717
1 INTRODUCTION
The concept of unmanned shipping has been
developing since 1970s, but it gained a considerable
momentum in the second decade of 21st century,
when several R&D projects have been funded to
exploreitsfeasibility.
Among these, the most notable are Maritime
Unmanned Navigation through Intelligence in
Networks(MUNIN)
(Burmeister,Bruhn,andWalther
2015), Advanced Autonomous Waterborne
Application Initiative (AAWA)(Wróbel, Montewka,
and Kujala2018b,2018a), as well as several projects
carriedoutbyprivately‐ownedcompanies.
Ithasbeengenerallyacknowledgedthattechnical
and organizational revolution of shifting merchant
vessels’ control from their crews to shore‐based
facilitiesor
on‐boardcomputerswillinfluencesafety
inmultipleways(NautilusFederation2018;Ramoset
al.2018;Utne,Schjølberg,andRoe2019;Rødsethand
Burmeister 2015). Nevertheless, due to
unquestionable innovativeness of the concept and
lack of full‐scale prototypes operating in a real
environment, a comprehensive safety evaluation of
theconcept
couldnotbeperformedtodate(Thieme,
Utne,andHaugen2018),particularlyinaquantitative
manner.
In an attempt to bridge this gap, we applied a
System‐Theoretic Process Analysis (STPA), a tool
developed to analyze safety of large socio‐technical
systems regardless their development phase. It is
basedon
theassumptionthatsafetyisnotavalueto
be assessed but rather a feature to be controlled.
Therefore,someprinciplesofcontrolengineeringcan
beappliedtomodelsafety(Leveson2011).STPAand
related methods have previously been applied in
various domains, including automated driving
systems (Abdulkhaleq et al. 2018),
aeronautics
(Allison et al. 2017; Lower, Magott, and Skorupski
2018), maritime accidents’ analysis (Filho, Jun, and
Waterson2019;Kim,Nazir,andØvergård2016)and
maritime safety management (Valdez Banda and
Goerlandt 2018). Its versatility made it a perfect
candidateforconductingasafetyanalysisofasystem
stillbeingunder
developmentatthetime.
Preliminary Results of a System-theoretic Assessment
of Maritime Autonomous Surface Ships’ Safety
K.Wróbel&P.Krata
GdyniaMaritimeUniversity,Gdynia,Poland
J
.Montewka
GdyniaMaritimeUniversity,Gdynia,Poland
A
altoUniversity,Espoo,Finland
ABSTRACT: While a system‐theoretic approach to the safety analysis of innovative socio‐technical systems
gains a growing acceptance among academia, safety issues ofMaritime Autonomous Surface Ships (MASS)
remainlargelyunexplored.Therefore,weappliedaSystem‐TheoreticProcessAnalysistodevelopandanalyze
apreliminarymodel
oftheunmannedshippingsysteminordertoelaboratesafetyrecommendationsforfuture
developersoftheactualsystem.Resultsindicatethatcertainadvancementsshallbeundertakeninrelationto
MASS’softwaresolutionsinparticular.
http://www.transnav.eu
the International Journal
on Marine Navigation
and Safety of Sea Transportation
Volume 13
Number 4
December 2019
DOI:10.12716/1001.13.04.03
718
2 MATERIALSANDMETHODS
Asystem‐theoretic,holisticinsighthasoriginallybeen
developed to address safety issues regardless
organizational levels to which they relate, from top
managementthrough individual operatorsor
actuators.Bythat,controloverhazardsineachpoint
ofthesystemʹsstructurewouldbeensured(Keeet
al.
2017;Leveson2011).Withinthisapproach,knownas
System‐Theoretic Accident Model and Process
(STAMP), it is not unreliability of particular
componentsofthesysteminquestionbutinadequacy
ofinteractionsbetweenthemthat leads to accidents.
Such interactions must be executed in an adequate,
controlled manner which will
ensure thatthe whole
system maintains its safety pre‐conditions (Kazaras,
Kontogiannis, and Kirytopoulos 2014). Therefore,
violation of safety constraints that shall be enforced
onthesystemmightdevelopahazard(asystemstate
orsetofconditionsthat,togetherwithaparticularset
of worst‐case conditions, will lead to
an accident)
(Leveson2011).Conditionsthatcouldinfactresultin
a hazard are investigated and ideas on how to
mitigatethem are explored.It is however
recommendedto renounce any quantitative research
activity includingriskcalculation(Bjerga, Aven, and
Zio2016),mostlyduetoapotentiallackofsufficiently
reliabledata,whichisparticularlyapparentininitial
phasesofsystemdevelopment.
