357
1 INTRODUCTION
TheMUNINproject
1
isdevelopingaconceptforan
unmanneddrybulkshipofaround50000tonsdead
weight. The starting point is a conventional bulker
with a single engine and propeller and otherwise
normalon‐boardequipment.Topreparethisshipfor
unmanned operation, the concept proposes new
sensor systems, new technical operation and
maintenance procedures, aut
onomous navigation
functions, a new shore control centre and other
componentsasdescribedinBurmeisteretal.(2014b).
1
TheMUNIN(Maritimeunmannedshipsthroughintelli‐
genceinnetworks)projecthasreceivedfundingunderthe
EuropeanUnion’s7thFrameworkProgrammethroughthe
agreementSCP2‐GA‐2012‐314286.Seewww.unmanned‐
ship.org.
Astheprojectisaconceptstudy,noactualtrials
will take place. However, to show the feasibility of
the concept, it has been important to identify the
most critical technological, operational and
legislative factors that may be obstacles to the
conceptʹs realization and to demonstrate that these
factorscanbema
nagedsufficientlywelltomakethe
realization of the MUNIN ship likely. Furthermore,
theprocessofidentifyingandanalysingthesefactors
hastobedoneinastructuredwaysothattheprocess
and results can be documented and to substantiate
theclaimthat all significant factors have been dealt
with.
Toachievethese goals, the projecthas startedto
developarisk‐ba
sedmethodfordesignandanalysis
of “industrial autonomous systems”. An industrial
autonomous system is defined as an autonomous
vehicle that can operate safely and effectively in a
real world environment while doing operations of
Risk Assessment for an Unmanned Merchant Ship
Ø.J.Rødseth
NorskMarintekniskForskningsinstituttAS(MARINTEK),Trondheim,Norway
H.‐C.Burmeister
FraunhoferCentreforMaritimeLogistics(CML),Hamburg,Germany
ABSTRACT: The MUNIN project is doing a feasibility study on an unmanned bulk carrier on an
intercontinental voyage. To develop the technical and operational concepts, MUNIN has used a risk‐based
designmethod,basedontheFormalSafetyAnalysismethodwhichisalsorecommendedbytheInternational
Mari‐ti
meOrganization.Scenario analysis has beenusedtoidentifyrisks andto simplify operational scope.
Systematic hazard identification has been used to find criticalsafety andsecurity risks and how to address
these. Technology and operational concept testing is using a hypothesis‐based test method, where the
hypotheseshavebeencreatedasaresultoftheriskassessment.Finally,thecost‐benefitassessmentwillalso
use results from the risk assessment. This pa
per describes the risk assessment method, some of the most
important results and also describes how the results havebeen or will be used in the different pa
rts of the
project.
http://www.transnav.eu
the International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 9
Number 3
September 2015
DOI:10.12716/1001.09.03.08
358
direct commercial value and which can be
manufactured, maintained, deployed, operated and
retrieved at an acceptable cost. The corresponding
definitionofautonomyisanautomatedsystem that
has the capability of making independent sensor
baseddecisionsbeyondordinaryclosedloopcontrol.
This paper presents some of the results of using
thenewdesignandanalysismethodintheMUNIN
projectaswellassomeofthe experiences thathave
beengainedthroughthisprocess.
Chapter 2 gives an overview of some published
workonriskbaseddesignforautonomousvehicles.
Chapter3givesabriefoverviewofthedevelopment
method
and following chapters discuss the main
partsofthemethod:Scenariodevelopments(Ch. 4),
system modularization and operational issues (Ch.
5), hazard identification and risk control (Ch. 6),
hypothesis formulation and tests (Ch. 7) as well as
design verification (Ch. 8). A few comments on the
coming cost‐benefit analysis can
be found in
chapter9. This paper concludes with chapter 10,
summarizing the conclusions and experiencesmade
sofarintheproject.
2 AUTONOMYANDRISKBASEDDESIGN
An industrial autonomous system must be a cost
effective solution for the intended tasks. “The first
question any potential customer is going
to ask is:
Can the [vehicle] do the job, and if so, at a lower
cost?” (Stokey et al. 1999). This certainly applies to
industrial autonomous systems, but even for
scientific missions this becomes more and more an
issue.Whilesciencemaybemorelaxrelativetocost‐
effectiveness than commercial
industry, they may
stillhavetopayfore.g.insuranceorreplacementof
lostvehicles(Griffithsetal.2007).However,thisis
not often a subject of scientific dissertation and
papersonrisk‐baseddesigncriteriaforautonomous
vehiclesarestillrelativelyrare.
