Scholarly article on topic 'Towards the assessment of potential impact of unmanned vessels on maritime transportation safety'

Towards the assessment of potential impact of unmanned vessels on maritime transportation safety Academic research paper on "Earth and related environmental sciences"

CC BY
0
0
Share paper
Keywords
{"Unmanned ships" / "Maritime safety" / "Hazard analysis" / "Maritime accidents" / "Autonomous vehicles" / "Resilience engineering"}

Abstract of research paper on Earth and related environmental sciences, author of scientific article — Krzysztof Wróbel, Jakub Montewka, Pentti Kujala

Abstract The prototypes of unmanned merchant vessels are expected to come into service within the coming years. The main line of argument supporting their introduction pertains to the increase in navigational safety, which is expected to be achieved by reducing the frequency of human-related accidents on board ships, by removing the crews. On the other hand, the response of unmanned ship to potential accidents is still uncertain. With enthusiasm on one side and apprehension on the other, the literature lacks an objective study on the effect of unmanned ships on safety of maritime transportation. This paper constitutes an attempt to bridge the aforementioned gap by applying a framework based on what-if analysis to a hundred maritime accident reports. The aim of the analysis is to assess whether the accident would have happened if the ship had been unmanned, and once the accident had happened - would its consequences have been different. The results obtained reveal that the occurrence of navigational accidents (e.g. collision, grounding) can be expected to decrease with the development of unmanned ship. However the extent of consequences resulting particularly from non-navigational accidents (e.g. fire, ship loss due to structural failure) can be expected to be much larger for the unmanned ships when compared to the conventional ones.

Academic research paper on topic "Towards the assessment of potential impact of unmanned vessels on maritime transportation safety"

Author's Accepted Manuscript

Towards the assessment of potential impact of unmanned vessels on maritime transportation safety

Krzysztof Wrobel, Jakub Montewka, Pentti Kujala

www.elsevier.com'locate/ress

PII: S0951-8320(16)30333-7

DOI: http://dx.doi.org/10.1016/j.ress.2017.03.029

Reference: RESS5789

To appear in: Reliability Engineering and System Safety

Received date: 4 August 2016

Revised date: 3 March 2017

Accepted date: 22 March 2017

Cite this article as: Krzysztof Wrobel, Jakub Montewka and Pentti Kujala Towards the assessment of potential impact of unmanned vessels on maritimi transportation safety, Reliability Engineering and System Safety http ://dx.doi. org/ 10.1016/j .ress.2017.03.029

This is a PDF file of an unedited manuscript that has been accepted fo publication. As a service to our customers we are providing this early version o the manuscript. The manuscript will undergo copyediting, typesetting, an< review of the resulting galley proof before it is published in its final citable form Please note that during the production process errors may be discovered whic could affect the content, and all legal disclaimers that apply to the journal pertain

Towards the assessment of potential impact of unmanned vessels on maritime transportation safety

Krzysztof Wrobela1, Jakub Montewkabcd, Pentti Kujalac

a - Gdynia Maritime University, Faculty of Navigation, Department of Navigation, 81-345 Gdynia, Poland

b - Gdynia Maritime University, Faculty of Navigation, Department of Transport and Logistics, 81-225 Gdynia, Poland

c - Aalto University, Department of Mechanical Engineering, Marine Technology, Research Group on Maritime Risk and Safety, 02150, Espoo, Finland d - Finnish Geospatial Research Institute, 02430 Masala, Finland

Abstract

The prototypes of unmanned merchant vessels are expected to come into service within the coming years. The main line of argument supporting their introduction pertains to the increase in navigational safety, which is expected to be achieved by reducing the frequency of human-related accidents on board ships, by removing the crews. On the other hand, the response of unmanned ship to potential accidents is still uncertain. With enthusiasm on one side and apprehension on the other, the literature lacks an objective study on the effect of unmanned ships on safety of maritime transportation.

This paper constitutes an attempt to bridge the aforementioned gap by applying a framework based on what-if analysis to a hundred maritime accident reports. The aim of the analysis is to assess whether the accident would have happened if the ship had been unmanned, and once the accident had happened - would its consequences have been different. The results obtained reveal that the occurrence of navigational accidents (e.g. collision, grounding) can be expected to decrease with the development of unmanned ship. However the extent of consequences resulting particularly from non-navigational accidents (e.g. fire, ship loss due to structural failure) can be expected to be much larger for the unmanned ships when compared to the conventional ones.

Keywords: unmanned ships, maritime safety, hazard analysis, maritime accidents, autonomous vehicles, resilience engineering

1 Corresponding author's e-mail: k.wrobel@wn.am.gdynia.pl, phone: +48 58-5586-115

1. Introduction

The concept of unmanned surface vehicle (USV) is not new. While its first demonstration was performed by Nikola Tesla in 1898 [1], the last decade of the 20th century has seen a large number of projects emerge. The vast majority of existing solutions pertain to the law-enforcement and naval units with displacement of up to 10 tons [2], although some minesweepers can reach up to 100 tons [3]. Due to technology advancements in recent years and experience gained in the operation of small- and medium-sized USVs, the aspiration appeared to develop an unmanned merchant vessel able to haul her cargo across the oceans. It is believed that the first unmanned ships will become operational within the next 10-15 years [4], [5]. However, it must be ensured that those masterpieces of technology would indeed increase maritime safety or at least would not reduce it [6,7]

At present, there are several R&D projects aiming at the development of a proof of autonomous merchant vessels' concept [1,8-11]. Therein a hypothetical autonomous ship takes advantage of her ability of being operated in one of the three modes, as follows: fully manned, remote controlled or fully autonomous. The latter corresponds to autonomy level 5 (AL5) according to Lloyd's Register scale, defined as follows: Unsupervised or rarely supervised operation where decisions are made and actioned by the system, i.e. impact is at the total ship level1 [12]. She would traverse high seas autonomously with possibility of switching to remote control via satellite communication link in case the systems are unable to perform correctly in given circumstances or whenever a shore-based operator considers it necessary. Furthermore, a full complement of crew would embark prior to reaching the port of destination in order to perform mooring or any other demanding operations in a safe and efficient manner.

In the course of quantitative safety assessment of the unmanned bulk carrier concept carried out within MUNIN project [6,10] the authors claim that the unmanned ship can be expected to be safer than the conventional units despite acknowledging that they lack vital information pertaining to her design and operation [11]. Moreover, the majority of the hazards anticipated within that study are human-related and the effect of human absence on the development of the accident's aftermath does not appear to be properly accounted for. For instance, redundancy is claimed to be a primary means of reducing accident's consequences which can prove unfeasible in some cases like fire incidents where, as we conclude from our analysis, it would be extremely difficult to design a technical system capable of preventing or handling all the potential fire scenarios.

Furthermore, insurance companies are rather sceptical about the idea of unmanned ships. It is believed that it will take decades rather than years for the concept to become operational and legally acceptable, however it could offer an economically feasible alternative for short sea

shipping, in a form of a convoy formation with manned vessels escorting and tracking the unmanned ships, [13].

From the scarce body of literature in the field of unmanned shipping it is evident that one of major issues related to the unmanned ship operations is their safety. The main line of argument supporting their introduction pertains to the increase in navigational safety. This is expected to be achieved by reducing the frequency of human-related accidents on board ships, simply by removing the crews. However, the crew will not be in fact completely removed but rather relocated to a remote command centre. This may create hazards that are yet to be identified. Furthermore, the response of unmanned ship to potential accidents is still uncertain. With enthusiasm on one side and apprehension on the other, the literature lacks scientific study on the effect of unmanned ships on the safety of maritime transportation. To bridge this gap, or at least to reduce it, we made an attempt of applying a safety assessment framework based on what-if analysis over a hundred of maritime accident reports. The aim of the analysis was to assess whether the accident would have happened if the ship had been unmanned, and once it had - would its consequences have been different if there were no one on board to counteract them.

The assessment is based on the use of subjective two-step what-if analysis supported by Human Factors Analysis and Classification System for Marine Accidents (HFACS-MA) method and simple consequences check. Within such framework the available accident reports are studied with respect to the cause of an accident and its consequences. The first step was to assess whether the accidents were more (or less) likely to happen if the ship in question was unmanned (the question about the accident's likelihood). In the next step, given the accident did in fact occur, would the consequences be different (the question about the impact severity). To answer these two questions a qualitative scale is used as follows: 1) no influence, 2) occurrence or impact greater, 3) occurrence or impact lesser. The obtained results show that if the unmanned ships are put into operation as per autonomy level 5, we may expect lower occurrence of typical, human-related maritime accidents, however there is no premise to expect the consequences of potential accident to be lower than observed nowadays. The assessment does not account for hazards that were not experienced in the shipping industry in the past, like cyber-piracy or terrorism [14]. If those appear, they may lead to devastating consequences significantly affecting the safety of navigation of unmanned ships and public perception of them.

The remainder of this paper is structured as follows: first materials and methods used in the assessment are introduced. Subsequently we present and discuss the obtained results as well as additional observations based on the analysis. Finally the conclusions are drawn and recommendations for future studies are given.

