Dynamics Simulation for Process Risk Evolution on the Bunker Operation of an LNG-fueled Vessel with Catastrophe Mathematical Models

Abstract

Liquefied nature gas (LNG) is a green energy. LNG-fueled vessels are extremely complex engineering systems. In view of the inherent hazardous properties of LNG fuel, LNG fueling is not only an important part, but it is also full of high risks in the operation of LNG-fueled vessels (LNGFVs). Therefore, it is necessary to study the risk factors, and the intrinsic relationship among them between the LNG and the vessel, and to simulate the system dynamics in the process of LNGFV operation. During the process of fueling of LNGFV, at every moment the vessel interacts with the energy and information of the surrounding environment. First, the impact of the three interactions of the fueling operation process, ship factors, and environmental factors were analyzed on the risk of fueling operation, and a complete node system was proposed as to the complex system dynamics mode. Second, by analyzing the boundary conditions of the system, the relationship of factors was established via the tools of system dynamics (SD). Based on the catastrophe theory (CA), the dynamics model for the fueling of LNG is set up to study the system’s risk mutation phenomenon. Third, combined with the simulation results of the case analysis, the risk evolution mode of the LNGFV during the fueling process was obtained, and constructive opinions were put forward for improving the safe fueling of the LNGFV. Application examples show that formal description of risk emergence and transition is a prerequisite for the quantitative analysis of the risk evolution mode. In order to prevent accidents, the coupling synchronization of risk emergence should be weakened, and meanwhile risk control should be implemented.

1. Introduction

As a clean and efficient energy source, natural gas has become more and more important in the global energy landscape and plays an increasingly important role in the maritime trade. Its transportation volume, the future prospects of transporting liquefied natural gas (LNG) ships and the development of LNG-fueled vessels (LNGFV) are all topics of great concern to the industry. In the past decade, the number of LNGFVs has more than tripled. Although the overall fleet size is still limited, the number of LNGFVs has increased rapidly due to the imminent implementation of the International maritime organzition (IMO) sulfur limit regulations. In the past LNGFVs, LNG carriers were the main ship type using green energy. However, other ship types, such as container ships, bulk carriers, etc., have recently begun to occupy a certain share [1]. Some ships in Northern Europe have been using LNG as their fuel source for over a decade, with an extremely good safety performance. But as the use of LNGFVs spreads to other parts of the world and many more parties become involved, there is a clear intention to study LNG operations risks for LNGFV at an international level.

LNG is an alternative fuel for traditional ship power, but it is a complex system. In comparison, LNGFVs have the same safety risks faced by traditional ships. Due to the different requirements of the corresponding equipment and facilities of their fuel systems, they will also face their own unique safety risks. These safety risks will also generate operational risks for ships. In particular, the fueling operation process of LNG, due to the complexity of its system and the particularity of its operation mode, coupled with the particularity of LNG fuel itself, makes it a recognized high-risk operation process in the operation of LNGFVs. A little carelessness can have disastrous consequences. LNGFVs are one of the problems that basic research needs to face as the evolution of equipment due to the coupling of ship factors and LNG factors to form a complex system. The safety mechanism of ship operation as a man-machine complex system is an application-based issue that is expected to be solved [2]. Therefore, in the face of the new situation of LNG fuel replacing traditional fuels as ship power, the theory and application of complex equipment risk evolution in the context of new ship technology application is a very urgent research focus in the period of sustainable development [3].

In the past 10 years since 2005, the research on the basic theory and engineering application of ship operation risks has been mainly carried out by quantitative measurement research, using safety analysis and reliability control theory and targeting ‘Human-Ship-LNG’ systems or external traffic environment systems for reductive or holistic research on ships [4]. The accident model contains assumptions about how the accident occurred, what caused the accident, and how these factors combined, interacted, or passed to cause an accident. Recently, safety simulation has been a very hot research field, but the existing safety simulation is still relatively basic and its content mainly focuses on automation analysis, situation simulation, and verification [5]. There are also problems, such as large limitations of simulation functions, low utilization rate of simulation information, and low systematics. Recently, in view of the limitations of existing methods and the emerging situation of complex systems, researchers began to be enthusiastic about using system thinking to consider system safety issues and proposed an accident model based on system thinking and a method of safety analysis and control. System dynamics (SD) is a simulation method for studying the dynamic behavior of a system. It can establish a simulation model based on the complex feedback characteristics inside the system and then seek the root cause of the problem. The method of SD has been widely used in coal mines, roads, aviation, and other fields.

In the following sections, the following research is mainly conducted. Section 2 reviews the relevant research status. Section 3 brings forward the concept of the LNG-fueled vessel’s operation system (LNGVOS) risks and establishes a LNGFV process risk system. Section 4 deals with the application process of a catastrophe method and system dynamics in a LNG bunker risk assessment. In Section 5 and Section 6, based on the established SD model and catastrophe theory (CA) method, the equations are established and assigned and the simulation is carried out. Section 7 discusses the process risk evolution.

2. Literature Review

LNG fueling is a particular type of operation where LNG fuel is transferred from a given distribution source to an LNG-fueled ship [6]. The technology development on an LNG fuel system and bunkering infrastructure could strengthen the competitiveness of LNG as a marine fuel for carriers [7]. Economic analysis by the discount cash flow method has shown that the project of LNG low-speed diesel ships is a more attractive investment than the project of the oil-fueled ships with selective catalystic reduction [8,9]. With the advantages of green shipping applications in the ship, there are more fully LNG-fueled ships in service worldwide since 2000 from Norway, and the quantity of LNG-fueled ships in operation is even higher in China [10].

In the field of ship safety technology research, ship engineering reliability research has achieved rich results. The use of LNG as a ship power creates different types of hazards than those that exist for traditional powers. The increased complexity, safety requirements, and space allocation required for LNG-involved facilities increase the capital risk [11,12]. Jafarzadeh et al. (2017) proposed a systems engineering approach to clarify the technical aspects of LNG-fueled systems and better understand the expertise and training required to operate them safely [13]. Davies et al. (2013) summarizes the release likelihood data used and provides an example of ultra large container ships for a simplified LNG fueling system [14]. Jeong et al. investigated the potential risk of LNG fueling and, for two typical LNG-fueled ships, evaluated the extent of indicative safety exclusion zones for the LNG fueling station, using the integrated quantitative risk assessment software [15]. From the perspective of risk potential in the LNG fuel, the application of safety assessment [16] in the shipbuilding industry originated in the late 1980s and began to change the traditional post-accident ship accident research model with reference to some pre-control methods used in the nuclear industry [17]. The emergence of ship damage has prompted the shipping industry to become more aware of the importance of research and application of ship safety assessments.

