
to thinking. Uncertainties and biases in the evidence (i.e. underly-
M1 Encounter detection model B.2
ing the risk model construction) as well as uncertainties in the
M2 Encounter vessel mass model B.1.2
M3 Encounter type classification model B.2
relation between the risk model and the space of possible out-
M4 Models for collision impact variables B.3 comes are considered. Hence, the assumption effect assessment
M5 Tank volume model B.1.4 acts as a focal point to discuss the risk quantification of the first
M6 Collision damage model B.5.1 risk analysis stage, assisting the deliberative judgment leading to
M7 Oil spill model B.5.2
an uncertainty quantification in the second risk analysis stage,
data is in itself not very informative, as the context of the system

operation has changed since the accidents occurred, and is likely
to change also in the future. In recent years, there is more focus
on tanker safety, with the tanker industry investing in extensive
safety assessment programs (OCIMF, 2008). Moreover, various
technological innovations such as on-line collision avoidance sup-
port (Mou et al., 2010), electronic communication of intended
routes (Porathe et al., 2013) and enhanced navigation support ser-
vices (Hänninen et al., 2014) can positively affect navigation safety.
On the other hand, increase in traffic volume increases the number
of vessel encounters and thus number of opportunities for a colli-
sion to result. Based on the above, it is considered likely that the
collision occurrence is overestimated in the risk model.
Assumption 10. Only mechanical impact is considered as a

consequence.
The risk model only considers oil outflow as a direct result of

the mechanical damage to the hull. While there is little evidence
available, some collision analyses account for the occurrence of fire
and/or explosion caused by the collision (Klanac and Varsta, 2011)
and for ship capsizing and sinking (IMO, 2008). This is not account-
ed for in the current risk model, but has the potential to lead to
spill sizes beyond the maximum considered spill range, possibly
leading to important deviations from the model-based risk picture
of Fig. 6.
Fig. 5. Qualitative importance ranking of evidence uncertainty and bias for risk
model variables, variable notations see Appendix A.
5.6. Risk quantification based on BN-model
see Fig. 1. Some assumptions are rated and discussed below, to
The BN model results in a risk metric which combines the annu-
illustrate the rationale of assumption assessment scheme.
al collision probability in the considered area with the potential
spill sizes in case of an accident, through the BN-variable ‘‘prob-
Assumption 1. The traffic composition is taken as 2011 baseline.
ability of oil spill’’. The results of this analysis are shown in Fig. 6.
The data for describing the traffic configuration in the area is The influence of alternative hypotheses is considered by
taken to provide good evidential support, see Table 4, but it dates evaluating the model response for a set of test cases, shown in
from 2011 and may not be fully descriptive of future traffic condi- Appendix C. First, each hypothesis is altered in turn, keeping the
tions. More tanker traffic is expected in the Gulf of Finland, espe- other hypotheses at their base value, with the weights for the alter-
cially due to developments in Russian oil terminals (Brunila and native hypotheses summarized in Appendix A. In these test cases,
Storgård, 2012). This may affect the number of large tankers oper- the most conservative (leading to highest risk quantification) and
ating in the area, which in turn affects the distribution of tanker most optimistic (leading to lowest risk quantification) alternative
lengths and deadweights. While it is quite certain that more large hypotheses are applied. Finally, the extreme bounds for the mod-
tankers will operate in the area, it is uncertain to what extent this el-based risk quantification are identified by setting all hypotheses
will affect the size distribution: no studies on this issue are known. first to their most conservative and then to their most optimistic
The deviation from this assumption is taken to be relatively mod-
Table 7
est, likely leading to an increase of the risk metric in the medium- Assessment of effect of assumptions on risk quantification.
higher range of the quantification.
A1 A2 A3 A4 A5 A6 A7 A8 A9 A10
Assumption 3. Operating conditions remain as in 2011 baseline. Magnitude of L L L– L L L L L– L M

deviation M M
The data assessment in Table 4 highlights that there is very lit- Direction of + ± ± ± ± + +
tle data for assigning a probability of collision occurrence. deviation
Uncertainty about this thus is high. Moreover, the historic accident Consequence M– L– L– L L– L– L– L– L– L–B
range H H H H H H H H
Strength of L M L– M– H M– M M– L L
Table 6
justification M H H H
Results of sensitivity analysis, variable notations see Appendix A.
Variable max|u1| Variable max|u1| Label Description Appendix

