Journal of Physics: Conference Series

PAPER • OPEN ACCESS

NYK’s Approach for Autonomous Navigation – Structure of Action

Planning System and Demonstration Experiments
To cite this article: Koji Kutsuna et al 2019 J. Phys.: Conf. Ser. 1357 012013

View the article online for updates and enhancements.

This content was downloaded from IP address [Link] on 14/11/2019 at 12:56

MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

NYK’s Approach for Autonomous Navigation – Structure of

Action Planning System and Demonstration Experiments

Koji Kutsuna1, Hideyuki Ando1, Takuya Nakashima2, Satoru Kuwahara3 and

Shinya Nakamura3
1
MTI Co., Ltd., Tokyo, Japan
2
Mitsubishi Research Institute, Inc., Tokyo, Japan
3
Japan Marine Science Inc., Kawasaki, Japan

Email: koji_kutsuna@[Link]

Abstract. NYK Line and its group companies have been conducting research projects towards
autonomous ship operation. This paper shows the structure of our Action Planning System (APS),
which integrates several support functions with man-machine interface, targeted at supporting
decision making for seafarers. By conducting risk assessment with reference to class guidelines
for autonomous ships, the safety of APS is verified. This paper also introduces our demonstration
experiment of this system, which will be conducted in FY2019.

1. Introduction
Technological development and demonstration projects for autonomous shipping are being conducted
all over the world. In December 2018, Rolls-Royce and Finferries demonstrated a fully autonomous
operating ferry [1], and ABB carried out the world's first test of remote control for a passenger ship [2].
In addition to the technological developments, efforts towards their social implementation are
progressing. At the Maritime Safety Committee’s 100th session (MSC100) in December 2018,
discussions began on a framework for the scoping exercise and trial guidelines for MASS operation. At
MSC101 in June 2019, interim guidelines for MASS trials were agreed. Classification societies are also
working on the creation of guidelines; DNV GL released a class guideline for autonomous and remotely
controlled ships [3], and ClassNK issued a provisional version of "Guidelines for Concept Design of
Automated Operation and Autonomous Operation of Ships" [4] in 2018.
To achieve efficient and safe operations and reduction of crew workloads, NYK Line and two Group
companies, MTI Co. Ltd. and Japan Marine Science Inc. (JMS), have been conducting research projects
towards autonomous ship operations, including a demonstration project utilizing ship manoeuvring
support functions and remote control supported by the Ministry of Land, Infrastructure, Transport and
Tourism (MLIT) [5].
We analysed the causes of navigational accidents from the internal database and found that human
error accounts for 95 percent of all losses [6]. Also, based on our feasibility study, we concluded that
“manned autonomous navigation” should at the current stage be aimed from safety and economic
perspectives [6]. Manned autonomous navigation means that the machine systems support the cognitive
and decision-making tasks of vessel crews. In particular, this will achieve one-man bridge operation
(B1), which enables a more-efficient utilization of vessel crew and a reduction in fatigue.

1
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

This paper shows the structure of our Action Planning System (APS), which the NYK Group
considers a core system for manned autonomous navigation, and for which we are aiming to obtain
approvals in principle (AiPs) and/or concept approvals from classification societies. The APS integrates
several support functions with human-machine interface, targeted at making decisions for the seafarers.
With reference to the class guidelines, the paper describes target tasks, main roles and functions,
operational design domain (ODD), and APS fallback mechanisms. Also, in order to verify this system
has an equivalent level of safety, risk assessment was conducted.

2. Concept of Action Planning System

2.1 Premise
As the core system of manned autonomous navigation, the NYK Group designed the concept of Action
Planning System (APS). APS aims to support crews’ decision making by analysing the situation
surrounding the ship based on sensor information and presenting an action plan based on the analysis.
After a verification and approval by humans, the plan is transferred to the control signals sent to the
actuators. APS also has a potential to realize high-level autonomous navigation with additional sensors
and reliable action-planning algorithms in the future.
Figure 1 shows a conceptual diagram of APS. The core part of this system is called Action Planning
Unit (APU), which analyses surrounding situations and calculates optimized action plans. In addition,
in our use case, APS information is also shared with an onshore support system, which provides
additional information and advice to the crew. We call this onshore support system a Remote Concierge
service. Based on the data-transmission requirements of each system [7], the transmission information
between ship and land, the transmission frequency, and remote supporting menus, e.g., voyage planning
based on the latest weather, are to be changed depending on the communication speed, which is
continuously monitored from the shore support centre.

