Real-time flooding risk evaluation for ship-to-ship collisions based on first principles

.


Introduction
The survivability assessment for a passenger ship after a flooding event always identifies with the evaluation of the stability properties of the vessel in damaged conditions, i.e. the analysis and judgement of the residual righting lever curve GZ (Rahola, 1939).Such an approach intrinsically introduces the need for defining a "sufficient" amount of stability necessary to compare the quantitative analysis performed on the vessels' righting arm in several conditions.The meaning of such a required threshold value is still not explicitly clarified by in-force regulations (IMO, 2009), whereby a Required Index R is put forward as an acceptance/rejection instrument.However, it is not clearly explained what the meaning of the threshold is and what is implied in meeting the criterion or in which sense the goal of keeping the vessel upright and afloat is catered for.Such a question was first disclosed during the early 2000s, with the application of Risk Based Design approach (Papanikolaou, 2009) to the "Design for Safety" of passenger ships, ensuring the design of a vessel with a known safety level (Bergstrom et al., 2016) (Montewka et al., 2017) (Spyrou and Koromila, 2020) that, in case of damage stability, corresponds to a known flooding risk (Vassalos, 2009) (Vassalos, 2012).For the flooding risk, the two principal elements of the evaluation process concern the availability of damage stability codes and methods to better understand survivability as a function of time (Vassalos and Paterson, 2021) (Vassalos et al., 2022a), as well as advanced evacuation analyses to check the available time to abandon the ship once compromised (Guarin et al., 2014), following flooding casualty.
Notwithstanding the above, risk analysis for passenger ships does not cover the design phase only but should also include the operational phase (Du et al., 2020) or the vessel life cycle in general (Vassalos et al., 2021a) (Vassalos et al., 2022b).For such a reason, the elaboration of risk models for ships also covers, besides risk-based ship design, the operational risk evaluation and management and mitigation measures due to waterway complexity.For passenger ships, the risk assessment is always a combination of susceptibility to an accident and vulnerability in the accident (Goerland and Montewka, 2015), following the classical definition and approach to risk among industries (Aven, 2012), which means estimating accident occurrence and its consequences.However, the recent trend is to abandon a rigorous determination of probabilities of occurrence in favour of a more in-depth analysis of the uncertainties associated with an accident (Aven, 2022).Therefore, it is necessary to account for the risk model uncertainties.To this end, in the specific case of passenger ships, the target of the FLARE project (FLARE Flooding Accident Response, 2022) is to reduce model uncertainties through the employment of first principle-based tools for the evaluation of flooding risk.
In this sense, the early developments of FLARE allow for determining survivability models for damage stability employing a multi-level concept (Maccari et al., 2022).That means combining or substituting simplified static or quasi-static damage stability calculations with time-domain flooding simulations based on rigid body dynamics of the ship coupled with internal water motions, ingress and regress (Mauro et al., 2022a) (Mauro et al., 2022b).Such an approach is also valid for the design phase framework for risk assessment, employing the Possible Loss of Lives (PLL) as risk metrics (Vassalos et al., 2022c) (Vassalos et al., 2022d).However, the first developments of an operational framework for risk assessment inside FLARE (Ruponen et al., 2020) (Ruponen et al., 2022a) do not apply direct methods, keeping quasi-static analysis as the source for vulnerability assessment and proximity indicators (Gil et al., 2022) to assess accident susceptibility (Montewka et al., 2021).
The present work proposes the challenge of introducing direct methods for the operational phase of a passenger ship, posing the bases for developing a real-time risk evaluation methodology for onboard applications.Thanks to the recent developments of modern damage stability methodologies and advanced direct methods for collisions (Conti and Hirdaris, 2020a) (Conti et al., 2022a) and groundings (Conti and Hirdaris, 2020b) (Zhang et al., 2022) breach generation, it is possible to conceptualise a novel operational framework for flooding risk derived from the design phase structure entirely based on direct calculations.Furthermore, the same approaches may lead to the definition of real-time risk analysis for an onboard application.Such a process does not follow the susceptibility concept but evaluates the actual risk status from data and sensors available onboard, considering the associated uncertainties.The process, potentially applicable to both collision and groundings for the operational phase, is here described for the onboard risk assessment for ship-to-ship collisions only.The methods available for these topics are more mature for developing and applying the proposed approach.
The present work presents a new framework for the real-time onboard flooding risk assessment of passenger ships due to collisions.Here, the following main pillars provide an enhancement to state-of-the-art procedures in damage stability and flooding risk assessments: -Develop a risk-assessment framework for the design phase entirely based on first principle analyses.-Apply a multi-level approach to the flooding risk providing simplifications in case first principle analyses are not available.-Extend to the operational phase of the ship life cycle of the design phase framework.-Conceptualise a process based on damages and survivability databases for the real-time evaluation of flooding risk due to collisions.-Proof the applicability of the process in real time.
The paper addresses the points above in specific sections.Section 2 describes the flooding risk framework for passenger ships and its application to the design and operational phases.More precisely, section 2.1 introduces the multi-level assessment concept of flooding risk, providing simplifications in case first-principles calculations are not available for all risk components.Subsequently, section 2.2 presents the framework for the design phase, while section 2.3 addresses the operational phase of the vessel life cycle, including onboard applications (Section 2.4).Section 3 introduces a process to develop an onboard real-time risk assessment "tool" for use in collision scenarios.The latter presents a novel approach to risk assessment based on surrogate models derived from a database of direct calculations of crash analysis and timedomain flooding simulations.Finally, Section 4 presents the challenges of developing the surrogate models and provides an example of the applicability of such an approach to an arbitrary set of models.The notional example, presented in the paper, highlights the feasibility of the proposed concept for real-time flooding risk assessment onboard passenger ships.

