On the Inﬂuence of Human Factors on Safety of Remotely-Controlled Merchant Vessels

: With numerous efforts undertaken by both industry and academia to develop and implement autonomous merchant vessels, their safety remains an utmost priority. One of the modes of their operation which is expected to be used is a remote control. Therein, some, if not all, decisions will be made remotely by human operators and executed locally by a vessel control system. This arrangement incorporates a possibility of a human factor occurrence. To this end, a variety of factors are known in the literature along with a complex network of mutual relationships between them. In order to study their potential inﬂuence on the safety of remotely-controlled merchant vessels, an expert study has been conducted using the Human Factors Analysis and Classiﬁcation System-Maritime Accidents (HFACS–MA) framework. The results indicate that the most relevant for the safety of this prospective system is to ensure that known problems are properly and timely rectiﬁed and that remote operators maintain their psycho- and physiological conditions. The experts elicited have also assigned higher signiﬁcance to the causal factors of active failures than latent failures, thus indicating a general belief that operators’ actions represent the ﬁnal and the most important barrier against accident occurrence.


Introduction
It is expected by many authors that the maritime industry is about to undergo a revolution with an introduction of highly automated vessels, including those capable of operating without any human involvement [1]. Nowadays, it remains with humans to make decisions and operate onboard equipment either manually or remotely. In this case, the latter means that a person is located in a different compartment onboard the ship than the equipment operated. For instance, a helmsman steering the ship from a wheelhouse uses a wheel to actuate a steering gear motor in a compartment located a few decks below. It is, however, postulated that certain advantages can be achieved by using a truly remote control. In such a solution, the operator is seated in a remote facility sometimes referred to as a Shore Control Centre (SCC [2], if located on shore) or Remote Control Centre (RCC [3], without exact location). In this system, the remote control is performed by using a radiocommunication [4], perhaps via a satellite link rather than by the ship's wiring alone.
Numerous frameworks have been proposed to categorize autonomy of maritime systems [5,6]. Recently, the most widely used is the one that has been put forward by the International Maritime Organization for the purpose of performing a process of assessing the degree of autonomy that may affect existing regulatory frameworks, in order to address prospective Maritime Autonomous Surface Ship (MASS) operations [7,8]. Therein, it is postulated that MASS would operate under one of four Degrees of Autonomy (DoA) as presented in Table 1 [7] with a capability of dynamically switching between these. Such a switch may be triggered by changing environmental conditions, for instance [9]. Table 1. Definitions of International Maritime Organization's degrees of autonomy [7].

DoA
Description Definition 1 Ship with automated processes and decision support Seafarers are on board to operate and control shipboard systems and functions. Some operations may be automated.

Remotely controlled ship with seafarers on board
The ship is controlled and operated from another location, but seafarers are on board. 3 Remotely controlled ship without seafarers on board Remotely controlled ship without seafarers on board: The ship is controlled and operated from another location. There are no seafarers on board. 4 Fully autonomous ship The operating system of the ship is able to make decisions and determine actions by itself As can be seen, one of the modes of operation is the above-mentioned remote control with or without seafarers' presence onboard. It is also expected that this type of MASS will be easier to implement than a fully autonomous one, for various reasons [10,11]. Among them is the issue of safety [12], often named as the most important aspect of the operation of any socio-technical system. Most of the authors agree that the newly implemented autonomous ships shall be at least as safe as conventional ones [13][14][15], regardless of the DoA. Meanwhile, it has been raised that fully autonomous vessels will not necessarily meet this criteria [16], especially that they are expected to contribute to improve the maritime safety by eliminating, or at least greatly reducing, the occurrence of human errors [17]. However, no matter how autonomous the system is, some chances for the emergence of human factors remain [3,18,19]. Humans would need to be involved in the operations of the autonomous system at various points ranging from design [15] through maintenance [8] and trouble-shooting [20][21][22][23][24].
With respect to this issue, Man et al. applied an expert focus group method for identifying human factors present in the remote control of a ship [25]. Zhang et al. used probabilistic methods for modelling human-autonomy collaboration [26]. Ramos et al. investigated interrelations between tasks to be carried out by remote operators [27]. Man et al. also applied a non-participating observation of simulator runs, in order to study how seafarers handle remote supervision and control [28]. Similar ideas were investigated by Baldauf et al. [29]. Fan et al. investigated how certain risk factors can affect navigation of a remotely controlled ship on different legs of her voyage [30].
Despite all the above contributions, the question of what types of the human factors can potentially have the greatest influence on the occurrence of accidents involving remotely controlled vessels remains unanswered. The herein study aims to bridge this gap by collecting expert-elicited data to enhance the understanding of the development of potential accidents involving remotely-controlled merchant vessels. To this end, we employed a Human Factors Analysis and Classification System for Maritime Accidents (HFACS-MA, see Figure 1) [31] along with an expert study. The results suggest that factors falling under Condition of operator(s) and Failure to correct known problem categories are believed to affect the safety of remote vessels the most. This indicates the need of (1) proper safety management of the system (taking early and appropriate corrective actions) as well as (2) taking the condition of (remote) human operators into account even with the vessels themselves being unmanned. tions) as well as (2) taking the condition of (remote) human operators into account even with the vessels themselves being unmanned.
Our findings can be found relevant by various stakeholders of maritime autonomization, including both academia and industry. The remainder of this paper is structured as follows. Section 2 introduces methods applied and materials used to obtain the results. These are presented in Section 3 and discussed in Section 4. The final section concludes the paper.  Our findings can be found relevant by various stakeholders of maritime autonomization, including both academia and industry. The remainder of this paper is structured as follows. Section 2 introduces methods applied and materials used to obtain the results. These are presented in Section 3 and discussed in Section 4. The final section concludes the paper.

