Risk Evaluation of Maritime Autonomous Surface Ship Operations: A Formal Safety Assessment Approach

Abstract

Maritime autonomous surface ships (MASSs) are reshaping the organization of navigation, ship operation, remote control and maritime supervision. However, the transition from crewed navigation to autonomy also changes the structure of safety risk. Traditional ship risk assessment approaches rely heavily on historical accident records and crew-centered operational assumptions, whereas MASS operations involve coupled risks arising from perception systems, autonomous decision-making, communication links, cybersecurity, remote control centers, environmental uncertainty and management readiness. To address the scarcity of operational accident data and the need for a structured safety evaluation method, this paper develops a Formal Safety Assessment (FSA)-based risk evaluation framework for MASS operations. A hierarchical indicator system is established from five dimensions: ship machinery, human factors, environmental factors, information technology and management. A frequency-severity risk criterion is then constructed by defining the Frequency Index (FI), Severity Index (SI) and Risk Index (RI), and by introducing the ALARP principle to classify unacceptable, tolerable and broadly acceptable risk regions. On this basis, an integrated fuzzy analytic hierarchy process is proposed to determine factor weights, transform expert judgements into membership degrees, and calculate comprehensive risk scores. A case study using 50 expert questionnaires shows that the overall risk score of MASS operation is 5.64, located in the ALARP region. Among the first-level indicators, environmental factors, information technology factors and ship machinery factors present relatively high risk levels, with scores of 6.82, 6.60 and 6.25, respectively. At the secondary-indicator level, intelligent navigation system, weather conditions, hydrometeorological conditions, communication capability, equipment and systems, navigation decision-making, and environmental perception are identified as high-intensity risk indicators. Further contribution decomposition reveals that environmental perception, routine ship management, navigation decision-making, and communication capability contribute most substantially to the overall risk profile due to their higher systemic importance. The proposed framework provides an interpretable approach for MASS safety assessment and risk-control prioritization under limited operational data availability.

1. Introduction

Maritime Autonomous Surface Ships (MASSs) represent a landmark technological transformation reshaping the global maritime industry. Driven by breakthroughs in multi-modal sensing, high-reliability marine communication, artificial intelligence algorithms, remote ship–shore coordination and automatic control systems, MASS is widely expected to elevate shipping operational efficiency, reduce seafarers’ exposure to harsh and dangerous onboard environments, and support refined, intelligent maritime traffic supervision [1,2,3].

Nevertheless, the deployment of autonomous navigation technologies cannot eliminate maritime safety risks fundamentally. Instead, autonomy redistributes safety hazards across an integrated ship–shore socio-technical system, shifting risk carriers from onboard seafarers to shipborne perception modules, autonomous decision-making units, long-distance communication networks, shore remote control centers, equipment maintenance systems and maritime regulatory governance mechanisms [4,5]. This fundamental redistribution of safety-critical functions creates a brand-new coupled risk landscape that distinguishes MASS entirely from conventional manned vessels.

Against this technological transformation backdrop, the global regulatory framework for autonomous shipping has also undergone rapid iteration and upgrading. After finishing the regulatory scoping exercise for MASS in 2021, the International Maritime Organization (IMO) shifted its work focus from identifying loopholes in existing maritime conventions to constructing a goal-oriented safety governance system for remotely controlled and fully autonomous ships [6]. In May 2026, the IMO formally adopted the International Code of Safety for Maritime Autonomous Surface Ships (MASS Code), which entered into force on 1 July 2026 for cargo vessels. At the current stage, the code serves as a non-mandatory guiding document, while IMO will further explore its mandatory incorporation into the SOLAS Convention in subsequent revisions [7,8]. The formal implementation of the MASS Code makes transparent, traceable and operation-oriented quantitative risk assessment an urgent practical demand. As MASS sea trials and early commercial operations gradually scale up, safety demonstration can no longer rely on general technological superiority; instead, operators and regulators must rely on evidence-based systematic safety evaluation to justify the rationality of autonomous navigation deployment [9].

The safety risk formation mechanism of MASS differs essentially from that of traditional crewed vessels. On conventional manned ships, core safety functions including visual lookout, traffic situation assessment, collision avoidance decision-making, vessel maneuver execution, real-time equipment monitoring and emergency response are fully undertaken by onboard navigators and engineers. For MASS, these core safety tasks are partially or completely transferred to multi-sensor perception and data fusion systems, autonomous collision avoidance algorithms, propulsion and steering actuators, ship–shore communication links, shore-based remote operators and organizational management systems. Such cross-domain function redistribution introduces complex systemic dependencies throughout the entire ship–shore operation chain: degraded sensor perception will distort the environmental traffic picture for collision avoidance calculation; communication delay or packet loss may hinder timely shore intervention; cyber security intrusion can tamper with navigation and control data; and insufficient organizational management capacity will delay fault recovery after technical failures. Accordingly, MASS operational safety should be regarded as a multi-dimensional coupled socio-technical problem covering ship-machine, human, environmental, information technology and management factors, rather than being evaluated solely based on the crew-centered risk assumptions applicable to traditional ships [10,11].

Existing maritime risk assessment theories and tools provide solid theoretical foundations; yet, prominent limitations emerge when directly applied to MASS risk quantification. First, global operational accident records of autonomous surface ships remain extremely scarce, making pure statistical risk estimation infeasible. Second, MASS risk sources feature high diversity and strong mutual coupling, covering five categories including ship machinery, human factors, marine environment, digital information systems and organizational management. Third, evaluation outputs need to be interpretable for multiple stakeholders including maritime regulators, ship designers, shipping operators and remote-control center supervisors. Under such constraints, a practicable MASS risk evaluation framework must organically integrate expert empirical knowledge, semi-quantitative risk acceptance criteria and multi-index hierarchical comprehensive assessment.

Formal Safety Assessment (FSA), standardized and promoted by the IMO for maritime safety governance, provides a complete standardized workflow covering hazard identification, quantitative risk measurement, risk mitigation scheme screening, cost–benefit analysis and decision-making recommendation [12]. Its core advantage lies in building a transparent logical connection between hazard identification and risk control measures, which fits the safety decision-making demands of autonomous shipping. However, the standard FSA framework formulated for manned vessels cannot be directly transplanted to MASS scenarios. Targeted adaptive optimization is required: it is necessary to extract exclusive risk indicator systems for autonomous navigation, construct risk acceptance criteria matching unmanned operation characteristics, and convert ambiguous qualitative expert judgments into comparable quantitative risk scores.

