1. Introduction
Benefiting from the development of technology and the testing experience of unmanned surface vehicles, the deployment of unmanned cargo ships, which can travel across the oceans autonomously, has been boosted by the rising pressure of maritime safety, crew costs rising, and environmental protection. It is expected that the first unmanned cargo ship will be commercially available by 2035 [
1,
2]. Subsequently, waterway transport will enter a new era, in which both conventional ships and unmanned ships will be sailing on the same water simultaneously. In this paper, such scenarios are called hybrid scenarios, or more specifically, the Manned–Unmanned (M-U) scenario and Unmanned–Manned (U-M) scenario. The same naming convention of scenarios is used for Manned–Manned (M-M) scenarios and Unmanned–Unmanned (U-U) scenarios. The hybrid scenarios will remain relevant for quite a long period until the conventional ships are totally replaced. However, there is no convincing evidence that maritime safety will be increased by gradually adopting unmanned ships [
3,
4]. This worry is not without reason, especially when it comes down to scenarios involving critical events, such as ship encounter situations with collision risk, which need all the involved ships to communicate and accompany each other.
Research and development (R&D) activities have been initiated in recent years around the world for the development of unmanned cargo ships [
5,
6]. In general, there are at least three modes of operation for an unmanned cargo ship that can adapt to hazardous conditions: fully manned, remote-controlled, and fully autonomous. According to Lloyd’s Register scale, the unmanned cargo ship with autonomy level 5 (AL5) [
7] should be able to travel across oceans autonomously or rarely supervised, performing real-time navigation risk identification, navigational states assessment, and instant decision-making at the total ship level. Besides, the ship should be able to switch to remote control via maritime satellite whenever a shore-based operator deems it necessary, such as in challenging emergency conditions in which the ship cannot recover by itself [
8]. For example, the research team of the Maritime Unmanned Navigation through Intelligence in Networks (MUNIN) project [
3,
9], one of the unmanned bulk carriers development projects, have attempted to suggest a risk-based design method based on Formal Safety Assessment (FSA) [
10]. However, FSA also has some problems, such as insufficient consideration of human-related factors, over reliance on expert judgment and over-generalization of methods [
11]. The authors use different risk analysis methods to study the safety of unmanned ship [
12,
13], and draw conclusions that the unmanned ships tend to be safer than the traditional ships, despite acknowledging that necessary information about the ship’s design and operation is still missing. Our analysis intends to qualitatively and quantitatively evaluate the safety improvement. Moreover, the potential hazards studied in this research are mostly human-related, although the analysis of subsequent events following accidents is expected to be important for unmanned ships given that they do not have a physical onboard crew. Wróbel et al. [
12,
14] studied this problem by using a what-if analysis framework and data from one hundred maritime accident reports. Their research is divided into two parts: the potential impact on the occurrence and consequences of maritime accidents, and the probability of occurrence of such events. Due to the limited available information and lack of objective accident data [
15], the research is only qualitative and summary. Nevertheless, the author’s expectation is a decrease in the probability of occurrence, while the consequences of maritime accidents involving unmanned ships are expected to be much larger compared to the conventional ones.
From the very limited literature in the area of unmanned waterway transport, one of the main challenges of unmanned ships is the need for analyses of their safety [
16]. The main argument in favor of the research into unmanned ships is the increase in maritime safety. This is expected to be accomplished by eliminating or reducing the accidents involving the onboard crew by merely reducing the crew size. However, instead of migrating and disappearing entirely, the crew may work in a remote shore-based command center [
17]. In turn, this configuration may create some new problems, such as situations in which the damage cannot be counteracted in a timely way by crews mobilized to reach the scene of the accident [
12]. Among the different kinds of maritime accidents, it is generally considered that the probability of the occurrence of ship collision accidents will benefit the most from the deployment of unmanned ships [
18]. In practice, to identify and maneuver a ship on a collision course with another ship is a complex task [
19,
20]. Although the commonly used navigation equipment, such as maritime radar/Automatic Radar Plotting Aid (ARPA) and Automatic Identification System (AIS), play a significant role in navigation, they still have various problems in practical use. Due to the huge inertia and typical under-actuation of most cargo ships, communication and cooperation are always needed during the whole process [
21,
22]. Within most autonomous decision-making algorithms designed for unmanned ships [
23], collision avoidance is just a part of path planning, constructed with dynamic obstacles avoidance, traffic regulations (e.g., Convention on the International Regulations for Preventing Collisions at Sea (COLREGs), formulated by IMO, 1972) and motion constraint obedience. In most projects, communication with the target ship is not designed as an essential part of the collision avoidance process for unmanned ships, particularly in the hybrid scenario. Considering that the hybrid scenario will be the status quo until all the manned ships are replaced, it is necessary to evaluate the potential impact of unmanned vessels on ship collision accidents.
