244
Sensemaking in Safety Critical and Complex Situations
At any point in time, an autonomous ship will have a number of active SCT
with different degree of automation and different timing requirements. Examples
are SCT related to navigation, energy production, and stability. This means that
the operator’s response deadline for the full system will be the minimum of the
individual T DL values for all active SCT and states. If a function FDL is defined to
determine T DL for a given state and condition, the s ystem-wide T DL can be defined
as in Eq. ( 14.4).
∀ ∈
c
c
j
j
c, ∃ ⊂
O
O
ˆ
ˆ
n
n
: ∈O ˆ
min
=
(
)
( )
(14.4)
ˆ
T DL
FDL O n , c
n
CONSTRAINED AUTONOMY
The concept of constrained autonomy for ships was proposed by Rødseth and
Nordahl ( 2017). Here, it was defined as the automation system having defined limits
to the options it can use to address these conditions, e.g. maximum deviation from
planned track or arrival time. The automation system needs to request assistance
from human operators if these constraints are exceeded. This definition was linked to
the concept of operational envelope in ( Rødseth 2019). The latter paper also defines
five degrees of automation:
• DA0 – Operator controlled: Limited automation and decision support is
available, as on most of today’s merchant ship. The human is always in
charge of operations and need to be present at controls and aware of the
situation at all times.
• DA1 – Automatic: More advanced automation, e.g. dynamic positioning,
automatic crossing or auto-berthing, is used. Crew attention is required to
handle problems such as object classification and collision avoidance. The
human may use own judgement as to how long he or she may be away from
the control position. For automated fjord crossing in good weather, little
traffic and in sheltered water, the operator may be away from the controls
for several minutes.
• DA2 – High automation: The degree of automation is higher than for
DA1 and may include certain "cognitive" functions, such as object detection and classification or collision avoidance. However, there are inherent
and unknown limits to the automation system’s capabilities.. These limits
are not defined or constrained ( see DA3), so the human operator must still
use his or her judgement as to the required attention level. However, it is
assumed that the need for attention is lower than for DA1.
• DA3 – Constrained autonomy: The degree of automation is similar to DA2,
but system capabilities are now constrained by programmed or otherwise
defined limits. The limits are set to enable the system to detect when limits
are exceeded and to alert the operator in time before operator intervention
is required.
Sensemaking in Safety Critical and Complex Situations
At any point in time, an autonomous ship will have a number of active SCT
with different degree of automation and different timing requirements. Examples
are SCT related to navigation, energy production, and stability. This means that
the operator’s response deadline for the full system will be the minimum of the
individual T DL values for all active SCT and states. If a function FDL is defined to
determine T DL for a given state and condition, the s ystem-wide T DL can be defined
as in Eq. ( 14.4).
∀ ∈
c
c
j
j
c, ∃ ⊂
O
O
ˆ
ˆ
n
n
: ∈O ˆ
min
=
(
)
( )
(14.4)
ˆ
T DL
FDL O n , c
n
CONSTRAINED AUTONOMY
The concept of constrained autonomy for ships was proposed by Rødseth and
Nordahl ( 2017). Here, it was defined as the automation system having defined limits
to the options it can use to address these conditions, e.g. maximum deviation from
planned track or arrival time. The automation system needs to request assistance
from human operators if these constraints are exceeded. This definition was linked to
the concept of operational envelope in ( Rødseth 2019). The latter paper also defines
five degrees of automation:
• DA0 – Operator controlled: Limited automation and decision support is
available, as on most of today’s merchant ship. The human is always in
charge of operations and need to be present at controls and aware of the
situation at all times.
• DA1 – Automatic: More advanced automation, e.g. dynamic positioning,
automatic crossing or auto-berthing, is used. Crew attention is required to
handle problems such as object classification and collision avoidance. The
human may use own judgement as to how long he or she may be away from
the control position. For automated fjord crossing in good weather, little
traffic and in sheltered water, the operator may be away from the controls
for several minutes.
• DA2 – High automation: The degree of automation is higher than for
DA1 and may include certain "cognitive" functions, such as object detection and classification or collision avoidance. However, there are inherent
and unknown limits to the automation system’s capabilities.. These limits
are not defined or constrained ( see DA3), so the human operator must still
use his or her judgement as to the required attention level. However, it is
assumed that the need for attention is lower than for DA1.
• DA3 – Constrained autonomy: The degree of automation is similar to DA2,
but system capabilities are now constrained by programmed or otherwise
defined limits. The limits are set to enable the system to detect when limits
are exceeded and to alert the operator in time before operator intervention
is required.