Collision Risk Analysis of Maritime Autonomous Surface Ships Considering Mental Workload of Shore Control Center Operators

Zhaohong Liu^1,2, Haiyang Che^1,2,*

1 School of Reliability and Systems Engineering, Beihang University, Beijing 100191, China

2 Science & Technology on Reliability & Environmental Engineering Laboratory, Beijing 100191, China

* Corresponding author: chehaiyang@buaa.edu.cn

Article TypeResearch Article AccessOpen Access LicenseCC BY 4.0 ReceivedNot listed RevisedNot listed AcceptedNot listed Published OnlineApril 5, 2026 DOITo be assigned Copyright© 2026 The Author(s)

Abstract. Although Maritime Autonomous Surface Ships (MASS) can detect and avoid collisions autonomously, they should be supervised or intervened by shore control center operators (SCCOs) if necessary. SCCOs may operate with a dynamic level of human control (LoHC) and their mental workload (MWL) increases with the LoHC. In addition, SCCOs represent the ultimate safety barrier for collisions, while a high MWL (HMWL) may cause human errors and increase collision risks. In this paper, a collision risk analysis method considering SCCOs’ HMWL is first proposed based on fault tree (FT). HMWL mechanism is investigated and a HMWL-performance dependency (HMWL-PDEP) Gate is proposed to describe the occurrence and effects of HMWL. Its inputs include the tasks of current LoHC, and HMWL occurs when task demand exceeds SCCOs’ ability. Then, HMWL triggers related errors of commission and omission uncertainly. Through the HMWL-PDEP Gates of different LoHC, the dynamic LoHC and HMWL are added to conventional FT. To analyze the FT with HMWL-PDEP Gates where exists the probabilistic change of LoHC and non-deterministic relationships due to HMWL, an implicit-explicit method is proposed. The proposed FT-based method obtains a more rational collision probability and critical events, and provides a safer behavior strategy for SCCOs with HMWL.

Keywords: risk analysis, MASS collision, mental workload, human error, FTA.

1. INTRODUCTION

Maritime Autonomous Surface Ships (MASS) have recently attracted increasing interest in academia and industry [1-3]. Several research projects and forums focus on developing MASS, such as the Advanced Autonomous Waterborne Applications Initiative (AAWA) [4], the Maritime Unmanned Navigation through Intelligence in Network (MUNIN) [5], and the Norwegian Forum for Autonomous Ships (NFAS) [6]. Although autonomous technology for MASS is developing rapidly, a fully autonomous MASS without human supervision or intervention is not expected to be realistic in the near or intermediate future [7]. Current literatures position themselves one or two steps below the maximum number of the level of autonomy (LoA) to show that MASS are highly autonomous while not autonomous enough to exclude humans [8]; for example, the third LoA, defined as “ships can be controlled remotely without any crew on board [9]”, is studied most widely. They introduce an onshore control room called the Shore Control Center (SCC), where the operators can monitor MASS or control remotely [5].

The human-autonomous system (H-AS) collaboration is crucial for ensuring MASS safety [10, 11], and human errors (HEs) are the critical navigational risk factors for highly autonomous ships [12-14]. SCC operators (SCCOs) represent the ultimate and most important safety barrier for MASS against the occurrence of accidents [15-17]. They will be expected to intervene and bring the MASS back to safety through remote control if the autonomous system is subjected to an abnormal situation that cannot be solved by itself. Guo et al. [18] suggest that the failure probability of a MASS is most sensitive to “the failure of the remote supervisor’s intervention”. The International Maritime Organization (IMO) indicates that “the human element is one of the most important contributors to the causation and avoidance of accidents.”[19].

The ‘‘collision’’ scenario is considered to be one of the most serious accident among potential MASS hazards [18, 20]. Collision avoidance is a complex multitasking problem because it is dependent on many factors such as own ship-related data, data on collision candidates, and environmental data [21]. SCCOs may operate with a dynamic level of human control (LoHC): initially, they monitor necessary information with low LoHC (LLoHC); when a collision candidate is detected, they will assess autonomous solution and decide on a strategy with intermediate LoHC (ILoHC), or remotely control MASS to safe path with high LoHC (HLoHC) if the MASS cannot provide a solution for collision avoidance or if the SCCOs disagree with the autonomous solution [15]. Under ILoHC and HLoHC where the task complexity increases suddenly and the available time may not be sufficient, mental workload (MWL) research is usually the most pertinent and/or most pursued. SCCOs must perceive enormous amounts of visual data to compensate for the lack of the feeling of the environment inside or outside a ship [22]. In other words, replacing the bodily feel of the MASS with visual indications in the SCC could result in the trade-off of information overload [23]. The information overload has been considered as the primary factor that influences operators’ decisions and actions when working onshore [24]. For SCCOs, high MWL (HMWL) is a very real concern [25], which can result in forgetting or mistaking tasks [26] and can be considered as an important precursor to accidents [22, 27]. Therefore, autonomy may have detrimental effects on the MWL of SCCOs, and increase the risk of collision accident [22].

The required cognitive resources increase with the LoHC, and HMWL will occur if the amount exceeds a certain threshold [28]. Visual, Auditory, Cognitive, and Psychomotor (VACP) method [29] and Multiple Resources Model (MRM) [30] are commonly used for predicting MWL. For example, based on VACP method, a discrete event simulation tool called Improved Performance Research Integration Tool (IMPRINT) is developed by the United States Army for modeling MWL [31]. Rusnock and Borghetti [32] indicate that HMWL is more likely to occur when MWL calculated by VACP exceeds the theoretical threshold value of 25. In literature, the effects of HMWL on human performance can be divided into two modes [33-35]: (a) leading to Errors of Commission (EOC), such as misreading information during collecting information, and (b) leading to Errors of Omission (EOO), such as abandoning the perception of parts of information during the assessment of autonomous solutions. Therefore, HMWL can be considered a common cause (CC) of HEs, and it is significant to incorporate HMWL into collision risk assessment of MASS. However, there are two main challenges: (i) the possibility of a dynamic LoHC, and (ii) the occurrence and effects of HMWL.

In recent years, Probabilistic Risk Assessment (PRA) method shows great promise for the risk analysis of MASS collisions. Fault trees (FTs) [36, 37] and Bayes Networks (BNs) [12, 18, 38, 39] are widely used to assess collision risk of MASS through analyzing risk influence factors (RIFs) and quantifying their cause–effect relationships and influence on collision. To investigate the effects of H-AS interactions on collision accident, several FT analysis (FTA) methods combined with task analysis (TA) and human reliability analysis (HRA) are proposed. TA analyzes how humans perform tasks through interacting with machines or other colleagues, and HRA analyzes what HEs may occur at each step of a task. Shuen-Tai Ung [40] incorporates Cognitive Reliability Error Analysis Method (CREAM) into FTA to assess the risk of ship collision. Ramos et al. [10] propose a concurrent TA method of MASS collision avoidance to perform the TA of each system’s agent concurrently. Failure events arising from interactions and failure propagation through agents are identified based on FTA. On the other hand, several studies introduce event sequence diagrams (ESDs) to describe event propagations and their consequences in H-AS collaborations. Hybrid Causal Logic (HCL) methods are proposed to link the outcomes of ESD and FTs to BNs, allowing for modeling non-deterministic cause–effect relationships due to human and organization behavior [41]. Inspired by the HCL method, Ramos et al. [1] propose a Human-System Interaction in Autonomy (H-SIA) method to analyze the collision risk of MASS while lacked the implementation of BNs. Wu et al. [42] and Zhang et al. [43] propose a full HCL model for MASS operations to assess collision risk, focusing on the interactions between manned and unmanned ships and the H-AS interactions of SCCOs and MASS, respectively.

Although previous PRA methods have successfully considered HEs during H-AS interactions, they do not consider the MWL of SCCOs and MWL’s dynamics due to the dynamic LoHC. Among PRA techniques, FTA is the most prominent, recognized and widely used to analyze the risk of complex safety-critical systems [44-46]. In this paper, a risk assessment method of MASS collision considering MWL is proposed through an extension of FTA. During collision avoidance, the LoHC may change to ILoHC or HLoHC, and the MWL may increase significantly. The performance of SCCOs will degrade exponentially if HMWL occurs [47]. This decrease in performance will increase the probabilities of related HEs. Therefore, these HE events are no longer statistically independent, and the causal relationships between the HMWL and these events are non-deterministic. Such characteristics are considered as HMWL-performance dependency (HMWL-PDEP) which cannot be described by current FTA methods. When considering dynamic LoHC and HMWL, an expanded FTA method should be proposed for risk assessment of MASS collision.