2. Materials and methods

This section elaborates on the available data used for the assessment of the potential unmanned ships' impact on the safety of navigation. Also, methods applied are introduced here. Finally, the section demonstrates the application of the method on a selected accident report as a case study.

2.1. Accident reports

Due to ongoing discussion regarding the manner in which the unmanned vessels would actually be operated [15][16], we assume that unmanned ships will operate in autonomous mode during ocean passage until a certain point before a port approach where the shore operator will take over. 'Conn to operator' point can vary for different ports or voyages depending on expected traffic, complexity of environmental conditions etc. but it may be expected that ships' managers would like to operate them in autonomous mode as long as possible in order to exploit full advantage of autonomy and not involve additional costs. In order to accommodate this uncertainty, we assume that the ship in question would operate autonomously until the point in which the Master took conn in a real event. It is also acknowledged that future unmanned ships might be forced to stay at the anchorage due to, for example, berthing crew's embarkation inability in severe weather.

In the study presented here, we analysed 100 maritime accidents involving 119 vessels based on publicly available investigation reports. Based on anticipated operational practice of unmanned ships, we selected only the accidents that occurred during those parts of voyage that are most likely to become unmanned in the future. The accidents that occurred in the other parts of the voyage (e.g. harbour navigation) are considered irrelevant for this study unless no connection between voyage phase and accident circumstances could be identified. The breakdown of accidents' number by voyage phase in which it occurred and special conditions prevailing is given in Table 1.

The accidents reports were retrieved from the following organizations: Australia Transport Safety Bureau [17], Accident Investigation Board of Norway [18], Danish Maritime Authority [19], European Maritime Safety Agency [20], Isle of Man Ship Registry [21], Japan Transport Safety Bureau [22], Marine Accident Investigation Branch in UK [23], The Federal Bureau for Maritime Casualty Investigation in Germany [24], The Bahamas Maritime Authority [25], The Government of Hong Kong Special Administrative Region [26], Transport Safety Board of Canada [27]. The list of the accidents analysed and sources of data is given in the Table A1. In the course of the analysed accidents, 63 lives have been lost and 28 people have been injured. The numbers include rescuers wounded or perished while assisting endangered seafarers. Three cases resulted in serious environmental damage. Types of vessels involved

in the accidents are presented in Fig.1. We have included cargo ships' accidents in our analysis as a majority and other ships' types (Ro-Ro ferries, Offshore Support Vessels) only when their different type had no apparent effect on event's likelihood or consequences. The accidents involved vessels with their gross tonnage ranging from 182 to 170,794. They happened in years 1999 through 2015 in various geographical regions, although most of the groundings occurred in Northern European waters and collisions - in the China Sea, the former involving noticeably large number of coaster vessels manned by small crews of 7 to 8 men. No particular relationship between age of the ship and her likelihood to become involved in maritime accident has been observed.

Table 1: The breakdown of accidents' number by voyage phase in which they occurred

Type of accident Pilot station to berth Coastal navigation Ocean navigation Anchorage Restricted visibility Wind Beaufort 5°+

Grounding 32 1 2 7

Fire, explosion 3 9 11 1 2

Collision 16 3 9 4

Flooding 7 2 5

Loss of stability 1 2 3 2 5

Damage to cargo 2 2 3

Loss of structural integrity 1 1 1

Loss of buoyancy 1

Types of vessels considered in analysis

Fig.1.: Types of vessels considered in analysis

2.2. Methods

The available body of scientific literature lacks a method assessing an influence of lack of the crew on board on vessel's safety in an emergency. Therefore, we attempt to qualitatively assess such an influence based on the analysis of conditions and circumstances prevailing in time of casualty, accident's causes together with crew's actions in response to the emergency and other factors, if applicable.

Although the concepts of unmanned merchant vessels are still under development, high-level anticipation of their future design and performance is available, see for example [6,10,28,29]. This background knowledge was utilized in our preliminarily assessment of the unmanned vessels' impact on maritime safety.

2.2.1. Framework for safety analysis of unmanned ships

In order to answer the question of whether the introduction of unmanned vessels will increase an overall safety of marine transportation, we adopt a framework of what-if analysis [30] augmented by Human Factors Analysis and Classification System for Marine Accidents (HFACS-MA) and a simple consequences check. We paid particular attention to the two following aspects:

1. If the ship were unmanned, how would that fact affect the likelihood of particular accident?

2. If the accident occurred anyway, would its consequences be more or less serious if there were no crew on board?

To this end we reviewed one hundred maritime accident investigation reports. Those were prepared and published by national marine safety agencies, bodies that use the best knowledge and experience of their members and contributing experts. Vast majority of the reports included sections of event's time outline, involved ships' details, and actions taken by the crew before, during and after the accident, its causes and consequences. We divided each of the accidents into two stages: prior to the accident and post-accidental. Then, the former is studied with respect to its two aspects: the root causes and direct causes. For the purpose of the analysis, we define root causes as event or conditions leading to the direct causes, which in turn are pivoting points in incidents' development after which little, if anything, can be done to avoid the accident. The post-accident stage encompasses the following phases: situation assessment, decision-making and damage control, as described in Figure 2.

Root causes

Direct causes

ACCIDENT

Situation assessment

Damage control

Decision making

EVALUATION OF UNMANNED SHIPS ACCIDENTS LIKELIHOOD:

1 Assess qualitatively the potential occurrence of each HFACS-MA causal category in future maritime accidents where unmanned ships are involved;

2. Review historical accident reports for manned ships to determine the causal factor(s) leading to the accidents;

3. Attribute each defined causal factor to causal categories as per HFACS-MA;

4 Assess qualitatively the impact of the unmanned ships' introduction on accident's likelihood, based on knowledge extracted in Step 3 and classification scheme in Step 1.

EVALUATION OF ACCIDENTS COIN SEQUENCES:

1. Determine impact on unmanned ship's accident output based on outcome factors

WHAT-IF ANALYSIS Fig. 2.: Safety analysis framework

LIKELIHOOD AND CONSEQUENCES ASSESSMENT adopted in this study

For the purpose of the analysis we made the following assumptions:

1. the control systems of a hypothetical vessel would be designed to properly handle majority of conditions that can occur during normal operation of the ship, detect unexpected situations in ample time and operate under remote control.

2. the vessel is operated in AL5 mode until the system detects a situation in which shore-based operator's intervention is required - an event corresponding to a present situation where ship's nautical officer calls for master's assistance or fire/general alarm activates automatically.

Some consequences of somewhat idealistic first assumption are further discussed in section 2.2.2.

2.2.1.1. Causes of an accident

For the evaluation of the accident's causes we applied HFACS-MA as originally presented in [31]. Generic HFACS is based on Reason's Swiss Cheese theory [32] and was initially developed for studying the contribution of human elements to military aviation accidents but was further developed by various scholars to include other causal factors. Its success in detecting the contributing failures and in the accident analysis made it popular among accident investigators from various fields including aviation, railroad and shipping [33]. According to HFACS-MA the accident's causes are divided into 21 causal categories grouped in 5 levels: External Factors, Organisational Influences, Unsafe Supervision, Preconditions and Unsafe

Acts. The causes belonging to a particular category can be either a result of a factor located on the upper level or can occur independently, eventually leading to an accident. For the description of the method see Figure 3 and Table 2. When reviewing factual data regarding the event in question, its causal factors are identified and inventoried. Then, those are assigned to a causal category in accordance with HFACS-MA taxonomy. Subsequently we assigned HFASC-MA causal categories an impact each of them would have on unmanned ships' safety performance, as indicated in Table 2.

For instance, 'Hardware' faults would increase unmanned vessel's likelihood of getting involved in an accident due to maintenance-related challenges, inability of manual adjustments or operation of mechanisms etc. On the other hand, 'Planned Inappropriate Operation' would be less likely to affect negatively the safety of unmanned vessels since, for example, passage planning can be performed and verified at various stages by numerous actors including vessel's own control system and shore-based operators. This allows examining qualitatively which causal category had the largest impact on accident's occurrence. We did not focus on the relationships between the causal categories and levels but instead we analysed their relevance to unmanned shipping.

Finally, we reviewed the accidents reports and identified their causal factors, in accordance with the two assumptions listed in section 2.2.1. The identified causal factors were then assigned to causal categories and based on that, relevance of each causal factor for hypothetical unmanned ship's accident likelihood was qualitatively assessed. Whenever there were contradictory findings, we assigned the final value based on direct cause's causal category. For inconclusive results, 'neutral' influence was assigned.

