1. Study Methodology

The H-SAFE project (EMSA/OP/21/2023) followed IMO’s goal-based approach (MSC.1/Circ.1394 Rev.2) through six interconnected tasks over multiple years. Task 1 mapped hydrogen-specific hazards and validated modeling tools. Task 2 assessed reliability data and developed generic risk models, confronting the reality that maritime-specific hydrogen failure data essentially doesn’t exist. Task 3.1 conducted HAZID workshops examining compressed hydrogen, liquefied hydrogen, fuel consumers, and bunkering operations. Tasks 3.2 and 4 performed quantitative risk analysis on generic concepts and specific ship types (Platform Supply Vessel with CH₂, Service Operation Vessel with LH₂). Task 5 synthesized findings into comprehensive guidance through stakeholder consultation including a November 2025 DNV-hosted roundtable with 30+ participants. Task 6 produced this final report with complete guidance (Appendix A), IMO comparison (Appendix B), and bunkering guidance structure (Appendix C).

Validation and Tools: Commercial CFD models proved effective for hydrogen dispersion and deflagration modeling, but less validation exists for hydrogen versus natural gas. Hydrogen-specific models exist for leak frequency and ignition probability but lack failure data for full validation, creating the highest uncertainty in risk analyses.

2. Hydrogen Properties and Safety Hazards

2.1 Physical Property Comparison

2.2 Critical Hazards

Fire and Explosion

Hydrogen’s extraordinarily low ignition energy (0.017 mJ) means static electricity discharges imperceptible to humans can trigger combustion. The wide flammability range (4-75%) creates ignitable mixtures across vastly more conditions than methane. Once ignited, burning velocity of 3.46 m/s—seven times faster than methane—means explosions develop with frightening rapidity and readily transition to detonation in confined spaces. Critical finding: leak rates as low as 0.1 kg/s create ignitable clouds within seconds—far faster than detection and isolation systems can respond.

Cryogenic Hazards (LH₂)

At -253°C, LH₂ exists below the condensation points of nitrogen (-196°C) and oxygen (-183°C). Vacuum insulation failure causes external surfaces to liquefy surrounding air, with oxygen condensing preferentially to create enriched mixtures exceeding 50% O₂ (versus 21% normally). This oxygen-enriched liquid makes normally non-flammable materials highly combustible. Ship steel exposed to these temperatures undergoes catastrophic embrittlement—ductility vanishes, brittle fracture can occur under normal loads, threatening tank supports and hull structure.

High-Pressure Hazards (CH₂)

Compressed hydrogen systems at 350-700 bar present rupture hazards with blast effects, high-velocity jets causing injection injuries, and potential for catastrophic tank failure. The high pressure drives substantial leak rates when failures occur and amplifies ignition risks through adiabatic compression heating.

3. Reliability Analysis

3.1 Data Sources and Limitations

The analysis relied on three primary databases, each with significant limitations. HCRD (Hydrocarbon Release Database) from offshore oil/gas provides high-quality failure data for marine environments but not hydrogen-specific. HyRAM+ (Hydrogen Risk Assessment Models) offers hydrogen-specific data but limited maritime applicability and continues evolving. OREDA/NPRD/PDS provide generic equipment reliability data lacking both hydrogen and maritime specifics. Critical gap: none account for maritime factors like ship motion, saltwater corrosion, limited maintenance access, space constraints, or crew variations.

Equipment Risk Drivers: Heat exchangers top the risk hierarchy due to complex geometries, thermal cycling, and inspection difficulties. Compressors follow with dynamic seals subject to wear, high-pressure differentials, and vibration loading. Valves appear throughout systems in large numbers; flexible hoses (for portable systems) suffer fatigue from ship motion; flanges and fittings multiply leak points despite seeming simplicity.

3.2 Leak Frequency

Generic analysis of a 4-tank CH₂ system with inerted tank connection enclosure yields approximately 1 leak event per 10 years, with high uncertainty spanning orders of magnitude. This represents the most uncertain parameter in the risk analysis.

3.3 Ignition Probability

3.4 Detection Systems

Point gas detectors (catalytic/electrochemical) are too slow—they must contact leaked gas before triggering, introducing 10-30+ second delays while critical clouds form in seconds. Acoustic/ultrasonic detectors offer faster response but face reliability concerns in noisy machinery spaces with high false alarm potential. Optical detectors (infrared/UV) have line-of-sight limitations and environmental challenges from fog, spray, contamination. Conclusion: High uncertainty exists whether detection systems can react quickly enough, reinforcing that secondary enclosures must be primary safety barriers.