Based on the previous work of the risk assessment of two conventional ships collision accidents [
24], this article aims to generalize the HCL model of the future ship collision avoidance scenario with unmanned ships on the basis of the HCL model of the conventional scenario established in the previous study. Firstly, ship collision scenarios have a high degree of consistency of event sequence at the logical level. For example, collision avoidance decisions must be made after risk detection and confirmation. From this point, encountered ships with different levels of automation can be seen as ships with different decision-making methods and maneuver preferences. Secondly, the HCL methodology allows analysists to study different generation processes of the same event in similar scenarios, such as decision failure, which can be caused by human error or software failure. Finally, the quantitative analysis can be carried out on the basis of the HCL model to some extent.
The remainder of the paper is organized as follows:
Section 2 gives a short introduction of the previous study of the HCL model of the M-M scenario. In
Section 3, the HCL model of the U-U scenario is constructed by some assumptions of the application of unmanned ships. In
Section 4, the HCL model of hybrid scenarios is built based on the models of the M-M scenario and the U-U scenario. The results of the risk assessment of ship collision accident scenarios for the various types of vessels are shown in
Section 5. Finally, some discussions and conclusions are given in
Section 6.
2. Overview of the HCL Model for Ship Collision Risk Analyses of the M-M Scenario
In the previous paper, the ship collision accident of the conventional scenario was modeled based on 50 ship collision accident investigation reports.
The initiating event (IE) of the event sequence diagram (ESD) occurs when the distance to the closest point of approach (DCPA) is less than a predefined minimum safe distance. The ESD in
Figure 1 illustrates the following pivotal event (PE) sequences caused by the initiating event, which is a graphical representation for all the possible accident scenarios. The events and related details are listed in
Table 1. The whole ESD can be divided into three main parts: the collision risk identification and confirmation, the own ship’s (OS’s) decision-making and communication with the target ship (TS), and OS’s response action under different conditions. There are eleven end states following the various response actions and systems performance.
There are three main logic paths in the ESD after the collision risk identification (PE 3):
- (1)
The scenarios with successful communication with TS—This will lead to a collaborative effort between both sides for avoiding a collision (PE 4\5\6\7, End 1\2\3);
- (2)
The scenarios with failed communication with TS—This will lead to a unilateral effort of collision avoidance (PE 4\5\8\9, End 4\5\6);
- (3)
The scenarios under emergency conditions—Since it is under emergency conditions, both ships do not have time to communicate with each other and only take recovery measures based on their assessment alone (PE 4\10\11\12, End 7\8\9\10).
The HCL model of M-M scenario also includes Fault Trees (FTs) and Bayesian Networks (BNs) associated with PEs in ESD, as well as the assignment of related probability values. Detailed analysis and the modeling process can be seen in the previous paper.
3. HCL Model for Ship Collision Risk Analyses of the U-U Scenario
3.1. The Effect of Unmanned Ships on the Likelihood and Consequences of the Accidents
Based on the HCL model of the M-M scenario in
Section 2, the ship collision scenarios will be analyzed in the following sections. Due to the discussion about how the unmanned ships will actually be operated in reference [
25,
26], the assumption is applied that the unmanned ship will keep the automatic mode in most of its entire voyage until approaching a certain point outside the port. Subsequently, the shore-based center operator would take over the control and remotely control the ship to complete the berthing process. This navigation process is similar to the current pilotage process in conventional navigation. To take advantage of the unmanned ship’s capabilities and reduce the extra expenditure, the ship owners are likely to keep the vessel in automatic mode as long as possible. Based on this assumption, a preliminary ship collision scenario involving unmanned ships can be sketched.