Although a global marine transport network model for LNG fuels meets the safety requirements from bunkering operations, fleet utilization, and marine container transportation demands [18], risk engineering is fully necessary to be applied in the fuel operation accident of the LNGFV. A fuel leakage accident of the LNGFV is most likely to occur in its fueling operation [19,20]. It is necessary to carry out a deep analysis of its safety, evaluate and analyze the risks existing in the process, and propose corresponding risk control schemes on the equipment or operating procedures to achieve the safety of the LNG fueling operation. The leakage of LNG fuel is a threat for the safety of LNG-fueled vessels. Experts and scholarships have paid more attention to engineering reliability [21,22,23,24,25]. Fu et al. (2003) illustrated a framework for the quantitative risk assessment of LNG-fueled vessels with respect to potential leakage. Event tree analysis (ETA) and computational fluid dynamics (CFD) simulation have been integrated for the investigation of the hazard, the analysis of the consequences, and the quantification the risk of the LNG leakage [26]. Although these research results can effectively monitor the risk factors in different aspects, they still have some limitations with operation process risks.

In 1993, the UK introduced the concept of a formal safety assessment (FSA) to the maritime industry, a milestone in ship operational risk research [27]. Compared with other methods, the application research of FSAs has rapidly promoted the development of quantitative risk assessment practice. Since then, the research on system risk management has emerged as an important aspect of ship operational safety research. Marine traffic risk and safety research is increasingly favored by researchers, providing decision support for relevant departments and helping to develop positive ship operation safety. Management policy has become the hottest research topic in marine traffic safety research. According to the literature data that can be collected, the most important aspects of marine traffic safety research are navigation technology, safety and reliability, policy and management [28]. The research on ship operation safety in the maritime industry and the shipping industry is showing the character of interdisciplinary and multidisciplinary integration.

All safety efforts, whether for forward-looking accident prevention or retrospective accident analysis, are inseparable from the accident model. The accident model represents the cause of accidents in accident analysis or system design. On the one hand, the cause of accidents could be limitted the application of traditional methods on ship safety prediction and evaluation. On the other hand, these indicators are mostly based on the traditional safety analysis theory, such as the Reason model and Domino model. Separation of factors causes accidents, such as human, machine, environment, and management accidents. The impact on the interaction behavior of the system is very limited [29]. With the advancement of technology in recent years, the reliability level of ship equipment has been greatly improved. The complex logic system represented by software is widely used as the cross-linking systems, which was involved human-computer interaction and water shores. Accidents, which those caused specifically by the synergy of the base, have increased dramatically. Therefore, it is imperative to construct a new model for ship safety based on the complex system theory [30]. With the increasing influence of human factors in ship accidents, it has been widely recognized as the main cause of ship accidents. The risk analysis of ship man-machine systems based on human reliability has gradually become a hot issue in the study of operation risks. System engineering methods are used to reveal the technical risks of green fuel systems, analyze their potential implementation models, and propose the professional knowledge and training programs required for humans to operate safely. Ship operational risks involve many factors, so a systematic perspective is needed to study the possible causes of ship operation risks. Human and organizational errors also pose a huge challenge for safety engineering technology. The widespread use of software also changes human-computer interaction and operator behavior, making new features for human and organizational errors. The dominance depends mainly on the type and quality of the feedback information received by the human, as well as the operational context information in which the human operates [31].

To this end, scholars are introducing systematic thinking methods to consider system safety and establish new things. Therefore, due to the model, system safety analysis and controls are carried out. Typical examples include the systems-theoretic accident model and process (STAMP) and the functional resonance accident model (FRAM). The common feature of these methods is to study the safety of complex systems from the perspective of system thinking, emphasizing the importance of interaction of multiple components in system safety analysis and standardizing the mutual constraints between systems through various constraints. Information feedback to describe the context of the system operation, just to make up for the shortcomings of traditional analysis methods, has significant advantages in dealing with system safety problems, such as software intensive, new human and organizational factors (HOF) faced by complex systems, and has attracted widespread attention in the industry [32]. Most of the existing methodologies lack inbuilt and practical techniques that take into consideration the complex interactions and dynamic feedback effects. A novel modelling and simulation method was introduced to address the dynamic risks effects [33,34,35,36,37,38].

This paper takes the LNGFV operation process as the research object, analyzes the characteristics of the LNGFV, and combines the SD method to construct a process risk model for the LNGFV operation. Through specific case analysis, the risk of the LNGFV operation process is obtained and further solutions are proposed.

3. Problem Description of Process Risk

LNGFVs refer to the addition of a set of LNG fuel systems based on ordinary pure diesel power ships. The LNG fuel systems normally include gas storage cylinders and fuel supply devices for fueling operation. The working principle of the system is the following in Figure 1.

The pump is used to pump the LNG through the filler pipeline (or filler arm) into the receiver LNG tank. An emergency shut-off device (ESD) is installed at both ends of the pipeline. If a leak or abnormal operation occurs, the ESD can be automatically or manually turned off. To prevent overvoltage, the ESD response time is about 30 s. To prevent pressure oscillations when the ESD is off, the tank is equipped with a self-circulating system for cooling and depressurization. To prevent excessive relative movement between the filler and the receiver, an emergency release control system (ERC) is placed on the pipeline. Dry disconnect couplings (DDC) are used at both ends of the filler pipeline to prevent leakage.

The LNG tank before filling is normally called the hot tank. Prior to pre-fueling, the tank is first filled with about 1 m³ of LNG, and the LNG tank is pre-cooled, which is slowly opened, and the inlet valve on the inlet gas tank is pre-cooled into the inlet pipeline by the Boil Off Gas (BOG) gas of the supply device. The staff should purge and pre-cool the connecting pipeline with the LNGs evaporating gas, then insert the connecting pipeline with nitrogen, and then replace the nitrogen in the pipeline with natural gas. After the pre-cooling is completed, the working staff closes the delivery valve of the supply device, and after the LNG is gasified and pressurized for 20 to 30 min in the tank, the filling is continued in the LNG tank according to the approved filling rate.