V24 Tanker as struck 0.2811 V21 Impact location along 0.0050 A1 Traffic composition is taken as 2011 baseline B.1.1
vessel struck tanker hull A2 Collision probability is equal for all encounters B.2, B.4
V23 Tanker collision 0.1456 V19 Impact angle 0.0034 A3 Operating conditions remain as in 2011 baseline B.1.1, B.4
occurrence A4 Bunker capacity and arrangement are representative for B.5.2
V28 Oil spill mass in 0.0187 V16 Direction of tanker 0.0015 all ships of size class
damaged tanks travel A5 Oil density is 0.9 tonne/m3 B.5.2
V6 Tanker 0.0098 V15 Area in GoF 0.0009 A6 All cargo tanks and ballast tanks in cargo area have equal B.1.4
deadweight length
V22 Tanker striking or 0.0077 V1 Tanker length 0.0006 A7 Accidents are underreported at a 20% rate B.4
struck A8 All oil is spilled from a breached tank B.5.2
V7 Tanker loading 0.0051 V2 Tanker width 0.0003 A9 All non-tanker encountering vessels are fully laden B.1.2
condition A10 Only mechanical impact is considered as consequence B.5
Fig. 6. Results from the risk model, alternative hypotheses as in Appendix C (risk analysis stage 1) and the uncertainty intervals (risk analysis stage 2), with evidence
assessment as in Section 3.6.
values. The model response for these test cases is shown in Fig. 6 model suggests, while the second uncertainty interval results in a
using summary statistics (median, quantiles, minima and maxima). higher oil spill risk than suggested by the risk model.
It is seen that the risk quantification is relatively stable in
regards the general trend, despite the fact that alternative
hypotheses can result in important changes in the risk metric, of 6.2. Application of risk analysis results in risk-informed decision
just over an order of magnitude. This is in line with expectations, making
as various alternative hypotheses may lead to significantly differ-
ent oil outflows, e.g. the impact angle (AH 5) and the damage The risk analysis results can be used to inform a decision. As out-
extent model (AH 8 and AH 9). lined in Section 2.3, the results should be seen in a wider decision-
However, the analysis indicates some general trends, which are making setting, where other issues such as costs and societal con-
stable despite the uncertainty. According to the model, spills in the cerns are taken into account, e.g. in terms of the urgency of environ-
range lower than 10,000 tonnes have an occurrence probability mental protection. Hence, the oil spill risk from tanker collisions as
between ca. 4 103 and 1 102. Spills up to 20,000 tonnes have resulting from the analysis can be used to update the knowledge
an occurrence probability of about 1 103, whereas spills over underlying models for environmental risks from oil spills (Lecklin
20,000 have a probability between 1 104 and 3 104. Spills over et al., 2011), for investigating the response fleet effectiveness in case
30,000 tonnes are very unlikely in the area, with a model-based of spills (Helle et al., 2011) and for determining the clean-up costs of
probability in the order of 3 106. It is stressed that in the current spills in a sea area (Montewka et al., 2013). One immediate use of the
framework, this quantification cannot be seen separate from the risk analysis results relates to the required response capacity for oil
underlying evidence base, the qualitative evidence assessment spills in the Gulf of Finland. Presently, a capacity of 30,000 tonnes is
and the assumption effect assessment. available according to Jolma and Haapasaari (2014).
First, the risk analysis suggests that the occurrence of any acci-
dental oil spill from tankers is unlikely, with an occurrence prob-
6. Case study: risk analysis stage 2 and risk-informed decision ability of any spill from tanker collisions of around 0.006. While
making this probability per se is not decisive in terms of the need for oil
response preparedness, an indication of the occurrence of acciden-
6.1. Deliberative judgment and global evidence assessment tal spills can be relevant in the context of broader societal decision
making for environmental protection. This can e.g. concern pri-
In the second risk analysis stage, the results of the model-based oritizing investments in measures for other sources of oil spills,
quantification (Fig. 6), the evidence assessment (Tables 4 and 5) such as more frequently occurring operational spills (Hassler,
and the assumption affect assessment (Table 7) are used to make 2011), measures for other types of pollution from maritime trans-
a judgment in terms of degrees of belief of the occurrence of cer- portation or other sources of marine pollution in general.
tain spill sizes. The uncertainty intervals are shown in Fig. 6, where Second, the analysis suggests that spills up to 30,000 tonnes may
a color code conveys information regarding the combined strength occur, but larger spills are very unlikely as far as only direct
of the evidence for making the judgments. Two uncertainty inter- mechanical damage is considered. Smaller accidental spills, up to
val series are shown. The intervals bounded by diamonds account about 10,000 tonnes, are more likely than larger spills. While the
for the model-based quantification, the evidence assessment and evidence on which these results are based is not very strong in cer-
assumptions A1–A9, which is considered medium strength of evi- tain aspects (see Fig. 5), the consideration of alternative hypotheses
dence. The intervals bounded by circles additionally account for indicates that the general trends are stable despite this uncertainty.
assumption A10, which concerns consequences beyond mechani- The results could be used to argue that the current response capa-
cal impact. As the evidence for these additional consequences is city is sufficient, or even that the current capacity is over-conserva-
poor, the total evidence for this uncertainty interval is medium- tive, as far as concerns tanker collisions. However, the analysis also
poor, and the uncertainty interval is wider. It is seen that the first highlights that considering further possible consequences such as
uncertainty interval leads to a lower oil spill risk than the risk fire, explosion and sinking due to collision could result in even larg-
Fig. 7. Evaluation tests and criteria for the two risk analysis stages, in relation to the risk analysis methods and perspectives, see also Fig. 1.
er spills. Evidence for this is however scarce and further analysis is struct and risk-theoretical validity tests. Second, the risk analysis
needed to reduce this uncertainty. qua risk analysis is evaluated using relevant criteria. The evaluation
One of the reviewers of an earlier version of the manuscript tests and criteria are shown in Fig. 7 in relation to the two defined
suggested discussing the risk analysis results in the context of risk stages for risk analysis. These criteria and tests are briefly further
acceptance criteria (RAC). Here, it should be noted that for oil spill outlined below: the reader is referred to the cited publications
risk, there are no currently agreed bounding values for the ALARP8 for more elaborate discussions.
regions for maritime oil spill risk in a cumulative consequence prob-
ability plot, as exist e.g. for loss of life (Papanikolaou, 2009). Cost-ef-
fectiveness criteria for risk-reducing measures have been proposed 7.1.1. Evaluation of the risk model
(Vanem et al., 2008), but numerical values for oil spill costs are As a reflection of a mind construct addressing possible conse-
not agreed upon (Psaraftis, 2012). Moreover, these would not be quences which may or may not occur, a direct comparison between
applicable as the current risk model and analysis do not include the risk model results and observations from the described system
risk-reducing measures (a limitation of the case study, not of the is not possible. In the considered area, no accidental oil spills from
framework). tankers have been reported during the period 1998–2014
On a more fundamental level, it has been argued that defining (HELCOM, 2014), so a comparison with historic data is likewise
RAC and evaluating that the calculated risk meets these criteria inconclusive. However, evaluation can be understood in a wider
is not required for managing risk. First, defining criteria does not sense than a comparison with observed data, by inspecting the
lead to more ethical risk management (Aven, 2007). Second, the model qua model. Such approaches are widely used in social science
introduction of pre-determined criteria may give a wrong focus, research (Trochim and Donnely, 2008), system dynamics modeling
i.e. meeting these criteria rather than obtaining overall good and (Forrester and Senge, 1980) and for expert-based Bayesian Network
cost-effective solutions. Third, standard use of RAC presupposes modeling (Pitchforth and Mengersen, 2013). These model-related
that risk analyses can achieve an adequate precision level, which tests are only of interest in the first risk analysis stage, see Fig. 7.
can be questioned depending on the strength of the knowledge First, it is possible to evaluate whether the model adequately
base. Alternative decision making strategies exist, focusing on a operationalizes the construct it intends to measure, i.e. how well
broad assessment of risks, costs, public perceptions and other it concretizes the object of inquiry for the given purpose. This is
socio-economic concerns (Aven and Vinnem, 2005). The current evaluated in terms of face and content validity. Face validity (FV)
framework, which acknowledges the weaknesses in the evidence is a subjective, heuristic interpretation of whether the model is an
base and the judgmental nature of risk analysis, therefore does appropriate operationalization of the construct. Content validity
not apply RAC. Rather, the analysis results are used in a broader (CV) is a more detailed comparison of the elements in the risk mod-
risk evaluation in a managerial review and judgment, see e.g. el in relation to what is believed to be relevant in the real system.
Aven and Vinnem (2005). Second, a number of specific tests can be performed on the
model, to evaluate whether the model adequately meets certain
7. Discussion: evaluation of the risk analysis criteria. A behavior sensitivity test (BST) is used to assess to which
model elements the results are sensitive. The parameter sensitivity
7.1. Evaluation: method and criteria of a BN can be calculated as in Section 3.1.3, and the results can be
evaluated by domain experts. In a qualitative features test (QFT),
Validity concerns the question whether the analysis describes the model response is evaluated for a number of test conditions
the specific concepts one intends to describe, for its intended use in terms of a qualitative understanding how the system is believed
(Carmines and Zeller, 1979), whereas evaluation is a quality con- to respond under these conditions. In a concurrent validity test
trol process with the risk analysis as its object (Rosqvist and (CVT), the model elements are compared with the elements in
Tuominen, 2004). Two aspects are considered. First, the plausibility another model for a similar purpose. This can also include a com-
of the risk model as a tool for serving its envisaged functions in the parison with the output of such a model if the scope of the appli-
risk analysis is assessed. As introduced in Section 2.3, the model cations is the same.9
functions: (i) to convey an argumentation based on available evi-
9
dence, (ii) to provide a basis for communication and (iii) to serve More model evaluation tests have been proposed in the literature then the ones
as an aid to thinking. Its plausibility is evaluated using model-con- retained here, e.g. a dimensional consistency tests, boundary adequacy tests and
structure verification tests (Forrester and Senge, 1980). Which tests are considered
largely depends on the type of developed model. For the purposes of this paper, a
8
ALARP: As Low As Reasonably Practicable. limited number of relatively straightforward tests is retained.
The validity tests do not ‘‘prove’’ that the model results are cor- adequacy of the evidence base and the underlying assumptions,
rect, but only indicate the extent to which the model is a plausible as in Sections 3.3 and 3.5.
representation of the object of inquiry, serving functions (i) and (ii)
as outlined above. This relates to adopted understanding of risk
and the adopted risk perspective, where no reference is made to 7.2. Application of evaluation criteria to the risk analysis
an underlying ‘‘true’’ risk, see Section 2.2. The model should be
plausible enough to serve as a basis for further reflections, leading 7.2.1. Risk model evaluation tests
to deliberative judgments in the second risk analysis stage, see In terms of face validity, it can be found that the risk model is an
Fig. 7. adequate reflection of ship–ship collision oil spill risk. The
sequence encounter-impact-hull breach is a logical flow of events
for an oil spill to occur, and the elements describing these situa-
tions seem reasonable. Encounters occur between ships of certain
7.1.2. Evaluation of the risk analysis types and dimensions in certain locations and encounter types,
Following criteria are considered in the current framework, and at certain speeds and loading conditions. The situation at
based on work by Aven and Heide (2009) and Rosqvist and impact is somehow related to the encounter conditions, and
Tuominen (2004): aspects such as which is the striking and struck vessel, the impact
location, speeds and impact angle are known to affect the damage
V1: the degree to which the uncertainty assessments are size. The vessel size is related to the size of the oil tanks, and hence
complete. the possible spill sizes. Content validity can similarly be estab-
V2: the degree to which the bias assessments are complete. lished, by more carefully inspecting the adequacy of the elements
V3: the degree to which the assigned subjective probabilities of the model in relation to knowledge about the system. For rea-
adequately describe the assessor’s uncertainties of the sons of brevity, this is not elaborated upon here. Considering the
unknown quantities. comment made in Section 7.1.2 concerning the relation between
V4: the degree to which the analysis addresses the right CV and V1, the reader is referred to Sections 5.3 and 5.5, where
quantities. the evidence and assumption assessments are performed.
The behavior sensitivity test is performed using the method-
As illustrated in Fig. 7, V1 and V2 concern the uncertainty and ology described in Section 3.1.3, with results shown in Table 6. It
bias related to the limitations of the risk model to cover the scope is seen that the model output is mainly sensitive to changes in
of the possible outcome space, as well as the uncertainty and bias the parameters of the variables ‘‘Tanker as struck vessel’’, ‘‘Tanker
concerning the evidence for assessing probabilities in the model collision occurrence’’, ‘‘Oil spill mass in damaged tanks’’, ‘‘Tanker
construction. V1 also concerns the uncertainty judgments in the deadweight’’, ‘‘Tanker striking or struck’’, ‘‘Tanker loading condi-
second risk analysis stage, and the uncertainty in the evidence tion’’, ‘‘Impact location along struck tanker hull’’ and ‘‘Impact
for making these uncertainty judgments (i.e. the global evidence angle’’. It is found that the sensitivity of the model results to these
resulting from the first risk analysis stage). V3 is relevant in both variables is plausible: the oil outflow is clearly sensitive to the
risk analysis stages, and concerns whether appropriate elicitation occurrence of a collision, whether the tanker is striking or struck,
principles and procedures are followed to elicit the probability on the size of the tanker and its loading condition and on the
judgments. An elaborate discussion on this criterion is outside impact conditions which govern how many tanks are breached.
our current scope, for more details see Ayyub (2001) and The qualitative features test is performed for a number of test
O’Hagan et al. (2006). V4 addresses the question whether the ana- conditions, by selecting certain states of the BN-variables as inputs,
lysis focuses on fictional quantities (parameters of a model) or on and by inspecting the corresponding model response. This is illus-
observables (events, consequences of observable aspects of a sys- trated in Table 8, showing the test settings, the expected value of
tem). This last criterion thus relates to the interpretability of the the oil spill risk measure and a short assessment of the plausibility
risk analysis results, i.e. how easily the presented numbers and of the results. It is seen that the results indicate that the BN-model
information can be given a meaning, see also Aven (2011a). qualitatively follows the expected response.
It can be noted that the risk model evaluation criteria can be Concurrent validity can be tested by inspecting the structure
related to the evaluation of the risk analysis, especially to V1, the and content of models for similar problems to the one developed.
completeness of the uncertainty assessments. For example, an In Fig. 8, a number of models for oil spill risk is briefly reviewed,
evaluation of the content validity can assist in evaluating the focusing on structure (the logical sequence of events leading to
Table 8
Results from the qualitative features test for the BN-model of Fig. 4.
Variable State E (C/year) Plausibility assessment

Baseline Appendix A 29.8 –
Tanker length 100–120 7.7 Small tankers carry less oil than large ones, implying that a collision leads to smaller spills
240–260 66.1
Tanker encounter speed 4–8 18.2 Lower encounter speeds imply lower impact speeds and collision energy, smaller hull damages and
12–16 30.2 smaller spills
Tanker loading condition Laden 55.9 Laden tankers lead to bigger spills from cargo tanks. In ballast condition, only bunker tanks can lead
Ballast 1.3 to a spill
Impact angle 0–36 7.3 Oblique angles may inflict insignificant damage if vessels grind alongside, perpendicular impact
72–108 39.2 leads to damage
Impact location 0–20 12.9 In aft ship, impact does not lead to spill or to small bunker tank spills. In midship, spills from cargo
40–60 39.3 tanks are larger
Tanker striking or struck Striking 0 If the tanker is the striking vessel, no spills occur. Otherwise, spills occur
Struck 45.9
Damage extent model M1 31.6 By construction, M2 leads to smaller damages than M1 as more stringent limits are imposed on
M2 29.6 bulkhead breach
Fig. 8. Results from concurrent validity test for model structure and content.
Table 9
Comparison of concurrent validity (structure and content) for selected models.
Gucma and Przywarty (2008) van Dorp and Merrick (2011) Proposed risk model
Encounter AIS data AIS and environmental data AIS data
Traffic simulation model Traffic simulation model Encounter detection method
Alternative hypotheses
Collision occurrence Based on accident data Expert-based model Based on accident data
Accounts for underreporting
Alternative hypotheses
Impact not explicitly modeled Assumed relations between encounter Models linking encounter to impact
and impact Alternative hypotheses
Hull damage not explicitly modeled Meta-model based on coupled collision Meta-model based on coupled collision mechanics model
mechanics model Multiple tanker designs based on tanker data
Two tanker designs considered Alternative hypotheses
Oil outflow Based on accident data Cargo tank layout of two ships Cargo tank layout multiple ships
Bunker tank data Bunker tank data
Fig. 9. Results from concurrent validity test for model structure and content; for BN-model, the summary statistics are calculated for model output for test cases of Appendix
C.
Table 10
Advantages and drawbacks of the risk analysis tools.
Tool Benefits Drawbacks

