lines of the recently introduced IMO Polar Code. ... Convention for the Safety of Life at Sea (SOLAS), ... Polar Code de-risks polar ship design, operations,.
Marine Design XIII – Kujala & Lu (Eds) © 2018 Taylor & Francis Group, London, ISBN 978-1-138-34076-3
Towards the unmanned ship code M. Bergström, S. Hirdaris, O.A. Valdez Banda, P. Kujala & O.-V. Sormunen Aalto University, Marine Technology, Espoo, Finland
A. Lappalainen
Rolls-Royce, Turku, Finland
ABSTRACT: Maritime operations are disrupted by smart innovative technologies enabling an everhigher level of on-board automation. Recently, developments reached a point where unmanned remotely controlled ships are thought to be in principle technically feasible. However, for unmanned ships to deliver on their promise for safer, cleaner and resource-efficient transport, new regulations are essential. This paper paves the way toward a performance driven regulatory framework for unmanned ships along the lines of the recently introduced IMO Polar Code. The work presented is thought to be useful supplement to the existing regulations of conventionally manned ships. 1 INTRODUCTION
2 MARITIME REGULATIONS
In recent years, the maritime industry witnessed dramatic technology developments resulting in an ever-increasing level of on-board automation. Today this trend reached a break—even point where completely unmanned, remotely controlled, ships are thought to be in principle technically feasible. It is thought that unmanned ships may enable safer, cost-efficient and environmentally friendly maritime transport. However, the origins of existing maritime rules and regulations come from an era before the introduction of such disruptive technologies. To enable the design and operation of unmanned ships from a design for safety and overall regulatory perspectives, several performance driven regulatory challenges have to be addressed. Along these lines, this work suggests the introduction of a new regulatory framework for unmanned ships, namely the ‘Unmanned Ship Code’ (USC). Our proposal takes under consideration the recently introduced IMO code on the safety for ships operating in polar waters (Polar Code). This means that USC is fundamentally performance driven, goal-based and supplements existing conventional regulations. The paper is structured as follows: Firstly, an overview of the existing maritime regulatory framework is presented and regulatory challenges of unmanned ships are highlighted; Secondly, the proposed USC is outlined and discussed. The study is limited to regulatory issues concerning ship design and operation. Legal issues, such as liability, are only briefly touched upon.
2.1 Overview of the regulatory framework The design and operation of ships are regulated by a mixture of international, European Union (EU), national, and Classification specific rules and regulations. The implementation of mandatory international regulations is facilitated by the International Maritime Organization (IMO). Nevertheless, enforcement of these regulations depends upon the individual IMO member states, acting both as flag administrations and port/coastal states (IMO, 2016c). While individual IMO members are obliged to make international IMO conventions part of their own national law, they also have the right to determine additional regulations (and bans) on top of the IMO requirements (UN, 1982). This implies that, within their own internal waters, they could deviate from international conventions, unless they have accepted limitations to that right in other international agreements. 2.2 Traditional maritime regulations Traditional maritime regulations consist of rules prescribing the required means, i.e., the required solutions to achieve safety in design and operations. Generally, these regulations are empirically determined based on in service experience. The benefit of prescriptive Rules is that they are purpose specific in terms of application. Verification against compliance helps to assure design or operation objectives that consist the backbone of associated insurance requirements. However,
881
