Towards the assessment of potential impact of unmanned vessels on maritime transportation safety

The prototypes of unmanned merchant vessels are expected to come into service within the coming years. The main line of argument supporting their introduction pertains to the increase in navigational safety, which is expected to be achieved by reducing the frequency of human-related accidents on board ships, by removing the crews. On the other hand, the response of unmanned ship to potential accidents is still uncertain. With enthusiasm on one side and apprehension on the other, the literature lacks an objective study on the e ﬀ ect of unmanned ships on safety of maritime transportation. This paper constitutes an attempt to bridge the aforementioned gap by applying a framework based on what-if analysis to a hundred maritime accident reports. The aim of the analysis is to assess whether the accident would have happened if the ship had been unmanned, and once the accident had happened - would its consequences have been di ﬀ erent. The results obtained reveal that the occurrence of navigational accidents (e.g. collision, grounding) can be expected to decrease with the development of unmanned ship. However the extent of consequences resulting particularly from non-navigational accidents (e.g. ﬁ re, ship loss due to structural failure) can be expected to be much larger for the unmanned ships when compared to the conventional ones.


Introduction
The concept of unmanned surface vehicle (USV) is not new. While its first demonstration was performed by Nikola Tesla in 1898 [1], the last decade of the 20th century has seen a large number of projects emerge. The vast majority of existing solutions pertain to the lawenforcement and naval units with displacement of up to 10 t [2], although some mine-sweepers can reach up to 100 t [3]. Due to technology advancements in recent years and experience gained in the operation of small-and medium-sized USVs, the aspiration appeared to develop an unmanned merchant vessel able to haul her cargo across the oceans. It is believed that the first unmanned ships will become operational within the next 10-15 years [4,5]. However, it must be ensured that those masterpieces of technology would indeed increase maritime safety or at least would not reduce it [6,7].
At present, there are several R & D projects aiming at the development of a proof of autonomous merchant vessels' concept [1,[8][9][10][11]. Therein a hypothetical autonomous ship takes advantage of her ability of being operated in one of the three modes, as follows: fully manned, remote controlled or fully autonomous. The latter corresponds to autonomy level 5 (AL5) according to Lloyd's Register scale, defined as follows: 'Unsupervised or rarely supervised operation where decisions are made and actioned by the system, i.e. impact is at the total ship level' [12]. She would traverse high seas autonomously with possibility of switching to remote control via satellite communication link in case the systems are unable to perform correctly in given circumstances or whenever a shore-based operator considers it necessary. Furthermore, a full complement of crew would embark prior to reaching the port of destination in order to perform mooring or any other demanding operations in a safe and efficient manner.
In the course of quantitative safety assessment of the unmanned bulk carrier concept carried out within MUNIN project [6,10] the authors claim that the unmanned ship can be expected to be safer than the conventional units despite acknowledging that they lack vital information pertaining to her design and operation [11]. Moreover, the majority of the hazards anticipated within that study are humanrelated and the effect of human absence on the development of the accident's aftermath does not appear to be properly accounted for. For instance, redundancy is claimed to be a primary means of reducing accident's consequences which can prove unfeasible in some cases like fire incidents where, as we conclude from our analysis, it would be extremely difficult to design a technical system capable of preventing or handling all the potential fire scenarios.
Furthermore, insurance companies are rather sceptical about the idea of unmanned ships. It is believed that it will take decades rather than years for the concept to become operational and legally acceptable, however it could offer an economically feasible alternative for short sea shipping, in a form of a convoy formation with manned vessels escorting and tracking the unmanned ships, [13].
From the scarce body of literature in the field of unmanned shipping it is evident that one of major issues related to the unmanned ship operations is their safety. The main line of argument supporting their introduction pertains to the increase in navigational safety. This is expected to be achieved by reducing the frequency of human-related accidents on board ships, simply by removing the crews. However, the crew will not be in fact completely removed but rather relocated to a remote command centre. This may create hazards that are yet to be identified. Furthermore, the response of unmanned ship to potential accidents is still uncertain. With enthusiasm on one side and apprehension on the other, the literature lacks scientific study on the effect of unmanned ships on the safety of maritime transportation.
To bridge this gap, or at least to reduce it, we made an attempt of applying a safety assessment framework based on what-if analysis over a hundred of maritime accident reports. The aim of the analysis was to assess whether the accident would have happened if the ship had been unmanned, and once it had -would its consequences have been different if there were no one on board to counteract them.
The assessment is based on the use of subjective two-step what-if analysis supported by Human Factors Analysis and Classification System for Marine Accidents (HFACS-MA) method and simple consequences check. Within such framework the available accident reports are studied with respect to the cause of an accident and its consequences. The first step was to assess whether the accidents were more (or less) likely to happen if the ship in question was unmanned (the question about the accident's likelihood). In the next step, given the accident did in fact occur, would the consequences be different (the question about the impact severity). To answer these two questions a qualitative scale is used as follows: 1) no influence, 2) occurrence or impact greater, 3) occurrence or impact lesser.
The obtained results show that if the unmanned ships are put into operation as per autonomy level 5, we may expect lower occurrence of typical, human-related maritime accidents, however there is no premise to expect the consequences of potential accident to be lower than observed nowadays. The assessment does not account for hazards that were not experienced in the shipping industry in the past, like cyberpiracy or terrorism [14]. If those appear, they may lead to devastating consequences significantly affecting the safety of navigation of unmanned ships and public perception of them.
The remainder of this paper is structured as follows: first materials and methods used in the assessment are introduced. Subsequently we present and discuss the obtained results as well as additional observa-tions based on the analysis. Finally the conclusions are drawn and recommendations for future studies are given.