Bayesian Network model Provides quantitative risk picture Does not distinguish well-supported from poorly
Sections 3.1 and 5.1 Integrates various sources and qualities of evidence (- evidenced probabilities
data, models, judgments) Development of expert-based BNs is resource-
Explicit treatment of uncertainty, including alternative intensive
hypotheses (AHs) Stable causal dependencies between system parts
Computationally efficient are to be identified or assumed
Allows sensitivity analysis Discretization leads to information loss
Focus on observable system aspects No support for modeling system feedback
Relatively accessible to non-experts
Evidence assessment Increases transparency of analysis Relatively crude
Sections 3.3 and 5.3 Easy to perform and use Quantity of ratings can obscure their relative
Shows strengths, weaknesses and biases importance
Acts as a guide for improving analysis
Evidence importance ranking and selection Visual representation of evidence strength and direction Relatively crude
of alternative hypotheses of bias Importance is relative to risk model, thus con-
Sections 3.4 and 5.4 Easy to perform and use strained by underlying choices
Highlights important model variables, for which AHs can
be applied
Alternative hypothesis approach Shows effect of conflicting evidence Utility constrained by quality of underlying
Sections 3.2 and 5.6 Insight in stability of risk quantification evidence
Relatively resource-intensive
Infeasible to consider all alternatives
Assumption effect assessment Provides insight in importance of assumptions for con- Relatively crude
Sections 3.5 and 5.5 sidered problem Utility constrained by understanding of analyst
Serves as a basis for discussion and further evidence team
gathering
Easy to perform and use
No constraints on data or models
Global evidence assessment Provides a global insight in the combined strength of evi- Relatively crude
Sections 3.6 and 6.1 dence for the risk quantification
Easy to perform and use
spills) and content of the models (which elements are considered models (IMO, 2003; Montewka et al., 2010b) have some serious
in analyzing the consequences). For reasons of brevity, not all mod- limitations to maritime transportation risk analysis as argued by
els are analyzed in detail in the comparison. Two models are briefly van de Wiel and van Dorp (2011), it is concluded from these tests
considered. that the proposed model is a more accurate reflection for the prob-
The models by Gucma and Przywarty (2008) and by van Dorp ability of different oil spill sizes in the Gulf of Finland then
and Merrick (2011) follow implicitly or explicitly the sequence of achieved by the earlier models.
events underlying the model presented in Fig. 4: encounter,
impact, hull damage and oil outflow. A brief comparison is made 7.2.2. Evaluating the risk analysis
in Table 9. It can be concluded that the presented model has sig- At the first stage of risk analysis, the criteria V1 and V2 are
nificant similarities to some other models in the literature, both addressed by performing the evidence assessment (Tables 4 and
in structure and content, while more thoroughly accounting for 5), the alternative hypotheses in the risk model (Figs. 4 and 6)
uncertainties through considering alternative hypotheses. As the and by the assumption effect assessment (Table 7). As found also
focus of the presented model is the magnitude of the conse- in Aven and Heide (2009), there is no guarantee that all uncertainty
quences, the impact, hull damage and tanker capacity is modeled is addressed. However, the assessments increase the transparency
in more detail than in most other oil spill risk models, whereas of the evidence base, and indicate the strength of the argument put
the level of detail in the collision occurrence is comparable to most forward by the risk model. Criterion V4 is met, as the probability
other oil spill risk models (Fig. 9). assignments focus on observable quantities of the maritime trans-
A final concurrent validity check can be performed by compar- portation system: the situational factors and events of Fig. 4 are
ing the outcome of the model with other information regarding oil observables in the maritime transportation system and in collision
spills. As mentioned in Section 7.1.1, no accident data is available accidents.
in the study area, so a comparison with spill data cannot be per- At the second stage of risk analysis, the uncertainty assessment
formed. Moreover, as the models mentioned above are applied to (V1) is performed by assessing the global strength of evidence, and
different sea areas, these cannot be used as a comparison either. by assessing degrees of beliefs over the outcome space based on
However, other models have been proposed for the Gulf of Finland, the global evidence, see Fig. 6. The analysis also focuses on observ-
where oil spill sizes where included. The distributions in Helle able quantities (V4), namely the spill sizes in collision accidents
et al. (2011) and Lehikoinen et al. (2013) cover both collision and with tankers.
grounding accidents, and show the probability of a spill of a certain Criterion V3 is difficult to verify: the subjective probabilities
size in case an oil spill occurs. The distributions are respectively used at the first stage (e.g. for BN-variables V18, V19 and V20, see
based on simple outflow models (IMO, 2003; Montewka et al., Table A1 in Appendix A) and probability intervals at the second
2010b), which only account for oil outflow due to mechanical dam- stage are assessor’s judgments. The principles and procedures pro-
age and do not take local traffic conditions into account. The results vided in Aven and Heide (2009) are followed to the extent possible
from the current model differ from the earlier results mainly by the in stage 2, but as the subjective probabilities in the first stage are
lower probabilities for the larger spill sizes, but a comparison is dif- obtained from the literature, no information is available on how
ficult as the analysis scope is not identical. As the simple outflow these are assessed.
8. Discussion: reflection on the methods for contextualizing risk List of symbols and abbreviations
In Sections 2 and 3, various tools have been introduced to quan- A arcs in BN

tify and highlight uncertainty, and to convey qualitative informa- AH set of alternative hypotheses in BN
tion beyond the risk model. These tools have been applied in AIS Automatic Identification System
Sections 5 and 6. Some reflections on the benefits and drawbacks ALARP As Low As Reasonably Practicable
of these tools are given in Table 10. For further discussions on AR risk metrics in BN
the advantages and challenges of Bayesian Networks, see B qualitative bias assessment/beyond maximum
Hänninen (2014) and Uusitalo (2007). BK background knowledge
The use of the various methods for contextualizing the risk BN Bayesian Network
quantification in the first risk analysis stage depends on the deci- BST behavior sensitivity test
sion context. For instance, in a particular application, it can be C consequence/conservative
decided not to perform the evidence importance ranking and the COLREGs collision regulations
alternative hypothesis approach, because this is relatively resource Ci volumetric coefficient
intensive. The tools for providing insight in the strength of the evi- CPT conditional probability table
dence and the effect of assumptions are less demanding, and can CT number of center tanks
also be used to contextualize the risk quantification. CV content validity
CVT concurrent validity test
9. Conclusion DAG directed acyclic graph
E event
In this paper, a framework for risk analysis for maritime trans- E set of events in BN
portation systems is proposed, following a two-stage procedure. At EBi alternative i in evidence base
the first stage, directed at an expert-review, a Bayesian Network EvQL qualitative evidence assessment scheme
model is constructed, providing a basis for communicating evi- FSA Formal Safety Assessment
dence and putting forward an argumentation based on this evi- FV face validity
dence. This is supplemented with broad evidence and G(V, A) graphical component of BN
assumption effect assessments, functioning as an aid to thinking GOFREP Gulf of Finland reporting system
beyond the model, qualifying the model-based argument. Sensitive H high
model elements are identified, and if possible, alternative hypothe- IMO International Maritime Organization
ses are applied to quantify the uncertainty within the BN model. JDP joint probability distribution
The second stage, directed at decision makers, consists of a delib- max|u1| maximum sensitivity value of BN-variable
erative judgment through assessing subjective probabilities. These L low
are informed by the results of the first analysis stage. A global LA distance from aft perpendicular to closest
qualitative evidence assessment conveys information regarding transverse cargo tank bulkhead
the combined strength of the evidence. Various tools have been LF distance from fore perpendicular to closest
proposed to highlight uncertainties and biases beyond the model, transverse cargo tank bulkhead
and their merits have been discussed. LT cargo tank length
The framework has been applied to a case study of spills from LBH longitudinal bulkhead positions
collisions with oil tankers in a given sea area, focusing on the LNG Liquid Natural Gas
possibility of occurrence of certain spill sizes. While the model M medium
is applied to the Gulf of Finland, the approach can be adapted Mbal ship mass in ballast condition
to any sea area, providing a proactive method for supporting Mlad ship mass in laden condition
decision making concerning oil spill risk. The evaluation tests MMSI maritime mobile service identity
indicate that the model is a plausible representation of the oil N neutral
spill risk, accounting for many factors found relevant also in NBT number of ballast tanks
other analyses. Model behavior and qualitative features tests also NCT number of cargo tanks
indicate the model’s plausibility. The evidence assessment shows O optimistic
that the model provides adequate decision support e.g. for spill P probabilistic component of BN
capacity planning, but that further improvements can be made Pa(Vi) parent nodes of BN-variable Vi
by more accurate modeling of the damage size and oil outflow, pi subjective weight, expressing credibility of model i
and by analysis of further consequences initiated by the collision to reflect underlying mechanism
event. Pf frequentist probability
The presented framework applies risk analysis only as decision Ps subjective probability
support, not to make firm recommendations or ‘‘optimized’’ solu- ½Ps ; P s probability interval lower and upper bound
tions about what should be done. In this, the framework differen- QFT qualitative features test
tiates itself from some other maritime risk analysis frameworks RAC risk acceptance criteria
and applications, by more explicitly and elaborately communicat- RM risk metric
ing and reflecting on the limitations of the risk quantification. It S sensitivity analysis
is hoped that the tools for treating uncertainty and bias can be fur- Sf situational factor
ther developed and applied also in other maritime risk analysis, Sf set of situational factors in BN
especially because earlier research has highlighted lack of uncer- S Ef BN-variables concerning encounter situation
tainty treatment in the application area, and lack of tools for
assessing uncertainty. (continued on next page)
S If BN-variables concerning impact situation ‘‘encountering vessel type (AIS)’’, see Section B.2. For evaluating the
damage extent, the half bow entrance angle of the encountering
ST number of side tanks
vessels is required, see Section B.5. Data for this angle is available
TBH transverse bulkhead positions
for container ships, bulk carriers and general cargo vessels. Based
TSS Traffic Separation Scheme
on a traffic analysis by Nyman et al. (2010), a proportion between
TT tank configuration type
these cargo vessels is obtained as shown in Table B2. This is used in
UAH quantitative uncertainty assessment using
the CPT for the variable ‘‘encountering vessel type (detailed)’’. For
alternative hypotheses
the tankers, only tankers with AIS classification ‘‘tankers – all
UQL qualitative assessment of uncertainty
types’’ are considered. Other AIS ship classifications include chemi-
V BN-variables
cal tankers and Liquid Natural Gas (LNG) tankers, which are not
VBT volume of ballast tank
further considered here.
VCT volume of cargo tank
Vi BN-variable/tank volume/risk analysis evaluation
B.1.2. Data related to encountering vessels
criterion
The model for evaluating the damage extent and oil outflow (Sec-
VTS Vessel Traffic Service
tion B.5) requires the vessel mass and the bow entrance angle g. The
yL collision damage length
latter parameter is obtained for the considered vessel types from an
yT collision penetration depth
analysis by Brown (2002), see Table B3. The mass of the encounter-
h collision damage direction
ing vessels MEV is conditional to the vessel type, size and loading con-
qc cargo oil density
dition. The mass of fully laden general cargo, bulk carrier, container
qsw sea water density
and passenger vessels is derived from data-based regression models
+ increase
presented by Brown (2002). The models, having a statistical fit with
± increase/decrease
R2-values around 0.98, have regression coefficients as in Table B3
decrease
and a functional form as follows, with L the ship length:
rffiffiffi
a L
Acknowledgements MEV ¼ ðB1Þ
c
This work presented in this paper is carried out within the Except for tankers, there is no information available concerning
WINOIL project in association with the Kotka Maritime Research the loading condition of the vessels operating in the area.
Centre. This project is co-funded by the European Union, the Rus- Therefore, the conservative assumption is made that all are fully
sian Federation and the Republic of Finland. The contributions by laden. For tankers, more detailed data and models are available,
the second author are supported by the EU-funded project FAROS see Section B.1.4.
(Grant No. 314817), the FP7 program. The financial support is
acknowledged. The opinions expressed are those of the authors B.1.3. Data related to cargo of oil tankers
and should not be construed to represent the views of the project For oil tankers, data concerning the main dimensions, mass,
consortia. The presented Bayesian Network model has been deadweight and tank configuration is available from a ship data-
developed using the GeNie modeling environment developed at base (IHS Maritime, 2013), for 410 oil tankers operating at least
the Decision Systems Laboratory, University of Pittsburgh, avail- twice in the area during the period 2011–07 to 2011–10. It is
able from http://genie.sis.pitt.edu. The authors are grateful to assumed that these vessels are representative to the entire oil tan-
three anonymous reviewers whose thoughtful comments have ker fleet in the area. This is shown in Fig. B1, where L2, B2 and D2
helped to improve an earlier version of this paper. are respectively the tanker length, width and depth. TT signifies
the tank configuration type. TT1 is a double hull (DH) tanker with-
Appendix A. Notations and discretization of BN-model variables out longitudinal bulkhead, TT2 with one longitudinal bulkhead and
TT3 with two longitudinal bulkheads. ST and CT signify the number
See Table A1. of side and center tanks, respectively.
The loading conditions of the tankers directly affect the likeli-
Appendix B. Evidence underlying the Bayesian Network model hood of a spill and depend on the tanker type, tanker size, location
in the sea area and direction of travel (COWI, 2011). As the avail-
In this appendix, the evidence for the construction and able AIS data does not contain data for specific tanker types, results
parameterization of the BN-model shown in Section 5.1 is briefly of a traffic flow analysis by Nyman et al. (2010) are used to assess
presented, for the case study of the Gulf of Finland, see Section 4. the probability of the tankers being oil product or crude oil tankers,
Brevity is aimed at, but it is attempted to describe the data process- see Table B4.
ing, to facilitate potential application of the model to other sea The quantification of the loading condition is based on a
areas. detailed analysis of goods transported in the Baltic Sea, reported
by COWI (2011). The probabilities assessed based on this informa-
B.1. Evidence related to vessel characteristics tion are given in Table B5.
The mass of the tanker is derived directly from the ship data-
B.1.1. Data related to vessel traffic in the sea area base, see Fig. B1, if the vessel is fully laden. If the vessel is in ballast
Data related to the main vessel characteristics operating in the condition, the tanker mass is determined based on the ship data-
area are obtained from the Automatic Identification System (AIS) base and a model for cargo and ballast tank configuration, see
for the period 2011–07 to 2011–11, with data fields as shown in Section B.1.4.
Table B1. The data is further processed using an encounter detec-
tion model, see Section B.2. B.1.4. Model for cargo and ballast tank configuration and tanker mass
Concerning the ship types of encountering vessels, the AIS data in ballast condition
only specifies the crude categories cargo ship, passenger ship and The cargo tank dimensions are determined based on a model
tanker. AIS data analysis leads to the probabilities for the variable proposed by Smailys and Česnauskis (2006). The main parameters
Table A1
Description of variables in the model.
Factor group Symbol Discretization Ref.