Motivated by the above practical gaps and theoretical limitations, this paper constructs a systematic MASS operational risk evaluation framework based on the FSA standard paradigm. The main innovations and contributions of this study are summarized as four aspects. First, a hierarchical risk indicator system specific to MASS is established, which regards autonomous navigation safety as a coupled socio-technical system and divides all risk sources into five primary dimensions: ship-machine factors, human factors, environmental factors, information technology factors and management factors. This hierarchical structure fully characterizes the interaction logic among shipborne hardware, human participants, marine operating environment, digital communication infrastructure and organizational governance in MASS operation. Second, this study combines the classical FSA risk analysis logic with a Frequency Index (FI), a Severity Index (RI) and the As Low as Reasonably Practicable (ALARP) principle, forming explicit, interpretable risk grading standards for autonomous ships. Third, an integrated fuzzy-AHP evaluation process is proposed to quantify expert subjective experience into standardized comprehensive risk scores under the constraint of insufficient MASS accident data. Fourth, the framework distinguishes risk intensity of individual indicators and their systemic weighted contribution to overall safety, supporting differentiated priority sorting for targeted risk mitigation measures.

The remaining chapters of this paper are organized as follows. Section 2 conducts a comprehensive literature review covering MASS safety research, FSA theory and fuzzy multi-criteria risk assessment methods. Section 3 elaborates the FSA-adapted MASS risk assessment framework and hierarchical indicator system. Section 4 constructs the semi-quantitative risk benchmark model combined with FI-SI matrix and ALARP zoning rules. Section 5 presents the case study based on 50 expert questionnaires and interprets the quantitative evaluation results. Section 6 further discusses the internal logic behind the empirical risk measurement results. Section 7 analyzes targeted risk control suggestions for ship operators, designers and maritime regulators. Section 8 concludes the whole research and proposes directions for follow-up expansion research.

2. Literature Review

2.1. MASS

Research on MASS has developed from early discussions of unmanned surface vehicles and autonomous shipping concepts toward more specific analyses of operational modes, safety assurance, remote control and regulatory adaptation. Recent reviews indicate that unmanned surface vehicles have progressed through advances in guidance, navigation, control, sensing and communication, but also face challenges related to autonomy, reliability and environmental uncertainty [1]. From an operational perspective, autonomous shipping may reduce exposure of seafarers to hazardous shipboard environments and may improve transport efficiency, but it also raises questions about system reliability, legal responsibility, quality assurance and the future role of human operators [2].

The distinction between conventional shipping and MASS is not merely the physical absence of crew. It is a reallocation of functions across shipborne automation, shore-based control centers and organizational procedures. Thieme et al. [5] showed that conventional ship risk models cannot be transferred mechanically to MASS because functional allocation and dependency structures change. Ramos et al. [10] further demonstrated that human-system task allocation remains central to MASS operation and safety. Human involvement is redistributed to remote-control centers, maintenance teams, system designers and maritime administrations, rather than removed from the safety chain.

Recent regulatory developments reinforce this socio-technical interpretation. The IMO regulatory scoping exercise clarified that MASS operations may affect multiple instruments under the existing maritime safety framework [6]. The 2026 MASS Code further signals that autonomous shipping is moving from conceptual exploration toward a safety-case and operational-design-domain logic, where functions, fallback arrangements, connectivity, remote control and human responsibilities must be demonstrated in a verifiable manner [7,8]. Consistent with this regulatory shift, recent research has begun to translate high-level MASS safety objectives into concrete certification requirements concerning system architecture, operational limitations, redundancy, human oversight and verification evidence [13].

2.2. MASS Risk

MASS risk sources can be grouped into ship-machine, human, environmental, information-technology and management dimensions. Perception and situational awareness are central to ship-machine safety. Autonomous navigation requires the ship to detect static and dynamic targets, interpret traffic situations, identify navigational constraints and maintain a reliable representation of the surrounding environment. Radar, AIS, optical cameras, lidar, electronic charts and other sensors may produce incomplete or conflicting information. Under heavy rain, sea clutter, fog or strong reflection, sensor reliability may decline, and data fusion may generate false, delayed or inconsistent situational pictures [14,15].

Navigation decision-making and collision avoidance constitute another major risk source for MASS. Autonomous ships must correctly interpret COLREGs and local navigation rules, identify encounter types and give-way/stand-on responsibilities, assess collision-risk evolution, and select timely and appropriate maneuvers while accounting for the uncertain behavior of crewed vessels. Namgung [16] integrated COLREGs Rules 5, 7, 8, and 13–17 with collision-risk inference, ship-domain constraints, and velocity-obstacle analysis, demonstrating how rule compliance and quantitative risk appraisal can be incorporated into local collision-avoidance planning. These tasks become particularly demanding in multi-vessel encounters, restricted waters, traffic-separation schemes, and emergency situations. Although geometric, rule-based, optimization-based, and learning-based collision-avoidance methods have been proposed, their robustness under complex and adverse scenarios remains insufficiently validated [16,17,18].

Communication and cybersecurity are decisive because MASS operations connect operational technology and information technology systems. Ship–shore communication supports monitoring, remote control, software updates, decision support and emergency response. Interruption, latency, packet loss or inconsistent data may reduce the ability of shore-based personnel to understand the situation or take over control. Cyber intrusion, spoofing, data tampering and denial-of-service attacks may affect navigation sensors, communication channels, control systems or shore infrastructure, which means that cybersecurity should be treated as a safety-critical component rather than only an information-management issue [19].

Human and organizational factors remain relevant even when the number of onboard crew is reduced. Shore-based operators, engineers, supervisors and maritime authorities become part of the control structure. Human factors include attention, workload, situation awareness, trust in automation, takeover readiness, teamwork, communication and competence [11,20]. When artificial-intelligence functions are introduced into remotely controlled ships, the safety boundary becomes broader still, because hazardous outcomes may arise from interactions among AI modules, onboard personnel and shore-based operators rather than from an isolated technical failure [21]. Organizational factors, including training, maintenance, emergency planning and responsibility allocation, may influence how technical failures escalate into accidents. Therefore, MASS risk assessment should not be limited to technical reliability. This is consistent with maritime accident analyses showing that human and organizational factors shape collision causation [22].

2.3. Risk Assessment Methods

Maritime safety risk assessment has developed through a broad set of methods. FSA provides a structured framework for rule-making and safety decision support. According to IMO FSA guidelines, the process generally includes hazard identification, risk assessment, risk-control options, cost–benefit assessment and recommendations for decision-making [12,23]. FSA is attractive for regulatory and management-oriented problems because it links risk results to risk-control decisions and allows a combination of qualitative and quantitative evidence. In the MASS context, FSA can help translate uncertain technical and operational hazards into a risk classification that is understandable for administrators and operators.

Failure mode and effects analysis (FMEA) and fault tree analysis (FTA) are often used for system reliability and accident causation. FMEA identifies possible component failures and evaluates their effects, while FTA starts from a top event and decomposes it into contributing events through logical gates. These methods are useful for equipment and subsystem analysis, but they may become less flexible when dealing with uncertain dependencies, human–automation interaction and management factors. Bayesian networks (BNs) have been introduced in maritime risk analysis to represent conditional dependence and update risk probabilities when evidence changes [24,25]. For MASSs, BN-based methods are promising for dynamic inference, but they require conditional probability tables that are difficult to estimate when operational data are limited.