To incorporate MWL into collision risk assessment, VACP method is introduced to evaluate the MWL and a HMWL-PDEP Gate is proposed based on the functional dependency (FDEP) gate [48]. This new gate can model the occurrence and effects of HMWL during collision avoidance. Its inputs include multiple task events of the current LoHC, involving information-perceiving, decision-making, and action-taking tasks, and they combine to cause HMWL when the cumulative task demands calculated by VACP method exceed the threshold limit of 25. Subsequently, effect (a) or (b) will be triggered, and one or more EOC or EOO events are forced to occur uncertainly. HWML occurs in the tasks of ILoHC and HLoHC and the HMWL-PDEP Gates of both ILoHC and HLoHC are developed. Their input tasks, MWL and output EOC and EOO events are different while some output events of HMWL-PDEP Gates of ILoHC (e.g. autonomous solution misdiagnosed in ILoHC) will trigger HLoHC. Through these new Gates, the dynamic LoHC and HMWL are added to conventional FT construction. To conduct a risk analysis of the FT with two HMWL-PDEP Gates, an implicit-explicit method is proposed. The proposed method provides a more in-depth analysis of MASS collision, and obtains the more rational collision probability and critical events, which demonstrates the effectiveness of the method.

The remainder of this paper is organized as follows. Section 2 specifies the MASS collision scenarios. Section 3 analyzes the SCCO’s behavior considering MWL during collision avoidance. In section 4, a FT model with HMWL-PDEP Gate is proposed to model the collision risk considering SCCO’s MWL. Section 5 proposes an implicit-explicit analysis method to analyze the collision risks and calculate collision probability. The result analysis and discussions are provided in Section 6. Section 7 gives the conclusions of this paper.

2. MASS COLLISION SCENARIO ANALYSIS

2.1. The concept of MASS

A MASS is defined as a kind of ships that can operate independently of human interaction to a varying degree [49]. This concept was proposed formally at the 98th Maritime Safety Committee (MSC) of the IMO in 2017 [50]. Nearly all the subsystems of MASS will be controlled through autonomous or remote mode, including ship state monitoring and collision avoidance decision-making [51]. The MASS may be manned with a reduced number of seafarers on board or unmanned with or without supervision by SCCOs and have the capabilities to make decisions and perform actions independently [51]. However, the more the autonomy degree and artificial intelligence increase, the more the system safety is need [52].

As for the LoA of MASS, more than six international authorities have published their versions of LoA for ships [53], such as IMO, Lloyd’s Register, NFAS, Danish Maritime Authority (DMA), and etc.. In 2018, IMO [9] adopted the taxonomy of autonomy levels proposed by DMA, as shown in Table 1. Such taxonomy with four LoA is adopted in this paper.

The concept of MASS is different from that of unmanned ships. As shown in Fig. 1, unmanned ships are an important stage in the development of MASS, and they are the manifestations of MASS reaching a high LoA [51]. Limited by the development of intelligence technology and maritime regulations, L1–L3 will coexist with MASS and humans for a long time which are practical solutions within the achievable range [11]. The remote-control mode supported by SCC corresponding to L2 and L3 in IMO’s description is focused more on in current academia and industry [8]. For the MASS with L3, there is no bridge or space for seafarers to operate it onboard. The SCCOs are the operators working in a SCC who constantly monitor the ship, take remotely control if necessary, and may contact/be contacted by crews/VTS. For the MASS with L2, the decisions and actions are performed autonomously with human supervision and authorization, including the SCCOs and officer of the watch (OOW) at manual control station onboard. Meanwhile, the SCCOs and OOW have the right to intervene the control of MASS. The OOW will be requested to receive the control of MASS in necessary or emergency such as the communication between SCC and ship is unexpectedly interrupted or SCCO’s failure to perform collision avoidance operations, to ensure the MASS safety [51].

In this paper, we focus on the MASS with L3 that is remotely controlled by SCCOs and unmanned on board. The MASS may face unfavorable situations such as potential collision scenarios and then generate a collision alarm and an autonomous solution. If the situation cannot be handled by MASS, the danger warnings will be sent to the SCC to seek assistance from human intervention [12]. The behavior of SCCOs with MWL and its effects on collision accident are studied in this paper. In addition, the collision risk analysis method can be also applicable to the MASS with L2 through considering the OOW on board.

2.2. Collision scenarios for MASS

Collision can be defined as the contact between two or more ships, or between a ship and a fixed or floating structure [10]. In this paper, the initiating situation of collision scenario is being on collision course with another ship named target ship, i.e., two ships will collide if no action is taken [54]. The encounters of MASS and the target ships may be of head-on, overtaking, contact, crossing type, or allision type, as shown in Fig. 2. For each type of encounter, the ships must follow the international rules for collision avoidance–COLREGs and local rules. For head-on scenario (1), both MASS and target ships need to change their course to starboard (right in the direction of travel based on Rule 14 in COLREGs). For overtaking scenario (2), the MASS is responsible for avoiding collision based on Rule 13 in COLREGs. For crossing scenario (4), the MASS requires to alter course and speed to avoid collision based on Rule 15 (i.e., Crossing collision require the ship having the crossing ship on starboard to alter course and speed to avoid collision). Similarly for scenarios (3) and (5), the MASS has to take actions to avoid collision with objects.

In this paper, the crossing type i.e. scenario (4) that is the most common situation leading to collision accidents [55] is the considered collision scenario of ship-ship encounter. On such condition, the MASS is the main responsible for avoiding collision according to COLREGs. The MASS has to make a collision avoidance maneuver which may involve changing the course and speed. In addition, the target ship is a manned ship and the SCCOs can communicate with the seafarers on the target ship to collect/identify/inform the necessary information.

The collision scenario begins with the detection of the target ship by the MASS. Then an audible and visual alert at the SCC will be triggered and an autonomous solution for collision avoidance will be provided on the screens. Normally, each SCCO monitors six MASS through a monitoring and controlling workstation [15]. Once the SCCO identifies the source of the alert, s/he focuses more on the MASS with collision alert. The SCCO should perceive information about the information available on the screen during regular operation (own ship status –equipment status, speed, fuel, direction; waves; weather; surroundings) and the target ship status (direction, speed, etc.) to evaluate the autonomous solution provided by MASS. MASS will execute it if agreed the autonomous solution, otherwise the SCCO will switch the MASS to manual mode, plan the safe path by himself and remotely control the MASS. In addition, MASS may not be able to generate an autonomous solution due to the complexity of the situation or machine failure. In this case, the SCCO is required to plan the safe path by himself and remotely control the MASS. The SCCO can communicate with VTS, crews, and target ship when evaluating the autonomous solution and planning the safe path.

3. ANALYSIS OF SCCO’S BEHAVIOR WITH MWL

The SCCO’s LoHC depends on the evolution stages of collision scenario, and the MWL changes accordingly. The dynamic LoHC and HMWL are analyzed and HMWL-PDEP is described in this section.

3.1. Dynamic LoHC and HMWL

For a MASS with L3, it is either responsible for the collision avoidance task on its own or in conjunction with the SCCOs. In the MASS operations, collision avoidance task will be performed by the autonomous system, and supervised or intervened if necessary by the SCCOs. There are three dynamic LoHC (i.e. LLoHC, ILoHC, and HLoHC) for a SCCO adopted from the human-centered AI “stage of automation” framework [8, 56]. The TA of collision avoidance has been conducted by Ramos et al. [1, 10, 15] based on IDA model to obtain the detailed operations of SCCOs with each LoHC. IDA model consists of information processing (I), problem solving and decision-making (D), and action execution (A), and details can be found in a series of five literatures [57-61]. IDA model is also widely used to analyze other emergency response processes of the SCCOs [12, 62]. According to the detailed descriptions of TA in [1, 10, 15], the operations with each LoHC at a high level of task goal are described as follows:

l  Operations with LLoHC: (1) monitor MASS status, and (2) be aware of collision alert;

l  Operations with ILoHC: (1) collect information, (2) assess the autonomous solution by own and crews and decide on manual or autonomous strategy in terms of successful collision avoidance;

l  Operations with HLoHC: (1) put ship on manual control, (2) redirect ship on safe path, and (3) enter rational commands or waypoints.

The dynamic LoHC during H-AS interactions in collision avoidance tasks is shown in Fig. 3. As the SCCO detects collision candidate by an alarm, the LoHC will increase from LLoHC to ILoHC or HLoHC. As studied in [1, 10, 15], the SCCO’s tasks will follow ILoHC if the MASS has an autonomous solution for the collision scenario. The SCCO need collect necessary data on both candidate and own ships and autonomous solution through screens. In addition, s/he should assess the solution and identify the solution assessment through consulting with crews/VTS. The task difficulty and complexity are usually higher than the ones with LLoHC.

However, if the MASS fails to develop an autonomous solution, the SCCO is warned to redirect the MASS to safe path with HLoHC. In addition, two main scenarios will result in a change of LoHC from ILoHC to HLoHC as depicted by two blue arrows in Fig. 3: (i) the autonomous solution provided by MASS is wrong and the SCCOs disagree with the autonomous solution to avoid collision; and (ii) the SCCOs misdiagnose the correct autonomous solution and select the remote control mode incorrectly. It indicates that the collision situation relatively complex or the data collected by MASS is wrong or inadequate. Therefore, the SCCO need collect necessary data through screen and identifies the data through communication with target ships and VTS. Then s/he provides the safe path by consulting with crews and VTS. In addition, the SCCO enters the commands/waypoints serially through the keyboard or the screens within a limited time after the safe path is identified by the VTS. Therefore, the task difficulty and complexity with HLoHC is the highest.