Variable
Encounter situation – tankers (S Ef )

V1 Tanker length L2 {L80, 80–100, 100–120, 120–140, 140–160, 160–180, 180– B.1
200, 200–220, 220–240, 240–260, M260} [m]
V2 Tanker width B2 {L15, 15–20, 20–25, 25–30, 30–32.5, 32, 5–40, 40–45, 45– B.1
50} [m]
V3 Tanker mass MT {L10, 10–15, 15–20, 20–30, 30–40, 40–60, 60–80, 80– B.1
100, 100–120, 140–190} [ktonne]
V4 Tanker encounter speed V E2 {0–4, 4–8, 8–12, 12–16} [kn] B.1
V5 Tanker type – {Oil product, crude oil} B.1
V6 Tanker deadweight – {L10, 10–20, 20–30, 30–40, 40–80, 80–120, 120–160} B.1
[ktonne]
V7 Tanker loading condition – {Laden, Ballast} B.1
Encounter situation – encountering vessel (S Ef )

V8 Encountering vessel length L1 {L80, 80–100, 100–120, 120–140, 140–160, 160–180, 180– B.1
200, 200–220, 220–240, 240–260, M260} [m]
V9 Encountering vessel mass MEV {L10, 10–20, 20–40, 40–80, 80–180} [tonne] B.1
V10 Encountering vessel type (AIS) – {Tanker, Passenger vessel, Cargo vessel} B.1
V11 Encountering vessel type (detailed) – {Tanker, Passenger vessel, Bulk carrier, General cargo, B.1
Container vessel}
V12 Encountering vessel encounter speed V E2 {0–8, 8–12, 12–16, M16} [kn] B.1
V13 Encountering vessel loading condition LCEV {Laden, Ballast} B.1
V14 Encountering vessel bow entrance angle g {L34, 34–40, M40} [°] B.1
Encounter situation – context (S Ef )

V15 Area in Gulf of Finland – {Russian sector, Finnish GOFREP, Estonian GOFREP} B.2
V16 Direction of tanker travel – {Inbound, outbound} B.2
V17 Encounter type – {Overtaking, Meeting, Crossing} B.2
Impact situation (S If )
V18 Encountering vessel impact speed V I1 {0–8, 8–12, 12–16, M16} [kn] B.3
V19 Impact angle uI {0–36, 36–72, 72–108, 108–144, 144–180} [°] B.3
V20 Tanker impact speed V I2 {0–4, 4–8, 8–12, 12–16} [kn] B.3
V21 Impact location along struck tanker hull l {0–20, 20–40, 40–60, 60–80, 80–100} [from stern] B.3
V22 Tanker striking or struck – {Striking, Struck} B.3
V23 Tanker collision occurrence – {Collision, No collision} B.4
V24 Tanker as struck vessel – {Tanker struck, Tanker not struck} B.4
Consequences – oil spills from damaged compartment (C)
V25 Oil spill mass – AH 8 – Model 1 CM1 {0, 1–1250, 1250–2500, 2500–5 k, 5 k–10 k, 10 k– B.5
15 k, 15 k–20 k, 20 k–25 k, 25 k–30 k, 30 k–35 k} [tonne]
V26 Oil spill mass – AH 8 – Model 2 CM2 {0, 1–1250, 1250–2500, 2500–5 k, 5 k–10 k, 10 k– B.5
15 k, 15 k–20 k, 20 k–25 k, 25 k–30 k, 30 k–35 k} [tonne]
V27 Oil spill mass – AH 8 weighed CAH8 {0, 1–1250, 1250–2500, 2500–5 k, 5 k–10 k, 10 k– B.5
15 k, 15 k–20 k, 20 k–25 k, 25 k–30 k, 30 k–35 k} [tonne]
V28 Oil spill mass in damaged tanks CAH9 {0, 1–1250, 1250–2500, 2500–5 k, 5 k–10 k, 10 k– B.5
15 k, 15 k–20 k, 20 k–25 k, 25 k–30 k, 30 k–35 k} [tonne]
Alternative hypotheses (AH) Alternatives Weights
AH concerning encounter detection AH 1 {M1, M2} {0.5, 0.5} B.2
AH encountering vessel impact speed AH 2 {M1, M2, M3, M4} {0.1, 0.1, 0.1, 0.7} B.3
AH tanker impact speed AH 3 {M1, M2, M3, M4} {0.1, 0.1, 0.1, 0.7} B.3
AH impact location along struck tanker hull AH 4 {M1, M2} {0.25, 0.75} B.3
AH impact angle AH 5 {M1, M2, M3, M4, M5, M6} {0.05, 0.2, 0.1, 0.2, 0.05, 0.4} B.3
AH tanker striking or struck AH 6 {M1, M2} {0.5, 0.5} B.3
AH tanker collision probability AH 7 {M1, M2} {0.5, 0.5} B.4
AH damage extent and oil outflow AH 8 {M1, M2} {0.1, 0.9} B.5
AH damage extent oblique impact angles AH 9 {M1, M2} {0.2, 0.8} B.5
Risk metric (RM)
Probability of oil spill – {0, 1–1250, 1250–2500, 2500–5 k, 5 k–10 k, 10 k– 6.1
15 k, 15 k–20 k, 20 k–25 k, 25 k–30 k, 30 k–35 k} [P
(tonne/year)]
for the determination of the tank volumes and the location of the width of the double hull w and number of longitudinal bulkheads,
transverse and longitudinal bulkheads are shown in Fig. B2. LF i.e. the tank configuration type. For TT2, the bulkhead is at the cen-
and LA are the distances from the fore and aft perpendicular to ter line and for TT3, the two bulkheads are at a distance
the respective closest transverse cargo tank bulkheads. The posi- w þ 27 ðB2 2wÞ from the ship side.
tions of the transverse bulkheads TBH are determined based on The volume Vi of a given tank is determined as follows, with
LA, LF, the tanker length L and the number of cargo tanks. Equal car- notations as in Fig. B2:
go tank lengths LT are assumed. The positions of the longitudinal
bulkheads LBH are determined based on the tanker width B2, the V i ¼ C i BT LT DT ðB2Þ
Table B1 Table B3
AIS data fields available for the presented model. Regression coefficients for encountering vessel mass and bow entrance angle g, based
on Brown (2002).
Data field Unit Explanation
Ship type c a g
MMSI number – A 9-digit code uniquely identifying a vessel
Time stamp s Time at which the message is recorded Bulk carrier 6.6 0.332 40
[YYYY]–[MM]–[DD] [hh]:[mm]:[ss] General cargo 6.93 0.325 40
Position Longitude and latitude of transmitted Container ship 5.49 0.353 34
message, in WGS-84 coordinate system Passenger ship 8.22 0.299 34
Ship type – A 2-digit code identifying the type of vessel, Tanker N/A N/A 76
see USCG (2012)
Ship length and width m Dimensions from bow to stern and side to
side, see USCG (2012)
Ship speed kn Speed over ground B.2. Evidence for situational factors at vessel encounters
Ship course ° Course over ground
For deriving probabilities for various factors related to the