System-theoretic approaches, such as STPA and FRAM, have also been applied to complex safety-critical systems. They focus on control structures, unsafe control actions, functional resonance and systemic interactions [26,27,28]. Building on this foundation, Li et al. [29] combined STPA with a Hidden Markov Model to extend functional hazard analysis toward the evaluation of navigation-risk state transitions under a human–machine co-driving mode. These approaches are valuable for identifying hazards in autonomous systems, but they do not always provide a direct numerical risk score or an ALARP-based classification. In contrast, risk matrices and fuzzy evaluation methods are practical when risk needs to be ranked and communicated. A risk matrix represents risk as a function of probability and consequence, while fuzzy methods address ambiguity in expert judgment [30]. AHP is widely used to determine weights in multi-criteria decision problems.

At the individual-encounter level, quantitative collision-risk inference provides a complementary perspective to system-level expert assessment. Namgung and Kim [31] developed a COLREGs-compliant collision-risk inference system using AIS-derived near-collision data and an adaptive neuro-fuzzy inference system. The model takes DCPA, TCPA, variance of compass bearing degree, and relative distance as inputs and produces a collision-risk index that reflects the evolution of collision danger and the timing of warnings during a specific encounter. Such an approach differs from the present framework in analytical scope: encounter-level inference quantifies an evolving navigation situation, whereas the fuzzy-AHP framework evaluates the relative risk intensity and systemic contribution of heterogeneous MASS operational factors. The two approaches are therefore complementary, and encounter-level collision-risk evidence could be used in future work to update the navigation decision-making component of the system-level assessment.

Recent MASS-specific methods have become more formal and data-driven. Chang et al. [32] assessed the operations of MASS using FMEA, evidential reasoning and rule-based Bayesian networks. Fan et al. [33] further proposed a risk-comparison framework for autonomous ship navigation across manual, remote-control and autonomous operational modes. Han et al. [34] proposed a dynamic Bayesian network for the availability of MASS machinery systems. Zhang et al. [35] used catastrophe theory to evaluate changes in MASS risk states. Laakso et al. [36] assessed an autonomous navigation system, while Na et al. [37] developed a cognitive model-based functional analysis and hazard-identification method. Lee et al. [38] further proposed a three-stage collision-case-based scenario framework comprising case collection, trajectory extraction, and scenario development to support the validation of autonomous collision-avoidance algorithms under realistic encounter and environmental conditions. These studies provide valuable causal or dynamic insights, but many remain subsystem-oriented, scenario-specific or demanding in terms of probability data.

2.4. Summary

Existing MASS risk studies have substantially improved hazard identification, subsystem reliability analysis and scenario-based safety evaluation. However, these analytical objectives differ from the system-level operational risk assessment pursued in this study [39,40]. Hazard-identification approaches provide detailed descriptions of unsafe functions and causal mechanisms, but they generally do not generate an ALARP-oriented quantitative priority structure. Probabilistic and dynamic models offer stronger representations of dependency and temporal evolution, but they often require reliability parameters, conditional probabilities or scenario-specific data that remain difficult to obtain during the early deployment stage of MASSs. Navigation-focused studies provide detailed insights into collision avoidance and autonomous decision-making, but they typically concentrate on specific functions rather than the broader socio-technical operational system.

Therefore, the contribution of this study is not the introduction of another standalone FSA, AHP or fuzzy evaluation method. Instead, it develops an integrated assessment chain that combines socio-technical risk structuring, FSA-based risk acceptance, expert-frequency membership aggregation, AHP weighting and contribution decomposition. This framework is designed for early-stage MASS operations where empirical accident data are limited and transparent risk-control prioritization is required.

Table 1. Analytical comparison of representative MASS risk assessment studies.

Papers	Assessment Focus	Data/Evidence Basis	Risk Representation	Dynamic Updating	ALARP/Risk Acceptance	Decision Output
Chang et al. [32]	MASS operational hazards	Expert knowledge and hazard information	Evidential reasoning and Bayesian network-based risk ranking	Limited; mainly static assessment	Not explicitly linked	Hazard identification and risk ranking
Fan et al. [33]	Risk comparison among manual, remote-control and autonomous navigation modes	Scenario-based assessment and expert judgment	Comparative navigation risk evaluation	Scenario-dependent	Not explicitly linked	Operational mode comparison
Han et al. [34]	Machinery-system availability of MASSs	Reliability and maintenance-related parameters	Dynamic Bayesian network	Yes, through state transition	Not explicitly linked	Machinery availability and maintenance support
Zhang et al. [35]	MASS risk-state evolution	Risk-factor modeling	Catastrophe theory-based risk evolution	Partial	Not explicitly linked	Risk-state monitoring
Laakso et al. [36]	Autonomous navigation system risk	System analysis and expert-based assessment	Causal risk modeling	Limited	Not explicitly linked	Navigation-system safety evaluation
Na et al. [37]	MASS functional hazards	Cognitive functional analysis and hazard identification	Qualitative hazard assessment	No	Not explicitly linked	Hazard identification and safety preparation
This study	System-level MASS operational safety risk	Expert elicitation under limited accident data	FI-SI-RI benchmark, ALARP classification and fuzzy-AHP aggregation	Static evaluation with robustness analysis	Explicitly incorporated	Risk intensity, systemic contribution and risk-control prioritization

summarizes the positioning of this paper relative to the main research streams.

3. Research Design

3.1. Assessment Boundary

The assessment object is the operational safety risk of MASS during autonomous or remotely supervised navigation. To ensure a consistent assessment boundary among experts, this study defines a reference MASS operating context (IMO autonomy level 3/4). The assumed system represents an early-stage autonomous cargo vessel capable of performing autonomous navigation functions under shore-based supervision. The vessel is assumed to operate without relying on continuous onboard navigational decision-making, while a shore control center provides monitoring, decision support, emergency intervention and remote takeover when required.

The reference operational domain includes open-water and coastal navigation scenarios with moderate traffic density, where the vessel performs perception, route planning, collision-avoidance decision-making, communication and emergency-response functions. The assessment considers the safety-related functions within the ship–shore operational chain, including onboard perception and control systems, communication links, remote supervision capability and management readiness. Cargo handling operations, commercial scheduling, legal responsibility allocation and non-navigation-related port activities are outside the assessment boundary unless they directly affect navigation safety.