Operations with different LoHC will invoke different types and levels of cognitive demands, resulting in different levels of MWL. In this paper, the operations with ILoHC and HLoHC are focused on because the task difficulty and complexity are higher and the HMWL will occur under these two conditions. During H-AS interactions, as depicted by red arrows in Fig.1, HMWL could lead to HEs (e.g., “agree with wrong autonomous solution” during ILoHC, “unsafe path is identified” during HLoHC, etc.) that can finally lead to a collision accident.

3.2. Dependency between HEs due to HMWL

“Mental workload describes the relation between the (quantitative) demand for resources imposed by a task and the ability to supply those resources by the operator” [30]. Wickens [35] investigates the schematic relationships among task resources demand, supplied resources, and human performance, as shown in Fig. 4. The X-axis represents the increasing task resource demands, while the Y-axis represents “resources supply” and “human performance” functions. As the task demand exceeds the supply, the solid line representing the resource supply flattens because no further resources can be supplied by operators. The “human performance” is depicted by the heavy line. When supply exceeds the demand, human performance remains perfect, and unchanged before exceeding a certain value of demand. Once reach such value, even though the demand does not exceed the maximum of supply, operators need take more effort to invoke resources, which subsequently degrades the human performance [63]. Such point can be considered as the “performance degradation line (PDL)” of MWL. As demand exceeds supply referred to as the ‘red line’ of mental overload (MOL) [25], further increase of demand will lead to performance degrading rapidly.

As discussed above, the collision avoidance may experience three LoHC, and the SCCOs with each LoHC perform tasks following IDA cognitive model. During the IDA processes of each LoHC, EOO and EOC, and machine failures (MF) will occur and result in the collision accident, as shown in Fig. 5. All of the IDA tasks invoke the cognitive resources such as visual, auditory, cognition, and response resources from the resource pool of the SCCOs. In addition, as the LoHC changes to ILoHC or HLoHC, the demand for resource increases significantly. The MWL may exceed the PDL and HMWL occurs. HMWL will result in two effects, as shown in Fig. 5: (a) degrades human performance and increases the probabilities of EOC events, as shown by the green lines in Fig.5, or (b) abandons parts of IDA tasks (i.e. EOO of tasks), as shown by the yellow lines in Fig.5. Therefore, the EOO and EOC events in IDA tasks are dependent due to HMWL. Such dependency is considered as HMWL-PDEP in this paper. These events can occur with different individual probabilities, while their occurrence probabilities may increase as HMWL occurs. The causal relationships between HMWL and these events are often uncertain and non-deterministic.

For the collision avoidance task, SCCOs are subject to dynamic LoHC and HMWL, and EOC and EOO events experience HMWL-PDEP and non-deterministic causal relationships due to HMWL. In existing FTA methods, the basic events are assumed to be statistically independent and the causal relationships among events is deterministic, i.e., some combinations of basic events guaranteed the occurrence of higher level events [64]. Therefore, it is a challenging issue to propose a FT model of MASS collision.

4. PROPOSED FT-BASED RISK MODEL OF MASS COLLISION CONSIDERING MWL

In this paper, a collision risk analysis method considering MWL is proposed based on FTA method. The HMWL mechanism is investigated first to describe how HMWL occurs and what its effects are. Then a HMWL-PDEP Gate is proposed to incorporate HMWL into FT construction. Finally, a FT with HMWL-PDEP Gates of ILoHC and HLoHC for analyzing MASS collision is proposed.

4.1. HMWL mechanism

4.1.1. The occurrence of HMWL

VACP method originally established by McCracken and Aldrich [29] provides a computational model for calculating total resource demand of collision avoidance tasks. It has been widely used in several safety-critical systems to analyze and predict MWL, such as in a helicopter [29], a remotely piloted aircraft [32], and a car [65]. The MWL of the SCCO is the sum of visual, auditory, cognitive, and psychomotor demands. Each part of VACP defines several encoded abstract behaviors whose rating ranges from 0 to 7. Alion [66] subdivides psychomotor demand into Fine motor, Gross motor, Speech, and Tactile demands, as presented in Table 2.

According to the results of TA in [1, 10, 15] and the description of each LoHC in Section 3.1, the decomposition of the goal of each LoHC into subordinate task goals is conducted. Then, we analyze the SCCO’s behaviors with each LoHC in detail to match the VACP rating scales, as shown in Table 3. It can be seen that the task difficulty and complexity increase with LoHC.

The task demands for resources can be measured from basic abstract behaviors based on the VACP rating scales [67]. The VACP rating scales will aid in increasing consistency and reduce inter-rater variability [32]. After decomposition of the task to the abstract behaviors, we determine their demand ratings and then the MWL under each LoHC can be predicted by the summation of VACP demands, as shown in Table. 3. In general, the MWL of the SCCOs increases with the task difficulty and complexity. As expected, the sequence of the MWL from low to high in order is: LLoHC, ILoHC, and HLoHC.

It is common knowledge that the cognitive resources are limited. Rusnock and Borghetti [32] indicate that the threshold value of the PDL is 25; thus, workload levels below 25 are within comfortable limits for their operator. As the MWL increases further, human performance will degrade and the probabilities of EOO and EOC increase due to HMWL. Therefore, HMWL can be assumed to occur when . ILoHC and HLoHC can lead to HMWL based on the MWL calculated by VACP method.

4.1.2. The effects of HMWL

To investigate the effects of HMWL, it is important to understand the strategy of human behavior when HMWL occurs. Wickens et al. [33, 35] divide the HMWL behaviors strategy into two possible modes:

(a) Perform all tasks while degrade their performance: operators may perform all of the tasks, while may allow human performance degrades because attention is divided by sharing limited, multiple resources. Under such conditions, the degradation of human performance will increase the probabilities of EOC and then degrade task performance.

Based on the human error model with MWL in [47], the probabilities of EOC events can be considered as an exponential function of MWL. In this paper, an EOC model for SCCOs adapted from [47] is developed as

where  is the normal probability of HE with a nominal level of MWL calculated by HRA method, and  is the dependence factor describing the effects of the HMWL on  and its value can be estimated using test data [47].

(b) Shed tasks and abandon parts of tasks: operator may choose to abandon one or more tasks until the HMWL is relieved, which can be considered as an EOO. The tasks may be shed together in an optimal fashion, and those with lower priority will be eliminated more likely.

As HMWL occurs, the probability that the SCCOs eliminate the task with the th priority, i.e. the probability of , is assumed to be

where  is the total number of tasks. The formulation is taken from [68] and satisfies  and .

Unfortunately, beyond the literature on resource allocation and task management, little is known when humans adopt one mode or the other [25, 35]. However, the probability of adopting effect (b) will increase as  increases and effect (b) must be adopted in serious HMWL situations because adopting effect (a) in such situations is impossible [33].

4.2. Proposed HMWL-PDEP Gate

Based on the HMWL mechanism, a new logic gate called HMWL-PDEP Gate is proposed to incorporate HMWL into FTA. As shown in Fig. 6, this Gate consists of HMWL and PDEP gates. The MWL is dependent on the LoHC. Considering ILoHC as an example, the HMWL gate can describe the occurrence of HMWL, which is proposed based on VACP method. The inputs of HMWL gate are the tasks with ILoHC, including . These tasks will increase the risk of HMWL, and the output of the HMWL gate (i.e. a  event) occurs if , where  is the MWL of ILoHC calculated based on VACP method.

The PDEP gate can describe the effects of HMWL and it is proposed based on a probabilistic common cause failure gate [69] which extends FDEP gate [48] to model its outputs occurring with probabilities. The input of the PDEP gate is a  event. As the  event occurs, effect (a) or (b) will be triggered with certain (maybe different) probabilities  or , respectively. In addition, only one mode can be triggered at a time and . As discussed in Section 3.1.2,  will increase with , and may be equal to 1 in serious HMWL situations.

As the  occurs, the occurrence probabilities of these EOC events are increased by . Based on Eq. (1),  can be obtained through

where  is the probability of jth EOC event in ILoHC calculated by HRA methods under normal level of MWL. The occurrence probabilities of these EOO events are increased by . Based on Eq. (2),  can be calculated using Eq. (4) if the priority of task denoted as  is determined.

where  is the occurrence probability of th EOO events with normal MWL.

4.3. FT of MASS collision with dynamic LoHC and HMWL

4.3.1. Conventional FT of MASS collision

Based on the collision scenario analysis in Section 2, the elements influencing MASS collision consists of MASS, SCCOs, crews in SCC, VTS, environmental conditions, target ship, and seafarers on the target ship. In this paper, we investigate SCCO’s behavior with MWL and the possible human errors including EOO and EOC, and their effects on MASS collision. Therefore, we focus more on the elements that interact with SCCO including human machine interface and communication system of MASS, crews, VTS, and seafarers on the target ship and the MASS systems related to collision avoidance. The failures of these elements and their effects on MASS collision is investigated through conventional FT model.

