Towards approval of autonomous ship systems by their operational envelope

Abstract

Current guidelines for approval of autonomous ship systems are focused on the ships’ concrete operations and their geographic area. This is a natural consequence of the link between geography and the navigational complexity, but moving the ship to a new area or changing owners may require a costly re-approval. The automotive industry has introduced the Operational Design Domain (ODD) that can be used as a basis for approval. However, the ODD does not include the human control responsibilities, while most autonomous ship systems are expected to be dependent on sharing control responsibilities between humans and automation. We propose the definition of an operational envelope for autonomous ship systems that include the sharing of responsibilities between human and automation, and that is general enough to allow approval of autonomous ship systems in all geographic areas and operations that falls within the envelope. We also show how the operational envelope can be defined using a system modelling language, such as the unified modelling language (UML).

Exploring navigator roles and tasks in transitioning towards supervisory control of autonomous collision avoidance systems

“…First, a baseline case was developed where a human navigator performed all tasks related to collision avoidance. In this case, the human navigator is present on the bridge and collision avoidance tasks are exclusively performed by the navigator as per present-day best practice, i.e., also called "operator-exclusive" [15]. Second, a hypothetical supervision case was developed where an autonomous collision avoidance system (CAS) was envisioned to be able to perform all collision avoidance scenarios.…”

“…Second, a hypothetical supervision case was developed where an autonomous collision avoidance system (CAS) was envisioned to be able to perform all collision avoidance scenarios. However, a human supervisor is still present on the bridge to oversee the performance of the system, i.e., also called "operatorassisted" [15]. If needed, the supervisor can take over manually, i.e., thereby assuming a "human fallback" role [11].…”

Levels of autonomy for ships

“…When this is combined in a system where the automation system also knows the operators' maximum response time TMR, the automation can issue an alert when TDL TMR. This type of cooperation between human and automation is called constrained autonomy [18]. An example of how this could work is that the automation system has a limited set of pre-defined operator modes, each associated with a known TMR.…”

“…This allows an integrated description of automation and crew responsibilities in the different situations the ship is designed to encounter [12]. Developments are also underway to find methods where these concepts can be integrated in a more formal description of autonomous ship system capabilities and how this can be used in approval [18].…”

Model-Based Design and Safety Assessment for Crewless Autonomous Vessel

“…The basic idea of the status setting is shown in [20]. As the status can define responsibilities between humans and machines, it can be considered as the foundation for the operational envelope proposed in [21]. There are two types for status transition: one is Approval, in which the status is switched with the operator's approval, and the other is Acknowledgement, in which the operator is only notified of the switch.…”