A Comparative Assessment of Collision Risk of Manned and Unmanned Vessels

Abstract

It is expected that the prototypes of unmanned merchant ships will be deployed in the next few years. However, there is no specific research on whether the introduction of unmanned ships will reduce the risk of ship collision accidents in which communication between vessels is critical. This work constitutes an attempt to bridge the gap identified above by applying the Hybrid Causal Logic (HCL) methodology to model general-level collision scenarios of unmanned ships. The HCL methodology has been selected for its proven applicability to risk assessments, even when empirical data may be insufficient. Collision scenarios involving unmanned ships have been created in which manned ships of the conventional collision scenario HCL model are replaced with unmanned ships. Then, collision scenarios capturing the interactions between a manned ship and an unmanned ship were modeled. By comparing the qualitative and quantitative results of the different scenarios, we can see that the introduction of unmanned ships may effectively reduce the occurrence of ship collision accidents.

1. Introduction

Benefiting from the development of technology and the testing experience of unmanned surface vehicles, the deployment of unmanned cargo ships, which can travel across the oceans autonomously, has been boosted by the rising pressure of maritime safety, crew costs rising, and environmental protection. It is expected that the first unmanned cargo ship will be commercially available by 2035 [1,2]. Subsequently, waterway transport will enter a new era, in which both conventional ships and unmanned ships will be sailing on the same water simultaneously. In this paper, such scenarios are called hybrid scenarios, or more specifically, the Manned–Unmanned (M-U) scenario and Unmanned–Manned (U-M) scenario. The same naming convention of scenarios is used for Manned–Manned (M-M) scenarios and Unmanned–Unmanned (U-U) scenarios. The hybrid scenarios will remain relevant for quite a long period until the conventional ships are totally replaced. However, there is no convincing evidence that maritime safety will be increased by gradually adopting unmanned ships [3,4]. This worry is not without reason, especially when it comes down to scenarios involving critical events, such as ship encounter situations with collision risk, which need all the involved ships to communicate and accompany each other.

Research and development (R&D) activities have been initiated in recent years around the world for the development of unmanned cargo ships [5,6]. In general, there are at least three modes of operation for an unmanned cargo ship that can adapt to hazardous conditions: fully manned, remote-controlled, and fully autonomous. According to Lloyd’s Register scale, the unmanned cargo ship with autonomy level 5 (AL5) [7] should be able to travel across oceans autonomously or rarely supervised, performing real-time navigation risk identification, navigational states assessment, and instant decision-making at the total ship level. Besides, the ship should be able to switch to remote control via maritime satellite whenever a shore-based operator deems it necessary, such as in challenging emergency conditions in which the ship cannot recover by itself [8]. For example, the research team of the Maritime Unmanned Navigation through Intelligence in Networks (MUNIN) project [3,9], one of the unmanned bulk carriers development projects, have attempted to suggest a risk-based design method based on Formal Safety Assessment (FSA) [10]. However, FSA also has some problems, such as insufficient consideration of human-related factors, over reliance on expert judgment and over-generalization of methods [11]. The authors use different risk analysis methods to study the safety of unmanned ship [12,13], and draw conclusions that the unmanned ships tend to be safer than the traditional ships, despite acknowledging that necessary information about the ship’s design and operation is still missing. Our analysis intends to qualitatively and quantitatively evaluate the safety improvement. Moreover, the potential hazards studied in this research are mostly human-related, although the analysis of subsequent events following accidents is expected to be important for unmanned ships given that they do not have a physical onboard crew. Wróbel et al. [12,14] studied this problem by using a what-if analysis framework and data from one hundred maritime accident reports. Their research is divided into two parts: the potential impact on the occurrence and consequences of maritime accidents, and the probability of occurrence of such events. Due to the limited available information and lack of objective accident data [15], the research is only qualitative and summary. Nevertheless, the author’s expectation is a decrease in the probability of occurrence, while the consequences of maritime accidents involving unmanned ships are expected to be much larger compared to the conventional ones.

From the very limited literature in the area of unmanned waterway transport, one of the main challenges of unmanned ships is the need for analyses of their safety [16]. The main argument in favor of the research into unmanned ships is the increase in maritime safety. This is expected to be accomplished by eliminating or reducing the accidents involving the onboard crew by merely reducing the crew size. However, instead of migrating and disappearing entirely, the crew may work in a remote shore-based command center [17]. In turn, this configuration may create some new problems, such as situations in which the damage cannot be counteracted in a timely way by crews mobilized to reach the scene of the accident [12]. Among the different kinds of maritime accidents, it is generally considered that the probability of the occurrence of ship collision accidents will benefit the most from the deployment of unmanned ships [18]. In practice, to identify and maneuver a ship on a collision course with another ship is a complex task [19,20]. Although the commonly used navigation equipment, such as maritime radar/Automatic Radar Plotting Aid (ARPA) and Automatic Identification System (AIS), play a significant role in navigation, they still have various problems in practical use. Due to the huge inertia and typical under-actuation of most cargo ships, communication and cooperation are always needed during the whole process [21,22]. Within most autonomous decision-making algorithms designed for unmanned ships [23], collision avoidance is just a part of path planning, constructed with dynamic obstacles avoidance, traffic regulations (e.g., Convention on the International Regulations for Preventing Collisions at Sea (COLREGs), formulated by IMO, 1972) and motion constraint obedience. In most projects, communication with the target ship is not designed as an essential part of the collision avoidance process for unmanned ships, particularly in the hybrid scenario. Considering that the hybrid scenario will be the status quo until all the manned ships are replaced, it is necessary to evaluate the potential impact of unmanned vessels on ship collision accidents.