Although the MASS is the main responsible for avoiding collision, the target ship should take measures to avoid collision if the MAAS is not controllable or has limited maneuverability [10]. Therefore, the MASS collision will occur if the MASS and target ship both fail to avoid collision. In this paper, The FT of the failure to avoid collision by MASS is investigated. The conventional FT of MASS collision is conducted based on the FTs for autonomy failure events and human failure events in [1]. The FT construction of the MASS collision accident without MWL is shown in Fig. 7. The collision accident is due to “failure to detect target ship” (G1), “Adopt unsafe avoidance solution” (G2), or “Failure to implement avoidance solution by MASS” (G3). G2 could occur in autonomous control mode (G4) or manual control mode (G5). The detailed FT constructions of these events are described below.

(1) Failure to detect target ship (G1)

The SCCOs can fail in detecting target ship when they fail to detect target ship through screens (G6) and to perceive and identify collision alert (G7) during supervision safety status of MASS. Such failures may be caused by the combinations of MFs, EOO, and EOC. To detect target ship through screens, the SCCOs need check the collision related information through screens and then recognize if there is a target ship. In addition, the SCCOs can also detect a target ship through collision alert. They need perceive (listen or visualize) the alert and identify its cause or source. The detailed FT construction of G1 is shown in Fig. 8, and the descriptions of the basic events are shown in Table 1 in the Appendix.

(2) Adopt unsafe avoidance solution in autonomous control mode (G4)

After successfully detecting the target ship, the SCCOs will assess the autonomous solution proposed by MASS and decide on strategy – autonomous or manual mode. The detailed FT construction of G4 is shown in Fig. 9, and the descriptions of the basic events are shown in Table 1 in the Appendix. G4 will occur if a wrong autonomous solution is provided by MASS (G10) and the wrong solution is chosen (G11). MASS generate an autonomous solution based on the following steps: (i) collect necessary data, and (ii) decide a solution to avoid collision [1]. The failure of each step can lead to wrong autonomous solution. During assessing the wrong autonomous solution, G11 event will occur if the SCCOs fail to assess wrong autonomous solution (G12) and the SCCO fails to identify wrong agree autonomous solution by crew/VTS (G13). G12 will occur if the SCCOs fail to collect necessary data through screens (G14) or agree with the wrong solution even though necessary data is successfully collected (G15).

(3) Provide unsafe avoidance solution in manual control mode (G5)

When the SCCOs choose the manual mode, MASS will fail to avoid collision if the SCCOs fail to redirect MASS to safe path. As discussed in Section 3.1, the manual mode with HLoHC will be chosen if no autonomous solution provided (X18) or the autonomous solution is not chosen (G18). In addition, X18 and G18 Connect to G16 via an XOR gate because they cannot occur concurrently. Then, the SCCOs need collect necessary information to develop a safe path plan. Finally, the SCCOs enter waypoints to redirect MASS to the safe path. The detailed FT construction of G5 is shown in Fig. 10, and the descriptions of the basic events are shown in Table 1 in the Appendix.

(4) Failure to implement avoidance solution by MASS (G3)

After a safe collision avoidance solution is adopted, the MASS will implement this solution through the control systems and execution systems. MASS will fail to avoid collision due to the failures of these systems. Such failures are mainly caused by MFs, and the detailed FT construction of G3 is shown in Fig. 11. The descriptions of the basic events are shown in Table 1 in the Appendix. The event “Loss of control” (X35) is mainly due to the interruption of communication link and environmental factors, while the event “Limited maneuverability” (X36) is mainly due to the failure of some control component.

4.3.2. Proposed FT of MASS collision with HMWL-PDEP Gates

As a target ship is detected, the SCCOs will perform the tasks with ILoHC or HLoHC, and HMWL occurs. Thus, the SCCOs’ behaviors are subjected to HMWL-PDEP. To model the dynamic LoHC and HMWL, two HMWL-PDEP Gates are developed.

For ILoHC, the HMWLI-PDEP Gate is shown in Fig. 12. The ILoHC will occur if an autonomous solution to avoid collision is provided by the MASS. The SCCOs need collect necessary information including own ship data, target ship data, and environment data, through screens. Then the SCCOs will assess the solution by their own mental models or consulting with teams. Thus the inputs of HMWL gate of ILoHC including 3 subtasks as shown in Table 3. The priority is given to “Assess the autonomous solution” (denoted as ), the secondary task is “Collect necessary information” (denoted as ), and the third priority task is “Identify the solution assessment” (denoted as ), because  is a confirmation task. The MWL calculated by VACP method is 27.2 and then the HMWL will be triggered. The HMWL will increase the probabilities of EOO and EOC that may occur in ILoHC, as shown in Fig. 12. These EOO and EOC events are forced to occur with increased probabilities  and  respectively. These events are dependent due to the “” event and their non-deterministic causal relationships from  are described by  and .

For HLoHC, the HMWLH-PDEP Gate is shown in Fig. 13. The HLoHC will occur if MASS cannot provide an autonomous solution to avoid collision. In addition, HLoHC may be introduced during performing the tasks of ILoHC if the provided solution is wrong or the SCCOs misdiagnose a right solution. The detailed causes of the occurrence of HLoHC can be seen in Fig. 13. During HLoHC, the inputs of HMWL gate of HLoHC including 6 tasks as shown in Table 3. The priority is given to “Put ship on manual control”, “Provide collision avoidance solution by SCCOs”, and “Enter rational commands/waypoints”, and they are all denoted as , the secondary task is “Collect necessary information” (denoted as ), the third priority task is “Identify the safe path with VTS” (denoted as ), and the fourth priority task is “Identify the collision situation with crews/target ship/VTS” (denoted as ) because  and  are confirmation tasks. In addition, for HLoHC, the  cannot be abandoned because MASS cannot be controlled without these three tasks. The MWL calculated by VACP method is 41.6 and then the HMWL will be triggered. The HMWL will increase the probabilities of EOO and EOC that may occur in HLoHC, as shown in Fig. 13. These EOO and EOC events are forced to occur with probabilities  and  respectively.

The proposed FT of MASS collision with dynamic LoHC and HMWL is shown as Fig. 14. The human behaviors considering HMWL during performing tasks of ILoHC and HLoHC are modeled through the proposed HMWL-PDEP Gate. In addition, the dynamic LoHC can also be described through this new Gate. The HEs in ILoHC i.e. “misreading autonomous solution” (X19) and “autonomous solution misdiagnosed” (X20) and the MFs including X4 and X10 that lead to wrong autonomous solution (G21) will introduce HLoHC. Then, the LoHC will change from ILoHC to HLoHC, and the MWL will change from 27.2 to 41.6 accordingly. By adding these two HMWL-PDEP Gates to conventional FT, the dynamic LoHC and HMWL due to H-AS interactions, and uncertainties and dependence of HE events due to HMWL, are described successfully.

4.4. Extension: collision risk model of MASS with L2

L3 is focused more on by current literatures [1, 10, 15, 43] and it is the next achievement goal in unmanned navigation primary phase. However, L2 is a practical solution within the achievable range according to the current development of intelligence technology and maritime regulations [51]. To make the proposed collision risk analysis method applicable to the MASS with L2, a FT of MASS collision is also developed through considering the behaviors of OOW on board.

Under normal considerations, the MASS with L2 is operated by operators of SCC or execute autonomous navigation in predefined plan and operational envelope without human intervention. Under the emergency conditions such as the communication between SCC and ship is unexpectedly interrupted or SCCO’s failure to perform collision avoidance operations, the OOW should be requested to receive the control of MASS to ensure the MASS safety [51]. Therefore, the escalation of collision accident for MASS with L2 is mostly the same as it for MASS with L3. The OOW represents the ultimate and most important safety barrier for MASS against accident occurrence. The FT construction of the collision accident for MASS with L2 is shown as Fig. 15. The top event of the FT in Fig. 7 is expressed as “Failure to avoid collision by autonomy and SCCOs”, and it cannot cause the MASS collision directly. Only when the intervention of OOW during emergence is also failed (G6), the MASS collision will occur.

The OOW should check necessary information through lookout or screens and diagnose the collision emergency by himself or consulting with SCCOs when the MASS implements collision avoidance solution. After detecting such emergency, the OOW need take evasive actions timely and the MASS should implement the collision avoidance actions in manual mode. Therefore, the event “Failure to avoid collision by OOW” (G6) will occur due to “Failure to detect collision emergency”, “Failure to take evasive action” or “Failure of MASS to implement collision avoidance solution”. The detailed FT construction of G6 is shown in Fig. 16. In addition, the MWL of OOW can be evaluated through the VACP method. If the value of MWL is more than 25, the HMWL-PDEP Gate should be proposed based on the method in Section 4.2 and incorporated into the FT construction based on the method in Section 4.3.2. Finally, the FT can be analyzed through the implicit-explicit method proposed in Section 5.

