Part B | 24.1
528 Part B Autonomous Ocean Vehicles, Subsystems and Control
ability, the effects of the operational environment, the
quality of the maintenance program, and the experience
and competence of the deployment team. Assessing this
risk requires a formal process that, in addition to providing a quantitative assessment, is transparent and able to
be followed and replicated by others.
In 2007, Griffiths and Trembanis [24.9] introduced
a risk management process tailored to the operation of
AUV. The approach was initially used for managing
AUV risk of loss [24.10]. Different stakeholders have
different interests in risk, for example, the AUVs owner
is interested in the safe recovery of the vehicle, whereas
a scientist is mostly interested in the recovery of data or
in the vehicles’ availability at a given time. The process
for AUV risk management can be applied for managing
other risks, not only the risk of loss. In this chapter, we
present a risk management process tailored to AOVs.
Different methods for assessing different risks are discussed in detail.
Most examples are given for propeller-based AUVs
but these are equally applied to vehicles using buoyancy change engines, typically denoted as gliders. We
also look at aspects of AUV design and deployment affecting risk.
24.1 Risk Management Process for Autonomous Ocean Vehicles
While aspects of reliability had featured within papers on the use of AOVs, reliability had been the topic
of very few specific studies until the mid-2000. The
provocative, anecdotal evidence in [24.11] gave rise to
discussions within the community of users on how to
improve reliability and reduce risk at a time when vehicle operations were just starting to be independent of
deploying vessels. Spurred by these considerations, and
especially by future requirements to operate under ice,
Griffiths et al. showed that simple statistical methods
could be applied to estimate risk of loss of autonomous
vehicles operating in various environments [24.12].
Subsequently, Podder et al. extended this approach to
look at reliability growth [24.13], which is the main desired outcome. However, these studies looked only at
revealed reliability, documenting what problems were
emerging; they were not set within a framework for risk
management.
The loss of the Autosub2 vehicle under the Fimbulisen in 2005, and the recommendations of a subsequent
board of inquiry led to the development of a holistic risk
management process for AUVs (Fig. 24.1) [24.9]. By
simple extension of differently described operating environments, it is applicable to the wider class of AOVs.
This remains the only published structured procedure
for risk management of these vehicles.
Taking the steps in sequence, first a responsible
owner is identified and they state an acceptable probability of loss for the campaign under consideration.
The owner may factor in the importance of the vehicle’s
mission, the value of the data it would return, the future program for the vehicle, and other considerations,
into the acceptable probability of loss. Independently,
the principal investigator, or user, sets out the requirements of the campaign in terms of number of missions,
their duration, and the environment characteristics, such
as surface or subsurface, coastal, open ocean, under ice,
or in areas of high traffic. The next step is for the technical team to assess the probability of loss in light of
the campaign just described. This is a difficult step, and
much of the remainder of this chapter is given over to
methods used to make this estimate.
Accepting for now that this estimate can be made, it
is then compared with the responsible owner’s acceptable risk. If the estimated risk of loss is less than the
owner is willing to accept, there is a need to demonstrate that the estimated risk is realistic before the
campaign can proceed. This demonstration could take
the form of reliability trials, where the vehicle would
be run in a benign environment over a duration or range
commensurate with the planned missions and the outcomes evaluated. If the estimated risk of loss is greater
than the owner’s acceptable risk, several feedback paths
are followed.
The first activity is to rank the risk factors identified by the analysis of fault history, or fault projections.
Those that can be mitigated, without question, are dealt
with. This demands that the causes of failure are fully
understood and the corrective measures are known, able
to be implemented, and tested, before the campaign.
Belief in ability to mitigate faults, or assertion alone,
is not sufficient.
In parallel, the user may reassess the missions required and the responsible owner may reassess the
acceptable risk, following which the test for acceptable
risk is repeated. Two or more iterations may be needed,
or indeed, the decision may be to postpone or cancel the
proposed campaign.