Based on the previous work of the risk assessment of two conventional ships collision accidents [24], this article aims to generalize the HCL model of the future ship collision avoidance scenario with unmanned ships on the basis of the HCL model of the conventional scenario established in the previous study. Firstly, ship collision scenarios have a high degree of consistency of event sequence at the logical level. For example, collision avoidance decisions must be made after risk detection and confirmation. From this point, encountered ships with different levels of automation can be seen as ships with different decision-making methods and maneuver preferences. Secondly, the HCL methodology allows analysists to study different generation processes of the same event in similar scenarios, such as decision failure, which can be caused by human error or software failure. Finally, the quantitative analysis can be carried out on the basis of the HCL model to some extent.

The remainder of the paper is organized as follows: Section 2 gives a short introduction of the previous study of the HCL model of the M-M scenario. In Section 3, the HCL model of the U-U scenario is constructed by some assumptions of the application of unmanned ships. In Section 4, the HCL model of hybrid scenarios is built based on the models of the M-M scenario and the U-U scenario. The results of the risk assessment of ship collision accident scenarios for the various types of vessels are shown in Section 5. Finally, some discussions and conclusions are given in Section 6.

2. Overview of the HCL Model for Ship Collision Risk Analyses of the M-M Scenario

In the previous paper, the ship collision accident of the conventional scenario was modeled based on 50 ship collision accident investigation reports.

The initiating event (IE) of the event sequence diagram (ESD) occurs when the distance to the closest point of approach (DCPA) is less than a predefined minimum safe distance. The ESD in Figure 1 illustrates the following pivotal event (PE) sequences caused by the initiating event, which is a graphical representation for all the possible accident scenarios. The events and related details are listed in

Table 1. Events’ information of M-M scenario’s ESD model.

Node NO.	Node Name	Description
IE	Initiating Event: CPA<n	The closest point of approach less than the minimum safe distance (e.g., 100 m)
PE1	OS Collision Alarm	Own Ship (OS) alarm signal for possible collision
PE2	OW Identifies Collision	The officer on watch identifies possible collision
PE3	OS Crew Confirmation	OS crew confirm possible collision
PE4	OS Response Strategy Decision	The crew decides response strategy
PE5	OS Effective Communication with TS	OS effective communication with TS
PE6	OS Crew Response Action with Successful TS Communication	OS crew response action with successful TS communication
PE7	OS Propulsion and Steering
PE8	OS Crew Response Action with Failed TS Communication	OS crew response action with failed TS communication
PE9	OS Propulsion and Steering with Failed TS Communication	OS Propulsion and steering with failed TS communication
PE10	OS Response Strategy Decision for Emergency	The crew decides the response strategy for emergency
PE11	OS Crew Response Action for Emergency	OS crew response action for emergency
PE12	OS Propulsion and Steering for Emergency	OS propulsion and steering for emergency
PE13	TS Measures	Target ship measures
E1	End State 1	Successful avoidance
E2	End State 2	Ship mechanical failure
E3	End State 3	Crew response action failure
E4	End State 4	Successful avoidance with failure TS communication
E5	End State 5	Ship mechanical failure with failed TS communication
E6	End State 6	Crew response action failure with failed TS communication
E7	End State 7	Successful avoidance for emergency
E8	End State 8	Crew response action failure for emergency
E9	End State 9	Crew response action failure for emergency
E10	End State 10	Crew response decision failure
E11	End State 11	OS and TS all failure for collision

. The whole ESD can be divided into three main parts: the collision risk identification and confirmation, the own ship’s (OS’s) decision-making and communication with the target ship (TS), and OS’s response action under different conditions. There are eleven end states following the various response actions and systems performance.

There are three main logic paths in the ESD after the collision risk identification (PE 3):

(1)

The scenarios with successful communication with TS—This will lead to a collaborative effort between both sides for avoiding a collision (PE 4\5\6\7, End 1\2\3);

(2)

The scenarios with failed communication with TS—This will lead to a unilateral effort of collision avoidance (PE 4\5\8\9, End 4\5\6);

(3)

The scenarios under emergency conditions—Since it is under emergency conditions, both ships do not have time to communicate with each other and only take recovery measures based on their assessment alone (PE 4\10\11\12, End 7\8\9\10).