During the filling process, the pump is started and the horsepower is gradually increased within the controllable range until the defined filling rate is reached. Both sides of the ship and shore closely monitor the operation of the pump to prevent possible LNG leakage and at the same time monitor the pipelines, the operation of the equipment, and the working state of the system.

When the level of the inlet tank reaches the requirement, the delivery valve on the gas supply device is shut off and the LNG in the inlet pipeline is blown into the filled gas tank by the BOG in the supply device.

Among the working LNGFVs, the LNG intermediary terminal-ship via pipeline method is the most widely used. This method fills LNG by establishing an LNG gas storage cylinder at the LNG fueling terminal, using insulated pipelines. This paper focuses on the risk problems in the terminal-ship via pipeline method.

3.1. Process Risk on Fueling for LNGFV

Risk is the description of the coupling of the uncertain events under the action of risk factors, which is the consistent performance of continuity and catastrophe. Let Ω be the total set of randomness test possibilities. If any of the risks on the LNG-fueled vessel’s operation system (LNGVOS) satisfies Equation (1), then the risk of R being f is called.

$$R_t=f(r_1,r_2,r_3,\cdots ,r_n,t)$$

(1)

where R is the measurable risk sample, $r_1,r_2,\cdots ,r_{n-1},r_n$ are the causal factors influencing the risk performance, including order, human, energy, information, equipment, and material flow, and f is a function defined on Ω in the real domain.

Definition

For a specific moment of risk state, $R_t$, $S=\left\{r\right\}$ is the space within the range of safety and complete failure, if for each time parameter t ∈ T, X (r, t) is a random risk state on S, and since any $g(l)\in S,X(r,t)$ is a function of t, then $\{X(r,t),t\in T,l\in S\}$ is called the process risk.

Continuity refers to the unsafe state of the causal factor of the system or the process of the change of human unsafe behavior, which are continuous and gradually accumulating. It has obvious continuous and associated diffusion in time and space and finally presents certain regularity.

The process is usually used to describe the phenomenon related to time. When describing the process specifically, it is necessary to indicate that the thing and the phenomenon are in a certain state at a certain moment. The stochastic process studies the statistical law of the dynamic change of random phenomena and mainly studies a number of interrelated random variables.

The LNGVOS risk system discussed in this paper is used to study its risk analysis problems under certain timing conditions, mainly by stage to characterize its process, which is divided into the preparation stage, operation stage, and review stage. At each stage, different factors directly or indirectly affect the state of the system. The process of analyzing the system in stages can effectively analyze the essence of the development of things. It is no longer simply the process of decomposing the system from a fixed static system, but decomposing the state of the system representation in time.

Furthermore, these mentioned methods of safety engineering are well suited to prevent simple accidents, such as component failures, but it is difficult to identify other complex causes of accidents, such as defective requirements. In fact, most popular methods are based on component models or failure modes of erroneous behavior in a predetermined manner, but these models are not suitable for complex systems and human and organizational errors. Safety engineering activities are often carried out at a later stage of the system development process. Currently, there are quite detailed designs for safety analysis, but this approach precisely limits the available solutions and can cause design changes and implementation costs that are extremely expensive. Although people have tried to analyze complex human tasks or software models using traditional methods, these methods only treat people or software as special system components and propose an integrated view of safety from a system perspective.

3.2. Risk Formation Mechanism of Multi-Factor Interaction

There are many factors affecting the risk of the LNGVOS, and there is a dynamic trend. In order to reduce the risk of the LNGVOS process and prevent the occurrence of major accidents, it is necessary to have an in-depth understanding of the source of the risk of accidents caused by the LNGVOS and the mode and cause of the accident.

The main safety risks of LNGVOS during the filling process are concentrated in the “three points and one pipeline”, namely “three points” in gas storage cylinders, fuel supply devices, and machinery, and also the “first pipeline” of piping systems, including accessories and valve parts, where the pipeline system runs through the remaining three spaces. According to the safety system engineering and previous research, the risk systems that cause LNGFV fueling accidents are divided into three categories: The ship risk system, environmental risk system, and LNG risk system while operating.

The ship risk system is derived from the structural strength of the ship itself and the design defects at the time of production. As the ship is used, it will inevitably cause certain corrosion damage, and its structural strength, sealing, and integrity will be affected.

When studying the impact factors of the environment risk of LNGVOS, the first is to consider the impact of wind, tide, and visibility. The greater the wind, the greater risk of the operation. Tidal waves have a direct impact on the navigation of ships. At low tides, the depth of the ship’s berthing may be insufficient. The poor visibility is due to the natural causes of rain, snow, fog, hail, etc., causing the crew’s pipeline of sight to be blurred, thus judging mistakes. When the port conditions are good, the risks are naturally low which considers the topography and shape of the port, as well as the water area. The requirements for the construction of LNG fueling stations are generally high, and the port factors need to be considered when berthing.

The LNG risk system while operating is divided into three stages: The preparation stage, the LNG fueling operation stage, and the post-fueling review stage. These three stages are sequentially performed in the time series. At the same time, the previous stage has an impact on the next stage. The three systems of the ship risk system, environmental risk system, and the LNGFV fueling process risk system interact with each other. These systems are coupled with each other and jointly affect the safety of LNGFV fueling operations.

3.3. Risk Mechanism on the Fueling Process of LNGFV

To evaluate the risk of LNGVOS, it is first necessary to define a series of nodes that can be observed and can also characterize the system. Through the relevant literature research and analysis of related LNG accidents, the risk of the LNGVOS filling process is mainly the risk of leakage and fire accidents. The risk of leaking accidents is more prominent, caused by equipment failures, personnel failures, extreme environments, and improper safety management:

(1) Damage from LNG flexible hose: Lack of proper routine maintenance and mishandling, damage to the hose base, hose falling, low temperature corrosion, fatigue breakage, etc. may cause a large amount of LNG leakage.

(2) Leakage from the filling pipeline, return gas pipeline flange, and valve connection: Human error, design and equipment problems, production error, flange quality, and impact of falling objects may cause filling pipeline valve LNG leakage at the flange joint connection.

(3) Leakage from LNG gas tank overcharge: LNG gas tank liquid level warning failure, human error, barometer safety valve failure, etc. may cause LNG steam to enter the return pipe and flow to the mast vent. If there is an ignition source, It causes serious consequences. Overfilling of LNG tanks also carries the risk of overpressure fracture.

(4) Failure or missing from emergency or quick disconnect device: No clutches disconnecting the quick connect device, emergency release clutch, or the flange connection, etc. may cause flange failure, resulting in a large amount of LNG leakage.