Somepapersarepublished,mostlyinthe
domain
ofautonomousunderwatervehicles(AUV).Onewas
referenced above (Stokey et al. 1999) and it is an
interesting account of what can go wrong with an
AUV. The details are not of general interest in the
MUNIN scope as application area and operation
paradigms are quite different. However, some
general
observationscanbemade:
1 Human error is the most common source of
problems. This also includes problems with the
softwaredesigninthecontrolstations.
2 Non‐complex hardware errors, such as
connectors,batteryandcalibrationofsensorsand
algorithms,arealsoamajorcauseofproblems.
Thereis
noreasontobelievethatthispatternwill
be much different for other types of vehicles so it
confirms the idea that a risk‐based design process
maybeagoodchoice,but also emphasizes thatthe
riskanalysishastofocusasmuchonʺtrivialʺhazards
as on the more
complex and intellectually
challenging hazards related to the autonomy of the
system.
Another paper, (Griffiths et al. 2003) focuses on
risk‐based design, but still with an AUV as case. It
presents a pragmatic approach to safety, focusing
partlyonproblemsthatareknownbyexperienceto
have a high
probability and partly on simplifying
physical designs and programs to keep complexity
under control. Some of the main risks identified
were:
1 Humanerror,directlyorindirectly,accountsfora
highpercentageofproblems.
2 Relatively trivial physical problems (electronics,
GPS receiver, mechanical, power, leaks etc.) also
causealargegroup
offailures.
3 Other significant problems are environmental
disturbances (for acoustic transmissions) and
softwareerrors.
Thepaperclassifiesfaultsintoimpactclassesand
performs a more complete risk assessment, taking
consequencesofthe faults intoconsideration.While
this is of limited use to MUNIN, as the technical
domainisvery
different,itshouldbequitevaluable
to other AUV designers. One should also note that
statisticalmodelsareproposedforsomeofthefault
classes which could be used for more quantitative
assessments of expected reliability. Finally, part of
the conclusion is that “This paper has shown that by
good
design and thorough testing of the ‘significant few’
systemsthatcouldposehighrisktothevehicle,theoverall
reliability of the autonomous vehicle is not dominated by
thecomplexassembliesneededtoprovidethatautonomy”.
Thisisalsoencouragingtootherautonomoussystem
designs as this has applications not
only to AUVs,
but can be viewed as a general statement about
industrialautonomoussystems.
Another fault analysis is done by Podder et al.
(2004). This focuses on technical failures and
determination of statistical data for quantitative
assessmentofrisk.Theobservationfromthispaperis
also that most faults are
“trivial” in the sense that
they do not occur in the more complex sensing,
controlanddecisionmakingsoftwaremodulesofthe
vehicle.
In (Brito et al. 2010), an operational risk
management process model is described. This is
partly a quantitative approach where expert
judgementsarepartofthedecision
makingdataset.
It defines an acceptable risk level and tries to
determineifthe risks derived from a givenmission
exceed this level. Itis alsotargeted atoperations in
high risk environments,i.e. an AUV operating near
and under ice, and is not so relevant to MUNIN’s
operational planning.
However, the principles and
methods discussed are more quantitative in nature
thanintheMUNINprojectanditwillbeinvestigated
ifvariantsofthemethodologycanbeusedalsointhe
designphaseforindustrialautonomoussystems.
3 THEMUNINAPPROACH
The high‐level objectives of the MUNIN design
processare:
1 Ensureanacceptablesafetyandsecuritylevelfor
own and other ships and the international
shippingcommunityingeneral.
2 Minimize uncertainty in the missions’ intended
outcomeaswellasinunintendedsideeffects.
359
3 Developacosteffectivesystemthatcancompete
at a level field in a commercial operational
environment.
Onekeycontributiontothesethreeobjectivesisto
keep the system complexity as low as possible.
Higher complexity generally means more hidden
errors, more development work and higher cost.
Higher complexity
also implies less deterministic
mission outcomes, partly because the autonomous
decisionmakingprocessbecomesmorecomplexand
partly because unintended system errors may
interfere with the process in unexpected ways. To
reducesystemcomplexity,wehavefoundthatavery
effectiveapproachistosimplifythemissionandthe
environmental
constraints as much as possible
through a careful scenario analysis. This will be
returnedtoinchapter4.