Materials and methods
This section elaborates on the available data used for the assessment of the potential unmanned ships' impact on the safety of navigation. Also, methods applied are introduced here. Finally, the section demonstrates the application of the method on a selected accident report as a case study.

Accident reports
Due to ongoing discussion regarding the manner in which the unmanned vessels would actually be operated [15,16], we assume that unmanned ships will operate in autonomous mode during ocean passage until a certain point before a port approach where the shore operator will take over. 'Conn to operator' point can vary for different ports or voyages depending on expected traffic, complexity of environmental conditions etc. but it may be expected that ships' managers would like to operate them in autonomous mode as long as possible in order to exploit full advantage of autonomy and not involve additional costs. In order to accommodate this uncertainty, we assume that the ship in question would operate autonomously until the point in which the Master took conn in a real event. It is also acknowledged that future unmanned ships might be forced to stay at the anchorage due to, for example, berthing crew's embarkation inability in severe weather.
In the study presented here, we analysed 100 maritime accidents involving 119 vessels based on publicly available investigation reports. Based on anticipated operational practice of unmanned ships, we selected only the accidents that occurred during those parts of voyage that are most likely to become unmanned in the future. The accidents that occurred in the other parts of the voyage (e.g. harbour navigation) are considered irrelevant for this study unless no connection between voyage phase and accident circumstances could be identified. The breakdown of accidents' number by voyage phase in which it occurred and special conditions prevailing is given in Table 1.
The accidents reports were retrieved from the following organizations: Australia Transport Safety Bureau [17], Accident Investigation Board of Norway [18], Danish Maritime Authority [19], European Maritime Safety Agency [20], Isle of Man Ship Registry [21], Japan Transport Safety Bureau [22], Marine Accident Investigation Branch in UK [23], The Federal Bureau for Maritime Casualty Investigation in Germany [24], The Bahamas Maritime Authority [25], The Government of Hong Kong Special Administrative Region [26], Transport Safety Board of Canada [27]. The list of the accidents analysed and sources of data is given in the Table A1.
In the course of the analysed accidents, 63 lives have been lost and 28 people have been injured. The numbers include rescuers wounded or perished while assisting endangered seafarers. Three cases resulted in serious environmental damage. Types of vessels involved in the accidents are presented in Fig. 1. We have included cargo ships' accidents in our analysis as a majority and other ships' types (Ro-Ro Table 1 The breakdown of accidents' number by voyage phase in which they occurred.

Methods
The available body of scientific literature lacks a method assessing an influence of lack of the crew on board on vessel's safety in an emergency. Therefore, we attempt to qualitatively assess such an influence based on the analysis of conditions and circumstances prevailing in time of casualty, accident's causes together with crew's actions in response to the emergency and other factors, if applicable.
Although the concepts of unmanned merchant vessels are still under development, high-level anticipation of their future design and performance is available, see for example [6,10,28,29]. This background knowledge was utilized in our preliminary assessment of the unmanned vessels' impact on maritime safety.