because prescriptive rules refer to specific solutions, they imply design constraints and do not encourage innovation (Papanikolaou, 2009). According to (Papanikolaou, 2009) the rules are often reactive. They are determined in response to individual catastrophic events and based on older (parent) designs. Therefore, they may not be efficient in terms of assurance or cost efficiency when innovation poses unforeseen challenges. Today technology advances (e.g. the ever-increasing knowledge and computer speed) often suggest improved possibilities for cost-efficient and theoretical or semi-empirical assessments. This improved ability to assess the performance of a ship, irrespective to the afore mentioned weaknesses of prescriptive rules, initiated a trend toward performance-based standards. This trend is expected to lead to the formation of goal based design rules and operations that may fundamentally change how ships are assured (IMO, 2015b). 2.3 Polar Code The Polar Code (IMO, 2015), is the first international regulatory framework addressing performance driven arctic shipping risks. It comprises of a set of regulations that interlink with various IMO statutory instruments, such as the International Convention for the Safety of Life at Sea (SOLAS), the International Convention for the Prevention of Pollution from Ships (MARPOL) and other binding IMO instruments that account for Arctic specific conditions and hazards (e.g. ice, remoteness and severe weather conditions). In this sense, the Polar Code de-risks polar ship design, operations, construction, equipment, training, and pollution prevention. The Polar Code is fundamentally performancebased. This is because it helps to determine mandatory provisions in terms of goals, functional requirements FR(s), and regulations that meet those. Whereas regulations are generally prescriptive, the objective of the Polar Code is not to enforce a specific solution, but to ensure that the applied solution meets the FRs and design goals. Thus, a ship can be approved either as a prescriptive design or as an equivalent design (see Figure 1). A prescriptive design assurance process should meet all requirements associate with the FR(s) as stipulated in prescriptive rules. On the other hand, an equivalent design is approved in accordance with Regulation 4 of SOLAS Chapter XIV. This regulation (IMO, 2014), states that ‘any solution may deviate from the prescriptive requirements determined by the Polar Code, on the condition that the alternative design meets the intent of the goal and functional requirements concerned and provide an equivalent level of safety as the prescriptive design’. Accordingly, to
Figure 1. Approval principle in accordance to the Polar Code.
prove equivalency, a design should be analysed, evaluated, and approved on the basis of: - Guidelines for the approval of alternative and equivalents as per various IMO instruments, MSC.1/Circ.1455 (IMO, 2013a). - Guidelines on alternative design and arrangements as per SOLAS chapters II-1 and III, MSC.1/Circ.1212 (IMO, 2006a). - Guidelines on alternative design and arrangements for fire safety, MSC/Circ.1002 (IMO, 2001). A ship approved in accordance with the Polar Code will be issued a Polar Ship Certificate that classifies her as: - Category A, when allowed to operate in at least medium thick (> 0.7 m) first-year ice. - Category B, when allowed to operate in at least thin (≤ 0.7 m) first-year ice. - Category C, when allowed to operate in ice conditions less severe than those included in Category A-B. The ice certificate also clarifies in detail operational limits (e.g. minimum temperature, worst ice conditions, etc.). 2.4 The regulatory challenges of unmanned ships Studies carried out by research projects MUNIN (Maritime Unmanned Navigation through Intelligence in Networks) and AAWA (Advanced Autonomous Waterborne Application Initiative) highlighted key legal and regulatory challenges for unmanned ships. This is because existing international maritime conventions do not consider autonomous ships and do not provide a path toward their regulatory approval (MUNIN, 2015b) (AAWA, 2016). Both projects concluded that future regulatory challenges will relate with
882
obligatory crew functions in general and the role of the shipmaster in specific. Currently, the following regulations directly refer to the shipmaster and crew functions (AAWA, 2016) (MUNIN, 2015b) (Raw & Craney, 2017): - COLREGs (Convention on the International Regulations for Preventing Collisions at Sea), Rule 5: A ship must always maintain a proper lookout by sight and hearing as well as by all available means appropriate in the prevailing circumstances and conditions to make a full appraisal of the situation and of the risk of collision. - STCW (International convention on Standards of Training, Certification and Watchkeeping for Seafarer), Ch. VIII, Reg. VIII/2: Officers in charge of the navigational watch must be physically