First principle-based damage stability frameworks
The development of a framework for the flooding risk estimation of a passenger ship requires the execution of a set of recursive analyses, namely: 1. Information on the ship and calculation scenarios.2. Evaluation of the flooding risk.3. Identification of possible vulnerability mitigation measures.4. Reassessment of the flooding risk.This set of operations is applied already during the ship design phase or after a modification/refitting of the ship layout or a modification of the vessel's operational profile.
The risk due to flooding is well represented by the Possible Loss of Lives (PLL), which, according to the general definition of risk, is given by the following equation: where p f represents the probability of flooding, and c f is the consequence of the flooding event.The risk modelling and its evaluation for a passenger ship identify an attained Possible Loss of Lives level (PLL A ) and compares it with a required or tolerable risk level.To obtain a model suitable for the ship's life cycle, it can be worth considering a PLL A attained for each year of service (PLL A *), evaluating with more flexibility multiple operative scenarios.Therefore, the definition of PLL A * for a single scenario follows the general structure of equation ( 1) but with a more in-depth definition of p f and c f : N hz is the number of possible hazards, which in a probabilistic framework for damage stability, as described by project FLARE, consist of collisions, side and bottom groundings (N hz = 3).N op is the number of operational areas, which could be in open seas, in restricted or port areas.N ld is the number of loading conditions, which according to the FLARE framework, is limited to two loading conditions.Such an assumption differs from the in-force SOLAS regulations, which employ three drafts as standard.However, the approach works independently of the number of drafts selected for the analyses.Finally, N c is the number of flooding cases, which depends on the internal subdivision of the ship.The associated probabilities and consequences have the following form: The probabilities defined in equation (3) result from database analyses performed on the collection of accidents specific to passenger ships.Concerning the likelihood of the damage case, it is possible to express it as a function of the so-called p and s-factor, commonly used for damage stability analyses (Pawlowski and Przemyslu, 2004) (IMO, 2009) (Vassalos et al., 2022e).Equation (4) defines the consequences, composed of the fatality rate FR of each damage case and the people at risk POB for the associated event.Therefore, risk assessment necessitates D. Vassalos et al. the investigation of N = N hz N op N ld N c possible scenarios, considering not only the flooding survivability (as usual in damage stability assessment) but also the consequences of the flooding process in terms of loss of lives, thus considering the evacuation process when necessary.
As mentioned, the evaluation of the PLL A * requires the execution of a large set of calculations that, according to the spirit of a modern calculation framework, should be performed by employing first principle-based tools for flooding and evacuation analyses.Between the available alternatives presented by relevant, comprehensive studies on flooding risk (Vassalos, 2016) (Vassalos, 2022), the following options give the best compromise between accuracy and calculation time: 1 Flooding simulations: rigid-body time-domain simulations are the most suitable first principle-based method, modelling the flooding process with Bernoulli's equation.Such codes allow for a good insight into the flooding development in a complex layout with the ship subject to an irregular wave environment.2 Evacuation analyses: there are two possible ways to determine the total evacuation time of a passenger ship: a simplified and an advanced method.The simplified calculation method evaluates the flow of persons with hydraulic similarity.With the continuous growth of the passenger ship dimensions and, consequently, with the transport of numerous people (both passengers and crew), the simplified method could not be accurate enough to simulate the evacuation of the ship.In this sense, advanced calculation methods improve the capability to detect congestion areas and evaluate the total evacuation time.Such tools directly evaluate the evacuation issues for usage in a risk model.
Therefore, a framework for flooding risk involves using different software tools, catering for distinct determinants of flooding risk at the consecutive stages of the assessment.The process culminates in identifying risk control options and quantitative risk measures (Vassalos et al., 2021b).
The above-described structure applies to different levels of approximation for different phases of the ship's life cycle.This is true, especially for the design phase, the operational phase or for onboard emergency avoidance/management.The following sections describe the peculiarities of the multi-level nature of the framework for each particular moment of the vessel life cycle.

Multi-level approach
The boost provided by Project FLARE leads to the development of calculation frameworks, initially oriented to survivability only and afterwards extended to risk.Such frameworks combine the researchoriented vision of the flooding problem with the designer and operators' practical aspects.The calculation time and availability of suitable codes are the main obstacles to a global first-principle characterisation of flooding risk.Therefore, a multi-level approach, with consequent multi-fidelity results, significantly improves in-force damage stability frameworks for passenger ships.
The multi-level approach allows for adopting different tools or approximations for several aspects involved in the risk assessment after a flooding event.The main assumptions refer to three characteristics of the flooding process determination: the occurrence, the survivability and the fatality of a given scenario.Therefore, the definition of PLL A * of equation (2) assumes the following form for the case of a single scenario: According to the definition provided by equation ( 5), all the weights and probabilities associated with the scenario occurrence are grouped in p*, while s underlines the survivability of the scenario and c f the consequences as per equation (4).The different values or probabilities related to the occurrence, survivability and fatality are described by different levels in the risk evaluation process, as outlined in Fig. 1.More precisely, the occurrence is determined by the input preparation phase and during a Level 1 survivability assessment.Level 1 or Level 2 damage stability calculations determine survivability, while evacuation analyses determine the fatality.The different PLL levels associated with such a multi-level framework are as follows: -PLL Level 1: the approach employs only static damage stability calculations.The expected number of fatalities depends on the time to capsize, and the static analysis does not account for time.Then, the fatality rate estimate needs some approximation at this stage.To simplify the methodology and to account for the dependencies between survivability and fatality rate, the following simplifying assumptions are made: This simple and conservative approach aligns with the method used in the EMSA III Project.EMSA III is a project funded by the European Maritime Safety Agency, focussing specifically on the damage stability of passenger ships (post-Concordia Accident), the results of which were used to support political decisions at IMO, leading eventually to SOLAS 2020 regulations for damage stability.Moreover, research in FLARE, as reported in (Paterson et al., 2021), indicates that collated information from time-domain simulations on cruises and RoPax vessels provide some evidence in support of this assumption in that 80% of damage scenarios in a survivability assessment are transients, in which case no time for evacuation is available.
-PLL Level 2: The main parameters for Level 2 flooding risk estimation are Time to Capsize TTC and the Time to Evacuate TTE.The TTC relates to identifying the time it takes the vessel to capsize/sink after a flooding event.Therefore, TTC evaluation requires mandatorily the execution of time-domain flooding simulations, abandoning the static approach.The TTE indicates the time necessary for an orderly evacuation of passengers and crew onboard a passenger ship after a flooding hazard occurs.Hence, a rigorous determination of the TTE implies the execution of time-domain evacuation analyses.However, the multi-level framework includes simplified methods oriented to a fast TTE evaluation, thus providing two sub-levels for the Level 2 analysis.Such options are: o Level 2.1: this level of approximation considers only time domain flooding simulations to determine TTC.TTE evaluation does not require evacuation analyses; therefore, FR derives from the following empirical formulations: where n is the maximum allowable evacuation time in seconds according to MSC.1/Circ.1533.The assumption on FR intrinsically considers the nature of the capsize as a function of the TTC, assuming the impossibility to evacuate the ship during fast transient capsizes.
oLevel 2.2: This level relates to the direct evaluation of TTE.Starting from significant cases described by time-domain flooding simulations, where it is realistic to proceed with an evacuation analysis, ship motions and floodwater can be imposed on the evacuation software.Such a coupling allows comparing the evacuation process and the associated TTC.Fig. 2 shows the process, where the FR (in the reported case 1-FR) results from the intersection between the evacuation curve and the mean time to capsize TTC* among multiple irregular wave repetitions of the flooding process.
Further details, justifications and applied examples for the FLARE multi-level risk framework are given by (Vassalos et al., 2022c) and are not rediscussed here for the sake of brevity.The single definition of probability and values associated with occurrences, survivability and fatality is not only influenced by the selected level between the above-presented options but is also dependent upon the phase of interest during the vessel life-cycle.