5. PROPOSED ANALYSIS METHOD

HMWL can be considered as a CC that probably leads to EOO and EOC of human behaviors during performing with ILoHC or HLoHC. Therefore, the EOO and EOC events for ILoHC or HLoHC are no longer independent due to the HMWL. The existing approaches to analyze the FT model with CCs can be classified into two categories: explicit and implicit approaches [51]. For explicit approaches, their basic idea is to analyze an expanded system model built through considering CC as a basic event shared by all the related events and incorporating CC into original FT model [70]. For the other one, the basic idea is to develop the FT without the effects of CCs and then evaluate the FT including the contributions of CCs through some special treatments [69]. This section develops a method to analyze FT with two HMWL-PDEP Gates based on the abovementioned explicit and implicit approaches.

For collision avoidance tasks, there are two operational scenarios (OS) for SCCOs when detecting a target ship [1, 10, 15]: (i) when the MASS provides an autonomous solution, the SCCOs assess the solution while they will change to take over control remotely to redirect MASS to safe path if they disagree with the solution, denoted as ; and (ii) when the MASS cannot provide an autonomous solution, the SCCOs take over control directly, denoted as . Therefore,  and  are mutually exclusive, and they are dependent on the occurrence or nonoccurrence of X18 (no autonomous solution provided by MASS). On such condition, an explicit method is difficult to proposed, while an implicit method can overcome this problem. However, during performing the tasks of  with ILoHC initially, HLoHC will be introduced if X4, X10, X19, or X20 occurs in ILoHC. In addition, the  increases the probabilities of EOC events, X19 and X20, in ILoHC. Therefore,  promotes the change of LoHC from ILoHC to HLoHC. Such dependence is difficult to be addressed directly through the implicit analysis. An explicit method is incorporated to the implicit analysis of . Finally, to conduct the collision risk analysis of FT with HMWL-PDEP Gates, an implicit-explicit method is proposed as following six-step processes.

Step 1: Construct an OS space that involves all the combinations of simultaneous occurrence and non-occurrence of  and , and then evaluate occurrence probability of each combination.

An event space that consists of 2 disjoint scenarios is constructed because  and  are mutually exclusive. Such scenario is called a probabilistic OS (POS). Two POSs are as follows:

For example,  represents the event that  occurs while  cannot occur. The sum of the occurrence probabilities  is 1, i.e., .  is equal to the probability that the MASS can provide an autonomous solution.

Step 2: Build the risk model of MASS collision without considering the effect of HMWL under each POS.

A reduced FT should be constructed first under each POS. For each POS, its occurrence (or non-occurrence) implies the non-occurrence (or occurrence) of “no autonomous solution provided” (X18) event. In addition, X18 should be replaced with logical ‘0’ (or ‘1’) when constructing the reduced FT under . The fault logics of the LoHC that do not occur under  need to be deleted from the original FT.

(1) Reduced FT of  without the effects of

Based on the original FT (i.e. Fig. 14 excluding the HMWLI-PDEP gates), a reduced FT without considering the effect of  under  can be built, as shown in Fig. 17. For , the occurrence of  implies that X18 does not occur. Therefore, X18 should be replaced with constant ‘0’.

(2) Reduced FT of  without the effects of

Based on the original FT (i.e. Fig. 14 excluding the HMWLH-PDEP gates), a reduced FT without considering the effect of HWML under  can be built, as shown in Fig. 18. For , the occurrence of  implies that X18 should be replaced with constant ‘1’. In addition, G4 with ILoHC does not occur, and its fault logic should be deleted from the original FT.

Step 3: Evaluate the total occurrence probability for each EOO and EOC event under  and .

Let  denote the individual occurrence probability of the th EOC event ,  denote the individual occurrence probability of th EOO event , and  and  denote the increased occurrence probabilities of  and  respectively. For , the total occurrence probabilities for EOC and EOO under , denoted by  and , are expressed as follows:

Step 4: Expand the reduced FT of  to include the effect of  on HLoHC under .

Based on the reduced FT of  (i.e. Fig. 12) excluding the HMWLH-PDEP gates, some independent pseudo-nodes representing the EOO or EOC events triggered by  are added. Since an EOO or EOC event occurs either locally or following  affecting this HEs, the total EOC and EOO events can be represented by logical expression.

Fig. 19 illustrates the FT model representing Eq. (8). The occurrence probabilities of  and  (denoted by  and , respectively) are the increased failure probabilities of EOC and EOO events given that  occurs. After establishing the sub-FT models as shown in Fig. 19 for all the EOC and EOO events influenced by , the expanded FT can be established as shown in Fig. 20 by using them to replace the corresponding EOC and EOO events in the reduced FT of  (i.e. Fig. 17) excluding the HMWL-PDEP Gates.

Step5: Calculate reduced/expanded FT models using the total occurrence probabilities of human behavior events under POS.

Let  denotes the conditional accident probability given that  occurs.  can be computed by evaluating the expanded FT models established in Step 4, where the total probabilities of EOC and EOO events affected by  are obtained in Step 3. can be computed by evaluating the reduced FT models established in Step 2, where the total probabilities of EOC and EOO events affected by  are obtained in Step 3.

Step 6: Evaluate the collision probability of the MASS with dynamic LoHC and HMWL using the total probability law as

6. RESULT ANALYSIS AND DISCUSSIONS

6.1. Quantification of the basic events of the FT

6.1.1. Quantification of the basic events of the conventional FT

In this quantitative analysis, the probabilities of EOC events are calculated using a famous human error analysis method i.e. CREAM [71], which has been widely applied to analyze HEs in maritime area [40, 72]. The probabilities of “Abandon task” events i.e. EOO events are assumed to be 1e-4, which naturally cannot happen with a normal level of MWL. The individual occurrence probabilities of basic events are shown in Table 4. Based on the data of these events given by Guo et al. [18], the probability of “Failure to generate alert after collecting necessary data” (X1) is obtained to be 0.0316. The events “Failure probability of decision system on maneuvers to avoid collisions (X10)” and “No autonomous solution provided (X18)” are dependent on software reliability [42]. Their occurrence probabilities are both 0.07039 [37].

6.1.2. Quantification of the EOO and EOC events with HMWL

 will occur if the MASS cannot provide an autonomous solution. Thus  is equal to the probability of “X18”, i.e., . Then . The MWL in ILoHC and MWL in HLoHC are 27.2 and 41.6, respectively. HMWL occurs and will increase the probabilities of the EOO and EOC events. The corresponding parameters that describe the effects of HMWL on EOO and EOC are assumed in this paper, as shown in Table 5. Then, the total occurrence probability for each EOO and EOC event of reduced FT under  and  can be calculated.

(1) Evaluate the total occurrence probability for each EOO and EOC event under

Under , the EOC events X11, X14-X15, X17, X19, and X20, and the EOO events X12, X13, and X16 are affected. Based on Eq. (3), the increased occurrence probabilities for EOC events denoted as  can be calculated. Base on the tasks’ priority of ILoHC, the increased occurrence probabilities for EOO events denoted as  can be calculated using Eq. (4). Then, we can obtain the total occurrence probabilities for EOC and EOO events denoted as  and  using Eqs. (6) and (7), as shown in Table 6.

(2) Evaluate the total occurrence probability for each EOO and EOC event under

Under , the EOC events X22, X23, X25, X26 and X28-33, and the EOO events X21, X27, and X34 are affected. Based on Eq. (3) the increased occurrence probabilities for EOC events denoted as  can be calculated. Base on the tasks’ priority of HLoHC, the increased occurrence probabilities for EOO events denoted as  can be calculated using Eq. (4). Then, we can obtain the total occurrence probabilities for EOC and EOO events denoted as  and  using Eqs. (6) and (7), as shown in Table 7.

6.2. Result analysis

To model the dynamic LoHC and HMWL, a FT model of MASS collision with HMWL-PDEP Gate is developed as shown in Fig. 14. An implicit-explicit analysis method is proposed in Section 5 to analyze the FT with HMWL-PDEP Gates. Based on the initial probabilities of basic events in Table 4, the total probabilities of EOC and EOO events under  in Table 6, and the increased probabilities of EOC and EOO events under  in Table 7,  can be computed by evaluating the FT models established in Step 4, i.e., . In addition, based on the initial probabilities of basic events in Table 4, and the total probabilities of EOC and EOO events under  in Table 7,  can be computed by evaluating the FT models established in Step 2, i.e., . Then we can evaluate the collision probability of the MASS with dynamic LoHC and HMWL using Eq. (9)

The collision accident occurs during the SCCOs performing the tasks of detecting target ship, assessing autonomous solution, or redirecting MASS to safe path through remote control. Their task demands predicted by VACP method are 20.6, 27.2, and 41.6, respectively. HMWL occurs when performing the last two tasks with ILoHC and HLoHC, respectively. The collision probability without considering MWL is 0.01058, while the collision probability increases to 0.04983 with considering MWL. Therefore, HMWL can contribute greatly to the collision accident. In this subsection, the effects of HMWL on the collision accident occurred under  and  are analyzed respectively.