Therisk‐baseddesignapproachusedinMUNIN
isbasedontheFormalSafetyAnalysis(FSA)method
fromIMO(2007).ThestructureofFSAisillustrated
in Figure 1. This is the internationally
accepted
method for doing cost‐benefit analysis in the
International Maritime Organizationʹs (IMO) rule
making process. Thus, it makes senseto use this as
baseline as the legislative issues are an important
partofthesystemrequirementsforunmannedships.
FSA is also emphasizing the identification of cost
effective
measurestoensureanʺoptimalʺsafetylevel,
whichisanimportantobjectiveforMUNIN.
Figure1.TheFSAProcess(IMO2007)
Asdiscussedin(Rødseth&Tjora2014),MUNIN
putspartsoftheFSAmethodologyintoaframework
as shown in Figure 2. We refer the reader to that
paper for a discussion of the background and
principlesofthemethodandtheframework.
Figure2.MUNINDesignprocess
Inthispaperwediscusssome of the results and
experiencesfromtheuseofthemethodology.Eachof
the following chapters discusses one or two of the
steps.
4 SCENARIOBUILDING
The first step undertaken in the analysis of the
unmanned ship is to develop a number of
operational scenarios in the form of UML (Unified
ModellingLanguage)usecases.
Theintentionofthisexerciseistodevelopabetter
understanding of the challenges that an unmanned
shipwouldbeexposedto,whatsupportfunctionsit
needs and how the operational procedures would
have to be implemented to support unmanned
operation. This is an iterative process where also a
draft physical architecture is developed and the
operational principles are laid down. The main
scenariosdevelopedarelistedinTable1.Theycover
normaloperation(1to8–unshaded)aswellaswhat
was considered to be problems that the system
wouldneedtobeabletohandle(9to18–shaded).
Table1.MUNINinitialscenarios
2
_______________________________________________
1 Openseamodewithoutmalfunctions
2 Smallobjectdetection
3 Weatherrouting
4 Collisiondetectionanddeviation
5 Periodicstatusupdatestoshorecontrol
6 Periodicupdatesofnavigationaldata
7 Releasevesselfrom/toautonomousoperation
8 Manoeuvringmode‐normal
9 Floodingdetected
10 GNSS(GPS/GLONASS)malfunction
11 Manoeuvringmodewithmalfunctions
12 Communicationfailure
13 On‐boardsystemfailureandresolution
14 Pilotunavailable:Remotecontroltosafety
15 Piracy,boardingandshipretrieval
16 Ropeinpropeller
17 Openseamodewithmalfunction
18 Unmannedshipinsearchandrescue(SAR)
_______________________________________________
By detailing and discussing the scenarios it was
possible to identify challenges that could not easily
be solved and which could lead to the final system
solution not being safe or cost‐effective. These
challenges were henceforth used to adjust the
operationalcapabilityoftheshiptoavoidorlimitthe
impactoftheproblems.Sometypicalexamplesare:
1 Use of a continuously manned shore control
center(SCC):Thisavoidsexcessiveandexpensive
levels of autonomy while also providing
immediate backup in cases where onboard
systems fail or are unable to solve problems
satisfactorily.
2 Limitunmannedoperationtodeep
seaareasand
place crew onboard for port departure and
approach:Thisavoidslegalproblems in the port
and coastal state waters as well as avoiding
complex autonomous navigation in heavy traffic
areas.
3 Add redundancy in communication systemsand
addanindependentrendezvouscontrolunit:This
avoidsseveralcriticaland
highprobabilitysingle
pointoffailurecases.

2 DetailedUMLdiagramsareavailablefromhttp://www.mits‐forum.org/munin/index.htm
(January2015).
360
Thescenariobuildingexercisedevelopstheinitial
system and user requirements as well as identifies
critical issues that have significant impact on
operational constraints and high level
modularization.
5 SYSTEMDESCRIPTIONS
The system description consists of the system
modularization and the specification of the
operationalprinciplesfortheunmannedship.

5.1 Modularization
The general system modularization is shown in
Figure3.
Figure3.TheMUNINmodules(Rødsethetal.2013)
The new modules and components needed to
implement autonomy are shaded. Existing modules
arewhite.TheLOScommunicationblockconsistsof
standard systems intended for direct line of sight
(LOS) ship to shipor ship to shore communication.
This includes the automatic identification system
(AIS), global maritime distress and safety systems
(GMDSS) as well as a proposed future VHF data
exchangeservice (VDES) as discussedinRødseth et
al. (2013). The radar, integrated bridge and
automation systems are other existing ship control
systems.