Fig. 3.: The overview of HFACS-MA framework applied here, adopted from [31]

Table 2: Brief description of HFACS-MA causal categories applied in this study, adopted from [31]

Level V: External factors

Legislation gaps The deficiencies of existing rules or codes that guide the maritime industry and relevant authorities [34]

Administration oversights The deficiencies of the governing authorities in implementing the existent rules or codes, or the negligence in performing their duties

Design flaws Poor system design, such as poor consideration on ergonomics and maintainability of the system/components [35]

Level IV: Organisational influences [36]

Resource management Encompasses the realm of corporate-level decision making regarding the allocation and maintenance of organisational assets (such as personnel, money, equipment and facilities)

Organisational climate The working atmosphere within the organisation which includes culture, policies and structure

Organisational process Refers to corporate decisions and rules that govern the everyday activities within the organisation. This includes the establishment/use of standard operational procedures and formal methods for maintaining oversight of the workforce

Level III: Unsafe Supervision

Inadequate supervision The factors that supervision fails to identify a hazard, recognise and control risk, provide guidance, training and/or oversight etc., resulting in human error or an unsafe situation

Planned inappropriate operation The factors that supervision fails to adequately assess the hazards associated with an operation and allow for unnecessary risk

Failure to correct known problem The factors that supervision fails to correct known deficiencies in documents, processes or procedures, or fails to correct inappropriate or unsafe actions of individuals create an unsafe situation

Supervisory violations The factors that supervision wilfully disregards instructions, guidance, rules or operating instructions whilst managing organisational assets create an unsafe situation

Level II: Preconditions [37]

Condition of operator(s) The conditions of an individual that have adverse influence to perform his/her job, i.e. mental and physiological status and mental/physical limitations of the practitioners

Software The non-physical part of the system including organisational policies, manuals, checklist layouts, charts, maps, advisories and computer programs

Hardware The physical part of the workplace. It includes the equipment of work stations, displays, controls and seats, etc.

Physical environment The factors of nature environment which can affect the actions of individuals result in human error or an unsafe situation

Technological environment The factors emphasise on the artificial environmental constructions, e.g. harbours, waterways and traffic control issues

Liveware The peripheral livewares refer to the system's human-human interactions including such factors as managements, supervision, crew interactions and communications

Level I: Unsafe acts

Skill-based errors Errors involve slips and lapse. Slips are an unintentional action where the failure involves attention whilst lapses are an unintentional action where the failure involves memory [37]

Rule-based mistakes Mistakes involve inappropriate matching of environmental signs to the situational component of well-tried troubleshooting rules [32]

Knowledge-based mistakes Mistakes happen when an individual has run out of applicable problem-solving routines and is forced to work 'on-line', using slow, sequential, laborious and resource limited conscious processing [32]

Routine violations Causal factors tend to be habitual by nature and often tolerated by governing authority [38]. They occur every day as people regularly modify or do not strictly comply with work procedures, often because of poorly designed or defined work practices [37]

Exceptional violations Causal factors tend to be a one-time breach of a work practice, such as safety regulations being deliberately ignored to carry out a task. Even so, the intention was not to commit a malevolent act but just to get the job done [37]

Indicates accident's likelihood greater for unmanned vessels in the applied framework

Indicates accident's likelihood lesser for unmanned vessels

Indicates neutral impact on the likelihood of the unmanned vessels' accident

2.2.1.2. Consequences of an accident

The analysis of accident's consequences was based on a simple check of the way in which the aftermath of maritime casualty impacted people. We assigned the value of 'consequences greater for unmanned ships' whenever at least one of the following outcome factors was identified in an accident report:

• crew had to directly intervene by either inspecting ship's enclosed spaces or manually reconfiguring its sub-systems;

• crew had to cooperate with other actors under pressure of time;

• crew was obligated to assist other seafarers should the vessel they collided with need to be abandoned;

• decisions on further actions could not be efficiently taken from remote command post;

• better maintenance of on board equipment before accident could have limited its outcome.

We assigned the value of 'consequences lesser for unmanned ships' whenever an accident report mentioned fatalities, serious injury or it was evident that humans' presence on board during an accident restricted number of possible options of counteracting the effects of accident (e.g. when a person was missing in muster station and so CO2 could not be released). Should the circumstances of 'greater' and 'lesser' outcome occur simultaneously, the value was assigned based on more detailed analysis regarding which of them would be more relevant, with potential for avoiding fatalities greatly lowering the hypothetical consequences.

Whenever neither 'greater' nor 'lesser' outcome factors could be identified, the event was considered neutral, meaning it is not expected to influence the future unmanned ship's accident's outcome.

2.2.2. Uncertainty assessment

Various issues related to uncertainty in analysing accident reports as well as the systems' performance itself along with risk and safety assessment of transportation systems and individual ships have been discussed in the literature, see for example [33,39-44]. Those include among others: subjectivity, hindsight bias and lack of knowledge of investigator or analyst, possible overlooking of key factors and linguistic problems. Moreover, the approach presented here contains another dimension of uncertainty, which relates to very limited background knowledge on the design of unmanned ships and their operation. These are based on the state of the art results as reported in [6,10,28].

Further uncertainty may be related to inadequate assignment of causal factors to causal categories in HFACS-MA method or wrong statement of what impact the particular causal category would have on unmanned ships' likelihood to be involved in an accident. Consequences check, in turn, may be inaccurate in some particularly complicated cases and may promote assigning unmanned ships' accidents with greater consequences. In the framework applied, accidents' outcome for unmanned ships can only be lowered if there were fatalities, serious injuries or crewmembers' presence restricted possible damage control options in a real event. Meanwhile, 'greater consequences' can be assigned more readily as outcome factors leading to such a conclusion are more complex and multiform. Knowing all the restraints associated with investigation reports' analysis, we estimate that approximately 30% of the results obtained can be assigned a low level of uncertainty, meaning that the causes of the accidents and their aftermaths are relatively easy to define based on the reports, the answers to what-if questions are straightforward, and the direction of the influence is unequivocal.

However, 10% of the results obtained in the course of this analysis can be labelled with high uncertainty, meaning that the accident reports are very complex - clear definition of the five stages of the accidents as depicted in Fig.2 is a problematic task and the what-if questions cannot be given unambiguous answers, thus making the direction of the influence vague, see for example [39,45]. This includes three cases in which investigators failed to reveal an actual cause of an accident and therefore based the assessment on circumstantial evidence. The remaining 60% of analysis' results can be characterized by medium level of analysis' uncertainty, which reflects the conditions between those characterizing low and high uncertainty.

Moreover, types of accidents analysed here do not closely reflect their share in global casualties' statistics (see Fig.4 & 5 respectively). This is attributed to the fact that some investigation reports are not available, have been prepared in local languages or do not meet requirements of this research - pertain to groundings during berthing or in narrow channels, for instance. As depicted in Fig.4, majority of accidents analysed here was navigation-related with groundings and collisions constituting 52% of the total amount while those constituted as much as 73% globally. The accidents consisting solely of cargo damage were not included in the investigation reports unless dangerous goods were involved. This is due to the fact that as long as cargo is not dangerous, the consequences of an accident are in most cases purely commercial and need not to be investigated by governmental institutions but rather by insurance companies. Loss of property sustained in such disasters can be, however, significant.

Damage to cargo 4%

Loss of stability 8%

Accidents by type as analysed

Loss of structural , ,

^Loss of buoyancy

integrity

Flooding 9%

Grounding 33%

Collision 19%

Fire, explosion 24%

Fig.4.: Breakdown by type of the accidents analysed here.

Accidents by type - global values

Flooding 6%

Loss of stability 2%

Loss of structural integrity 1%

Grounding 37%

Collision 36%

Fire, explosion 18%

Fig. 5.: Accidents by type, global values in years 2011-2013, [46]

2.2.3. Application of a framework to a case study

This section demonstrates the application of the safety assessment framework to an accident of fire on board of m/v "Charlotte Maersk that took place on 7th July 2010. At the time of the accident, "Charlotte Maersk' was en route from Port Klang, Malaysia to Salalah, Oman. She was a 9 years old container vessel, flying Danish flag and carrying various containerised cargoes. Three hours into the voyage, smoke was observed rising from a forward part of the ship. Fire alarm has been activated and crew engaged in firefighting. The fire has been considered under control not sooner than after 24 hours of joint efforts of crew, support ships and firefighting aeroplane. For the next 13 days, the vessel was manned by extra firefighters to prevent fire's re-occurrence as she was proceeding to her original port of destination. Damage sustained included heat deformation of the hull and loss of approximately 160 containers together with cargo inside them. One crewmember suffered respiratory problems from inhaling smoke. A certificate of commendation has been awarded by IMO to ship's crew for their acts of bravery during the firefighting operation.

An investigation report by Danish Maritime Accident Investigation Board concluded that the fire was most likely caused by explosion of methyl ethyl ketone peroxide (MEKP, IMO class 5.2, UN number 3105). This cargo was proved to have been stowed improperly, however in full compliance with regulations applicable at that time. Those were amended only after the incident. MEKP exploded after receiving excessive amount of heat from sunlight in the hot and humid climate of the Malaysian Peninsula. Since it did not require stowage in refrigerated containers at that time, neither the crew nor any other party had reasons to decline accepting it on board.

Immediately after the fire was detected, the ship was headed out of the shipping lane. Contingency planning was engaged aiming at minimalizing losses, particularly not allowing the fire to reach other containers filled with dangerous goods. The entire crew was involved in either rigging the fire hoses, directing water on the most vital spots, or assessing the fire spread and releasing carbon dioxide into the cargo holds directly below it. Firefighting continued for a couple of days, during which time some containers had to be opened to extinguish minor fires inside them.