The HCL model of M-M scenario also includes Fault Trees (FTs) and Bayesian Networks (BNs) associated with PEs in ESD, as well as the assignment of related probability values. Detailed analysis and the modeling process can be seen in the previous paper.

3. HCL Model for Ship Collision Risk Analyses of the U-U Scenario

3.1. The Effect of Unmanned Ships on the Likelihood and Consequences of the Accidents

Based on the HCL model of the M-M scenario in Section 2, the ship collision scenarios will be analyzed in the following sections. Due to the discussion about how the unmanned ships will actually be operated in reference [25,26], the assumption is applied that the unmanned ship will keep the automatic mode in most of its entire voyage until approaching a certain point outside the port. Subsequently, the shore-based center operator would take over the control and remotely control the ship to complete the berthing process. This navigation process is similar to the current pilotage process in conventional navigation. To take advantage of the unmanned ship’s capabilities and reduce the extra expenditure, the ship owners are likely to keep the vessel in automatic mode as long as possible. Based on this assumption, a preliminary ship collision scenario involving unmanned ships can be sketched.

Out of all the global maritime accidents, the ship collision accident constituted as much as 36% of the total amount [27]. According to the investigation, most of the accidents were navigation-related human errors [28]. A consensus has been reached that the deployment of unmanned ships could enable avoiding accidents due to human errors [29]. However, for the type of collision accidents due to the bridge team’s non-compliance in detecting the target ship or navigational danger, which is in violation of Rule 5 of COLREGs, “Look-out”, the unmanned ships being equipped with a sensor and optimizing risk identification and decision algorithms, such as lidar and infrared cameras, can help eliminate those events [30]. Updating the sensing and cognitive abilities has become of interest in the recent unmanned ship Research and Development (R&D) projects, and this also meets the COLREG’s requirement about increasing detection methods to cope with the lack of radar detection capabilities [31]. Thus, a reduction in the likelihood of collision accidents is to be expected given that all the new systems perform better than the crew they replace.

However, even if the likelihood of collision accidents can be reduced, it is difficult to draw the same conclusion about the consequences of such events. In the process of ship collision avoidance practice, the crews on board played an important role in damage reduction and self-rescue processes after the accident. For instance, when the damage was significant or the recovery was complicated, needing the shore parties’ assistance, the survivors had to be picked up by the other encountered ship. There is no evidence showing that the unmanned ships have the function of picking up survivors, nor the purpose of cooperating in case of an emergency. Therefore, once the two ships collide in the hybrid scenario, the crew on the manned ship may be in a more challenging situation than the traditional scenario (M-M scenario).

It should be noted that the ademption in this paper is only a first try at modeling future ship collision accidents. By changing the structure of the FT or BN in the existing HCL model and qualitatively adjusting the probabilities of the risk influencing factors (RIF), we can examine the ship collision accident in the hybrid and the U-U scenarios with a relatively high degree of resolution.

3.2. Basic Assumptions and Construction of U-U Scenario

Since the hybrid scenario can be seen as a combination of the M-M scenario and U-U scenario, the HCL model of the ship collision accident for the U-U scenario is presented firstly on the basis of the M-M scenario model. The unmanned ship analyzed here is set to be at least at the AL-5, the lowest level of fully autonomous ship according to Lloyd’s Register guidance 2016. In this future scenario, the advantages of unmanned ships are maximized, and the impact of human factors is minimized for the vast majority of commercial shipping activities. According to the known unmanned ship R&D projects, the unmanned ship functions can be simply divided into three main parts: information gathering through sensors, decision-making, and controlling. Figure 2 illustrates the main differences between manned ships and unmanned ships in ship collision scenario. To facilitate the application of HCL methodology, four basic assumptions are proposed, as follows:

(1)

The risk perception system of the unmanned ship is a collection of modern sensor technologies. For instance, the lidar and camera are often used to form the visual system of unmanned ships. The FT model of OS alarm failure for collision risk is extended. The models of the lidar system and camera system are appended in it according to the latest sensor application and unmanned ship development. Due to the uncertainties in the development of machine vision systems, a new BN is modeled to analyze the impact of external environment factors on sensor performance;

(2)

Currently, there is no industry consensus on the solutions for the communication between unmanned ships or between manned ships and unmanned ships. In most of the current designs, unmanned ships are able to perform reliable autonomous collision avoidance maneuvers without communicating with the target ship. Therefore, it is assumed that there is no communication between the unmanned ship and other encountered ships in a ship collision scenario in the proposed model. The probability of the communication-related PE (PE 5\6\7 in Figure 1) is set to a small value (i.e., 1$\times {10}^{-6}$), which naturally does not happen;

(3)

The decision-making system is a software-only system, including the communication function between OS and the shore-based center. All PEs related to decision-making in ESD (PE 2\4\5\6\8\10\11 in Figure 1) are part of the decision system of the unmanned ship, and the probability of these events is the probability of the software reliability of the unmanned ships. The ESD’s PEs in which unmanned ships perform decision-making activities are converted from BNs representing human factors to BNs representing software reliability. All the structure and values of the software reliability are modeled according to the software industry practices;

(4)

In fact, it is speculated that in the process of unmanned ship navigation, the most concerning risks have changed from these “soft” factors to “hard” factors such as the reliability of sensors and mechanical systems. The hardware configuration of unmanned ships has not yet reached maturity in the industry, thus most of the currently unmanned ship R&D project designs look like the traditional ships equipped with sensors and digital control equipment. Therefore, in this paper, the same FT structure and parameters of propulsion and steering are adapted for mechanical failure events (PE 7\9\12) of both manned and unmanned ships.