3.2. FSA-Based Assessment Logic

The proposed evaluation methodology follows a six-step sequential research pipeline derived and decomposed from FSA core logic, among which Steps (2)–(5) are the core improved FSA risk analysis modules developed in this work:

(1)

Delineate the assessment boundary covering navigation safety risks of unmanned or remotely supervised MASSs (preparation for FSA hazard identification);

(2)

Identify, classify and stratify all potential MASS risk factors, and construct the hierarchical risk indicator framework shown in Table 2 (core optimized FSA hazard-identification stage);

(3)

Establish semi-quantitative risk acceptance benchmarks via Frequency Index (FI) and Severity Index (SI) matrix coupled with ALARP zoning rules (core optimized FSA risk analysis stage: risk criterion construction);

(4)

Collect expert subjective judgments and convert qualitative risk ratings into standardized fuzzy membership degrees (core optimized FSA risk analysis stage: data fuzzification processing);

(5)

Synthesize expert weights and fuzzy evaluation results through integrated AHP-fuzzy comprehensive evaluation to output single-factor and overall quantitative risk scores; further decompose risk intensity and weighted systemic contribution to identify key risk sources;

(6)

Summarize high-priority risk factors and propose targeted risk mitigation countermeasures.

Table 2. MASS operational safety risk assessment indicator hierarchy.

Primary Code	Primary Factor	Secondary Code	Secondary Indicator
U1	Ship-machine factors	U11	Environmental perception
		U12	Navigation decision-making
		U13	Equipment and systems
U2	Human factors	U21	Cognitive capacity
		U22	Navigational skills and habits
		U23	Teamwork and communication
U3	Environmental factors	U31	Weather conditions
		U32	Hydrometeorological conditions
		U33	Traffic complexity
U4	Information-technology factors	U41	Communication capability
		U42	Cybersecurity capability
		U43	Intelligent navigation system
U5	Management factors	U51	Routine ship management
		U52	Remote control center emergency management
		U53	Shipboard emergency management

Table 2. MASS operational safety risk assessment indicator hierarchy.

Primary Code	Primary Factor	Secondary Code	Secondary Indicator
U1	Ship-machine factors	U11	Environmental perception
		U12	Navigation decision-making
		U13	Equipment and systems
U2	Human factors	U21	Cognitive capacity
		U22	Navigational skills and habits
		U23	Teamwork and communication
U3	Environmental factors	U31	Weather conditions
		U32	Hydrometeorological conditions
		U33	Traffic complexity
U4	Information-technology factors	U41	Communication capability
		U42	Cybersecurity capability
		U43	Intelligent navigation system
U5	Management factors	U51	Routine ship management
		U52	Remote control center emergency management
		U53	Shipboard emergency management

3.3. Indicator Hierarchy

The assessment object, denoted as $U$, signifies the comprehensive operational safety risk of MASSs. The primary factor set is formulated as $U=\{U_1,U_2,U_3,U_4,U_5\}$, with each primary factor $U_i$ encompassing three secondary indicators, $U_{ij}$, as delineated in Table 2. This hierarchy translates the redistribution of safety-critical functions across the MASS ship–shore system into a structured and assessable risk framework. The operational definitions and evaluation criteria of the secondary indicators are further specified in

Table A8. Operational definitions and evaluation criteria of MASS risk indicators.

Primary Code	Primary Factor	Secondary Code	Secondary Indicator	Operational Definition and Evaluation Criteria
U1	Ship-machine factors	U11	Environmental perception	The capability of MASS to perceive surrounding objects and environmental states through multi-source sensing and data fusion. Evaluation considers target detection accuracy, sensor availability, information consistency, perception reliability under poor visibility, and robustness against environmental disturbances.
		U12	Navigation decision-making	The capability of MASS to generate safe, timely, and rule-compliant navigation decisions based on perceived information, COLREGs requirements, and operational objectives. Evaluation considers COLREGs compliance, encounter-type identification, give-way/stand-on judgment, collision-risk assessment based on parameters such as DCPA and TCPA, avoidance action timing, multi-vessel encounters handling, restricted-water maneuvering, and fallback decisions under abnormal conditions.
		U13	Equipment and systems	The reliability and availability of onboard hardware and control systems supporting autonomous operation. Evaluation considers equipment redundancy, propulsion and steering reliability, fault detection, system monitoring, and recovery capability.
U2	Human factors	U21	Cognitive capacity	The capability of remote operators and involved personnel to understand operational situations and make appropriate decisions. Evaluation considers situation awareness, workload management, attention allocation, and intervention capability.
		U22	Navigational skills and habits	The navigation competence and practical experience of personnel involved in MASS supervision and operation. Evaluation considers navigation knowledge, rule understanding, operational experience, and emergency-handling capability.
		U23	Teamwork and communication	The effectiveness of coordination and information exchange among remote operators, engineers, managers, and other stakeholders. Evaluation considers communication efficiency, responsibility allocation, teamwork, and coordination during abnormal events.
U3	Environmental factors	U31	Weather conditions	Meteorological conditions that influence MASS perception, communication, and maneuvering performance. Evaluation considers visibility, precipitation, wind conditions, and severe weather exposure.
		U32	Hydrometeorological conditions	Marine environmental conditions affecting vessel motion and navigation safety. Evaluation considers wave conditions, currents, sea state, and hydrodynamic disturbances.
		U33	Traffic complexity	The complexity of surrounding maritime traffic conditions encountered by MASSs. Evaluation considers traffic density, encounter situations, vessel interactions, and restricted-water navigation challenges.
U4	Information-technology factors	U41	Communication capability	The reliability of ship–shore communication supporting monitoring, decision support, and remote intervention. Evaluation considers communication availability, latency, bandwidth, packet loss, redundancy, and recovery capability.
		U42	Cybersecurity capability	The capability of MASS information and control systems to resist cyber threats. Evaluation considers data integrity, authentication, intrusion prevention, system protection, and cyber-response capability.
		U43	Intelligent navigation system	The capability of autonomous navigation software and algorithms to support safe navigation. Evaluation considers algorithm robustness, autonomous planning capability, decision explainability, validation coverage, and fail-safe performance.
U5	Management factors	U51	Routine ship management	The effectiveness of daily operational and maintenance management supporting MASS safety. Evaluation considers maintenance procedures, operational monitoring, documentation, and compliance management.
		U52	Remote control center emergency management	The capability of shore-based centers to monitor, intervene, and recover MASS operations during abnormal situations. Evaluation considers emergency procedures, takeover readiness, operator availability, and coordination efficiency.
		U53	Shipboard emergency management	The capability of onboard systems and personnel arrangements to respond to emergency situations. Evaluation considers emergency equipment availability, fallback procedures, and recovery capability.

to ensure that each factor represents an identifiable MASS operational capability or failure mechanism.

3.4. Expert Elicitation

The expert panel was recruited through targeted purposive sampling to ensure coverage of the major knowledge domains involved in MASS safety, including ship operation, marine engineering, intelligent-ship technology, remote operation, maritime administration, emergency management and risk assessment. The inclusion criteria required professional experience related to maritime operations, safety management, autonomous shipping technologies or relevant risk-analysis activities. Fifty experts were invited, and all completed questionnaires were retained as valid responses. The detailed professional profile, organizational background and experience information are reported in Appendix D.