Materials and Methods
Human Factors Analysis and Classification System (HFACS) has initially been developed for analyzing human error occurrences in aviation, both military and civilian [32]. Initially, it contained 17 categories of human errors. Besides its original applications, it has later been adopted by other industries, such as maritime [33,34], mining [35], and railway [36]. For the former, a special branch of HFACS (HFACS-MA) has been postulated in [31] to embrace the complexity of maritime operations and accidents. Its outline is given in Figure 1.
Herein, the accident's causal factors are divided into 21 categories grouped in five levels of External Factors, Organizational Influences, Unsafe Supervision, Preconditions, and Unsafe Acts. The descriptions of categories can be found in Table 2. The causal factors belonging to a particular category can arguably be either a result of a factor located on the upper level or can occur independently [37], eventually leading to an accident [38]. When reviewing factual data regarding the event in question, its causal factors are identified and inventoried. Then, those are assigned to a causal category in accordance with HFACS-MA taxonomy.   In order to identify how the upper-level factors can influence the emergence of others in a potential accident of a remotely controlled vessel, an online questionnaire has been set up in September 2020. The experts involved in various projects related to maritime autonomy were sent an online invitation and requested to assign the magnitude of potential factors' influence. Such an influence could be either positive or negative with the latter meaning that the emergence of the upper factor reduces the occurrence of the lower one. This impact is hereinafter referred to as a stage, with a reference to the stages of accident development (assuming linear model of the accident development [39]).
To increase the transparency of the study, sliders were used to assess the mutual influence of each of the factors between the successive levels. These were not labeled with numerical values, so as not to suggest any ranges or typical intervals. The only marking was Likert-like description of the middle (neutral influence), and the extreme (full amplification/reduction) values. In total, each participant would mouse-click on each of 75 sliders (equivalent for factors influences within HFACS-MA framework) distributed to 4 subpages (for each of the stages) in addition to one subpage for demographic data collection. The entire survey was conducted anonymously to avoid biases typical for expert studies. The questionnaire has been shared with individuals known to have a professional or academic experience in autonomous maritime systems. Prior to the actual survey, each participant was familiarized with the principles of HFACS, as well as definitions of the factors.
A total of 32 filled questionnaires have been received. Among the respondents, 28 were male and four female. Their nationalities included Republic of Korea (nineteen), Poland (six), Germany (two), Finland, Indonesia, Japan, Norway, and Russia (one each). Issues related to the number and type of the experts elicited are discussed in Section 4.2.
For the herein study, it was not distinguished between the positive and negative influence (amplification/reduction). Instead, the mere influence of one factor on another has been analyzed. This is generally in line with the principles of HFACS which is based on the linear model of accident development. In this model, the occurrence of a certain causal factor increases the likelihood of another's emergence. The scope and purpose of the herein study are to assess the magnitude of such an increase.