(1) The effects of HMWL under

When the MASS detect a target ship and provides an autonomous solution, the SCCOs are under . They assess autonomous solution with ILoHC, while they will be expected to redirect MASS to the safe path with HLoHC if the autonomous solution is wrong or the SCCOs wrongly disagree the autonomous solution. Under , the FT model is shown as Fig. 17. Without considering MWL, the EOC and EOO events in ILoHC shown in Table 7 are independent, and the EOC and EOO events in HLoHC shown in Table 6 are also independent. The probabilities of G1 (failure to detect target ship), G2 (adopt unsafe avoidance solution), G3 (failure to implement avoidance solution) are 0.00069, 0.00488 and 0.00482 respectively. The probability of failure to avoid collision by MASS is 0.01031.

When considering MWL, the EOC and EOO events will occur more likely due to HMWL. These events are forced to occur with certain probabilities, and their total occurrence probabilities are shown in Tables 6 and 7. Because HMWL does not occur when the SCCOs monitor data and detect target ship, the probabilities of G1 and G3 with and without MWL are both 0.00069 and 0.00482, respectively. However, the HMWL occurs when the SCCOs assess autonomous solution with ILoHC and redirect MASS to safe path with HLoHC. When considering HMWL, the probability of G4 (adopt unsafe avoidance solution in autonomous control mode) increases from 0.00033 to 0.00661; the probability of G5 (provide unsafe avoidance solution in manual control mode) increases from 0.00459 to 0.03502; and the probabilities of G2 and failure to avoid collision by MASS increase to 0.03696 and 0.04192, respectively. It can be seen that the SCCOs with HLoHC are more likely to fail through comparing the probability of G4 with G5. This is due to the fact that the MWL is higher and HEs are more likely to occur in HLoHC.

In addition, the  promotes the change of LoHC from ILoHC to HLoHC, and increases the collision risk. This change may result from wrong disagreement with autonomous solution during H-AS interactions due to the EOC events X19 (misreading autonomous solution in ILoHC) and X20 (autonomous solution misdiagnosed in ILoHC). The probabilities of X19 and X20 will increase due to , and the probability of G18 (autonomous solution provided but not chosen) increases from 0.11135 to 0.11645.

(2) The effects of HMWL under

When the MASS detects a target ship and cannot provide an autonomous solution, the SCCOs are warned to redirect the MASS to the safe path with HLoHC and the  occurs. On such condition, the reduced FT model is shown as Fig. 18. Without considering MWL, the EOC and EOO events in Table 7 are independent. The probabilities of G1 (failure to detect target ship) and G2 ( adopt unsafe avoidance solution) are 0.00069 and 0.01299, respectively. The probability of failure to avoid collision by MASS is 0.01838.

The MWL will increase suddenly under  where the LoHC increases from LLoHC to HLoHC. Due to , the EOC and EOO events in  are forced to occur with certain probabilities, and their total occurrence probabilities are shown in Table 7. The probability of G2 increases from 0.01299 to 0.14987, and the probability of failure to avoid collision by MASS increases from 0.01838 to 0.15427.

6.3. Importance analysis

To identify the crucial basic events under , the Birnbaum importance measures are calculated. Without considering MWL, X36 (Limited maneuverability), X37 (Power/Propulsion System failure), X38 (Steering Gear failure), and X35 (Loss of control) are found to be the most critical events. All of their Birnbaum importance values are 0.99. This is due to the fact that all of these events are MFs in action executions by MASS and each of them can lead to the failure of collision avoidance. When considering MWL, these events are also the most critical events, while their Birnbaum importance values decrease to 0.96. The Birnbaum importance value of X4 (Failure in collecting necessary data by MASS) increases from 0.14 to 0.79. This can be explained by the following facts: HMWL increases the probabilities G11 (wrong autonomous solution chosen) and G17 (failure to remotely control MASS to safe path); X4 can lead to G10 (wrong autonomous solution proposed by MASS) and G16 (manual solution chosen); and both of the combination of G9 and G10 and the combination of G16 and G17 can lead to the collision accident. Therefore, as the probabilities of G11 and G17 increase due to HMWL, the collision accident depends more on X4.

Under , X36 (Limited maneuverability), X37 (Power/Propulsion System failure), X38 (Steering Gear failure), and X35 (Loss of control) are the most critical events without considering MWL. Their Birnbaum importance values are 0.98. In addition, X28 (Command to put ship on manual control not given on time), X29 (Wrong command given when putting ship on manual control), X31 (Waypoint not given on time), and X32 (Wrong waypoint given) are also the most critical events. All of their Birnbaum importance values are also 0.98. This is due to the fact that X28, X29, X31, and X32 are all EOC in action executions and each of them can lead to the failure of collision avoidance. When considering MWL, these are also the most critical events. In addition, the Birnbaum importance value of X4 increases from 0.13 to 0.64. This is due to the fact that the probabilities of X25 (Misunderstanding information in HLoHC), X26 (Miscommunicating information in HLoHC), and X27 (Abandon Communication to collect/ identify information in HLoHC) increase significantly due to HMWL and the combination of X4 and either of these events can lead to the collision accident.

In addition, to obtain the most optimal order of abandonment of tasks in ILoHC and HLoHC, the Birnbaum importance measures of the conventional FT of MASS collision without considering MWL are calculated. Based on the Birnbaum importance value of EOO events, the most optimal order of abandonment of tasks in ILoHC is X13, X16, X12; and the most optimal order of abandonment of tasks in HLoHC is X34, X21, X27. Compared with the order of abandonment of tasks given in section 3.3.2,  with the most optimal order decreases from 0.04192 to 0.02213,  with the most optimal order decreases from 0.15427 to 0.11555, and the collision probability decreases from 0.04983 to 0.02871. Therefore, the order of abandonment of tasks under HMWL condition can also contribute greatly to the collision accident.

6.4. Sensitivity analysis

The SCCOs with ILoHC or HLoHC are subject to HMWL that increases the collision risk of MASS. With the model that describes the effects of HMWL, the dependence factor  and the probability that effect (a) is adopt on HMWL, denoted as  or , are two important parameters. In this section, the sensitivity analysis of these two parameters are performed respectively two analyze their effects on collision risk.

The parameter  represents the effect of HMWL on the occurrence of EOC. To study its effects on collision risk, we calculate the probabilities of MASS collision under four different levels of dependence factor (i.e. ) and the results are shown in Fig. 21. It can be seen that the collision probability increases exponentially as  increases from 0.1 to 0.3. This can be explained the fact that the probabilities of EOC increase exponentially as  increases when the HMWL occurs.

The parameter  and  represents the probability of effect (a) being followed with  and , respectively. On , the LoHC may change from ILoHC to HLoHC during dynamic H-AS interactions.  and  both exist on , but on , only  exists. In this section, we only conduct the sensitivity analysis of  on . To study its effects on collision risk, we calculate  under six different levels  (i.e. ) and the results are shown in Fig. 22.  are equivalent to related  because . It can be seen that  increases as  increases. It indicates that effect (a) has more detrimental effects on collision avoidance. The indication suggests that the SCCOs should follow effect (b) preferentially.

7. CONCLUSIONS

For collision avoidance, the SCCOs experience dynamic LoHC and HMWL during H-AS interactions. In this paper, the HMWL mechanism is investigated first and a HMWL-PDEP Gate is proposed to model the occurrence and effects of HMWL. Then HMWL_I-PDEP Gate and HMWL_H-PDEP Gates are proposed to describe human behaviors of ILoHC and HLoHC with HMWL, respectively. Through adding these two Gates to conventional FT, the dynamic LoHC and HMWL are incorporated into collision risk analysis. A FT-based model of MASS collision is proposed where the probabilistic occurrence and change of LoHC and non-deterministic relationships due to HMWL present a challenge to analysis. An implicit-explicit method is proposed to analyze the proposed FT model and calculate collision probability. As seen from the result analysis, the HMWL contributes significantly to the MASS collision. The proposed method provides a more in-depth collision analysis and obtains more rational collision probability and critical events. In addition, a safer behavior strategy for SCCOs with HMWL is provided through the Birnbaum importance analysis and sensitivity analysis.

ACKNOWLEDGMENTS

This work was supported by the Science and Technology on Reliability and Environmental Engineering Laboratory.