The accident was analysed as follows. Firstly, it was divided into stages of prior to- and postaccident. Secondly, its causal factors were identified, namely improper but legally acceptable way of shipping MEPK in hot climate. Next, it was assessed whether the fact that ship was to be operated in remote or autonomous mode could have had some influence on likelihood of factors' leading to the accident occurrence by identifying HFACS-MA causal categories involved. Those were as follows: 'Planned Inappropriate Operation', and 'Legislation Gaps'. Neither of those was found to be particularly specific for unmanned vessels. All actions

leading to accepting the container for shipping and stowing it in its slot were in compliance with all existing regulations and good seamanship.

It must be noted that even if dangerous goods are to be legally banned from transportation by autonomous ships, they might still be carried without official reporting. Undeclared, containerised dangerous cargoes constitute a problem even nowadays and have been a contributory factor in several maritime accidents, see for example [47]. Therefore, safety issues related to it must be considered regardless of future regulations governing their carriage.

The next step was to determine the importance of the crew's actions in response to the accident and to analyse what would happen if the vessel was operating without crew on board - another instance of what-if analysis.

With reference to the check described in section 2.2.1.2. it was found that the crew had to assess the damage locally, enter enclosed spaces (containers) and re-arrange the fire system by rigging the fire hoses to spaces with indirect access. Coordination with shore services was also required. It was therefore concluded that the test was in favour of assigning the accident with greater consequences should the vessel be unmanned.

Finally, feasibility of designing an autonomous system which could act on reducing the likelihood or outcome of the accident without direct involvement of humans was examined as an additional consideration. In relation to accident's causes, no changes in ship's design or operation could prevent it except for the amendment of international laws or shipping company's procedures. As for the consequences, designing such a system would be a nontrivial task involving providing a vessel with complex firefighting system capable of providing boundary cooling of various spaces, means of inspecting enclosed spaces etc. Chain of events during "Charlotte Maersk" accident and its analysis are presented in Table 3.

Table 3: "Charlotte Maersk accident with safety analysis framework applied [19,30]

DEFINE THE ACTIVITY OF INTEREST

Fire on board m/v "Charlotte Maersk'

DEFINE THE PROBLEMS

Lack of crew on board

SUBDIVIDE THE ACTIVITY FOR ANALYSIS

Root causes

Direct causes

Situation assessment

Decision making

Damage control

GENERATE WHAT-IF QUESTIONS FOR EACH ELEMENT OF THE ACTIVITY

What causal categories are involved?

Could situation be properly assessed without crew on board?

Could the decisions be made remotely in an efficient way?

Could the fire be extinguished in remote control? How where the people involved? Where there fatalities?

RESPOND TO WHAT-IF QUESTIONS

Legislation Gaps, n/a With great difficulty Poor situational Nearly impossible, as

Planned and under awareness will lead to containers had to be enterec 1.

Inappropriate uncertainty poor decision making; ( Coordination with shore

Operation on the other hand, services was required.

shore operator will be Fortunately, there were no

under lesser stress if operating remotely major injuries

FURTHER SUBDIVIDE THE ELEMENTS OF THE ACTIVITY

n/a n/a Dependence on environmental sensors and reliable communication link n/a M /lanual operation impossible remote firefighting system would need to cover entire ship to function properly, however, there would be no risk for firefighters i i

USE THE RESULTS

Neutral Neutral Negative Negative Negative

Neutral impact on likelihood Negative impact on consequences

As can be deduced from the case study, analysis framework described in section 2.2.1. can be applied to estimate qualitatively the impact unmanning ships would have on accidents' likelihood and consequences and thus on the overall level of maritime safety. This is done in the following section. Uncertainties do exist, although they can be deemed manageable.

3. Results

This section presents the results of one hundred maritime accidents' analysis using the framework presented in earlier sections. The results are divided into the influence of unmanned ships on the likelihood and consequences of accidents. Breakdown of particular accidents' analysis results is given in Table A2 in the appendix.

3.1. The effect of unmanned ships on the likelihood of the accidents

The results of the qualitative analysis of the influence of unmanned system on accident's likelihood are presented in Fig.6. It was found that the cases in which likelihood would be lesser outnumber those with greater one about three times (47 to 16%). The former have been largely resulted from a human error. The cases in which likelihood of accident would be greater can be attributed to lack of bridge team's situational awareness or inadequate maintenance or supervision of mechanisms. The issues concerning those factors can be

found in the literature, see for example [29,48]. In the following subsections the impact of unmanned vessels on their likelihood is outlined for particular types of accidents.

3.1.1 Grounding

Introduction of unmanned ships might result in a significant decrease in the number of grounding events. In the accident reports analysed, twenty-four out of thirty-three grounding cases resulted from nautical officers being either distracted from their duties, following improper passage plan or other factors theoretically possible to eliminate by computerization [28]. The two cases of greater likelihood for unmanned vessels were a result of improper assessment of weather conditions and dragging anchor while drifting offshore might have been a better choice. The remaining seven neutral cases were mostly caused by the use of improper or out-dated charts - circumstances of particular events led to conclusion that it could happen to manned as well as unmanned vessels. Although seven groundings occurred under wind force of Beaufort 5 or more and two other during restricted visibility, it was found that only in one case would the weather conditions cause the likelihood of unmanned vessel's accident to increase.

3.1.2 Collision

The introduction of unmanned ships could enable avoiding sixteen of nineteen cases of collisions that were analysed. However, since many collisions occur due to bridge team's noncompliance with COLREG Rule 5: "Look-out", special attention must be paid to future system's capability of detecting another ship or navigational danger in due time and properly assessing the situation arising, along with appropriate action planning and execution. As per COLREG, detection by radar would not suffice and more means of observation shall be employed [49]. On the other hand, nine of the hereby-analysed collisions occurred during restricted visibility conditions where radar is now the only means of look-out. For the future solutions some other supporting means of object detection could be anticipated, such as infrared cameras.

The breakdown of the likelihood of accident with regard to phase of voyage for casualty types to which it was considered relevant - grounding and collision - is presented in Table 4. As can be seen, the vast majority of such accidents occurred in coastal waters, which is obvious for grounding incidents and natural for collisions as they generally happen in areas of increased traffic concentration near ports.

Table 4: Direction of change of the accident's likelihoods for unmanned vessel for grounding and collision in particular phases of voyage, compared to conventional ships

Changes in the likelihood of grounding Changes in the likelihood of collision

Type of accident Increased Decreased Neutral Increased Decreased Neutral

Pilotage - - - - - -

Coastal navigation 1 24 7 2 14 1

Ocean navigation - - - - 2 -

At anchor 1 - - - - -

3.1.3 Fire/explosion

Eleven out of twenty-four cases were mostly a result of cargo self-heating or similar factors. Six cases in which the likelihood would be lesser for unmanned ships were caused by crews themselves directly contributing to fire's occurrence by regrettable disregard to fire safety precautions and procedures. The remaining seven cases came as a result of technical failures due to insufficient maintenance, an issue to which unmanned ships may be particularly vulnerable.

3.1.4 Flooding

Three cases in which the probability would be greater for unmanned ship involved a vessel not being prepared for navigating in the ice or where maintenance of seawater pipelines was insufficient. On the contrary, one case related to crew not being familiar with ship's equipment, which would present lower likelihood in case of unmanned ship. Further five neutral cases happened mostly due to corroded pipelines or improper design of on board systems.

3.1.5 Loss of stability, structural integrity and buoyancy

For nine cases of those casualties combined, it would be irrelevant whether the ship were manned or not - those resulted from e.g. cargo liquefaction or improper stowage. Two cases in which the unmanned ships would be more likely to suffer from loss of stability involved their crews failing to control the vessel properly in a heavy weather conditions, which is an issue unmanned ships can also be vulnerable to. Even today, it is generally discouraged to use an autopilot in a heavy weather [50].

3.1.6 Damage to cargo

In all four cases analysed, no apparent relationship between manning and accident's likelihood could be found. Those were a result of adverse weather conditions or cargo stowed not as per good practice.

Likelihood of accident for unmanned vessel in compare to traditional one

35 30 25 20 15 10 5 0

^ ^ .¡f ^ # ^ c/ </ ^ ,

H Greater: increased likelihood □ Lesser: decreased likelihood M No influence

Fig.6.: Influence of unmanned system on accident's likelihood

It is worth mentioning that in many cases, the safety barriers should have been in place as required by SOLAS convention or company regulations but those have been overridden due to bad practice or design misconception, see [51]. For instance, in the majority of cases neither of the counter-measures against fatigued nautical officer (presence of look-out duty seaman, Bridge Navigational Watch Alarm System) fulfilled its role at the time it was designed and implemented to operate. This highlights the importance of applying a systemic approach to the design of unmanned ship and the operational environment she is anticipated to work within [52].

The results of the analysis suggest that the introduction of unmanned ships can reduce the likelihood of some types of accidents such as grounding or collisions. However, it must be noted that the system is expected to be assisted by a shore-based operator in particularly demanding situations. This operator would, when prompted, take over control of each of ship's subsystems in order to resolve the problem, which means that the possibility of human error is not eliminated, but rather transferred to a control centre some hundreds of miles away [53]. Therefore, the likelihood can easily be magnified by the operator's lack of situational awareness, inability to properly assess data provided by multiple sensors and insufficient perception of actual hydro-meteorological conditions along with their influence on ship's behaviour [54]. Some issues of data misinterpretation by unmanned vehicle's operators are well-known to military personnel involved in airborne drone operations [55], therefore such hazard needs to be anticipated at the planning stage of the unmanned ships operations.

