Attachment Report of the MEGURI2040 Safety Assessment

Risk analysis procedure for MASSFY 2023 Edition
Japan Ship Technology Research Association
National Maritime Research Institute

Table of Contents
1.

Outline ....................................................................................................................................... 32.

Key Principles ............................................................................................................................ 3
2.1 Target ships of this manual .................................................................................................. 3
2.2 Target risk analysis of this manual ....................................................................................... 3
2.3

Definition of terms ............................................................................................................... 3

3.

Outline of risk analysis procedure ............................................................................................. 5

4.

Documents to prepare ................................................................................................................ 6

5.

4.1

Documents necessary for an analysis of the initial design ................................................... 6

4.2

Documents necessary for an analysis of the detailed design................................................ 7

Tasks performed at each step of a risk analysis ......................................................................... 7
5.1

Preparation for an analysis ................................................................................................... 7

5.2

Working group ..................................................................................................................... 8

5.3 Consensus on the analytical conditions................................................................................ 8
5.4

Performing analysis and assessment .................................................................................. 11

5.4.1

Identifying hazards .................................................................................................. 11

5.4.2

Indexing risks .......................................................................................................... 13

5.4.3

Risk analysis and assessment of the initial design .................................................. 13

5.4.4

Risk analysis and assessment of the detailed design ............................................... 14

5.5 Report.................................................................................................................................14
Annex 1. An example of hazards to consider .......................................................................... 16
Annex 2.

Outline of common risk analysis methods ............................................................... 19

Appendix 1. A practical example of risk analysis on a phase II autonomous ship ......................... 22
Appendix 2. A practical example of risk analysis on a demonstration experiment of phase III
autonomous ship ............................................................................................................................... 131
Appendix 3. A practical example of risk analysis on a phase III autonomous ship ...................... 252
References ..................................................................................................................................... 293― 1 ―― 2 ―

1. Outline
MASS (Maritime Autonomous Surface Ships) have been developed in recent years and guidelines
for MASS have been published by multiple classification societies and flag states. International Maritime Organization (IMO) has published interim guidelines for MASS trials to safely conduct thedemonstration experiment. These guidelines require the implementation of risk analysis, but specificprocedures are not indicated. Thus, in this manual, we present concrete steps of a risk analysis for
MASS which carried out at the design and/or MASS trial. It contributes to better safety and promotionof development in regard to MASS.

2. Key Principles
2.1 Target ships of this manual
Though there is no international consensus on the definition of MASS and level of automation, thismanual focuses on phase II and phase III autonomous ships of “Roadmap to Realize Autonomous
Ships” by Maritime Bureau, Ministry of Land, Infrastructure, Transport and Tourism (phase II autonomous ships: ships on which sailors, the ultimate decision makers, are supported by the operation fromland and/or the proposal by artificial intelligence (AI), phase III autonomous ships: ships with a highdegree of autonomy and is designed for situations where the final decision-maker is not a sailor.).

2.2 Target risk analysis of this manual
As MASS, conventionally designed, built, and operated ships are partially redesigned or equippedwith an automation system. Because ships that are conventionally designed, built, and operated are
sufficiently safe, further risk analysis of the ship itself is unnecessary. Therefore, the risk analysis of
the present manual analyzes hazards associated with parts and operations different from conventional
ships.

2.3 Definition of terms
Table 2.1 shows the definition of main terms used in this manual.
Table 2.1. Definition of terms.
Terms
Risk

Definition
A measure of the likelihood that an undesirable event will occur together witha measure of the resulting consequence within a specified time, i.e., a combination of the frequency and severity of the consequence. [1]HazardA factor leading to harm to life, health, property or environment. It is also referred to as the hazard factor. [2]― 3 ―Accident

sce-When a series of stages up to harm is assumed from the initial condition in

nario

which the potential for hazard exists, its description is called a scenario. [2]Risk treatment

Refers to a single or multiple measures taken to reduce risks. Measures include
avoidance of hazard, reduction of consequences, and reduction of the likelihoodof consequences from hazards.

HAZID

Acronym for HAZard IDentification.

FI

Initialism for frequency index. Frequency is converted to a common logarithm.

SI

Initialism for severity index. Severity is converted to a common logarithm.

RI

Initialism for risk index. Risk is converted to a common logarithm and obtained
as a sum of FI and SI.

HAZID

work-

shop

A workshop held to identify hazards. In addition to identifying hazards, FI, SI,
and RI are often determined and risk treatments are considered, some of which
are merely proposed while others provide estimates of their effects to decision
makers for more effective risk treatment.

Task

Combination of operations and work that constitute ship operation according to
the automation system design. “Tasks” vary depending on target, coverage area,and level of automation and remote control. [3]SubtaskOperations and work that constitute a task. [3]Decision-making

The subtasks related to decision making by humans, such as situation aware-subtask

ness, decision, and action. [3]Automated con-

A condition where computer systems control the execution of some or all theditiondecision-making subtasks. [4]Automated oper-

A system that automates part or all of decision-making subtasks with a com-ation

systemputer system or a combination of computer system and human. [3]Remoteopera-

A system in which a part or all the decision-making subtasks can be operatedtion

systemby a remote operator (human) or a combination of an AOS and a remote oper-

(AOS)

(ROS)

ator (human).

Assumed condi-

Principal particulars of ships equipped with an automation system, a sea route,tions of use

ship operation phase, and marine weather conditions for which an automation
system is used.

Operational de-Operational domain in which an automation system appropriately functions

sign(ODD). [3]domain(ODD)

It may be expressed as a part of assumed conditions of use.

Fallback

Countermeasures to minimize risks when the AOS/ROS cannot work properly
owing to unpredictable events such as malfunctions of the AOS/ROS and cyber-― 4 ―attack. This includes countermeasures when the AOS/ROS has deviated outside
the ODD. [4]3. Outline of risk analysis procedure
Let us explain the risk analysis procedure simply. It follows the flow shown in Figure 3.1. Pleaserefer to the Section in this manual indicated in a bracket for detailed explanation of each item.
Risk analysis is performed for the initial and detailed designs. For a risk analysis of the initialdesign, documents necessary for confirming the analytical target scope and risk analysis are prepared.
These documents are used to determine the analytical target scope and to summarize the informationthat must be confirmed for the risk analysis. Upon obtaining the consensus of those involved on theanalytical conditions, such as risk assessment criteria, the analysis and assessment are performed. Finally, a report that summarizes the above results is prepared.
Next, a risk analysis is performed on the detailed design. For the detailed design that incorporates
risk treatments recommended in the risk analysis on the initial design, specific machines and operations that were not yet determined in the initial design are assumed to analyze and assess risks in thesame flow as the risk analysis of the initial design. Since the same preparation for the analysis andconsensus on analytical conditions as that of the risk analysis on the initial design can be often used,
these can be omitted. As the result of the risk assessment, recommended risk treatments are incorporated into the final detailed design, at which the risk analysis that is the target of the present manual iscomplete.
It is noted that, in the case of risk analysis on a demonstration experiment, depending on the demonstration experiment, the experiment may be conducted after risk analysis for the initial design.

― 5 ―Initial Design
Preparation of documents (4.1)
Preparation of analysis (5.1)
Consensus on analytical conditions (5.3)
Performing analysis and assessment (5.4)
Preparation of a report (5.5)

Detailed Design

Recommended
safety measures Preparation of documents (4.2)
are incorporated
If necessary
in the detailed(Preparation of analysis (5.1))
design.
If necessary(Consensus on analytical conditions (5.3))
Performing analysis and assessment (5.4)

Recommended
safety measures
are incorporated
in the final
detailed design.

Preparation of a report (5.5)

Figure 3.1. Flow chart of procedures used for risk analysis.

4. Documents to prepare
In this Section, we explain documents that are necessary in each step of an analysis.

4.1 Documents necessary for an analysis of the initial design
When analyzing the initial design, the following documents are necessary.
(1) Functional requirements for the automation system (target tasks and subtasks of the automation).
(2) System architecture that clarifies the entire image of the automation system (it is desirable toclarify the relation between the automation system and other systems on board the ship, andclarify sensors and nautical equipment as much as possible).
(3) Outline of the internal operation of the automation system.
(4) Outline of the division of roles for the automation system and humans (includes execution transfer between the automation system and humans and fallback process).
(5) ODD of an automation system.
In the case of risk analysis on a demonstration experiment, the following document is required
addition to the above documents.
(6) Outline of a demonstration experiment (Objective of the experiment, Experimental route, Schedule, Experimental process, etc.)― 6 ―4.2 Documents necessary for an analysis of the detailed design
Risk analysis of the detailed design requires changes in documents presented in the initial design
and also documents for which parts that were unclear in the initial design are clarified.

5. Tasks performed at each step of a risk analysis
In this Section, we explain each task performed at each step of a risk analysis.

5.1 Preparation for an analysis
As the preparation of an analysis, parts of the target ship that are different from the conventional
ships must be clarified. Information such as objective, role, composition, and method of new featuresof the analytical target ship and or new use of existing facilities is summarized. Based on this information, the analytical target is defined and the analytical target scope is confirmed.
First, features and usages of facilities with new features (hereafter referred to as the new facility),
which are the analytical target, must be clarified. In addition, as the conditions of autonomous operation of the analytical target ship, the ODD, characteristics of the sea route, ship operation phase, conditions that must be maintained when deviating from the ODD, and response to such situations, mustbe summarized.
Furthermore, based on this information and specifications of the new facility, the analytical target
is modeled. This is useful in defining the analytical target, confirming the analytical target scope, andsupporting the analysis. As for modeling, elemental features for each module, such as hardware andsoftware that constitute the new facility, are broken into a level that suits the analysis and then defined.
As necessary, interaction (input, output, and so on) of elements is included in the definition. If information must be manually input or corrected, interaction between the feature and humans must be
included as well. If the elements of the new system have an interaction with the existing ship facilities,
these facilities are added to the model and the interaction between the new facility and the existing
facilities are clarified to analyze the effect of the new facility on the existing facilities. Within themodel prepared in the above procedure, the scope necessary for the objective of an analysis is definedas the analytical target scope. By using such model, understanding of the analytical target is promoted,
supporting the analysis itself. See Appendices 1-3 for examples of modeling.
As for an analysis, if data on the failures or defects in each component included in the analyticaltarget scope are available, such data must be gathered.
In summary, at the preparation stage of an analysis, the following information must be summarized.
Example of the information is included in Appendices 1-3.
 Definition of the feature.
 Objective of the feature.