Out of all the global maritime accidents, the ship collision accident constituted as much as 36% of the total amount [
27]. According to the investigation, most of the accidents were navigation-related human errors [
28]. A consensus has been reached that the deployment of unmanned ships could enable avoiding accidents due to human errors [
29]. However, for the type of collision accidents due to the bridge team’s non-compliance in detecting the target ship or navigational danger, which is in violation of Rule 5 of COLREGs, “Look-out”, the unmanned ships being equipped with a sensor and optimizing risk identification and decision algorithms, such as lidar and infrared cameras, can help eliminate those events [
30]. Updating the sensing and cognitive abilities has become of interest in the recent unmanned ship Research and Development (R&D) projects, and this also meets the COLREG’s requirement about increasing detection methods to cope with the lack of radar detection capabilities [
31]. Thus, a reduction in the likelihood of collision accidents is to be expected given that all the new systems perform better than the crew they replace.
However, even if the likelihood of collision accidents can be reduced, it is difficult to draw the same conclusion about the consequences of such events. In the process of ship collision avoidance practice, the crews on board played an important role in damage reduction and self-rescue processes after the accident. For instance, when the damage was significant or the recovery was complicated, needing the shore parties’ assistance, the survivors had to be picked up by the other encountered ship. There is no evidence showing that the unmanned ships have the function of picking up survivors, nor the purpose of cooperating in case of an emergency. Therefore, once the two ships collide in the hybrid scenario, the crew on the manned ship may be in a more challenging situation than the traditional scenario (M-M scenario).
It should be noted that the ademption in this paper is only a first try at modeling future ship collision accidents. By changing the structure of the FT or BN in the existing HCL model and qualitatively adjusting the probabilities of the risk influencing factors (RIF), we can examine the ship collision accident in the hybrid and the U-U scenarios with a relatively high degree of resolution.
3.2. Basic Assumptions and Construction of U-U Scenario
Since the hybrid scenario can be seen as a combination of the M-M scenario and U-U scenario, the HCL model of the ship collision accident for the U-U scenario is presented firstly on the basis of the M-M scenario model. The unmanned ship analyzed here is set to be at least at the AL-5, the lowest level of fully autonomous ship according to Lloyd’s Register guidance 2016. In this future scenario, the advantages of unmanned ships are maximized, and the impact of human factors is minimized for the vast majority of commercial shipping activities. According to the known unmanned ship R&D projects, the unmanned ship functions can be simply divided into three main parts: information gathering through sensors, decision-making, and controlling.
Figure 2 illustrates the main differences between manned ships and unmanned ships in ship collision scenario. To facilitate the application of HCL methodology, four basic assumptions are proposed, as follows:
- (1)
The risk perception system of the unmanned ship is a collection of modern sensor technologies. For instance, the lidar and camera are often used to form the visual system of unmanned ships. The FT model of OS alarm failure for collision risk is extended. The models of the lidar system and camera system are appended in it according to the latest sensor application and unmanned ship development. Due to the uncertainties in the development of machine vision systems, a new BN is modeled to analyze the impact of external environment factors on sensor performance;
- (2)
Currently, there is no industry consensus on the solutions for the communication between unmanned ships or between manned ships and unmanned ships. In most of the current designs, unmanned ships are able to perform reliable autonomous collision avoidance maneuvers without communicating with the target ship. Therefore, it is assumed that there is no communication between the unmanned ship and other encountered ships in a ship collision scenario in the proposed model. The probability of the communication-related PE (PE 5\6\7 in
Figure 1) is set to a small value (i.e., 1
), which naturally does not happen;
- (3)
The decision-making system is a software-only system, including the communication function between OS and the shore-based center. All PEs related to decision-making in ESD (PE 2\4\5\6\8\10\11 in
Figure 1) are part of the decision system of the unmanned ship, and the probability of these events is the probability of the software reliability of the unmanned ships. The ESD’s PEs in which unmanned ships perform decision-making activities are converted from BNs representing human factors to BNs representing software reliability. All the structure and values of the software reliability are modeled according to the software industry practices;
- (4)
In fact, it is speculated that in the process of unmanned ship navigation, the most concerning risks have changed from these “soft” factors to “hard” factors such as the reliability of sensors and mechanical systems. The hardware configuration of unmanned ships has not yet reached maturity in the industry, thus most of the currently unmanned ship R&D project designs look like the traditional ships equipped with sensors and digital control equipment. Therefore, in this paper, the same FT structure and parameters of propulsion and steering are adapted for mechanical failure events (PE 7\9\12) of both manned and unmanned ships.