present on the navigating bridge or in a directly associated location at all times. - SOLAS, Reg. 24: The on-board track control system (autopilot) must enable an immediate switch from automatic to manual control. In addition, the functionality of the manual steering must be tested frequently. - SOLAS, Reg. 33: The master of a ship is required to assist persons in distress at sea. 3 THE ‘UNMANNED SHIP CODE’ (USC) 3.1 Main characteristics To address specific hazards related to unmanned ships, the proposed Unmanned Ship Code (USC), similarly to the Polar Code, is determined as a supplement to existing rules and regulations. However, USC cannot simply add provisions on the top of those for conventional ships, but must also replace existing regulations; especially those that define obligatory safe crew functions on-board a vessel (see Sec. 2.4). Given the general limitations of prescriptive rules (see Sec. 2.2), USC is largely performance driven and goal-based. It aims to enable unmanned ship operations and to ensure that unmanned ship operations are at least as safe as (preferably safer
than) conventional ship operations. In this sense, USC determines ship system specific sub-goals and related FRs. However, because of general challenges related to the qualification and quantification of safety performance metrics (Bergström, et al., 2016b), USC, similarly to the Polar Code, would rely upon new and established industry standards (e.g. regarding integrated sensor systems) as well as ‘common interpretations’ of existing rules for manned ships. A performance-based regulatory approach requires the definition of goals and FRs for various ship functions. Hence, it motivates systemsdriven thinking, i.e. it promotes the thinking that a ship is part of the maritime transport eco-system. The ship system may also be divided into a hierarchy of subsystems that perform a specific function that supports her overall function or mission (Bergström, et al., 2016b). This notion drives the design process in a way that considers both functional requirements and limitations of subsystems (Bergström, et al., 2016a) and enables design optimisation early on (Bergström, et al., 2016a). 3.2 The ‘Unmanned Ship Certificate’ USC suggests that a ship is issued an “Unmanned Ship Certificate”. This, similarly to the Polar Ship Certificate would be awarded on the merit of shipspecific operational limitations and constraints determined along the lines of autonomous operations envelope. For example, permitted conditions could be specified in terms of the type of fairway (e.g. open water, narrow fairway), traffic (e.g. vessel density) or the prevailing weather conditions (e.g. wind speed). Whenever a ship encounters a situation exceeding the operational limitations set by the certificate, she would either need to operate at a lower level of autonomy. This implies increased involvement by the Remote Operating Centre (ROC) in charge of the ship. As last resort, each safety critical system would require an integrated ‘fail-to-safe’ function. The level of autonomy could be specified in accordance with Table 1. The general approach
Table 1. Autonomy Levels (AL) as determined by Loyd’s register (Marine Electronics & Communications, 2016). Level
Description
AL0 AL1 AL2 AL3 AL4 AL5 AL6
No autonomous functions. All operations are manual On-ship decision support. Data will be available to crew Off-ship decision support. Shore monitoring Active human-in-the-loop. Semi-autonomous ship. Crew can intervene. Human-on-the-loop. Ship operates autonomously with human supervision. Fully autonomous ship. There is a means of human control. Fully autonomous ship that has no need for any human intervention.
883
Table 2. System specification. System function
Specification
Unmanned look-out
The goal of this system is to ensure proper lookout at all times. The FRs of the system must be at least equivalent to the function of an on-board human look-out as per COLREGs Rule 5, SOLAS Reg. 24, and the STCW. FRs should be determined both with regards to visual detection of objects (‘sight’) and the detection of sounds (‘hearing’). For remote control, it is enough that the system transfers sufficient visual and sound data to the ROC. For higher level of autonomy, the system should also enable the identification of objects and sounds. Especially the ability to detect and identify small objects (e.g. persons, liferafts) in water in harsh conditions (e.g. high seas, darkness, rain/snow fall) may be difficult yet critical for safety (Rødseth & Burmeister, 2015). The performance of the system could be tested and validated using ‘test tracks’, along which an unmanned lookout system’s ability to detect various objects could be measures. Once well-proven solutions have been identified, these could be described and prescribed in terms of a set of technical standards (e.g. on the required technical characteristics of integrated sensor systems). The goal of the collision avoidance system is to avoid collisions between the ship and other objects. To this end, the FRs of the system should be determined so that the functioning of the system replaces the collision avoidance actions normally taken by the crew (e.g. the ‘Officer of the Watch’). To this end, the system must be able to plan and execute proper collision avoidance manoeuvres. The system depends on input from, and is thus strongly integrated with, the lookout system. It should be noted that the system is only needed for levels of autonomy higher than AL3 as defined by Table 1. The goal of the SAR system is to provide sufficient assistance to persons in distress at sea. A manned ship, encountering persons in distress, could take measures including: (1) contact and inform SAR services, (2) lower life rafts/lifeboats, (3) recover persons from the water or life rafts /lifeboats, (4) provide shelter and first aid to recovered persons. Out of these measures sufficient input from the lookout system, an unmanned ship could be expected to provide measure 1–2. We assume that measures related with decision-making under uncertain and complex circumstances would always be carried by remote control, i.e., at autonomous AL3 (see Table 1). The goal of cybersecurity system is to provide sufficient and holistic protection against all types of cyber hazards. Cyber security is already an issue for conventional ships and the IMO recently issued guidelines on maritime cyber risk management (IMO, 2017). However, cyber security risks are obviously more significant for unmanned ships. Cybersecurity could also be ensured by prescribing a specific cybersecurity standard, combined with appropriate FRs. Such standard should account for “penetration tests” during which human testers try to exploit all the vulnerabilities of a system (Bayer, et al., 2016). The goal of technical reliability and maintenance system is to ensure sufficient technical reliability of an unmanned ship. Without an on-board crew able to deal with possible on-board technical failures, any technical failure – however minor – may lead to serious consequences (AAWA, 2016). Thus, the risk of accidents caused by technical failures may be considered as one of the most significant challenges for unmanned/autonomous ships (MUNIN, 2015a). FRs that may help to ensure sufficient technical reliability include: (1) condition monitoring devices that enable addressing technical issues before the occurrence of failures; (2) inbuilt technical resilience systems that may limit the consequences of technical failures; (3) backup systems; and (4) fail-to-safe functions incorporated into safety critical systems as last resort (MUNIN, 2015b) (Rødseth & Burmeister, 2015). The goal of the fire protection system is to ensure a sufficient level of fire protection. Existing fire protection regulations mainly aim to protect sea-going personnel. On an unmanned ship, the priority of fire protection system would be to protect the ship and her cargo. Accordingly, efficient automated fire extinguishing methods, such as the use of CO2, should be applied (MUNIN, 2015b). The unmanned physical security system is used to ensure sufficient security for the ship and her cargo. An important FR of the system is to prevent unauthorised persons from gaining access to critical ship systems and cargo. On a manned ship the shipmaster is responsible for the security of the cargo (and passengers) and armed security personnel might be deployed to fight piracy. An advantage of an unmanned ship is that physical security can be achieved partially by other means as those used on a manned ship. For instance, because there is no need for a traditional deck and superstructure, the access to a ship and her cargo can be made significantly more difficult by passive means such as locks and other protective physical barriers. If such passive measures are insufficient, additional active measures such as remotely controllable anti-piracy ‘weapons’ (e.g. long range acoustic devices, anti-piracy laser and water cannons) can be installed (Kantharia, 2017c).