― 7 ― Extent of automation and the relation between automation and the ship operator (crew onboard/remote operator).
 Extent of remote control and the relation between automation and the ship operator (crew onboard/remote operator).
 Assumed conditions of use (principal particulars of ships equipped with the new feature, searoute, ship operation phase, and marine weather conditions at which the new feature is used,and so on).
 ODD (external, internal, and communication conditions under which the new feature operates).
 Methods of autonomous navigation.
 Monitoring method of the relevant feature.
 Response procedure when autonomous navigation deviates from the ODD.
 Feature of each element, such as hardware and software, that constitutes the relevant new facility, interaction of elements, and so on (including information on the interaction between
each element and humans and between each element and the existing systems).
 Data on failures and defects of each constituent element included in the analytical target scope.

5.2

Working group
Analysis is usually performed at a workshop attended by experts of different fields and attendees

selected from experts in different fields. Below is a list of experts as an example:
Owners, ship builders, ship designers, experts with knowledge and experience of safety, design,and operation of the target system. And as necessary, ship inspectors, ship operators, safety engineers,experts of devices and human engineering, navigators, and marine engineers [5][6].

5.3 Consensus on the analytical conditions
Handling of the identified risks must be decided ahead of time. In other words, range at which risk
reduction measures must be implemented for hazards with a risk of more than a certain level must be
determined and those involved must reach a consensus. In addition, whether post-risk-treatment risks
need to be estimated must be decided. To that end, (i) indexing of risks and (ii) setting of the criteria
are necessary. Let us discuss these topics below.
(i) Indexing risks
For each accident scenario that starts with a hazard, the frequency of occurrence, the severity ofconsequences, and their product; i.e., risk, are semi-quantified (indexed). By expressing the frequency
and severity of consequences with a logarithmic scale, semi-quantification (indexing) is performed.
For determining the severity of consequences, generally, the level of effect on human life, environment,
and asset is considered. Whether all of these are the targets or choose one must be determined a head

― 8 ―of time.
With risk denoted by R, occurrence frequency represented by F, and severity of consequences denoted by S, risk is obtained using Equation (1). By converting Equation (1) into a common logarithm,
we obtain Equation (2).
R = F⋅S(1)

Log(R) = Log(F) + Log(S)(2)

We refer to risk, frequency, and severity of consequences converted to a common logarithm as risk
index (RI), frequency index (FI), and severity index (SI), respectively. Here we present examples of
FI, SI, and RI, which is a combination of FI and SI [7]. These are simply examples, and the samevalues are not required for an analysis. Thus, definition of FI and SI must be determined by those
involved. Table 5.4 is called a risk matrix.
Table 5.1. Example of the definition of FI [7].
FIFrequency

7

Frequent

Definition

F (per ship year)

Likely to occur once per month on one ship

10

5 Reasonably probable Likely to occur once per year in a fleet of 10 ships

0.1

3

RemoteLikely to occur once per year in a fleet of 1,000 ships

10−3

1

Extremely remote

Likely to occur once in the lifetime of a world fleet of

10−55,000 ships
Table 5.2. Example of the definition of SI [7].
SI

Severity

Effects on human safety

Effects on ship

S (Equivalent fatalities)

1

Minor

Single or minor injuries

Local equipment

0.01

damage2Significant

Multiple or severe injuries

Non-severe ship dam-

0.1

age
3

SevereSingle fatality or multiple severe in-Severe damage

1

Total loss

10

juries4

Catastrophic

Multiple fatalities

Table 5.3. Example of the definition of SI (environment) [7].
SI

Severity1Category 1

Definition
Oil spill size < 1 tonne

― 9 ―

2

Category 2

Oil spill size between 1–10 tonnes

3

Category 3

Oil spill size between 10–100 tonnes

4

Category 4

Oil spill size between 100–1,000 tonnes

5

Category 5

Oil spill size between 1,000–10,000 tonnes

6

Category 6

Oil spill size > 10,000 tonnes

Table 5.4. Example of the definition of RI (risk matrix) [7].
Severity index (SI)
1

2

3

4

FI

Frequency

Minor

Significant

SevereCatastrophic

7

Frequent

8

9

10

11

7

8

9

10

6

7

8

9

5

6

7

8

4

5

6

7

3

4

5

6

2

3

4

5

6
5

Reasonably probable

43

Remote21Extremely remote(ii) Setting the criteria
Judgment criteria for indexed risks; in other words, criteria are set.
Thus, criteria are set on the risk matrix of (i) first. As shown in Figure 5.1, it is common to use
three levels: “risk must be reduced,” “risk reduction must be considered,” and “no risk reduction necessary.” Risk is indexed for each hazard and accident scenario, and by comparing those with the criteria, need for risk treatment is determined.
Severity Index (SI)
1

2

3

4

Significant

SevereCatastrophic

FI

Frequency

Minor

7

Frequent

8

9

10

11

7

8

9

10

6

7

8

9

5

6

7

8

4

5

6

7

3

4

5

6

2

3

4

5

6
5

Reasonably
probable

4
3

Remote21Extremely
remoteNo risk reduction necessary.

Figure 5.1. Example of judgment criteria.

― 10 ―

Risk must be
reduced.

Risk reduction
must beconsidered.

 Consideration of risk treatment is unnecessary for hazards and accident scenarios under “no risk
reduction necessary.” Risk treatment is considered for hazards and accident scenarios under “risk reduction must be considered.” Whether such risk treatment will be actually implemented is also examined. Because theintroduction of a risk treatment is highly necessary for hazards and accident scenarios with high
RI, risk treatments are implemented for hazards and accident scenarios with RI over a certain level.
However, the level of RI at which risk treatments are implemented must be decided ahead of time.
Even hazards and accident scenarios below this level of RI require at least some risk treatment
efforts because they fall under “risk reduction must be considered.” Risk treatment is considered to be implemented for hazards and accident scenarios under “riskmust be reduced.” Whether risk is indexed after an implementation of a risk treatment must be
determined ahead of time. If yes, it is compared with the criteria of the risk matrix once again, andif it falls under “risk must be reduced” or “risk reduction must be considered,” further risk treatments are considered. These steps are repeated until hazard/accident scenario falls under “no risk
reduction necessary” or “risk reduction must be considered.”

5.4 Performing analysis and assessment
Analysis is performed via common hazard identification methods (e.g., Structured What IF Technique (SWIFT), Failure Mode and Effects Analysis (FMEA), and HAZard and OPerability study(HAZOP)). It begins with identifying possible hazards for a new feature, followed by estimation of
causes of hazards, consequence, severity of the consequence, and hazard frequency. These processes
must be performed with experts mentioned in the previous Section. If necessary, risk treatment and soon that are recommended for high-risk hazards are identified. Similarly, if needed, risk following arisk treatment is estimated (it is desirable to also examine if a risk treatment leads to a new hazard andso on). The analysis process is recorded on a worksheet corresponding with the method as part of thereport.

5.4.1

Identifying hazards(i)General matters
Here, let us explain matters that are necessary to implement an analysis regardless of the identification method of hazards.
 Selection of experts
Please refer to Section 5.2.
 Separating the phase
Analysis must be performed for each phase that uses the target automation system. For― 11 ―

example, the following phases must be considered. Since this is simply an example, phases
should be set according to the characteristics of the target automation system.
Berthing and unberthing, in-harbor navigation, navigation in congested waters, ocean navigation, emergencies (fire, flooding, and so on).
 Example of hazards that should be considered
Appendix 2 shows examples of hazards that should be considered. Because these are simply
examples, hazards should be exhaustively identified beyond this list.
 Type of risk targets that should be considered (human life, environment, and asset)
As discussed in Section 5.3, in terms of the severity of consequence, it must be determinedahead of time which one or several of human life, environment, and property, will be considered
as a target in analyzing the severity of consequence.
(ii) Outline of the risk analysis method
The outline of SWIFT, a method often used for risk analysis in the marine field, is presented below.
Common methods other than SWIFT are listed in Appendix 3.
 SWIFT
At a workshop of designers, users, and experts of the target system led by a facilitator, questions
are repeatedly asked about a situation that deviates from a normal one, “what if,” and hazards are
identified through brainstorming.
The analysis is technically easier than the other analysis methods and can be applied during a concept study or concept design stage. At the same time, it has disadvantages that the result depends onthe experiences of participants and accident scenario is not explicitly presented as an analysis output.
Standard steps and worksheet of SWIFT are as follows:
Step 1: Define the target system and process.
Step 2: Prepare documents, such as design information and related data, and organize a working
group.
Step 3: Hold a HAZID workshop and identify hazards, causes, results, FI, SI, RI, and existing
safety measures through brainstorming.
Step 4: Record these discussions on the worksheet.
Worksheet example:
System: LNG carrier
Phase: In-harbor navigation
ID

Hazards

CausesConsequences

Existing measures― 12 ―

necessarymeasures

FI

SI

RI

comments

1

Collision - Dysfunction / damage to machines- Stormy weather- Operation error- Dysfunction /damage to structural equipment- Secondary disaster- Injury or death tocrew- Preventive measures(alert system, double hull
structure)- Mitigation measures(damage stability, lifesaving and rescue)- Inspection of machines- Education and training ofoperators

2

4

6

Figure 5.2. Example of the SWIFT worksheet.

5.4.2

Indexing risks

Frequency and degree of severity for the identified hazards and accident scenarios are semi-quantified (indexed). Documents that can be referred for this indexing are shown below.
Documents necessary to set the frequency and severity: Data necessary to examine the frequency
and seriousness.
 Data on the frequency and severity (level of damage and effect on human life, environment,
and asset) of defects, failures, and accidents in each system that occurred in the past or are
anticipated. If those are not available, reference the data for a similar system.
 Data on human life (number of death and injured), environment (marine pollution), and/or
asset (damage to the ship).
Usable data should be used as much as possible for semi-quantification (indexing). However, inmany cases, there is no usable datum. In such a case, semi-quantification (indexing) is performed
based on the experience of experts. For example, by comparing the frequency and severity of hazards
and/or accident scenarios without data to hazards and accident scenarios that have been semi-quantified (indexed) based on data, semi-quantification (indexing) of hazards and accident scenarios without
data becomes possible.
Semi-quantified (indexed) risks are compared to the preset criteria, and a response to the risk isdetermined based on the predetermined judgment method used for determining risk acceptance, anexamination method of risk treatment, and the judgment method for determining risk acceptance afterrisk treatment, in that if the risk is not acceptable, the risk with treatments is judged.