Based on these assumptions, the ESD of the HCL model for the M-M scenario (Figure 1) can be developed into Figure 3. The PE 1 OS alarm is linked with an extended FT (shown in Figure 4) that includes the lidar and cameras, the most important hardware sensor system for unmanned ships. As the sensors of the enhanced vision system are influenced by the uncertainties of the environment, the basic events OSLidarSensor and OSCamera of the FT are linked to a new BN that is shown in Figure 5. The PE 7\9\12 and their linked FTs remain the same as in the M-M scenario according to assumptions (2) and (3). In U-U scenario, the PE 2 (OW Identifies Collision), PE 4 (OS Response Strategy Decision), PE8 (OS Crew Response Action with Failed TS Communication), PE 10 (OS Response Strategy Decision for Emergency) and PE 11 (OS Crew Response Action for Emergency) are linked with the reliability of the software system instead of the human-related BNs in M-M scenario. Given the lack of the reference for the intelligent software system’s reliability assessment, an attempt is made in Section 3.4 and a BN model of software reliability is made based on the analysis. Finally, the probability of PE 13 Target Ship’s Measures is determined in the same way as in the M-M scenario.

3.3. Fault Trees Model of U-U Scenario

The hardware factors related to PE 1 (OS Collision Alarm) of the ESD are extendedly modeled by performing a functional decomposition of the risk detection system of unmanned ships. According to the previous assumption, the FT model of alarm failure for unmanned ships is shown in Figure 4.

The failure events of ARPA failure and AIS failure are the same with the FT model of the manned ship. The lidar failure and machine vision failure are both composed of hardware failure, software algorithm failure and an AND gate. In practice, the uncertain environmental factors are one of the important factors that affect the performances of environment perception sensors, such as lidar and camera. To further determined the impact, sensor effectiveness is modeled with BN, which is shown in Figure 5.

3.4. Bayes Networks Model of U-U Scenario

In the HCL methodology, the BN method is applied to quantitatively analyze the performance influencing factor (PIF) for PEs with uncertainty factors. For each PE that requires BN modeling analysis, the established BN model consists of one PE node and several PIF nodes. The PE node is the analysis object, and the result of BN analysis is directly transmitted to ESD for calculating the probability of the end state. The PIF nodes are the factors that affect the analysis object in the performance of ship collision avoidance, including environmental factors, operator state factors, safety culture factors, and so on. The interaction between these factors and PE is very complex and involves much uncertainty. It is not possible and appropriative to use FT to model and analyze, while BN modeling is suitable in this situation. For example, the software-related failure events, such as the reliability of the input information and the decision complex, are among the most important contributors to a collision accident. These two concepts, together with other concepts that affect software system reliability, are analyzed and modeled later in detail in this section.

3.4.1. Bayes Network of Sensor Effective

Figure 5 illustrates the BN structure of sensor effectiveness, which is linked with the basic events Lidar Sensor Failure and Camera Failure of the FT model in Figure 4. Only factors that affect the PE node are analyzed in this BN, and the standard of the level setting of the BN’s nodes are based on the degrees of impact. The descriptions, level labels and conditional probabilistic table (CPT) of the BN model of sensor effectiveness are listed in

Table 2. Descriptions, level labels and CPT of the BN model of sensor effectiveness.

Node Name	Description	Level Name	Probability
Sensor Effective		Effective	0.66354
		Ineffective	0.33646
visibility	visibility condition	Good	0.738
		Bad	0.262
Daylight	illumination condition	Daytime	0.4
		Dawn and Dusk	0.2
		Night	0.4
weather	rain, fog, haze	Fine	0.7
		Rainy	0.2
		Fog Haze	0.1
wave	followed by wind	0–3 m	0.7
		3–10 m	0.2
		>10 m	0.1
wind	according to Beaufort Wind Scale	Level 0–5	0.7
		Level 6–9	0.2
		Level 10–12	0.1

. Lidar and camera are representative sensors for unmanned ships to perceive the external environment. On the one hand, this kind of sensor needs to keep sensitivity to the external environment. On the other hand, it needs to overcome the uncertainties in the external environment. Therefore, the reliability of a sensor’s performance is affected by different uncertain environment factors. For the lidar and camera, wind, wave and visibility are important factors affecting sensor performance. Among them, wind and wave will interfere with lidar’s target and obstacle recognition. Poor visibility conditions, such as rain, snow, fog and haze, will affect the signal collection of sensors. Similarly, the camera is also influenced by these two factors. It should be noted that the impact of illumination on the effectiveness of the sensor system is obviously less than that on the conventional manned ship. However, based on the research of the previous literature on the impact of daylight on the sensor performance of the camera [32] and lidar [33], the illumination condition is still an important factor.