Those mentioned above mainly describe the risk in the process of fueling of LNGVOS, which was shown among the relationships between ships, LNG, and human behavior. The additional condition should be involved in environmental conditions. In order to fully describe the structure of the LNGVOS and its dynamic characteristics, it is necessary to select multiple sets of nodes to characterize the system and establish a suitable LNGVOS risk evaluation node system. The involved factors were analyzed from the three aspects of “ship”, “environment”, and “LNG fuels process”, which can be used to form a relatively complete risk assessment system for the LNG fueling process in

Table 1. A ship’s fueling risk evaluation node system. Emergency shut-off device (ESD).

Nodes	Components and Meaning	Nodes	Components and Meaning
L1	Process risk level for fueling	R1	Increment of environment safety level
A1	Meteorological safety level	A27	Protection system safety level
A2	Geographical safety level	A28	Gas supply system safety level
A3	Flange status	A29	Gas supply pipeline safety level
A4	Safety checking ability level	A30	Ventilation status
A5	Environment safety level	A31	Ship safety level
A6	Protective equipment safety level	A32	Environmental risk level
A7	Pipeline temperature status	A33	Ship risk level
A8	Dosing pump flow status	A34	LNG risk level: Fueling operation
A9	LNG safety valve status	A35	LNG detector ability level
A10	LNG tank pressure status	A36	Connection level of fueling pipeline
A11	LNG tank status	A37	Berth operation safety level
A12	Hose valve tightness status	A38	Preparation stage: Pre-fueling
A13	Open-pump working level	T1	Wind status
A14	Working monitoring safety level	T2	Tide status
A15	Stop-pump working level	T3	Visibility status
A16	Toolbox Integrity	C1	Topography status
A17	Connecting pipeline Integrity	C2	Water area safety status
A18	LNG residue in pipeline	C3	Pipeline tension status
A19	Gas removal working level	C4	Pipeline strength status
A20	Purging operation safety level	C5	Fender limit safety status
A21	Review stage: Post-fueling	C6	Pipeline pressure status
A22	Operation stage: LNG fueling	C7	Pipeline tightness status
A23	Gas supplying status	C8	Ship-shore communication
A24	LNG tank safety level	C9	Pipeline lifetime status
A25	Fire protection aids feature	C10	Ship mooring system status
A26	ESD feature	C11	Ship structure status

.

3.4. Risk Evolution Mode on the Fueling Process of LNGFV

The complex interaction of multiple factors contributes to the ultimate safety accident in LNGFV operation. The result of this joint effect is an overall macroscopic emergence of the vessel operation accident system. The systemic model regards the accident as an emerging phenomenon. For the safety risks of complex LNGVOS, many risks are caused not only in the physical system, but also in external causes, such as errors and environmental disturbances surrounding the LNGFV. System science requires the study of the general modes of system evolution and development. Therefore, it is necessary to simplify LNGVOS accidents into general issues to carry out research. For example, before the LNGVOS boundary is expanded, the general safety risk factors of the complex LNGVOS are extracted according to certain mapping rules, so the progressive factor hierarchy model is obtained through the structured processing method. The construction corresponds to the operation complex system and a risk forming system with operation system boundaries and strong clustering characteristics of system elements. By further understanding the dynamic behavior of the LNGVOS, especially its risk evolution dynamics behavior, the corresponding risk behavior control mode algorithm is designed to obtain the risk control strategy of the complex system.

In LNGVOS, except for a few causal nodes (referring to the basic node and the end node), there are no upstream nodes or downstream nodes, and most of the nodes are intermediate nodes in the upstream and downstream. The input of the causal nodes is the upstream safety risk factor during the process of LNG operation. As a result of the action, the output is the input to the downstream related causal node. If the input and output are bounded in the fueling process for LNGFVs, the node is stable and the node state is stable and there is no risk emerging. The interaction of risk factors leads to the gradual evolution of the structural state of some causal nodes. Under the initial random disturbance, the risk of an accident causing nodes emerges (that is, the state of the causal node deviates), due to the inter-node. The nonlinear coupling causes the risk occurrence of the associated nodes to gradually converge. Over time, when enough nodes have a risk emerging and tend to be synchronized (expressed as a certain pattern or pattern as a whole), the whole complex will be caused. The system broke through the threshold and an accident occurred.

The emergence of accidents is the progressive emergence of node risks in the LNGVOS. The complex risky system eventually leads to LNGVOS accidents. All of the risks originating from the nodes first emerge. The emergence of the safety accident occurs when there are enough nodes in the risky system or when there exists some (generally more than one) key nodes. When the risks occur and the coupling synchronization occurs with each other, it is very likely to induce system-level accidents to occur, avoiding and weakening the coupling synchronization of the risks between nodes, and to a certain extent it can effectively prevent the occurrence of system-level accidents.

4. Method and Model of Process Risk Evolution

4.1. System Dynamics Theory

SD is a method in complex systems simulation, which was proposed by Forrest in 1958 [25]. SD was used to analysis enterprise problems, such as production management and inventory management [25]. It is a cross-integrated tool for understanding system problems and solving system problems. From the perspective of complex system methodology, SD is the unification of structural, functional, and historical methods. It is based on system theory and absorbs the essence of cybernetics and information theory, and it applies the systematic scientific ideas that every system must have the structure and make system structure to determine the system function. According to the internal characteristics of the internal components of the system as the causal feedback characteristics, it can be useful from the internal structure of the system to find the root cause of the problem, rather than using external interference or random events to illustrate the nature of the system’s behavior [22].

SD represents the operations in an organization, which was represented by six streams, including order, human, energy, information, equipment, and material flow, which is shown in Figure 2. These six streams summarize the basic structure of the system’s operations. The modeling process of SD is mainly used to observe the interaction process of the six streams in the system and to discuss the changes in the volume and the various rate behaviors of the influential products in different streams.

The integrity in SD representing things in real activity can accumulate or decrease over time. The source of the information in the pattern, including the variables of the model (status variable, rate variable, auxiliary variable, constant and exogenous variables) relied on the variable equation, which connected each variable through the causal relationship between the variables. This causal relationship constituted the feedback system and the feedback loop, which was represented as the embodiment of the whole process by the system flow diagram. It defined a certain point in time and was the state of the environment variable.