Figure 1. Conceptual diagram of action planning system (APS).

2.2 Elemental technologies

The NYK Group’s research and development for manned autonomous navigation can be categorized as
situation-awareness support and risk-analysis and planning support. Remote support for each part can
also be combined. System developments and several experiments for these support functions are being
conducted.

2
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

As for situation-awareness support, image-processing technologies to detect surrounding ships and

obstacles are being developed. For risk analysis, indices for collision-risk judgement that extracts the
sense of expert seafarers are evaluated by navigation simulator experiments. For planning, collision-
avoidance programs are being developed based on several approaches. One of them constantly calculates
optimal routes from the collision-risk and economic preference. And from the viewpoint of
communication cost, we are developing a concept of a shore support centre that monitors vessels and
gives them additional information using an abundant information network and computing capacity.

2.3 Target task and mode

The APS targets the decision-making support necessary for seafarers to manoeuvre vessels and has the
following three specific functions.

• Anti-collision and anti-aground support: formulate and present an action plan to prevent
collision and aground during voyage. The parameters for the analysis can be different depending
on the area (open ocean, coastal area, congested area, or waterway).
• Approach support: formulate and present an action plan for stopping and restarting the boat,
e.g., anchoring, berthing, and mooring.
• Docking and undocking support: formulate and present an action plan for docking/undocking
including position and attitude adjustment by using various actuators such as main engine,
rudder, thruster, and tug’s support. This function is the same as the approach support mode for
a ship with a docking and undocking capability of its own.

Tasks related to marine vessel decision-making can be divided into the following categories:

• Information acquisition: obtain information of own ship and other ships (position, heading,
speed), geographical information, and weather information (wind direction and speed, wave
direction and height, ocean current, etc.).
• Information integration: integrate and fuse the information sent from several sensors,
considering their specification and accuracy.
• Risk analysis and action planning: based on the obtained information, grasp current and future
situations of the own ship and accompanying risks to formulate appropriate action plans.
• Verification and approval: judge whether the action plan is appropriate and approve the action
plan by making modifications as necessary.
• Execution and control: continuously converse the action plan to control orders to the actuator
according to the approved plan.

2.4 Division of roles

Advanced collaboration between machines and humans is an important feature of APS. In the system
design for automation, it is important to divide the roles between humans and the system clearly, i.e., to
clarify who will conduct the tasks and/or subtasks. Regarding APS, basically, the system will lead the
implementation except for the verification and approval parts, which greatly reduces the load of the
crew.
Table 1 shows the division of roles between machine and human operator. In the case of the AP
Normal 2 status (to be described later), part of the information acquisition and integration is replaced by
a human being from the system (additional information input by a human being is necessary). In case of
the AP Failed status, the risk-analysis and action-planning function will not operate.

3
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

Table 1. Division of roles between machine and human operator.

Task No. Task Main Sub

1 Information acquisition Machine Human
2 Information integration Machine Human
3 Risk analysis and action planning Machine NA
4 Verification and approval Human NA
5 Execution and control Machine Human

2.5 Operational Design Domain (ODD)

Operational Design Domain (ODD) means a design area where the system functions properly. It can be
composed by traffic density, geographical restriction, weather conditions, availability of traffic system
support, time zone (day and/or night), and so forth.
The ODD for APS is roughly defined as follows. Since onboard seafarers validate the action plan
from the system, those who handle APS should be required to have appropriate competences.

• The geographic and weather condition are acceptable enough that ships can be controlled by the
system, which refers to the standards for other navigation instruments, such as the Dynamic
Positioning System [8], etc.
• The system behaves correctly, i.e., information is correctly displayed on the monitor, and the
results are validated by human judgement.
• Integral and reliable information including human manual function can be obtained for situation
assessment and action planning.