TheaboveconsiderationsareinlinewithSafety‐II
approach that focuses on making entire socio‐
technical systems capable of succeeding (in safety
terms) under any circumstances (Hollnagel 2014).
Therein, safetyshould be rooted in thesystem from
its
earliest design phases and throughout operation
until decommissioning. STAMP and related tools
(including STPA) are said to be more effective in
achieving this goal (Altabbakh et al. 2014) than
previously applied methods, including quantitative
ones. With reference to unmanned shipping as an
emergent technology, system‐theoretic approach
gives an opportunity
to both perform a proactive
safetyanalysisaswellasassess itsfeasibility in this
aspect.Thelattercouldonlybeattainedsomeperiod
after unmanned vesselsʹ implementation when the
outcome could be validated, for instance through
reality check or benchmarking (Goerlandt, Khakzad,
andReniers2017).
Before the STPA could be
performed, hazards to
whichitcan be exposedare listed as well as safety‐
related interactions between its components being
modelled and visualized through safety control
structure(seeFigure1,depictingageneralizedSTPA
procedure).
Thence,anidentificationofpotentiallyinadequate
interactions (control actions or feedback) between
system’scomponentsis
carriedout.Thosecanoccur
because:
1 Acontrolactionrequiredforsafetyisnotprovided
ornotfollowed;
2 Acontrolactionisprovidedinanunsafemanner;
3 Apotentiallysafecontrolactionisprovidedatthe
wrongtimeorinthewrongsequence;
4 Acontrolactionrequired
forsafetyisstoppedtoo
soonorappliedtoolong(Leveson2011).
Subsequently,waysinwhichunsafecontrolaction
could occur are investigated. This consists of an
examination of system’s control loops in order to
determine what factors could cause it to be
inadequateandhow.Furthermore,hazardmitigation
measures
canbeelaboratedatthisstage,whichisof
particular significance from safety‐driven design
point of view. Therein, cooperation between system
developers and safety analysts is iteratively utilized
todesignanever‐safesystem(FlemingandLeveson
2015). When multiple controllers influence one
component, particular attention must be paid to
all
relevant control loops so as to eliminate potential
coordinationproblems.
Figure1.STPAstandardizedprocedure,inspiredby(LevesonandThomas2018)
719
The analysis presented in this paper is based on
publiclyavailabledatapertainingtounmannedships’
system concept (Porathe, Prison, and Man 2014;
Rødseth and Tjora 2014; Van Den Boogaard et al.
2016;Porathe2016;HoggandGhosh2016;Burmeister
etal.2014).Thesehavebeenreviewedandcompiled
into
amodelofsystemsafetycontrolstructureinline
withSTPA’sprinciples.Thereindevelopedmodelhas
beenconsultedwithexpertsinvolvedinR&Dprojects
relatedtoMASS.Thence,theproperpartofSTPAhas
beenperformedwithidentificationofhazards,control
actionsandpotentialhazardmitigationmeasures.The
herein‐described
analysis has been performed for a
conceptoffully‐autonomousmerchantvessel.Sucha
ship is expected to navigate herself without a direct
control of shore‐based operator and conduct all
shipborne processes based on pre‐programmed
algorithmsofartificialintelligence.
Additionally, uncertainties pertaining to the
analysis have been analyzed as
postulated in
(Goerlandt and Reniers 2016; Bjerga, Aven, and Zio
2016).
TheanalysisprocedureisoutlinedinFigure2.
Figure2. System‐Theoretic Process Analysis outline as
performed
3 MODELANDRESULTS
The high‐level safety control structure of fully‐
autonomous merchant vessel is given in Figure 3
while the list of identified hazards to which an
autonomous merchant vessel can be susceptible is
giveninTable1.
AscanbeseeninTable1,mostofthehazards
are
relatedtomechanicalfailuresanddangerousphysical
interactionsofanautonomousshipwithotherobjects.
Nevertheless,thesecanresultfromalldifferentkinds
of inadequacies of control actions, just to name
improper safety culture implemented within a
shippingcompany.
Thence, recommendations for future systems’
developers have been elaborated, pertaining
to
potential ways of mitigating hazards. These are also
referred to as mitigation measures. Their full list is
given in (Wróbel, Montewka, and Kujala 2018b),
whileFigure4depictstheirsummary.