encounter situation, a model is used to detect encounters between
Ci is a volumetric coefficient, accounting for the actual shape of tankers and encountering vessels in the AIS data described in Sec-
the tank in comparison with a rectangular prism, assuming a cargo tion B.1.1. Probability distributions are constructed for the type,
loading level of 98%. Values for Ci depend on the tank configuration length and speed of encountering vessels and length and speed
type, the location of the tank and the size of the vessel (Smailys and of the oil tankers. Also the encounter type is determined, i.e.
Česnauskis, 2006). whether vessels overtake, cross or meet. The derived distributions
The model also enables an evaluation of the ballast water vol- are conditional to the direction of tanker travel and the respective
ume, from which the tanker mass in ballast condition can be GOFREP areas. The model includes the four steps outlined below.
derived, as follows:
Step 1: The AIS data is prepared for further analysis. In par-
X
NCT X
NBT
ticular, the positions of all vessels are determined at examining
M T;bal ¼ M T;lad qc V CT;j þ qsw V BT;k ðB3Þ
j¼1 k¼1
times Ti, with an interval DT of 1 min, using linear interpolation
from the AIS data points.
where Mbal is the ship mass in ballast condition, Mlad the mass in Step 2: The encounters between tankers with other vessels are
laden condition as available in the data shown in Fig. B1, qc the den- detected. First, the trajectories of all tankers are extracted from
sity of the cargo oil, taken as 900 kg/m3 and qsw the density of sea the processed AIS data. Then, a circular inspection area is drawn
water, taken as 1025 kg/m3, NCT and NBT the total number of cargo around the tanker position at each examining time Ti, as in the
and ballast tanks, VCT,j the volume of the j-th cargo tank, obtained method by van Dorp and Merrick (2011). While this inspection
from Eq. (B2), and VBT,k the volume of the k-th ballast tank, deter- area is not the same concept as the ship domain10, it is known
mined as follows: that application of alternate ship domains leads to detection of
different sets of encounters, particularly with respect to in the
V dh
BT ¼ wDT LT ðB4Þ location where these occur (Goerlandt and Kujala, 2014). The
uncertainty about the limits of the inspection area is here consid-
P ered by applying alternative hypotheses (AH 1 in Fig. 4), setting
B mi BT;i
V db
BT ¼ h LT ðB5Þ the limit at 0.5 nm and 1 nm. Then, violations of the tanker
2
inspection area with encountering vessels are detected by com-
paring AIS positions with the inspection area limits. The related
V fp
BT ¼ 0:4D
3
ðB6Þ information (vessel dimensions, types, speeds, courses) is stored.
Step 3: For each encounter, additional information is derived
with V dh db
BT a ballast tank in the double hull, V BT a ballast tank in the
from the parameters in AIS data. The GOFREP area in which
double bottom, V fp the encounter occurs is determined by comparing the positions
BT the forepeak ballast tank, calculated as in
Okumoto et al. (2009) and m the number of cargo tanks in a trans- of the tankers with the boundaries of the GOFREP sectors, see
verse section. The other notations are as applied above. FTA (2010). The direction of tanker travel, i.e. whether the ves-
sel is sailing into or out from the Gulf of Finland is derived from
the course over ground of the tanker: courses toward east are
B.1.5. Data and information related to bunker tank size and position inbound, courses toward west are outbound. Finally, the classi-
The model for the oil outflow of Section B.5 includes the bunker fication of the encounter type is based on a method proposed by
oil. Limited data regarding the bunker tank volumes as well as Tam and Bucknall (2010), distinguishing overtaking, crossing
information of some common bunker tank layouts is available and meeting encounters. The method classifies encounters
from McAllister et al. (2003). It is assumed that bunker tanks are based on the headings and bearings of both interacting vessels.
fully laden. The volume of the bunker tanks for different vessel Step 4: The data is further processed and analyzed. Only one
categories, defined according to Evangelista (2002), is given in data field is retained per day, per GOFREP area, for an encounter
Table B6, along with assessed probabilities of the various tank con- between a unique pair of vessels (as identified by the MMSI
figurations. The alternative tank configurations are shown in number, see Section B.1.1). This is done to account for the fact
Fig. B3. that certain encounters last much longer than others, potential-
ly skewing the results. Distributions for the length and speed of
Table B2
Probabilities of cargo vessel types in various sea areas, based on Nyman et al. (2010).
Container Bulk carrier General cargo 10

A ship domain is defined as ‘‘the surrounding effective waters which the
Finnish GOFREP 0.42 0.08 0.5 navigators of a ship want to keep clear of other ships or fixed objects’’ (Qu et al.,
Estonian GOFREP 0.42 0.08 0.5 2011), whereas an inspection domain is used only to determine which vessels get into
Russian national VTS 0.44 0.07 0.49 each other’s vicinity, without any reference to this area being indicative of a specific
risk level (van Dorp and Merrick, 2011).
Fig. B1. Data for tankers considered in the analysis.
Table B4
phenomenon, there are important uncertainties related to the rela-
Probabilities of tanker types in different sea areas, based on Nyman et al. (2010).
tionship between encounter and impact.
GoF area P (oil product tanker) P (crude oil tanker) A number of models for establishing a relation between the
Finnish GOFREP 0.7 0.3 relevant situational factors has been proposed, see Ståhlberg
Estonian GOFREP 0.7 0.3 et al. (2013). In the BN model of Fig. 4, these models are considered
Russian national VTS 0.56 0.44
as a set of alternative hypotheses. The models are outlined in
Table B7, including a reference. V I1 and V I2 are the impact speeds
tankers and encountering vessels, as well as the type of encoun-
of the encountering vessel and the tanker. V E1 and V E2 are the corre-
tering vessels are derived, conditional to the GOFREP area and
sponding encounter speeds. The impact location l along the tanker
the direction of travel. Finally, distributions of encounter type
hull is measured relative to the ship stern. uI and uE are respec-
are derived from the obtained data set of vessel interactions.
tively the impact and encounter angle, where uI is measured from
the bow of the striking vessel. The table also contains assigned
B.3. Evidence for situational factors at collision impact probabilities for alternative hypotheses AH 2–AH 6.
From collision accident reports and forensic analysis of ship col-

lisions, it is known that the impact conditions typically differ from B.4. Evidence for probability of tanker collision
the encounter conditions (Cahill, 2002; Wang et al., 2013). Hence,
the impact speeds differ from the encounter speeds, and the Various models have been proposed for estimating the prob-
impact angle differs from the encounter angle. Furthermore, the abilities of collisions in sea areas, e.g. Friis-Hansen and Simonsen
impact conditions include additional situational factors such as (2002) and Weng et al. (2012). These methods follow the concept
which of the colliding vessels is the struck vessel and the damage introduced by Fujii and Shiobara (1971), combining a count of
location relative to the length of the tanker. However, as collisions encounters in an area with a causation probability, which is
are rare events and the collision evasive maneuvering is a complex defined as the probability of failing to avoid a collision given a cri-
Table B5
Probabilities of tanker being laden in different sea areas, based on COWI (2011).
GoF area Inbound Outbound

Oil product Crude oil Oil product Crude oil
Finnish GOFREP 0.5 DWT 6 20 kton: 0.33 DWT 6 120 kton: 0.5 DWT < 40 kton: 0.99
DWT 6 80 kton: 0.084 DWT > 120 kton: 0.99 DWT < 120 kton: 0.98
DWT 6 120 kton: 0.07 DWT < 160 kton: 0.995
DWT > 120 kton: 0.06
Estonian GOFREP 0.5 DWT 6 20 kton: 0.33 DWT 6 120 kton: 0.5 DWT < 40 kton: 0.99
DWT 6 80 kton: 0.084 DWT > 120 kton: 99 DWT < 120 kton: 0.98
DWT 6 120 kton: 0.07 DWT < 160 kton: 0.995
DWT > 120 kton: 0.06
Russian national VTS DWT 6 30 k: 0.5 0.01 DWT 6 120 kton: 0.5 0.99
DWT > 30 k: 0.01 DWT > 120 kton: 0.99
A first process concerns the redistribution of kinetic energy and its

conversion to deformation energy due to two ship-shaped bodies
coming into contact. This is coupled to a second process: the elastic
and plastic deformation of the steel structures due to applied con-
tact pressure. These processes are known as ‘‘outer dynamics’’ and
‘‘inner dynamics’’ (Terndrup Pedersen and Zhang, 1998). Several
models have been proposed for evaluating hull damages in colli-
sions, primarily aimed at ship design (Ehlers, 2011).
A relatively simple model, developed specifically for use in oil
spill risk assessment, is presented in van de Wiel and van Dorp
(2011). It is a statistical meta-model, based on a fit of a large set
of damage extents as determined by a mechanical engineering
model for a set of tanker designs (Brown and Chen, 2002). The
model uses a set of dimensionless predictor variables xi to estimate
the damage length yL and the penetration depth yT, defined in
Fig. B2. Definition of tank dimensions and ship parameters. Fig. B4:
!
X
5 X
5
Table B6 yL ¼ exp ^l þ
b ^ l xi
b ðB7Þ
0 i;j j
Probabilities of different bunker tank configurations, based on McAllister et al. (2003). i¼1 j¼1
Vessel size Total bunker tank Probability of bunker tank !

(ktonnes) capacity (m3) configuration X
5 X
5
yT ¼ exp ^t þ
b ^ t xi
b ðB8Þ
0 i;j j
B1 B2 B3 B4 B5 B6
i¼1 j¼1
DWT < 10 500 1/2 1/2
10 6 DWT < 60 1000 1/2 1/2 The predictor variables xi are functions of impact situational
60 6 DWT < 80 2000 1/3 1/3 1/3 factors. x1 and x2 are derived from the perpendicular and tangential
80 6 DWT < 120 2500 1/3 1/3 1/3 collision kinetic energy, which are functions of the vessel masses,
120 6 DWT < 160 4000 1/4 1/4 1/4 1/4
impact speeds and impact angle. x3 is a function of the relative
damage location, x4 of the bow entrance angle and x5 is a function
tical ship encounter. However, the probability estimates have been of the tanker length (for yL) or the tanker width (for yT). For expres-
found unreliable, due to questions related to the encounter detec- sions for the variables xi and the regression coefficients b, ^ see van
tion mechanism (Goerlandt and Kujala, 2014) and the numerical de Wiel and van Dorp (2011).
values of the causation factors. Hence, there is uncertainty in The model determines the maximum and minimum location of
applying these models (Sormunen et al., 2014). the longitudinal damage extent, respectively yL1 and yL2, as a func-
As the focus of the case study concerns the consequence dimen- tion of the damage length yL, the tanker length L, the relative dam-
sion, a crude evaluation of the collision occurrence is made based age location l and the damage direction h. The latter variable
on available accident data and traffic information. Based on acci- accounts for the phenomenon that the longitudinal damage extent
dent data analysis, an annualized collision frequency of 0.22 is will typically not be symmetrical around the impact location. The
found for the Gulf of Finland in open sea conditions, irrespective model for h is conditional to the impact angle u and the relative
of ship type (Nyman et al., 2010). Furthermore, analysis of the tangential velocity vT.
number of vessels operating in the area indicates that between
13% (Montewka et al., 2010a) and 20% (Nyman et al., 2010) are B.5.2. Integrated model for oil spill size conditional to impact situation
oil product or crude oil tankers. It is known that maritime acci- In the BN of Fig. 4, the probabilities of oil spill sizes conditional
dents are underreported to accident databases (Qu et al., 2012). to the impact situational variables are determined based on the fol-
Based on an analysis by Hassel et al. (2011), it is assumed that acci- lowing procedure:
dents in the Gulf of Finland are underreported at a 20% rate.
Assuming that the accident probability is equal to all ship types, i. The model of Section B.1.4 is used for all vessels to deter-
this leads to a probability of a collision involving a tanker between mine the cargo tank layout and volumes, and the mass in
3.58 102 and 5.50 102. These probabilities are taken as alterna- ballast condition, using the data of Section B.1.3.
tive hypothesis AH 7 in the BN. In terms of the rationale of Eq. (6), ii. For k = 1 ? 10: Select a bunker tank layout, based on
an equal probability is assigned to these. Section B.1.5.
iii. For all combinations of V I1 , V I2 , uI, l, g, MEV and the tanker
B.5. Model for oil spill size loading condition TLC:
The model for the oil spill size integrates various data sources
and engineering models: data concerning tanker cargo tank layout
(Section B.1.3), a model for estimating the location and volumes of
cargo tanks (Section B.1.4), data and information related to bunker
tanks (Section B.1.5) and a model for estimating the damage size
conditional to the impact conditions. This model is briefly intro-
duced first. Then, the integrated procedure for determining the
oil spill size is outlined.
B.5.1. Model for estimating the damage extent conditional to impact

situation
A ship–ship collision is a complex, non-linear phenomenon
which can be understood as a coupling of two dynamic processes. Fig. B3. Definition of bunker tank configurations, based on McAllister et al. (2003).
Table B7
Alternative hypotheses for impact situational factors.
Variable Model p (Mi) Outline Reference
AH 2: Encountering vessel impact speed V I1 M1 0.1 V I1 ¼ V E1 van Dorp and Merrick (2011)