4. Methodology

Section 4 converts the expert inputs into quantitative risk results through four connected stages. Section 4.1 establishes the FI–SI–RI benchmark and the common three-category evaluation set. Section 4.2 transforms the experts’ categorical judgments into membership vectors and matrices. Section 4.3 derives hierarchical weights because the membership distributions do not reflect the relative importance of the indicators. Section 4.4 combines the membership matrices, hierarchical weights, and category-score vector to obtain indicator-level, primary-factor, and overall risk-intensity scores, followed by weighted contribution decomposition.

4.1. Risk Benchmarking and ALARP Delineation

Risk is conceptualized as the product of accident frequency and consequence severity [41]. Due to the scarcity of historical accident data for MASS, which impedes robust statistical estimation, frequency and severity metrics are discretized into comparable ordinal scales. The ship FSA guidance of IMO [12] and China Classification Society [42] is used here as a reference scaffold.

$$R=F\times S$$

(1)

To facilitate matrix-based evaluation, the aforementioned multiplicative function is logarithmically transformed into an additive Risk Index ($RI$), as delineated in Equation (2):

$$log\left(R\right)=log\left(F\right)+log\left(S\right)=RI=FI+SI$$

(2)

The specific FI and SI criteria used in this study are presented in

Table 3. Frequency and Severity Indices used for MASS risk benchmarking.

Index	Level	Operational Definition
FI = 4	Frequent	One occurrence per ship per month is possible
FI = 3	Regular	One occurrence per ship per year is possible
FI = 2	Occasional	One occurrence may occur during one ship life cycle
FI = 1	Rare	One occurrence may occur in the life cycle of several similar ships
SI = 4	Very severe	Failure cannot be restored by shore support and may lead to a major accident
SI = 3	Severe	Failure can be restored by shore support
SI = 2	Major	Failure causes functional loss but can be basically restored onboard
SI = 1	Minor	Failure has limited influence on equipment function

, and their cross-tabulation produces the RI matrix in

Table 4. Semi-quantitative FI–SI risk matrix and case-study ALARP zones.

Severity/Frequency	FI = 1 Rare	FI = 2 Occasional	FI = 3 Regular	FI = 4 Frequent
SI = 4 Very severe	5 ALARP zone	6 High-risk zone	7 High-risk zone	8 High-risk zone
SI = 3 Severe	4 ALARP zone	5 ALARP zone	6 High-risk zone	7 High-risk zone
SI = 2 Major	3 ALARP zone	4 ALARP zone	5 ALARP zone	6 High-risk zone
SI = 1 Minor	2 Low-risk zone	3 ALARP zone	4 ALARP zone	5 ALARP zone

. The FI–SI–RI matrix was constructed based on expert evaluations of identified MASS safety hazard indicators. The Frequency Index (FI) reflects the likelihood that a hazard occurs during MASS operation, while the Severity Index (SI) represents the potential impact of the hazard if it occurs. The Risk Index (RI) was then determined by combining FI and SI values to classify hazards into different risk categories. These three states are represented by the fuzzy evaluation reference vector [9, 6, 3], where 9, 6, and 3 correspond to high risk, ALARP, and low risk, respectively.

4.2. Determination of Fuzzy Membership Degrees

For each secondary indicator $U_{ij}$, expert panelists evaluate the risk state and assign it to one of three discrete risk levels: high risk, the ALARP category, or low risk. Let $F_{ijk}$ denote the number of experts assigning indicator $U_{ij}$ to level $k$, and let $N$ denote the total number of valid expert evaluations. The fuzzy membership degree is mathematically formulated in Equation (3).

This discrete response-proportion-based membership calculation differs from continuous parameterized fuzzy functions but conforms to maritime FSA engineering assessment specifications [42], and is suitable for MASS risk evaluation under insufficient accident data. First, maritime industry experts are more inclined to give categorical risk judgments rather than continuous scores, which reduces subjective bias in evaluation. Second, continuous fuzzy functions require large sample datasets to calibrate shape parameters, which cannot be satisfied given limited MASS operational records. Third, the frequency proportion of expert classification can directly form a standardized membership matrix, and the subsequent fuzzy weighted aggregation and defuzzification scoring process fully follow the standard fuzzy comprehensive evaluation workflow, retaining the core advantages of fuzzy theory in handling ambiguous subjective judgment.

$$P_{ijk}={\displaystyle \frac{F_{ijk}}{N}},k\in \{\mathrm{1,2},3\}$$

(3)

In the present study, the survey yielded $N=50$ valid responses. Accordingly, the fuzzy membership matrix detailed in

Table 5. Expert membership matrix for the fifteen MASS risk indicators.

Primary	Indicator	Indicator Name	High Risk	ALARP	Low Risk
U1	U11	Environmental perception	0.12	0.78	0.10
	U12	Navigation decision-making	0.24	0.70	0.06
	U13	Equipment and systems	0.30	0.62	0.08
U2	U21	Cognitive capacity	0.06	0.86	0.08
	U22	Navigational skills and habits	0.02	0.50	0.48
	U23	Teamwork and communication	0.00	0.22	0.78
U3	U31	Weather conditions	0.38	0.56	0.06
	U32	Hydrometeorological conditions	0.32	0.60	0.08
	U33	Traffic complexity	0.06	0.86	0.08
U4	U41	Communication capability	0.30	0.64	0.06
	U42	Cybersecurity capability	0.00	0.98	0.02
	U43	Intelligent navigation system	0.70	0.30	0.00
U5	U51	Routine ship management	0.00	0.30	0.70
	U52	Remote control center emergency management	0.10	0.72	0.18
	U53	Shipboard emergency management	0.04	0.92	0.04

is directly derived from these expert response frequencies. To illustrate, if 6, 39, and 5 experts assess the environmental perception indicator $U_{11}$ as high risk, the ALARP category, and low risk, respectively, the corresponding membership row vector is computed as [0.12,0.78,0.10].

4.3. AHP Weighting Derivation and Consistency Analysis

The Analytic Hierarchy Process (AHP) was employed to determine the relative importance of the primary and secondary risk factors. Expert judgments were aggregated according to the Saaty nine-point scale to construct the pairwise comparison matrices. The consistency ratio (CR) was calculated to examine the logical consistency of the aggregated judgment matrices. For methodological transparency and reproducibility, Appendix A provides the aggregated AHP weighting matrices and the corresponding consistency information used in the weight calculation.

$$m_i={\left({\prod }_{j=1}^n{a}_{ij}\right)}^{{\displaystyle \frac{1}{n}}}$$

(4)

$$w_i={\displaystyle \frac{m_i}{{\sum }_{j=1}^n{m}_j}}$$

(5)

where $a_{ij}$ represents the judged importance of factor $i$ relative to factor $j$.

