At least as safe as manned shipping? Autonomous shipping, safety and “human error”

A paradigm shift is presently underway in the shipping industry promising safer, greener and more efficient ship traffic with unmanned, autonomous vessels. In this article, we will look at some of these promises. The expression “autonomous” and “unmanned” are often used interchangeably. We will therefore start out by suggesting a taxonomy of automation and manning of these ships. We will then go on examining the promise of safety. An hypotheses of increased safety is often brought forward and we know from various studies that the number of maritime accidents that involves what is called “human error” ranges from some 7090 percent. If we replace the human with automation, can we then reduce the number of accidents? And is there a potential for new types of accidents to appear? Risk assessment will be a valuable tool, but will only reach as long as to the “known unknowns”. shuttle, “Yara remote control, Yara remote control, are you following what is happening in the Brevik strait?” He turned and looked at the shuttle and could see that she had not slowed down as he had expected. Both of the ships were now only a few hundred meters from the overturned kayak under the bridge. “Yara remote control, Yara remote control, this is Brevik VTS on channel 16. Please respond Yara.” He took up his binoculars and saw that the tanker was slowly turning. The shuttle was now only some 100 meters from the overturned kayak and the turning tanker and still showed no sign of slowing down. The radio crackled. “Brevik VTS, this is Yara. Did you call me? I had a coffee break.” “Thank, you, Yara,” the operator quickly replied. “Stop immediately; can’t you see the kayak in front of you?” “No, the sun is completely blinding both my cameras and on the radar I only see the bridge” the remote operator answered, and then he shouted “What the hell is the tanker doing!” We will not know how this incident ended as it is pure fiction and the Yara shuttle will not start to traffic the Brevik strait in southern Norway until 2021 (she will be manned in 2019, remote controlled in 2020, before attempting to go autonomous 2021). Nevertheless, the situation could be plausible. Kayaks, scooters and other leisure crafts will be close companions to autonomous ships in Scandinavian waters summertime. Cameras and radars can be deceive, as was shown in the Tesla car accident in 2017 (Lambert 2017; NTSB 2017). Bridges may obscure radar detection of objects underneath. Objects coming and leaving like the two scooters may confuse the artificial intelligence of collision avoidance sys-tems, and LIDAR (Light Imaging, Detection, And Ranging) is only useful at close range, closer than the stopping distance. Finally, the human backup may have gone for a cup of coffee. The fictional incident above is, maybe unfairly, attributed to the planned autonomous Yara-Birkeland container feeder (Kongsberg Maritime 2017). This unmanned, autonomous vessel, taking 120 containers on a fully electric propulsion system, will replace some 20 000 trucks taking the same amount of containers on the road today. There is an economic as well as environmental gain to be made. Doing this autonomously and unmanned will be a challenge. So let us start by looking at that. 1.2 Ambiguity in definitions The concepts of unmanned and autonomous when used on ships are ambiguous. The ship bridge may be unmanned, perhaps in periods, but crew may still be on board, ready to take control when needed. A ship can also be remotely controlled from a shore station via highly redundant and high capacity communication links. Is this ship unmanned or autonomous? A dynamic positioning (DP) system on a ship will automatically control the position and perhaps the heading of the ship, but most DP systems will rely on an operator to handle any errors, e.g. in sensors, that occur during the operation. Is the DP automatic or autonomous? Furthermore, to what ship functions do unmanned or autonomous apply? In (Rødseth & Tjora 2017), eight main functional groups are identified, including, e.g. navigation, engine control, cargo monitoring and onboard safety functions. In the following text, we will refer to typical bridge functions, but in a truly autonomous ship, all shipboard functions must be automated to some degree and the degree of autonomy may be different for each function. Finally, the degree of autonomy will be different during the ship's voyage. Tighter supervision and perhaps continuous remote control will be necessary during berthing while a high degree of autonomy is normally desired during the deep-sea passage. This ambiguity is reflected in many existing definitions of "autonomy levels". In (Vagia et al 2016), 12 different "levels of autonomy" are examined and even more have become available as autonomy levels have been extended to ships (Rødseth & Nordahl 2017). One reason for the numerous definitions is that autonomy must be defined along several axes and with a strong focus on the operational profile at hand. The idea of autonomy is very context dependent. 1.3 Three axes of autonomy For ships, we propose to characterize autonomy along three axes (Rødseth & Nordahl 2017). One axis is the complexity of the intended operation. Is the ship operating in sheltered or open seas, what are the likely weather or visibility impacts, how much other traffic is there, how complex is the sailing routes in terms of shallows, turns and obstacles, and so on. We propose to capture the complexity in the operational design domain (ODD) as explained in the next section. The second axis is the manning level. The ship can have a continuously manned bridge, but still have a high degree of autonomy in automated object detection and collision avoidance. One can foresee ships with enough autonomy to allow the crew to go to bed at night, when sailing in open waters and fair weather. Ships can also be remotely controlled, with hardly any "real" autonomy at all. On the other end of the axis, one may see ships with no crew and no remote monitoring at all: they are fully autonomous. The manning level is dealt with in Table 1. The third axis is the operational autonomy, how the necessary operations to satisfy requirements of the ODD are divided between human and machines. We propose to capture this aspect by diving the Dynamic Navigation Tasks (DNT) into two parts: One part that requires human intervention to be executed (Operator Exclusive DNT) and one that can be handled by the automation systems (Control System DNT). 1.4 A proposed taxonomy To simplify the definition of autonomous and unmanned, we will start with a concept borrowed from the US car industry and its definition of terminology for autonomous cars (SAE 2016). This is called the "Operational Design Domain" (ODD) which is the operational conditions that limits when and where a specific autonomous car can be used. The corresponding capabilities of the car and its control systems is the "Dynamic Driving Task" (DDT). The concept also includes the "DDT Fallback" which is procedures and safety guards that are built into the vehicle and control systems for handling situations when the ODD is exceeded. The DDT Fallback will bring the system to a "minimal risk condition" (SAE 2016). For a ship, we suggest renaming DDT to the "Dynamic Navigation Task" (DNT). Most autonomous or unmanned ships are expected to have a "backup" operator somewhere on board or on shore, so that situations that cannot be handled by automatic functions can be safely handed over to the operator. This can be illustrated by dividing the DNT into two regions: The "Operator Exclusive DNT" where the operator is needed to resolve problems that the automation cannot handle and the "Control System DNT" which represents the unassisted capabilities of the automatic systems. The complete concept is illustrated in Figure 1. Figure 1 – The Operational design domain and dynamic navigation