M2 0.1 V I1
¼ Tr 0; 23 V E1 ; V E1 COWI (2011)
8
M3 0.1 > E Lützen (2001)
< U 0; 0:75V 1
I
V1 ¼ E E
: Tr 0:75V 1 ; V 1
>

M4 0.7 Empirical relation V I1 ¼ f V E1 Sormunen et al. (2014))
AH 3: Tanker impact speed V I2 M1 0.1 V I2 ¼ V E2 van Dorp and Merrick (2011)

M2 0.1 V I2 ¼ Tr 0; 23 V E2 ; V E2 COWI (2011)

M3 0.1 V I2 ¼ Tr 0; V E2 Lützen (2001)
M4 0.7 Empirical relation V I2 ¼ f ðV E2 Þ Sormunen et al. (2014)
AH 4: Impact location along tanker l M1 0.25 l = U(0, L2) Rawson et al. (1998)
M2 0.75 Empirical histogram Samuelides et al. (2008)
AH 5: Impact angle uI M1 0.05 uI = uE van Dorp and Merrick (2011)
M2 0.2 uI = U(0, 180) Rawson et al. (1998)
M3 0.1 uI = Tr(0, uE, 180) Lützen (2001)
M4 0.2 uI = N(90, 29) NRC (2001)
8
M5 0.05 < p ¼ 0:1 : uI ¼ Uð30; 150Þ COWI (2011)
CR and MT: uI = U(30, 150) OT: p ¼ 0:9 : uI ¼ uE
:
M6 0.4 Empirical histogram Samuelides et al. (2008)
AH 6: Tanker striking or struck M1 0.5 P (tanker struck) = 0.5 Klanac et al. (2010)
M2 0.5 P (tanker struck struck) = 0.8 IMO (2008)
Notes: U(a, b) = uniform distribution, Tr(a, b, c) = triangular distribution, N(l, r) = normal distribution, other notations see Appendix A.
c. Determine limits of the longitudinally breached area yL1

and yL2, see Section B.5.1.
d. Compare yL1 and yL2 with the locations of the transverse
bulkheads TBH, see Fig. B4.
e. Compare yT with the locations of the longitudinal bulk-
heads LBH, see Fig. B4.
P
f. The volume of spilled oil is calculated as V oil ¼ Ni¼1 V i ,
with N the number of tanks enclosed in the area encom-
passed by the comparisons in steps d and e, and Vi the
cargo or bunker tank volume, see Sections B.1.4 and
B.1.5.
g. The mass of spilled oil is calculated as Moil = qoilVoil,
assuming qoil = 0.9 tonne/m3.
Count the relative occurrence frequency of Moil for each of the
Fig. B4. Definition of impact situation, damage extent and hypotheses for breached discrete classes of the BN-variable V25, see Appendix A.
compartments. iv. The procedure ii.–iii. is repeated for all tanker designs.
v. The CPTs for the individual tanker designs are averaged
over the group of vessels in the same deadweight range,
For j = 1 ? 25: according to the discretization in BN variable V6, see
a. Sample a value in the considered discrete state of V I1 , V I2 , Appendix A.
uI, l, g, MEV and TLC. vi. Aggregation of all averaged CPTs for all tanker deadweights
b. Determine damage length yL and damage depth yT, see leads to the complete CPT for the BN variable V25, see Appen-
Section B.5.1. dix A.
Table B8
Alternative hypotheses for damage extent.
Variable Model p (Mi) Outline