Mitigation measures
If the flooding risk level detected for the operational phase is too high, then it is possible to study the application of mitigation measures for flooding risk specific to the ship operation.In the design phase, the detection and mitigation of risk concern global scenarios that may not have the same risk level as a specific operation on a selected route.If this is the case, the application of additional mitigation measures may be studied by following the same approach adopted for the design phase (Vassalos et al., 2021a) (Vassalos et al., 2022f).
A detailed description of the possible risk control options (RCOs) to be installed onboard has been provided by (Tompuri et al., 2020); however, the possible implementation of additional RCOs from an operational perspective may not include all the possible mitigation measures addressed during the preliminary studies.Several RCOs imply the reconfiguration of the internal layout of the vessel (Vassalos et al., 2022f), something that is possible to address only during the design phase (Vassalos et al., 2021b).Therefore, risk mitigation during the operational phase should be restricted to a set of measures that do not imply a reconfiguration of the vessel layout, but just the possibility to be used in case of necessity using the existing layout as a basis.In this respect, the possible mitigation measures that could be investigated are those limiting locally the flooding progression, namely deployable barriers.

Effectiveness of proposed modifications
Once eventual modifications for the design or the operational environment of the ship are changed, calculation procedures for the recursive risk assessment can be carried out a second time.Such an issue gives the possibility to understand whether the proposed modification decreases the qualitative level of risk evaluated for the original scenario.If the risk is still not acceptable, the loop can be repeated, studying new or alternative countermeasures until obtaining the desired level of risk.
In particular, the following sections describe the main differences and challenges typical for the flooding risk assessment during the design phase, the operational management of the ship and onboard prevention of a hazard.

Design phase
The implementation of the risk framework for the design phase of a passenger ship requires the definition of the main inputs and parameters to be capable of evaluating PLL A * according to equation ( 2), with input and information available in this specific stage of the vessel life cycle.Moreover, during the design phase, it is essential to refer to regulations, assumptions, and requests from the statutory damage stability framework.As such, this necessity reflects in the selection of the frequencies and probabilities associated with the occurrence, survivability and fatality of a scenario and in the generation of the cases to be analysed.Hereafter, the main assumptions for the FLARE framework during the design phase are listed: -Possible hazards: the framework can handle three kinds of casualties (N hz = 3); collisions, side, and bottom groundings, namely.Such hazards imply the adoption of specific frequencies of occurrence p hz, corresponding to the relative weights w used to define the A-index in the damage stability frameworks.Suitable values for p hz derive from database analyses and are reported in (Vassalos et al., 2022c) with the associated w adopted in FLARE.
-Operational areas: for design purposes, only open sea is considered (N op = 1), limiting the wave conditions to a representative sea state corresponding to a significant wave height H s of 4 m.Such an assumption is considered for Level 1 or Level 2 risk assessment.
-Loading conditions: as previously mentioned, the framework presented in FLARE is based on two drafts T 1 and T 2 having the same weight on the final assessment and corresponding to 0.45 and 0.75 times the design draught of the ship, respectively.Such an assumption is maintained across the levels and does not follow the SOLAS standards, which are based on three draughts.
-Calculation scenarios: the number of scenarios proposed by the FLARE framework changes with the level selected for the risk assessment.For a Level 1 prediction, 10,000 breaches are generated for each hazard type, sampling the location and dimensions from pertinent cumulative distributions (Mauro and Vassalos, 2022).As  time-domain simulations are more time-consuming than a static approach, the number of scenarios is reduced to 1,000 breaches for each hazard.Levels 1 and 2 refer to the same damage distributions, SOLAS for collisions and EMSA III for bottom and side groundings.
According to the given assumptions, equation ( 2) can be rewritten by modifying the occurrence terms provided by equation (3), resulting in the following final formulations valid for Level 1 and Level 2 predictions, respectively: the main differences between the two equations are in the determination of the scenario's occurrence p c * and the final number of scenarios N c .Such differences are strictly connected with the nature of damage stability calculations.In fact, the generation of breaches is equivalent between Level 1 and Level 2, sampling damage characteristics with an enhanced Randomised Quasi-Monte Carlo technique and following a non-zonal approach.However, by employing a static assumption (Level 1), there is no sense to distinguish between cases damaging the same group of internal compartments.Therefore, the final amount of scenarios to evaluate is N c *<10,000 and strictly depends on the ship's internal layout.All cases referring to the same damaged compartments are grouped to determine the scenario occurrence p c *. On the contrary, employing dynamic simulations (Level 2), the grouping is no more possible as the dimension of the breach is influencing the amount of water entering/abandoning the ship.Then, for Level 2 calculations, all cases are equiprobable and all the 1,000 scenarios are considered with the same p c *.The framework allows for a hybrid approach, considering in Level 2 assessment only the case with the higher breach longitudinal area resulting from static calculations (Mauro et al., 2023).In any case, the suggestions and developments performed in FLARE are aimed at consolidating the employment of dynamic analyses for the damage stability assessment of passenger ships and, consequently to opt for Level 2 assessment of flooding risk.
Concerning the evaluation of the consequences and FR in particular, preliminary calculations performed during the FLARE project highlight small differences between Level 2.1 and Level 2.2 assessments (Vassalos et al., 2022c).The implementation of design phase assessment at Level 2.2 on one cruise ship and one Ro-pax underlines the substantial equivalence of the final attained risk level employing or not advanced evacuation analyses.Therefore, appropriate determination and coupling between TTC and TTE from direct calculations will for sure benefit further studies in the future.