The RCU module is mainly used during port
approach and departure when the port operations
crewisboarding,
butitdoesalsoplayaspecialrole
inrecoveryofunmannedshipsthatcannototherwise
becontrolled.TheRCUisoperationallyindependent
from all other autonomous system components and
representspartofthefailtosafebackupprocedures
for ship recovery, even when normal satellite
communicationorautonomouscontrolsystems
fail.
NewsensorsconsistofacombinedCCTVandfar
infrared(IR)camerathatworkstogetherwithmainly
AIS and radar to detect andclassify nearby objects.
TheIR camera is of the ForwardLooking IR(FLIR)
type. The sensor fusionfunctions are located in the
ASM(Bruhnetal.
2014).
Theautonomousshipcontroller(ASC)consistsof
various sub‐modules for autonomous navigation,
engine control, engine condition monitoring and
energy efficiency management (Burmeister et al.
2014a, Walter et al. 2014). The shore control center
(SCC)isaremotecontrolcenterwithseveralcontrol
stationsandfunctions(Porathe2014).
Communication between
ship and SCC is done
over a standard commercial satellitelink with a
capacity of preferably at least 1500 kilobits per
second (kbps), but which will work down to 125
kilobits per second (Rødseth et al. 2013). Another,
normally lower capacity satellite link, e.g. Inmarsat
or Iridium is used as
backup. In addition, the
unmanned ship will be able to communicate with
othershipsthroughtheLOSmodule.
5.2 Operationalprinciples
The operational principles are characterized by a
conservative approach to using “intelligent control”
intheship.TheinclusionoftheSCCremovesmany
complexity increasing factors from the operational
scenarios.
This means that it is only necessary to
implementarelativelylimiteddegreeofautonomyin
the ship. This also makes it easier to ensure
determinism in mission execution. The operational
modesareshowninFigure4.
Figure4.Theoperationalmodes(Rødsethetal.2013)
Autonomous execution corresponds roughly to
autopilot operation. It performs navigational and
lookout tasks fully automatically as long as more
advanced reasoning and decision making is not
necessary.Thisisdonewithoutguidancefromshore,
butwithperiodicandbriefstatusreportssenttothe
shore operators. Autonomous control is a mode
where the ship, within defined operational limits,
performs actions on own initiative to avoid
dangerous or unwanted situations. The typical
example is avoidance maneuvers when other ships
areinthevicinity.Remotecontrolcanbedirectwith
continuous and real time control from the SCC or
indirect which is when
the SCC only outputs high
levelcommands,e.g.waypoints,totheshipwithout
controlling other operational parameters directly.
Failtosafeisthestatetheshipcontrollerwillgo to
whenitisunabletocontinueautonomousoperations
without SCC assistance and SCC responses are
missing or delayed. The specifications of
the fail to
safemodearebasedonpre‐programmedinstructions
from SCC and will normally be updated from the
SCCasthevoyageproceeds.Thespecificfailtosafe
mode will depend on what problem the ship
encounters and other environmental or ship
parameters(Burmeisteretal.2014b).
5.3
Operationaldomain
The final part of the system description is the
definitionoftheoperationaldomainoftheship.The
MUNIN ship is a dry bulk carrier of medium size
361
and the voyage foreseen is iron ore transport
betweenSouthAmericaandEurope.
During analysis of the use case scenarios, it was
also decided to limit the voyage to the deep sea
passageand not include transit in congested waters
or port approach or departure. There are two main
reasons
forthat:
1 Operationindeepseaareasaremainlyunderthe
jurisdiction of the flagstate which simplifies the
regulatoryissuessignificantly.Thereisnoneedto
consider different port or costal states’ legal
regimes.
2 Traffic density and complexity of operation is
very much simplified by operating only
in deep
sea areas. Also, the probability that an error
resultsinadangerousconsequenceislower.
Ontheotherhand, this willalsohave animpact
on cost effectiveness as one needs to have crew
onboard for port approach and departure. This
meansthatsomeaccommodationfacilitiesmayhave
to
be available. These measures will increase both
capital and operational costs and may have an
impactonthecost‐effectivenessofthewholeconcept.
6 HAZARDIDENTIFICATIONANDRISK
CONTROL
The hazard identification was done in a workshop
guided by certain semantic components from the
MiTS architecture (Rødseth 2011), mainly
the ship
functional breakdown together with voyage phases
andtheoperationalmodes.
Atotalof 65mainhazards were identified. Each
of the hazards was then classified according to its
consequence if the event should happen and the
probability that it will happen. The risk was then
graded in three levels:
Acceptable (low probability
and/or low consequence); Unacceptable (high
consequenceand/orhighfrequency);andALARP:As
lowasreasonablypracticable.