AH 8: Damage extent and oil spill size M1 0.1 Damage extent is rectangular area covered by damage limits yL1, yL2 and yT
All oil is spilled from the damaged compartments
M2 0.9 Damage extent is rectangular area covered by damage limits yL1, yL2 and yT
Maximum two longitudinal bulkheads breached
Maximum two transverse bulkheads breached
All oil is spilled from the damaged compartments
AH 9: Damage extent in relation to impact angle M1 0.2 Hull breach occurs for all impact angles uI
Damage extent and oil spill size according to AH 8
M2 0.8 Hull breach occurs only for impact angles uI 2 [36°, 144]
Damage extent and oil spill size according to AH 8
Table C1 models assume that the ship hulls will only grind alongside, with-
Definition of test cases for evaluating influence of alternative hypotheses. out leading to extensive structural damage (COWI, 2011; Ståhlberg
Test AH 1 AH 2 AH 3 AH 4 AH 5 AH 6 AH 7 AH 8 AH 9 et al., 2013). In such cases, no breach of the double hull structure is
case assumed, and no oil is spilled. In other analyses, it is taken that all
C1 B B B B B B B B B impact angles lead to hull breach (van Dorp and Merrick, 2011). In
C2 M1 B B B B B B B B the BN, this uncertainty is considered through AH 9, as outlined in
C3 M2 B B B B B B B B Table B8.
C4 B M1 B B B B B B B
C5 B M3 B B B B B B B
C6 B B M1 B B B B B B
C7 B B M3 B B B B B B Appendix C. Test cases for alternative hypotheses
C8 B B B M2 B B B B B
C9 B B B M1 B B B B B In Table C1, the test cases for quantifying the influence of the
C10 B B B B M4 B B B B alternative hypotheses AH 1–AH 9 in the BN of Fig. 4 are summa-
C11 B B B B M5 B B B B
C12 B B B B B M2 B B B
rized. In each test case, the AHs are either taken at the baseline
C13 B B B B B M1 B B B level or set at a particular model alternative. The model is run for
C14 B B B B B B M2 B B each of these cases, and summary statistics of the corresponding
C15 B B B B B B M1 B B results are shown in Fig. 6.
C16 B B B B B B B M1 B
C17 B B B B B B B M2 B
C18 B B B B B B B B M1 References
C19 B B B B B B B B M2
C20 M1 M1 M1 M2 M4 M2 M2 M1 M1
Akhtar, J., Bjornskau, T., Jean-Hansen, V., 2012. Oil spill risk analysis of routeing
C21 M2 M3 M3 M1 M5 M1 M1 M2 M2
heavy ship traffic in Norwegian waters. WMU J. Marit. Aff. 11, 233–247. http://
Notes: B: baseline weighing of alternative hypothesis, M1–M5: alternative models dx.doi.org/10.1007/s13437-011-0016-8.
Apostolakis, G.E., 2004. How useful is quantitative risk assessment? Risk Anal. 24,
for various alternative hypotheses.
515–520.
Aven, T., 2007. On the ethical justification for the use of risk acceptance criteria. Risk
Anal. 27, 303–312.
Aven, T., 2008. Risk Analysis: Assessing Uncertainties beyond Expected Values and
In this procedure, it is assumed that all oil in a tank is lost. More Probabilities. Wiley, Chichester, UK.
Aven, T., 2009. Perspectives on risk in a decision-making context – review and
accurate models for evaluating the oil spill exist (Sergejeva et al., discussion. Saf. Sci. 47, 798–806. http://dx.doi.org/10.1016/j.ssci.2008.10.008.
2013; Tavakoli et al., 2010), but their application requires informa- Aven, T., 2010a. On how to define, understand and describe risk. Reliab. Eng. Syst.
tion regarding the damage height and opening size and shape. As Saf. 95, 623–631. http://dx.doi.org/10.1016/j.ress.2010.01.011.
Aven, T., 2010b. Misconceptions of Risk. John Wiley & Sons Ltd., Chichester, UK.
the damage extent model by van de Wiel and van Dorp (2011) only
Aven, T., 2010c. Some reflections on uncertainty analysis and management. Reliab.
provides crude information regarding the limits of the breached Eng. Syst. Saf. 95, 195–201. http://dx.doi.org/10.1016/j.ress.2009.09.010.
area, no detailed information for these factors is available. Thus, Aven, T., 2011a. Interpretations of alternative uncertainty representations in a
the conservative assumption of a complete loss of oil from dam- reliability and risk analysis context. Reliab. Eng. Syst. Saf. 96, 353–360.
Aven, T., 2011b. Selective critique of risk assessments with recommendations for
aged tanks is made, as in van Dorp and Merrick (2011). improving methodology and practise. Reliab. Eng. Syst. Saf. 96, 509–514. http://
dx.doi.org/10.1016/j.ress.2010.12.021.
Aven, T., 2012. The risk concept—historical and recent development trends. Reliab.
B.5.3. Alternate hypotheses Eng. Syst. Saf. 99, 33–44. http://dx.doi.org/10.1016/j.ress.2011.11.006.
Aven, T., 2013. Practical implications of the new risk perspectives. Reliab. Eng. Syst.
In the procedure outlined in Section B.5.2, several assumptions Saf. 115, 136–145. http://dx.doi.org/10.1016/j.ress.2013.02.020.
are made, leading to epistemic uncertainties. These concern the Aven, T., Guikema, S., 2011. Whose uncertainty assessments (probability
damage extent in relation to the bow penetration depth and the distributions) does a risk assessment report: the analysts’ or the experts’?
Reliab. Eng. Syst. Saf. 96, 1257–1262. http://dx.doi.org/10.1016/
damage extent in relation to the impact angle. These epistemic j.ress.2011.05.001.
uncertainties are considered through a set of alternative hypotheses. Aven, T., Heide, B., 2009. Reliability and validity of risk analysis. Reliab. Eng. Syst.
In steps iii./d.–e. of the procedure in Section B.5.2, the dam- Saf. 94, 1862–1868. http://dx.doi.org/10.1016/j.ress.2009.06.003.
Aven, T., Reniers, G., 2013. How to define and interpret a probability in a risk and
age extent is taken as the rectangular area covered by the dam-
safety setting. Saf. Sci. 51, 223–231. http://dx.doi.org/10.1016/
age limits yL1, yL2 and yT, in line with the application by van de j.ssci.2012.06.005.
Wiel and van Dorp (2011). It is however known that the breach Aven, T., Renn, O., 2009. On risk defined as an event where the outcome is uncertain.
of each additional bulkhead corresponds to an increased amount J. Risk Res. 12, 1–11.
Aven, T., Vinnem, J.E., 2005. On the use of risk acceptance criteria in the offshore oil
of required deformation energy (Ehlers and Tabri, 2012; and gas industry. Reliab. Eng. Syst. Saf. 90, 15–24. http://dx.doi.org/10.1016/
Ståhlberg et al., 2013). As the model by Brown and Chen j.ress.2004.10.009.
(2002), on which the meta-model by van de Wiel and van Aven, T., Zio, E., 2011. Some considerations on the treatment of uncertainties in risk
assessment for practical decision making. Reliab. Eng. Syst. Saf. 96, 64–74.
Dorp (2011) is based, only accounts for the outer hull and the http://dx.doi.org/10.1016/j.ress.2010.06.001.
double hull bulkhead, there is uncertainty regarding the breach Aven, T., Zio, E., 2014. Foundational issues in risk assessment and risk management.
of the subsequent longitudinal bulkhead(s). Likewise, the breach Risk Anal. 34, 1164–1172.
Ayyub, B.M., 2001. Elicitation of Expert Opinions for Uncertainty and Risk. CRC
of transverse bulkheads is uncertain, as the bulkhead structure Press, Boca Raton, FL.
requires more deformation energy for a breach to occur Bi, H., Si, H., 2012. Dynamic risk assessment of oil spill scenario for Three
(Klanac et al., 2010). This uncertainty is considered through Gorges Reservoir in China based on numerical simulation. Saf. Sci. 50, 1112–
1118.
model M2 for AH 8, as outlined in Table B8. The same procedure Brown, A.J., 2002. Collision scenarios and probabilistic collision damage. Mar.
as in Section B.5.2 is followed for constructing the CPT for BN- Struct. 15, 335–364. http://dx.doi.org/10.1016/S0951-8339(02)00007-2.
variable V26 (see Appendix A), but maximum two longitudinal Brown, A.J., Chen, D., 2002. Probabilistic method for predicting ship collision
damage. Ocean Eng. Int. 6, 54–65.
and two transverse bulkheads can be breached.
Brunila, O.-P., Storgård, J., 2012. Oil Transportation in the Gulf of Finland in 2020
Another uncertainty concerns the collision consequences under and 2030 (No. A61). Publications from the Centre for Maritime Studies.
oblique impact angles. While advanced theoretical models exist for University of Turku, Turku.
non-perpendicular collisions (Tabri et al., 2010), the behavior of Cahill, R.A., 2002. Collisions and their Causes, third ed. The Nautical Institute,
London.
the interface between the impacted structures under oblique Carmines, E.G., Zeller, R.A., 1979. Reliability and Validity Assessment, Quantitative
angles is not well understood in the present state of research. Some Applications in the Social Sciences. SAGE Publications, Thousand Oaks, CA.
Chen, D., 2000. Simplified Ship Collision Model (M.Sc.). Virginia Polytechnic Kaplan, S., 1997. The words of risk analysis. Risk Anal. 17, 407–417. http://
Institute and State University, Blacksburg, Virginia. dx.doi.org/10.1111/j.1539-6924.1997.tb00881.x.
Coupé, V.M.H., van der Gaag, L.C., 2002. Properties of sensitivity analysis of Bayesian Klanac, A., Varsta, P., 2011. Design of marine structures with improved safety for
Belief networks. Ann. Math. Artif. Intell. 36, 323–356. environment. Reliab. Eng. Syst. Saf. 96, 75–90. http://dx.doi.org/10.1016/
COWI, 2011. BRISK – Sub-regional Risk of Spill of Oil and Hazardous Substances in j.ress.2010.06.016.
the Baltic Sea. Klanac, A., Duletić, T., Erceg, S., Ehlers, S., Goerlandt, F., Frank, D., 2010.
Dalton, T., Jin, D., 2010. Extent and frequency of vessel oil spills in US marine Environmental risk of collisions in the enclosed European waters: Gulf of
protected areas. Mar. Pollut. Bull. 60, 1939–1945. Finland, Northern Adriatic and the implications for tanker design. In: 5th
De Rocquigny, E., Devictor, N., Tarantola, S. (Eds.), 2008. Uncertainty in Industrial International Conference on Collision and Grounding of Ships. Aalto University,
Practice – A Guide to Quantitative Uncertainty Management. Wiley, New Jersey. Espoo, Finland, pp. 55–65.
Debnath, A.K., Chin, H.C., 2010. Navigational traffic conflict technique: a proactive Kloprogge, P., van der Sluijs, J.P., Petersen, A.C., 2011. A method for the analysis of
approach to quantitative measurement of collision risks in port waters. J. assumptions in model-based environmental assessments. Environ. Model.
Navigation 63, 137–152. Softw. 26, 289–301.
Diekmann, S., Peterson, M., 2013. The role of non-epistemic values in engineering Koller, D., Friedman, N., 2009. Probabilistic graphical models: principles and
models. Sci. Eng. Ethics 19, 207–218. techniques,, .. Adaptive Computation and Machine Learning, first ed. The MIT
Douglas, H., 2009. Science, Policy and the Value-free Ideal. University of Pittsburgh Press.
Press, Pittsburgh, PA. Lecklin, T., Ryöma, R., Kuikka, S., 2011. A Bayesian network for analyzing biological
Ehlers, S., 2011. A review of collision and grounding damage assessment method. acute and long-term impacts of an oil spill in the Gulf of Finland. Mar. Pollut.
Mar. Syst. Ocean Technol. 6, 5–15. Bull. 62, 2822–2835.
Ehlers, S., Tabri, K., 2012. A combined numerical and semi-analytical collision Lee, M., Jung, J.-Y., 2013. Risk assessment and national measure plan for oil and HNS
damage assessment procedure. Mar. Struct. 28, 101–119. http://dx.doi.org/ spill accidents near Korea. Mar. Pollut. Bull. 73, 339–344.
10.1016/j.marstruc.2012.05.005. Lehikoinen, A., Luoma, E., Mäntyniemi, S., Kuikka, S., 2013. Optimizing the recovery
Evangelista, J., 2002. Scaling the tanker market. Surv. – Q. Mag. ABS, 5–11. efficiency of Finnish oil combating vessels in the Gulf of Finland using Bayesian
Faber, M.H., 2005. On the treatment of uncertainties and probabilities in Networks. Environ. Sci. Technol. 47, 1792–1799. http://dx.doi.org/10.1021/
engineering decision analysis. J. Offshore Mech. Arctic Eng. 127, 243–248. es303634f.
Felski, A., Jaskolski, K., 2013. The integrity of information received by means of AIS Li, S., Meng, Q., Qu, X., 2012. An overview of maritime waterway quantitative risk
during anti-collision maneuvering. TransNav – Int. J. Mar. Navig. Saf. Sea Transp. assessment models. Risk Anal. 32, 496–512.
7, 95–100. Lindley, D.V., 2006. Understanding Uncertainty, 11th ed. Wiley-Interscience,
Fenton, N., Neil, M., 2012. Risk Assessment and Decision Analysis with Bayesian Hoboken, NJ.
Networks. CRC Press. Lützen, M., 2001. Ship Collision Damage. PhD Thesis, Department of Mechanical
Flage, R., Aven, T., 2009. Expressing and communicating uncertainty in relation to Engineering, Technical University of Denmark, Lyngby.
quantitative risk analysis (QRA). Reliab. Risk Anal. Theory Appl. 2, 9–18. McAllister, T., Rekart, C., Michel, K., 2003. Evaluation of Accidental Oil Spills from
Forrester, J.W., Senge, P.M., 1980. Tests for building confidence in system dynamics Bunker Tanks (Phase I) (Technical Report No. SSC-424). Ship Structures
models. TIMS Stud. Manage. Sci. 14, 209–228. Committee, Washington, DC.
Friis-Hansen, P., Simonsen, B.C., 2002. GRACAT: software for grounding and Miraglia, R.A., 2002. The cultural and behavioral impact of the Exxon Valdez oil spill
collision risk analysis. Mar. Struct. 15, 383–401. on the native peoples of the Prince William Sound, Alaska. Spill Sci. Technol.
FTA, 2010. GOFREP Master’s Guide. Bull. 7, 75–87.
Fujii, Y., Shiobara, R., 1971. The analysis of traffic accidents – studies in marine Montewka, J., Hinz, T., Kujala, P., Matusiak, J., 2010a. Probability modelling of vessel
traffic accidents. J. Navigation 24, 534–543. collisions. Reliab. Eng. Syst. Saf. 95, 573–589. http://dx.doi.org/10.1016/
Garcia Negro, M.C., Villasante, S., Carballo Penela, A., Rodriguez Rodriguez, R., 2009. j.ress.2010.01.009.
Estimating the economic impact of the Prestige oil spill on the Death Coast (NW Montewka, J., Ståhlberg, K., Seppala, T., Kujala, P., 2010. Elements of risk analysis for
Spain) fisheries. Mar. Policy 33, 8–23. collision of oil tankers. In: Reliability, Risk and Safety: Back to the Future.
Goerlandt, F., Kujala, P., 2014. On the reliability and validity of ship–ship collision Presented at the European Safety and Reliability Annual Conference,
risk analysis in light of different perspectives on risk. Saf. Sci. 62, 348–365. ESREL2010, Rhodes, Greece, pp. 1005–1013.
http://dx.doi.org/10.1016/j.ssci.2013.09.010. Montewka, J., Weckström, M., Kujala, P., 2013. A probabilistic model estimating oil
Goerlandt, F., Montewka, J., 2015. Maritime transportation risk analysis: review and spill clean-up costs – a case study for the Gulf of Finland. Mar. Pollut. Bull. 76,
analysis in light of some foundational issues. Reliab. Eng. Syst. Safe. 138, 115– 61–71. http://dx.doi.org/10.1016/j.marpolbul.2013.09.031.
134. http://dx.doi.org/10.1016/j.ress.2015.01.025. Montewka, J., Ehlers, S., Goerlandt, F., Hinz, T., Tabri, K., Kujala, P., 2014a. A
Graveson, A., 2004. AIS – an inexact science. J. Navigation 57, 339–343. framework for risk assessment for maritime transportation systems—a case
Gucma, L., Przywarty, M., 2008. The model of oil spills due to ship collisions in study for open sea collisions involving RoPax vessels. Reliab. Eng. Syst. Saf. 124,
Southern Baltic Area. TransNav Int. J. Mar. Navig. Saf. Sea Transp. 2, 415–419. 142–157. http://dx.doi.org/10.1016/j.ress.2013.11.014.
Hampel, J., 2006. Different concepts of risk – a challenge for risk communication. Montewka, J., Goerlandt, F., Kujala, P., 2014b. On a systematic perspective on risk for
Int. J. Med. Microbiol. 296, 5–10. formal safety assessment (FSA). Reliab. Eng. Syst. Saf. 127, 77–85. http://
Hänninen, M., 2014. Bayesian networks for maritime traffic accident prevention: dx.doi.org/10.1016/j.ress.2014.03.009.
benefits and challenges. Accid. Anal. Prev. 73, 305–312. Mou, J.M., van der Tak, C., Ligteringen, H., 2010. Study on collision avoidance in busy
Hänninen, M., Mazaheri, A., Kujala, P., Montewka, J., Laaksonen, P., Salmiovirta, M., waterways by using AIS data. Ocean Eng. 37, 483–490.
Klang, M., 2014. Expert elicitation of a navigation service implementation NRC, 2001. Environmental Performance of Tanker Designs in Collision and
effects on ship groundings and collisions in the Gulf of Finland. Proc. Inst. Mech. Grounding. Special Report 259. National Research Council.
Eng. Part O J. Risk Reliab. 228, 19–28. Nyman, T., Porthin, M., Karppinen, S., 2010. Collision and Grounding Frequency
Harrald, J.R., Mazzuchi, T.A., Spahn, J., Van Dorp, R., Merrick, J., Shrestha, S., Analyses in the Gulf of Finland.
Grabowski, M., 1998. Using system simulation to model the impact of human OCIMF, 2008. Tanker Management Self-Assessment (TMSA). Oil Companies
error in a maritime system. Saf. Sci. 30, 235–247. http://dx.doi.org/10.1016/ International Maritime Forum, London.
S0925-7535(98)00048-4. O’Hagan, A., Buck, C.E., Daneshkhak, A., Eiser, J.R., Garthwaite, P.H., Jenkinson, D.J.,
Hassel, M., Asbjørnslett, B.E., Hole, L.P., 2011. Underreporting of maritime accidents Oakley, J.E., Rakow, T., 2006. Uncertain Judgments: Eliciting Experts’
to vessel accident databases. Accid. Anal. Prev. 43, 2053–2063. Probabilities, first ed. Wiley.
Hassler, B., 2011. Accidental versus operational spills from shipping in the Baltic Okumoto, Y., Takeda, Y., Mano, M., Okada, T., 2009. Design of Ship Hull Structures: A
Sea: risk governance and management strategies. Ambio 40, 170–178. Practical Guide for Engineers, first ed. Springer.
HELCOM, 2014. HELCOM – Baltic Sea Trends – Accidents. <http://helcom.fi/baltic- Papanikolaou, A. (Ed.), 2009. Risk-based Ship Design: Methods, Tools and
sea-trends/maritime/accidents> (accessed 12.20.14). Applications. Springer.
Helle, I., Lecklin, T., Jolma, A., Kuikka, S., 2011. Modeling the effectiveness of oil Pitchforth, J., Mengersen, K., 2013. A proposed validation framework for expert
combating from an ecological perspective – a Bayesian network for the Gulf of elicited Bayesian Networks. Expert Syst. Appl. 40, 162–167.
Finland; the Baltic Sea. J. Hazard. Mater. 185, 182–192. Porathe, T., Lützhöft, M., Praetorius, G., 2013. Communicating intended routes in
Hermansson, H., 2012. Defending the conception of ‘‘objective’’ risk. Risk Anal., 32 ECDIS: evaluating technological change. Accid. Anal. Prev. 60, 366–370.
Hodges, J.S., 1991. Six (or so) things you can do with a bad model. Oper. res. 39, Psaraftis, H.N., 2012. Formal safety assessment: an updated review. J. Mar. Sci.
355–365. Technol. 17, 390–402.
Hogström, P., 2012. RoPax Ship Collision – A Methodology for Survivability Analysis Qu, X., Meng, Q., 2012. The economic importance of the Straits of Malacca and
(PhD Dissertation). Chalmers University of Technology, Gothenburg, Sweden. Singapore: an extreme-scenario analysis. Transport. Res. E: Logist. Transport.
IHS Maritime, 2013. Maritime Insight and Information. Rev. 48, 258–265.
IMO, 2003. Revised Interim Guidelines for the Approval of Alternative Methods of Qu, X., Meng, Q., Suyi, L., 2011. Ship collision risk assessment for the Singapore
Design and Construction of Oil Tankers. Strait. Accid. Anal. Prev. 43, 2030–2036. http://dx.doi.org/10.1016/
IMO, 2008. Formal Safety Assessment – FSA Crude Oil Tankers. j.aap.2011.05.022.
IMO, 2010. Manual on Oil Spill Risk Evaluation and Assessment of Response Qu, X., Meng, Q., Li, S., 2012. Analyses and implications of accidents in Singapore
Preparedness. IMO Publishing. Strait. Transport. Res. Rec. J. Transp. Res. Board 2273, 106–111.
Jolma, K., Haapasaari, H., 2014. Oil and Chemical Spill Response in Finland – Current Rawson, C., Crake, K., Brown, A., 1998. Assessing the environmental performance of
Situation. tankers in accidental grounding and collision. SNAME Trans. 106, 41–58.
Rosqvist, T., 2010. On the validation of risk analysis – a commentary. Reliab. Eng. Terndrup Pedersen, P., Zhang, S., 1998. On impact mechanics in ship collisions. Mar.
Syst. Saf. 95, 1261–1265. Struct. 11, 429–449.
Rosqvist, T., Tuominen, R., 2004. Qualification of formal safety assessment: an Thompson, P.B., Dean, W.R., 1996. Competing conceptions of risk. Risk Health Saf.
exploratory study. Saf. Sci. 42, 99–120. Environ. 7, 361–384.
Samuelides, M.S., Tabri, K., Incecik, A., Dimou, D., 2008. Scenarios for the assessment Trochim, W., Donnely, J.P., 2008. The Research Methods Knowledge Base, third ed.
of the collision behavior of ships. Int. Shipbuild. Prog. 55, 145–162. http:// Atomic Dog Publishing.
dx.doi.org/10.3233/ISP-2008-0043. USCG, 2012. Automatic Identification System – Encoding Guide.
Sergejeva, M., Laarnearu, J., Tabri, K., 2013. Hydraulic modelling of submerged oil Uusitalo, L., 2007. Advantages and challenges of Bayesian networks in
spill including tanker hydrostatic overpressure. In: Analysis and Design of environmental modelling. Ecol. Model. 203, 312–318.
Marine Structures. CRC Press, Taylor and Francis Group. Van de Wiel, G., van Dorp, J.R., 2011. An oil outflow model for tanker collisions and
Shrader-Frechette, K.S., 1991. Risk and Rationality: Philosophical Foundations for groundings. Ann. Oper. Res. 187, 279–304. http://dx.doi.org/10.1007/s10479-
Populist Reforms. University of California Press, Berkeley. 009-0674-5.
Smailys, V., Česnauskis, M., 2006. Estimation of expected cargo oil outflow from Van Dorp, J.R., Merrick, J.R., 2011. On a risk management analysis of oil spill risk
tanker involved in casualty. Transport 21, 293–300. using maritime transportation system simulation. Ann. Oper. Res. 249–277.
Solberg, O., Njå, O., 2012. Reflections on the ontological status of risk. J. Risk Res. 15, http://dx.doi.org/10.1007/s10479-009-0678-1.
1201–1215. Vanem, E., Endresen, O., Skjong, R., 2008. Cost-effectiveness criteria for marine oil
Sormunen, O.-V.E., Goerlandt, F., Häkkinen, J., Posti, A., Hänninen, M., spill preventive measures. Reliab. Eng. Syst. Saf. 93, 1354–1368.
Montewka, J., Ståhlberg, K., Kujala, P., 2014. Uncertainty in maritime Vareman, N., Persson, J., 2010. Why separate risk assessors and risk managers?
risk analysis: extended case study on chemical tanker collisions. Proc. Further external values affecting the risk assessor qua risk assessor. J. Risk Res.
Inst. Mech. Eng. Part M: J. Eng. Marit. Environ. http://dx.doi.org/10.1177/ 13, 687–700.
1475090213515640. Wandall, B., 2004. Values in science and risk assessment. Toxicol. Lett. 152, 265–
Ståhlberg, K., 2010. Estimating Deformation Energy in Ship–Ship Collisions with 272.
Stochastic Modeling (MSc thesis). Aalto University, Otaniemi, Finland. Wang, Y., Zhang, J., Chen, X., Chu, X., Yan, X., 2013. A spatial–temporal forensic
Ståhlberg, K., Goerlandt, F., Ehlers, S., Kujala, P., 2013. Impact scenario models for analysis for inland-water ship collisions using AIS data. Saf. Sci. 57, 187–
probabilistic risk-based design for ship–ship collision. Mar. Struct. 33, 238–264. 202.
http://dx.doi.org/10.1016/j.marstruc.2013.06.006. Watson, S.R., 1994. On the meaning of probability in probabilistic safety analysis.
Tabri, K., 2010. Influence of coupling in the prediction of ship collision damage. In: Reliab. Eng. Syst. Saf. 45, 261–269.
Presented at the International Conference on Collision and Grounding of Ships, Weng, J., Meng, Q., Qu, X., 2012. Vessel collision frequency estimation in the
Aalto University, Espoo, Finland, pp. 133–138. Singapore Strait. J. Navigation 65, 207–221.
Tabri, K., Varsta, P., Matusiak, J., 2010. Numerical and experimental motion Wiśniewski, K., Kołakowski, P., 2003. The effect of selected parameters on ship
simulations of non-symmetric ship collisions. J. Mar. Sci. Technol. 15, 87–101. collision results by dynamic FE simulations. Finite Elem. Anal. Des. 39, 985–
Tam, C., Bucknall, R., 2010. Collision risk assessment for ships. J. Mar. Sci. Technol. 1006.
15, 257–270. Yan, X., Zhang, J., Zhang, D., Soares, Carlos Guedes, 2014. Challenges and
Tavakoli, M.T., Amdahl, J., Leira, B., 2010. Analytical and numerical modelling of oil developments in navigational risk assessment with large uncertainty. In:
spill from a side damaged tank. In: Proceedings of the Fifth International ASME 2014 33rd International Conference on Ocean, Offshore and Arctic
Conference on Collision and Grounding, ICCGS, Aalto University, Espoo, Finland. Engineering, San Francisco, CA, p. 8. http://dx.doi.org/10.1115/OMAE2014-
Taylor, E., Steen, A., Meza, M., Couzigou, B., Hodges, M., Maranda, D., Ramos, J., 23411.
Moyano, M., 2008. IOSC workshop report: a proposed international guide for oil Zio, E., Apostolakis, G.E., 1996. Two methods for the structured assessment of model
spill response planning and readiness assessment. In: Presented at the uncertainty by experts in performance assessments of radioactive waste
International Oil Spill Conference, Savannah, Georgia, pp. 1–18. repositories. Reliab. Eng. Syst. Saf. 54, 225–241.