3.4.2. Bayes Network of Software Reliability

According to the current development information for unmanned ships, the decision-making of unmanned ship also follows the same cognitive model as that of conventional ships, that is, risk situation awareness, collision avoidance decision-making and control signal sending. Figure 6 illustrates the composition and structure of a typical unmanned ship’s intelligent software system [34]. The function module design, information processing and conversion of the system can be regarded as the digital presentation of the human decision-making process. In the ship collision scenario, all the functions are mobilized to deal with the collision risk. According to the research on the PIFs of the human reliability model based on the human cognitive process [35,36], the PIFs of the unmanned ship’s software can be obtained by analogy. The PIF of the unmanned ship’s software system is divided into internal the PIF group and external PIF group, which are used to represent the influence of the internal and external state of the intelligent decision-making system on its decision-making process. The contents are listed in

Table 3. Descriptions of the PIFs of an unmanned ship’s software system.

PIF Group	PIF Classify	Content and Description
External PIF	Data Reliability	The reliability of incoming data from sensor system, which may cause packet loss, incomplete data and information lag.
	Environment Factor	Environmental factors will affect the hydrodynamic characteristics of ships and affect the calculation difficulty of the decision-making and control system. The uncertainty of environmental factors will directly affect the accuracy of risk situation awareness.
	Hardware Factor	The reliability of the sensor system will affect the situation awareness ability of the software system. The reliability of the power and steering system affects the response to the decision of the software system, and then affects the execution efficiency of the software control function.
	Conditioning Events and Hidden Faults	Conditioning events and hidden faults are inevitable, and the software system should have a response plan.
Internal PIF	Knowledge Base	Predetermined storage information that needs to be collected in the decision-making process.
	Intelligent Decision Algorithm	It refers to the specific decision-making mode of the system. It is the basis of intelligent decision-making, which directly affects the cognition and processing of the current scenario.
	Parameter System	It is matched with decision algorithm. Different parameter systems should be used in different situations and different decision-making links, so as to ensure the optimal allocation of computing resources.
	Intelligent Level of Software	Refers to the overall functional level of the system. The higher the level of intelligence, the more complex scenarios it can deal with.
	Input Information of Memory	The uncertainty of input information will affect the decision accuracy of the intelligent system to a great extent.
	Working Memory	All kinds of dynamic factors which can affect the current operation of the software.
	Cognitive Modes and tendencies	Refers to the cognitive style and processing tendency of ships in the current navigation situation.
	Alertness	The ship’s alertness represents the basic cognition of the current encounter scenario. If it is not alert enough or too vigilant, it will lead to cognitive imbalance of the scenario and make inappropriate decisions. In an emergency, the system needs to set alertness to the highest level and put the current task at the highest priority.
	Attention to Current Task	The decision-making system needs to deal with multiple tasks at the same time, and the attention to the current task affects the decision priority of the ship for the current encounter scenario. In an emergency, the system needs to set the attention to the current task to the highest priority, and give the current task the highest priority.
	Attention to Surrounding Environment	Attention to the surrounding environment affects the priority given by the ship to dealing with the environmental factors of the current encounter scenario. In harsh environment, it is necessary to use a more complex control system mode.
	Pressure Load	Pressure load affects how well the system performs in the current task.
	Time Constrained Load	Collision avoidance decision-making is highly related to the time of taking measures. The more urgent the situation, the higher the time constraint load, especially in the case of emergency collision avoidance.
	Task Related Load	The urgency of the collision avoidance situation has great influence on the difficulty of the collision avoidance decision, and the more urgent the situation, the higher the requirement of the collision avoidance decision.
	Information Load	The collision avoidance decision needs to consider a lot of internal and external information, but the system’s ability to use information is limited, and more information will aggravate the information load.
	Perception and Assessment	Perception and evaluation of current navigation situation.
	Perception Threshold	Perception threshold is the starting point of situation awareness. Only when the current navigation risk is large enough can it be triggered.
	Decision Complexity	Decision complexity has a great influence on the software efficiency of the decision-making and control system, which will directly affect the effect of collision avoidance.
	Sense of Responsibility	In the collision avoidance scenario, the responsibilities of the encountered ships are not the same.

.

It can be seen from Figure 6 that the performance of the unmanned ship’s software system is restricted by various internal and external factors. External PIFs refer to various impact factors outside the software system. Data reliability, environmental factors of navigation, and hardware factors will all restrict the software system’s perception of the outside world, affect the ship’s hydrodynamic performance, and finally effect the decision-making and control systems. Conditioning events and hidden faults are inevitable, especially in sailing. Even though the software system should have a response plan for the unpredictable hazards, unexpected or unknown disruptions are still one of the most important factors causing navigation risks and accidents [18].