The rate variables in SD means the rate of change of a quantity in a unit of time. It can simply describe an increase, a decrease, or a net increase rate. It is a place where information is processed and converted into action.

The auxiliary variables in SD have three meanings in the pattern; the intermediate process of information processing, parameter values, and the input test function of the mode. Among them, the first two meanings can be regarded as part of the rate variable.

The information feedback loops in SD are basic components of the complex systems structure. The loop is composed of the current situation, the target, and the adjustment action (rate) generated by the gap between the current situation (integration) and the target. The characteristics of the loop behavior are the gap between the target and the current situation.

The behavior of the complex system is the process of mutual strength between loops. In addition to the negative loop of the target pursuit, there is also a self-reinforced positive feedback loop, which is the relationship between causality and mutual reinforcement.

A time delay process is also included in the structure of system, such as in the organization processes, i.e., production, transportation, and delivery, etc., or intangible processes, such as decision-making processes and cognitive processes, which there is a long or short time delay.

4.2. Catastrophe Series Evaluation Method

The catastrophe theorywas founded by Thome in 1972 [26]. The CA can effectively combine the continuous change phenomenon with the sudden phenomenon and obtain the change law of the two change phenomena at the joint by a theoretical mathematical method, which reflects the forward-looking of this theory. The LNGVOS risk system is a complex system. The catastrophe progression method is a comprehensive evaluation method based on CA. It mainly combines CA with fuzzy mathematics. It doesn’t need to apply weight values and, to some extent, implies the relative importance of each evaluation node. It can combine qualitative analysis with quantitative analysis to reduce the uncertainty caused by human subjective factors and is scientific and reasonable.

When using the catastrophe progression evaluation method to study the risk of the LNGVOS fueling process, according to the problems reflected by the system, the contradictions of the multilevel decomposition total indicators were arranged in the primary and secondary order. The method was decomposed layer by layer until it was broken down into nodes that could be observed or measurable.

Since the range of values and unit dimensions of the last evaluation node were not the same, it was difficult to compare the indicators, so it needed to be converted into dimensionless data between 0 and 1. Moreover, it was also necessary to convert all the underlying evaluation indicators into “rather better” type or “better” type data, so that the reciprocal method could be used for standardization processing.

We normalized the raw data, brought the values of each factor into the normalization formula of each catastrophe model, calculated the catastrophe level value, and gradually calculated it until the final function value was calculated. Catastrophe theory proposes that in the case of no more than four parameters, various catastrophe models can be represented by catastrophe functions [11]. The types and functions of several mutations used in this paper are shown in

Table 2. Catastrophe type functions. Fold catastrophe (FC), cusp catastrophe (CC), swallowtail catastrophe (SC), and butterfly catastrophe (BC).

Catastrophe Type	FC	CC	SC	BC
Number of state variables	1	1	1	1
Number of control variables	1	2	3	4
Mutant core	x3	±x4	x5	±x6
Dimension	1	2	3	4
Potential function structure	$u^{1/2}$	$u^{1/2}+v^{1/3}$	$u^{1/2}+v^{1/3}+w^{1/4}$	$u^{1/2}+v^{1/3}+w^{1/4}+z^{1/5}$

, which is shown as the fold catastrophe (FC), cusp catastrophe (CC), swallowtail catastrophe (SC), and butterfly catastrophe (BC). The normalization formula is a basic operation formula. It is mainly used for comprehensive analysis and evaluation in the catastrophe theory. It can be obtained by decomposing the divergence equation. It normalizes the different state forms of the various control variables in the system to the same comparable status. The normalized recursive operation of the system can be realized by using the normalized formula, and then the total mutation membership function value of the system characterizing the state of the system can be obtained. The potential functions and normalization formulas of the three commonly used mutation models are shown in Table 2, where x is the state variable and u, v, w, and z are the control variables.

During the period of obtaining the total mutation membership function value, the catastrophe progression of the layer is obtained according to the two rules of “interconnected” and “non-interconnected”. The “interconnected” means that when there is a potential or direct interaction between the large number of control variables of the LNGFV’s risk safety system, the average of the total values of these variables will be taken. Meanwhile the “non-interconnected” is mainly aimed at the fact that there is no correlation between the indicators in the calculation process, and the calculation rule is in the order of “big, medium, and small”.

To sum up, the comprehensive evaluation model of LNGFV’s fueling risk based on the catastrophe theory can be expressed as:

$$F=\left\{\begin{array}{cc}\frac{1}{3}(G^{(1/i)}+E^{(1/j)}+S^{(1/k)})& interconnected\\ min(G^{(1/i)},E^{(1/j)},S^{(1/k)})& non\text{-}interconnected\end{array}\right\}i,j,k=2,3,4$$

(2)

In the formula, F characterizes the safety state of the LNGVOS fueling process; G, S, and E respectively represent the LNG factor, the ship factor, and the environmental factor. The function means the catastrophe membership value of the LNG’s fueling process.

During the fueling process, the LNGFV interacts with the outside world every moment with material energy information. The system will be affected by various external factors, breaking through the previous equilibrium state, which will lead to accidents. Only when the level of control factors is before the critical point of the sudden change of the whole system, can the safety of the LNGFV be effectively guaranteed. When studying the mathematical model of discontinuous changes, the catastrophe theory is highly convincing and can be used to analyze the sudden discontinuity in the development of the risk system of the LNGVOS process. System dynamics can perfectly combine qualitative analysis with quantitative analysis and has strong applicability to the complexity of the LNGVOS risk system. Combining the CA with the SD can not only solve the problem that the catastrophe theory can’t describe the dynamic system defects, but can also improve the subjectivity of the system dynamics and can effectively summarize the trend of the risk of the LNGVOS process with time.

4.3. SD Model of Risk Mutation in the Fueling Process for LNGFV

Through in-depth study and analysis of the system, there are intricate relationships among the various subsystems of the LNGVOS during the fueling process, which are shown in Figure 3. Here the symbol means that A (1~38): Auxiliary variable; L1: status variable; C (1~11): constant; T (1~3): table function.

Here, the node configuration with those black lines in Figure 3 and the process risk for fueling $L1$ have linked to ship risk $A33$, the environment risk A32, and the post-fueling risk A21. The post-fueling risk has been viewed as the outcome from the preparation stage and the LNG fueling operation. Here, the risk system is a complex system.