Based on these assumptions, the ESD of the HCL model for the M-M scenario (
Figure 1) can be developed into
Figure 3. The PE 1 OS alarm is linked with an extended FT (shown in
Figure 4) that includes the lidar and cameras, the most important hardware sensor system for unmanned ships. As the sensors of the enhanced vision system are influenced by the uncertainties of the environment, the basic events OSLidarSensor and OSCamera of the FT are linked to a new BN that is shown in
Figure 5. The PE 7\9\12 and their linked FTs remain the same as in the M-M scenario according to assumptions (2) and (3). In U-U scenario, the PE 2 (OW Identifies Collision), PE 4 (OS Response Strategy Decision), PE8 (OS Crew Response Action with Failed TS Communication), PE 10 (OS Response Strategy Decision for Emergency) and PE 11 (OS Crew Response Action for Emergency) are linked with the reliability of the software system instead of the human-related BNs in M-M scenario. Given the lack of the reference for the intelligent software system’s reliability assessment, an attempt is made in
Section 3.4 and a BN model of software reliability is made based on the analysis. Finally, the probability of PE 13 Target Ship’s Measures is determined in the same way as in the M-M scenario.
3.3. Fault Trees Model of U-U Scenario
The hardware factors related to PE 1 (OS Collision Alarm) of the ESD are extendedly modeled by performing a functional decomposition of the risk detection system of unmanned ships. According to the previous assumption, the FT model of alarm failure for unmanned ships is shown in
Figure 4.
The failure events of ARPA failure and AIS failure are the same with the FT model of the manned ship. The lidar failure and machine vision failure are both composed of hardware failure, software algorithm failure and an AND gate. In practice, the uncertain environmental factors are one of the important factors that affect the performances of environment perception sensors, such as lidar and camera. To further determined the impact, sensor effectiveness is modeled with BN, which is shown in
Figure 5.
3.4. Bayes Networks Model of U-U Scenario
In the HCL methodology, the BN method is applied to quantitatively analyze the performance influencing factor (PIF) for PEs with uncertainty factors. For each PE that requires BN modeling analysis, the established BN model consists of one PE node and several PIF nodes. The PE node is the analysis object, and the result of BN analysis is directly transmitted to ESD for calculating the probability of the end state. The PIF nodes are the factors that affect the analysis object in the performance of ship collision avoidance, including environmental factors, operator state factors, safety culture factors, and so on. The interaction between these factors and PE is very complex and involves much uncertainty. It is not possible and appropriative to use FT to model and analyze, while BN modeling is suitable in this situation. For example, the software-related failure events, such as the reliability of the input information and the decision complex, are among the most important contributors to a collision accident. These two concepts, together with other concepts that affect software system reliability, are analyzed and modeled later in detail in this section.
3.4.1. Bayes Network of Sensor Effective
Figure 5 illustrates the BN structure of sensor effectiveness, which is linked with the basic events Lidar Sensor Failure and Camera Failure of the FT model in
Figure 4. Only factors that affect the PE node are analyzed in this BN, and the standard of the level setting of the BN’s nodes are based on the degrees of impact. The descriptions, level labels and conditional probabilistic table (CPT) of the BN model of sensor effectiveness are listed in
Table 2. Lidar and camera are representative sensors for unmanned ships to perceive the external environment. On the one hand, this kind of sensor needs to keep sensitivity to the external environment. On the other hand, it needs to overcome the uncertainties in the external environment. Therefore, the reliability of a sensor’s performance is affected by different uncertain environment factors. For the lidar and camera, wind, wave and visibility are important factors affecting sensor performance. Among them, wind and wave will interfere with lidar’s target and obstacle recognition. Poor visibility conditions, such as rain, snow, fog and haze, will affect the signal collection of sensors. Similarly, the camera is also influenced by these two factors. It should be noted that the impact of illumination on the effectiveness of the sensor system is obviously less than that on the conventional manned ship. However, based on the research of the previous literature on the impact of daylight on the sensor performance of the camera [
32] and lidar [
33], the illumination condition is still an important factor.