5.4.3

Risk analysis and assessment of the initial design

In a case of initial risk analysis based on a concept or basic design information, a focus is put on
the role of the system and difference from existing ships due to the role in order to conduct a risk
analysis and assessment.
Using the document shown in Section 4.1, the analytical target scope is determined with the method
shown in Section 5.1 and the information shown in Section 5.1 is summarized. Then, attendees arechosen based on Section 5.2, reach a consensus on items shown in Section 5.3, and perform an analysis
and assessment according to Sections 5.4.1 and 5.4.2.

― 13 ―

From the following, hazards based on the concept design are considered.
(1) Risks originating from human–machine interface.
(2) Defects of sensors and control equipment linked to the automation system.
(3) Effect of the automation system on other systems on the ship.
(4) Cyber security.
(5) Defects during an operation of the automation system (including forgotten updates of related
software and verification of the validity of emergency response).

5.4.4

Risk analysis and assessment of the detailed design

At this stage, following is confirmed.
 Recommendations of the initial risk analysis and assessment are definitely reflected in the detailed
design.
 Accident scenarios and related features that were not considered in the initial risk analysis.
For the former, if it is found that the recommendations are not reflected, it will be ensured that they
will be reflected in the detailed design. For the latter, if there are accident scenario or related feature
not considered, analysis is performed in the same manner as in Section 5.4.3, and after updating theanalysis, assessment is made.

5.5

ReportDetails up to the previous Section must be recorded in a written form. An example of the table ofcontents for a record is shown below.
1. Risk analysis and assessment of the initial design
1.1 Conceptual explanation of the system and documents necessary to perform a risk analysis
on the initial design
1.2 Information necessary to prepare for the analysis
1.3 Working group
1.4 Analytical conditions
1.5 Analysis and assessment results
1.5.1 Risk analysis procedure
1.5.2 Analysis and assessment results (attached worksheet, explanation of the analysis andassessment results)
2. Risk analysis and assessment of the detailed design
2.1 Explanation of the system and documents necessary to perform a risk analysis on thedetailed design
2.2 Information necessary to prepare for the analysis― 14 ―

2.3 Working group
2.4 Analytical conditions
2.5 Analysis and assessment results
2.5.1 Risk analysis procedure
2.5.2 Analysis and assessment results (attached worksheet, explanation of the analysis andassessment results)― 15 ―

Annex 1.

An example of hazards to consider

Table A1.1 shows examples of hazards to consider by summarizing hazards from each class guide [4],[8], and [9] and existing studies [11]–[14].
Table A1.1.

Examples of hazards to consider.

Classification

Hazards

External environ-

Bad weather

ment

Poor visibility
Congested waters
Unexpected behavior of other ships

Failure of AOS

Loss of signal from information collection devices

andDecrease of reliability or stability of information from information collection

equipment

relateddevices
Failure of related equipment in the AOS
Software bug in the AOS
Inappropriate tuning of parameters according to ship specifications (e.g., themaneuverability of the ship is not correctly reflected in the AOS)
Power loss of the AOS or related equipment
Inappropriate human–machine interface (HMI), e.g., it is difficult to understandthe reason for issuing an alarm, or there is insufficient time to execute transferfrom the AOS to a human
Improper interface between the AOS and other systems such as differences insituation awareness range, differences in kinetic performance models, mismatched parameters, system failures, and poor communication

Detection

Failure in detecting small objects (wreckage)
Failure in detecting collision targets
Failure in detecting navigational aids
Failure in detecting ship lights, sounds, or shapes
Failure in detecting semi-submerged towed or floating devices (e.g., seismic
gauges and fishing trawls)
Failure in detecting discrepancy between charted water depth and sounded water depth
Failure in detecting discrepancy between weather forecast and actual weather
situation― 16 ―

Failure in detecting degrading performance of a sensor
Failure in detecting degrading performance of the automation system
Failure in detecting slamming or high vibration
Navigation

Collision with other ships or offshore infrastructures
Collision with floating objects
Collision with marine wildlife
Collision with onshore infrastructure
Loss of intact stability owing to unfavorable ship responses
Loss of intact stability owing to icing
Unexpected maneuvers and drive off
Grounding owing to the loss of propulsion
Grounding owing to the loss of steering control
Grounding owing to deviation from the planned route
Grounding owing to error in the planned route
Fishing equipment/net becomes snagged on the sea route
Loss of intact stability owing to shift/liquification of cargo

Improper opera-

Omission of updating charts, atmospheric information, related software, etc.

tion

leading to misinformation
Incorrect input of setting data and initial input data to the AOS, e.g., navigation
plan data and reference values for collision avoidance decisions
Replacement of related equipment with equipment that is not compatible with
the AOSToo many alarms. Prioritization of alarms is not possible

Communication

Failure of electronic components in the communication links
Less than ideal radio coverage for wireless links
Error in transmission of data (also known as bit faults)
Failure in data integrity (data transmission errors, etc.)
Lack of acknowledgment of command(s)Wrong configuration of communication functions
Unexpected reduction of available bandwidth
Unexpected increase in latency
Unstable data links over time
Network storms
Loss of power

Security

GNSS spoofing, AIS spoofing, etc.

― 17 ―Jamming of RADAR, etc.
Unauthorized access/hacking of the AOS and related systems
The AOS or related systems infected with malware
Onboardcrew(fallback)Onboard crew dozing off
Lack of proficiency and understanding of the AOS users, e.g., cannot understand the meaning of alarms and unsuitable use environment of the AOS
Overconfidence of automation system users (onboard crew) in the automation
systemInadequate human–machine interface
Inability to understand incorrect input and unentered input of the voyage plan
Conniving inappropriate sea routes
Inability to understand unswitched operation modes (e.g., navigation mode foroutside of a port navigation mode for inside of a port)
Outside of the ODD and fallback is necessary, but onboard crew cannot respondEmergency

Severe hull damage (structural damage, flooding due to failure of watertightequipment, etc.)
Malfunction of ship equipment (propulsion, steering gear, radar, etc.)
Fire
Temporary or permanent power outage due to causes such as blackout

Remote control

Human errors by remote operators (falling asleep, leaving the position too long,incorrect interpretation of data, etc.)
Ship losing communication with the remote control center
Communication latency and failures
Frozen screen, such as that for the remote control system
Failure of remote operators to recognize the situation due to excessive or insufficient information
Handover of responsibilities from one operator to another― 18 ―

Annex 2.

Outline of common risk analysis methods

Below, we present the outline of risk analysis methods other than SWIFT, which was discussed in
the main text and summarize their characteristics. Please refer to the references, e.g., [15]–[20], formore detailed descriptions of each method including SWIFT. Methods other than those presented inthis manual can be applied to the risk analysis of an autonomous ship as well.
(1) Failure Mode and Effects Analysis (FMEA)
With a focus on the equipment that constitutes the system, possible modes of failure for the equipment are identified and their effects on the system are analyzed. This method is often used to identify
the effect of failures.
It is advantageous in that a systematic and exhaustive analysis is possible. At the same time, its
disadvantages include its difficulty in application during the concept design stage and the fact that itis labor and time intensive.
The standard steps and worksheet for FMEA are as follows:
Step 1: Define the target system and process.
Step 2: Prepare documents such as design information and related data and organize a working
group.
Step 3: Hold a workshop and perform FMEA analysis. Select the components and perform thefollowing for these components:
・ Identifying features.
・ Identifying the types of possible defects (failure mode).
・ Identifying localized effect caused by the failure mode (local effect) and effect on theoverall system (final effect).
・ Identifying the measures to protect the system from the failure mode (a means, including
alarms and error messages from the automated systems, to detect failures, corrective actions, etc.).
Step 4: Record these discussions on the worksheet.

― 19 ―Example of worksheet:
System:Main engine system

Subsystem:

Fuel oil pipe system

Navigation mode:

Normal sailing at full speed

Block diagram:

Block diagram of fuel oil pipe system

Date:

Editor:Sheet number:Approval by:

Numberdevicefeaturefailure mode

namecause offailureeffect of failure
Local

final

failuremeasuresseverity

detectioneffect1

Main

Burn the fuelDeclined

Damage to Main en-engine 1

and convert theoutputthe piston

Outer 2 axes

Majorgine 1 oper- axes can- sound, vibra- are stopped

Outer 2

Unusual(2, 3, 4)energy to me-(stoppedof the main ation dis-

not beimpactchanical work

output)engine 1 (2, continued

operated alarms

tion, various and sailing3, 4)with inner 2
axes

Figure A2.1. Example of FMEA worksheet*.
*NMRI edition of the FMEA worksheet based on the HSC code.
Failure mode refers to the types of potential defects. The 2000 High-speed craft (HSC) Code, aninternational regulation for high-speed crafts [21], lists the following modes of failure: structural failure (damage), physical restraint or biting, vibration, inability to maintain position, inability to open or
close, poor opening or closing, internal and external leakage, being above or below the tolerance level,
accidental movements, intermittent movements, unstable movements, erroneous display, limited flow,
erroneous movements, inability to stop or start, inability to switch, early movements, delayed movements, erroneous input (increase/decrease), erroneous output (increase/decrease), loss of input or output, short circuit, electric release, electric leakage, and other.
(2) HAZard and OPerability study (HAZOP)This is a method that is often used to analyze hazards at process plants. It clarifies potential abnormalities in a process system and propagation mechanisms to assess validity of measures. Analysis
begins by assuming “a deviation” from the design intent, and both cause and consequence are analyzed.
Guide words are used to prepare questions to analyze potential risks of deviating from the design
specifications, and causes and consequences are estimated on the basis of the answers to the questions.
While systematic and exhaustive analysis is possible, it is difficult to apply during the concept
design stage and is labor and time intensive.
(3) Bow-Tie Diagram
Generally, a diagram in a bow-tie shape is used. The target phenomenon is the knot, while the left
shows causes that could lead to the target phenomenon. The right side shows the consequences of the― 20 ―

notesphenomenon. This method combines the preventive measures of the target phenomenon and the preventive measures of the consequences of such a phenomenon. This method is often used to display an
accident scenario in combination with SWIFT.
While this method can explicitly display an accident scenario, it does not support the identificationof hazards, causes, or consequences and requires the use of other methods such as SWIFT.
(4) STAMP/STPA (Systems-Theoretic Accident Model and Processes/System-Theoretic Process
Analysis)
This method was developed to analyze the safety of large-scale and complex systems that incorporate technologies such as AI/IoT, which focuses on defects in interactions between elements. Whileconventional methods such as FMEA assume accidents occur due to failure of constituting machines
and operational errors, this method is characterized by its assumption that accidents occur due to interactions between elements.
Its advantages include the identification of abnormalities that cannot be discovered by conventional
methods, analysis at a lower cost and with less labor than conventional methods [22], and its application to concept study and/or design stages. However, it does not support the detailed analysis of thecause of failure or perform semi-quantitative analysis [23]. As it is a relatively new method, examples
of its application are limited when compared to conventional methods.
Table A2.1 shows a summary of the characteristics of the above methods and SWIFT.
Table A2.1. Characteristics of each method.
SWIFT
Outline