AscanbeseeninTable1,mostofthehazardsare
relatedtomechanicalfailuresanddangerousphysical
interactions
ofanautonomousshipwithotherobjects.
Nevertheless,thesecanresultfromalldifferentkinds
of inadequacies of control actions, just to name
improper safety culture implemented within a
shippingcompany.
Table1.Listofhazards
_______________________________________________
# Descriptionofhazard
_______________________________________________
1 Physicalhazards
_______________________________________________
1.1Vesselcollideswithanothership,runsintoelement
ofinfrastructureordamagesotherman‐madeobjects
1.2Vesselisincapableofproperlycontainingdangerous
chemicalsorenergy
1.3Vesselcausesdeathorinjurytopersons accidentally
orillegallyoccupyinghercompartments
1.4Systemdoesnotdetectadistress
situation
1.5Vesselloseshercargoatsea
1.6Vesselisunabletomaintainpropercargostowage
conditions
1.7Vesselrunsaground
1.8Vesselsuffersfrompropulsion/steeringfailure
1.9Vessel’snavigationalcapabilitiesareimpairedby
weatherconditions
1.10 Vesselsuffersfromlossofstability
1.11 Vesselsuffersfromflooding
1.12
Vesselsuffersfromfireorexplosion
1.13 Vesselsuffersfromlossofstructuralintegrity
1.14 Vesselsuffersfromlossofpowersupply
1.15 Systemcausesothervesseltoground,runinto
elementofinfrastructureordamageotherman‐made
objects
_______________________________________________
2 Organizationalhazards
_______________________________________________
2.1Contactwiththevesselcannotbeestablished
2.2Vesselisdeniedpassageduetosecurityconcerns
2.3Vesselcontributestodelayofotherships’traffic
2.4Vesselviolatesinternationalorcoastalstate’s
regulations
2.5System’scommunicationsubsystemunintentionally
interfereswithotherassets
_______________________________________________
3 Environmentalhazards
_______________________________________________
3.1Vesselisunabletomaintainintegrityoftanks
containingoilsoroilymixtures
3.2Vesselisunabletomaintainproperfuelcombustion
parameters
3.3Vesselisincapableofproperlycontainingdangerous
chemicalsorenergy
_______________________________________________
Thence, recommendations for future systems’
developers have been elaborated, pertaining to
potential ways of mitigating hazards. These are also
referred to as mitigation measures. Their full list is
given in (Wróbel, Montewka, and Kujala 2018b),
whileFigure4depictstheirsummary.
720
Figure3.High‐levelsafetycontrolstructureoffully‐autonomousmerchantvesselsystem
Figure4.SummaryofhazardmitigationmeasuresforMaritimeAutonomousSurfaceShips
721
Figure5.Resultsofuncertaintyassessment
The relevant mitigation measures have been
structured into three categories: those pertaining to
liveware, software and hardware. As can be seen in
Figure 4, the number of suggested solutions is
significant,particularlyfortheshore‐sidepartofthe
system.
Furthermore, results’ uncertainties have been
evaluated according to the method introduced
in
(Flage and Aven 2009) and refined in (Wróbel,
Montewka, and Kujala 2018b). The uncertainties
pertainingtobackgroundknowledgesupportingany
given mitigation measure implementation has been
assessedaseithersignificant,moderateorminor.The
resultsofthispartofstudyaregiveninFigure5.
The mitigation measures related
to software
solutionscanbecharacterizedasmoreuncertainthan
others. This can result from a fact that autonomous
vesselswouldoperatebasedoninnovativesoftware,
perhapsincludingartificialintelligence,development
of which is still ongoing with promising results.
Similar issues had been encountered during the
development of driverless cars (Waldrop
2015).
Meanwhile,theuseofsamehardwaresolutionsasin
manned shipping is expected which brings about a
limiteduncertainty.
4 DISCUSSION
Throughout the analysis, some high‐level
recommendations on MASS safety solutions have
been elaborated and assessed with relation to the
uncertainties potentially affecting the feasibility of
theirimplementation.
AscanbeseeninFigure4,such
recommendationscanbeappliedtoalmostanyaspect
of MASS operation ranging from organizational
factorsthroughenvironmentsensing.