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Appendix

Event	Basic Failure Event	Description
X1	Failure to generate alert after collecting data	MASS has collected the correct information through various sensors, but don't generate alert for the presence of target ship.
X2	Alert not perceived on time	SCCO does not detect the auditory/visual alert.
X3	The cause / source for the alert not identified	SCCO is aware of the alert, but does not recognize the cause/source of the alert. In other words, the alert was not detected as a collision warning for a particular MASS.
X4	Failure in collecting necessary data by MASS	One or several components of the data collection fails. The components include GPS, Doppler Speed log and INS related to MASS state perception, AIS, LiDAR, Radar and Dual Optical & Thermal Camera related to surface obstacles state perception, Echo Sounding System related to underwater obstacle state perception, Anemometer and Visibility & Present Weather Sensor related to weather state perception. Besides, there are the Microphone and ECDIS.
X5	Abandon to check part of information	SCCO don't check all the required information. For example, s/he only focuses on the speed and direction of MASS.
X6	Information not checked with appropriate frequency	When SCCO monitors six ships through the screens, the information needs to be checked at the appropriate frequency. Otherwise, SCCO may miss an important change in a variable.
X7	Checking information from the wrong ship	SCCO is aware of the information needed, but checks it from the wrong ship. This is largely due to SCCO monitors multiple ships simultaneously.
X8	Misreading information during checking tasks	SCCO fails to execute while reading the information. For example, s/he may misread distance numbers.
X9	Candidate on collision course not recognized	When SCCO is monitoring six MASS, he/she did not detect a ship approaching one of the MASS.
X10	Failure of decision on safe solution to avoid collisions by MASS	MASS generates the wrong collision avoidance solution due to software failure.
X11	Failure to identify wrong solution by consulting with crew/VTS	SCCO communicates with crew but also fails to determine that the autonomous solution is wrong. This can be due to inadequate communication or misunderstanding.
X12	Abandon to consult with crew to identify wrong solution in ILoHC	Due to the HMWL or confidence, SCCO gives up communication with crew for assistance.
X13	Abandon to perceive part of information in ILoHC	SCCO gives up perception of certain information due to high mental workload or negligence. In addition, SCCO may not collect additional information if he/she thinks the current information is sufficient.
X14	Demanding information from the wrong ship in ILoHC	SCCO is aware of the information needed, but collects it from the wrong ship.
X15	Misreading information during collecting tasks in ILoHC	SCCO fails to execute while reading the information. For example, he/she may misread distance numbers.
X16	Abandon to assess autonomous solution in ILoHC	Due to the HMWL, SCCO gives up the autonomous solution evaluation.
X17	Failure to identify wrong autonomous solution by SCCOs in ILoHC	SCCO himself/herself fails to determine that the autonomous solution is wrong.
X18	No autonomous solution provided by MASS	MASS fails to generate collision avoidance solution due to software failure.
X19	Misreading autonomous solution in ILoHC	SCCO fails to execute while reading the autonomous solution. For example, s/he may misread speed numbers.
X20	Autonomous solution misdiagnosed  in ILoHC	MASS provides the right autonomous solution, but SCCO misdiagnoses the current situation and therefore chooses the manual mode.
X21	Abandon to perceive part of information in HLoHC	SCCO gives up perception of certain information due to HMWL or negligence. In addition, SCCO may not collect additional information if s/he thinks the current information is sufficient.
X22	Demanding information from the wrong ship in HLoHC	SCCO is aware of the information needed, but collects it from the wrong ship.
X23	Misreading information in HLoHC	SCCO fails to execute while reading the information. For example, s/he may misread distance numbers.
X24	Failure of communication system	The communication system is unavailable. This may be due to software failure, hardware failure, or LTE failure, etc.
X25	Misunderstanding information in HLoHC	SCCO collects information through communication but incorrectly internally processes it.
X26	Miscommunicating information in HLoHC	In the process of SCCO collecting information through communication with the crew, VTS or the target ship, there may be communication errors, such as incomplete or incorrect information, or sending it to the wrong person or at the wrong time.
X27	Abandon Communication to collect/ identify information in HLoHC	SCCO gives up communication for more information due to high mental workload or negligence. In addition, SCCO may not collect additional information through communication if he/she thinks the current information is sufficient.
X28	Command to put ship on manual control not given on time	SCCO enters the command in a bad timing – too late or too early.
X29	Wrong command given when putting ship on manual control	SCCO enters the wrong command.
X30	System state / situation misdiagnosed	SCCO misdiagnoses the current situation and therefore plans the wrong collision avoidance solution.
X31	Waypoints not given on time	SCCO enters the waypoints in a bad timing – too late or too early.
X32	Wrong waypoints given	SCCO enters the wrong waypoints.
X33	Failure to plan the safe path by consulting with VTS	SCCO communicates with VTS but also fails to plan the safe path. This can be due to inadequate communication or misunderstanding.
X34	Abandon to consult with VTS when planning the safe path	Due to the high mental workload or confidence, SCCO gives up communication with the VTS for assistance.
X35	Loss of control	If the communication link between SCCO and MASS is interrupted, instructions cannot be issued, which will cause MASS out of control. This may be due to environmental factors such as strong wind, large waves and rapids.
X36	Limited maneuverability	MASS cannot achieve the required speed or approach angle when implementing the avoidance solution.
X37	Power/Propulsion System failure	The Power/Propulsion System consists of Main Engine & Auxiliary System and Shafting. Failure of any one of them will cause Power/Propulsion System to fail. But they are designed with sufficient redundancy.
X38	Steering Gear failure	Steering Gear is designed with sufficient redundancy. If they both fail, Steering Gear fails.