3.2. The effect of unmanned ships on the consequences of the accidents

The results of applying safety analysis framework with respect to potential consequences of accidents involving unmanned ship are presented in Fig.7. In the course of the analysis it was evaluated how strongly the accident's outcome depended on crewmembers' presence on board in three phases of consequence mitigation, namely: situation assessment, decisionmaking and damage control, as depicted in Fig.2. On the other hand, we acknowledge that the greatest advantage of introducing unmanned vessels would be elimination of fatalities, since no crewmember would be exposed to hazards on board a ship in danger. In the following sections we discuss the factors influencing the extent of damage in each of the accidents' categories.

35 30 25 20 15 10 5 0

Consequences for unmanned vessel in compare

to traditional one

i1' ■ ■ ■■ i

vON xCT ^ ^ ^

^ ^ àF

^ ^ ^ V

H Greater: increased consequences □ Lesser: decreased consequences \S\ No influence

Fig.7.: Influence of unmanned system on accident's consequences

3.2.1 Grounding

In fourteen of thirty-three vessels running aground the capability of successful self re-floating remained after the grounding. Such an action is theoretically possible to be performed remotely, provided that proper depth assessment around the hull is performed along with i.e. visual check of hull's integrity and sounding the tanks. One case involved ingress of water through pipe tunnel manhole, which would normally be closed if the vessel were unmanned. In further eighteen cases, vessels required shore parties' assistance, which means that a full-scale operation involving the concerned vessel's crew was needed.

3.2.2 Fire/explosion

Sixteen of the twenty-four analysed cases would have resulted in greater damage to the ship and cargo due to fire. In original cases, the crew's actions included boundary cooling, fighting fires in spaces where CO2 release could not be used for various reasons and controlling residual fire after CO2 release. In three cases, the fire was so extensive that it would consume the vessel regardless of her operational mode. Five further cases in which lack of crew on board might be beneficial were those in which crewmembers perished or could not be accounted for in critical moments, which in turn led to delaying CO2 release.

3.2.3 Collision

In eleven of nineteen cases it would have been irrelevant if there were crews on board any of the ships as neither of those sustained great damage and both continued with passage after implementing standard contingency procedures. However, in eight cases the damage was significant or of such complicated nature that shore parties' assistance was required or one of the ships must have been evacuated and survivors picked up by another vessel. It should be noted that the latter case is of great importance and an issue of providing the unmanned ships with capability of picking up survivors must be considered. Furthermore, ensuring efficiency of global Search and Rescue system in a transition period when unmanned ships would coexist with manned ones must be addressed. Since not only cargo vessels carry people on board but also cruise ships, recreation yachts and fishing boats, that period will most likely never end.

3.2.4 Flooding

Six of nine cases would have involved greater damage than in fully manned operations. Those included necessity of rearranging the pipelines or crews discovering a problem when all the sensors failed to do so. Two cases with lesser consequences for unmanned ships consisted in crewmembers taking improper actions in response to accident due to for example stress. The remaining case was a result of an irreparable malfunction that could not be handled neither manually nor remotely.

3.2.5 Loss of stability, structural integrity and buoyancy

In five out of eleven cases of those casualties combined, the mode of vessel's operation would be irrelevant to the course of action. Those were mainly when the extent of damage was so great or the rapidity of events was such that nothing could have been done to minimize it. In

four further cases the consequences could be lesser for unmanned vessels as human lives would be spared.

3.2.6 Damage to cargo

Three cases of accidents involving dangerous cargo were of such nature that no action could have been undertaken due to cargoes' properties or type of damage. One further case was an incident when the crew was able to take corrective action only because an odour was detected.

4. Discussion

By applying safety analysis framework to a hundred maritime accidents, we were able to provide arguments in favour of a statement that unmanned vessels would perform better in reducing likelihood of accidents than mitigating its consequences - see Fig.8. Introducing autonomy and removing crews from vessels can result in a reduction of accidents' probability; especially in events in which humans' actions had a direct impact on its occurrence. That is the case particularly for navigation-related accidents like groundings or collisions involving crewmembers' lack of situational awareness, disregard for COLREG or negligence. Unmanned vessels might minimize chances of such occurrences provided that the system as a whole is properly designed and operated, and the systemic approach to safety is applied [52].

Due to the restriction of methods applied and the limitation in the background knowledge, we were not able to assess the role that crewmembers actually had in preventing accidents as we only considered accidents that did happen and were investigated. Unfortunately, potentially valuable data on events in which crew's actions prevented a near-miss from turning into disaster are not publicly available. Crew's actions in the immediate aftermath of an accident can be highly beneficial for restricting its consequences. Maritime accidents' chain of events as well as an outcome can vary strongly from one case to another - many of them include radical changes in system's layout or capabilities of survival. Only an experienced, well-trained and organised crew can use those features as assets and act accordingly with full situational awareness. Thus, when speaking of accidents' consequences - better results can be expected if humans are actually involved and behave proactively. Designers of unmanned vessels will need to address this issue by taking each and every effort to ensure proper level of resilience to their product, [56-59].

In ten cases, both likelihood and consequences of the accident would be greater if the vessel were operated without crew. Nine of them were fires or mechanical breakdowns and the

remaining one was of particularly complicated nature where two ships collided and one's crew had to abandon her. Should the other vessel be unmanned, her ability to pick up the survivors might be very limited.

It must be underlined, however, that the analysis has been performed basing on rather limited information regarding concepts of future unmanned ships and the ways they will be operated. This may have an effect of serious uncertainties affecting the result of future systems' performance. Since most scholars paid their attention to navigational aspects of unmanned shipping to date [1,6,28], unmanned ships' behaviour in the case of actual non-navigational accident remains terra incognita and demands further investigation. Nevertheless, the results of our analysis indicate that ensuring proper post-accidents behaviour of unmanned ships will be particularly vital to their overall safety.

For hundreds of years, the shipping industry relied on seafarers having served years at sea and gaining experience. Even today, period of one's service is considered to be one of the most important factors when investigating maritime accident and special attention is paid to Master's, chief engineer's and other relevant crewmembers' experience and certificates held. The more experienced the person is, the more likely he or she is to have a better understanding of his/her working environment and take proper actions in extraordinary circumstances. The introduction of unmanned vessels will most likely reduce this effect - even if maritime experts are gathered in a situation room ashore in order to control damage sustained by the vessel in some distant part of the world - they might not be capable of properly assessing the situation and by that they might be forced to make decisions based on incomplete data [29,54]. Lack of situational awareness attributes for approximately 71% of human errors [60]. One may be surrounded by numerous displays yet still be unable to make proper decisions due to information overflow, bad prioritization of tasks or lack of actual perception of the situation [52,61,62]. Only a skilled crew can experience such. Providing shore based operators with artificial situational awareness might be insufficient for planning and executing required actions in a safe and efficient manner [63]. Over-reliance on sensors indications may also be an important issue [64].

A study on safety of Unmanned Aerial Vehicles (UAVs) indicates that human factor remains one of the most common causes of accidents involving aerial drones [65]. Similar conclusions also come from experience with the operation of Autonomous Underwater Vehicles (AUVs) -[66] - indicating that human errors will exist in unmanned systems' operations at least as long as people are involved in either the design or the operations themselves, in other words: forever. Additionally the analysis performed here suggests that at least 60% of disasters have been caused by human errors on various stages of the ship's life ranging from design process through loading operation and sea passage. There is a great potential for improvement, which can involve unmanned ships, provided that they are properly designed and operated.

System's operators would not be able to take some actions requiring direct human interference. Therefore, the design of safety features for the whole unmanned vessel must be such that a single failure does propagate or at least that such propagation is delayed as it has been accomplished in multiple examples of class 2 and 3 dynamic positioning (DP) systems [67].

It would be extremely optimistic to assume that unmanned ships will avoid all potential threats thanks to their perfect design and performance. It is acknowledged that at some point a disaster might occur in some distant part of the world without any salvors being able to render assistance in proper time. It is therefore of the highest importance to design an unmanned ship in such a way that she would withstand a serious damage to her hull, machinery and control system. It may be also necessary for her to serve as a lifeboat for any survivors from other vessels she could potentially collide with. Examples taken from other modes of transportation in which unmanned systems had been successfully implemented, i.e. automotive, airborne, metropolitan subway or even subsea, prove that autonomous vehicles can be operated safely, provided that the system is properly designed, relevant hazards are properly anticipated and the lessons from the past are properly learned, [68-70]. To achieve this goal, it could be beneficial to adopt resilience engineering way of thinking when designing unmanned ships and their operational patterns, see for example [56-59,71].