FMEA

HAZOP

Bow-Tie

STAMP/STPA

Questions on a With a focus on Analysis begins A method of il- Developedtosituationthat machinesthedeviatesfrom constitute a sys- deviation” from process from a safety of a large-

normal,“what tem, the failure the design in- cause to the tar- scalethat by assuming “a lustratingif,” are repeat- modes possible tent, and both get

the analyze

complexphenome- system that fo-

edly asked, and for these ma- causes and con- non, and from a cuses on defects
hazards

are chines are iden- sequences

identified

tified and their analyzed

throughbrain- effects on theare causetothe in the interac-consequences,illustrated in a ements

storming in this system are ana-

shape of a bow-methodtie

lyzed

tion between el-

TypicalConcept study, Detailed design Detailed design Concept study, Concept study,

stage ofconcept design,concept design, concept design,

application detailed design

detailed design detailed design― 21 ―

Major ad- ・Analysis is rel- ・vantages

atively easy.

Systematic ・Systematic ・ Accident sce- ・ Abnormalities

and exhaustive and exhaustive nario is explicit. that cannot be

and disad- ・Can be applied analysis is pos- analysis is pos- ・ Difficult
vantagesto the stage of sible.

sible.

identify

to found using thehaz- conventional

concept study or ・Difficult to ap- ・Difficult to ap- ards,

causes, methods can be

design.

conse- identified [22].

ply during the ply during the and・ Dependent on concept design concept design quences
the experience stage.
ofstage.

only

using ・ Analysis at athis lower cost andworkshop ・Labor and time ・Labor and time method, this re- with fewer man-participants.

intensive

intensive

quiringother hours than the・ Accident sce-methods such as conventional

nario is not ex-

SWIFT

plicitmethods [22].
・Can be applied
to concept study
and/ordesignstages.
・ Difficult

toconduct a detailed

analysisof the cause of
failures.
・(Semi-) quantitative

assess-ment is difficult[23]
・Fewer applications than theconventional
method.

Appendix 1. A practical example of risk analysis on a phase II autonomous ship
A practical example of risk analysis on a phase II autonomous ship are shown in this Appendix. We
assume two phases, that is, normal navigation and berthing/unberthing. It should be noted that risk
analysis is desirable considering more phases to increase the comprehensiveness of hazards.

― 22 ―

i. Preparation of documents
Examples of the documents mentioned in section 4.1 of this procedure are shown as follows:(0) ConOps
Table 1.1 ConOps● Definition of the featureThis feature targets a given voyage plan, detects other ships and wreckage that the ship encounters,
disturbances caused by marine weather, formulates a ship action plan according to a predeterminedaction policy, calculates engine output and steering commands to achieve the action plan, and outputs the speed and the course for the ship to achieve the voyage plan.
The voyage plan consists of the departure point, departure date and time, arrival point, arrival date
and time, and way point. The autonomous ship steering system onboard the ship will formulate aship action plan based on the voyage plan and control the steering and engine output in accordancewith the ship action plan using the ship control system.
<Navigation Plan>
Departure point: XXX Port
Departure date and time: Month/date, XX:XX
Arrival point: YYY Port
Arrival date and time: Month/date, YY:YY
Waypoint: ZZZ Port
Waypoint arrival date and time: Month/date, ZZ:ZZ<Action Policy>
Secure an appropriate time to begin avoidance and an appropriate distance to avoid interfering navigation of other ships or causing fear on sailor of other ships.
Considering the voyage plan, in order to prevent a large delay, the time spent on avoidance navigation should be minimized while securing the above mentioned appropriate avoidance start time anddistance.
● Objective of the feature
The objective of this feature is to develop the ship steering plan that includes responses to external
obstacles and disturbances that may act as impediments in the realization of the voyage plan and tocontrol the ship according to that action plan approved by onboard crew.

― 23 ―

● Extend of automation and relation of automation with operators (onboard crew/remote operators)
Extent of automation of the present feature is equivalent to the Category I shown in the ClassNK
Guidelines [4].
Collection of information on obstacles, integration of the collected information, and preparation of
the action plan are performed with this feature.
The action plan is presented to the onboard crew, and stands ready until the onboard crew approves.
The action plan approved by the onboard crew is output to the steering and engine equipment by
the present feature.
Within the assumed conditions of use for this feature discussed below, autonomous navigation is
performed with this feature. Outside these conditions, the crew on board steers in the conventional
method.
● Extent of remote control and relation with operators (onboard crew/remote operators)
This feature does not have remote control capability.
●Assumed range of use
ship:
Ship name: ◯◯◯Type of ship: Ferry
Gross tonnage: 199 tons
Loa: 45 m
Width: 9 m
Navigation area: Coasting area
Route: Port XXX to Port YYY
Phase of operation: normal navigation (including in-port and out-of-port); berthing and unberthing.
● Autonomous navigation methods
Autonomous navigation of a ship equipped with this feature is performed by taking over the tasks
from the onboard crew on the sea route within the assumed conditions of use and turning on thefeature upon having the onboard crew confirming the operation.
Completing the autonomous navigation along the sea route within the assumed conditions of use
and hanging over the tasks to the onboard crew completes the extent of autonomous navigation. If
the ship leaves the ODD during its route, even within the assumed conditions of use, autonomous
navigation is stopped by handing over to the onboard crew."● Means of monitoring relevant feature
The sensor information collected and integrated into the present feature, the prepared action plan,and the position of the ship within the ODD are constantly provided to the onboard crew by the
dedicated monitoring device on the ship.

― 24 ―

● Response procedures in case of deviation from the ODD during the automatic operation
Deviation from the ODD is detected by this feature and the onboard crew are notified by the onboard
alarm. After the crew switch from autonomous mode to manual mode in a defined procedure, thecrew take over the control of the ship.
(1) Functional requirements for the automation system (target tasks and subtasks of the automation)
Table 1.2 Functional requirements for the automation system (Phase: Normal navigation)
ID

Element name

Task

SubtaskAutonomousship steeringsystem• Obtain integrated information on own ship
• Obtain integrated information on other ships• Establish action

and drifting objects

plan• Obtain integrated information on marine• Switch operation1

phase (normal navigation → berthing)• Diagnose own status

weather conditions• Calculate navigational safety and economic efficiency• Present ship action plans• Obtain information necessary to diagnose own
statusInformation
integration
system for2

own ship• Integrate information on own ship
• Diagnose own status• Diagnose sensor
statusInformation
integration
system for3other ships/
drifting objects• Integrate information on other ships
and drifting objects• Diagnose own status• Diagnose sensor
status• Obtain information on own ship
• Obtain information necessary to diagnose own
status• Obtain information necessary to diagnose sensor status• Transmit integrated information, own status,and sensor status• Obtain information on other ships and drifting
objects• Obtain information necessary to diagnose own
status• Obtain information necessary to diagnose sensor status• Transmit integrated information, own status,and sensor status― 25 ―

Information
integration
system for marine weather• Obtain information on marine weather conditions (current location)• Integrate of the in-• Obtain marine weather condition forecast in-formation on marine

formation

weather conditions• Obtain information necessary to diagnose own• Diagnose own sta-4

statustus• Obtain information necessary to diagnose sen-

• Diagnose sensor

sor status

status• Transmit integrated information, own status,and sensor status

Ship control• Calculate control

systemvariables based on• Obtain ship action plansship action plans• Obtain actual ship’s position• Rudder/engine con-• Calculate of the deviation between the ship ac-

troltion plans and the ship’s position• Diagnose rud-

• Compare current situation with control thresh-

der/engine status

old values• Diagnose own sta-

• Transmit rudder/engine status and own status5

tusAutonomous
operation
management6

system• Obtain information on own ship, other ships,
drifting objects, marine weather conditions• Control mode

• Obtain information on the status of each sys-

switching instructions

tem• Diagnose own sta-

• Determine whether inside or outside ODD

tus• Obtain information necessary to diagnose own
statusOnboard crew

• Check information on own ship, other ships,
drifting objects, marine weather conditions• Approve/revise the• Check the action plan established by autono-

action planmous ship steering system• Switch the ship
7

• Check the instruction of switching the ship

steering mode

steering mode by autonomous operation manage-• Emergency response (forced switchover to manual mode)

ment system• Constant monitoring of each system operation• Constant monitoring of surroundings of own
ship― 26 ―

Table 1.3 Functional requirements for the automation system (Phase: Berthing/unberthing)ID