As for the integrity and reliability of information, we analyse the information from each piece of
onboard equipment related to the subtasks of “information acquisition,” “information integration,” and
“risk analysis and action planning” as shown in table 2.
Also, as shown in table 3 and figure 2, we classify the APS status of implementing the "situation
analysis" and "action planning" tasks, which are the core function of APS. Of these, AP Normal 0-2 are
in the ODD, and AP Failed is subject to “fallback” (to be described later). Figure 3 shows the criteria
for determining the status.

4
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

Table 2. Integrity and reliability of related equipment by subtask.

Table 3. Definition of APS status.

Status Target Definition

It has highly reliable information and planning algorithms to carry
Fully
AP out all tasks. Human approval can be skipped in usual situations. It
autonomous
Normal 0 does not apply to the current APS, but it is assumed to be available
navigation
for achieving automation only with machines in the future.
Manned It has reliable information to carry out tasks till action planning.
AP
autonomous Human intervention and additional actions other than verification
Normal 1
navigation and approval of navigation plans are unnecessary.
Manned To maintain all tasks to be executed with high accuracy, part of the
AP
autonomous input information is missing, or some tasks depend on the manual
Normal 2
navigation inputs by human only.
A state in which some or all the information sources of tasks are
AP Failed NA missing, and it is impossible to present an appropriate analysis and
action plan even if a human adds and/or modifies information.

5
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

Figure 2. Criteria for determining APS status.

2.6 Fallback
Fallback means the alternative action to ensure Minimum Risk Condition (MRC) when the automation
system does not operate properly. Basically, MRC for APS (other than AP Normal 0) is guaranteed by
the crews’ backup; therefore, it is necessary to have appropriate alert mechanisms.
Figure 3 shows the state transition of APS with ODD and fallback. The status of the APS needs to
be properly displayed on the interface for the seafarers and remote operators to understand its system
reliability.
In order to confirm whether fallback mechanisms are safe and reliable, we conduct fallback
assessments considering external conditions, internal conditions, and ODD. A time-and-distance
allowance for the necessary action is assumed by each fallback mechanism.

Figure 3. APS status transition.

6
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

2.7 Safety verification by risk assessment

Risk assessments were conducted to verify whether APS has a proper human-machine interface, and
whether appropriate measures are taken to ensure cybersecurity and computer system reliability.
We conducted comprehensive risk assessment with reference to Systems Theoretic Process Analysis
(STPA), which is a hazard-identification model based on the Systems-Theoretic Accident Model and
Processes (STAMP), and useful especially for novel and/or complicated systems [16][17]. We went
back and forth between the risk analysis and the concept, including task and mode, division of roles,
ODD, and fallback, mentioned in 2.3, 2.4, 0, and 2.6, with reference to the guidelines from DNV GL
and ClassNK [3][4]. By this goal-based approach, the goal and subgoals for each task can be identified
[9][17].
In the hazard identification (HAZID) phase, we first assumed “collision,” “allision,” and/or “critical
machine failure” as the critical effects of possible incidents due to APS. Then hazards, failures, and
scenarios that lead to the critical effects were assumed as comprehensibly as possible, using “What-if”
analysis and fishbone diagrams. In addition, possible human-failure events were also identified by this
process, with reference to Ramos et al. (2018) assuming a human-machine interaction scheme and
possible operator decisions for each task [10].
Their causes, which can be acts or conditions, were pointed out and categorized with reference to
MSCAT [11], a tool to investigate the causation of loss events proposed by DNV GL. Then we analyzed
the frequency and severity of each hazard and plot them on the risk matrix shown in figure 5. Failure
mode, effects and criticality analysis (FMECA) is used for the risk analysis of machine failure. Incident
severity was ranked by the matrix shown in figure 5, with reference to Marine Injury Reporting
Guidelines [12] and so forth. Finally, possible risk-mitigation measures were considered, and the
mitigated risks were calculated. In this assessment, newly appeared hazards by the installation of APS,
and hazards with gaps between conventional ships and autonomous ships with APS were assessed.

Extremely remote Very remote Remote Seldom Resonably probable Probable Frequent
Frequency
Likely to occur once per 20 Likely to occur once per Likely to occur once per Likely to occur once per Likely to occur once per Likely to occur once per Likely to occur once per
Severity years of 5,000 ships. ten years on 1,000 ships. year on 1,000 ships. year on 100 ships. year on 10 ships. year on one ship month on one ship

Negligible

Minor 2 3 4 5 6 7 8

Moderately serious 3 4 5 6 7 8 9

Serious 4 5 6 7 8 9 10

Major 5 6 7 8 9 10 11

Exceptional 6 7 8 9 10 11 12

Figure 4. Risk matrix.

