236
Sensemaking in Safety Critical and Complex Situations
system like an autonomous ship, there are several suggested definitions of autonomous
and the subject will be discussed later in this chapter. An autonomous ship can be classified as an industrial autonomous system. This is an autonomous unit, or a collection
of such, that can operate safely and efficiently in a real-world environment while doing
operations of direct commercial value and which can be manufactured, maintained,
deployed, operated and retrieved at an acceptable cost relative to the value it provides
( Grøtli et al. 2015). When operating in general seaways together with other ships and
leisure crafts, this puts a high demand on safety and reliability that is difficult to achieve
with automation systems today. Furthermore, merchant ships have a high capital value,
and it is expected that most autonomous and uncrewed ships will be continuously supervised from a remote control centre ( RCC) to keep a close watch on the ship and the
corresponding investment. However, when an RCC is in place, it also makes sense to
let the RCC operators participate in the control of the ship. This avoids the need for the
automation system to be able to handle all possible operational cases as the operator is
available for the cases that are too complex for the automation to handle reliably.
This means that most autonomous ship systems will involve both an automation
system and a human operator. Thus, the question of a how to design a high-quality
human–automation interface ( HAI) is a central one for autonomous ships. This chapter will discuss some possibilities for the design of the automation system for autonomous ships that may enable a better HAI to be designed. In the following, the term
autonomous ships will be used for an automated ship where human operators are
available but are not continuously attending to the control positions. The operators
may be on the ship or in the RCC.
CONSTRAINED AUTONOMY IN THE LITERATURE
The form of constrained autonomy discussed in this text was first published as a
concept in ( Rødseth & Nordahl 2017). Here, it described a designed-in limitation on
the possible action of an automation system in a mixed autonomy/ human operator
context. The objective is to create a more deterministic behaviour as seen from the
human designer or operator, and by that make the allocation of tasks and responsibilities between human and automation more efficient and safer.
Other writers have used a similar terminology for other concepts such as in
Al-Rifaie et al. ( 2012) where it applies to Gaussian constrained autonomy in swarms,
where constrained refers to a limited random behaviour by swarm members. In Jha
et al. ( 2018), the term chance-constrained temporal logic is used on a variant of temporal logic adapted to perception uncertainty. Both these uses of constrained autonomy are very different from the concept as it is described here.
The terms limited autonomy and partly autonomous have also been used frequently in the literature, but this normally refers to emergent and generally unwanted
limitations in the automation system and not to a design feature.
AUTOMATION, AUTONOMY, RESPONSE TIME AND DEADLINE
Automation and autonomy has a wide range of definitions in the literature ( see, e.g.,
Vagia et al. 2016). For the purposes of this chapter, a relatively simple definition will
be used. Here, automation can be defined as “ pertaining to a process or device that,
Sensemaking in Safety Critical and Complex Situations
system like an autonomous ship, there are several suggested definitions of autonomous
and the subject will be discussed later in this chapter. An autonomous ship can be classified as an industrial autonomous system. This is an autonomous unit, or a collection
of such, that can operate safely and efficiently in a real-world environment while doing
operations of direct commercial value and which can be manufactured, maintained,
deployed, operated and retrieved at an acceptable cost relative to the value it provides
( Grøtli et al. 2015). When operating in general seaways together with other ships and
leisure crafts, this puts a high demand on safety and reliability that is difficult to achieve
with automation systems today. Furthermore, merchant ships have a high capital value,
and it is expected that most autonomous and uncrewed ships will be continuously supervised from a remote control centre ( RCC) to keep a close watch on the ship and the
corresponding investment. However, when an RCC is in place, it also makes sense to
let the RCC operators participate in the control of the ship. This avoids the need for the
automation system to be able to handle all possible operational cases as the operator is
available for the cases that are too complex for the automation to handle reliably.
This means that most autonomous ship systems will involve both an automation
system and a human operator. Thus, the question of a how to design a high-quality
human–automation interface ( HAI) is a central one for autonomous ships. This chapter will discuss some possibilities for the design of the automation system for autonomous ships that may enable a better HAI to be designed. In the following, the term
autonomous ships will be used for an automated ship where human operators are
available but are not continuously attending to the control positions. The operators
may be on the ship or in the RCC.
CONSTRAINED AUTONOMY IN THE LITERATURE
The form of constrained autonomy discussed in this text was first published as a
concept in ( Rødseth & Nordahl 2017). Here, it described a designed-in limitation on
the possible action of an automation system in a mixed autonomy/ human operator
context. The objective is to create a more deterministic behaviour as seen from the
human designer or operator, and by that make the allocation of tasks and responsibilities between human and automation more efficient and safer.
Other writers have used a similar terminology for other concepts such as in
Al-Rifaie et al. ( 2012) where it applies to Gaussian constrained autonomy in swarms,
where constrained refers to a limited random behaviour by swarm members. In Jha
et al. ( 2018), the term chance-constrained temporal logic is used on a variant of temporal logic adapted to perception uncertainty. Both these uses of constrained autonomy are very different from the concept as it is described here.
The terms limited autonomy and partly autonomous have also been used frequently in the literature, but this normally refers to emergent and generally unwanted
limitations in the automation system and not to a design feature.
AUTOMATION, AUTONOMY, RESPONSE TIME AND DEADLINE
Automation and autonomy has a wide range of definitions in the literature ( see, e.g.,
Vagia et al. 2016). For the purposes of this chapter, a relatively simple definition will
be used. Here, automation can be defined as “ pertaining to a process or device that,