Unmanned collision avoidance
Unmanned Search and Rescue (SAR)
Unmanned Cybersecurity
Unmanned Technical reliability
Unmanned fire protection
Unmanned physical security
884
to reduce the level of autonomy in challenging situations should not be based on the premise that human involvement is always safer. Instead, operational limits for various levels of autonomy should be determined so that they maximise safety, considering the strengths and weaknesses of technical systems and human operators. From a legal point of view, we believe there is a significant difference between AL 3-4, implying ‘remotely-controlled’ operations, and AL 5-6 implying ‘fully autonomous’ operations. Remotely-controlled operations imply ships with crews that have been relocated to a ROC. In such situations, the crew would still oversee operations and be responsible for the ship, albeit not from on-board the ship. On the other hand, fully autonomous operations imply ships that, at least periodically, do not have any crew. As a result, in case of an accident, caused by a weakness or failure in any autonomous system, there could be a complicated situation in terms of liability (i.e. it might be unclear who is legally responsible for the accident, the system provider or the operator). For this reason alone, it is believed that fully autonomous ships may not be feasible any time soon. Notwithstanding, similarly to manned ships that often operate on autopilot, remotelycontrolled ships may periodically be allowed to operate at a higher level of autonomy (Marine Electronics & Communications, 2016). 3.3 Specific unmanned ship functions Alike the Polar Code, USC supplements existing regulations where it is necessary to consider risks specific to unmanned ships (e.g. a heightened risk of cyber-attacks and technical failures), that in turn require the removal of regulatory barriers (see Sec. 2.4). To this end, it addressees the following ship and crew functions: - Look-out - Collision avoidance - Search and Rescue (SAR) - Cybersecurity - Technical reliability - Fire protection - Physical security Following the principle of system thinking, each of these functions is to be provided by a specific system. Exemplary functions are described in Table 2. Continuous autonomous operations (AL4 or higher) would, in addition to the functions listed in Table 2, require an operational and strategic decision-making function for: - Safe weather routing; - Planning of complex manoeuvres such as entering/leaving port;
- Determination of safe speed margins that consider prevailing operational conditions (e.g. visibility, traffic density, manoeuvrability, wind, currents, potential navigational hazards and draught). According to (MUNIN, 2015b), state-of-the-art technology is not able to help with the completion of such tasks. 4 DISCUSSION AND CONCLUSIONS This paper paves the way toward USC. It addresses existing regulatory barriers for unmanned ship operations. The thinking behind this proposal is based on the recently enforced goal-based Polar Code. Our proposal inter-connects existing rules and regulations for conventional manned ships and suggests to consider unmanned operations along the lines of technical standards. To enable autonomy without compromising safety, USC proposes to translate safety critical crew functions into technical FRs that at least ensure the basis of equivalent level of safety. Because it is practically not feasible to quantify all types of safety performance we advocate, similarly to the Polar Code, a ‘hybrid’ regulatory approach i.e. an approach that that is well aligned to multiple paths to approval would present the best way forward. In this way, once there are established technical standard solutions that are known to meet the FRs, approval can be achieved by applying such standards. Also, with regards to performance assessment over time there could be multiple acceptable alternative performance assessment methods to demonstrate that a given FR has been met. Today the “human factor” is the reason behind most (75–96%) marine accidents (Rothblum, 2000). Because the societal acceptance is higher for accidents caused by humans than for accidents caused by machines, applied technical solutions that enable remote and periodically autonomous control should be robust enough to ensure minimal risk. This is why performance assessment may require validation against real-world data and testing of unmanned ship operations. Limited test operations are already underway or planned at least both in Norway and Finland (The Maritime Executive, 2016) (World Maritime News, 2017). For this reason, the next steps in USC development will entail the definition of goals and FRs for the safe operation and assessment of unmanned ship systems. ACKNOWLEDGEMENTS This paper was produced within the frame of the DIMECC project D4VALUE (Design for Value— Value driven ecosystem for digitally disrupting supply chain).
885
ABBREVIATIONS AAWA AL COLREGs D4VALUE EU FR IMO MARPOL MUNIN Polar Code ROC SAR SOLAS STCW
UN USC
Advanced autonomous waterborne Application Initiative Autonomy Level Convention on the International Regulations for Preventing Collisions at Sea Design for Value – Value driven eco-system for digitally disrupting supply chain European Union Functional Requirements International Maritime Organization International Convention for the Prevention of Pollution from Ships Maritime Unmanned Navigation through Intelligence in Networks International Code for Ships Operating in Polar Waters Remote Operating Centre Search and Rescue International Convention for the Safety of Life at Sea International convention on Standards of Training, Certification and Watch-keeping for Seafarer United Nations Unmanned Ship Code
REFERENCES AAWA, 2016. Remote and autonomous ships—The next steps, Espoo: AAWA—Advanced Autonomous Waterborne Applications Initiative. Bayer, S., Enderle, T., Dennis-Kengo, O. & Wolf, M., 2016. Automotive Security Testing—The Digital. Energy Consumption and Autonomous Driving, pp. 13–22. Bergström, M., Erikstad, S.O. & Ehlers, S., 2016a. A Simulation-Based Probabilistic Design Method for Arctic Sea Transport Systems. Journal of Marine Science and Application, 15(4), p. 349–369. Bergström, M., Erikstad, S.O. & Ehlers, S., 2016b. Assessment of the applicability of goal – and riskbased design on arctic sea transport systems. Ocean Engineering, Volume 128, pp. 183–198. IMO, 2001. Guidelines on alternative design and arrangements for fire safety. MSC/Circ.1002. London: International Maritime Organization. IMO, 2006a. Guidelines on alternative design and arrangements for SOLAS chapters II-1 and III. MSC.1/Circ.1212. London: International Maritime Organization. IMO, 2013a. Guidelines for the approval of alternatives and equivalents as provided for in various IMO instruments. London: International Maritime Organization.