Incident Severity Matrix
Severity Environmental Hull damage
Injury Machinery damage/ Reputational
damage
(as per OCIMF Marine Injury Reporting Guidelines) Malfunction damage
Scale Score (Oil and HNS) Burn Collision/Groounding/Contact

Potential for Brand Damage.

Spill contained onboard and Minor fire detected and
Minor 1 First Aid Case No damage on hull Damage/malfunction which was recovered immdediately. Minor impact on customer confidence.
quantity less than 100 liters. easily extinguished
Impact less than one month.
Minor brand damage.
Moderately Medical Treatment Case Water/Ground Pollution by Minor damage resulting in slight loss of Medium damage/malfunction resulting in minor delay of Serious impact on customer confidence resulting in company asset not suitable
2 Insignificant damage
Serious Restricted Workday Case less than 100 liters. seaworthiness. schedule. for customer business.
Impact lasting between one and three months.
Significant damage resulting in moderate loss Local brand damage.
Water/Ground Pollution by of seaworhiness to repair at the elariest Significant damage/malfunction resulting in delay of Serious impact on customer confidence resulting in multiple company assets no
Serious 3 Lost Workday Case Some damage
more than 100 liters. timing. schedule and vessel could NOT recover by themselves. suitable for customer requirements.
Impact lasting three months to one year.
Regional brand damage.
Major damage/malfunction resulting in prolong delay of
Water/Ground Pollution by Significant ship/property Major damage resulting in repair at dockyard Serious impact on customer confidence resulting in all company assets not
Major 4 Permanent Partial Disability schedule and dedicated repair facility are required for
more than 1 cbm. damage. or dedicated facility. suitable for customer business for a prolonged period.
recovery.
Impact lasting more than 12 months.
Case resulting in Global brand damage.
Permanent Total Disability Water/Ground Pollution by extensive damage Case resulting in extensive damage and/or Case resulting in extensive damage and/or total Serious impact on customer confidence resulting in all company assets not
Exceptional 5
Fatality more than 100cbm. and/or total constructive total constructive loss. constructive loss. suitable for customer business for a prolonged period.
loss. Likely to lead to a change of regulations.

Figure 5. Incident severity matrix.

7
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

The identified hazards are shown in table 4, and the risk-assessment results are plotted in figure 6.
This indicates that this system with risk-mitigation measures has a much higher safety level than current
navigation systems.
Regarding cybersecurity, guidelines created by BIMCO (Baltic and International Maritime Council)
et al. [13] and by ABS (American Bureau of Shipping) [14], and a framework proposed by NIST
(National Institute of Standards and Technology) [15] are referred to in considering countermeasures to
avoid and reduce risks. Basically, it is assumed that execution and control functions should be
completely isolated from the external network to eliminate external threats and take effective
countermeasures.

Table 4. List of identified hazards.