Framework for safety analysis of unmanned ships
In order to answer the question of whether the introduction of unmanned vessels will increase an overall safety of marine transportation, we adopt a framework of what-if analysis [30] augmented by Human Factors Analysis and Classification System for Marine Accidents (HFACS-MA) and a simple consequences check. We paid particular attention to the two following aspects: 1. If the ship were unmanned, how would that fact affect the likelihood of particular accident? 2. If the accident occurred anyway, would its consequences be more or less serious if there were no crew on board?
To this end we reviewed one hundred maritime accident investigation reports. Those were prepared and published by national marine safety agencies, bodies that use the best knowledge and experience of their members and contributing experts. Vast majority of the reports included sections of event's time outline, involved ships' details, and actions taken by the crew before, during and after the accident, its causes and consequences.
We divided each of the accidents into two stages: prior to the accident and post-accidental. Then, the former is studied with respect to its two aspects: the root causes and direct causes. For the purpose of the analysis, we define root causes as event or conditions leading to the direct causes, which in turn are pivoting points in incidents' development after which little, if anything, can be done to avoid the accident. The post-accident stage encompasses the following phases: situation assessment, decision-making and damage control, as described in Fig. 2.
For the purpose of the analysis we made the following assumptions: 1. the control systems of a hypothetical vessel would be designed to properly handle majority of conditions that can occur during normal operation of the ship, detect unexpected situations in ample time and operate under remote control. 2. the vessel is operated in AL5 mode until the system detects a situation in which shore-based operator's intervention is requiredan event corresponding to a present situation where ship's nautical officer calls for master's assistance or fire/general alarm activates automatically.
Some consequences of somewhat idealistic first assumption are further discussed in Section 2.2.2.  For the evaluation of the accident's causes we applied HFACS-MA as originally presented in [31]. Generic HFACS is based on Reason's Swiss Cheese theory [32] and was initially developed for studying the contribution of human elements to military aviation accidents but was further developed by various scholars to include other causal factors. Its success in detecting the contributing failures and in the accident analysis made it popular among accident investigators from various fields including aviation, railroad and shipping [33]. According to HFACS-MA the accident's causes are divided into 21 causal categories grouped in 5 levels: External Factors, Organisational Influences, Unsafe Supervision, Preconditions and Unsafe Acts. The causes belonging to a particular category can be either a result of a factor located on the upper level or can occur independently, eventually leading to an accident. For the description of the method see Fig. 3 and Table 2. When reviewing factual data regarding the event in question, its causal factors are identified and inventoried. Then, those are assigned to a causal category in accordance with HFACS-MA taxonomy.
Subsequently we assigned HFASC-MA causal categories an impact each of them would have on unmanned ships' safety performance, as indicated in Table 2.
For instance, 'Hardware' faults would increase unmanned vessel's likelihood of getting involved in an accident due to maintenancerelated challenges, inability of manual adjustments or operation of mechanisms etc. On the other hand, 'Planned Inappropriate Operation' would be less likely to affect negatively the safety of unmanned vessels since, for example, passage planning can be performed and verified at various stages by numerous actors including vessel's own control system and shore-based operators. This allows examining qualitatively which causal category had the largest impact on accident's occurrence. We did not focus on the relationships between the causal categories and levels but instead we analysed their relevance to unmanned shipping.
Finally, we reviewed the accidents reports and identified their causal factors, in accordance with the two assumptions listed in Section 2.2.1. The identified causal factors were then assigned to causal categories and based on that, relevance of each causal factor for hypothetical unmanned ship's accident likelihood was qualitatively assessed. Whenever there were contradictory findings, we assigned the final value based on direct cause's causal category. For inconclusive results, 'neutral' influence was assigned.

2.2.1.2.
Consequences of an accident. The analysis of accident's consequences was based on a simple check of the way in which the aftermath of maritime casualty impacted people. We assigned the value of 'consequences greater for unmanned ships' whenever at least one of the following outcome factors was identified in an accident report.
• crew had to directly intervene by either inspecting ship's enclosed spaces or manually reconfiguring its sub-systems; • crew had to cooperate with other actors under pressure of time; • crew was obligated to assist other seafarers should the vessel they collided with need to be abandoned; • decisions on further actions could not be efficiently taken from remote command post; • better maintenance of on board equipment before accident could have limited its outcome.
We assigned the value of 'consequences lesser for unmanned ships' whenever an accident report mentioned fatalities, serious injury or it was evident that humans' presence on board during an accident Table 2 Brief description of HFACS-MA causal categories applied in this study [34][35][36][37][38], adopted from [31]. restricted number of possible options of counteracting the effects of accident (e.g. when a person was missing in muster station and so CO 2 could not be released). Should the circumstances of 'greater' and 'lesser' outcome occur simultaneously, the value was assigned based on more detailed analysis regarding which of them would be more relevant, with potential for avoiding fatalities greatly lowering the hypothetical consequences.
Whenever neither 'greater' nor 'lesser' outcome factors could be identified, the event was considered neutral, meaning it is not expected to influence the future unmanned ship's accident's outcome.