Primarily, this process has been used for campaigns
with a significant risk of vehicle loss in the Polar Regions. Brito et al. described its use for a campaign
of six Autosub3 missions under Pine Island Glacier,
Antarctica [24.10]. Here, the initial estimated risk was
sufficiently high that reliability-proving trials in a Nor-
528 Part B Autonomous Ocean Vehicles, Subsystems and Control
ability, the effects of the operational environment, the
quality of the maintenance program, and the experience
and competence of the deployment team. Assessing this
risk requires a formal process that, in addition to providing a quantitative assessment, is transparent and able to
be followed and replicated by others.
In 2007, Griffiths and Trembanis [24.9] introduced
a risk management process tailored to the operation of
AUV. The approach was initially used for managing
AUV risk of loss [24.10]. Different stakeholders have
different interests in risk, for example, the AUVs owner
is interested in the safe recovery of the vehicle, whereas
a scientist is mostly interested in the recovery of data or
in the vehicles’ availability at a given time. The process
for AUV risk management can be applied for managing
other risks, not only the risk of loss. In this chapter, we
present a risk management process tailored to AOVs.
Different methods for assessing different risks are discussed in detail.
Most examples are given for propeller-based AUVs
but these are equally applied to vehicles using buoyancy change engines, typically denoted as gliders. We
also look at aspects of AUV design and deployment affecting risk.
24.1 Risk Management Process for Autonomous Ocean Vehicles
While aspects of reliability had featured within papers on the use of AOVs, reliability had been the topic
of very few specific studies until the mid-2000. The
provocative, anecdotal evidence in [24.11] gave rise to
discussions within the community of users on how to
improve reliability and reduce risk at a time when vehicle operations were just starting to be independent of
deploying vessels. Spurred by these considerations, and
especially by future requirements to operate under ice,
Griffiths et al. showed that simple statistical methods
could be applied to estimate risk of loss of autonomous
vehicles operating in various environments [24.12].
Subsequently, Podder et al. extended this approach to
look at reliability growth [24.13], which is the main desired outcome. However, these studies looked only at
revealed reliability, documenting what problems were
emerging; they were not set within a framework for risk
management.
The loss of the Autosub2 vehicle under the Fimbulisen in 2005, and the recommendations of a subsequent
board of inquiry led to the development of a holistic risk
management process for AUVs (Fig. 24.1) [24.9]. By
simple extension of differently described operating environments, it is applicable to the wider class of AOVs.
This remains the only published structured procedure
for risk management of these vehicles.
Taking the steps in sequence, first a responsible
owner is identified and they state an acceptable probability of loss for the campaign under consideration.
The owner may factor in the importance of the vehicle’s
mission, the value of the data it would return, the future program for the vehicle, and other considerations,
into the acceptable probability of loss. Independently,
the principal investigator, or user, sets out the requirements of the campaign in terms of number of missions,
their duration, and the environment characteristics, such
as surface or subsurface, coastal, open ocean, under ice,
or in areas of high traffic. The next step is for the technical team to assess the probability of loss in light of
the campaign just described. This is a difficult step, and
much of the remainder of this chapter is given over to
methods used to make this estimate.
Accepting for now that this estimate can be made, it
is then compared with the responsible owner’s acceptable risk. If the estimated risk of loss is less than the
owner is willing to accept, there is a need to demonstrate that the estimated risk is realistic before the
campaign can proceed. This demonstration could take
the form of reliability trials, where the vehicle would
be run in a benign environment over a duration or range
commensurate with the planned missions and the outcomes evaluated. If the estimated risk of loss is greater
than the owner’s acceptable risk, several feedback paths
are followed.
The first activity is to rank the risk factors identified by the analysis of fault history, or fault projections.
Those that can be mitigated, without question, are dealt
with. This demands that the causes of failure are fully
understood and the corrective measures are known, able
to be implemented, and tested, before the campaign.
Belief in ability to mitigate faults, or assertion alone,
is not sufficient.
In parallel, the user may reassess the missions required and the responsible owner may reassess the
acceptable risk, following which the test for acceptable
risk is repeated. Two or more iterations may be needed,
or indeed, the decision may be to postpone or cancel the
proposed campaign.
Primarily, this process has been used for campaigns
with a significant risk of vehicle loss in the Polar Regions. Brito et al. described its use for a campaign
of six Autosub3 missions under Pine Island Glacier,
Antarctica [24.10]. Here, the initial estimated risk was
sufficiently high that reliability-proving trials in a Nor-