3.5 Safety Barrier Performance

ESD systems: Failure probability 10⁻² to 10⁻³ per demand depending on design; common cause failures critical. Ventilation: Reliability depends heavily on maintenance; not effective against substantial leaks. Inerting systems: Active systems with multiple failure modes; gas-freeing temporarily removes barrier. Secondary enclosures (passive): High reliability once installed, no active components to fail, minimal maintenance—the preferred barrier.

4. Compressed and Liquefied Hydrogen Systems

4.1 CH₂ Configuration Analysis

HAZID workshops evaluated five compressed hydrogen tank connection enclosure (TCE) configurations, revealing a clear hierarchy of safety performance.

4.2 TPRD Systems and Vent Mast Hazards

Thermal Pressure Relief Devices represent the last defense against fire-induced tank rupture but create their own severe hazards. External fire heats tanks, raising internal pressure while weakening tank material. Without intervention, catastrophic rupture releases entire inventory instantaneously, creating devastating fireball. TPRD activates on temperature (not pressure), venting entire contents deliberately to prevent rupture—a controlled disaster preferable to uncontrolled catastrophe.

Venting hazards: Ignition inside vent mast risks detonation with structural failure potential. Jet fire from vent outlet creates massive vertical flame (50-200+ meters) with severe thermal radiation affecting 20-50 meter radius. If ignition delays, hydrogen cloud on open deck could cause deflagration or detonation. Gas ingress through openings creates asphyxiation risks in accommodation/machinery spaces. Personnel exposure hazards affect anyone on deck, bridge wings, or near affected areas.

Frequency estimation: TPRD activation depends on external fire occurrence—collision, grounding, cargo fire. Historical statistics suggest 10⁻⁴ to 10⁻³ per ship-year. Bunkering overpressure represents another trigger but frequency not quantified (requires Human Reliability Analysis). Given venting occurs, ignition probability is HIGH due to multiple potential sources: hot surfaces, static electricity, electrical equipment, possible spontaneous ignition.

Mitigating measures: Large diameter vent lines minimize backpressure and internal velocity. Structural design must withstand internal detonation without rupture. Flame arrestors attempt to prevent ignition propagation (effectiveness requires validation). Vent mast location optimization for height, distance from accommodation/life-saving equipment, prevailing wind consideration. Exclusion zones define inaccessible areas during venting. Emergency procedures must account for areas that become unsafe, with alternative muster locations pre-planned.

Outstanding TPRD questions requiring research: Can jet fire impingement directly on tank activate sensor quickly enough? What are proper sensor placement requirements? If sensor located inside TCE for protection, does isolation delay create unacceptable risk during external fire? What testing protocols verify performance in realistic scenarios? How to balance response time with false activation prevention?

4.3 External Event Protection

Collision and grounding analysis applies GOALDS methodology in three steps. First, estimate annual collision/grounding probability for ship type and trade (10⁻³ to 10⁻⁴ per ship-year based on casualty statistics). Second, calculate probability that damage penetrates to fuel tank location using SOLAS probabilistic damage stability methodology—tanks inside double hull protected, side tanks more vulnerable to collision, bottom tanks to grounding. Third, estimate probability that penetrating damage actually ruptures tank—Type C independent pressure vessels (spherical/cylindrical) prove remarkably robust against impact; membrane tanks much more vulnerable.

Dropped object scenarios particularly relevant for Platform Supply Vessels and offshore support vessels. Cargo operations involve lifting heavy equipment over deck areas. Analysis must consider: equipment mass and drop height determining impact energy; tank arrangement relative to cargo handling zones; protective structures (crash frames, gratings) that absorb energy; operational procedures limiting concurrent cargo operations and hydrogen system operation.

Design implication: thoughtful tank placement inside double hull, away from likely damage zones (forward of machinery, aft of cargo areas benefit statistically), with structural protection against dropped objects significantly improves survivability. While complete protection against all possible impacts remains impossible, risk can be substantially reduced through arrangement decisions made early in design.

4.4 LH₂ Vacuum Insulation Loss

Vacuum loss represents a credible failure mode through multiple mechanisms: physical damage from collision/grounding/dropped objects; seal degradation from thermal cycling, material aging, or installation defects; manufacturing defects in vacuum jacket. The consequences unfold as a devastating cascade over seconds to hours.