If the risk system is considered a simple system of the ship, environment, and gas subsystems, then the node configuration with the defined red lines in Figure 3 may be changed. All subsystems are integrated into a whole system. The stages for fueling operation are separated. The process risk for fueling L1 was linked to the ship risk A33, environment risk A32, and LNG risk: Fueling operation risk A34. The LNG risk was viewed as the outcome from 3 stages, including A21, A22, and A38. In the SD model, these three variables were made with delay function. The others remain stable.

The system contained positive feedback and negative feedback, indicating that the risk abrupt process of the complex system is nonlinear. According to the above analysis of the LNGFV’s fueling operation, the SD model of the entire LNGVOS fueling process risk system was obtained and the system dynamics equation was constructed by using the system dynamics principle and the catastrophe theory.

4.3.1. Risk Level for Root Node in Working Flow of Risk System

Analysis of the driving properties of each variable in the system and the state of sudden changes in the system risk required not only the establishment of the SD model, but also the qualitative analysis process for the system; quantitative analysis of the variables was also required. The variables of the SD model of the LNGFV’s fueling process risk system are shown in

Table 3. Risk assessment standard for root node.

Root Nodes	Risk Level
	Lower Risk	low Risk	Reasonable	High Risk	Higher Risk
T1	~1	2~3	4~6	7~8	>8
T2	Even	High tide	Low tide	Ebb	Raising
T3	>=1 nm	<1 nm	<1000 m	<800 m	<500 m
C1	Normal	Individual failure	Part failure	Most failure	Full failure
C2	Normal	Individual failure	Part failure	Most failure	Full failure
C3	higher	high	normal	low	lower
C4	higher	high	normal	low	lower
C5	Normal	Individual failure	Part failure	Most failure	Full failure
C6	higher	high	normal	low	lower
C7	higher	high	normal	low	lower
C8	Normal	Individual failure	Part failure	Most failure	Full failure
C9	<1	(1,3]	(3,5]	(5,7]	>7
C10	<3	(3,8]	(8,12]	(12,16]	>16
C11	Normal	Individual failure	Part failure	Most failure	Full failure
A3	Normal	Individual failure	Part failure	Most failure	Full failure
A6	Normal	Individual failure	Part failure	Most failure	Full failure
A7	most suitable	suitable	normal	rather suitable	not suitable
A8	higher	high	normal	low	lower
A9	higher	high	normal	low	lower
A10	most suitable	suitable	normal	rather suitable	not suitable
A11	most suitable	suitable	normal	rather suitable	not suitable
A12	higher	high	normal	low	lower
A16	higher	high	normal	low	lower
A17	higher	high	normal	low	lower
A18	most suitable	suitable	normal	rather suitable	not suitable
A20	higher	high	normal	low	lower
A23	higher	high	normal	low	lower
A25	higher	high	normal	low	lower
A26	higher	high	normal	low	lower
A30	Normal	Individual failure	Part failure	Most failure	Full failure

.

4.3.2. Risk Level Equation for Middle Node in Working Flow of Risk System

To perform quantitative analysis, it is first necessary to determine the corresponding functional relationship between the factors. The catastrophe types of each state variable in the model are obtained by the relationship in Figure 3, and the computing equations are shown in

Table 4. Middle nodes involved in each type of mutation.

Mutation Type	Middle Nodes
Fold catastrophe	A5, A15, A18, A35
Cusp catastrophe	A2, A4, A13, A19, A24, A27, A29, A32
Swallowtail catastrophe	L1, A1, A14, A22 (delay), A28, A31, A33, A34, A36, A37
Butterfly catastrophe	A21 (delay), A38 (delay)

.

The parameter design of the model refers to determining the type of membership function of the variable according to the number of control variables according to the evaluation node system, paving the way for the realization of the model, as shown in

Table 5. Equation of middle nodes.

Nodes	Equation	Nodes	Equation
A1	λA1-T1T11/2+λA1-T2T21/3+λA1-T3T31/4	A26	IF THEN ELSE (A14< = 0.8, 0, 1)
A2	λA2-C1C11/3+λA2-C2C21/3	A27	λA25-A27A251/2+λA26-A27A261/3
A4	λA4-A5A51/2+λA4-A6A61/3	A28	λA28-A29A291/2+λA28-A35A351/3+λA24-A28A241/4
A5	λA5-A32A321/2	A29	λC9-A29C91/2+λA10-A29A101/3
A13	λA7-A13A71/2+λA8-A13A81/3	A31	λC10-A31C101/2+λC11-A31C111/3+λA30-A31A301/4
A14	λA10-A14A101/2+λA11-A14A111/3+λA9-A14A91/4	A32	λA1-A32A11/2+λA2-A32A21/3
A15	λA12-A15A121/2	A33	λA31-A33A311/2+λA27-A33A271/3+λA28-A33A281/4
A18	λA18-A20A201/2	A35	λA23-A35A231/5
A19	λA16-A19A161/2+λA17-A19A171/3	A36	λC6-A36C61/2+λC7-A36C71/3+λA3-A36A31/4
A21	λA18-A21A181/2+λA19-A21A191/3+λA15-A21A151/4	A37	λC3-A37C31/2+λC4-A37C41/3+λC5-A37C51/4
A22	λA13-A22A131/2+λA14-A22A141/3+λA4-A22A41/4	A38	λA36-A38A361/2+λA37-A38A371/3+λA4-A38A41/4+λA38-A39A391/5
A24	λA10-A24A101/2+λA9-A24A91/3	L1	λL1-R1R11/2+λL1-A21A211/3+λL1-A33A331/4

.

5. Results

5.1. Scenario Description

An LNGFV with a fueling operation at a port in China was used as a research object, and the berth was assisted by a tugboat. After the fueling, the LNGFV left the berth. The length of the ship was 306 m, the ship was 47.65 m wide, the depth was 26.25 m, and the speed was 20.3 knots. The storage tank had a cubic meter volume and was 3 years old. Local weather information was available through local meteorological data. All root nodes were investigated and measured by the workmates.

We selected a specific time period in the weather database. Here, the wind, tide, and visibility was measured with time. There was a tropical cyclone during this time period, which may have affected environment factors and the safety level of the system. The table function of wind, tide, and time was established, and the normal distribution and β distribution were used to fit, and the wind and tide trends with time and the risk level curve of the LNGVOS fueling process were obtained. The results are shown in Figure 4. The red line shows the observed data, and the blue line is the computed data.