References

1. Ramos M A, Thieme C A, Utne I B, Mosleh A. A generic approach to analysing failures in human – System interaction in autonomy. Safety Sci 2020;129:104808.
2. Thieme C A, Utne I B. A risk model for autonomous marine systems and operation focusing on human–autonomy collaboration. Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability 2017;231(4):446-64.
3. Chou C, Wang C, Hsu H. A novel quantitative and qualitative model for forecasting the navigational risks of Maritime Autonomous Surface Ships. Ocean Eng 2022;248:110852.
4. Laurinen, M., 2016. Remote and autonomous ships: the next steps. In: AAWA Adv. Auton. Waterborne Appl. pp. 88.
5. MUNIN, 2016. Research in Maritime Autonomous Systems Project Results and Technology Potentials. MUNIN.
6. Rødseth, Ø., Nordahl, H., 2017. Definitions for autonomous merchant ships.
7. Akdağ M, Solnør P, Johansen T A. Collaborative collision avoidance for Maritime Autonomous Surface Ships: A review. Ocean Eng 2022;250:110920.
8. Veitch E, Andreas Alsos O. A systematic review of human-AI interaction in autonomous ship systems. Safety Sci 2022;152:105778.
9. International Maritime Organization (IMO). [2018-10-19]. http://www.imo.org/en/MediaCentre/PressBriefings/Pages/08-MSC-99-MASS-scoping.aspx.
10. Ramos M A, Thieme C A, Utne I B, Mosleh A. Human-system concurrent task analysis for maritime autonomous surface ship operation and safety. Reliab Eng Syst Safe 2020;195:106697.
11. Liu C, Chu X, Wu W, Li S, He Z, Zheng M, et al. Human–machine cooperation research for navigation of maritime autonomous surface ships: A review and consideration. Ocean Eng 2022;246:110555.
12. Zhang M, Zhang D, Yao H, Zhang K. A probabilistic model of human error assessment for autonomous cargo ships focusing on human–autonomy collaboration. Safety Sci 2020;130:104838.
13. Di Z, Mingyang Z, Houjie Y, Kai Z, Cunlong F. Prediction Model of Human Error Probability in Autonomous Cargo Ships. In: Editor, Alejandro Valdez Banda O, Kujala P, Hirdaris S, Basnet Seditors. Warsaw, Poland: Sciendo, 2020. 110-24. Pages.
14. Wróbel K, Gil M, Krata P, Olszewski K, Montewka J. On the use of leading safety indicators in maritime and their feasibility for Maritime Autonomous Surface Ships. Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability 2021:1748006X-2110276X.
15. Abilio Ramos M, Utne I B, Mosleh A. Collision avoidance on maritime autonomous surface ships: Operators’ tasks and human failure events. Safety Sci 2019;116:33-44.
16. Ramos M A, Mosleh A. Human Role in Failure of Autonomous Systems: A Human Reliability Perspective.: IEEE, 2021. 1-6.
17. Wróbel K, Gil M, Krata P, Olszewski K, Montewka J. On the use of leading safety indicators in maritime and their feasibility for Maritime Autonomous Surface Ships. Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability 2021:1748006X-2110276X.
18. Guo C, Haugen S, Utne I B. Risk assessment of collisions of an autonomous passenger ferry. Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability 2021:1748006X-2110507X.
19. IMO. Revised Guidelines for Formal Safety Assessment (FSA) for the use in the IMO Rule-Making Process (No. MSC-MEPC.2/Circ.12/Rev.2). In: IMO, London, UK.2018.
20. Zhang X, Wang C, Jiang L, An L, Yang R. Collision-avoidance navigation systems for Maritime Autonomous Surface Ships: A state of the art survey. Ocean Eng 2021;235:109380.
21. Statheros T, Howells G, Maier K M. Autonomous Ship Collision Avoidance Navigation Concepts, Technologies and Techniques. J Navigation 2008;61(1):129-42.
22. Yoshida M, Shimizu E, Sugomori M, Umeda A. Identification of the Relationship between Maritime Autonomous Surface Ships and the Operator’s Mental Workload. Applied Sciences 2021;11(5):2331.
23. Wahlström M, Hakulinen J, Karvonen H, Lindborg I. Human Factors Challenges in Unmanned Ship Operations – Insights from Other Domains. Procedia Manufacturing 2015;3:1038-45.
24. Ramos M A, Utne I B, Mosleh A. On factors affecting autonomous ships operators performance in a Shore Control Center. Probabilistic Safety Assessment and Management PSAM 14, 2018, Los Angeles, CA, 1-12.
25. Young M S, Brookhuis K A, Wickens C D, Hancock P A. State of science: mental workload in ergonomics. Ergonomics 2015;58(1):1-17.
26. Broccia G, Milazzo P, Ölveczky P C. Formal modeling and analysis of safety-critical human multitasking. Innovations in Systems and Software Engineering 2019;15(3-4):169-90.
27. Mosquera Benitez D, Del Corte Valiente A, Lanzi P. A novel global operational concept in cockpits under peak workload situations. Safety Sci 2018;102:38-50.
28. Che H, Zeng S, You Q, Song Y, Guo J. A fault tree-based approach for aviation risk analysis considering mental workload overload. Eksploatacja i Niezawodnosc - Maintenance and Reliability 2021;23(4):646-58.
29. Mccracken J, Aldrich T. Analyses of Selected LHX Mission Functions: Implications for Operator Workload and System Automation Goals. Defense Technical Information Center1984.
30. Wickens C D. Multiple resources and performance prediction. Theoretical Issues in Ergonomics Science 2002;2(3):159-77.
31. Parasuraman R, Rovira E. Workload modeling and workload management: Recent theoretical developments . Aberdeen Proving Ground, MD: US Army Research Laboratory's Human Research and Engineering Directorate, 2005.
32. Rusnock C F, Borghetti B J. Workload profiles: A continuous measure of mental workload. Int J Ind Ergonom 2018;63:49-64.
33. Wickens C D, Gutzwiller R S, Santamaria A. Discrete task switching in overload: A meta-analyses and a model. Int J Hum-Comput St 2015;79:79-84.
34. Gore B F, Jarvis P. Modeling the complexities of human performance. IEEE International Conference on Systems2006.
35. Wickens C D, Hollands J G, Simon B, Parasuraman R. Engineering Psychology and Human Performance. USA: Pearson Education, Inc., 2012.
36. Sahin B, Yazidi A, Roman D, Soylu A. Ontology-Based Fault Tree Analysis Algorithms in a Fuzzy Environment for Autonomous Ships. Ieee Access 2021;9:40915-32.
37. Lee, P. , et al. "Fault Tree Analysis of the Autonomous Navigation for Maritime Autonomous Surface Ships." Stability and Safety of Ships and Ocean Vehicles 2021.
38. Chang C, Kontovas C, Yu Q, Yang Z. Risk assessment of the operations of maritime autonomous surface ships. Reliab Eng Syst Safe 2021;207:107324.
39. Utne I B, Rokseth B, Sørensen A J, Vinnem J E. Towards supervisory risk control of autonomous ships. Reliab Eng Syst Safe 2020;196:106757.
40. Ung S. Evaluation of human error contribution to oil tanker collision using fault tree analysis and modified fuzzy Bayesian Network based CREAM. Ocean Eng 2019;179:159-72.
41. Groth K, Wang C, Mosleh A. Hybrid causal methodology and software platform for probabilistic risk assessment and safety monitoring of socio-technical systems. Reliab Eng Syst Safe 2010;95(12):1276-85.
42. Wu Q, Wang T, Diaconeasa M A, Mosleh A, Wang Y. A Comparative Assessment of Collision Risk of Manned and Unmanned Vessels. Journal of Marine Science and Engineering 2020;8(11):852.
43. Zhang D, Han Z, Zhang K, Zhang J, Zhang M, Zhang F. Use of Hybrid Causal Logic Method for Preliminary Hazard Analysis of Maritime Autonomous Surface Ships. Journal of Marine Science and Engineering 2022;10(6):725.
44. Ruijters E, Stoelinga M. Fault tree analysis: A survey of the state-of-the-art in modeling, analysis and tools. Computer Science Review 2015;15-16:29-62.
45. Khakzad N, Khan F, Amyotte P. Risk-based design of process systems using discrete-time Bayesian networks. Reliab Eng Syst Safe 2013;109:5-17.
46. Chen M, Xiao N, Zuo M J, Ding Y. An Efficient Algorithm for Finding Modules in Fault Trees. Ieee T Reliab 2021;70(3):862-74.
47. Burns K J, Bonaceto C A, Estes S L, Helleburg J R. Quantifying the Safety Benefits of a Digital Copilot in General Aviation. J Aerosp Inform Syst 2019;16(8):296-306.
48. Dugan J B, Bavuso S J, Boyd M A. Dynamic fault-tree models for fault-tolerant computer systems. Ieee T Reliab 1992;41(3):363-77.
49. IMO, 2018. IMO takes first steps to address autonomous ships. https://www.imo.org/en/MediaCentre/PressBriefings/Pages/08-MSC-99-MASS-scoping.aspx.Online:(Accessed27July2021).
50. IMO, 2017. Maritime safety committee (MSC), 98th session. https://www.imo.org/en/MediaCentre/MeetingSummaries/Pages/MSC-98th-session.aspx.Online:(Accessed27July2021).
51. Zhou X, Liu Z, Wang F, Wu Z. A system-theoretic approach to safety and security co-analysis of autonomous ships. Ocean Eng 2021;222:108569.
52. BahooToroody A, Abaei M M, Valdez Banda O, Montewka J, Kujala P. On reliability assessment of ship machinery system in different autonomy degree; A Bayesian-based approach. Ocean Eng 2022;254:111252.
53. Zhou X, Liu Z, Wang F, Wu Z, Cui R. Towards applicability evaluation of hazard analysis methods for autonomous ships. Ocean Eng 2020;214:107773.
54. Otto S, Pedersen P T, Samuelides M, Sames P C. Elements of risk analysis for collision and grounding of a RoRo passenger ferry. Mar Struct 2002;15(4-5):461-74.
55. Zhang W, Deng Y, Du L, Liu Q, Lu L, Chen F. A method of performing real-time ship conflict probability ranking in open waters based on AIS data. Ocean Eng 2022;255:111480.
56. Shneiderman B. Human-Centered Artificial Intelligence: Reliable, Safe & Trustworthy. International Journal of Human–Computer Interaction 2020;36(6).
57. Chang Y H J, Mosleh A. Cognitive modeling and dynamic probabilistic simulation of operating crew response to complex system accidents: Part 1: Overview of the IDAC Model. Reliab Eng Syst Safe 2007;92(8):997-1013.
58. Chang Y H J, Mosleh A. Cognitive modeling and dynamic probabilistic simulation of operating crew response to complex system accidents. Part 2: IDAC performance influencing factors model. Reliab Eng Syst Safe 2007;92(8):1014-40.
59. Chang Y H J, Mosleh A. Cognitive modeling and dynamic probabilistic simulation of operating crew response to complex system accidents: Part 3: IDAC operator response model. Reliab Eng Syst Safe 2007;92(8):1041-60.
60. Chang Y H J, Mosleh A. Cognitive modeling and dynamic probabilistic simulation of operating crew response to complex system accidents. Part 4: IDAC causal model of operator problem-solving response. Reliab Eng Syst Safe 2007;92(8):1061-75.
61. Chang Y H J, Mosleh A. Cognitive modeling and dynamic probabilistic simulation of operating crew response to complex system accidents: Part 5: Dynamic probabilistic simulation of the IDAC model. Reliab Eng Syst Safe 2007;92(8):1076-101.
62. Fan C, Wróbel K, Montewka J, Gil M, Wan C, Zhang D. A framework to identify factors influencing navigational risk for Maritime Autonomous Surface Ships. Ocean Eng 2020;202:107188.
63. Brookhuis K A, Waard D D. Assessment of drivers' workload: performance, subjective and physiological indices: Assessment of drivers' workload: performance, subjective and physiological indices, 2001.
64. Kabir S. An overview of fault tree analysis and its application in model based dependability analysis. Expert Syst Appl 2017;77:114-35.
65. Wang J, Fang W. A structured method for the traffic dispatcher error behavior analysis in metro accident investigation. Safety Sci 2014;70:339-47.
66. Alion. Improved Performance Research Integration Tool. 2015.
67. Wang P, Fang W, Guo B. A colored petri nets based workload evaluation model and its validation through Multi-Attribute Task Battery-II. Appl Ergon 2017;60:260-74.
68. Che H, Zeng S, Guo J. Reliability assessment of man-machine systems subject to mutually dependent machine degradation and human errors. Reliab Eng Syst Safe 2019;190:106504.
69. Wang C, Xing L, Levitin G. Explicit and implicit methods for probabilistic common-cause failure analysis. Reliab Eng Syst Safe 2014;131:175-84.
70. Vaurio J K. Fault tree analysis of phased mission systems with repairable and non-repairable components. Reliab Eng Syst Safe 2001;74(2):169-80.
71. Hollnagel E. Cognitive reliability and error analysis method (CREAM). Oxford, UK: Elsevier, 1998.
72. Ahn S I, Kurt R E. Application of a CREAM based framework to assess human reliability in emergency response to engine room fires on ships. Ocean Eng 2020;216:108078.
73. Sokukcu M, Sakar C. Risk analysis of collision accidents during underway STS berthing maneuver through integrating fault tree analysis (FTA) into Bayesian network (BN). Appl Ocean Res 2022;126:103290.