Despite the autonomous merchant vessels being
expected to operate with no crew on board, stating
thathumanfactorwillberemovedfromthesystemis
misguiding. In fact, human operators will remain in
loop one way or another through design, fleet
management, remote supervision or control tasks
(Kobyliński 2018; Ahvenjärvi 2016). The number of
mitigationmeasuresinvolvinglivewareissignificant
andapplicabletoallaspectsofMASSoperation,and
organizationalenvironmentinparticular.
Although
the number of mitigation measures
involvingsoftwaresolutionsiscomparabletotheseof
hardware,itmustbenotedthatsoftwareis likely to
have much greater influence on autonomous ships’
safety performance than it has on today’s merchant
vessels(Lloyd’sRegister2017;Komianos2018;Manet
al.2018).Virtuallyallcomponents
ofthesystemwill
rely on software to the extent that cannot be
determinedatthepoint.Thefactthatsomesignificant
uncertainties have been identified pertaining to
software solutions feasibility, a further, more
comprehensive study on this matter is required
(Thieme,Utne,andHaugen2018).Closecooperation
between systems’
developers, researchers and
practitioners such as seafarers may be extremely
beneficialinthismatter.
5 CONCLUSIONS
An application of a qualitative, systemic method
insteadofquantitativeonestoanalyzesafetyissuesof
autonomousmerchantvesselallowedforobtaininga
high‐level, universally applicable results. These do
not depend on the actual
design of MASS system
which is still being developed by va rious industry
actors, but should rather be considered as general
guidelinesforthedevelopersofsuchsystems.
722
As opposed to quantitative sets of safety
assessment methods, no determination of safety of
riskvalueshasbeenperformedasthesearebelieved
to be misleading (Leveson 2011) or unnecessary
(Condamin, Louisot, and Naïm 2007). Instead, some
general recommendations have been elaborated on
howtoensurethatMASSsystemretains
safetyasits
feature in any conditions. Nevertheless, the results
must be considered incomplete as these pertain to
some idealistic model of autonomous ship systems
retrievedfrompubliclyavailablematerials.
Nevertheless,theycanbevalidatedassoonasthe
concept of autonomous shipping enters a full‐scale
implementationphase.
REFERENCES
Abdulkhaleq, Asim, Markus Baumeister, Hagen Böhmert,
and Stefan Wagner. 2018. “Missing No Interaction—
Using STPA for Identifying Hazardous Interactions of
Automated Driving Systems.” International Journal of
Safety Science 02 (01): 115–24.
https://doi.org/10.24900/ijss/0201115124.2018.0301.
Ahvenjärvi,S.2016.“TheHumanElementandAutonomous
Ships.” TransNav, the International Journal on Marine
NavigationandSafetyof
SeaTransportation10(3):517–21.
https://doi.org/10.12716/1001.10.03.18.
Allison,CraigK.,KirstenM.Revell,RodSears,andNeville
A. Stanton. 2017. “Systems Theoretic Accident Model
and Process (STAMP) Safety Modelling Applied to an
Aircraft Rapid DecompressionEvent.”Safety Science98
(October). Elsevier Ltd: 159–66.
https://doi.org/10.1016/j.ssci.2017.06.011.
Altabbakh, Hanan, Mohammad A. AlKazimi, Susan
Murray, and
KatieGrantham.2014.“STAMP‐Holistic
SystemSafetyApproach or JustAnotherRiskModel?”
Journal of Loss Prevention in the Process Industries 32.
Elsevier Ltd: 109–19.
https://doi.org/10.1016/j.jlp.2014.07.010.
Bjerga, Torbjørn, Terje Aven, and Enrico Zio. 2016.
“Uncertainty Treatment in Risk Analysis of Complex
Systems: The Cases of STAMP and FRAM.” Reliability
Engineering
and System Safety 156. Elsevier: 203–9.
https://doi.org/10.1016/j.ress.2016.08.004.
Boogaard,MauritsVanDen,AndreasFeys,MikeOverbeek,
Joan Le Poole, and Robert Hekkenberg. 2016. “Control
Concepts for Navigation of Autonomous Ships in
Ports.” In 10th Symposium on High‐Performance Marine
Vehicles.Cortona.
Burmeister, Hans‐Christoph, W C Bruhn, and L Walther.
2015.
“Interaction of Harsh Weather Operation and
Collision Avoidance in Autonomous Navigation.”
TransNav, the International Journal on Marine Navigation
and Safety of Sea Transportation 9 (1): 31–40.
https://doi.org/10.12716/1001.09.01.04.