Therewereseveralhazardsthatwereclassifiedas
unacceptableintheinitialshipconfiguration:
1 Interactionwithotherships,whethertheyfollow
COLREGS or not, is a critical issue. Navigation
and
anti‐collision software must be thoroughly
tested.
2 Errors in detection and classification of small to
medium size objects is critical as it may be
wreckage,persons,lifeboatsorotherobjectsthat
need to be reported to authorities. This function
mustbecarefullytested.
3 Failure in object detection, particularly
in low
visibility, can cause powered collisions. The
advanced sensor module must be verified to be
able to do all relevant types of object detection,
alsoinadverseweather.
4 Propulsion system breakdown will render the
shipunabletomove.Itisnecessarytohaveavery
good condition monitoring
and forecasting
systemto reduce suchincidents to an acceptable
minimum.
5 Very heavy weather may make it difficult to
manoeuvretheshipsafely.Itisnecessarytoavoid
excessive weather and it is also required to
investigateimprovedmethodsforremotecontrol
ifsuchconditionsshouldbeencountered.
TheALARP
groupofrisksrepresentsissuesthat
have to be considered on a cost‐benefit basis. One
shouldaimtoremoveorreducetheserisksaslongas
costisnotprohibitivelylarge.
Amongthelatterwerethevarioussecurityrelated
hazards, including stowaways, pirate attacks and
terrorism.Whilethescenario
ofaterroristusingthe
unmanned ships as a remotely controlled weapon
may be seen as a very high risk scenario,
investigationsintoalreadydefinedtechnicalbarriers
showedthatitwasunlikelythatterroristswouldbe
able to take control of the ship as long as
communication systems, position sensing and
on‐
board control systems were designed properly
(Rødsethetal.2013).
Theidentifiedriskcontroloptionsassociatedwith
theaboveunacceptablerisksarelistedinTable2.
Table2.Majorriskcontroloptions
_______________________________________________
Hzd Riskcontrol
_______________________________________________
1 Avoidheavytraffic
Objectdetectionandclassification
Deepseanavigationmodule
SCCandVHFcommunicationwithships
2 Improvedmaintenanceroutines
Improvedconditionmonitoring
Redundancyinpropulsion(waterjet)
3 RadarandAISintegratedinobjectdetection
SCCnotificationwhenindoubt
4 Weatherrouting
SCC
indirectcontrol
5 FLIRcameraandhighresolutionCCTV
SCCnotificationwhenindoubt
_______________________________________________
Theriskcontrolsaregenerallyfirsttotrytoavoid
thedangeroussituation,secondlyhandlingitaswell
aspossibleonboardandthirdly,usetheSCCassoon
asthereisanydoubtaboutoutcome.Therewillalso
befailtosafeactionsformanyofthesecases
thatare
notlistedhere.
Thedefinedacceptablesafetylevelistobeatleast
as good as on normal manned ships, which means
thatsomeoftheconventionaltechnologycanbeused
to achieve the same safety level. This will as an
example apply to the use of radar and
AIS in low
visibility.
For the propulsion system breakdown, one
proposal is to install a water jet that can be driven
from the auxiliary generators so that it is
independentofallmainpropulsioncomponents.The
ideaistogiveatypeof“limphome”functionality.
Theobjectdetectionsystem
consistsofanumber
of sensors that should give at least and normally
better detection capabilities than a human lookout.
Amongthesensorsisradar,CCTV,forwardlooking
infrared(FLIR)andAIS.
362
7 HYPOTHESISFORMULATIONANDTESTS
Achallengefordesignersofautonomoussystemsis
toconvince users that the systemis safeand thatit
will do what it is intended to do. Even by
demonstrating a certain function, it can be argued
thatalthoughitworkedonce,itdoesnot
meanthatit
willworkeverytime.InMUNINwehavedecidedto
addressthisproblemthroughhypothesistesting.
Oxford dictionary defines a hypothesis as “a
suppositionorproposed explanation madeon the basisof
limited evidence as a starting point for further
investigation”. Thus, MUNIN’s main hypothesis for
the
feasibilitytestisthatunmannedshipsystemscan
autonomously sail on an intercontinental voyage at
leastassafeandefficientasmannedships.However,
a scientific approach requires the hypothesis to be
testedtovalidateit.AsMUNIN’smainhypothesisW
is rather broad, testable sub‐hypotheses S
ij for each
module are derived that are directly dependent on
the main hypothesis. Of course, even if all S
ij are
valid,thisdoesnotmeanthatWholds,butatleasta
falsification is possible by this approach due to
contraposition:
(WS
ij)(SijW) (1)
The S
ij are derived from the identified hazards.