Likelihood and consequences of unmanned ship's accidents compared with conventional one

100 80

60 40 20 I ^Greater I □ Lesser ■..■.■ UNo influence

i i Likelihood Consequences

Fig.8.: Anticipated changes in the likelihood and consequences of an accident involving an unmanned ship compared to a conventional vessel

5. Conclusions

This paper presents qualitative analysis of 100 maritime accident reports. The aim of the research was to assess whether the introduction of unmanned ships would change the occurrence rate of accidents as well as their consequences. The analysis was limited to safety hazards - all the intentional actions aiming to compromise ship's security (piracy, terrorism, etc.) are not accounted for. For that reasons the presented analysis is by no means complete. Moreover, the limited amount of available information about the system where the unmanned ships are anticipated to operate does not allow for any detailed nor quantitative results. Another issue affecting results' credibility is the fact that no method of evaluating unmanned vessels' safety exists to date and framework applied here, which is sound for manned ships, might be inaccurate or incomplete for the unmanned vessels. Therefore, the research results should be rather seen as first insight into the problem and an introduction to further discussion.

The obtained results supported by the available literature indicate that the introduction of unmanned vessels will be very challenging from the safety point of view. The results show on one hand that the damage assessment and control is likely to be one of the biggest difficulties in achieving unmanned vessels' safety. Separating humans from all the dangers associated with working at sea will be opposed by a disturbing thought that there will be nobody on the scene of the accident to counteract the damage immediately. Preventing accidents from occurring appears therefore to be a better idea than counteracting its consequences. Actions aiming at reducing the occurrence of accidents must be implemented at early stages of system's design and combined with well-prepared operational procedures. On the other hand, however, implementation of unmanned ships might reduce the number of navigation-related accidents like collisions or groundings.

The reduction of risks to human life is one of the industry's top priorities. Apart from major economic benefits of eliminating crewing costs, the greatest advantage of implementing unmanned ships would be the lesser likelihood of seafarers perishing at sea. It can be seen when investigating potential consequences of fire, flooding and loss of stability accidents. Even though the vessel eventually founders, no human is harmed for nobody was on board in a first place. However, the potential consequences of maritime disaster can be massive and may include damage not only to the vessel itself, but also to her cargo, environment, infrastructure and people that happen to be nearby even unintentionally - their safety must be ensured as well. On the other hand, immediate post-accident actions are vital to reducing the spread of consequences. It is commonly very difficult for even experienced Masters and crews to properly assess the damage and take proper actions to counteract its propagation. Those

actions may include visual assessment of confined spaces, manual rearrangement of the

system's components, boundary cooling or manual start of machinery.

Nevertheless, the introduction of the unmanned merchant vessels to the global shipping

industry appears to be only a matter of time, despite all social, legal and technological

concerns.

To obtain a complete picture of unmanned vessels' safety, the actual operational conditions of those ships shall be known. This in turn must be supported by knowledge of their design and manner in which they respond to accidents. On top of that, all anticipated hazards must be listed and their effect evaluated. Only then the level of safety associated with the unmanned ships operations could be assessed. The piece of study presented in this paper is just a first step in this long process.

Acknowledgments

The authors appreciate the financial contributions from Finnish Funding Agency for Technology Innovation (TEKES), since this research was co-funded by the Advanced Autonomous Waterborne Application Initiative (AAWA) project (project number 5166/31/2014; duration 01.01.2015-30.06.2017). The views expressed remain solely those of the authors.

The authors are grateful to three anonymous reviewers, whose comments and suggestions helped us to improve the earlier version of the manuscript.

Authors also wish to express their gratitude to Ms. Anna Szczepanik and Mr. Owen Jones for their help with improving language of this paper.

References

[1] Bertram V. Autonomous ship technology - smart for sure, unmanned maybe. Smart Sh. Technol., London: 2016, p. 5-12.

[2] Bertram V. Unmanned Surface Vehicles - A Survey. Ski Selsk 2008:1 -14.

[3] Bundeswehr. Hohlstablenkboot „Ensdorf"-Klasse 2016. http://www.marine.de/portal/a/marine (accessed May 13, 2016).

[4] Kretschmann L, Rodseth 0J, Tjora A, Fuller BS, Noble H, Horahan J. Maritime Unmanned Navigation through Intelligence in Networks - Qualitative assessment. 2015.

[5] Rolls-Royce. Rolls-Royce reveals future shore control centre 2016. http://www.roHs-royce.com/media/press-releases/yr-2016/pr-2016-03-22-rr-reveals-future-shore-control-centre.aspx (accessed May 13, 2016).

[6] Rodseth 0J, Burmeister H-C. Risk Assessment for an Unmanned Merchant Ship. TransNav, Int J Mar Navig Saf Sea Transp 2015;9:357-64.

doi:10.12716/1001.09.03.08.

[7] Laurinen M. Advanced Autonomous Waterborne Applications Initiative AAWA. Helsinki: 2016.

[8] Levander O. Ship intelligence - a new era in shipping. Smart Sh. Technol., London: RINA; 2016, p. 25-32.

[9] Haun E. China Completes Unmanned Ships R&D Project 2015. http://www.marinelink.com/news/completes-unmanned396151.aspx (accessed April 29, 2016).

[10] Burmeister H-C, Bruhn W, Rodseth 0J, Porathe T. Autonomous Unmanned Merchant Vessel and its Contribution towards the e-Navigation Implementation: The MUNIN

Perspectives Int J E-Navigation Marit Econ 2014;1:1-13. doi:10.1016/j.enavi.2014.12.002.

11] Kretschmann L, Mcdowell H, Rodseth 0J, Fuller BS, Noble H, Horahan J. Maritime Unmanned Navigation through Intelligence in Networks - Quantitative assessment.

12] LR. Cyber-enabled ships ShipRight procedure - autonomous ships. Southampton:

13] Hooydonk E Van. The law of unmanned merchant shipping - an exploration. J Int Marit Law 2014;20:403-23.

14] Dobryakova L, Lemieszewski L, Ochin E. The vulnerability of unmanned vehicles to terrorist attacks such as GNSS-spoofing. Mar. Traffic Eng. Int. Symp. Inf. Ships, Kotobrzeg: 2015, p. 100-11.

15] Theunissen E. Navigation of unmanned vessels - history, enablers, challenges and potential solutions. 12th Int. Nav. Eng. Conf. Exhib., Amsterdam: 2014.

16] Van Den Boogaard M, Feys A, Overbeek M, Le Poole J, Hekkenberg R. Control concepts for navigation of autonomous ships in ports. 10th Symp. high-performance Mar. Veh., Cortona: 2016.

17] Australia Transport Safety Bureau. Maritime Accident Investigation Reports n.d. http://https//www.atsb.gov.au/ (accessed March 25, 2016).

18] Accident Investigation Board Norway. Maritime Accident Investigation Reports n.d. http://www.aibn.no/ (accessed March 25, 2016).

19] Danish Maritime Authority - Division for Investigation of Maritime Accidents. Maritime Accident Investigation Reports n.d. http://http//www.dma.dk/ (accessed March 30, 2016).

20] European Maritime Safety Agency. Maritime Accident Investigation Reports n.d. http://emsa.europa.eu/ (accessed April 12, 2016).

21] Isle of Man Ship Registry. Maritime Accident Investigation Reports n.d. https://www.gov.im/ded/shipregistry/ (accessed March 29, 2016).

22] Japan Transport Safety Board. Maritime Accident Investigation Reports n.d. http://www.mlit.go.jp/ (accessed April 1, 2016).

23] Marine Accident Investigation Branch. Maritime Accident Investigation Reports n.d. http://www.gov.uk/ (accessed March 20, 2016).

24] Bundesstelle für Seeunfalluntersuchung. Maritime Accident Investigation Reports n.d. http://http//www.bsu-bund.de/ (accessed April 5, 2016).

25] The Bahamas Maritime Authority. Maritime Accident Investigation Reports n.d. http://www.bahamasmaritime.com/ (accessed March 25, 2016).

26] The Government of Hong Kong Special Administrative Region - Marine Accident Investigation Section. Maritime Accident Investigation Reports n.d. http://http//www.mardep.gov.hk/ (accessed April 5, 2016).

27] Transportation Safety Board of Canada. Maritime Accident Investigation Reports n.d. http://www.tsb.gc.ca/ (accessed April 6, 2016).

28] Burmeister H-C, Bruhn WC, Rodseth 0J, Porathe T. Can unmanned ships improve navigational safety ? Proc. Transp. Res. Arena, Paris: 2014.

29] Porathe T, Prison J, Man Y. Situation awareness in remote control centres for unmanned ships. Hum. Factors Sh. Des. Oper., London: 2014, p. 1-9.

30] ABS Consulting. Marine Safety: Tools for Risk-Based Decision Making. Rowman & Littlefield; 2002.

31] Chen S, Wall A, Davies P, Yang Z, Wang J, Chou Y. A Human and Organisational Factors (HOFs) analysis method for marine casualties using HFACS-Maritime Accidents (HFACS-MA). Saf Sci 2013;60:105-14. doi:10.1016/j.ssci.2013.06.009.

32] Reason J. The Contribution of Latent Human Failures to the Breakdown of Complex Systems. Philos Trans R Soc London B Biol Sci 1990;327:475-84.

33] Mazaheri A, Montewka J, Nisula J, Kujala P. Usability of accident and incident reports for evidence-based risk modeling - A case study on ship grounding reports. Saf Sci 2015;76:202-14. doi:10.1016/j.ssci.2015.02.019.

[34] Reinach S, Viale A. Application of a human error framework to conduct train accident/incident investigations. Accid Anal Prev 2006;38:396-406.