Uncertainty assessment
Various issues related to uncertainty in analysing accident reports as well as the systems' performance itself along with risk and safety assessment of transportation systems and individual ships have been discussed in the literature, see for example [33,[39][40][41][42][43][44]. Those include among others: subjectivity, hindsight bias and lack of knowledge of investigator or analyst, possible overlooking of key factors and linguistic problems. Moreover, the approach presented here contains another dimension of uncertainty, which relates to very limited background knowledge on the design of unmanned ships and their operation. These are based on the state of the art results as reported in [6,10,28].
Further uncertainty may be related to inadequate assignment of causal factors to causal categories in HFACS-MA method or wrong statement of what impact the particular causal category would have on unmanned ships' likelihood to be involved in an accident. Consequences check, in turn, may be inaccurate in some particularly complicated cases and may promote assigning unmanned ships' accidents with greater consequences. In the framework applied, accidents' outcome for unmanned ships can only be lowered if there were fatalities, serious injuries or crewmembers' presence restricted possible damage control options in a real event. Meanwhile, 'greater consequences' can be assigned more readily as outcome factors leading to such a conclusion are more complex and multiform.
Knowing all the restraints associated with investigation reports' analysis, we estimate that approximately 30% of the results obtained can be assigned a low level of uncertainty, meaning that the causes of the accidents and their aftermaths are relatively easy to define based on the reports, the answers to what-if questions are straightforward, and the direction of the influence is unequivocal.
However, 10% of the results obtained in the course of this analysis can be labelled with high uncertainty, meaning that the accident reports are very complex -clear definition of the five stages of the accidents as depicted in Fig. 2 is a problematic task and the what-if questions cannot be given unambiguous answers, thus making the direction of the influence vague, see for example [39,45]. This includes three cases in which investigators failed to reveal an actual cause of an accident and therefore based the assessment on circumstantial evidence.
The remaining 60% of analysis' results can be characterized by medium level of analysis' uncertainty, which reflects the conditions between those characterizing low and high uncertainty.
Moreover, types of accidents analysed here do not closely reflect their share in global casualties' statistics (see Figs. 4 and 5 respectively). This is attributed to the fact that some investigation reports are not available, have been prepared in local languages or do not meet requirements of this researchpertain to groundings during berthing or in narrow channels, for instance. As depicted in Fig. 4, majority of accidents analysed here was navigation-related with groundings and collisions constituting 52% of the total amount while those constituted as much as 73% globally. The accidents consisting solely of cargo damage were not included in the investigation reports unless dangerous goods were involved. This is due to the fact that as long as cargo is not dangerous, the consequences of an accident are in most cases purely commercial and need not to be investigated by governmental institutions but rather by insurance companies. Loss of property sustained in such disasters can be, however, significant.

Application of a framework to a case study
This section demonstrates the application of the safety assessment framework to an accident of fire on board of m/v "Charlotte Maersk" that took place on 7th July 2010.
At the time of the accident, "Charlotte Maersk" was en route from Port Klang, Malaysia to Salalah, Oman. She was a 9 years old container vessel, flying Danish flag and carrying various containerised cargoes. Three hours into the voyage, smoke was observed rising from a forward part of the ship. Fire alarm has been activated and crew engaged in firefighting. The fire has been considered under control not sooner than after 24 h of joint efforts of crew, support ships and firefighting aeroplane. For the next 13 days, the vessel was manned by extra firefighters to prevent fire's re-occurrence as she was proceeding to her original port of destination. Damage sustained included heat deformation of the hull and loss of approximately 160 containers together with cargo inside them. One crewmember suffered respiratory problems from inhaling smoke. A certificate of commendation has been awarded by IMO to ship's crew for their acts of bravery during the firefighting operation.
An investigation report by Danish Maritime Accident Investigation Board concluded that the fire was most likely caused by explosion of methyl ethyl ketone peroxide (MEKP, IMO class 5.2, UN number 3105). This cargo was proved to have been stowed improperly, however  in full compliance with regulations applicable at that time. Those were amended only after the incident. MEKP exploded after receiving excessive amount of heat from sunlight in the hot and humid climate of the Malaysian Peninsula. Since it did not require stowage in refrigerated containers at that time, neither the crew nor any other party had reasons to decline accepting it on board. Immediately after the fire was detected, the ship was headed out of the shipping lane. Contingency planning was engaged aiming at minimalizing losses, particularly not allowing the fire to reach other containers filled with dangerous goods. The entire crew was involved in either rigging the fire hoses, directing water on the most vital spots, or assessing the fire spread and releasing carbon dioxide into the cargo holds directly below it. Firefighting continued for a couple of days, during which time some containers had to be opened to extinguish minor fires inside them.
The accident was analysed as follows. Firstly, it was divided into stages of prior to-and post-accident. Secondly, its causal factors were identified, namely improper but legally acceptable way of shipping MEPK in hot climate. Next, it was assessed whether the fact that ship was to be operated in remote or autonomous mode could have had some influence on likelihood of factors' leading to the accident occurrence by identifying HFACS-MA causal categories involved. Those were as follows: 'Planned Inappropriate Operation', and 'Legislation Gaps'. Neither of those was found to be particularly specific for unmanned vessels. All actions leading to accepting the container for shipping and stowing it in its slot were in compliance with all existing regulations and good seamanship.
It must be noted that even if dangerous goods are to be legally banned from transportation by autonomous ships, they might still be carried without official reporting. Undeclared, containerised dangerous cargoes constitute a problem even nowadays and have been a contributory factor in several maritime accidents, see for example [47]. Therefore, safety issues related to it must be considered regardless of future regulations governing their carriage.
The next step was to determine the importance of the crew's actions in response to the accident and to analyse what would happen if the vessel was operating without crew on boardanother instance of what-if analysis.
With reference to the check described in Section 2.2.1.2. it was found that the crew had to assess the damage locally, enter enclosed spaces (containers) and re-arrange the fire system by rigging the fire hoses to spaces with indirect access. Coordination with shore services was also required. It was therefore concluded that the test was in favour of assigning the accident with greater consequences should the vessel be unmanned.
Finally, feasibility of designing an autonomous system which could act on reducing the likelihood or outcome of the accident without direct involvement of humans was examined as an additional consideration. In relation to accident's causes, no changes in ship's design or operation could prevent it except for the amendment of international laws or shipping company's procedures. As for the consequences, designing such a system would be a non-trivial task involving providing a vessel with complex firefighting system capable of providing boundary cooling of various spaces, means of inspecting enclosed spaces etc.
Chain of events during "Charlotte Maersk" accident and its analysis are presented in Table 3.
As can be deduced from the case study, analysis framework described in Section 2.2.1. can be applied to estimate qualitatively the impact unmanning ships would have on accidents' likelihood and consequences and thus on the overall level of maritime safety. This is done in the following section. Uncertainties do exist, although they can be deemed manageable.