Afterwards,appropriatescientifictestscanbefound
and conducted to attempt to falsify the main
hypothesis. Thus, the principal test approach of
MUNINissummarizedinFigure5.
Main hypothesis W
Sub-hypotheses S
1
to S
n
Design and conduct test for S
i
S ˄ ¬ (¬S)
Test S
i
and ¬S
i
next W not ok
noyes
for each i
Figure5.Hypothesisderivationandtests
Table3.Extractofderivedhypothesis(Krüger,ed.2014)
_______________________________________________
Number Hypothesis
_______________________________________________
WUnmannedshipsystemscanautonomouslysail
onanintercontinentalvoyageatleastassafe
andefficientasmannedships.
S
1 ASCcanautonomouslynavigateashipsafely
andefficientlyalongapredefinedvoyageplan
withrespecttoweatherandtrafficconditions.
S
11 ASCcanidentifytheCOLREG‐obligationofthe
shiptowardsallobjectsinthevicinityin
unrestrictedwaters.
S
12 ASCcancalculatepossible,COLREG‐compliant
deviationmeasuresforagiventrafficsituation
inunrestrictedwatersthatminimizethe
necessarytrackdeviation.
S
2 ASMcansensesufficientweatherandtraffic
datatoensurenavigationandplanningfunction
onautonomousvesselsandenablesituation
awarenessinanoperationroom.
S
21 ASMiscapabletodetectafloatingobjectof
standardcontainersizeinarangeofatleast4.0
NM.
S
22 ASMiscapabletodetectaliferaftinarangeof
atleast3.0NM.
_______________________________________________
WhilethisisnotafullproofthatWistrue,itisa
muchmoreconvincingargument, particularly ifthe
sub‐hypothesis and tests are well designed.
However,itisachallengetodesigngoodtestsforthe
negationofS.
As an example, Table 3 gives an overview
of a
smallpartofMUNIN’ssub‐hypothesiswithregards
to collision avoidance and object detection hazards
describedinchapter6.
Basedonthishypothesistree,individualtestsare
designed and conducted. These tests might differ
dependingontheconcretecircumstances.Whilee.g.
S
21andS22canbeeasilytestedbyconductinganin‐
situ‐testofthesystemunderdifferentenvironmental
conditions, S
11 can e.g. be verified by checking the
compliance of obligations derived from S
11 with
situationspre‐evaluatedbynauticalexpertsorcourt
decisions.Incontrast, S
12 can be tested byhistorical
tracksavailablefromAIS‐Dataproviders.
Thehypothesistestswillalsoserveaspartofthe
generalsoftwareandsystemtesting.However,asthe
hypotheses normally focus on sub‐systems and
specific functions, other and more system oriented
tests are also necessary. This will be
part of the
constructionandtestphaseandwillnotbediscussed
furtherhere.
8 DESIGNVERIFICATION
Fornormalships,theprocessofgettingtherequired
flag state and class certificates is the final design
verification.Duringthe certificationprocess,
independent third parties examine the technical
solutions and issue certificates as
proof of safety,
securityandfunctionality.
One will need a similar regime for unmanned
ships.Tobeabletosail,the shipmustbe approved
andcertifiedbyaflagstateandforinsuranceandfor
acceptance by the cargo owners as well as other
commercial parties, it will also
have to have class
approval.
One can assume that the approval and
certification process for unmanned or reduced
manningshipswillbesimilarinstructuretothatfor
manned ships. The problem is to define the
acceptance criteria and to a lesser degree to test
compliance. Another significant problem is that
many of the existing international regulations
stipulatethatthereisacrewonboardandthatmany
rules deal with what work processes and what
routines are required by this crew to ensure a safe
voyage. An obvious example hereis the
“InternationalConventiononStandardsofTraining,
Certification and Watchkeeping
for Seafarers”
(STCW)whichisobviouslynotpossibletofulfillfor
anunmannedvessel.Thisandothercodeswillhave
tobereassessedorreformulatedtoaddresstheuseof
automatedlookoutsandhelmsmen.
363
TherearealreadymechanismsinplaceintheIMO
regulatoryframeworktoallowflagstateandclassto
develop new methods for defining requirements to
andfortestingsystemstocertainsafetygoalsrather
than to technical standards. The concept of “Goal
BasedStandards”(GBS)wasintroducedbytheIMO
Council in 2002. This may be a significant help in
adaptingatleastsomeoftherelevantregulationsto
unmannedships.TheuseoftheFSAmethodologyis
animportantpartofthisandisthereasonwhyFSA
wasselectedas baselineforthe MUNIN
methodology.Theuseof
FSA‐basedmethodsalready
in the concept studies will presumably make it
possibletoreusemanyoftheanalysisresultsalsoin
theinternationallyregulatoryprocesses.