5.2. Data Processing

For the boundary values of the system, such as tides, wind, visibility, topography, water area, etc., the corresponding specific values can be given. There were other boundary values, such as pipeline tightness, cable tension, valve tightness, LNG residue in pipeline, etc., for which we were not able to give certain values. These risk factors need to be scored using

Table 6. Cable tension original value and normalized value.

Items	Excellent	Good	Moderate	Poor
Observe data	0.071	0.875	0.154	0
Normalized value	0.065	0.795	0.140	0

.

For the non-denationalization of the underlying indicators of qualitative indicators, the degree of membership of the fuzzy evaluation to its corresponding evaluation final value must first be calculated, taking the factor cable tension as an example.

We assumed that the utility value of the indicator was $E_1({\omega }_k)=\{1.00,0.75,0.50,0.25\}$. According to the initial fuzzy membership function formula of the qualitative indicator, the initial fuzzy membership function value corresponding to this node was obtained:

$$x_{cable\text{-}tension}=1\times 0.065+0.75\times 0.795+0.50\times 0.140+0.25\times 0=0.731$$

(3)

Similarly, the dimensionless value of other qualitative indicators could be obtained. For quantitative indicators, the original value was converted to “the larger the better” and “the smaller the better” according to the demand.

During the LNGVOS fueling process, wind and tide showed a certain trend of change with time. In this paper, we fit it into a table function with time. According to the wind factor, combining the catastrophe time of the risk with the actual state of the wind at the port, the X-axis represents the time of the catastrophe evolution and the Y-axis represents the risk level. In the process of fueling, using mathematical functions to fit, such as normal distribution, β distribution, etc., we found the trend that best matched the wind with time and, taking 10 points based on the horizontal value, we created a table function.

The fueling process was presented in a phased process, that is, there was a delay in time. The DELAY function was used to set the LNG fueling phase time in the fueling process from the third hour, and the checking process was set after the fueling, starting from the fourth hour.

5.3. Determination of Risk Assessment Factors

The influencing factors of the LNGFV’s fueling operation were very complicated and involved many fuzzy concepts. If the risk level of the operation is directly judged very accurately, such as “high risk” or “low risk”, such definition is difficult. This paper refers to relevant research and divides the safety level of each risk factor into five levels. The wind power, age of the ship, and the service life of the pipeline can be obtained, mainly according to the discussion in the literature [9]. The visibility evaluation node can be obtained through related specifications. For some indicators, some quantitative methods are difficult to adopt. In the description of division, this paper uses fuzzy language to make qualitative divisions and obtain the standard table of each risk evaluation node.

5.4. Safety Status and Acceptance Criteria of LNGFV’s Fueling Process Risk

The safety status of the LNGVOS process risk refers to no risk in the system during the process development and no accidents. The condition of an accident can usually reflect a risky situation. Conversely, safety can also be reflected in the situation of risk and accident. According to the safety level of the LNGFV, the order from low to high is I, II, III, IV, V. The higher the safety level, the higher the safety of the system, which indicates that the system is more stable safer. The value of the above safety interval was brought into the calculation formula of the membership degree of the total catastrophe series, and the corresponding safety membership interval was obtained. At the same time, the larger the evaluation value indicated in the catastrophe evaluation method, the safer the system. The safety level membership function of the LNG ship based on the mutation could be obtained, as shown in

Table 7. Membership function for the safety level.

Safety Level	I	II	III	IV	V
Risk condition	higher	high	reasonable	low	lower
Safety status interval	[0,0.39)	[0.39,0.63)	[0.63,0.75)	[0.75,0.84)	[0.84,1.00)

.

5.5. Simulation

The fueling process lasts for 5 h from the start of the preparation to the fueling operation and completion of the purge. The time unit of the model was in minutes, lasted for 300 min, and was displayed in an observed interval of 30 min. The value of the risk’s safety membership function of the LNGFV’s fueling process was between 0 and 1. The higher the value, the more stable and safe it became. The closer the value was to 0, the greater the risk of the system. The above values were brought into the model for simulation, and the risk trend of the LNGFV fueling process was obtained (see Figure 5). Under the condition that the environmental system was relatively stable, it was coupled with the ship factor and a certain stage process in the fueling process. Setting environmental factors in the system didn’t mutate and was in a safer level. As a result, the curve of the process risk system was obtained.

It can be seen from Figure 5 that the catastrophe process of the LNGFV’s fueling process was in a safe state at the beginning stage, and there was no sudden change in environment factors. The berthing work and the inspection work before the fueling were also completed smooth. At the beginning of the fueling, the safety level in the preparation stage was decreased. This was because the flange was damaged when the pipeline was connected, resulting in a slight LNG leak. The system appeared the uncertain mutation and the safety level was extremely low. Subsequently, due to the timely inspection of the staff, the flange was replaced and slowly recovered to a safe level, so that the risk was improved and controlled. LNG flexible pipeline rupture may have caused a large amount of LNG leakage, which may have been caused by mishandling and lack of proper routine maintenance, damage to the pipeline base, pipelines falling into the object, low temperature corrosion, or fatigue breakage, etc.

In Figure 5, risk values were simulated. The sub-system nodes were shown as Figure 5b–d. The process risk was shown as Figure 5a. It can be seen that when the environment factor was between 100 min and 230 min, the interaction of internal variables of environmental factors caused a catastrophe, which lead to a mutation of the system, which made the safety level of the system significantly lower during this period. When the safety level value of the condition monitoring was less than 0.8, the emergency shut-off device was activated. This scenario completely simulated that the LNGFV would start working when it encountered a LNG leakage or the accidental situation lead to a decrease in safety level. The emergency shut-off device was activated to reduce the possibility of an accident. It showed that the reliability of the ship was improved due to the protection measures and safety measures of the LNGFV. The ship’s staff also needed to ensure that the ship’s working conditions were normal and the emergency measures were normal in order to better reduce the risk of LNG fuel.

In the mentioned simulation, due to the coupling relationship between multiple factors in the environment system, the environment system had a catastrophe, resulting in a sudden change in the system and a decrease in the overall safety level. Subsequently, due to a series of protective measures, such as the inspection of the safety system on the ship and the opening of the ESD, the system slowly returned to a safe state (see the Figure 6).

It can be seen that during the fueling process, the safety level decreased and there were signs of sudden changes. For LNG power ships, flammable gas leakage was mainly caused by leakage of the pipeline, control devices, or LNG tanks. LNGFV was equipped with gas and spark detectors, alarm devices, emergency shut-off valves, safety valves, and other equipment. When there was a gas leak or fire source, it could quickly give an alarm and corresponding actions, such as the ESD opening and the fan working to start ventilation, and personnel could take appropriate hedging measures according to the alarm. When there was a problem in any connection, it could have led to dangerous consequences.