Results
This section presents the results of one hundred maritime acci-dents' analysis using the framework presented in earlier sections. The results are divided into the influence of unmanned ships on the likelihood and consequences of accidents. Breakdown of particular accidents' analysis results is given in Table A2 in the appendix.

The effect of unmanned ships on the likelihood of the accidents
The results of the qualitative analysis of the influence of unmanned system on accident's likelihood are presented in Fig. 6. It was found that the cases in which likelihood would be lesser outnumber those with greater one about three times (47 to 16%). The former have been largely resulted from a human error. The cases in which likelihood of accident would be greater can be attributed to lack of bridge team's situational awareness or inadequate maintenance or supervision of mechanisms. The issues concerning those factors can be found in the literature, see for example [29,48]. In the following subsections the impact of unmanned vessels on their likelihood is outlined for particular types of accidents.

Grounding
Introduction of unmanned ships might result in a significant decrease in the number of grounding events. In the accident reports analysed, twenty-four out of thirty-three grounding cases resulted from nautical officers being either distracted from their duties, following improper passage plan or other factors theoretically possible to eliminate by computerization [28]. The two cases of greater likelihood for unmanned vessels were a result of improper assessment of weather conditions and dragging anchor while drifting offshore might have been a better choice. The remaining seven neutral cases were mostly caused by the use of improper or out-dated chartscircumstances of particular events led to conclusion that it could happen to manned as well as unmanned vessels. Although seven groundings occurred under wind force of Beaufort 5 or more and two other during restricted visibility, it was found that only in one case would the weather conditions cause the likelihood of unmanned vessel's accident to increase.

Collision
The introduction of unmanned ships could enable avoiding sixteen of nineteen cases of collisions that were analysed. However, since many collisions occur due to bridge team's non-compliance with COLREG Rule 5: "Look-out", special attention must be paid to future system's capability of detecting another ship or navigational danger in due time and properly assessing the situation arising, along with appropriate action planning and execution. As per COLREG, detection by radar would not suffice and more means of observation shall be employed [49]. On the other hand, nine of the hereby-analysed collisions occurred during restricted visibility conditions where radar is now the only means of look-out. For the future solutions some other supporting means of object detection could be anticipated, such as infra-red cameras.
The breakdown of the likelihood of accident with regard to phase of voyage for casualty types to which it was considered relevantgrounding and collisionis presented in Table 4. As can be seen, the vast majority of such accidents occurred in coastal waters, which is obvious for grounding incidents and natural for collisions as they generally happen in areas of increased traffic concentration near ports.

Fire/explosion
Eleven out of twenty-four cases were mostly a result of cargo selfheating or similar factors. Six cases in which the likelihood would be lesser for unmanned ships were caused by crews themselves directly contributing to fire's occurrence by regrettable disregard to fire safety precautions and procedures. The remaining seven cases came as a result of technical failures due to insufficient maintenance, an issue to which unmanned ships may be particularly vulnerable.