The legal problemis lower whenoperating only
in international waters, where the jurisdiction is
almost exclusively that of the flag state. When
entering into
national waters, the port and coastal
states’ jurisdiction willcome into playas well. This
createsamuchmorecomplexpictureandwillinthe
longtermrequirenewinternationalregulationsand
conventions developed through IMO and possibly
other organizations. The MUNIN project has
provided some analysis of these issues,
but more
work is needed to find efficient solutions to the
identifiedproblems(Sage‐Fuller,ed.2013a,2013b).
Thehypothesistestswilltosomedegreealsoact
as verification criteria, although a hypothesis
typically only addresses factor from the hazard
identification and system modularization
individually.Thus,theywillnotaddressthe
system
asawhole.
Inthiscontextonealsohastolookatthein‐house
design verification. This is a normal part of the
system development process and is typically
undertaken during module tests, integration tests
and commissioning of the system. This will be an
add‐on and a
necessary step also to the third party
verificationrelatedtoissuanceofcertificates.
DesignverificationwillnotbedoneinMUNINas
theprojectislimitedtoaconceptstudy.Thefinaltest
stage in MUNIN will be the hypothesis tests and,
following those, the high level cost‐benefit analysis.
Thus,
system verification criteria have not been
developed and will not be addressed to any
significantextentinthisproject.
9 COST‐BENEFITANALYSIS
The cost‐benefit analysis (CBA) for the MUNIN
concept has notstarted yetand will be done in the
first half of 2015. Also here the results
of the risk‐
basedapproachareexpectedtohavesomeimpacts.
Weexpectthattheoperationalsimplificationsthat
cameoutofthescenarioanalysiswillhaveapositive
impactascostswillbereducedwhencomplexityof
thetechnologydecreases.Thepossibleexceptionhere
is the need for having crew onboard
during port
approachanddeparture.Unlessthisishandledina
way that reduces the need for life support systems
onboard,itmayoffsetmanyofthepotentialgainsin
having ships optimized for unmanned operations,
e.g. without accommodation areas, less life support
systemsandusingnewsuperstructureconcepts.
The
risk control options that were identified as
necessary in the hazard identification and risk
control activities will normally have a negative
impactasmostriskcontrolsrequiremoreadvanced
software or other technology. However, the
structured approach of FSA should guarantee that
theseriskcontrolsarereallynecessaryandthatthey
giveactualbenefitstotheshipandshipowners.
For the risk controls that were defined as
unnecessary or as ALARP, the FSA‐based
methodology should be expected to optimize the
cost‐benefits trade off and as such have a positive
contribution.
10 CONCLUSIONS
The experiences with the risk‐based
approach to
designhave been very good sofar.Ithas defined a
necessaryand efficient structure tothe analysis and
designactivitiesandhasmadeitpossibletopresenta
consistent and well documented argument for the
safetyandsecurityoftheunmannedship.Ithasalso
givenvaluableinput
totheinitialcost‐benefitwork.
The project team’s impression so far is that the
conceptofanunmannedshipisviable,althoughnot
necessarilyasaretro‐fittoexistingbulkcarriers.
The risk based method has in particular been
useful in structuring the Hazard Identification
processasthat
ishighlycriticalindefiningthemain
challengesandwheredevelopmenteffortsneedtobe
focused.Inouropinion,itisnotpossibletoarguefor
the safety and security of unmanned ships without
thistypeofstructuredproblemanalysis.
The early scenario description and analysis
exercise has also proven very
effective in balancing
operationalcomplexitywithtechnicalsimplifications.
This is a critical part of defining the industrial
autonomous system’s operational scope as a too
flexible or too extensive scope can have very high
impact on technical complexity and, hence on cost
andreliability.
Wehavenotyetusedthecost‐
benefitpartofthe
FSAmethodology, but this will be addressed in the
remaining half year of the project and reported on
later.However,theFSAmethod hasbeenused ina
numberofotherIMOstudiesandwedoexpectthat
alsothispartwillworkwell.
REFERENCES
Brito, M. P., Griffiths, G., & Challenor, P. 2010. Risk
analysisforautonomousunderwatervehicleoperations
in extreme environments. Risk Analysis, 30(12), 1771‐
1788.
