Risk and safety management of autonomous systems: a literature review and initial proposals for the maritime industry

Maritime autonomous systems pose many challenges to their designers. A fully autonomous vessel must be able to handle everyday navigation and propulsion in addition to an extensive list of other tasks such as cargo handling, emergency manoeuvering, ship-ship and ship-shore communications, situational awareness, and much more. If such systems are to be implemented for the sake of increased safety, their operational risk and safety must be managed and assured. The goal of this report is to investigate how risk and safety of these systems can and should be managed. There are three categories of system modelling methods that can be used for this purpose. The oldest category is “sequential methods”, followed chronologically by the most popular category, called “epidemiological methods”, and then by the newest category, called “systemic methods”. This report first contains an overview of these three categories. Following this is a literature review that investigates the approaches to risk and safety management of autonomous systems that are taken within four transportation industries (aviation, railway, automotive, and maritime). Next are three SWOT analyses, one for each category of methods. Within these analyses there contains the strengths, weaknesses, opportunities, and threats presented by or towards each method. For the role of autonomous maritime systems, the literature review and SWOT analyses indicate that STPA (a systemic method) is the optimal choice (if one method that current exists is to be used). This is because it is a comprehensive method that can handle complex socio-technical systems, such as those in question, while providing useful safety improvement recommendations. However, no single method is better than every other in all situations, and STPA presents certain limitations and drawbacks. First, it is very resource heavy, demanding long time investments from expert personnel. Second, because few data on the proposed systems exist, it is very difficult to conclusively recommend a suitable method. Therefore, if practitioners decide to employ STPA, they should be open to considering other methods in case they can yield better results. Finally, STPA (and other systemic methods) cannot currently yield accident probabilities. This means that STPA, in its current form, is unable to entirely satisfy the IMO’s FSA, which is important for the future of autonomous ships. Conversely, the literature review and SWOT analyses indicate that methods that can satisfy the FSA are unsafe for this application. This is because they are too theoretically simplistic and not comprehensive enough to produce trustworthy results. To solve this issue, one of the following should take place: (a) STPA (or another systemic method) is augmented to include probabilistic abilities; (b) STPA (or another systemic method) is combined with a sequential method to achieve the benefits of both categories (e.g. comprehensive and probabilistic results); or (c) a new systemic method is created that provides the depth of analysis of STPA as well as the required probabilistic capabilities. However, barring the FSA issue, the enclosed analysis indicates that the optimal choice is a systemic method (specifically STPA) despite its heavy burden to resources. This may seem like a cavalier recommendation, but it is the most comprehensive method and it produces the most safety improvement recommendations, thereby making it the optimal choice. It is additionally recommended that system analysis is performed from the design concept stage through to system operation, regardless of the method chosen. This is so that the analysis can be improved as more system data are produced.