Operational phase
Operational flooding risk can be evaluated using the concept of accident susceptibility (Gil et al., 2022) and consequent vulnerability, adopting the approach described in (Ruponen et al., 2020).The method requires the availability of AIS data (Du et al., 2020) (Zang et al., 2021) for the selected route, together with the associated sea bathymetry.Besides, evaluating vulnerability, a database should also be available having the required information necessary to evaluate vulnerability to flooding risk.According to the process developed in (Ruponen et al., 2020), vulnerability is assessed through a simplified A* index derived from specific static calculations, that can be used to estimate the relative index r*, which is the measure of vulnerability due to open WTDs.The A* and r* databases employed in (Ruponen et al., 2020) are not part of the design phase FLARE framework; therefore, the application of such a method to assess vulnerability requires loading an external database coming from static damage stability software.
As an alternative, PLL can be used as the measure of flooding risk, as described above.Such an option implies that the operator can select the level of accuracy of risk estimation as was the case for the designer according to the design phase framework (Vassalos et al., 2022d).Therefore, the formulation of PLL given by equation ( 2), or the reworked form of equation ( 5) is still valid as a starting point for flooding risk evaluation, leading to the following definition for the operational phase in a single scenario: Where all the terms have the same meaning as in equation ( 5), with a probability of occurrence of scenario p*i, survivability si, and fatality rate fri, whilst accounting for the People On Board (POB).If the hazard has already occurred, the probability phzi is 1, otherwise, this needs to be estimated.This is the standard definition of PLL for a design phase framework (in which case the frequency of occurrence of pertinent hazards is derived from the developed FLARE accident database).However, the process is not the same as described in a design-oriented framework to evaluate the PLL from an operational perspective.In case such an approach is selected, there is the need to develop a database approach to determine each component of the PLL.More precisely, all the components of equation ( 5) should be identified by a proper database.
The structure of the operational framework should reflect the general layout of the basic guidelines described for the design phase, more precisely for what concerns the preparation of hull geometry input and internal layout.As mentioned, the operational framework requires the definition of additional input for the operational profile of the vessel not needed for the design phase as well as the vulnerability databases.Fig. 3 shows an example of a suitable recursive process for an operational framework.
Two different approaches may be followed to determine the operational PLL: direct time-domain simulation of a ship voyage or probabilistic determination of PLL in the selected scenario.As the simulation of a voyage scenario has characteristics similar to what may be needed by a real-time onboard risk evaluation, this section discusses the probabilistic way only and the voyage will be separately discussed afterwards.
Considering equation ( 10), the PLL for a damage is evaluated by the combination of the damage occurrence, the probability of not surviving the damage, the fatality rate occurring in the specific case and the POB.This approach is fully in line with the design phase framework, except for the source of the single PLL components and the frequency of each hazard in question, as explained above.Being this work oriented to shipto-ship collisions, the operational phase is here discussed for the The determination of the occurrence of a specific accident (collision damage case) is now depending on the operation of the vessel in question and no longer on statistical or regulatory sources.Therefore, the sources of the p* terms should be determined by employing direct crash simulations specific to the operational scenario.The process to perform this task has been conceptualised for collisions and bottom groundings (Conti and Hirdaris, 2020a), and it has been demonstrated that suitable probability marginal distributions can be provided from direct collision simulations on a specific ship location (Conti et al., 2022a).Besides, local statistics for the environmental condition have to be considered from specific observations or available long-term statistics.Therefore, the p* component in equation ( 10) can be decomposed into the following sub-terms for collision hazards: where the single terms are: -Damage position occurrence (p XM ): derives from the marginal distribution of the longitudinal collision damage centre derived from the crash simulations.
-Damage length occurrence (p Lx ): derives from the marginal distribution of the collision damage length derived from the crash simulations.
-Damage penetration occurrence (p Ly ): derives from the marginal distribution of the collision damage penetration derived from the crash simulations.
-Damage height occurrence (p Lz ): derives from the marginal distribution of the collision damage height derived from the crash simulations.As an alternative, the upper vertical position z UL of the damage can be used, depending on the output of the crash simulation tools employed for direct calculations.
-Damage low z limit occurrence (pz LL ): derives from the marginal distribution of the collision damage low z limit determined by the crash simulations.
-Weather condition occurrence (p WC ): determination of the probability of occurrence of the specific environmental conditions (Hs and Tz) and vessel encounter speed and angle.
The marginal distributions can be obtained from direct crash calculations concerning geometrical parameters of collision damages prescribed in SOLAS/eSAFE (Fig. 4).However, the shape of the damage is slightly different, as the damage derived from direct calculations is assumed to be box-shaped, while the SOLAS one follows the waterline at the actual draught of the ship (Fig. 5).This has an impact on survivability (Mauro et al., 2023), however, the box-shaped approximation is, nowadays, the most appropriate modelling for coupling direct crash simulations with time domain flooding analyses.
The differences between the conventional distribution generally applied in the design phase framework and custom scenario-specific distributions are shown in Fig. 6, where a reference case for damages located amidships is shown (thus x D = 0.5L s ) for the operations in the Gulf of Finland (Conti and Hirdaris, 2020a) (Conti et al., 2022a).This is a simplified case, as only amidship location is considered, but can be used to explain the differences shown on the other damage dimensions.
Besides the probability distributions for the damage dimension and locations, also the environmental conditions have to be selected.In this respect, some assumptions are still needed to make the amount of calculation reasonable and comparable with the design framework process.There is, of course, the possibility to adopt complex models considering the joint distribution of H s and T z (in the form of scatter diagrams as reported in Fig. 7).However, such an approach is not part of the design phase framework which adopts only the modelling of H s , varying Tz according to a constant wave steepness of 0.02.The same process should be applied also to the probabilistic operational framework for methodological coherence and understanding of the provided results.Therefore the p WD should be considered as a route-specific distribution of H s .Dynamic simulations should then be performed assuming the sampled H s , zero speed assumptions and encounter angles of 90 or 270 • (i.e.collision on starboard or port side with wave concurrent to the damaging side).Such assumptions derived from the design framework provide a result that is on the safety side, as such encounter angles are unfavourable compared to other headings for vessel survivability.
The evaluation of survivability for the damage cases should follow the PLL Level 2 predictions of the design framework, thus employing time-domain simulations based on rigid-body dynamics of the vessel coupled with a flooding process governed by the Bernoulli equation only for critical cases.In such a way, si is given by a combination of static and dynamic calculations/simulations.As an alternative, only dynamic simulations can be performed, increasing calculation time but also the reliability of the results.
Having performed the dynamic analyses, the average TTC for each evaluated case is known, allowing for the calculation of PLL according to Level 2-1 or Level 2-2 assumptions.The already described design phase framework can cover such an approach to the operational phase, providing tailored damage distributions and selecting a Level 2 approach for PLL OP calculations.