Bruhn,W.C.,Burmeister,H.C.,Long,M.T.,&Moræus,J.
A.2014.Conductinglook‐outonan unmanned vessel:
Introduction to the advanced sensor
module for
MUNIN’s autonomous dry bulk carrier. In Proceedings
of International Symposium Information on Ships—ISIS
2014(pp.04‐05).
364
Burmeister H.‐C. & Bruhn W.C. 2014a, Designing an
autonomous collision avoidance controller respecting
COLREG, In Maritime‐Port Technology and Development
2014,Taylor&FrancisGroup,London(2014),pp.83‐88
Burmeister H.C., Bruhn W., Rødseth Ø.J. & Porathe T.
2014bAutonomousUnmannedMerchantVesselandits
Contribution towards the
e‐Navigation
Implementation: The MUNIN Perspective, in
International Journal of e‐Navigation and Maritime
Economy1(2014)1–13.
Griffiths,G.,Millard,N.W.,McPhail,S.D.,Stevenson,P.,
& Challenor, P. G. 2003. On the reliability of the
Autosub autonomous underwater vehicle. Underwater
Technology: International Journal of the Society
for
UnderwaterTechnology,25(4),175‐184.
Griffiths,G.,Bose,N.,Ferguson,J.,&Blidberg,D.R.2007.
Insurance for autonomous underwater vehicles.
UnderwaterTechnology,27(2),43‐48.
IMO 2007.MSC 83/INF.2, Formal Safety Assessment:
Consolidated text of the Guidelines for Formal Safety
Assessment(FSA) foruse in the
IMO rule‐makingprocess.
May14,2007
Krüger C. M. (ed.) 2014, MUNIN Deliverable D8.1, Test
environment set‐up description, November 2014
(AvailablefromMUNINprojectonrequest).
Podder,T.K.,Sibenac,M.,Thomas,H.,Kirkwood,W.J.,&
Bellingham, J. G. 2004. Reliability growth of
autonomous underwater vehicle‐Dorado.
In
OCEANSʹ04. MTTS/IEEE TECHNO‐OCEANʹ04 (Vol. 2,
pp.856‐862).IEEE.
Porathe, T. 2014. Remote Monitoring and Control of
UnmannedVessels–TheMUNINShoreControlCentre.
In Proceedings of the 13
th
International Conference on
Computer Applications and Information Technology in the
MaritimeIndustries(COMPIT‘14)(pp.460‐467).
Rødseth Ø.J. 2011, A Maritime ITS Architecture for e‐
Navigation and e‐Maritime: Supporting Environment
Friendly Ship Transport, in Proceedings of IEEE ITSC
2011,Washington,USA,2011.
Rødseth Ø.J & Burmeister, H.‐C.
2012. Developments
toward the unmanned ship, in Proceedings of
InternationalSymposiumInformationonShips–ISIS2012,
Hamburg,Germany,August30‐31,2012.
Rødseth,Ø.J.,Kvamstad,B.,Porathe,T.,&Burmeister,H.‐
C.2013.Communicationarchitectureforanunmanned
merchant ship. In Proceedings of IEEE Oceans 2013.
Bergen,
Norway.
Rødseth,Ø.J&Tjora,Å.2014.Ariskbasedapproachtothe
designofunmannedshipcontrolsystems.InMaritime‐
Port Technology and Development2014. Taylor &
FrancisGroup,London(2014).
Sage‐FullerB.(ed.)2013a.MUNINDeliverableD5.1,Legal
Analysis and Liability for the Autonomous Navigation
Systems,
March2013(AvailablefromMUNINprojecton
request).
Sage‐FullerB.(ed.)2013b.MUNINDeliverableD7.2,Legal
Analysis and Liability for the Remote Controlled Vessels,
August2013(Availablefromwww.unmanned‐ship.org
January2015orfromtheMUNINprojectonrequest).
Stokey,R.,Austin,T.,VonAlt,C.,Purcell,M.,Forrester,N.,
Goldsborough, R., & Allen, B. 1999. AUV Bloopers or
WhyMurphyMusthavebeenanOptimist:APractical
Look at Achieving Mission Level Reliability in an
Autonomous Underwater Vehicle. In Proceedings of the
Eleventh International Symposium on Unmanned
UntetheredSubmersibleTechnology(pp.32‐40).
Walther,L.,Burmeister,H.‐C.&
Bruhn,W.2014,Safeand
efficient autonomous navigation with regards to
weather,In:Proceedings of COMPIT ʹ14,Redworth, UK,
12‐14May2014,p.303‐317.