No. Category I Category II Hazard/Failure/Scenario
A1.1 System-Automated task Planning Improper input or no input of navigation plan
A1.2 System-Automated task Planning Improper output of action plan
A2.1 System-Automated task Hardware APU failure due to environmental condition
A2.2 System-Automated task Hardware APU failure affecting other equipment (e.g., ECDIS)
A3.1 System-Automated task Information integration Different input data from several sensors for the same function
A3.2 System-Automated task Information acquisition Improper input (out of validation range) or no input of sensor data
A3.3 System-Automated task Information integration Deterioration accuracy of GNSS data
A4.1 System-Automated task Information acquisition Erratic AIS data caused by sender
A4.2 System-Automated task Information acquisition Erratic target tracking data due to noise and/or false echo
A4.3 System-Automated task Information integration Detection failure of small objects (e.g., small boats, buoys) by system
A4.4 System-Automated task Action and control Deviation from the plan due to actuator failure
B1.1 System-Manual task Information acquisition No human response on manual input data of information integration
B1.2 System-Manual task Information acquisition Incorrect data input by human
B2.1 System-Manual task Verification Human failure in verification of action plan
B2.2 System-Manual task Verification Human failure in verification of alert
B2.3 System-Manual task Verification Human failure in verification of working condition of systems
B3.1 System-Manual task Action and control Human failure in manual operation to execute action plan
B3.2 System-Manual task Action and control Human failure in reviewing execution of action plan
C1.1 Manual task Motivation Failure in keeping navigation watch
C1.2 Manual task Motivation Failure in decision making and/or human tasks due to physical stress
C1.3 Manual task Motivation Failure in decision making and/or human tasks due to psychological
stress
C1.4 Manual task Motivation Failure in decision making and/or human tasks due to improper
motivation
C1.5 Manual task Motivation Failure in decision making due to over reliance on APS
C2.1 Manual task Skill Failure in decision making and/or human tasks due to lack of skills
and/or knowledge
C3.1 Manual task Communication Failure in decision making and/or human tasks due to communication
breakdown
C3.2 Manual task Communication Communication failure between the commander and others
D1.1 Environment Heavy traffic Improper man-machine I/F to understand data coverage of action plan
D1.2 Environment Heavy traffic Sudden change of traffic situation due to other vessels
D1.3 Environment Heavy traffic Human failure in understanding situation due to large number of other
vessels
D2.1 Environment Narrow channel Failure in execution of action plan due to environmental condition

8
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

D3.1 Environment Restricted visibility Failure of target detection by human due to restricted visibility.
D4.1 Environment Night time navigation Failure of target detection by human due to restricted brightness at
night.
E1.1 Emergency response Rescue Rescue operation of man overboard or other vessels
E2.1 Emergency response Fire Fire (affecting ship maneuverability and seaworthiness)
E2.2 Emergency response Fire Fire (not affecting ship maneuverability and seaworthiness)
E3.1 Emergency response Flooding Flooding (affecting ship maneuverability and seaworthiness)
E3.2 Emergency response Flooding Flooding (not affecting ship maneuverability and seaworthiness)
E4.1 Emergency response Power failure Short-time power failure which is easy to recover
F1.1 Cyber attack Planning Failure of APU due to cracking or infection of malware
F1.2 Cyber attack Information acquisition Failure of GNSS due to cracking or spoofing
F1.3 Cyber attack Information acquisition Failure of AIS due to cracking, or false data due to spoofing
F1.4 Cyber attack Information acquisition Failure of RADAR due to jamming
F1.5 Cyber attack Action and Control False output data due to infection of malware
F1.6 Cyber attack Communication Failure of network communication due to cracking or infection of
malware

Extremely remote Very remote Remote Seldom Resonably probable Probable Frequent

Minor 2 3 4 5 6 7 8

Moderately serious 3 4 5 6 7 8 9

Serious 4 5 6 7 8 9 10

Conventional
operation
A4.1, A4.2, B1.2, E1.1, E2.1, C1.2, C1.3, C1.4, C2.1, C3.1,
Major 5 6
E2.2, E3.1, E3.2 7 C3.2, D1.2, D1.3, D3.1, D4.1
8 9 10 11

A3.1, A4.3, A3.3, B2.2, B3.2

A1.1, B2.3 D1.1, D2.1, E4.1, F1.2, F1.4, A3.2, C1.5, F1.3
F1.5

Exceptional 6 7 8 9 10 11 12

Minor 2

A2.1 3

F1.6 4 5 6 7 8

Moderately serious 3 4 5 6 7 8 9

Serious 4 5 6 7
Blue: Risk reduced 8 9 10

APS operation C3.2 A4.1, A4.2, B1.2, E1.1, C1.2, C1.3, C1.4, C2.1, C3.1,
Red: Risk newly appeared
with mitigations E2.1, E2.2, E3.1, E3.2 D1.2, D1.3, D3.1, D4.1 by installation of APS
Major 5 A3.1, A4.3, A3.3, B2.1, B3.2
6 7 8 9 10 11

A1.1, B2.2 A3.2, C1.5, F1.3

D1.1, D2.1, E4.1, F1.2, F1.4,
F1.5

A1.2, A2.2, B1.1, B2.3, B3.1 F1.1

Exceptional 6 7 8 9 10 11 12

Figure 6. Result of risk assessment for conventional operation and autonomous operation with APS
with mitigation measures.