3.4.2. Bayes Network of Software Reliability
According to the current development information for unmanned ships, the decision-making of unmanned ship also follows the same cognitive model as that of conventional ships, that is, risk situation awareness, collision avoidance decision-making and control signal sending.
Figure 6 illustrates the composition and structure of a typical unmanned ship’s intelligent software system [
34]. The function module design, information processing and conversion of the system can be regarded as the digital presentation of the human decision-making process. In the ship collision scenario, all the functions are mobilized to deal with the collision risk. According to the research on the PIFs of the human reliability model based on the human cognitive process [
35,
36], the PIFs of the unmanned ship’s software can be obtained by analogy. The PIF of the unmanned ship’s software system is divided into internal the PIF group and external PIF group, which are used to represent the influence of the internal and external state of the intelligent decision-making system on its decision-making process. The contents are listed in
Table 3.
It can be seen from
Figure 6 that the performance of the unmanned ship’s software system is restricted by various internal and external factors. External PIFs refer to various impact factors outside the software system. Data reliability, environmental factors of navigation, and hardware factors will all restrict the software system’s perception of the outside world, affect the ship’s hydrodynamic performance, and finally effect the decision-making and control systems. Conditioning events and hidden faults are inevitable, especially in sailing. Even though the software system should have a response plan for the unpredictable hazards, unexpected or unknown disruptions are still one of the most important factors causing navigation risks and accidents [
18].
In contrast to external PIF, internal PIF is a direct factor that affects the running state of the software system. Some of these factors are due to defects in the software design and development stage, and some are due to the complexity of the current situation, which exceeds the capacity of the software system. The problems caused by software design defects are long-term and will affect the entire life cycle of unmanned ships. The problems caused by the current situation are short-term and will only have an impact in the current task. In this paper, the former type of internal PIFs is called knowledge base factors, and the latter type is called working memory. Both concepts are borrowed from cognition-based human reliability assessment methods [
35]. In the software system reliability analysis of unmanned ships, knowledge base factors are divided into four categories, namely, intelligent decision algorithm, parameter system, intelligent level of software and input information of memory. The analysis of working memory is more complicated. First of all, working memory is divided into three parts: cognitive modes and tendencies, pressure load and perception and assessment according to different aspects of influence. Then, each part is divided into several basic elements. A detailed description of the PIF is given in
Table 3.
Figure 7 illustrates the interaction among various PIFs and the influence of logic on the performance of collision avoidance behavior at the cognitive and decision-making level of unmanned ships. In
Figure 7, external PIFs can affect the reliability of the software system only by activating internal PIFs. The internal PIFs have a direct impact on the performance reliability of the intelligent system under the joint action of external PIFs and input information. The internal PIF is mainly divided into knowledge base and working memory. Knowledge base is predetermined storage information that needs to be collected in decision-making process. Working memory contains a variety of dynamic factors, together with real-time input information, affecting the current running state of the software. Internal PIFs can affect decision performance in many aspects, including the timing of decision-making, the efficiency of algorithm execution, the collaborative processing ability of different functions between systems, and the collaboration between software and hardware systems.
The PIF’s influence on software reliability is also an uncertain process, so a BN is applied to model and analyze the uncertain influence. The BN model of software reliability is shown in
Figure 8. The detailed description of each node and the classification setting of CPT are listed in
Table 4. As the research on the software reliability of intelligent ships is in the initial stage, the establishment of the BN model and the selection of the probability value mainly depend on the research reports of unmanned ship projects and related papers.