Element name

Task

SubtaskAutonomous• Obtain integrated information on own ship

ship steering• Obtain integrated information on other ships

system1• Establish berthing/and drifting objects

unberthing action plan

• Obtain integrated information on marine• Switch operation

weather conditions

phase (unberthing →• Calculate navigational safety and economic ef-

normal navigation)

ficiency• Diagnose own sta-

• Present ship action plans for berthing/ unberth-

tus

ing
• Obtain information necessary to diagnose own
statusInformation
integration
system for2

own ship• Obtain information on own ship

• Integrate infor-• Obtain information necessary to diagnose own

mation on own ship

status• Diagnose own sta-

• Obtain information necessary to diagnose sen-tus

sor status• Diagnose sensor• Transmit integrated information, own status,

statusand sensor status

Measuring• Measure the dis-

system for thetance between own

distance fromship and the berth

the berth• Activate an alarm in

3case of proximity• Diagnose own status• Diagnose sensor• Obtain the position of the berth• Obtain the position of own ship
• Obtain information necessary to diagnose own
status• Obtain information necessary to diagnose sensor status

statusInformation
integration4

system forother ships/
drifting objects• Integrate information on other ships
and drifting objects• Diagnose own status• Obtain information on other ships and drifting
objects• Obtain information necessary to diagnose own
status• Obtain information necessary to diagnose sensor status― 27 ―

• Diagnose sensor• Transmit integrated information, own status,

statusand sensor status

Information
integration
system for marine weather• Obtain information on marine weather conditions (current location)• Integrate of the in-• Obtain marine weather condition forecast in-formation on marine

formation

weather conditions• Obtain information necessary to diagnose own• Diagnose own sta-5

statustus• Obtain information necessary to diagnose sen-

• Diagnose sensor

sor status

status• Transmit integrated information, own status,and sensor status

Ship control• Calculate control

systemvariables based on• Obtain ship action plans for berthing/ unberthing

ship action plans for• Obtain actual ship’s position

berthing/unberthing• Rudder/engine con-

6trol
• Diagnose rudder/engine status• Diagnose own status

7• Calculate of the deviation between the ship action plans for berthing/ unberthing and the ship’s
position• Compare current situation with control threshold values• Transmit rudder/engine status and own status

Autonomous• Obtain information on own ship, other ships,

operation

drifting objects, marine weather conditions, andmanagement• Control mode

distance to the berth

systemswitching instructions• Obtain information on the status of each sys-

• Diagnose own sta-

tem

tus

• Determine whether inside or outside ODD• Obtain information necessary to diagnose own
statusOnboard crew

• Approve/revise theaction plan for berth-8

ing/unberthing• Switch the ship
steering mode

• Check information on own ship, other ships,
drifting objects, marine weather conditions• Check the action plan for berthing/unberthing
established by autonomous ship steering system― 28 ―

• Emergency re-• Check the instruction of switching the ship

sponse (forced switch-steering mode by autonomous operation manage-

over to manual mode)

ment system• Constant monitoring of each system operation• Constant monitoring of surroundings of own
ship(2) System architecture that clarifies the entire image of the automation system

Figure 1.1 System architecture (Phase: Normal navigation)― 29 ―

Figure 1.2 System architecture (Phase: Berthing/unberthing)(3) Outline of the internal operation of the automation system― 30 ―

Figure 1.3 Outline of the internal operation regarding autonomous navigation (Phase: Normal navigation)

Figure 1.4 Outline of the internal operation regarding mode decision (Phase: Normal navigation)― 31 ―

Figure 1.5 Outline of the internal operation regarding autonomous navigation (Phase: Berthing/unberthing)― 32 ―

Figure 1.6 Outline of the internal operation regarding mode decision (Phase: Berthing/unberthing)(4) Outline of the division of roles for the automation system and humans
Table 1.4 Outline of the division of roles for the automation system and humans (Phase: Normal
navigation)

Task

Autono-Infor-

Infor-

Infor-

Ship con-

Autono-Onboardmous

mationmation in-mationtrol sys-

mous op-

crew

ship

integra-tegration

integra-temerationsteeringtion sys-

system fortion sys-manage-systemtem forother

tem forment sys-

own shipships/drift-

marinetem

ing objects

weather

Switching(1)

operation

Switch-phase(2) Surveillanceing(1) Ac-Obtainingquiring

infor-and inte-(2) Sur-mation on

gratingveillance

own ship

information

Obtaining
infor-(1) Ac-mation on

quiring

otherand inte-

ships/drifti

grating in-ng objects,

formation(2) Surveillanceetc.
Obtaining
marineweather
information(1) Acquiringand inte-(2) Sur-gratingveillance

information― 33 ―

Establishing(avoidance) ac-(1) Estab-(2) Ap-lishingprovingtion plan
Executing(avoid-(1) Exe-(2) Sur-ance) ac-cutingveillancetion plan
Diagnosis(1) Diag-of related

nosis ofsensor sta-

condi-

tus

tions

Diagnosis
of ownstatus(1) Diag-(1) Diag-

nosis ofnosis ofcondi-

condi-

tions

tions

(1) Diagnosis ofconditions(1) Diagnosis ofconditions(1) Diagnosis of(2) Sur-condi-

veillance

tions(1) Diag-(1) Diag-(1) Diag-

nosis ofnosis ofnosis of(2) Sur-condi-

condi-

condi-

veillance

tions

tions

tions

Judging
inside or(1) Judg-

outside the
ODD anddetermin-ing and(2) Sur-determin-veillanceing

ing steering mode
Controlmodeswitching(1) Con-instruc-

trol modetions andswitching

control

instruc-

mode

tions

(2) Mode
switchingswitchover
Forced(1) Sur-switch-veillanceover to(2)― 34 ―

manualSwitch-mode

over tomanualmode

Table 1.5 Outline of the division of roles for the automation system and humans (Phase: Berthing/unberthing)
Infor-

Task

Autono-mationmous

integra-

ship

tion

steering

systemsystemfor own
ship

Infor-

Infor-

Measur-Autono-mation in-mationing sys-mous

tegration

integra-tem forsystem fortion

the dis-othersystemtanceships/drift

for ma-froming ob-

rine

the

ment

jects

weatherberthsystemShip
controlsystemoperation

Onboarman-

d crewage-

Switching(1)(2) Sur-

operation

Switch-

veil-

ing

lance

phase

(1) AcObtaining
information on
own shipquiring
and in-(2) Sur-

tegrat-veil-

ing in-lance

formation

Obtaining
infor-(1) Ac-mation on

quiring(2) Sur-otherand inte-

veil-

ships/drift

grating in-lance

ing ob-formation

jects, etc.
Obtaining(1) Ac-(2) Sur-marinequiringveil-weather

and

lance

― 35 ―

infor-inte-mationgrating
information

Measuring distance to
berth

(1)

(2) Sur-

Measur-

veil-

ing

lance

Establishing action
plan forberthing/
unberth-(1) Es-(2) Ap-tablish-proving

ing

ing
Executingactionplan for(1) Exe-

berthing/

cuting(2) Surveillance

unberthing
Diagnosis(1) Di-of related

agnosissensorof con-statusditions

Diagnosis
of ownstatus(1) Di-(1) Di-agnosisagnosisof con-of con-ditions

ditions(1) Diagnosis ofconditions(1) Diagnosis ofconditions(1) Di-(1) Di-agnosisagnosisof con-of con-ditions

ditions(1) Di-(1) Di-(1) Di-(1) Di-agnosisagnosisagnosisagnosisof con-of con-of con-of con-ditions

ditions

ditions

ditions(2) Surveillance(2) SurveillanceJudging
inside or(1)

outsidethe ODDand determining

Judging(2) Sur-and de-veil-

termin-

lance

ing

steeringmode― 36 ―

Controlmode(1)

switchingControl

instruc-

mode

tions andswitch-control

ing in-mode

struc-

switch-

tions

(2)
Mode
switchingover(1) Surveil-

Forcedlance

switch-(2)over toSwitch-manualover tomode

manualmode(5) ODD of an automation system
Table 1.6 ODD of an automation system
Marine area conditions
Navigation zone

Designated ship course

Waters within a departing/ar-

There shall be occupied waters necessary for change of direc-

riving harbor
Waters around a departing/arriving the berth
Degree of congestion
Ships not equipped with AIS
and obstructions

tion in the harbor: 3 L of occupied waters
There shall be occupied waters necessary for departing fromor arriving at the berth: 0.5 L of occupied waters
Low Congestion: Up to 8 ships within a 3 NM range
No non-AIS equipped ships or obstacles that the system cannot detect: No dangerous obstacles of less than 1 m in size
within 500 m

Environmental condition
Marine weather
Time

Calm condition: Wind: 7 m/s or less, wave height: 1.5 m orless, and visibility: 500 m or more
All dayInternal state― 37 ―

System state
Equipment required for operation
Ship motion
Other

Running normally: No error indication
Running normally: No error indication
Within design constraints of the hull: No anomaly indicatedNo emergency events have occurred: No inboard fire, outboard fire, overboard, emergency signal interception, etc.

ii. Risk analysis
Examples of HAZID WS are shown in Tables 1.7 and 1.8. These are risk analysis results on Phase
II autonomous ship which explained in the above i (Preparation of documents). The definitions of FI(Frequency Index)，SI (Severity Index) and RI (Risk Index) are the same as those of section5.3 of thisprocedure document.