4.5 LH₂ Configuration Comparison

4.6 Bunkering Operations

Bunkering represents one of the highest-risk evolutions in hydrogen ship operations. Temporary connections between ship and shore introduce leak potential absent during sea passage. Personnel presence at manifold creates exposure risks. Coordination required between ship and shore crews creates communication failure modes. Weather conditions affect operations—wind could blow leaked gas toward personnel or accommodation, wave motion stresses connections, temperature extremes affect equipment performance.

Critical gap: Study identifies lack of harmonized international guidance for shore-side hydrogen bunkering as most glaring regulatory shortfall. While ship-side requirements receive detailed attention, facilities remain subject to patchwork of national/local regulations with widely varying requirements. This slows infrastructure development, creates safety variability, and complicates ship/shore interface definition. Appendix C outlines proposed structure for comprehensive bunkering guidance requiring international coordination through IMO processes.

5. Fuel Distribution and Consumer Systems

5.1 Fuel Preparation Rooms

Fuel preparation rooms condition hydrogen between storage and engine supply—pressure reduction, temperature management, flow control, buffering. These spaces concentrate equipment with multiple potential leak sources: pressure regulators, heat exchangers, buffer vessels, control valves, instrumentation. Double-wall piping requirements: All hydrogen piping through fuel preparation room must be double-walled or contained within secondary enclosure. The annular space between walls connects to vent system, ensuring any leakage from inner pipe routes safely away. Alternative: completely enclose room as secondary barrier, but this creates more complex access/ventilation challenges.

5.2 Engine Room Supply Systems

Routing hydrogen to engines in machinery spaces presents particular challenges. Engines represent unavoidable hydrogen consumers within spaces containing numerous ignition sources—hot exhaust surfaces, electrical equipment, mechanical friction points. Mandatory measures: Gas-tight enclosures around all piping through machinery space; leak detection in all enclosures with immediate shutdown capability; emergency isolation preventing hydrogen flow to machinery space; vent lines routing leaked gas directly to vent mast without passing through additional spaces; gas-tight bulkhead penetrations for all services. Engine-specific considerations include knocking (similar to LNG engines but hydrogen’s faster flame speed requires attention to ignition timing and combustion chamber design) and crankcase explosion risk (hydrogen’s lower ignition energy means more potential ignition sources, wider flammable range easier to reach, relief valves must size for potentially more severe explosions).

5.3 Vent Systems

Comprehensive vent system requirements include: collect hydrogen from all potential sources (pressure relief valves, secondary enclosure vents, gas-freeing operations, maintenance venting); route to common vent mast without passing through accommodation or occupied spaces; prevent ignition within vent piping through flame arrestors, proper materials, grounding; withstand internal explosion if flame arrestors fail; vent outlet location ensuring safe distance from ignition sources, air intakes, accommodation; outlet design minimizing ignition probability.

6. Occupational Safety and Human Factors

5.1 Personnel Hazards

Beyond ship-level risks, personnel face: Asphyxiation from oxygen displacement (rapid onset, odorless/colorless warning); Cryogenic burns from LH₂ contact causing immediate severe injury, eye exposure, respiratory damage; High-pressure release creating blast effects, injection injuries, flying debris, hearing damage; Invisible flames creating burn hazards from unexpected contact; Confined space exposure requiring specific entry procedures and continuous monitoring; Static electricity making personnel potential ignition sources.

5.2 Accident Causation Analysis

HIAD 2.0 database analysis of 575 hydrogen incidents reveals: 49% involve SMS factors (inadequate procedures, insufficient planning, training gaps, poor communication); 35% materials/manufacturing errors (material incompatibility, fabrication defects, quality control failures); 29% individual human errors (operator mistakes, procedural deviations); 27% system design errors (inadequate design assumptions, unforeseen failure modes). Most striking: nearly 50% involve combined human and organizational errors—accidents typically require multiple failures to align.

5.3 Training Requirements

General training: All crew need foundational understanding of hydrogen properties, hazards (fire/explosion/asphyxiation/cryogenic/high-pressure), safety systems, emergency procedures, PPE use, and reporting protocols—not memorization but comprehension of why hydrogen behaves differently.

Specialized training: Engineering officers require in-depth system knowledge, hydrogen-specific maintenance procedures, troubleshooting, pressure vessel inspection, leak detection operation, confined space procedures. Deck officers need bunkering supervision, emergency coordination, cargo handling awareness, weather restrictions knowledge. Bunkering personnel must master connection procedures, transfer monitoring, emergency shutdown, spill response.

Practical training: Simulator training for realistic emergency scenarios, equipment familiarization before operations, regular emergency drills, tabletop exercises for complex decision-making. Theory alone proves insufficient—crews must train until responses become reflexive.