In contrast to external PIF, internal PIF is a direct factor that affects the running state of the software system. Some of these factors are due to defects in the software design and development stage, and some are due to the complexity of the current situation, which exceeds the capacity of the software system. The problems caused by software design defects are long-term and will affect the entire life cycle of unmanned ships. The problems caused by the current situation are short-term and will only have an impact in the current task. In this paper, the former type of internal PIFs is called knowledge base factors, and the latter type is called working memory. Both concepts are borrowed from cognition-based human reliability assessment methods [35]. In the software system reliability analysis of unmanned ships, knowledge base factors are divided into four categories, namely, intelligent decision algorithm, parameter system, intelligent level of software and input information of memory. The analysis of working memory is more complicated. First of all, working memory is divided into three parts: cognitive modes and tendencies, pressure load and perception and assessment according to different aspects of influence. Then, each part is divided into several basic elements. A detailed description of the PIF is given in Table 3.

Figure 7 illustrates the interaction among various PIFs and the influence of logic on the performance of collision avoidance behavior at the cognitive and decision-making level of unmanned ships. In Figure 7, external PIFs can affect the reliability of the software system only by activating internal PIFs. The internal PIFs have a direct impact on the performance reliability of the intelligent system under the joint action of external PIFs and input information. The internal PIF is mainly divided into knowledge base and working memory. Knowledge base is predetermined storage information that needs to be collected in decision-making process. Working memory contains a variety of dynamic factors, together with real-time input information, affecting the current running state of the software. Internal PIFs can affect decision performance in many aspects, including the timing of decision-making, the efficiency of algorithm execution, the collaborative processing ability of different functions between systems, and the collaboration between software and hardware systems.

The PIF’s influence on software reliability is also an uncertain process, so a BN is applied to model and analyze the uncertain influence. The BN model of software reliability is shown in Figure 8. The detailed description of each node and the classification setting of CPT are listed in

Table 4. Descriptions and level labels of the BN model of sensor effectiveness.

Node Name	Description	Level Name
Software Reliability	The reliability of the intelligent software system	Effective\Ineffective
Data Reliability	Data reliability of the external PIF	Reliable\Unreliable
Environment	Environment factors can influence the	Good\Medium\Severe
Hardware	hardware factor of the external PIF	Good\Medium\Poor
Condition& Hidden Faults	Conditioning events and hidden faults of external PIF	High-risk\Medium-risk\Low-risk
Knowledge Base	Internal PIF, for predetermined storage information that needs to be collected in decision-making	Advantage\Disadvantage
Working Memory	Internal PIF, for all kinds of dynamic factors	Advantage\Disadvantage
IntelAlg	Intelligent decision algorithm of knowledge base	Suitable\Unsuitable
Parameters System	Parameters system of knowledge base	Suitable\Unsuitable
Intelligent Level	Intelligent level of software of knowledge base	Intelligent Level1\Intelligent Level 2\Intelligent Level 3
Historical Input	Historical input information of memory of knowledge base	Reliable\Unreliable
Cog&Tend	Cognitive modes and tendencies of working memory	Advantage\Disadvantage
Pressure Load	Pressure load of working memory	Low\Medium\High
Prece&Assess	Perception and assessment of working memory	Positive\Negative
Alertness	Alertness of the software towards the current situation	High Alert\Medium Alert\Low Alert
Att Cur Task	Attention to current task	High Attention\Medium Attention\Low Attention
Att Envi	Attention to surrounding environment	High Attention\Medium Attention\Low Attention
Time Load	Time-constrained load of pressure load	Low\Medium\High
Task Load	Task-related load of pressure load	Low\Medium\High
Information Load	Information load of pressure load	Low\Medium\High
Perception Threshold	Perception threshold towards the current situation	Positive\Negative
Decision Complexity	Decision complexity towards the current situation	Positive\Negative
Sense of Responsibility	Sense of responsibility towards the current situation	Positive\Negative

. As the research on the software reliability of intelligent ships is in the initial stage, the establishment of the BN model and the selection of the probability value mainly depend on the research reports of unmanned ship projects and related papers.

The software system is the core of the unmanned ship system, and it plays different roles in different scenarios. In Section 2, ESD is divided into three main situations, namely normal, communication failure and emergency response situations. In these three situations, the problems that an unmanned ship needs to face and the urgency of the problems are different. Therefore, although the BN model’s structure is the same, the CPT of the BN model is different according to different situations, as is depicted in Figure 9. Appendix A lists the CPT settings of the BN model of software reliability in this paper under different situations.

(1)

The work of software in the initial stage of ESD belongs to the normal situation. This is because it is impossible to judge the current situation before determining the risk. Therefore, when dealing with the work of PE 2/3/4, the CPT of the normal situation is applied in the BN model of software reliability.