IMO, 2014. Amendments to the international convention for the safety of life at sea, 1974, AS AMENDED. RESOLUTION MSC.386(94). Annex 7. s.l.: International Maritime Organization. IMO, 2015b. International goal-based ship construction standards for bulk carriers and oil tankers, London: International Maritime Organization. IMO, 2015. International code for ships operating in polar waters (Polar Code). MEPC 68/21/Add.1 Annex 10. London: International Maritime Organization. IMO, 2016c. Implementation, Control and Coordination. [Online] Available at: http://www.imo.org/en/OurWork/MSAS/Pages/ImplementationOfIMOInstruments.aspx [Accessed 1 December 2016]. IMO, 2017. Guidelines on maritime cyber risk management. MSC-FAL.1/Circ.3., London: International Maritime Organization. Kantharia, R., 2017c. Marine Insight. 18 Anti-Piracy Weapons for Ships to Fight Pirates.. [Online] Available at: https://www.marineinsight.com/marine-piracymarine/18-anti-piracy-weapons-for-ships-to-fightpirates/ [Accessed 15 12 2017]. Marine Electronics & Communications, 2016. Creating class procedures for autonomous shipping. [Online] Available at: http://www.marinemec.com/news/ view,creating-class-procedures-for-autonomous-shipping_44157.htm [Accessed 20 2 2018]. MUNIN, 2015a. D9.2: Qualitative assessment, s.l.: MUNIN—Maritime Unmanned Navigation through Intelligence in Networks. MUNIN, 2015b. D9.3: Quantitative assessment, s.l.: MUNIN—Maritime Unmanned Navigation through Intelligence in Networks. Papanikolaou, A., 2009. Risk-Based Ship Design—Methods, Tools and Applications. 1 ed. Berlin Heidelberg: Springer. Raw, J. & Craney, P., 2017. Ghost ships. [Online] Available at: http://www.kennedyslaw.com/article/ghost-ships/ [Accessed 10 5 2017]. Rødseth, Ø.J. & Burmeister, H.-C., 2015. Risk assessment for an unmanned merchant ship. TransNav— The International Journal on Marine Navigation and Safety of Sea Transportation, 9(3). Rothblum, A., 2000. Human Error and Marine Safety. Presented at the Maritime Human Factors Conference 2000. Linthicum, s.n. Rylander, R. & Yemao, M., 2016. Autonomous safety on vessels—an international overview and trends within the transport sector, s.l.: Lighthouse—Swedish maritime competence centre. The Maritime Executive, 2016. Norway Readies for Autonomous Ship Testing. [Online] Available at: http:// www.maritime-executive.com/article/norway-readiesfor-autonomous-ship-testing[Accessed 10 5 2017]. UN, 1982. United Nations Convention on the Law of the Sea. New York: United Nations. World Maritime News, 2017. First Test Area for Autonomous Ships Opened in Finland.. [Online] Available at: https://worldmaritimenews.com/archives/227275/ first-test-area-for-autonomous-ships-opened-in-finland/ [Accessed 14 December 2017].
886