5.4 Safety Management System Requirements

Given that 49% of hydrogen accidents involve SMS factors, robust provisions are essential across four key areas:

Operational procedures: Detailed operating procedures for all hydrogen systems; bunkering procedures (preparation, connection, transfer, disconnection); startup and shutdown procedures; routine monitoring and inspection procedures; changeover procedures (hydrogen to backup fuel); weather/environmental restrictions clearly defined.

Maintenance program: Preventive maintenance schedules for all hydrogen equipment; inspection procedures with hydrogen-specific acceptance criteria; special maintenance for hydrogen-wetted components; leak testing procedures accounting for hydrogen’s small molecular size with appropriate frequency; pressure vessel inspection and certification beyond standard requirements; gas detection system calibration and testing ensuring continued functionality.

Emergency response: Emergency procedures for various scenarios (leak, fire, system failure, vacuum loss, TPRD activation); muster and evacuation plans accounting for hydrogen hazards and exclusion zones; fire-fighting procedures specific to hydrogen fires (invisible flames, high temperatures); communication protocols with shore authorities; medical emergency procedures for hydrogen exposure (cryogenic burns, asphyxiation, injection injuries); damage control procedures considering hydrogen system interactions.

Risk assessment and learning: Ship-specific risk assessment documenting hazards and controls; regular review and update as operational experience accumulates; near-miss and incident investigation procedures with root cause analysis; lessons learned incorporation into procedures ensuring continuous improvement; trending analysis identifying degrading equipment before catastrophic failure.

7. EMSA Guidance Structure

7.1 Goal-Based Framework

The EMSA Guidance (Appendix A of full report) follows IMO goal-based approach specified in MSC.1/Circ.1394 Rev.2, mirroring IGF Code structure with 19 parallel chapters plus additional chapter on personnel protection (Chapter 20). Each chapter specifies Goals (high-level safety objectives), Functional Requirements (performance-based requirements describing what systems must accomplish), and Prescriptive Measures (technical specifications and arrangements to meet functional requirements). This structure allows alternative designs meeting functional requirements through different solutions while providing prescriptive guidance for standard approaches.

7.2 Chapter Overview

Chapters 1-5 (General Requirements): Application and definitions; goals and functional requirements; general requirements; ship and cargo tank design/arrangement; fuel containment system materials.

Chapters 6-10 (System Design): Fuel containment systems (storage tanks); material and pipe design (piping systems); fuel supply to machinery; fuel preparation room arrangements; ventilation and air conditioning.

Chapters 11-15 (Safety Systems): Control, monitoring, and safety systems; Electrical installations; Power generation; Fire safety; Emergency systems.

Chapters 16-20 (Operations & Personnel): Operational requirements; Bunkering operations; Maintenance and inspection; Surveyors’ guidance; Personnel protection (hydrogen-specific addition).

7.3 Key Departures from IMO Interim Guidelines

EMSA Guidance takes more conservative positions in several areas, reflecting detailed risk analysis findings: Secondary enclosures: EMSA recommends for all potential leak sources including open deck; IMO allows alternatives. Substantial leak assumption: EMSA explicitly requires designing for substantial leaks; IMO less explicit. Ignition probability: EMSA emphasizes assumption of ignition occurrence; IMO focuses more on ignition prevention. LH₂ vacuum loss: EMSA requires accommodation in design; IMO less prescriptive. Detection system limitations: EMSA explicitly acknowledges detection may be too slow for hydrogen; IMO relies more heavily on detection as barrier.

Appendix B provides paragraph-by-paragraph comparison enabling readers to understand exactly where and why EMSA’s approach diverges from IMO’s developing framework. These differences aren’t arbitrary—they reflect the detailed HAZID workshops, quantitative risk analysis results, and uncertainty quantification documented throughout the study.

8. Conclusions and Recommendations

8.1 For Naval Architects and Design Engineers

Abandon IGF Code equivalency: Hydrogen is not LNG with modifications—fundamentally different design philosophy required. Secondary enclosures for ALL leak sources: Not optional risk mitigation but essential safety barriers including open deck applications. Design for substantial leaks: Small leak management insufficient; consider up to full-bore rupture in consequence analysis. Assume ignition will occur: Design systems to prevent leaks from reaching ignition sources (containment) OR accommodate ignition consequences. Accommodate LH₂ vacuum loss: Ship structures and systems must safely handle vacuum insulation failure. Minimize enclosed spaces: Where feasible, locate equipment on open deck rather than concentrating in enclosed spaces. Protect fuel systems from external events: Tank location and structural protection critical for collision/grounding/dropped object scenarios. Conduct comprehensive risk assessment: Ship-specific QRA essential early in design to inform arrangements and system selections.