(2)

Compared with the normal situation, when the communication fails, the unmanned ship needs to predict the collision avoidance intention of the target ship more and predict the content of the decision. Although there are special countermeasures in previous studies [27], this is still not easy. Therefore, the software system uses a different combination of CPTs from the normal situation when dealing with PE 8.

(3)

The emergency response situation is an urgent situation. In an emergency response situation, the distance between the encountering ships is relatively short, and the process of decision-making and control is complicated. The time load of the software system is also at a high level. Therefore, another set of CPT values is applied in the emergency situation.

4. HCL Model for Ship Collision Risk Analyses of the Hybrid Scenarios

4.1. Differences between U-M Scenario and M-U Scenario

In the future scenario, unmanned ships and manned ships should have significant signs on their appearance, such as hanging a flag or spraying painted signs marking the intelligent level of the own ship, AIS, GPS signals, etc. In this way, it is convenient to confirm each other’s identity for the first time in the encountered situation. In the hybrid scenario, the difference between M-U and U-M is the position of the unmanned ship and the manned ship. Considering the natural advantages of the unmanned ship compared with the manned ship in risk discovery, decision-making and ship maneuvering, unmanned ships should take active measures to avoid collision earlier and more actively. In this case, the unmanned ship is the main participant of the whole scenario, which is the U-M scenario. The manned ship only needs to cooperate with the avoidance or take no measures to go straight like the stand-on ship in the M-M scenario. The M-U scenario is the opposite. Due to various reasons, the manned ship becomes the main decision-maker and action-taker of the encounter scenario, while the unmanned ship is in a passive position.

4.2. HCL Model for Hybrid Scenarios

Although the normal operating procedures of unmanned ships have not yet been defined, the unmanned ships cannot be modeled in the same way as the manned ships due to the lack of an onboard crew. This difference becomes even more clear in hybrid scenarios. Moreover, the following points of ship collision accidents can be inferred:

(1)

The communication between manned and unmanned ships is no longer effective. Among the 50 accident reports, at least 15 cases mentioned communication problems between involved ships. Communication problems were the main reasons for the accident in eight cases [24]. This illustrates that even in the current M-M scenario, communication is a non-negligible factor that causes accidents. In the hybrid scenario, this phenomenon will become even more apparent. Even if there was a simple way to express and communicate decisions instantaneously between the two ships in the future, it is expected that this information exchange will be very limited compared to the open communication channels between captains available nowadays. Therefore, in the ESD of the hybrid scenario, communication is set to a very low probability value in the U-U scenario;

(2)

The ship collision avoidance hybrid scenario differs if modeled from the perspective of an unmanned ship or the perspective of a manned ship. Although the same logical sequence of events is followed in these two sub-cases, the probabilities of end states will vary depending on the type of OS. Thus, during the actual modeling process, the hybrid scenario can be subdivided into two categories depending on whether the OS is a manned ship or an unmanned ship. When the OS is a manned ship (the M-U scenario), the model can be regarded as a continuation of the M-M scenario, except that the relevant parameters of the PE 13 (target ship measure) are from the U-U scenario. When the OS is an unmanned ship (the U-M scenario), the model is built in a similar way. The ESDs of the hybrid scenarios developed using these two assumptions are given in Figure 10;

(3)

According to Figure 10, all BN models and FT models come from the M-M scenario in the M-U scenario. In contrast, when building the U-M scenario, all BN models and FT models come from the U-U scenario. This part follows the same modeling idea as the U-U scenario. In the U-U scenario, the FT model of the steering system is also directly adopted from the M-M scenario.

5. Results and Analysis of Risk Analysis of Ship Collision Accident Scenarios

Risk Results of the HCL Model for Unmanned Ships

In the previous research [24], the conventional ship collision scenarios are modeled with the Trilith software, which is specially developed for HCl analysis. The software is developed with a cross-platform computational engine, and a cross-compatible command-line tool is applied to quantitative analysis of the time-dependent HCL model with uncertainty factors. The main functions of the Trilith software include risk scenario modeling, analysis tools and other applications. Once the HCL model has been built, the analysis tools can be used to assist analysts to output the minimum cut set of each end state in the ESDs, the results of sub-models, and to measure the importance of events or elements by setting specific situations.

The four main models of ship collision avoidance scenarios have been quantified using Trilith to obtain all the risk metrics. The probability values of all the end state events of all the scenarios are listed in

Table 5. Probability values of all end state events of all scenarios.