The logical consistency of the judgment matrix is verified utilizing Equations (6)–(8). The matrix is considered to exhibit acceptable consistency provided that $CR<0.10$.

$${\lambda }_{max}={\displaystyle \frac{1}{n}}{\sum }_{i=1}^n{\displaystyle \frac{{\left(Aw\right)}_i}{w_i}}$$

(6)

$$CI={\displaystyle \frac{{\lambda }_{max}-n}{n-1}}$$

(7)

$$CR={\displaystyle \frac{CI}{RI}}$$

(8)

Table 6. AHP weights and global weights for MASS safety risk indicators.

Primary Code	Primary Factor	Primary Weight	Secondary Code	Secondary Indicator	Local Weight	Global Weight
U1	Ship-machine factors	0.383	U11	Environmental perception	0.633	0.242
			U12	Navigation decision-making	0.261	0.100
			U13	Equipment and systems	0.106	0.041
U2	Human factors	0.130	U21	Cognitive capacity	0.633	0.082
			U22	Navigational skills and habits	0.106	0.014
			U23	Teamwork and communication	0.261	0.034
U3	Environmental factors	0.038	U31	Weather conditions	0.643	0.024
			U32	Hydrometeorological conditions	0.283	0.011
			U33	Traffic complexity	0.074	0.003
U4	Information-technology factors	0.134	U41	Communication capability	0.669	0.090
			U42	Cybersecurity capability	0.267	0.036
			U43	Intelligent navigation system	0.064	0.009
U5	Management factors	0.315	U51	Routine ship management	0.669	0.211
			U52	Remote control center emergency management	0.243	0.077
			U53	Shipboard emergency management	0.088	0.028

Note: Local weight denotes the relative importance of a secondary indicator within its parent primary factor. Global weight denotes the overall importance of the secondary indicator in the complete hierarchy and is calculated as the product of the primary weight and the corresponding local weight. Local weights are used in fuzzy aggregation, whereas global weights are used for weighted contribution analysis.

summarizes the primary and secondary weights incorporated into the fuzzy aggregation process. The primary weight distribution reveals that ship-machine and management factors dominate the structural influence on the overall risk score. In contrast, environmental factors carry a comparatively marginal structural weight yet demonstrate high risk intensity.

4.4. Fuzzy Comprehensive Evaluation and Risk Quantification

For any given primary factor $U_i$, the secondary fuzzy membership matrix and the associated local weight vector are denoted as $R_i$ and $W_i$, respectively. The primary fuzzy evaluation vector $B_i$ is derived through the fuzzy composition of $W_i$ and $R_i$ (Equation (9)), which subsequently yields the primary risk score $G_i$ (Equation (10)).

$$B_i=W_i{R}_i=[b_{i1},b_{i2},b_{i3}]$$

(9)

$$G_i=B_i{C}^T$$

(10)

The global fuzzy evaluation vector $B$ is synthesized by aggregating the primary evaluation vectors weighted by the primary weight vector $W$, as delineated in Equation (11). The ultimate comprehensive risk score $G$ is then quantified via Equation (12)

$$B=W\left[\begin{array}{c}{B}_1\\ B_2\\ B_3\\ B_4\\ B_5\end{array}\right]$$

(11)

$$G=B{C}^T$$

(12)

To illustrate the computational pipeline, the assessment of the ship-machine factors ($U_1$) is presented as an illustrative case. Given the local weight vector $W_1=[0.633,0.261,0.106]$ and the corresponding membership matrix $R_1$, the primary evaluation vector is computed as $B_1=[0.170,0.742,0.087]$. Applying the score vector $C$, the primary risk score is determined as follows:

$$B_1=W_1{R}_1=[0.633,0.261,0.106]R_1=[0.170,0.742,0.087]$$

(13)

$$G_1=B_1{C}^T=[0.170,0.742,0.087][\mathrm{9,6},3{]}^T=6.25$$

(14)

Extrapolating this methodology across all primary factors generates the comprehensive evaluation vectors and risk scores tabulated in

Table 7. Fuzzy aggregation vectors and risk scores for primary factors.

Layer	Factor	High Membership	ALARP Membership	Low Membership	Score	Risk Zone
U1	Ship-machine factors	0.170	0.742	0.087	6.25	High-risk zone
U2	Human factors	0.040	0.655	0.305	5.21	ALARP zone
U3	Environmental factors	0.339	0.594	0.067	6.82	High-risk zone
U4	Information-technology factors	0.246	0.709	0.045	6.60	High-risk zone
U5	Management factors	0.028	0.457	0.516	4.54	ALARP zone
Overall	MASS operational safety risk	0.125	0.631	0.244	5.64	ALARP zone

. The global fuzzy evaluation vector is established as $B=[0.125,0.631,0.244]$. Accordingly, the final comprehensive risk score $G$ is computed as:

$$G=B{C}^T=[0.125,0.631,0.244]\left]\right[9,6,3{]}^T=5.64$$

(15)

5. Case Study

5.1. Case Setting

The survey instrument required experts to assess the risk level of each secondary indicator in accordance with the established FSA benchmarks. Data processing was conducted in three sequential phases. First, the frequency counts were transformed into fuzzy membership degrees utilizing Equation (3), yielding the membership matrix presented in Table 5. Second, the AHP weights for both primary and secondary factors were determined, as summarized in Table 6. Third, the membership matrices and weight vectors were synthesized through Equations (9)–(12), generating the primary evaluation results in Table 7 and the secondary indicator risk scores detailed in

Table 8. Secondary indicator risk scores and weighted contributions.

Primary	Code	Secondary Indicator	Score	Risk Zone	Global Weight	Weighted Contribution
U1	U11	Environmental perception	6.06	High-risk zone	0.242	1.469
	U12	Navigation decision-making	6.54	High-risk zone	0.100	0.654
	U13	Equipment and systems	6.66	High-risk zone	0.041	0.270
U2	U21	Cognitive capacity	5.94	ALARP zone	0.082	0.489
	U22	Navigational skills and habits	4.62	ALARP zone	0.014	0.064
	U23	Teamwork and communication	3.66	ALARP zone	0.034	0.124
U3	U31	Weather conditions	6.96	High-risk zone	0.024	0.170
	U32	Hydrometeorological conditions	6.72	High-risk zone	0.011	0.072
	U33	Traffic complexity	5.94	ALARP zone	0.003	0.017
U4	U41	Communication capability	6.72	High-risk zone	0.090	0.602
	U42	Cybersecurity capability	5.94	ALARP zone	0.036	0.213
	U43	Intelligent navigation system	8.10	High-risk zone	0.009	0.069
U5	U51	Routine ship management	3.90	ALARP zone	0.211	0.822
	U52	Remote control center emergency management	5.76	ALARP zone	0.077	0.441
	U53	Shipboard emergency management	6.00	High-risk zone	0.028	0.166

.

5.2. Secondary Indicator Scores and Risk Ranking

Eight indicators are classified within the high-risk zone: environmental perception, navigation decision-making, equipment and systems, weather conditions, hydrometeorological conditions, communication capability, intelligent navigation system, and shipboard emergency management. The risk ranking illustrated in

Table 9. Ranking of secondary indicator risk intensity.