On-board applications or voyage simulations
The second option is the simulation of a voyage employing a simulator tool (or digital twin) of the operating ship.Such an approach implies the simulation of the ship's navigation system and the simulation of traffic and weather conditions along the selected route.
Examples of such kinds of simulations have been performed in (Ruponen et al., 2020).However, the methods developed during that study refer to the already-mentioned concept of accident susceptibility.Such a concept measures with a qualitative scale (from Negligible to Very-High) the attitude of the ship to be potentially subjected to a hazard, based on the combination of two indices related to traffic and waterway complexity.An example of a voyage simulation is shown in Fig. 8 for a passenger ship sailing in the Baltic Sea.The figure shows the route and the associated levels of complexity for the traffic and the waterway together with the ensuing accident susceptibility.(Mauro et al., 2023).
In (Ruponen et al., 2020), susceptibility is associated with vulnerability according to the adoption of key performance indicators as A* and r* indices, derived from static calculations with different opening statuses for WTDs.The last part of the process should be substituted by the estimation of PLL in real-time.Then the simulation process should follow the steps described in Fig. 9.
Therefore, direct simulation of the voyage requires the adoption of the same methods needed by a real-time PLL estimator.For such a reason, the description of this particular option is given in the next chapter, when real-time risk estimation is explained.

Real-time flooding risk estimation due to collisions
Software for real-time risk estimation on-board of passenger ships (or ships in general) should be capable of performing the following tasks: -Identify potential hazards.
-Evaluate risk levels associated with the detected danger.
-(optional) Provide countermeasures to reduce risk.
The last point is optional, as this is part of an onboard DSS (Decision Support System), which is not included in the final scope of the FLARE Project and, consequently, of the present research.The following approach is a preliminary guideline to achieve the final scope of the process, providing a real-time risk assessment, during different phases: -Before an accident.
-After an accident.
These two aspects should be both covered but need dedicated analyses and implementations.However, this work covers only the flooding risk before an accident, the risk estimation after the accident should be separately analysed with a more in-depth focus on evacuation analyses.As the preliminary indication in FLARE shows that the impact between a Level 2-1 and a Level 2-2 is minimal, the real-time risk estimation is here covered up to Level 2-1, thus neglecting evacuation analyses.The  outline of such a real-time risk estimation tool is depicted in Fig. 10 for the case of the ship-to-ship collision.The following sections provide a description of the action necessary to realise an onboard risk estimation tool pursuing the path of a fully direct approach, considering enhancement provided by several studies within the FLARE project.

Hazard detection
The first step for real-time onboard software is the detection of a potential hazard, in the specification of a possible collision or grounding.The tool should work in symbiosis with onboard bridge instrumentation, receiving real-time data from Sonar, Radar, GPS and AIS, or other relevant sources of information present on board.
The identification of a collision requires: 1. Estimation of the route, speed and main dimension of ships sailing within a given range from their ship.This information comes from Radar and AIS data received onboard.2. Estimation of the environmental conditions from onboard instruments.3. Calculation of target ship estimated path and comparison with actual and predicted vessel path.4. Estimating the possibility of collision and assessing the most probable location, angle of encounter and speed at which it will occur.
Such kind of actions can be performed by employing different levels of simplifications.Estimation of the route can be performed by consecutive interrogations of GPS, Radar or AIS data, evaluating the future position of an object based on its actual position, heading and speed.The possibility to have multiple sources for the input variables allows for the potential mitigation of loss of data, as, especially for AIS sources, the transmission may not be continuous (Montewka et al., 2021).
The data that needs to be extracted from the different possible sources of input are: -Ship latitude: is the latitude in degrees of the actual position of the ship and can be obtained from the onboard GPS.
-Ship longitude: is the longitude in degrees of the actual position of the ship and can be obtained from the onboard GPS.
-Ship speed: the actual speed of the ship in knots, available from GPS and other onboard instrumentations.-Ship heading: is the actual heading of the own ship WRT North, expressed in degrees.Can be obtained from GPS or onboard compass.
-Target latitude: the latitude in degrees of a possible target ship.This can be obtained from the AIS data source or GPS.Alternatively, the radar system can directly detect the distance between the two objects.
-Target longitude: the longitude in degrees of a possible target ship.This can be obtained from the AIS data source or GPS.Alternatively, the radar system can directly detect the distance between the two objects.
-Target speed: the speed of the target ship that can be derived from the GPS, AIS data or indirectly derived from consecutive position measures.
-Target heading: the heading of the target ship that can be derived from GPS, AIS data or Radar.
-Target ship type: type of target ship derived from AIS data.
-Target ship length: length of the target ship derived from AIS data.
-Target ship breadth: breadth of the target ship derived from AIS data.
-Target ship draught: draught of the target ship derived from the AIS data.
-Environmental wave height: significant wave height H s in the ship operation that can be estimated onboard, using for example a wave radar or from ship motion recordings Starting with the above data, it is possible to determine the possibility to face a collision with multiple concurrent objects.
The estimation of possible occurrence of the collision can be esti-mated using the evaluation of minimum distance DTC and time to possible collision TTPC.Assuming a cartesian reference system centred on the ship, the DTC can be estimated as follows: where xs and ys are the estimated positions of the ship and xo and yo are the estimated position of the identified target at future instants τ until a maximum time Tmax.At every future time, the TTPC can be determined by: where Nτ is the number of τ intervals.The use of equations ( 12) and ( 13) implies the selection of criteria to be used to assess the possible occurrence of an accident, employing for example the COLREGS method (Fig. 11) used in early FLARE developments for susceptibility analyses (Ruponen et al., 2020).
From the collision check, an estimate of the possible position, speed and encounter angle of a target object can be determined and used to estimate damage dimensions.In case of potential grounding damage, use can be made of information coming from sonar or preloaded bathymetry in the onboard navigation system.In such a case, the detection of an obstacle follows the same assumptions as for a collision.However, with the focus of this process on collisions, it will be here not further analysed.

Evaluation of the risk level
The execution of real-time survivability calculations cannot be pursued as a possibility to assess the flooding risk during operation and its consequences.This was already known before the FLARE project and has been further confirmed during a new set of benchmark activities on flooding simulation software (Ruponen et al., 2021) (Ruponen et al., 2022b) (Ruponen et al., 2022c).Therefore, a possible solution is to use a dedicated set of preliminary calculations populating dedicated databases for the quantities to predict.With the adoption of direct approaches to survivability assessment after flooding, being one of the goals of the FLARE project, the databases should be developed adopting advanced tools for collision/grounding crash simulations, dynamic flooding assessment and evacuation, in such a way to estimate PLL as a metric to evaluate the actual risk level.