End State	End State Type	Probability of Different Scenario
		M-M	M-U	U-M	U-U
E1	Safe	0.1236	1.91$\times {10}^{-11}$	4.97$\times {10}^{-11}$	4.97$\times {10}^{-11}$
E2	Collision due to Mechanical Failure	0.0051	7.88$\times {10}^{-13}$	4.86$\times {10}^{-13}$	4.86$\times {10}^{-13}$
E3	Collision due to Human Error	0.0700	1.08$\times {10}^{-11}$	\	\
E3	Collision due to Software Failure	\	\	1.20$\times {10}^{-11}$	1.20$\times {10}^{-11}$
E4	Safe	0.0713	0.2019	0.4734	0.4734
E5	Collision due to Mechanical Failure	0.0066	0.0188	0.0046	0.0046
E6	Collision due to Human Error	0.0305	0.0864	\	\
E6	Collision due to Software Failure	\	\	0.1442	0.1442
E7	Safe	0.1611	0.1104	0.1703	0.0966
E8	Collision due to Mechanical Failure	0.0230	0.0158	0.0017	0.0009
E9	Collision due to Human Error	0.1277	0.0875	\	\
E9	Collision due to Software Failure	\	\	0.0736	0.0418
E10	Collision due to Human Error	0.3444	0.2359	\	\
E10	Collision due to Software Failure	\	\	0.1052	0.0596
E11	Safe	0.0366	0.2433	0.0269	0.1788
	Safe	0.3926	0.5556	0.6707	0.7488
	Collision due to Mechanical Failure	0.0349	0.0346	0.0063	0.0056
	Collision due to Human Error	0.5725	0.4098	\	\
	Collision due to Software Failure	\	\	0.3230	0.2456

, and the fractions of the three different end-state types (i.e., Collision due to Human Error, Collision due to Software Failure, Collision due to Mechanical Failure, and Safe) to the sum of all ends states for each scenario are shown in a bar chart, as shown in Figure 11.

The following conclusions can be drawn from Figure 11 and Table 5:

(1)

The collisions caused by human factors account for 90.93% of the total in the traditional collision avoidance scenario (M-M scenario). Considering that the industry consensus is that 75–96% of marine accidents are human factor-related [37,38], this result is reasonable. Compared with the M-M scenario, it can be seen that the safe end states of other ship collision avoidance scenarios have been effectively improved with the introduction of unmanned ships. This phenomenon is still apparent, even in the hybrid scenarios (M-U and U-M scenario). In the U-U scenario, the probability of successful and safe collision avoidance increases to more than 70%;

(2)

Even if the unmanned ships are independent of each other and do not exchange any information, their deployment significantly improves the safety of the ship collision avoidance scenarios compared to traditional ships. This is mainly due to the hardware and software being more reliable than the crew.

6. Discussion and Conclusions

This paper presents the qualitative and quantitative analysis of collision scenarios of manned and unmanned ships based on the previous study [24]. By using the HCL methodology to model different ship collision scenarios, the goal of this research was to assess whether the introduction of unmanned ships would make a difference in the occurrence rate of ship collision accidents. The scope of the study is limited to conventional traffic safety hazards—all known (e.g., piracy, terrorism) or unknown (e.g., hacking, remote hijacking) intentional damage to the vessel is not taken into account. Based on the above reasons, the analysis of this article is not comprehensive. Moreover, the available information of the unmanned ships, including normal operation mode and related navigation rules, are so limited that detailed qualitative and quantitative results are currently impossible. Another issue that affects the completeness of the results is that the existing reliability analysis methods are designed for the use of manned ships that do not depend on a lot of software.

It is generally known that the introduction of the unmanned ships will bring about disruptive changes to the entire shipping industry, and the existing methods for software reliability analysis will also have to face profound changes. Although different scenarios are analyzed on the base of the most basic logical similarities and consider the changes involved as comprehensively as possible, such defects are also unavoidable. Based on this, the results of this study should be rather seen as a useful attempt to study this issue and an introduction to further discussion, both qualitatively and quantitatively.

The results supported by the existing literature indicate that a huge challenge will gradually emerge with the introduction of unmanned ships, especially from the perspective of safety. On the one hand, damage assessment and control is believed to be one of the greatest difficulties for unmanned ships—there will be an alarming scenario that humans will no longer be present at the scene of the accident and mitigate the consequences in the critical moments after the accident. The main reason for deploying unmanned ships is preventing accidents rather than offsetting their consequences. On the other hand, the analysis results of this paper show that even if there is no communication between ships involved in the scenarios, unmanned ships still have the potential to effectively reduce the risk of ship collision accidents. Qualitative research on other accidents has also reached similar conclusions.

Efficiency and safety are the eternal themes of water transportation. They are among the top priorities of the maritime industry in terms of safeguarding human life. However, the potential consequences of maritime disasters can be enormous and multifaceted and, at most of the time, full of various uncertainties. This requires the on-site emergency crew to adapt to different problems. On the other hand, emergency management after an accident is crucial in accident rescue, as well as in reducing the spread of consequences. It is difficult for even experienced staff to take appropriate actions to offset its range, regardless of the performance of unmanned ships.

Nevertheless, unmanned merchant ships are on the way, despite various social, legal, and technological concerns. It is necessary to gather more information on the normal operating conditions of these ships and to obtain a complete picture of the safety of unmanned ships, which in turn requires the assessment of the accident consequences too. Most importantly, all the anticipated hazards must be predicted, and their magnitude evaluated. Only in this way can the safety level and hidden danger associated with unmanned ships be adequately assessed. The research in this article is just the first step in this long process.