Ranked Indicator	Name	Score	Risk zone
U43	Intelligent navigation system	8.10	High-risk zone
U31	Weather conditions	6.96	High-risk zone
U32	Hydrometeorological conditions	6.72	High-risk zone
U41	Communication capability	6.72	High-risk zone
U13	Equipment and systems	6.66	High-risk zone
U12	Navigation decision-making	6.54	High-risk zone
U11	Environmental perception	6.06	High-risk zone
U53	Shipboard emergency management	6.00	High-risk zone
U21	Cognitive capacity	5.94	ALARP zone
U33	Traffic complexity	5.94	ALARP zone
U42	Cybersecurity capability	5.94	ALARP zone
U52	Remote control center emergency management	5.76	ALARP zone
U22	Navigational skills and habits	4.62	ALARP zone
U51	Routine ship management	3.90	ALARP zone
U23	Teamwork and communication	3.66	ALARP zone

provides a graphical representation of these findings. The highest intensity score is observed for the intelligent navigation system ($U_{43}$), reaching a value of 8.10. This indicates that experts perceive the reliability, robustness, and fail-safe mechanisms of autonomous navigation as the most critical individual risk vulnerability.

5.3. Primary Factor Diagnosis

Under the scoring and aggregation rules adopted in this study, the primary-factor risk-intensity ordering is U₃ Environmental factors (6.82) > U₄ Information-technology factors (6.60) > U₁ Ship-machine factors (6.25) > U₂ Human factors (5.21) > U₅ Management factors (4.54). These values should be interpreted as expert-elicited screening results for the present assessment context rather than as observed accident probabilities or universally calibrated MASS risk estimates.

The empirical distribution delineated in

Table 10. Risk scores of primary factors and overall MASS risk.

Factor	Name	Score	Risk Zone
U1	Ship-machine factors	6.25	High-risk zone
U2	Human factors	5.21	ALARP zone
U3	Environmental factors	6.82	High-risk zone
U4	Information-technology factors	6.60	High-risk zone
U5	Management factors	4.54	ALARP zone
Overall	MASS operational safety risk	5.64	ALARP zone

engenders three pivotal implications. First, the preeminence of environmental risk underscores the acute vulnerability of MASSs to meteorological, hydrodynamic, visibility, and traffic complexities. Second, the near-parity between information technology and environmental risk scores highlights that MASS operational safety is inextricably linked to communication continuity, cyber resilience, and the robustness of intelligent navigation systems. Third, ship-machine factors persist as a critical risk nexus, as autonomous perception, decision-making, and equipment control mechanisms directly supplant or augment the functions traditionally executed by the onboard crew.

5.4. Risk Contribution Decomposition

Risk intensity alone is insufficient for determining control priorities. An indicator with higher risk intensity may contribute minimally to the overall score if its global weight is marginal. Consequently, the weighted contribution of each secondary indicator $U_{ij}$ is quantified using Equation (16).

Table 11. Weighted contribution decomposition at the secondary-indicator level.

Code	Indicator	Global Weight	Score	Contribution	Share
U11	Environmental perception	0.242	6.06	1.469	26.0%
U51	Routine ship management	0.211	3.90	0.822	14.6%
U12	Navigation decision-making	0.100	6.54	0.654	11.6%
U41	Communication capability	0.090	6.72	0.602	10.7%
U21	Cognitive capacity	0.082	5.94	0.489	8.7%
U52	Remote control center emergency management	0.077	5.76	0.441	7.8%
U13	Equipment and systems	0.041	6.66	0.270	4.8%
U42	Cybersecurity capability	0.036	5.94	0.213	3.8%
U31	Weather conditions	0.024	6.96	0.170	3.0%
U53	Shipboard emergency management	0.028	6.00	0.166	2.9%
U23	Teamwork and communication	0.034	3.66	0.124	2.2%
U32	Hydrometeorological conditions	0.011	6.72	0.072	1.3%
U43	Intelligent navigation system	0.009	8.10	0.069	1.2%
U22	Navigational skills and habits	0.014	4.62	0.064	1.1%
U33	Traffic complexity	0.003	5.94	0.017	0.3%

and

Table 12. Weighted contribution shares of primary factors.

Factor	Name	Weighted Contribution	Share of Total
U1	Ship-machine factors	2.393	42.4%
U2	Human factors	0.677	12.0%
U3	Environmental factors	0.259	4.6%
U4	Information-technology factors	0.884	15.7%
U5	Management factors	1.429	25.3%

present the decomposition results.

$${\mathit{\text{Contribution}}}_{ij}=W_{ij}^{\mathit{\text{global}}}\times G_{ij}$$

(16)

The decomposition results reveal an important distinction between risk intensity and systemic contribution. The indicator with the highest individual risk score does not necessarily represent the most influential factor for overall MASS safety. For example, the intelligent navigation system exhibits the highest risk intensity, reflecting concerns regarding autonomous navigation robustness and fail-safe capability, but its weighted contribution is limited because of its relatively small structural weight. In contrast, environmental perception and routine ship management contribute substantially to the overall risk profile due to the combination of considerable risk exposure and higher system-level importance. This finding suggests that MASS risk governance should not rely solely on ranking individual risk scores, but should prioritize factors according to their combined risk intensity and systemic influence.

5.5. Sensitivity Analysis

To examine the internal sensitivity of the overall classification, each primary-factor weight was independently increased and decreased by 10%, after which the complete primary-weight vector was renormalized. As shown in

Table 13. Sensitivity of the overall score to primary-weight perturbation.

Factor	Name	Perturbation	Recomputed G	Delta	Zone
U1	Ship-machine factors	minus 10%	5.618	−0.024	ALARP zone
	Ship-machine factors	plus 10%	5.665	+0.022	ALARP zone
U2	Human factors	minus 10%	5.648	+0.006	ALARP zone
	Human factors	plus 10%	5.637	−0.006	ALARP zone
U3	Environmental factors	minus 10%	5.638	−0.004	ALARP zone
	Environmental factors	plus 10%	5.647	+0.004	ALARP zone
U4	Information-technology factors	minus 10%	5.629	−0.013	ALARP zone
	Information-technology factors	plus 10%	5.655	+0.013	ALARP zone
U5	Management factors	minus 10%	5.678	+0.036	ALARP zone
	Management factors	plus 10%	5.609	−0.034	ALARP zone

, the recomputed overall score ranged from 5.609 to 5.678 and remained within the ALARP category in all ten perturbation cases. The largest absolute changes occurred when the management-factor weight (U₅) was varied: decreasing it by 10% increased the overall score by 0.036, whereas increasing it by 10% reduced the score by 0.034. This occurs because U₅ combines a relatively large baseline weight with the lowest primary-factor score.