[35] Celik M, Er ID. Identifying the Potential Roles of Design-based Failures on Human Errors in Shipboard Operations. TransNav, Int J Mar Navig Saf Sea Transp 2007;1:339-43.

[36] Scarborough A, Bailey L, Pounds J. Examining ATC operational errors using the human factors analysis and classification system. Washington, DC: 2005.

[37] IMO. Resolution A.884(21): Amendments to the Code for the Investigation of Marine Casualties and Incidents (A.849(20)). London: 1999.

[38] Shappell S, Douglas AW. A human error approach to aviation accident analysis: The human factors analysis and classification system. Ashgate Publishing, Ltd; 2012.

[39] Montewka J, Goerlandt F, Kujala P. On a systematic perspective on risk for Formal Safety Assessment (FSA). Reliab Eng Syst Saf 2014;127:77-85. doi:10.1016/j.ress.2014.03.009.

[40] Sabetzadeh M, Falessi D, Briand L, Di Alesio S. A goal-based approach for qualification of new technologies: Foundations, tool support, and industrial validation. Reliab Eng Syst Saf 2013;119:52-66. doi:10.1016/j.ress.2013.05.005.

[41] Stoop J, Dekker S. Are safety investigations pro-active? Saf Sci 2012;50:1422-30. doi:10.1016/j.ssci.2011.03.004.

[42] Goerlandt F, Reniers G. On the assessment of uncertainty in risk diagrams. Saf Sci 2016;84:67-77. doi:10.1016/j.ssci.2015.12.001.

[43] Goerlandt F, Khakzad N, Reniers G. Validity and validation of safety-related quantitative risk analysis: A review. Saf Sci 2016. doi:10.1016/j.ssci.2016.08.023.

[44] Nordstrom J, Goerlandt F, Sarsama J, Leppanen P, Nissila M, Ruponen P, et al. Vessel TRIAGE: A method for assessing and communicating the safety status of vessels in maritime distress situations. Saf Sci 2016;85:117-29. doi:10.1016/j.ssci.2016.01.003.

[45] Flage R, Aven T. Expressing and communicating uncertainty in relation to quantitative risk analysis. Reliab Risk Anal Theory Appl 2009;2:9-18.

[46] EMSA. Annual Overview of Marine Casualties and Incidents 2014. Lisbon: 2015.

[47] Ellis J. Undeclared dangerous goods - risk implications for maritime transport. WMU J Marit Aff 2010;9:5-27.

[48] Rodseth H, Brage M. Maintenance Management for Unmanned Shipping. In: Volker B, editor. 13 th Conf. Comput. IT Appl. Marit. Ind. COMPIT '14, Redworth: 2014, p. 27790.

[49] Bruhn WC, Burmeister H, Long MT, Morbus JA. Conducting look-out on an unmanned vessel: Introduction to the advanced sensor module for MUNIN's autonomous dry bulk carrier. Integr. Ship's Inf. Syst., 2014.

[50] Walther L, Burmeister H-C, Bruhn W. Safe and Efficient Autonomous Navigation with Regards to Weather. In: Bertram V, editor. Comput. IT Appl. Marit. Ind., Hamburg: 2014, p. 303-17.

[51] Basnyat S, Chozos N, Palanque P. Multidisciplinary perspective on accident investigation. Reliab Eng Syst Saf 2006;91:1502-20. doi:10.1016/j.ress.2006.01.014.

[52] Leveson NG. Engineering a Safer World - Systems Thinking Applied to Safety. Cambridge, MA: MIT Press; 2011.

[53] Ahvenjarvi S. The Human Element and Autonomous Ships. TransNav, Int J Mar Navig Saf Sea Transp 2016;10:517-21. doi:10.12716/1001.10.03.18.

[54] Man Y, Lundh M, Porathe T. Seeking Harmony in Shore-based Unmanned Ship Handling-From the Perspective of Human Factors, What Is the Difference We Need to Focus on from Being Onboard to Onshore? Adv Hum Asp Transp Part I 2014;7:231.

[55] USFOR-A. Investigation report relating to the 21 February 2010 civilian casualty incident in Uruzgan Province. Kabul: 2010.

[56] Hollnagel E, Woods DD, Leveson N. Resilience engineering: concepts and precepts. Ashgate; 2006.

[57] Stroeve SH, Everdij MHC. Agent-based modelling and mental simulation for resilience engineering in air transport. Saf Sci 2017;93:29-49. doi:10.1016/j.ssci.2016.11.003.

[58] Tran HT, Balchanos M, Domergant JC, Mavris DN. A framework for the quantitative assessment of performance-based system resilience. Reliab Eng Syst Saf 2017;158:73-84. doi:10.1016/j.ress.2016.10.014.

[59] Nan C, Sansavini G. A quantitative method for assessing resilience of interdependent infrastructures. Reliab Eng Syst Saf 2017;157:35-53. doi:10.1016/j.ress.2016.08.013.

[60] Grech M, Horberry T, Smith A. Human error in maritime operations: analyses of accident reports using the Leximancer tool. Proc. Hum. factors Ergon. Soc. Annu. Meet., vol. 46, 2002, p. 1718-21. doi:10.1017/CBO9781107415324.004.

[61] Man Y, Lundh M, Porathe T, Mackinnon S. From desk to field - Human factor issues in remote monitoring and controlling of autonomous unmanned vessels. Procedia Manuf 2015;3:2674-81. doi:10.1016/j.promfg.2015.07.635.

[62] Wahlström M, Hakulinen J, Karvonen H, Lindborg I. Human Factors Challenges in Unmanned Ship Operations - Insights from Other Domains. Procedia Manuf., vol. 3, Elsevier B.V.; 2015, p. 1038-45. doi:10.1016/j.promfg.2015.07.167.

[63] Manning SD, Rash CE, LeDuc PA, Noback RK, McKeon J. The Role of Human Causal Factors in U.S. Army Unmanned Aerial Vehicle Accidents. 2004. doi:USAARL Report No. 2004-11.

[64] Allianz Global Corporate &Speciality. Safety and Shipping Review 2015. Munich, Germany: 2015.

[65] Degarmo MT. Issues Concerning Integration of Unmanned Aerial Vehicles in Civil Airspace. 2004.

[66] Stokey R, Austin T, Alt C Von, Purcell M, Goldsborough R, Forrester N, et al. AUV Bloopers or Why Murphy Must have been an Optimist: A Practical Look at Achieving Mission Level Reliability in an Autonomous Underwater Vehicle. 11th Int Symp Unmanned, Untethered, Submers Technol (UUST '99) 1999:32-40.

[67] Cydejko J, Puchalski J, Rutkowski G. Statki i technologie off-shore w zarysie. Gdynia: Trademar; 2011.

[68] Sivak M, Schoettle B. Road safety with self-driving vehicles: general limitations and road sharing with conventional vehicles. Ann Arbor: 2015.

[69] Howard D, Dai D. Public Perceptions of Self-driving Cars: The Case of Berkeley, California. Transp. Res. Board 93rd Annu. Meet., vol. 14, 2014, p. 21.

[70] Benjamin A, Dezfuli H, Everett C. Developing probabilistic safety performance margins for unknown and underappreciated risks. Reliab Eng Syst Saf 2016;145:329-40. doi:10.1016/j.ress.2015.07.021.

[71] Thieme CA, Utne IB. Safety performance monitoring of autonomous marine systems. Reliab Eng Syst Saf 2017;159:264-75. doi:10.1016/j.ress.2016.11.024.

Appendices

Table A1 List of accidents analysed

Ship 1 Ship 2 Date Type of accident Source of data

1 Punjab Senator 28.05.2005 Explosion, fire (European Maritime Safety Agency)

2 Roseburg 05.11.2013 Loss of stability (Bundesstelle für Seeunfalluntersuchung)

3 MSC Flaminia 14.07.2012 Explosion, fire (Bundesstelle für Seeunfalluntersuchung)

4 Marti Princess Renate Schulte 27.06.2009 Collision (Bundesstelle für Seeunfalluntersuchung)

5 S. Gabriel 21.11.2009 Grounding (Bundesstelle für Seeunfalluntersuchung)

6 Beluga Revolution 30.04.2010 Grounding (Bundesstelle für Seeunfalluntersuchung)

7 Cleantec Frisia Rotterdam 13.12.2010 Collision (Bundesstelle für Seeunfalluntersuchung)

CMV Jula S Zenith Winner 24.07.2010 Collision (Bundesstelle für Seeunfalluntersuchung)

Ville d'Orion Top Glory 23.01.2003 Collision (Bundesstelle für Seeunfalluntersuchung)

MSC Ilona Hyundai Advance 07.12.2004 Collision (Bundesstelle für Seeunfalluntersuchung)

CMS Dona 20.10.2005 Grounding (Bundesstelle für Seeunfalluntersuchung)

Ladoga-3 16.07.2007 Grounding (Bundesstelle für Seeunfalluntersuchung)

Rithi Bhum Eastern Challenger 14.11.2004 Collision (Bundesstelle für Seeunfalluntersuchung)

Pacific Challenger 09.04.2008 Grounding (Bundesstelle für Seeunfalluntersuchung)

LT Cortesia 02.01.2008 Grounding (Bundesstelle für Seeunfalluntersuchung)