Damage model
The damage model for a real-time risk assessment should be based on databases of direct calculations composed of outputs coming from crash simulations.To this end, a valuable compromise between calculation time and accuracy and reliability of the results is given by calculation provided with SHARP software, tested and compared with more advanced BEM models during a dedicated crash analysis benchmark (Kim et al., 2022).Such kind of crash simulation is capable to simulate the scenario of a ship-ship collision, as depicted in Fig. 12.
The methodology is capable of providing an indication of breach dimensions and energy absorbed during the impact, requiring vessel dimensions relative speeds and damage location as input.Having all the required input and the output of the damage detection model previously described, the SHARP simulations are suitable to be used for damage modelling for real-time risk estimation problems.
However, even though the calculations do not require too much computational effort, the process is not fast enough to perform a realtime estimation of potential breach dimensions.Therefore, it is necessary to perform a wide set of preliminary calculations in such a way as to obtain a global database, suitable to have a sufficiently accurate description of potential damages that may occur in a specific operational area.
To this end, the methodology adopted in (Conti et al., 2022a) to determine custom damage distributions shown in Fig. 6 should be reworked and adapted to the necessity of a real-time risk estimator.
Besides the generation of the database itself, it is necessary to investigate also a method to generate a proper surrogate model from the database, suitable to provide all the relevant information concerning the breach faster than in real-time.Therefore, the general schematisation of the damage model can be the one shown in Fig. 13.
From the collision detection model, the values and indicators that are provided to the damage model coincide with the input necessary to identify a SHARP simulation, i.e. the striking ship speed V T , the relative heading β T , the collision location x D , the side identifier I side and the striking ship main dimensions (L s , B s and T s ).
As the provided input to the damage model is subject to uncertainties, it is unlikely to consider such input values are unique and distinct.Therefore, the process considers a distribution of input values, more precisely a normal distribution for each input having the mean as provided by the collision detection model and the standard deviation reflecting the uncertainty of the process (in case it is possible to determine it) or more generally an ignorance factor.
As a direct consequence, also the provided outputs (i.e. the damage length L D , the damage penetration B D , upper and lower limit z LL and z UP ) will be subject to uncertainties and thus provided as distributions instead of single values.

PLL model
After the definition of the real-time damage characteristics through the damage model, the PLL should be evaluated.PLL determination is composed of three steps, as shown in equation ( 1), necessary to evaluate the case occurrence, the survivability and the fatality rate.In a real-time risk assessment, the process is not properly the same, as the concept of occurrence is no longer related to the probabilistic distributions of the damages and environmental conditions described for the probabilistic approach to PLL calculation.The collision detection model determines the occurrence, which means that once the collision is predicted p is equal to 1, 0 otherwise.More precisely, the effective p is given by the Fig. 12. Collision scenarios modelled with SHARP software (Conti et al., 2022a).distribution of values given by the collision model, thus it is inherited in the PLL model too.
The PLL model can be then split into two sub-models, one for survivability and one for the fatality rate, to be applied in cascade.
The survivability model is schematised in Fig. 14 concerning the surrogate model that should be applied here for the same reasons highlighted for the damage model.A direct method for survivability implies using dynamic simulations that are far away to be directly employed for real-time predictions.Also in this case a database of calculations should be created, taking into consideration the relevant inputs that may affect a dynamic flooding simulation.
The detailed description of methods and inputs necessary to perform time-domain dynamic simulation has been already provided by preliminary FLARE studies (Guarin et al., 2021), thus a detailed database of calculations should be built varying the inputs described in Fig. 14, which means the damage location and dimensions, the loading and the environmental conditions.

Real-time PLL calculation
The process described in the above sections is not giving a single value as an output, but a distribution of PLL values for every target j that may be detected at each time step.There is no theoretical limit to the number of possible targets that can be detected by the collision detection system, the limit can be given by the software and hardware used to perform the calculation.The presence of different possible targets implies the detection of different PLL distributions for every target.With the aim of the real-time PLL calculation being to identify the higher risk level for the ship, the system should identify only the target having the higher PLL level in its integral form.Therefore, the final PLL value to be displayed is given by: Where N T is the number of targets and PLL** is one of the N b members of the PLL distribution of every detected target.The structure of the PLL(t) determination represents a Monte Carlo-like integration process, that allows for the inclusion of all kinds of uncertainties associated with the input data sources.The resolution of equation ( 14) can be obtained with conventional Monte Carlo calculation or with Quasi-Monte Carlo methods to speed up integral convergence.
The described process allows a real-time screening of the PLL for passenger ships, employing the outcome of direct methods for damage generation (crash simulations) and survivability (dynamic flooding simulations).The methods necessary to provide suitable databases for damages and PLL will be briefly discussed in the next section as a preliminary overview of future specific publications on the topics.

Discussion and calculation example
The real-time risk estimation method described in the previous section for ship-to-ship collisions requires the definition of suitable databases of breaches generated through direct crash analyses.Besides, it is also requested have an analogue database for survivability, which covers the breaches domain evaluated with the crash simulations.Of course, also survivability database needs to be evaluated with direct flooding simulations.Such an approach ensures the capability of the process to provide a Level 2-1 flooding risk assessment.However, a realtime risk evaluation system requires that calculations should be fast enough to be executed faster than real-time.Therefore appropriate surrogate models for breach dimensions and locations should be also available for a fast interrogation of the databases.Hereafter, a possible way to build such instruments is briefly introduced, providing a mockup model to check the feasibility of a real-time calculation.