― 38 ―

Table 1.7 HAZID WS (Phase: Normal navigation)― 39 ―

― 40 ―

― 41 ―

― 42 ―

― 43 ―

― 44 ―

― 45 ―

― 46 ―

― 47 ―

― 48 ―

― 49 ―

― 50 ―

― 51 ―

― 52 ―

― 53 ―

― 54 ―

― 55 ―

― 56 ―

― 57 ―

― 58 ―

― 59 ―

― 60 ―

― 61 ―

― 62 ―

― 63 ―

― 64 ―

― 65 ―

― 66 ―

― 67 ―

― 68 ―

― 69 ―

― 70 ―

― 71 ―

― 72 ―

― 73 ―

― 74 ―

― 75 ―

― 76 ―

― 77 ―

― 78 ―

― 79 ―

Table 1.8 HAZID WS (Phase: Berthing/unberthing)― 80 ―

― 81 ―

― 82 ―

― 83 ―

― 84 ―

― 85 ―

― 86 ―

― 87 ―

― 88 ―

― 89 ―

― 90 ―

― 91 ―

― 92 ―

― 93 ―

― 94 ―

― 95 ―

― 96 ―

― 97 ―

― 98 ―

― 99 ―

― 100 ―― 101 ―― 102 ―― 103 ―― 104 ―― 105 ―― 106 ―― 107 ―― 108 ―― 109 ―― 110 ―― 111 ―― 112 ―― 113 ―― 114 ―― 115 ―― 116 ―― 117 ―― 118 ―― 119 ―― 120 ―― 121 ―― 122 ―― 123 ―― 124 ―― 125 ―― 126 ―― 127 ―― 128 ―― 129 ―― 130 ―Appendix 2. A practical example of risk analysis on a demonstration experiment of phase
III autonomous ship
A practical example of risk analysis on a demonstration experiment of phase III autonomous ship
are shown in this Appendix. We assume two phases, that is, normal navigation and berthing/unberthing.
It should be noted that risk analysis is desirable considering more phases to increase the comprehensiveness of hazards.
i. Preparation of documents
Examples of the documents mentioned in section 4.1 of this procedure are shown as follows:(0) ConOps
Table 2.1 ConOps● Definition of the featureThis feature targets a given voyage plan, detects other ships and wreckage that the ship encounters, disturbances caused by marine weather, formulates a ship action plan according to a predetermined action policy, calculates engine output and steering commands to achieve the action plan,and outputs the speed and the course for the ship to achieve the voyage plan.
The voyage plan consists of the departure point, departure date and time, arrival point, arrival date
and time, and way point. The autonomous ship steering system onboard the ship will formulate aship action plan based on the voyage plan and control the steering and engine output in accordance with the ship action plan using the ship control system.
<Navigation Plan>
Departure point: XXX Port
Departure date and time: Month/date, XX:XX
Arrival point: YYY Port
Arrival date and time: Month/date, YY:YY
Waypoint: ZZZ Port
Waypoint arrival date and time: Month/date, ZZ:ZZ<Action Policy>
Secure an appropriate time to begin avoidance and an appropriate distance to avoid interferingnavigation of other ships or causing fear on sailor of other ships.
Considering the voyage plan, in order to prevent a large delay, the time spent on avoidance navigation should be minimized while securing the above mentioned appropriate avoidance start timeand distance.
● Objective of the feature
The objective of this feature is to develop the ship steering plan that includes responses to external― 131 ―

obstacles and disturbances that may act as impediments in the realization of the voyage plan andto control the ship according to that action plan.
● Extend of automation and relation of automation with operators (onboard crew/remote operators)
Extent of automation of the present feature is equivalent to the Category II shown in the ClassNK
Guidelines [4].
Collection of information on obstacles, integration of the collected information, and preparationof the action plan are performed with this feature.
The action plan is output to the steering and engine equipment by the present feature.
Within the assumed conditions of use for this feature discussed below, autonomous navigation is
performed with this feature. Outside these conditions, the crew on board steers in the conventional
method.
● Extent of remote control and relation with operators (onboard crew/remote operators)
This feature does not have remote control capability.
●Assumed range of use
ship:
Ship name: ◯◯◯Type of ship: Ferry
Gross tonnage: 199 tons
Loa: 45 m
Width: 9 m
Navigation area: Coasting area
Route: Port XXX to Port YYY
Phase of operation: normal navigation (including in-port and out-of-port); berthing and unberthing.
● Autonomous navigation methods
Autonomous navigation of a ship equipped with this feature is performed by taking over the tasks
from the onboard crew on the sea route within the assumed conditions of use and turning on thefeature upon having the onboard crew confirming the operation. t
Completing the autonomous navigation along the sea route within the assumed conditions of use
and hanging over the tasks to the onboard crew completes the extent of autonomous navigation. If
the ship leaves the ODD during its route, even within the assumed conditions of use, autonomous
navigation is stopped by handing over to the onboard crew.
● Means of monitoring relevant feature
The sensor information collected and integrated into the present feature, the prepared action plan,and the position of the ship within the ODD are constantly provided to the onboard crew by the― 132 ―

dedicated monitoring device on the ship.
● Response procedures in case of deviation from the ODD during the automatic operation
Deviation from the ODD is detected by this feature and the onboard crew are notified by the
onboard alarm. After the crew switch from autonomous mode to manual mode in a defined procedure, the crew take over the control of the ship.
(1) Functional requirements for the automation system (target tasks and subtasks of the automation)
Table 2.2 Functional requirements for the automation system (Phase: Normal navigation)
ID

Element

Task

name

SubtaskAutonomous• Obtain integrated information on own ship

ship steering• Obtain integrated information on othersystem• Establish action plan
• Switch operation phase(normal navigation →1ships and drifting objects• Obtain integrated information on marine
weather conditions• Calculate navigational safety and economic

berthing)• Diagnose own status

efficiency• Present ship action plans• Obtain information necessary to diagnose
own status

Information
integration
system for2

own ship• Obtain information on own ship
• Integrate information on
own ship• Diagnose own status• Diagnose sensor status• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status, and sensor status

Information
integration
system for3other ships/
drifting objects• Obtain information on other ships and drift• Integrate information onother ships and drifting objects• Diagnose own status• Diagnose sensor statusing objects• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status, and sensor status― 133 ―

Information• Obtain information on marine weather con-integration

ditions (current location)system formarine4

weather• Integrate of the information on marine weather
conditions• Diagnose own status• Diagnose sensor status• Obtain marine weather condition forecast
information• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status, and sensor status

Ship control
system• Calculate control variables based on ship actionplans• Rudder/engine control

5• Diagnose rudder/engine
status• Diagnose own status• Obtain actual ship’s position• Calculate of the deviation between the ship
action plans and the ship’s position• Compare current situation with control
threshold values• Transmit rudder/engine status and own status

Autonomous• Obtain information on own ship, otheroperation

ships, drifting objects, marine weather condi-

management
6• Obtain ship action plans

system• Control mode switching
instructions• Diagnose own statustions• Obtain information on the status of eachsystem• Determine whether inside or outside ODD• Obtain information necessary to diagnose
own status

7

Onboard(Immediately before goingcrew

to the bridge)• Go to the bridge based• Confirm the operation mode switching in-

on instructions from the au-

structions of the autonomous operation man-

tonomous operation man-agement systemagement system• Confirm information on own ship, other(After arriving at theships/drifting objects, weather/sea conditions

bridge)• Identify current situation― 134 ―

• Switch the ship steeringmode based on instructions
from the system• Manual operation
Shadow• Constant monitoring ofcrew

each system, surrounding
conditions, etc.

8

• Emergency response(forced switchover to manual mode)
Table 2.3 Functional requirements for the automation system (Phase: Berthing/unberthing)ID

Element

Task

name

Subtask• Obtain integrated information on own ship
• Obtain integrated information on other ships• Establish berthing/ unAutonomous
1

ship steeringsystemberthing action plan
• Switch operation phase(unberthing → normal navigation)and drifting objects• Obtain integrated information on marine
weather conditions• Calculate navigational safety and economic
efficiency• Present ship action plans for berthing/ un-• Diagnose own status

berthing• Obtain information necessary to diagnose
own status• Obtain information on own ship

2

Information• Integrate information on

integration

own shipsystem for• Diagnose own statusown ship• Diagnose sensor status• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status,and sensor status

Measuring3

system forthe distance• Measure the distance be-• Obtain the position of the berth

tween own ship and the• Obtain the position of own ship

berth

• Obtain information necessary to diagnose• Activate an alarm in caseown status― 135 ―

from theof proximity• Obtain information necessary to diagnose

berth• Diagnose own status

sensor status• Diagnose sensor status• Obtain information on other ships and driftInformation
integration4

system forother ships/
drifting objects• Integrate information onother ships and drifting objects

ing objects• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose• Diagnose own status• Diagnose sensor status

sensor status• Transmit integrated information, own status,and sensor status• Obtain information on marine weather conditions (current location)

5• Obtain marine weather condition forecast in-Information• Integrate of the infor-

integration

mation on marine weather

system forconditions

marine• Diagnose own status

weather• Diagnose sensor status

formation• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status,and sensor status• Calculate control variables based on ship actionplans for berthing/unberth6

Ship control

ing

system• Rudder/engine control• Diagnose rudder/engine
status• Obtain ship action plans for berthing/ unberthing• Obtain actual ship’s position• Calculate of the deviation between the ship
action plans for berthing/ unberthing and theship’s position• Compare current situation with control
threshold values• Diagnose own status• Transmit rudder/engine status and own status• Obtain information on own ship, other ships,

Autonomous
7

operation
management
system• Control mode switching
instructions• Diagnose own status

drifting objects, marine weather conditions,and distance to the berth• Obtain information on the status of each system• Determine whether inside or outside ODD― 136 ―• Obtain information necessary to diagnose
own status(Immediately before goingto the bridge)• Go to the bridge based on
instructions from the autonomous operation manage-

8

Onboardcrew

ment system• Confirm the operation mode switching instructions of the autonomous operation management system(After arriving at the• Confirm information on own ship, otherbridge)• Identify current situation• Switch the ship steering

ships/drifting objects, weather/sea conditions,and distance to the berthmode based on instructions
from the system• Manual operation• Constant monitoring ofeach system, surrounding
9

Shadowconditions, etc.

crew

• Emergency response(forced switchover to manual mode)(2) System architecture that clarifies the entire image of the automation system― 137 ―

Figure 2.1 System architecture (Phase: Normal navigation)― 138 ―

Figure 2.2 System architecture (Phase: Berthing/unberthing)(3) Outline of the internal operation of the automation system― 139 ―

Figure 2.3 Outline of the internal operation regarding autonomous navigation (Phase: Normal navigation)

Figure 2.4 Outline of the internal operation regarding mode decision (Phase: Normal navigation)― 140 ―

Figure 2.5 Outline of the internal operation regarding autonomous navigation (Phase: Berthing/unberthing)

Figure 2.6 Outline of the internal operation regarding mode decision (Phase: Berthing/unberthing)― 141 ―

(4) Outline of the division of roles for the automation system and humans
Table 2.4 Outline of the division of roles for the automation system and humans (Phase: Normal
navigation)