Flooding
Three cases in which the probability would be greater for unmanned ship involved a vessel not being prepared for navigating in the ice or where maintenance of seawater pipelines was insufficient. On the contrary, one case related to crew not being familiar with ship's equipment, which would present lower likelihood in case of unmanned ship. Further five neutral cases happened mostly due to corroded pipelines or improper design of on board systems.

Loss of stability, structural integrity and buoyancy
For nine cases of those casualties combined, it would be irrelevant whether the ship were manned or not -those resulted from e.g. cargo liquefaction or improper stowage. Two cases in which the unmanned ships would be more likely to suffer from loss of stability involved their crews failing to control the vessel properly in a heavy weather conditions, which is an issue unmanned ships can also be vulnerable to. Even today, it is generally discouraged to use an autopilot in a heavy weather [50].

Damage to cargo
In all four cases analysed, no apparent relationship between manning and accident's likelihood could be found. Those were a result of adverse weather conditions or cargo stowed not as per good practice.
It is worth mentioning that in many cases, the safety barriers should have been in place as required by SOLAS convention or company regulations but those have been overridden due to bad practice or design misconception, see [51]. For instance, in the majority of cases neither of the counter-measures against fatigued nautical officer (presence of look-out duty seaman, Bridge Navigational Watch Alarm System) fulfilled its role at the time it was designed and implemented to operate. This highlights the importance of applying a systemic approach to the design of unmanned ship and the operational environment she is anticipated to work within [52].
The results of the analysis suggest that the introduction of unmanned ships can reduce the likelihood of some types of accidents such as grounding or collisions. However, it must be noted that the system is expected to be assisted by a shore-based operator in particularly demanding situations. This operator would, when prompted, take over control of each of ship's subsystems in order to Table 3 "Charlotte Maersk" accident with safety analysis framework applied [19,30].  6. Influence of unmanned system on accident's likelihood. Table 4 Direction of change of the accident's likelihoods for unmanned vessel for grounding and collision in particular phases of voyage, compared to conventional ships.

Changes in the likelihood of grounding
Changes in the likelihood of collision

Increased Decreased Neutral Increased Decreased Neutral
Pilotage resolve the problem, which means that the possibility of human error is not eliminated, but rather transferred to a control centre some hundreds of miles away [53]. Therefore, the likelihood can easily be magnified by the operator's lack of situational awareness, inability to properly assess data provided by multiple sensors and insufficient perception of actual hydro-meteorological conditions along with their influence on ship's behaviour [54]. Some issues of data misinterpretation by unmanned vehicle's operators are well-known to military personnel involved in airborne drone operations [55], therefore such hazard needs to be anticipated at the planning stage of the unmanned ships operations.

The effect of unmanned ships on the consequences of the accidents
The results of applying safety analysis framework with respect to potential consequences of accidents involving unmanned ship are presented in Fig. 7. In the course of the analysis it was evaluated how strongly the accident's outcome depended on crewmembers' presence on board in three phases of consequence mitigation, namely: situation assessment, decision-making and damage control, as depicted in Fig. 2. On the other hand, we acknowledge that the greatest advantage of introducing unmanned vessels would be elimination of fatalities, since no crewmember would be exposed to hazards on board a ship in danger. In the following sections we discuss the factors influencing the extent of damage in each of the accidents' categories.

Grounding
In fourteen of thirty-three vessels running aground the capability of successful self re-floating remained after the grounding. Such an action is theoretically possible to be performed remotely, provided that proper depth assessment around the hull is performed along with i.e. visual check of hull's integrity and sounding the tanks. One case involved ingress of water through pipe tunnel manhole, which would normally be closed if the vessel were unmanned. In further eighteen cases, vessels required shore parties' assistance, which means that a full-scale operation involving the concerned vessel's crew was needed.

Fire/explosion
Sixteen of the twenty-four analysed cases would have resulted in greater damage to the ship and cargo due to fire. In original cases, the crew's actions included boundary cooling, fighting fires in spaces where CO 2 release could not be used for various reasons and controlling residual fire after CO 2 release. In three cases, the fire was so extensive that it would consume the vessel regardless of her operational mode. Five further cases in which lack of crew on board might be beneficial were those in which crewmembers perished or could not be accounted for in critical moments, which in turn led to delaying CO 2 release.