Burmeister, Hans‐Christoph, Wilko C Bruhn, Ørnulf Jan
Rødseth, and Thomas Porathe. 2014. “Can Unmanned
ShipsImproveNavigationalSafety?”InProceedingsofthe
TransportResearchArena.Paris.
Condamin, Laurent, Jean‐Paul Louisot, and Patrick Naïm.
2007. Risk Quantification: Management, Diagnosis and
Hedging.Chichester:JohnWiley&Sons,Ltd.
Filho,A,GTJun,andPWaterson.2019.“FourStudies,Two
Methods,OneAccident—anotherLookattheReliability
and Validity of Accimap and STAMP for
Systemic
AccidentAnalysis.”SafetyScience 113. Elsevier: 310–17.
https://doi.org/10.1016/j.ssci.2018.12.002.
Flage, Roger, and Terje Aven. 2009. “Expressing and
CommunicatingUncertaintyinRelationtoQuantitative
Risk Analysis.” Reliability & Risk Analysis: Theory &
Application2(13):9–18.
Fleming, Cody Harrison, and Nancy Leveson. 2015.
“Integrating Systems Safety into Systems Engineering
during Concept
Development.” In 25th INCOSE
International Symposium, 989–1003. Seatlle, WA.
https://doi.org/10.1002/j.2334‐5837.2015.00111.x.
Goerlandt, Floris, Nima Khakzad, and Genserik Reniers.
2017. “Validity and Validation of Safety‐Related
QuantitativeRiskAnalysis:AReview.”SafetyScience99
(November): 127–39.
https://doi.org/10.1016/j.ssci.2016.08.023.
Goerlandt, Floris, and Genserik Reniers. 2016. “On the
Assessment of Uncertainty in Risk Diagrams.”
Safety
Science 84: 67–77.
https://doi.org/10.1016/j.ssci.2015.12.001.
Hogg, Trudi, and Samrat Ghosh. 2016. “Autonomous
Merchant Vessels: Examination of Factors That Impact
the Effective Implementation of Unmanned Ships.”
AustralianJournalofMaritime&OceanAffairs8(3):206–
22.https://doi.org/10.1080/18366503.2016.1229244.
Hollnagel, Erik. 2014. “Is Safety a Subject for Science?”
Safety Science 67: 21–24.
https://doi.org/10.1016/j.ssci.2013.07.025.
Kazaras, Konstantinos, Tom Kontogiannis, and
KonstantinosKirytopoulos. 2014.“ProactiveAssessment
of Breaches of Safety Constraints and Causal
Organizational Breakdowns in Complex Systems: A
Joint STAMP‐VSM FrameworkforSafety Assessment.”
Safety Science 62. Elsevier Ltd: 233–47.
https://doi.org/10.1016/j.ssci.2013.08.013.
Kee, Dohyung, Gyuchan Thomas Jun, Patrick Waterson,
andRogerHaslam.2017.“ASystemicAnalysis
ofSouth
KoreaSewolFerryAccident‐StrikingaBalancebetween
Learning and Accountability.” Applied Ergonomics 59.
Elsevier Ltd: 504–16.
https://doi.org/10.1016/j.apergo.2016.07.014.
Kim,Tae‐eun,SalmanNazir,andKjellIvarØvergård.2016.
“ASTAMP‐BasedCausalAnalysisoftheKoreanSewol
Ferry Accident.” Safety Science 83: 93–101.
https://doi.org/10.1016/j.ssci.2015.11.014.
Kobyliński, Lech. 2018.
“Smart Ships – Autonomous or
Remote Controlled?” Scientific Journals of the Maritime
University of Szczecin 53 (125): 28–34.
https://doi.org/10.17402/262.
Komianos, Aristotelis. 2018. “The Autonomous Shipping
Era. Operational, Regulatory, and Quality Challenges.”
TransNav, the International Journal on Marine Navigation
and Safety of Sea Transportation 12 (2): 335–48.
https://doi.org/10.12716/1001.12.02.15.
Leveson,NancyG.
2011.EngineeringaSaferWorld‐Systems
ThinkingAppliedtoSafety.Cambridge,MA:MITPress.
Leveson, Nancy G., and John P. Thomas. 2018. STPA
Handbook.https://doi.org/10.2143/JECS.64.3.2961411.