Task

Autono-Infor-

Infor-

Infor-

Ship

Autono-OnboardShadowmous

mationmationmationcontrol

mous

crew

crew

ship

integra-integra-integra-systemopera-

steeringtion sys-

tion sys-

tion sys-tion

systemtem fortem fortem formanage-

own

other

marinement

ship

ships/driweathersystemfting objects
Switch-(1)(2)

ing oper-Switch-

Moni-

ing

toringation
phase
Obtain-(1) Ac-(2)

ing in-quiring

Moni-

for-

and in-toringmationtegrat-on owning in-ship

formation

Obtain-(1) Ac-(2)

ing in-quiring

Moni-

for-

and in-toringmationtegrat-on othering in-ships/drifor-fting ob-mationjects, etc.
Obtain-(1) Ac-(2)

ing ma-quiring

Moni-

and

toringrine― 142 ―

weatherintegrat-

infor-

ing in-mationformation

Estab-(1) Es-(2)

lishingtablish-Moni-(avoid-ing

toringance) action plan
Execut-(1) Exe-(2)

ing

cutingMoni-(avoid-toringance) action plan
Diagno-(1) Di-(1) Di-(1) Di-(2)

sis of re-agnosisagnosisagnosis

Moni-

lated

of con-of con-of con-toringsensorditions

ditions

ditions

statusDiagno-(1) Di-(1) Di-(1) Di-(1) Di-(1) Di-(1) Di-(2)

sis ofagnosisagnosisagnosisagnosisagnosisagnosisMoni-

own sta-of con-of con-of con-of con-of con-of con-toringtus

ditions

ditions

ditions

ditions

ditions

ditions

Judging(1)(2)

inside or

JudgingMoni-

outsideand de-toringthe ODDtermin-and de-ing

termining steering mode
Control(1) Con-(2) Go-

(5)

mode

trol

ing toMoni-switch-mode

thetoringing

switch-bridgeing― 143 ―

instruc-

instruc-(3)

tions andtions

Identify-

control

ing cur-

mode

rent sta-switch-

tus

over

(4)
Mode
switchingForced(1)

switch-Moni-over totoringmanual(2)

mode

Switchover tomanualmode

Table 2.5 Outline of the division of roles for the automation system and humans (Phase: Berthing/unberthing)
Infor-

Task

Infor-

mationAuton-

mation

inte-

omous

inte-

grationship

grationsystemsteer-

system

for

ing

for

other

systemown

ships/dship

rifting
objects

Switching operation
phase

Infor-

Meas-

mation

uring

inte-

systemgrationfor theShipsystemdis-

control

for ma-tancesystemrine

fromweathe

the

r

berth

Autonomous
operation

Onboar

Shado

man-

d crew

w crewagement
system(1)(2)

SwitchiMoni-ngtoring― 144 ―

(1) Ac-

Obtain-quiring

ing informationon ownand in-(2)tegrat-Moni-

ing in-toringfor-ship

mationObtain-(1) Ac-ing in-quiring

formationon otherships/driand in-(2)tegrat-Moni-

ing in-toringfor-fting ob-mationjects, etc.

(1) Ac-Obtain-quiring

ing marine
weather
infor-and in-(2)tegrat-Moni-

ing in-toringfor-mationmationMeasuring distance to
berth

(1)

(2)

Meas-

Moni-

uring

toringEstablishingaction(1) Es-(2)plan fortablish-Moni-

berthing/

ing

toringunberthing
Execut-(1) Ex-ing ac-ecutingtion plan― 145 ―

(2)
Monitoring

forberthing/
unberthing
Diagnosis of related
sensorstatus(1) Di-(1) Di-(1) Di-(1) Di-agnosisagnosisagnosisagnosisof con-of con-of con-of con-ditions

ditions

ditions

ditions(2)
Monitoring

Diagno-(1) Di-(1) Di-(1) Di-(1) Di-(1) Di-(1) Di-(1) Di-sis ofagnosisagnosisagnosisagnosisagnosisagnosisagnosisown sta-of con-of con-of con-of con-of con-of con-of con-tus

ditions

ditions

ditions

ditions

ditions

ditions

ditions(2)
Monitoring

Judging
inside or(1)

outsidethe ODDand determin-

Judg-

(2)

ing andMoni-

deter-

toringmininging steering mode(2) Going toControlthemodeswitching instructions andcontrolmodeswitch-(1)

bridgeControl(3)

mode

Identi-(5)switch-

fying

Moni-

ing in-current

toringstruc-

status

tions

(4)
Mode

over

switching― 146 ―

(1)
Moni-

Forcedtoringswitch-(2)over toSwitchmanualover tomode

manualmode(5) ODD of an automation system
Table 2.6 ODD of an automation system
Marine area conditions
Navigation zone

Designated ship course

Waters within a departing/ar-

There shall be occupied waters necessary for change of direc-

riving harbortion in the harbor: 3 L of occupied waters

Waters around a departing/ar- There shall be occupied waters necessary for departing from orriving the bertharriving at the berth: 0.5 L of occupied waters

Degree of congestion

Low Congestion: Up to 5 ships within a 3 NM range

Ships not equipped with AIS

No non-AIS equipped ships or obstacles that the system cannot

and obstructions

detect: No dangerous obstacles of less than 1 m in size within
700 m

Environmental condition
Marine weather

Calm condition: Wind: 7 m/s or less, wave height: 1.5 m orless, and visibility: 500 m or moreTime

All dayInternal state
System state

Running normally: No error indication

Equipment required for oper-

Running normally: No error indication

ation
Ship motion

Within design constraints of the hull: No anomaly indicated

Other

No emergency events have occurred: No inboard fire, outboard
fire, overboard, emergency signal interception, etc.

(6) Outline of a demonstration experiment• Objective of the experiment: To identify points that need to be improved in the automatic navigation― 147 ―

system by operating a ship equipped with the system under development in actual seas.
• Experimental route: Port XXX to Port YYY• Date of experiment: YYYY/MM/DD• Shadow crew: Keep a constant watch and check the operation of the ship during automatic ship
steering using this function and perform a fallback operation when any abnormality is detected.
Shadow crew shall be present on the bridge at all times.
• Onboard crew: Onboard crew remain in their cabins during automatic ship steering. When an alarmfrom the autonomous operation Management system is triggered, they shall go to the bridge, switch
to manual ship steering, and steer the ship.
• Passenger: The ship is a passenger ship; however, the experiment will be conducted without passengers on board.
ii. Risk analysis
Examples of HAZID WS are shown in Tables 2.7 and 2.8. These are risk analysis results on thedemonstration experiment of Phase III autonomous ship which explained in the above i (Preparationof documents). The definitions of FI (Frequency Index)，SI (Severity Index) and RI (Risk Index) are
the same as those of section5.3 of this procedure document.

― 148 ―

Table 2.7 HAZID WS (Phase: Normal navigation)― 149 ―

― 150 ―― 151 ―― 152 ―― 153 ―― 154 ―― 155 ―― 156 ―― 157 ―― 158 ―― 159 ―― 160 ―― 161 ―― 162 ―― 163 ―― 164 ―― 165 ―― 166 ―― 167 ―― 168 ―― 169 ―― 170 ―― 171 ―― 172 ―― 173 ―― 174 ―― 175 ―― 176 ―― 177 ―― 178 ―― 179 ―― 180 ―― 181 ―― 182 ―― 183 ―― 184 ―― 185 ―― 186 ―― 187 ―― 188 ―― 189 ―― 190 ―― 191 ―― 192 ―― 193 ―― 194 ―― 195 ―― 196 ―― 197 ―― 198 ―― 199 ―Table 2.8 HAZID WS (Phase: Berthing/unberthing)― 200 ―

― 201 ―― 202 ―― 203 ―― 204 ―― 205 ―― 206 ―― 207 ―― 208 ―― 209 ―― 210 ―― 211 ―― 212 ―― 213 ―― 214 ―― 215 ―― 216 ―― 217 ―― 218 ―― 219 ―― 220 ―― 221 ―― 222 ―― 223 ―― 224 ―― 225 ―― 226 ―― 227 ―― 228 ―― 229 ―― 230 ―― 231 ―― 232 ―― 233 ―― 234 ―― 235 ―― 236 ―― 237 ―― 238 ―― 239 ―― 240 ―― 241 ―― 242 ―― 243 ―― 244 ―― 245 ―― 246 ―― 247 ―― 248 ―― 249 ―― 250 ―― 251 ―Appendix 3. A practical example of risk analysis on a phase III autonomous ship
A practical example of risk analysis on a phase III autonomous ship are shown in this Appendix.
We assume one phase, that is, navigation in ocean (Navigation in port and Berthing/unberthing phases
are out of this risk analysis because we assume that manual operation is conducted in these phases). It
should be noted that risk analysis is desirable considering more phases to increase the comprehensiveness of hazards.
i. Preparation of documents
Examples of the documents mentioned in section 4.1 of this procedure are shown as follows:(0) ConOps
Table 3.1 ConOps● Definition of the featureThis feature targets a given voyage plan, detects other ships and wreckage that the ship encounters, disturbances caused by marine weather, formulates a ship action plan according to a predetermined action policy, calculates engine output and steering commands to achieve the action plan,and outputs the speed and the course for the ship to achieve the voyage plan.
The voyage plan consists of the departure point, departure date and time, arrival point, arrival date
and time, and way point. The autonomous ship steering system onboard the ship will formulate aship action plan based on the voyage plan and control the steering and engine output in accordance with the ship action plan using the ship control system.
<Navigation Plan>
Departure point: XXX Port
Departure date and time: Month/date, XX:XX
Arrival point: YYY Port
Arrival date and time: Month/date, YY:YY
Waypoint: ZZZ Port
Waypoint arrival date and time: Month/date, ZZ:ZZ<Action Policy>
Secure an appropriate time to begin avoidance and an appropriate distance to avoid interferingnavigation of other ships or causing fear on sailor of other ships.
Considering the voyage plan, in order to prevent a large delay, the time spent on avoidance navigation should be minimized while securing the above mentioned appropriate avoidance start timeand distance.
● Objective of the feature
The objective of this feature is to develop the ship steering plan that includes responses to external― 252 ―