8.2 For Ship Operators and Owners

Invest in training and safety culture: With 50% of accidents involving human/organizational factors, comprehensive training and active safety culture cultivation are non-negotiable. Build hydrogen-specific SMS: Don’t adapt conventional fuel SMS—develop from ground up addressing hydrogen hazards in bunkering, maintenance, and emergency procedures. Rigorous maintenance: Hydrogen-wetted components require specialized protocols, leak testing accounting for hydrogen’s small molecular size, embrittlement inspection, verified-compatible replacement parts. Emergency preparedness: Train to muscle-memory level through regular drills (leak detection, fire, vacuum loss, bunkering emergency) and tabletop exercises. Operational data collection: Document and share near-misses, leaks, failures—the maritime hydrogen database will only be built through collective experience. Bunkering safety: Work with facilities well in advance, verify safety standards, conduct thorough briefings, never allow commercial pressure to rush safety steps.

8.3 For Regulators and Classification Societies

Accelerate bunkering guidance: Shore-side safety gap must close through harmonized international standards. Consider EMSA’s conservative approach: Secondary enclosures for all leak sources, substantial leak design basis, explicit ignition assumption, LH₂ vacuum loss accommodation reflect data uncertainties. Support maritime-specific data collection: Industry database for hydrogen equipment failures urgently needed through standardized reporting, anonymized data sharing. Harmonize international standards: Consistent requirements across flag States and classification societies streamline development. Require comprehensive risk assessment: Mandatory QRA should inform design decisions, not just demonstrate equivalency. Monitor operational experience: Establish periodic review cycles with defined triggers for guideline updates as fleet grows.

8.4 For Equipment Manufacturers

Develop maritime-specific equipment: Land-based designs often unsuitable without substantial modification for ship motion, saltwater, space constraints, limited maintenance access. Address risk drivers: Focus on heat exchangers, compressors, valves—the components driving system risk. Improve detection technology: Faster, more reliable leak detection accounting for machinery noise, vibration, maritime conditions. Material rigor: All hydrogen-wetted materials must be specified for hydrogen embrittlement resistance under actual service conditions. Comprehensive documentation: Provide complete failure modes, maintenance requirements, service life, inspection procedures. Support data collection: Participate in industry failure database efforts.

8.5 Research Priorities

Critical areas requiring investigation: Maritime-specific leak frequency data from operational experience to reduce uncertainty. Ignition probability models validated for maritime environments accounting for electrical systems, hot surfaces, ship motion effects. Detection system effectiveness particularly acoustic detectors in machinery spaces. Long-term material performance over decades in hydrogen/marine service. TPRD validation through full-scale fire testing for activation reliability. Vacuum insulation reliability including failure modes, degradation rates, monitoring capabilities. Human Reliability Analysis for hydrogen bunkering and maintenance. Consequence modeling validation especially detonation transition and cryogenic/structure interactions.

8.6 Industry Path Forward

Near-term (2026-2027): IMO Interim Guidelines approval, flag State implementation, classification society rule updates, first commercial hydrogen ships operational, training programs established.

Mid-term (2028-2030): Operational experience from early adopters, maritime failure data collection initiated, bunkering infrastructure development, harmonized bunkering standards, equipment standardization, cost reduction through scale.

Long-term (2030+): Significant hydrogen fleet operating, validated maritime reliability data, revised IMO guidelines based on experience, mature supply chain, competitive economics, contribution to IMO 2050 decarbonization goals.

8.7 Final Perspectives

The EMSA H-SAFE study demonstrates that hydrogen can be safely used as marine fuel—but only under specific conditions that cannot be compromised.

Safety depends absolutely on: appropriate technical design with purpose-built systems incorporating study findings; conservative approach to uncertainties erring on caution given data limitations; robust operational procedures with training and safety culture as essential barriers; comprehensive ship-specific risk assessment informing design decisions; continuous improvement through operational data collection and transparent sharing.

The technical foundation now exists through EMSA Guidance, IMO Interim Guidelines, and developing classification society rules. What happens next depends on the maritime industry’s collective commitment to implementing these findings with unwavering dedication to safety in design decisions, operational practices, resource allocation, and cultural commitment. Hydrogen can enable deep decarbonization of shipping, but realizing that potential requires the diligence and discipline that hydrogen’s unique hazards demand.