Results
This section presents the results of the study. The slide-like responses given by the respondents have been covertly transformed into numbers describing the magnitude of the influence within the range <0; 100> to depict the apparent percentage of influence. These numbers were not revealed to the participants so as to prevent them from obtaining round numbers.
The histograms of the responses broken down into respective stages are presented in Figure 2. The obtained results were then analyzed, so as to remove the outliers (presented as box-plots in Figures 3-6). These were identified by multiplying the interquartile range (IQR) by 1.5 within each relationship. The values greater than Q3 + 1.5 × IQR or lesser than Q1 − 1.5 × IQR were discarded. We thereby removed 16 outlying data points (out of the total of 2400 data points, 0.67%). Median values for each relationship between factors (influence) have been calculated as presented in Figure 7. Furthermore, tables provided within Appendix A (Tables A1-A4         Medians of the influences. The color-coded arrows indicate that a particular influence was assessed as at least 20% stronger/weaker than the median for the stage to which it belongs.

Discussion
The results of the study are discussed within this Section along with their limitat and directions for further research.

Results and Their Significance
The results of experts' elicitation indicate their opinions by definition, not necessa facts. It is, however, the long-lasting paradox of performing research on the safety o novative systems. With only few prototypes in operation, autonomous merchant ves are characterized by the lack of quantitative data regarding their operational performa and features. Therefore, experts remain one of the most reliable sources of informa [40], in the presence of other sources.
To this end, the experts evaluated the influence that human factors can have on e other and thus, on the safety of remotely controlled merchant vessels. Looking at Fig  7, one can easily recognize the Condition of operator(s) (IV-A) as the most promin node of the net of mutual influences. It is both strongly influenced by upper-level ca categories, but also strongly impacts lower level, the one being the last line of defense depth. Similarly, Failure to correct known problem (III-C) has a relatively strong influe on its lower-level causal categories. This indicates that the experts appreciate the sig cance of recognizing and mitigating issues that have been found hazardous within system. This causal category is of a particular importance for the safety of the entire tem. This is because it consists of acknowledging that something is going wrong but doing anything about that, or taking insufficient actions to mitigate it. In other word means that there is a pre-existing, known, unrectified, safety-related problem.
On the contrary, the experts do not recognize Planned inappropriate operation B) as particularly challenging, perhaps because they expect that failures in planning Figure 7. Medians of the influences. The color-coded arrows indicate that a particular influence was assessed as at least 20% stronger/weaker than the median for the stage to which it belongs.

Discussion
The results of the study are discussed within this Section along with their limitations and directions for further research.

Results and Their Significance
The results of experts' elicitation indicate their opinions by definition, not necessarily facts. It is, however, the long-lasting paradox of performing research on the safety of innovative systems. With only few prototypes in operation, autonomous merchant vessels are characterized by the lack of quantitative data regarding their operational performance and features. Therefore, experts remain one of the most reliable sources of information [40], in the presence of other sources.
To this end, the experts evaluated the influence that human factors can have on each other and thus, on the safety of remotely controlled merchant vessels. Looking at Figure 7, one can easily recognize the Condition of operator(s) (IV-A) as the most prominent node of the net of mutual influences. It is both strongly influenced by upper-level causal categories, but also strongly impacts lower level, the one being the last line of defense-in-depth. Similarly, Failure to correct known problem (III-C) has a relatively strong influence on its lower-level causal categories. This indicates that the experts appreciate the significance of recognizing and mitigating issues that have been found hazardous within the system. This causal category is of a particular importance for the safety of the entire system. This is because it consists of acknowledging that something is going wrong but not doing anything about that, or taking insufficient actions to mitigate it. In other words, it means that there is a pre-existing, known, unrectified, safety-related problem.
On the contrary, the experts do not recognize Planned inappropriate operation (III-B) as particularly challenging, perhaps because they expect that failures in planning can be mitigated during the actual operations of remotely controlled vessels. Similarly, it can be noted in the relation to Inadequate supervision (III-A), perhaps because the experts found supervision to be irrelevant for real-time, remote problem-solving tasks. In this case, however, it was determined that supervision affects Liveware (IV-F) above average, indicating its strong influence on human-human relations. Notably, the experts recognized that causal factors falling within Physical environment (IV-D) and Technological environment (IV-E) categories cannot in general be easily affected by those from the Unsafe supervision (III) level. Moreover, Software (IV-B) and Hardware (IV-C) appear to affect causal categories on the Unsafe acts (V) level to a rather limited extent.
It can also be found that relationships between causal factors in Unsafe supervision and Preconditions (III vs. IV), as well as in Preconditions and Unsafe acts (IV vs. V) stages are generally characterized as either stronger or weaker than those on External factors and Organizational influences (I vs. II) or Organizational influences and Unsafe supervision (II vs. III) stages. It appears that it was somewhat easier for the experts to recognize stronger/weaker relationships on the stages closer to actual operations. The experts agreed with each other the most on the Organizational influences and Unsafe supervision (II vs. III) stage, with SD = 25.64. The overall median of the experts' responses was also the greatest for this stage (ME = 40.0), which suggests that the experts recognize that a widely-understood organizational environment is important for ensuring safe operations of autonomous vessels, including the human factors present therein. While this issue has been recognized as important by various scholars [8,28,40], it has also been studied to the least extent [41] to date.
The expert elicitation method proved its usefulness in assigning the magnitudes of influence of one causal factor category on another. This is in fact similar to the methods used for obtaining relationships in Bayesian Belief Networks [20,26] and fuzzy modelling [42]. Despite the fact that only experts known to have experience in autonomous shippingrelated research or operation were invited to the study, their answers varied significantly. This may indicate that even among experts in the field, there are some discrepancies in predicting the actual shape of the future autonomous maritime transportation and the role of human factors within it.
The approach applied in the herein study can also be found feasible for other domains outside autonomous shipping. In particular, it can be found useful for identifying the most relevant accident causal categories in the absence of historical evidence on the course of accidents.
The results indicate the need to design the entire socio-technical system of autonomous shipping. This should be provided in such a way that due caution is dedicated to the relevant risk influencing factors.

