Technical Summary: Engineering Safety Requirements for Maritime Autonomous Surface Systems

1. Problem Statement

Maritime autonomous surface operations (MASO) represent a fundamental shift from bridge-centered navigation to distributed control structures involving onboard automation, remote operators, control centers, and external maritime actors. This redistribution creates complex safety-critical pathways where hazards do not arise solely from component failures but from interactions between technical functions, human supervision, organizational procedures, and external traffic.

The core safety problem is not merely the level of autonomy, but the system's ability to maintain control when nominal assumptions degrade. Hazards emerge from scenarios involving degraded communication, ambiguous control authority, perception limits, collision-avoidance uncertainty, or delayed human intervention. Current guidance often identifies required capabilities or risk assessment obligations but lacks a systematic method for translating heterogeneous public evidence (regulatory guidance, trial reports, casualty notices) into reusable, actionable engineering requirements for control constraints and recovery. Without explicit specification of degraded modes, takeover authority, fallback behavior, and monitoring indicators, even highly automated vessels may operate in unsafe conditions.

2. Methodology

The study employs a scenario-based system safety engineering approach designed to translate publicly documented hazard scenarios into control constraints and recovery requirements. The methodology avoids statistical inference regarding accident frequencies, focusing instead on identifying recurring control-loss patterns.

• Data Corpus: The analysis is based on a coded corpus of 80 publicly available scenarios and requirements derived from 14 sources. These include international regulatory guidance (e.g., IMO), classification requirements, national guidance, operator-disclosed trials, technical reports, observed casualty reports, and public investigation notices.
• Coding Framework: Each scenario was coded using a structured codebook that preserved the chain from operational context to engineering requirement. The coding variables included:
  • Operational context and autonomy configuration.
  • Supervision mode and hazard mechanism.
  • Triggering conditions and degraded barriers.
  • Unsafe control actions and potential loss events.
  • Recovery pathways and derived safety requirements.
  • Monitoring indicators (observable variables supporting safety monitoring).
• Evidence Stratification: The corpus was audited and categorized by evidence status (e.g., regulatory/normative, observed events, pending investigations) to prevent mixing accident causality with trial expectations or approval requirements.
• Analytical Logic: The study follows a control-loss pathway sequence: Hazard Scenario → Triggering Condition → Degraded Barrier → Unsafe Control Action → Potential Loss Event → Recovery Action → Derived Safety Requirement.

3. Key Contributions

The paper provides three primary contributions to the system safety engineering of maritime autonomy:

1. Hazard Scenario Taxonomy: A classification of hazard scenarios specific to maritime autonomous surface systems, moving beyond generic failure modes to identify recurrent families of control degradation.
2. Control-Loss Pathway Model: A conceptual model linking triggering conditions (e.g., link loss, sensor uncertainty) to degraded barriers, unsafe control actions, and potential loss events, illustrating how safety is lost through interaction failures rather than isolated component faults.
3. Recovery-Oriented Safety Requirements: A set of derived requirements focused on degraded modes, fallback behaviors, and recovery pathways, intended to support design, operation, remote supervision, and safety assessment.

4. Results

4.1 Hazard Scenario Taxonomy

The analysis identified eight primary hazard analysis groups, with the most frequent being:

• Human Supervision and Control Authority (15 scenarios): Issues regarding delayed takeover, ambiguous authority, inadequate handover, and weak mode awareness.
• Communication and Remote-Control Link Degradation (13 scenarios): Loss of link, degraded latency, unavailable backups, and undefined performance thresholds.
• Operating Envelope and Verification (12 scenarios): Unvalidated trial envelopes, boundary exceedance, and insufficient hazard identification.
• Emergency Recovery and Minimum-Risk Conditions (11 scenarios): Undefined safe states, weak emergency stop logic, and inadequate recovery pathways.
• Navigation and External Interaction (11 scenarios): Collision avoidance failures, interaction with conventional vessels, and port/VTS interface issues.
• Perception, Cyber/Data Integrity, and Vessel Function: Smaller groups addressing sensor degradation, data compromise, and propulsion failures.

4.2 Control-Loss Pathways

Six recurrent control-loss pathways were identified:

1. Communication Degradation: Leading to unconfirmed control states and uncontrolled drift.
2. Ambiguous Control Authority: Where authority transfer between autonomy and humans is not verifiable.
3. Navigation under Degraded Interpretation: Failure to maintain separation or interpret rules in complex traffic.
4. Operational-Envelope Drift: Continued operation outside validated conditions due to insufficient boundary monitoring.
5. Safe-State Unavailability: Where a "minimum-risk condition" is named but not operationally feasible (e.g., stopping in a traffic lane).
6. Integrity Degradation: Compromised data or software affecting the control structure's perception and decision-making.

4.3 Derived Recovery Requirements

The study derived specific engineering constraints and monitoring indicators for key recovery groups:

• Minimum-Risk/Safe-State Recovery: Requires explicit definition of safe states (stop, hold, return) based on vessel type and mission phase, monitored by transition time and abort status.
• Communication/Lost-Link Recovery: Requires link-performance thresholds connected to state transitions, backup activation, and safe-state confirmation.
• Control Authority and Takeover: Requires visible, unambiguous authority states, handover confirmation, and operator readiness monitoring.
• Collision-Avoidance Recovery: Requires fallback behaviors for degraded autonomy, including speed reduction and remote escalation.
• Cyber/Data Isolation: Requires controlled rollback and isolation of compromised systems.

5. Significance and Claims

The paper claims that maritime autonomous surface safety is best treated as a problem of recoverable control rather than a property of the autonomous vessel alone.

• Shift in Safety Focus: Safety depends less on the nominal level of autonomy and more on the explicit specification of degraded modes, takeover authority, fallback behavior, and monitoring indicators. The safety unit is the "controlled operation," encompassing the vessel, remote control, communication infrastructure, and external coordination.
• Degraded Modes as Engineered Functions: "Safe states" and "minimum-risk conditions" must not be generic aspirations but operationally defined, technically feasible, and verifiable states specific to the vessel, mission, and environment.
• Human Supervision as Control Authority: Human supervision is not a passive assurance claim but a safety-critical control function that requires defined authority, feedback, and intervention thresholds to be effective.
• Communication as a Safety Channel: Communication links must be treated as safety-control channels where degradation triggers specific state transitions, not merely as operational connectivity services.
• Methodological Value: The study demonstrates that publicly documented scenarios, even when heterogeneous and non-statistical, can be systematically coded to generate actionable engineering requirements. This supports an incremental development approach for autonomy, making explicit what must be monitored and constrained before wider operational deployment.

The paper concludes that for each credible hazard scenario, designers and authorities must be able to answer: what degradation must be detected, what control constraint must remain valid, who has authority to intervene, what recovery pathway is available, and which indicator confirms the system has reached a safer state.