Database and surrogate model development
The necessity of estimating PLL in real-time according to the procedure described in section 3 implies that a breach damage database and a vulnerability database should be created by employing direct calculations.Afterwards, the database should be replaced by surrogate models suitable to provide a fast prediction of relevant variables.To this end, the design of experiments (DoE) is a suitable way to reduce the amount of observation needed to assess the variation of multiple dependent variables from independent ones.Of the many methodologies available for the generation of such experiments, the most commonly used are the factorial designs and their orthogonal variations (Box-Behnken designs, Central Composite designs, etc …).Such methods are used when surrogate models have to be derived from the experiment set.Factorial design space is an advantage when the interaction between different independent variables should be found.However, the method is intrinsically stratified, thus the independent variables assume only predefined values.Other options like random-based design are capable to cover the design space without stratification, but they do not grant an optimisation of the experiment to execute like in factorial design.
Pursuing such an approach, the creation of the damages database for the onboard real-time PLL estimation becomes an extension of the process developed in FLARE for direct crash analysis (Conti and Hirdaris, 2020a) (Conti et al., 2022a).Concerning survivability, the generation of a database implies the execution of damage stability calculation on the struck ship, considering the internal layout of the vessel.To reduce the number of simulations needed to generate a comprehensive database of damage cases, methodologies based on a reduced set of dynamic simulations (Mauro et al., 2022a) (Mauro et al., 2022b) can be employed without losing confidence in the final results.
Surrogate models are simple analytical models that mimic the input/ output behaviour of complex systems.Developing such models requires performing computationally expensive simulations at a set of carefully selected sample points.These models approximate the behaviour of the underlying complex simulations to a reasonable precision while also being computationally cheaper.Surrogate models can thus be seen as a simple representation of a complex system with potentially reduced accuracy in a given domain.The trade-off between the accuracy and the computational time is an important consideration during the construction of these models.
The construction of a surrogate model is comprised of three steps: -selection of the sample points.
-optimisation or "training" of the model parameters.
-evaluation of the accuracy of the surrogate model.
Although several machine learning and regression techniques have D. Vassalos et al. been developed for surrogate model construction, there has been little work on how to best select the appropriate model for a particular application for either design space approximation or optimisation.For studies applying surrogate modelling techniques for process design and optimisation, models are mostly selected using process-specific expertise with no systematic basis for the selection.During the FLARE project, the employment of multiple linear regressions, neural networks and forest trees has been investigated for the mentioned problems (Conti et al., 2022b).Summarising, the following steps are needed for the development of suitable models for real-time risk assessment due to flooding in the case of ship-to-ship collisions, employing the available software tools within FLARE: -Damage breach database generation: generation of a database of damage dimensions due to collisions using direct calculations with SHARP software.The scenarios are defined with DoE techniques, to reduce the number of calculations.
-Damage dimensions surrogate models: identification of surrogate models for damage breach dimensions from the generated database.Models are identified using different regression and training techniques.
-Vulnerability database generation: generation of a database of time to capsize after collision damages in calm water and irregular waves using time-domain simulations with PROTEUS3 software.The database is generated with a new technique based on uniform randomised quasi-random samples.
-Time to capsize surrogate model: identification of surrogate models for time to capsize in calm water and irregular waves employing the same methods as per damage dimensions.
The steps described above have been already investigated by the authors in the internal developments of FLARE, but need dedicated publication to properly discuss in detail the methods and processes needed by the single steps of database and surrogate model creations, both for breach dimensions and survivability.
It is worth mentioning that the described process can be used to cover also groundings hazards, providing the right simulation tools for the breaches generated by such a kind of hazard.

Example of damage and survivability surrogate models
Hereafter, an example of the surrogate models developed for a reference cruise ship is reported, limited to the employment of multiple linear regressions.Table 1 reports the main dimensions of the reference ship, while Fig. 15 shows its general arrangement.The reference ship is the principal reference hull of the FLARE project, being one of the hull forms used for benchmarking damage stability codes (Ruponen et al., 2021), thus giving confidence for the results of damage stability calculations employing the PROTEUS3 solver.Furthermore, this ship has been used as a reference for all the developments leading to the establishment of the design phase risk framework.
The generation of surrogate models for real-time risk evaluations necessitates the definition of pertinent databases for damage dimensions and survivability.The proper definition of damage and survivability dataset requires the filling of a wide multi-variable space, leading to the execution of a significant number of simulations for either crash or dynamic analyses.The correct minimum number of simulations needed to capture all the possible scenarios has not been yet defined and should be studied in the future.Here, to provide an example of the process an arbitrary number of simulations has been selected, based on the experience with crash analyses and flooding simulations damage screening.
To generate the damage database, a set of scenarios has to be generated from a set of collision simulations between the reference ship and a set of potential striking vessels.Table 2 reports the dimensions of the vessels employed as possible striking ships for SHARP collision simulations.Those ships are a representative sample of the worldwide fleet, as indicated by dedicated studies on crashworthiness (Conti and Hirdaris, 2020b).For this example 11 potential striking ships have been considered, simulating with the super element method 5500 possible scenarios, considering a combination of collision angles (uniformly distributed between 20 and 90 • ), vessels speed (2,4,6,8,10 m/s), the longitudinal position of impact (uniformly distributed between 0.2 and 0.8 L) and 3 draughts for each vessel.
For the survivability database, it is necessary to evaluate the TTC from a set of flooding simulations with PROTEUS3 software.The strategy for creating the database is different from the conventional damage stability assessment according to SOLAS and FLARE design phase framework.Here, instead of performing damage screening on a set of 10,000 damages generated with statutory marginal distributions, a reduced set of 500 breaches is performed employing uniform distribution for the damage characteristics.Such an approach allows for detecting critical cases, giving uniform coverage of all possible breaches that may occur on the reference ship (Mauro et al., 2022b) (Mauro et al    ).Thanks to the employment of the QMC sampling method, the coverage of the breach space is in any case more evenly distributed than using conventional MC methods.Therefore, with 500 simulations it is possible to describe with sufficient accuracy the possible breaches that may occur after a collision.As the simulations deals also with irregular waves at the H s of 1.0, 2.0, 3.0 and 4.0 m, 10 repetitions per scenario have been carried out to consider the random phases in the wave spectrum.Therefore a total number of 20,500 simulations has been performed on the reference ship, evaluating the TTC per each damage case as the mean value among the 10 repetitions.The simulation time has been set to 90 min for all the simulated scenarios.Fig. 16 gives an overview of the results obtained for the crash analyses and the flooding simulations in calm water.The figure shows just a part of the data for the sake of brevity, as more detailed analyses require dedicated work and are not in the scope of the present paper.For damages, the dependency of damage penetration with the position is presented, considering all 11 striking ships (different colours), highlighting the uniformity of results across the length of the vessel.
The dependency of the damage length with the position is reported for the flooding simulations.For the calm water case, The different colours refer to the number of criteria that failed during the simulations, which means criteria related to the maximum heeling, the average heeling in a given time, and the amount of water entering the ship at the end of the simulations.Such criteria are the standard applied in dynamic flooding analyses.Also in this case it is possible to notice the uniform coverage of the space obtained by applying the QMC sampling.Therefore the two databases cover a possible design space for damages and associated vulnerabilities.
Having two homogeneous databases allows for determining surrogate models to quickly evaluate the damage dimensions and the TTC.
Here, the models have been derived employing a multiple linear regression technique.For the damage dimensions the variables to be considered are 5, the striking vessel speed, the collision angle, the longitudinal position of damage, the striking vessel draught and the struck vessel draught.Employing a complete 4th-order polynomial regression (except for the two draughts that go up to the 2nd order), the final regression has been obtained removing not significant variables to maximise the goodness of fit of the regression.Fig. 17 shows the predicted/starting values for the damage length, penetration and upper/ lower limitations.As reported in the figure, the obtained regressions have a high value for the goodness of fit, thus the model is a good representation of the initial database.
The same has been performed for the TTC.In this case, the initial variables are the damage dimensions and location.However, the goodness of fit is not always giving a real effective matching between predicted and observed data.For this specific TTC case, this is important as a wrong prediction of the variable may lead to a wrong detection between capsize and not capsize of the ship in the same scenario.Fig. 17 shows also the predicted/starting values for TTC in the four irregular wave environments analysed in this example.It can be observed that the predicted and observed values are dense close to the extremities of the TTC space, having higher density closer to TTC = 0 s.This happens for all the tested conditions but increasingly the significant wave height strengthens the phenomenon as TTC intrinsically reduces.This is a problem for the regression models, as it is hard to reproduce well the behaviour close to the extremities of the domain.Therefore, for TTC, the employment of more advanced regression techniques may be suggested.
Notwithstanding the above, the two surrogate models for damage dimension and TTC can be used to demonstrate the feasibility of the Level-2.1 PLL calculation in real time for possible onboard applications.