The software system is the core of the unmanned ship system, and it plays different roles in different scenarios. In
Section 2, ESD is divided into three main situations, namely normal, communication failure and emergency response situations. In these three situations, the problems that an unmanned ship needs to face and the urgency of the problems are different. Therefore, although the BN model’s structure is the same, the CPT of the BN model is different according to different situations, as is depicted in
Figure 9.
Appendix A lists the CPT settings of the BN model of software reliability in this paper under different situations.
- (1)
The work of software in the initial stage of ESD belongs to the normal situation. This is because it is impossible to judge the current situation before determining the risk. Therefore, when dealing with the work of PE 2/3/4, the CPT of the normal situation is applied in the BN model of software reliability.
- (2)
Compared with the normal situation, when the communication fails, the unmanned ship needs to predict the collision avoidance intention of the target ship more and predict the content of the decision. Although there are special countermeasures in previous studies [
27], this is still not easy. Therefore, the software system uses a different combination of CPTs from the normal situation when dealing with PE 8.
- (3)
The emergency response situation is an urgent situation. In an emergency response situation, the distance between the encountering ships is relatively short, and the process of decision-making and control is complicated. The time load of the software system is also at a high level. Therefore, another set of CPT values is applied in the emergency situation.
6. Discussion and Conclusions
This paper presents the qualitative and quantitative analysis of collision scenarios of manned and unmanned ships based on the previous study [
24]. By using the HCL methodology to model different ship collision scenarios, the goal of this research was to assess whether the introduction of unmanned ships would make a difference in the occurrence rate of ship collision accidents. The scope of the study is limited to conventional traffic safety hazards—all known (e.g., piracy, terrorism) or unknown (e.g., hacking, remote hijacking) intentional damage to the vessel is not taken into account. Based on the above reasons, the analysis of this article is not comprehensive. Moreover, the available information of the unmanned ships, including normal operation mode and related navigation rules, are so limited that detailed qualitative and quantitative results are currently impossible. Another issue that affects the completeness of the results is that the existing reliability analysis methods are designed for the use of manned ships that do not depend on a lot of software.
It is generally known that the introduction of the unmanned ships will bring about disruptive changes to the entire shipping industry, and the existing methods for software reliability analysis will also have to face profound changes. Although different scenarios are analyzed on the base of the most basic logical similarities and consider the changes involved as comprehensively as possible, such defects are also unavoidable. Based on this, the results of this study should be rather seen as a useful attempt to study this issue and an introduction to further discussion, both qualitatively and quantitatively.
The results supported by the existing literature indicate that a huge challenge will gradually emerge with the introduction of unmanned ships, especially from the perspective of safety. On the one hand, damage assessment and control is believed to be one of the greatest difficulties for unmanned ships—there will be an alarming scenario that humans will no longer be present at the scene of the accident and mitigate the consequences in the critical moments after the accident. The main reason for deploying unmanned ships is preventing accidents rather than offsetting their consequences. On the other hand, the analysis results of this paper show that even if there is no communication between ships involved in the scenarios, unmanned ships still have the potential to effectively reduce the risk of ship collision accidents. Qualitative research on other accidents has also reached similar conclusions.
Efficiency and safety are the eternal themes of water transportation. They are among the top priorities of the maritime industry in terms of safeguarding human life. However, the potential consequences of maritime disasters can be enormous and multifaceted and, at most of the time, full of various uncertainties. This requires the on-site emergency crew to adapt to different problems. On the other hand, emergency management after an accident is crucial in accident rescue, as well as in reducing the spread of consequences. It is difficult for even experienced staff to take appropriate actions to offset its range, regardless of the performance of unmanned ships.
Nevertheless, unmanned merchant ships are on the way, despite various social, legal, and technological concerns. It is necessary to gather more information on the normal operating conditions of these ships and to obtain a complete picture of the safety of unmanned ships, which in turn requires the assessment of the accident consequences too. Most importantly, all the anticipated hazards must be predicted, and their magnitude evaluated. Only in this way can the safety level and hidden danger associated with unmanned ships be adequately assessed. The research in this article is just the first step in this long process.