obstacles and disturbances that may act as impediments in the realization of the voyage plan andto control the ship according to that action plan.
● Extend of automation and relation of automation with operators (onboard crew/remote operators)
Extent of automation of the present feature is equivalent to the Category II shown in the ClassNK
Guidelines [4].
Collection of information on obstacles, integration of the collected information, and preparationof the action plan are performed with this feature.
The action plan is output to the steering and engine equipment by the present feature.
Within the assumed conditions of use for this feature discussed below, autonomous navigation is
performed with this feature. Outside these conditions, the crew on board steers in the conventional
method.
● Extent of remote control and relation with operators (onboard crew/remote operators)
This feature does not have remote control capability.
●Assumed range of use
ship:
Ship name: ◯◯◯Type of ship: Ferry
Gross tonnage: 199 tons
Loa: 45 m
Width: 9 m
Navigation area: Coasting area
Route: Port XXX to Port YYY
Phase of autonomous navigation: navigation in ocean (manual operation is conducted in navigation in port and berthing/un-berthing phases).
● Autonomous navigation methods
Autonomous navigation of a ship equipped with this feature is performed by taking over the tasks
from the onboard crew on the sea route within the assumed conditions of use and turning on thefeature upon having the onboard crew confirming the operation. t
Completing the autonomous navigation along the sea route within the assumed conditions of use
and hanging over the tasks to the onboard crew completes the extent of autonomous navigation. If
the ship leaves the ODD during its route, even within the assumed conditions of use, autonomous
navigation is stopped by handing over to the onboard crew.
● Means of monitoring relevant feature
The sensor information collected and integrated into the present feature, the prepared action plan,and the position of the ship within the ODD are constantly provided to the onboard crew by the― 253 ―

dedicated monitoring device on the ship.
● Response procedures in case of deviation from the ODD during the automatic operation
Deviation from the ODD is detected by this feature and the onboard crew are notified by the
onboard alarm. After the crew switch from autonomous mode to manual mode in a defined procedure, the crew take over the control of the ship.
(1) Functional requirements for the automation system (target tasks and subtasks of the automation)
Table 3.2 Functional requirements for the automation system (Phase: Navigation in ocean)ID

Element

Task

name

SubtaskAutonomous• Obtain integrated information on own ship

ship steering• Obtain integrated information on othersystemships and drifting objects• Obtain integrated information on marine

1• Establish action planweather conditions• Diagnose own status• Calculate navigational safety and economic
efficiency• Present ship action plans• Obtain information necessary to diagnose
own status

Information
integration
system for2

own ship• Obtain information on own ship
• Integrate information on
own ship• Diagnose own status• Diagnose sensor status• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status, and sensor status

Information
integration3

system forother ships/
drifting objects• Integrate information onother ships and drifting objects• Diagnose own status• Diagnose sensor status• Obtain information on other ships and drifting objects• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status― 254 ―

• Transmit integrated information, own status, and sensor status

Information• Obtain information on marine weather con-integration

ditions (current location)system formarine4

weather• Integrate of the information on marine weather
conditions• Diagnose own status• Diagnose sensor status• Obtain marine weather condition forecast
information• Obtain information necessary to diagnose
own status• Obtain information necessary to diagnose
sensor status• Transmit integrated information, own status, and sensor status

Ship control
system• Calculate control variables based on ship actionplans• Rudder/engine control

5• Diagnose rudder/engine
status• Diagnose own status• Obtain actual ship’s position• Calculate of the deviation between the ship
action plans and the ship’s position• Compare current situation with control
threshold values• Transmit rudder/engine status and own status

Autonomous• Obtain information on own ship, otheroperation

ships, drifting objects, marine weather condi-

management
6• Obtain ship action plans

system• Control mode switching
instructions• Diagnose own statustions• Obtain information on the status of eachsystem• Determine whether inside or outside ODD• Obtain information necessary to diagnose
own status

7

Onboard(Immediately before goingcrew

to the bridge)• Go to the bridge basedon instructions from the autonomous operation management system• Confirm the operation mode switching instructions of the autonomous operation management system• Confirm information on own ship, otherships/drifting objects, weather/sea conditions― 255 ―

(After arriving at thebridge)• Identify current situation• Switch the ship steeringmode based on instructions
from the system• Manual operation(2) System architecture that clarifies the entire image of the automation system

Figure 3.1 System architecture (Phase: Navigation in ocean)― 256 ―

(3) Outline of the internal operation of the automation system

Figure 3.2 Outline of the internal operation regarding autonomous navigation (Phase: Navigationin ocean)Figure 3.3 Outline of the internal operation regarding mode decision (Phase: Navigation in ocean)― 257 ―

(4) Outline of the division of roles for the automation system and humans
Table 3.3 Outline of the division of roles for the automation system and humans (Phase: Navigation in ocean)Autono-Task

Infor-

Infor-

Infor-

Ship con-

Autono-Onboardtrol sys-

mous op-

crew

tem

erationmous ship

mation in- mation in- mation in-steering

tegrationsystemsystem for system for system for

manage-own shiptegration

tegrationothermarinement sys-

ships/drift

weathertem

ing objects
Obtain-(1) Ac-ing in-quiringfor-and inte-

mationgrating in-on ownformation

ship
Obtain-(1) Ac-ing in-quiringfor-and inte-

mationgrating in-on otherformation

ships/drifting objects,
etc.
Obtain-(1) Ac-ing ma-quiringrine

and inte-

weathergrating in-

infor-

formationmationEstab-(1) Estab-lishinglishing― 258 ―

(avoidance)
actionplan
Execut-(1) Exe-ing

cuting(avoidance)
actionplan
Diagno-(1) Diag-(1) Diag-(1) Diag-

sis of re-

nosis ofnosis ofnosis oflated

conditions conditions conditions

sensorstatusDiagno-(1) Diag-(1) Diag-(1) Diag-(1) Diag-(1) Diag-(1) Diag-

sis ofnosis ofnosis ofnosis ofnosis ofnosis ofnosis ofown sta-conditions conditions conditions conditions conditions conditions

tus
Judging(1) Judg-

inside oring andoutsidedetermin-

the

ing

ODD
and determining
steering
mode
Control(1) Con-mode

trol modeswitch-switchinging in-instruc-

struc-

tions

tions

(2) Going
to thebridge(3) Identifying current statusand― 259 ―

control(4) Modemodeswitchingswitchover(5) ODD of an automation system
Table 3.4 ODD of an automation system
Marine area conditions
Navigation zone

Designated ship course

Degree of congestion

Low Congestion: Up to 5 ships within a 3 NM range

Ships not equipped with AIS

No non-AIS equipped ships or obstacles that the system cannot

and obstructions

detect: No dangerous obstacles of less than 1 m in size within
700 m

Environmental condition
Marine weather

Calm condition: Wind: 7 m/s or less, wave height: 1.5 m orless, and visibility: 500 m or moreTime

All dayInternal state
System state

Running normally: No error indication

Equipment required for oper-

Running normally: No error indication

ation
Ship motion

Within design constraints of the hull: No anomaly indicated

Other

No emergency events have occurred: No inboard fire, outboard
fire, overboard, emergency signal interception, etc.

ii. Risk analysis
Examples of HAZID WS are shown in Table 3.5. These are risk analysis results on Phase III autonomous ship which explained in the above i (Preparation of documents). The definitions of FI (Frequency Index)，SI (Severity Index) and RI (Risk Index) are the same as those of section5.3 of thisprocedure document.

― 260 ―

Table 3.5 HAZID WS (Phase: Navigation in ocean)― 261 ―

― 262 ―― 263 ―― 264 ―― 265 ―― 266 ―― 267 ―― 268 ―― 269 ―― 270 ―― 271 ―― 272 ―― 273 ―― 274 ―― 275 ―― 276 ―― 277 ―― 278 ―― 279 ―― 280 ―― 281 ―― 282 ―― 283 ―― 284 ―― 285 ―― 286 ―― 287 ―― 288 ―― 289 ―― 290 ―― 291 ―― 292 ―References[1] IMO: MSC.1/Circ.1455 Guidelines for the approval of alternatives and equivalents as provided
for in various IMO instruments (2013)[2] ClassNK: Risk Assessment Guidelines (2009)[3] MLIT: Safety Guidelines for MASS (provisional translation) (2022) (in Japanese)[4] ClassNK: Guidelines for Automated/Autonomous Operation on ships (Ver.1.0) (2020)[5] IMO: MSC.1/Circ.1212 Guidelines on alternative design and arrangements for SOLAS chapters
II-1 and III (2006)[6] IMO: MSC/Circ.1002 Guidelines on alternative design and arrangements for fire safety (2001)[7] IMO: MSC-MEPC.2/Circ.12 Revised guidelines for formal safety assessment (FSA) for use in
the IMO rule-making process (2013)[8] Bureau Veritas: Guidelines for Autonomous Shipping (2019)[9] DNV-GL: Autonomous and remotely operated ships (2018)[10] M. Shiokari et al.: Application of Risk Analysis Method with System Modeling to Conceptual
Design of Autonomous Ships, Proc. Conf. on the Japan Society of Naval Architects and Ocean
Engineers, Vol.32, pp.355–366 (2021) (in Japanese)[11] MUNIN: D9.2, Qualitative assessment, FP7 GA-No 314286 (2015)[12] EMSA: Study of the risks and regulatory issues of specific cases of MASS—Part 1, Report No.
2019-1296, Rev.0 (2020)[13] EMSA: Study of the risks and regulatory issues of specific cases of MASS—Part 2, Report No.
2019-0805, Rev.0 (2020)[14] USTRAT: AUTOSHIP D2.4a—Risk assessments, fail-safe procedures and acceptance criteria
The Inland Waterway vessel analysis (2020)[15] ISO/IEC 31010 (Risk management—Risk assessment techniques)[16] ISO/IEC 27005 (information technology—Security techniques—Information security risk management)[17] IEC 60812:2006 (Analysis technique for system reliability—Procedure for failure mode and effects analysis. (FMEA))[18] IEC 61882:2016 (Hazard and operability studies (HAZOP studies) – Application guide)[19] NK: Risk Assessment Guidelines (2nd edition) Annex 1 Guidelines for implementation of FMEA
(related to the IGC Code) (provisional translation) (2017)[20] N. G. Leveson and J. P. Thomas: STPA HANDBOOK (2018)[21] IMO: MSC.97(73) Adoption of the international code of safety for high-speed craft, 2000 (2000
HSC code) (2000)― 293 ―

[22] IPA/SEC: Survey report on the STAMP method (provisional translation) (2015)[23] Y. Fukuzawa: System Safety and Security Analysis by STAMP/STPA, Systems, control and information.Vol.62, No.4, pp.130–133 (2018) (in Japanese)― 294 ―