Lykes Voyager Washington Senator 08.04.2005 Collision (Bundesstelle für Seeunfalluntersuchung)

Hanjin Gothenburg Chang Tong 15.08.2007 Collision (Bundesstelle für Seeunfalluntersuchung)

Sunrise Orient 21.02.2014 Loss of stability (The Government of Hong Kong)

Eastern Amber 04.03.2015 Grounding (The Government of Hong Kong)

An Tai Jiang 09.01.2009 Fire (The Government of Hong Kong)

Kum Song 8 20.11.2012 Fire (The Government of Hong Kong)

Trans Summer 14.08.2013 Loss of stability (The Government of Hong Kong)

Eternal Bright 19.04.2010 Fire (The Government of Hong Kong)

Zhong Fu Fa Zhan 08.05.2011 Grounding (The Government of Hong Kong)

New Lucky VII 02.04.2012 Loss of stability (The Government of Hong Kong)

Hui Long 20.05.2005 Loss of stability (The Government of Hong Kong)

Jokulfell 07.02.2005 Loss of stability (Isle of Man Ship Registry)

Finnoyglimt 07.10.2011 Loss of buoyancy (Accident Investigation Board Norway)

Hoegh Osaka 03.01.2015 Loss of stability (Mar ne Accident Investigat on Branch)

Dieppe Seaways 01.05.2014 Fire (Mar ne Accident Investigat on Branch)

Lysblink Seaways 18.02.2015 Grounding (Mar ne Accident Investigat on Branch)

K-Wave 15.02.2011 Grounding (Mar ne Accident Investigat on Branch)

Cosco Hong Kong Zhe Ling Yu Yun 135 06.03.2011 Collision (Mar ne Accident Investigat on Branch)

Karin Schepers 03.08.2011 Grounding (Mar ne Accident Investigat on Branch)

Swanland 27.11.2011 Structural failure (Mar ne Accident Investigat ion Branch)

Sonia 01.09.1999 Flooding (Mar ne Accident Investigat on Branch)

Rema 25.04.1998 Flooding (Mar ne Accident Investigat on Branch)

Green Lily 19.11.1997 Flooding (Mar ne Accident Investigat on Branch)

Toisa Gryphon 02.02.1999 Fire (Mar ne Accident Investigat on Branch)

Irving Forest 11.01.1990 Flooding (Mar ne Accident Investigat on Branch)

Dutch Navigator 25.04.2001 Cargo damage (Mar ne Accident Investigat on Branch)

Cepheus J Ileksa 22.11.2004 Collision (Mar ne Accident Investigat on Branch)

Kodima 31.01.2002 Grounding (Mar ne Accident Investigat on Branch)

Hyundai Dominion Sky Hope 21.06.2004 Collision (Mar ne Accident Investigat on Branch)

Berit 05.01.2006 Grounding (Mar ne Accident Investigat on Branch)

CP Valour 09.12.2005 Grounding (Mar ne Accident Investigat on Branch)

P&O Nedlloyd Genoa 27.01.2006 Damage to cargo (Mar ne Accident Investigat on Branch)

Maersk Doha 02.10.2006 Fire (Mar ne Accident Investigat on Branch)

Thunder 10.08.2006 Grounding (Mar ne Accident Investigat on Branch)

Maersk Kendal 16.09.2009 Grounding (Mar ne Accident Investigat on Branch)

CFL Performer 12.05.2008 Grounding (Mar ne Accident Investigat on Branch)

Riverdance 31.01.2008 Grounding (Mar ne Accident Investigat ion Branch)

MSC Napoli 18.01.2007 Flooding (Mar ne Accident Investigat on Branch)

ACX Hibiscus Hyundai Discovery 11.12.2011 Collision (Mar ne Accident Investigat on Branch)

Sea Breeze 09.03.2014 Flooding (Mar ne Accident Investigat on Branch)

Multitank Ascania 19.03.1999 Fire (Mar ne Accident Investigat on Branch)

57 Annabella 25.02.2007 Damage to cargo (Marine Accident Investigation Branch)

58 Navigator Scorpio 03.01.2014 Grounding (Marine Accident Investigation Branch)

59 Ovit 18.09.2013 Grounding (Marine Accident Investigation Branch)

60 Beaumont 12.12.2012 Grounding (Marine Accident Investigation Branch)

61 Pentland 07.12.1998 Grounding (Marine Accident Investigation Branch)

62 Eastfern Kinsale 25.09.2000 Collision (Marine Accident Investigation Branch)

63 Douwent 26.02.2013 Grounding (Marine Accident Investigation Branch)

64 Spring Bok Gas Arctic 24.03.2012 Collision (Marine Accident Investigation Branch)

65 Seagate Timor Stream 10.03.2012 Collision (Marine Accident Investigation Branch)

66 Coastal Isle 02.07.2012 Grounding (Marine Accident Investigation Branch)

67 Danio 16.03.2013 Grounding (Marine Accident Investigation Branch)

68 CMA CGM Florida Chou Shan 19.03.2013 Collision (Marine Accident Investigation Branch)

69 Paula C Darya Gayatri 11.12.2013 Collision (Marine Accident Investigation Branch)

70 John I 14.03.2014 Flooding (Transportation Safety Board of Canada)

71 AlgoCanada 24.07.2009 Explosion, fire (Transportation Safety Board of Canada)

72 Kometik 08.04.2006 Explosion, fire (Transportation Safety Board of Canada)

73 Kitano 22.03.2001 Fire (Transportation Safety Board of Canada)

74 Lake Carling 19.03.2002 Flooding (Transportation Safety Board of Canada)

75 Thebaud Sea 03.02.2001 Fire (Transportation Safety Board of Canada)

76 Caroline Maersk 26.08.2015 Fire (Danish Maritime Authority)

77 Parida 07.10.2014 Fire (Danish Maritime Authority)

78 Urd 04.03.2014 Fire (Danish Maritime Authority)

79 Britannia Seaways 16.11.2013 Fire (Danish Maritime Authority)

80 Eugen Maersk 18.06.2013 Fire (Danish Maritime Authority)

81 Munsu 13.05.2005 Grounding (Danish Maritime Authority)

82 Rosethorn 02.02.2008 Grounding (Danish Maritime Authority)

83 MCL Trader 17.05.2008 Grounding (Danish Maritime Authority)

84 MSC Patricia 30.03.2006 Grounding (Danish Maritime Authority)

85 Sea Venture II 21.01.2005 Grounding (Danish Maritime Authority)

86 Baltic Carrier Tern 29.03.2001 Collision (Danish Maritime Authority)

87 Charlotte Maersk 07.07.2010 Fire (Danish Maritime Authority)

88 Ziemia todzka Vertigo 07.12.2005 Collision (Danish Maritime Authority)

89 Vega Sagittarius 16.08.2012 Grounding (Danish Maritime Authority)

90 Laurentian 11.11.2001 Fire (The Bahamas Maritime Authority)

91 Karen Danielsen 03.03.2005 Grounding (The Bahamas Maritime Authority)

92 Nariva 14.08.2001 Fire (The Bahamas Maritime Authority)

93 MOL Comfort 17.06.2013 Structural failure (The Bahamas Maritime Authority)

94 Bulk Jupiter 02.01.2015 Loss of stability (The Bahamas Maritime Authority)

95 Tai Shan 02.07.2014 Fire (The Bahamas Maritime Authority)

96 Ficus 27.02.2008 Grounding (The Bahamas Maritime Authority)

97 Setsuyo Star 09.06.2006 Flooding (The Bahamas Maritime Authority)

98 Pyxis 14.10.2008 Fire (Japan Transport Safety Board)

99 MSC Lugano 31.03.2008 Fire (Australia Transport Safety Bureau)

100 Kota Pahlawan 16.06.2006 Damage to cargo (Australia Transport Safety Bureau)

Table A2 Results of safety assessment

Indicates likelihood/consequences greater for unmanned vessels Indicates likelihood/consequences lesser for unmanned vessels Indicates neutral impact on unmanned vessels' safety

Numbers in left-most column refer to specific accident, as listed in Table A1

HFACS-MA causal categories

# Legislation gaps Administration oversights Design flaws Resource management Organisational climate Organisational process Inadequate supervision Planned inadequate operation Failure to correct known problem Supervisory violations Condition of operator(s) Software Hardware Physical environment Technological environment Liveware Skill-based errors Rule-based mistakes Knowledge-based mistakes Routine violations Exceptional violations RESULTING LIKELIHOOD

Outcome factors RESULTING CONSEQUENCES

Direct intervention required Cooperation under time pressure Assistance to other seafarers Inability to make decisions remotely Better maintenance prior to accident Fatality or serious injury Delay

56 riT| aTJI

Total CN T— T— CN O CN 00 00 T— O t— O OJ CO T— 00 CO o T— T— CN O T— T— CN CO CN CD T— lO OJ CO t—

00 CN CO CN CN CO lO t— If)

Highlights

Framework assessing effect of unmanned ships on the safety of navigation is presented HFACS-MA and what-if analysis are applied over 100 maritime accident reports Only known safety hazards are anticipated, leaving out of the scope security issues The qualitative assessment is conducted along with the uncertainty evaluation