Feasibility of the proposed real-time PLL calculation method
Even though the above-mentioned databases are not yet available for a wide set of passenger ships, it is possible to test with the fictitious models presented afore the capability of the developed approach for the execution of real-time computations.To this end, the process has been implemented with the described surrogate models for breach location and dimensions and the PLL.Besides, gaussian errors have been added to the main input to simulate the uncertainties of the sensors producing the inputs to the models.Such a strategy allows for the testing of the calculation procedure and the evaluation of the suitability of a Quasi-Monte Carlo integration to evaluate the real-time PLL as given by the method described in section 3.
Therefore, the present test follows the subsequent steps for the simulation of a real-time calculation system: -Generation of arbitrary input data from onboard sensors.
-Addition of Gaussian noise to simulate sensor uncertainties.
-Sample an amount N QMC of breaches from the Gaussian input with a QMC method.
-Evaluate the distribution of the PLL at a Level 2-1 Proper modelling of errors and uncertainties requires the knowledge of all the sensors and measuring systems installed onboard and involved in the collision detection tool.However, at this stage of the project, such kind of information is unknown, and, consequently, some approximations have to be considered.Therefore, here a general model based on a Gaussian error on the initial input value is considered, as it is sufficiently general to be further extended and modified in consequence of future and more detailed studies.Then, each one of the inputs to the damage model assumes the following form: Where μ i is the original input value to the model (interpreted as the mean value of the process) and σ i is the associated standard deviation, simulating an uncertainty on the mean value.In the demonstration, the value modelled with this uncertainty is the target ship speed V T , the position of the breach centre x D and the collision angle β T .The arbitrary standard deviation reference values for the demonstration have been set to 1.5 knots for the speed, 10 m for the breach position and 5 • for the angle.The value is arbitrary and should be not intended to be proposed as the real value to be used on an onboard tool, is just reference input used to test and demonstrate the applicability of the real-time PLL calculation.
As a result of the application of equation ( 15) to the three inputs, the initial dataset is no more composed of a tuple of data but is composed of a tuple of probabilistic distributions of data, having equation ( 15) as marginal probability density functions.In the absence of additional indications on possible couplings between uncertainty levels of two or more inputs, the three distributions are here supposed to be independent random variables.
Having modelled the uncertainties, now the PLL calculation process is handling distributions and no more single values, therefore, to have again a single value as an output, a possible solution is to obtain the realtime PLL value as a Quasi-Monte Carlo Integration process on a sample of input values.Such an approach leads to the final calculation of PLL with the following formulation: The process described by equation ( 7) should be applied to a sample of N QMC quasi-random numbers, otherwise, adopting conventional pseudo-random numbers, the PLL value will be no more unique unless performed millions of calculations.Here the adoption of Sobol sequences allows for the reduction of N QMC up to a value of 1000, ensuring convergence of the final integration.Fig. 18 shows the final process of calculation of real-time PLL including the uncertainties in the input values.The total calculation time necessary to estimate the PLL is of 0.03 s employing a polynomial model for the damages and TTC.Thus the process can be applied in real-time computations.

Conclusions
The present work has formalised and described a framework for flooding risk assessment in the operational phase and real-time applications.The resulting process is fully aligned with the design phase framework developed and tested within the FLARE project.The operational framework allows for using the same levels of details and confidence for the estimation of flooding risk and estimation of the probability of loss of lives, giving preference to higher fidelity methods, namely Level 2-1 and Level 2-2 predictions.Furthermore, the operational framework allows following a probabilistic path that could be applied directly within the available FLARE framework software, just changing the source of damage distributions.Besides, the operational framework describes the evaluation of PLL also during a voyage simulation, using a real-time PLL estimation method based on databases of damages and vulnerability, which is not needed during the design phase.The same models are suitable for application on a real-time PLL estimation onboard, based on Level 2-1 predictions, thus, for the time being, neglecting evacuation analyses.
The present paper discusses and introduces the need for the development of dedicated databases for damage models and survivability after a flooding event due to collision.The application of a mock-up set of damages and vulnerability surrogate models highlights the applicability of the calculation methodology for a real-time application.However, the complete application of the process to onboard application requires the knowledge of the onboard sensors to evaluate the uncertainties associated with the measurement systems.Therefore, the present applicative example is still limited by a theoretical evaluation of errors.In any case, the methodology can be applied independently from the magnitude of uncertainties related to the sensor or the approximate nature of the surrogate models.
The presented methodology is a step forward to the estimation of real-time risk as for the first time real-time estimation of risk is addressed based on databases derived from first principle tools and not from extremely simplified static approximations.As the application of direct methods requires more computational effort and knowledge, further investigations are for sure needed in this field.In particular, the database and surrogate model generation topics, already addressed by the authors in the FLARE project, are here only introduced and will be further discussed and disseminated in dedicated separate works.

Declaration of competing interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence Fig. 18.Real-time PLL calculation with uncertainties as a QMC process.
D. Vassalos et al. the work reported in this paper.

Fig. 7 .
Fig. 7. Scatter diagrams for three operation areas of interest for passenger ships.

Fig. 8 .
Fig. 8. Example of accident susceptibility analysis in the Baltic Sea.

Fig. 9 .
Fig. 9. Flowchart showing the steps of a voyage simulation for real-time PLL estimation.

Fig. 16 .
Fig. 16.Flooding simulation results (right) with critical damage identification and crash simulations results (left) showing the dependency of penetrations with damage location.

Fig. 17 .
Fig. 17.Surrogate models for damage dimensions (left) and TTC (right) at H s = 1.0, 2.0 3.0 and 4.0 m for the reference ship.

Table 2
Calculation draughts for the reference cruise ship and the 11 target ships.