Collision
In eleven of nineteen cases it would have been irrelevant if there were crews on board any of the ships as neither of those sustained great damage and both continued with passage after implementing standard contingency procedures. However, in eight cases the damage was significant or of such complicated nature that shore parties' assistance was required or one of the ships must have been evacuated and survivors picked up by another vessel. It should be noted that the latter case is of great importance and an issue of providing the unmanned ships with capability of picking up survivors must be considered. Furthermore, ensuring efficiency of global Search and Rescue system in a transition period when unmanned ships would coexist with manned ones must be addressed. Since not only cargo vessels carry people on board but also cruise ships, recreation yachts and fishing boats, that period will most likely never end.

Flooding
Six of nine cases would have involved greater damage than in fully manned operations. Those included necessity of rearranging the pipelines or crews discovering a problem when all the sensors failed to do so. Two cases with lesser consequences for unmanned ships consisted in crewmembers taking improper actions in response to accident due to for example stress. The remaining case was a result of an irreparable malfunction that could not be handled neither manually nor remotely.

Loss of stability, structural integrity and buoyancy
In five out of eleven cases of those casualties combined, the mode of vessel's operation would be irrelevant to the course of action. Those were mainly when the extent of damage was so great or the rapidity of events was such that nothing could have been done to minimize it. In four further cases the consequences could be lesser for unmanned vessels as human lives would be spared.

Damage to cargo
Three cases of accidents involving dangerous cargo were of such nature that no action could have been undertaken due to cargoes' properties or type of damage. One further case was an incident when the crew was able to take corrective action only because an odour was detected.

Discussion
By applying safety analysis framework to a hundred maritime accidents, we were able to provide arguments in favour of a statement that unmanned vessels would perform better in reducing likelihood of accidents than mitigating its consequences -see Fig. 8. Introducing autonomy and removing crews from vessels can result in a reduction of accidents' probability; especially in events in which humans' actions  had a direct impact on its occurrence. That is the case particularly for navigation-related accidents like groundings or collisions involving crewmembers' lack of situational awareness, disregard for COLREG or negligence. Unmanned vessels might minimize chances of such occurrences provided that the system as a whole is properly designed and operated, and the systemic approach to safety is applied [52].
Due to the restriction of methods applied and the limitation in the background knowledge, we were not able to assess the role that crewmembers actually had in preventing accidents as we only considered accidents that did happen and were investigated. Unfortunately, potentially valuable data on events in which crew's actions prevented a near-miss from turning into disaster are not publicly available. Crew's actions in the immediate aftermath of an accident can be highly beneficial for restricting its consequences. Maritime accidents' chain of events as well as an outcome can vary strongly from one case to anothermany of them include radical changes in system's layout or capabilities of survival. Only an experienced, well-trained and organised crew can use those features as assets and act accordingly with full situational awareness. Thus, when speaking of accidents' consequencesbetter results can be expected if humans are actually involved and behave proactively. Designers of unmanned vessels will need to address this issue by taking each and every effort to ensure proper level of resilience to their product, [56][57][58][59].
In ten cases, both likelihood and consequences of the accident would be greater if the vessel were operated without crew. Nine of them were fires or mechanical breakdowns and the remaining one was of particularly complicated nature where two ships collided and one's crew had to abandon her. Should the other vessel be unmanned, her ability to pick up the survivors might be very limited.
It must be underlined, however, that the analysis has been performed basing on rather limited information regarding concepts of future unmanned ships and the ways they will be operated. This may have an effect of serious uncertainties affecting the result of future systems' performance. Since most scholars paid their attention to navigational aspects of unmanned shipping to date [1,6,28], unmanned ships' behaviour in the case of actual non-navigational accident remains terra incognita and demands further investigation. Nevertheless, the results of our analysis indicate that ensuring proper post-accidents behaviour of unmanned ships will be particularly vital to their overall safety.
For hundreds of years, the shipping industry relied on seafarers having served years at sea and gaining experience. Even today, period of one's service is considered to be one of the most important factors when investigating maritime accident and special attention is paid to Master's, chief engineer's and other relevant crewmembers' experience and certificates held. The more experienced the person is, the more likely he or she is to have a better understanding of his/her working environment and take proper actions in extraordinary circumstances. The introduction of unmanned vessels will most likely reduce this effect even if maritime experts are gathered in a situation room ashore in order to control damage sustained by the vessel in some distant part of the worldthey might not be capable of properly assessing the situation and by that they might be forced to make decisions based on incomplete data [29,54]. Lack of situational awareness attributes for approximately 71% of human errors [60]. One may be surrounded by numerous displays yet still be unable to make proper decisions due to information overflow, bad prioritization of tasks or lack of actual perception of the situation [52,61,62]. Only a skilled crew can experience such. Providing shore based operators with artificial situational awareness might be insufficient for planning and executing required actions in a safe and efficient manner [63]. Over-reliance on sensors indications may also be an important issue [64].
A study on safety of Unmanned Aerial Vehicles (UAVs) indicates that human factor remains one of the most common causes of accidents involving aerial drones [65]. Similar conclusions also come from experience with the operation of Autonomous Underwater Vehicles (AUVs) - [66] indicating that human errors will exist in unmanned systems' operations at least as long as people are involved in either the design or the operations themselves, in other words: forever. Additionally the analysis performed here suggests that at least 60% of disasters have been caused by human errors on various stages of the ship's life ranging from design process through loading operation and sea passage. There is a great potential for improvement, which can involve unmanned ships, provided that they are properly designed and operated.
System's operators would not be able to take some actions requiring direct human interference. Therefore, the design of safety features for the whole unmanned vessel must be such that a single failure does propagate or at least that such propagation is delayed as it has been accomplished in multiple examples of class 2 and 3 dynamic positioning (DP) systems [67].
It would be extremely optimistic to assume that unmanned ships will avoid all potential threats thanks to their perfect design and performance. It is acknowledged that at some point a disaster might occur in some distant part of the world without any salvors being able to render assistance in proper time. It is therefore of the highest importance to design an unmanned ship in such a way that she would withstand a serious damage to her hull, machinery and control system. It may be also necessary for her to serve as a lifeboat for any survivors from other vessels she could potentially collide with. Examples taken from other modes of transportation in which unmanned systems had been successfully implemented, i.e. automotive, airborne, metropolitan subway or even subsea, prove that autonomous vehicles can be operated safely, provided that the system is properly designed, relevant hazards are properly anticipated and the lessons from the past are properly learned, [68][69][70]. To achieve this goal, it could be beneficial to adopt resilience engineering way of thinking when designing unmanned ships and their operational patterns, see for example [56][57][58][59]71].