5.6. Reliability Test

We took an LNG-fueled dredger-ship for a fueling operation in a certain place in China.

On the day of the fueling, preparations for the fueling began at 10:00, lasting approximately 5 h. The relationship between wind, tide, and time was obtained based on local meteorological data. We brought the data into the model.

It was reported that the flange of the connecting pipeline was damaged during the fueling, resulting in a slit when connecting with the pipeline. Some LNG gas leaks happened at the beginning of the fueling, but then some members of staff found it and took measurements in time, thus only a small amount of LNG leakage didn’t cause any personal or economic damage.

The data in

Table 8. Membership function value of the underlying factor.

Node	Value	Node	Value	Node	Value
T1	0.658	C5	0.614	C4	0.796
C2	0.652	C6	0.775	A3	0.422
C8	0.786	C7	0.736	C3	0.762

was input into the software, Vensim, and model simulation was performed to obtain a risk change graph, as shown in Figure 7. The sub-system nodes were shown as Figure 5b–d. The process risk was shown as Figure 5a.

Environment risks have always been at a safe level, and ship risks have begun to decline. This is due to the LNG detector detecting LNG leakage, which has led to a decline in the safety level of the gas supply system. With the adoption of the measures, the safety level slowly recovered, achieving a safer level and successfully completing the raise. It can be seen that the simulation results of the model were almost consistent with the case.

The simulation results show that the high risk of LNG fuel can be reduced due to the protection measures of the ship and the high reliability of the emergency measures. The LNGFV can have high reliability characteristics; it was the easiest in the stage of the bunker process. A sudden catastrophe occurred, which led to a decline in the safety capacity of the system. More safety management and preventive measures should have been put in this stage to improve the safety level.

6. Discussion

Since the current LNGFV had high standards and strict specifications from design to manufacturing to operation and management, and the natural environment of the inland waters was relatively mild compared to the sea environment, the overall risk was relatively low when the LNGFV was filled in the port. However, considering the serious harm of the consequences of LNG accidents, it was necessary to take certain measures to ensure the safety of people and property around the operation, such as setting up a safe working area.

In the bunker operation stage shown in Figure 8 it was necessary to pay attention to the dangers existing in the piping system, and it was necessary to strictly check the safety conditions of valves, pipelines, flanges, etc. The stakeholders should strengthen the strict adherence of humans in the process of fueling, monitoring the instrument data at any time to check the safety status of various factors and reduce the probability of accidents. At the same time, it can be seen that the LNGVOS process posed a low level of safety, which required strict monitoring and manager attention to this operation.

Environmental nodes and ship nodes were between “reasonable risk” and “low risk”, indicating that the environmental and ship factors under the water areas had less impact on the overall risk, which could meet the requirements of bunker operations for the LNGFV. However, the risk level in the operation required bunkering/connecting equipment and human nodes were between “reasonable risk” and “high risk”, which had a greater impact on the overall risk and needed to be taken into account during the operation.

Based on the system dynamics risk transfer model, the multi-node risk transfer model of the accident system can be constructed accordingly. The single-node and two-node risk transfer model of the accident system considered three variables: Risk growth rate, external environmental conditions, and coupling modes. In fact, the variables that affected the risk transfer behavior included node immunity, random noise, a delay factor, etc. The transfer mechanism became extremely complicated. This study shows, to some extent, that the risk growth rate and external environmental conditions were sensitive parameters that affected the risk transfer behavior, and thus could have become a lever control point for implementing risk control. Constructing a single-node model and a two-node model for risk transfer was effective for analyzing a simple accident system. When there was many historical data, an analytical solution could be found.

The formal description of risk emergence and transition was a prerequisite for quantitative analysis of the risk evolution mode. In order to prevent safety accidents, the coupling synchronization of risk emergence should be weakened, risk control should be implemented, and sensitive parameters, such as risk growth rate and external control resources affecting risk transfer effects, should be noted. The numerical characterization of the operational risk in the process-based complex system was significantly higher than the operation values in the state-based simple system. Process-based correlation risk analysis was superior to state-based dynamic risk analysis. Process risk models using system dynamics helped to improve the sensitivity of the risk analysis.

7. Conclusions

Based on the basic idea of the CA and SD methods, this paper studied the LNGVOS process risk system. The work-flow process was modeled, the main influencing factors between the environment and the ship were studied, and the SD flow graph model of the whole system was obtained. The fuzzy membership function was used to derive the parameters of the qualitative indicators, the parameters of the quantitative indicators were obtained by the range conversion method, the importance ranking of each layer of indicators was obtained by using the expert scoring form, and the equation was written to finally solve the risk catastrophe. The process simulation yielded a quantitative conclusion of the process risk.

In the operation of LNG-fueled vessel, the most prone to accidents were the three basic events of LNG leakage, ignition source, and tank overpressure. The various LNG leakages were mainly caused by personnel failures, equipment failures, extreme environments, and improper safety management. The ignition source mainly came from the aging of the line or the external fire; the overpressure of the tank mainly came from the difference in density components during the filling process or the impact of external forces.

Ship refueling is a dynamic process whose risks change over time, sometimes due to environmental conditions and sometimes due to changes in equipment and personnel during operation. According to the stage of the LNG fueling process, it is divided into the preparation stage, operation stage, and review stage. The operational risk characteristics of these three phases are significantly different. The risk at the beginning of the replenishment is lower than the latter stage, and with the implementation of the operation, there is a possibility of sudden risk mutation.

For the time being, the LNG storage capacity of the LNG-fueled vessel is not very large compared to the LNG carrier. The risk of gas leakage during the filling process is not significant, but failure of the remedial action will result in a flammable gas leak concentration reaching the combustion explosion limit. Therefore, measures must be taken to prevent it, such as the addition of gas detection devices, detection, and alarm systems for regular inspection and protection, to ensure the normal operation of the gas detection system. We checked that the emergency shut-off valve and emergency release device were operating properly before filling.

LNG-related operations in the LNG-fueled vessel operation can be roughly divided into four processes: LNG filling, LNG usage, LNG storage, and LNG release. In each process, the LNG subsystem is strongly coupled to the ship subsystem. Next, we need to study the risks in the use of LNG.