It should be noted that the robustness analysis evaluates the internal stability of the proposed assessment framework rather than external operational validity. Given that MASS commercial deployment remains at an early stage and large-scale operational accident databases are still unavailable, the obtained risk score should be interpreted as a prospective assessment under the defined expert-based evaluation context. Future studies may further incorporate trial-operation records, autonomous-navigation test data, and long-term monitoring information to enhance empirical validation.

6. Discussion of Empirical Results

6.1. Why the Overall Risk Is ALARP Rather than Low

The final aggregate score of 5.64 indicates that the operational safety risk of MASS remains controllable under the assumed scenario but necessitates proactive risk mitigation. Given that the score is proximate to the upper boundary of the ALARP region, risk reduction measures must be implemented wherever technically and economically practicable. This finding aligns with the inherent characteristics of MASS operations: while autonomous technologies may mitigate certain conventional crew-related risks, they simultaneously introduce novel dependencies on perception systems, decision-making algorithms, communication networks, and remote-control organizations.

6.2. Environmental and Information-Technology Coupling

The results demonstrate that environmental and information technology factors cannot be managed in isolation. Adverse weather conditions, poor visibility, significant wave heights, and complex traffic scenarios degrade the fidelity of perception inputs, exacerbate collision avoidance complexities, and potentially compromise communication links. Consequently, a comprehensive MASS risk control strategy must integrate meteorological forecasting, sensor fusion, communication redundancy, and autonomous fail-safe maneuver. Furthermore, the elevated risk scores for weather conditions ($U_{31}$) and hydrometeorological conditions ($U_{32}$) corroborate the necessity for strictly defined environmental operating envelopes and dynamic route adaptation mechanisms.

6.3. From High Intensity Risk to High Priority Intervention

The comparison between risk intensity and weighted contribution provides a more nuanced understanding of MASS safety priorities. High-intensity indicators, such as the intelligent navigation system, represent areas requiring rigorous technical verification because failures may directly affect autonomous operation. However, high-contribution indicators, such as environmental perception and routine ship management, represent broader systemic vulnerabilities because they influence multiple aspects of operational safety. Therefore, technical validation and organizational governance should follow different intervention priorities: high-intensity risks require targeted engineering improvement, whereas high-contribution risks require integrated management strategies involving system design, operational procedures, and organizational readiness.

7. Managerial and Policy Implications

The results provide practical implications for MASS operators, system designers and maritime regulators. Primarily, perception reliability should be treated as a precondition for safe operation. Since environmental perception $U_{11}$ contributes most to the overall risk score, operators should not rely on a single sensing source in trial or commercial operation. Radar, AIS, optical cameras, LiDAR and ECDIS data should be cross-validated in real time, especially under poor visibility, heavy rain, sea clutter and dense traffic conditions. Before deployment, operators should conduct scenario-based perception tests and define minimum sensor-performance requirements. When perception confidence falls below a predefined threshold, the vessel should be configured to automatically shift to a conservative navigation mode, reduce speed, request shore-side confirmation or trigger remote takeover.

Furthermore, autonomous navigation decision-making should be verified under operationally realistic scenarios rather than idealized test cases, with particular attention to COLREGs compliance, encounter classification, collision-risk assessment, and maneuvering decisions under multi-vessel and restricted-water conditions. The higher risk intensity of navigation decision-making $U_{12}$ indicates that MASS algorithms should be tested in multi-vessel encounters, port approaches, narrow channels, traffic separation schemes, poor visibility and emergency maneuvering situations. In practice, test protocols should require algorithms to demonstrate COLREGs compliance, explainable avoidance logic and stable behavior under sensor uncertainty. For high-risk waters, operators should prepare predefined fallback strategies, such as speed reduction, route deviation, holding position, or transfer of control to the shore control center.

Moreover, ship–shore communication and cybersecurity should be incorporated into daily operational control rather than treated as auxiliary technical issues. The elevated risks of communication capability $U_{41}$ and cybersecurity capability $U_{42}$ suggest that latency, data loss, bandwidth fluctuation and cyber intrusion may directly affect remote monitoring and emergency intervention. MASS operators should therefore establish minimum communication-quality thresholds, multi-link backup channels, encrypted transmission, real-time link-health monitoring and clear rules for switching between autonomous, remote-control and fail-safe modes. Shore control centers should also conduct regular takeover drills, communication-loss exercises and cyber-contingency simulations to ensure that operators can intervene effectively when system performance deteriorates.

Ultimately, regulators and classification societies should shift from document-based approval to evidence-based safety assurance. Before allowing MASS operation in specific waters, authorities should require operators to define the Operational Design Domain, including permitted sea states, visibility conditions, traffic density, communication coverage and remote-control availability. Safety cases should include test records, failure-mode analysis, emergency response procedures, communication-performance evidence and human takeover arrangements. This would make MASS risk governance more operational, verifiable and accountable, and would help ensure that autonomous operation is permitted only within clearly defined and controllable conditions.

The 2026 MASS Code strengthens this policy direction by creating a global reference point for safe, secure and environmentally sound MASS operation. Although the Code is initially non-mandatory, its expected experience-building function means that operators and authorities should begin accumulating auditable risk evidence, including test records, operational envelopes, communication performance data and emergency fallback logs. The framework proposed in this paper can support that evidence-building process by translating expert judgments and operational assumptions into transparent risk-control priorities.

8. Conclusions

This study developed and empirically applied an FSA-based risk evaluation framework tailored to MASS operations. Building on a five-dimensional hierarchical indicator system and ALARP risk criteria, the framework integrates fuzzy-AHP and expert frequency-based evaluation to generate operationally interpretable risk scores. A case study with 50 domain experts demonstrates the framework’s utility in identifying risk priorities under conditions of limited accident data.

The case study based on 50 expert questionnaires shows that the overall MASS operational risk score is 5.64, which falls within the ALARP region. Environmental factors, information technology factors and ship machinery factors present relatively high risk levels, with scores of 6.82, 6.60 and 6.25. Beyond identifying major risk sources, the study reveals that risk intensity and systemic contribution provide different perspectives for MASS safety prioritization. While intelligent navigation systems exhibit the highest individual risk intensity, environmental perception, routine ship management, and navigation decision-making contribute more substantially to the overall risk profile due to their structural importance. This distinction provides a more targeted basis for allocating technical and managerial risk-control resources. With the 2026 MASS Code now adopted, the window for establishing evidence-based risk assessment protocols is immediate. The framework presented here offers a practical tool for translating the code’s safety objectives into auditable risk-control priorities.

Still, this study has several limitations. The case study relies mainly on expert questionnaire data because large-scale MASS accident data are not yet available. The indicator weights and membership degrees may therefore be affected by expert background and judgment uncertainty. Future research can incorporate real trial-operation data, simulation data and dynamic monitoring data to update the model. In addition, the proposed FSA-based framework can be integrated with Bayesian networks or system-dynamics models to capture causal propagation and dynamic risk evolution in MASS operations.