Conclusions
This paper presents qualitative analysis of 100 maritime accident reports. The aim of the research was to assess whether the introduction of unmanned ships would change the occurrence rate of accidents as well as their consequences. The analysis was limited to safety hazardsall the intentional actions aiming to compromise ship's security (piracy, terrorism, etc.) are not accounted for. For that reasons the presented analysis is by no means complete. Moreover, the limited amount of available information about the system where the unmanned ships are anticipated to operate does not allow for any detailed nor quantitative results. Another issue affecting results' credibility is the fact that no method of evaluating unmanned vessels' safety exists to date and framework applied here, which is sound for manned ships, might be inaccurate or incomplete for the unmanned vessels. Therefore, the research results should be rather seen as first insight into the problem and an introduction to further discussion.
The obtained results supported by the available literature indicate that the introduction of unmanned vessels will be very challenging from the safety point of view. The results show on one hand that the damage assessment and control is likely to be one of the biggest difficulties in achieving unmanned vessels' safety. Separating humans from all the dangers associated with working at sea will be opposed by a disturbing thought that there will be nobody on the scene of the accident to counteract the damage immediately. Preventing accidents from occurring appears therefore to be a better idea than counteracting its consequences. Actions aiming at reducing the occurrence of accidents must be implemented at early stages of system's design and combined with well-prepared operational procedures. On the other hand, however, implementation of unmanned ships might reduce the number of navigation-related accidents like collisions or groundings.
The reduction of risks to human life is one of the industry's top priorities. Apart from major economic benefits of eliminating crewing costs, the greatest advantage of implementing unmanned ships would be the lesser likelihood of seafarers perishing at sea. It can be seen when investigating potential consequences of fire, flooding and loss of stability accidents. Even though the vessel eventually founders, no human is harmed for nobody was on board in a first place. However, the potential consequences of maritime disaster can be massive and may include damage not only to the vessel itself, but also to her cargo, environment, infrastructure and people that happen to be nearby even unintentionallytheir safety must be ensured as well. On the other hand, immediate post-accident actions are vital to reducing the spread of consequences. It is commonly very difficult for even experienced Masters and crews to properly assess the damage and take proper actions to counteract its propagation. Those actions may include visual assessment of confined spaces, manual rearrangement of the system's components, boundary cooling or manual start of machinery.
Nevertheless, the introduction of the unmanned merchant vessels to the global shipping industry appears to be only a matter of time, despite all social, legal and technological concerns.
To obtain a complete picture of unmanned vessels' safety, the actual operational conditions of those ships shall be known. This in turn must be supported by knowledge of their design and manner in which they respond to accidents. On top of that, all anticipated hazards must be listed and their effect evaluated. Only then the level of safety associated with the unmanned ships operations could be assessed. The piece of study presented in this paper is just a first step in this long process.  Results of safety assessment. Numbers in left-most column refer to specific accident, as listed in Table A1.
(continued on next page)