242
Sensemaking in Safety Critical and Complex Situations
2. O AC – Autonomous Control: States where the automation system can sustain
automatic operation for at least a known T DL without human support.
T DL > 10 min
T DL > 10 min
1 min < T DL < 10 min
n /a
0 < T DL < 1 min
1
TCPA > 10 min or
CPA > 1nm
2
TCPA > 5min and
CPA ≤ 1nm
F1
4
TCPA < 1min or
CPA < 0.3nm
3
1min < TCPA ≤ 5min
0.3nm ≤ CPA ≤ 1nm
Keep speed and
course
Evasive
manoeuvres
Evasive
manoeuvres
Dead in water
Operator
control
FIGURE 14.4 Examples of operational envelope ( OE) states and ship control tasks.
human operator. Also, here the f all-back can be activated, e.g. if the operator does
not respond.
The figure also shows how to establish a one to one relationship between the OE
states and the SCT. The task associated with the f all-back state F1 is called a MRC
as F1 is not part of the OE. The tasks and MRC are illustrated by the boxes at the
bottom, below the state boxes. Note that the tasks corresponding to states 2 and 3
is identical in description but are still considered two different tasks as operational
parameters are different.
One can also create a corresponding set of states for daytime sailing when crew
is active and T MR normally is shorter, e.g. 1 minute. One could keep the same pattern
but reduce CPA and TCPA correspondingly. To keep the amount of code and specifications lower, this could be implemented as parameterized states and SCTs. This
could be done by comparing TCPA to T MR and distances to a relationship between
speed and T MR .
The above discussion shows that it is possible to split O into different partitions,
where each partition can define different relationship between automatic and crew
control. Note that this partitioning is not the same as the partitioning defined in Eq.
( 14.2). The different relationships between automation and crew are illustrated in
Figure 14.5, with the following O components:
1. O FA – Fully Autonomous: States that the automation system is designed to
handle alone, without human interaction. T DL is not relevant as long as the
system remains in these states.
3. O OA – Operator and Automation: States where automation can handle some
situations, but where T DL cannot be defined. A human needs to supervise
automation and be ready to take over control.
4. O OE – Operator Exclusive: States where direct operator control is required.
The automation may assist the operator but is not generally able to control
the ship in a safe manner.
5. F: Fall-back states containing the MRCs that are used in cases where events
take the system out of O. This may happen due to unanticipated failures,
environmental conditions outside O or failure of an operator to respond
when the system requires human intervention.
Sensemaking in Safety Critical and Complex Situations
2. O AC – Autonomous Control: States where the automation system can sustain
automatic operation for at least a known T DL without human support.
T DL > 10 min
T DL > 10 min
1 min < T DL < 10 min
n /a
0 < T DL < 1 min
1
TCPA > 10 min or
CPA > 1nm
2
TCPA > 5min and
CPA ≤ 1nm
F1
4
TCPA < 1min or
CPA < 0.3nm
3
1min < TCPA ≤ 5min
0.3nm ≤ CPA ≤ 1nm
Keep speed and
course
Evasive
manoeuvres
Evasive
manoeuvres
Dead in water
Operator
control
FIGURE 14.4 Examples of operational envelope ( OE) states and ship control tasks.
human operator. Also, here the f all-back can be activated, e.g. if the operator does
not respond.
The figure also shows how to establish a one to one relationship between the OE
states and the SCT. The task associated with the f all-back state F1 is called a MRC
as F1 is not part of the OE. The tasks and MRC are illustrated by the boxes at the
bottom, below the state boxes. Note that the tasks corresponding to states 2 and 3
is identical in description but are still considered two different tasks as operational
parameters are different.
One can also create a corresponding set of states for daytime sailing when crew
is active and T MR normally is shorter, e.g. 1 minute. One could keep the same pattern
but reduce CPA and TCPA correspondingly. To keep the amount of code and specifications lower, this could be implemented as parameterized states and SCTs. This
could be done by comparing TCPA to T MR and distances to a relationship between
speed and T MR .
The above discussion shows that it is possible to split O into different partitions,
where each partition can define different relationship between automatic and crew
control. Note that this partitioning is not the same as the partitioning defined in Eq.
( 14.2). The different relationships between automation and crew are illustrated in
Figure 14.5, with the following O components:
1. O FA – Fully Autonomous: States that the automation system is designed to
handle alone, without human interaction. T DL is not relevant as long as the
system remains in these states.
3. O OA – Operator and Automation: States where automation can handle some
situations, but where T DL cannot be defined. A human needs to supervise
automation and be ready to take over control.
4. O OE – Operator Exclusive: States where direct operator control is required.
The automation may assist the operator but is not generally able to control
the ship in a safe manner.
5. F: Fall-back states containing the MRCs that are used in cases where events
take the system out of O. This may happen due to unanticipated failures,
environmental conditions outside O or failure of an operator to respond
when the system requires human intervention.