Lloyd’s Register. 2017. “Cyber‐Enabled Ships. ShipRight
ProcedureAssignmentforCyberDescriptiveNotesfor
Autonomous&RemoteAccessShips.”Southampton.
Lower, Michał, Jan
Magott, and JacekSkorupski.2018.“A
System‐Theoretic Accident Model and Process with
Human Factors Analysis and Classification System
Taxonomy.”SafetyScience.
Man,Yemao,RetoWeber, JohanCimbritz,Monica Lundh,
and Scott N. MacKinnon. 2018. “Human Factor Issues
during Remote Ship Monitoring Tasks: An Ecological
Lesson for System Design in
a Distributed Context.”
InternationalJournalof IndustrialErgonomics68.Elsevier:
231–44.https://doi.org/10.1016/j.ergon.2018.08.005.
NautilusFederation.2018.“FutureProofed?WhatMaritime
Professionals Think about Autonomous Shipping.”
London.
Porathe,Thomas.2016.“ANavigating NavigatorOnboard
or a Monitoring Operator Ashore? Towards Safe,
Effective, and Sustainable Maritime Transportation:
Findings from Five Recent EU Projects.”
Transportation
Research Procedia 14 (2352). Elsevier B.V.: 233–42.
https://doi.org/10.1016/j.trpro.2016.05.060.
723
Porathe, Thomas, Johannes Prison, and Yemao Man. 2014.
“Situation Awareness in Remote Control Centres for
Unmanned Ships.” In Human Factors in Ship Design &
Operation.London.
Ramos,Marilia,IngridBouwerUtne,JanErikVinnem,and
Ali Mosleh. 2018. “Accounting for Human Failure in
AutonomousShipsOperations.”InSafetyandReliability‐
SafeSocietiesinaChangingWorldESREL2018,editedby
Stein Haugen, Anne Barros, Coen van Gulijk, Trond
Kongsvik, and Jan Erik Vinnem, 355–63. Trondheim:
CRCPress.
Rødseth,ØrnulfJan,andHans‐ChristophBurmeister.2015.
“Risk Assessment for an Unmanned Merchant Ship.”
TransNav, the International Journal on Marine Navigation
and
Safety of Sea Transportation 9 (3): 357–64.
https://doi.org/10.12716/1001.09.03.08.
Rødseth, Ørnulf Jan, and Åsmund Tjora. 2014. “A System
Architecture for an Unmanned Ship.” In 13th
InternationalConferenceonComputerandITApplicationsin
the Maritime Industries (COMPIT 2014), 291–302.
Redworth. http://www.ssi.tu‐
harburg.de/doc/webseiten_dokumente/compit/dokumen
te/compit2014_redworth.pdf.
Thieme, Christoph Alexander, Ingrid Bouwer Utne, and
Stein
Haugen. 2018. “Assessing Ship Risk Model
Applicability to Marine Autonomous Surface Ships.”
Ocean Engineering 165. Elsevier Ltd: 140–54.
https://doi.org/10.1016/J.OCEANENG.2018.07.040.
Utne, Ingrid B., Ingrid Schjølberg, and Emery Roe. 2019.
“High Reliability Management and Control Operator
RisksinAutonomousMarineSystemsandOperations.”
Ocean Engineering 171. Elsevier Ltd: 399–416.
https://doi.org/10.1016/J.OCEANENG.2018.11.034.
Valdez Banda,
Osiris A, and Floris Goerlandt. 2018. “A
STAMP‐BasedApproachforDesigningMaritimeSafety
ManagementSystems.”Safety Science109.Elsevier:109–
29.https://doi.org/10.1016/j.ssci.2018.05.003.
Waldrop, M. Mitchell. 2015. “Autonomous Vehicles: No
Drivers Required.” Nature 518: 20–23.
https://doi.org/10.1038/518020a.
Wróbel, Krzysztof, Jakub Montewka, and Pentti Kujala.
2018a. “System‐Theoretic Approach to Safety of
Remotely
‐Controlled Merchant Vessel.” Ocean
Engineering 152: 334–45.
https://doi.org/10.1016/j.oceaneng.2018.01.020.
Wróbel, Krzysztof, Jakub Montewka, and Pentti Kujala.
2018b. “Towards the Development of a System‐
TheoreticModelforSafetyAssessmentofAutonomous
MerchantVessels.”ReliabilityEngineering&SystemSafety
178:209–24.https://doi.org/10.1016/j.ress.2018.05.019.