Limitations
Every piece of research is burdened with limitations and uncertainties. Among those potentially occurring within the herein study, the following can be listed:

1.
Relatively small research sample-it has been decided by the authors that only persons directly involved in previous research (in academia or industry) on the development of MASS were involved in the herein expert study. This was done in order to avoid uninformed answers, as well as to improve their quality. However, such a condition caused significant narrowing of the research sample, as MASS remains a rather niche specialization within the entire maritime industry. Thus, the number of the experts that could qualify as participants was very limited. This factor could render the results unrepresentative. Moreover, the scarcity of data did not allow for a more advanced statistical analysis;

2.
Ambiguity of questions asked-the fact that the MASS experts were preferred for the study over persons involved in human factors analyses might bring about some misunderstandings of the survey. The explanation of how particular causal categories are defined was presented to the respondents before filling the questionnaire and was available to them at any moment of the survey. However, certain inevitable limitations are always embedded within the expert study such as this [43]; and 3.
Erroneous framework-the research used the maritime-oriented variant of a widely used HFACS framework as a foundation. However, HFACS-MA was developed in 2013 [31] and may not accurately reflect the subsequent development of the maritime industry in the direction of autonomy.
All in all, the biggest limitation of the herein study lies within the size of the sample. With a limited number of the worldwide experts available in the domain of autonomous shipping, this issue may only be overcome once MASS becomes fully operational. However, the analysis of the factors affecting their safety is required before that happens, which is what this study aims to cover.

Further Research
In the view of above, it is clear that human factors will remain an important issue in the safety context of arguably autonomous (or unmanned) shipping [44]. These factors must be identified, evaluated, and managed [45], so as to reduce their occurrence and by that, the likelihood of an accident involving the system in question.
To this end, more available data would be needed to be obtained by thorough analysis. This can be either gathered by eliciting a larger and more diverse sample of experts, or by analyzing hard evidence and quantitative data. The latter will unlikely be available prior to MASS implementation, at least on a limited scale. Even then, these vessels' managing and operating companies may be unwilling to share their data.

Conclusions
Within the present study, an attempt to identify human factors affecting the safety of prospective remotely controlled merchant vessels has been performed. An expertbased study has been carried out by involving the persons having previous research or industrial experience with autonomous maritime systems. The analysis of the results allowed for formulating conclusions on the magnitude of mutual relationships between human factor categories. Namely, mitigation of factors falling into two such categories appears to be of the greatest importance for the safety of systems in question-Failure to correct known problem, and Condition of operator(s). These two categories within the HFACS-MA framework have been identified as potentially having the greatest influence on the occurrence of maritime accidents involving prospective, remotely controlled vessels. On the other hand, Planned inappropriate operation, as well as Physical environment and Technological environment have been assessed as relatively less relevant.
These results can be found important by MASS system designers, safety engineers, classification societies, and maritime administrations.