Oil Spill Risk Analysis

Uploaded by

Copyright:

Available Formats

Oil Spill Risk Analysis

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Oil Spill Risk Analysis

Uploaded by

Copyright:

Available Formats

Safety Science 76 (2015) 42–66

Contents lists available at ScienceDirect

A framework for risk analysis of maritime transportation systems: A case

2. Framework for risk analysis: risk-theoretic foundations

Fig. 1. 2-Stage framework for risk analysis: methods and perspectives.

3.1.2. Interpretation of BNs in context of risk analysis

Table 1 account for all assumptions by considering alternative hypotheses.

The aim of the risk analysis is to provide insight in the possi-

3.5. Assessment of effect of assumptions 5.1. Bayesian Network model

Fig. 2. Evidence assessment scheme for selecting alternative hypotheses.

encounter speed, bow angle and loading condition) and tanker

Table 3 an illustration of the feasibility of justifying the ratings, some

Table 4 5.4. Evidence importance ranking and selection of alternative

Characteristic D1 D2 D3 D4 D5 D6 D7 The parameter sensitivity analysis is performed on the BN with

data is in itself not very informative, as the context of the system

Assumption 10. Only mechanical impact is considered as a

The risk model only considers oil outﬂow as a direct result of

Assumption 3. Operating conditions remain as in 2011 baseline. Magnitude of L L L– L L L L L– L M

Variable max|u1| Variable max|u1| Label Description Appendix

Variable State E (C/year) Plausibility assessment

Tool Beneﬁts Drawbacks

In Sections 2 and 3, various tools have been introduced to quan- A arcs in BN

Factor group Symbol Discretization Ref.

Encounter situation – tankers (S Ef )

Encounter situation – encountering vessel (S Ef )

Encounter situation – context (S Ef )

For deriving probabilities for various factors related to the

Container Bulk carrier General cargo 10

Fig. B1. Data for tankers considered in the analysis.

From collision accident reports and forensic analysis of ship col-

GoF area Inbound Outbound

A ﬁrst process concerns the redistribution of kinetic energy and its

Vessel size Total bunker tank Probability of bunker tank !

B.5.1. Model for estimating the damage extent conditional to impact

Variable Model p (Mi) Outline Reference

AH 3: Tanker impact speed V I2 M1 0.1 V I2 ¼ V E2 van Dorp and Merrick (2011)

M4 0.7 Empirical relation V I2 ¼ f ðV E2 Þ Sormunen et al. (2014)

c. Determine limits of the longitudinally breached area yL1

Variable Model p (Mi) Outline

You might also like