2.8 Future Developments

Although the APS proposed in this paper is assumed to be used for manned autonomous navigation, it
can also be utilized as a basic system for remote control or fully autonomous navigation in the future.
In case of remote control, it is necessary for the remote operator to acquire information including
visibility from the bridge by providing additional sensors, cameras, and a large-scale communication
infrastructure. In addition, it is necessary to have redundancy and fallback mechanisms mainly for
communication failure. As for fully autonomous navigation, it is necessary to guarantee that the
available information, through additional sensors and cameras, be enough to conduct holistic judgment
without human assistance.

3. Demonstration of APS

9
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

The NYK Group has been selected by MLIT to participate in a demonstration project utilizing ship
maneuvering support functions and remote control. During this project, NYK aims to make use of APS
in actual sea conditions. The demonstration test will be carried out on a tugboat in the latter half of
FY2019.
Several APS functions are going to be verified in this test. Specifically, in order to support ship
maneuvering and reduce the workload of human beings on board, a voyage plan will be prepared at a
remote location and presented to the vessel, and after verification and approval by the vessel crew, the
system will conduct navigation according to the plan. If there is a need to navigate against the voyage
plan, such as to avoid the risk of collision with surrounding vessels, the vessel crew will override the
system as appropriate. As the test system will not verify all APS functions shown above, additional
demonstrations or simulations will be conducted in the near future.

4. Conclusion
This paper introduced the concept of Action Planning System (APS), which is being developed and
demonstrated as a core technology of manned autonomous navigation by the NYK Group. According
to the risk assessment we conducted with reference to class guidelines for autonomous ship, APS with
risk-mitigation measures has a much higher safety level than current navigation systems. This system
will be verified by the demonstration in actual sea conditions in FY2019.

References
[1] Rolls Royce, Press Releases, [Link]
[Link] (Accessed
December 2018)
[2] ABB, Group Press Release, [Link]
groundbreaking-trial-of-remotely-operated-passenger-ferry (Accessed December 2018)
[3] DNV GL, Class Guideline - Autonomous and remotely operated ships, 2018
[4] ClassNK, Guidelines for Concept Design of Automated Operation and Autonomous Operation of
ships (provisional version), 2018 (Japanese)
[5] NYK Line website: [Link] (Accessed
September 2018)
[6] Kutsuna, K. et al., Feasibility Study of Automated Process of Ship Navigation and A Framework
of Action Planning System (APS), 1st international Conference on Maritime Autonomous
Surface Ships (ICMASS), 2018
[7] Höyhtyä, M. et al., Connectivity for autonomous ships: Architecture, use cases, and research
challenges. International Conference on Information and Communication Technology
Convergence (ICTC): 345-350, 2017
[8] American Bureau of Shipping, Guide for Dynamic Positioning System, 2014
[9] Heikkilä, E., Safety Qualification Process for an Autonomous Ship Prototype – a Goal-based
Safety Case Approach, 12th International Conference on Marine Navigation and Safety of Sea
Transportation, 2017
[10] Ramos, M.A. et al., Accounting for human failure in autonomous ship operations. Safety and
Reliability – Safe Societies in a Changing World, Taylor & Francis Group, 2018
[11] DNV GL, Marine Systematic Cause Analysis Technique - An Introduction, 2015
[12] Oil Companies International Marine Forum, Marine Injury Reporting Guidelines, 1997
[13] BIMCO et al., The Guidelines on Cyber Security Onboard Ships Version 3, 2018
[14] American Bureau of Shipping, ABS Guide for Cybersecurity Implementation for the Marine and
Offshore Industries - ABS CyberSafety™ Volume 2, 2018
[15] National Institute of Standards and Technology, Framework for Improving Critical Infrastructure
Cybersecurity Version 1.1, 2018
[16] Rokseth, B., Safety Verification for Autonomous Ships, MATEC Web of Conferences 273, 02002,
2019

10
MTEC/ICMASS 2019 IOP Publishing
IOP Conf. Series: Journal of Physics: Conf. Series 1357 (2019) 012013 doi:10.1088/1742-6596/1357/1/012013

[17] Montewka, J. et al., Challenges, solution proposals and research directions in safety and risk
assessment of autonomous shipping, Probabilistic Safety Assessment and Management PSAM
14, 2018

11