JP7712656B2 - Method for operating an autonomous ship, method for risk analysis, operation system, and risk analysis system - Google Patents

Description

Article 30, paragraph 2 of the Patent Act applies. 1. Published on May 18, 2020, on the website of the Japan Society of Naval Architects and Ocean Engineers, as Proceedings of the Japan Society of Naval Architects and Ocean Engineers Conference, Vol. 30, pages 393-396. 2. Published on July 29, 2020, on the website of the National Maritime Research Institute, as the manuscript for Poster Session 1 at the 20th Research Presentation Meeting.

The present invention relates to an operation method and operation system for an autonomous ship operated according to a navigation plan, and a risk analysis method and risk analysis system for an autonomous ship that models an autonomous ship operated according to a navigation plan and analyzes operational risks.

Technological development for the practical application of autonomous ships is still in its infancy, and when constructing a large-scale, complex overall system such as an autonomous ship, it is believed that the conceptual design of the operation method of the autonomous ship and the individual systems that will realize it will be crucial in the early design stage. By checking for any significant hazards in operation and in the concept of the overall system in the early design stage, it will be possible to avoid reworking in the detailed design stage of the individual systems thereafter.
Similar thinking can also be seen in automobiles and other large-scale, complex systems, and systems-theoretic approaches such as STAMP/STPA (Systems-Theoretic Accident Model and Processes/System-Theoretic Process Analysis) have been proposed as methods for analyzing risk by treating a collection of various elements such as hardware, software, and humans as a single overall system.
When conducting risk analysis of autonomous ships, the main differences from existing ships should be considered. In autonomous ships, software that takes over and assists in ship action planning and control, which was previously performed by human crew on existing ships, will be introduced, and the weight of software tasks in ship operation will increase. Compared to hardware, software is expected to have more complex interactions with humans, so it is important to consider human factors such as human error that may occur when an automated system is introduced. In addition, when remote monitoring and control of autonomous ships from a land-based control center are assumed, all of the differences from existing ships will be in the hardware of the land-based control center, such as the building and equipment, the software for monitoring, control, and ship-to-land communication, and the staff in charge.
In risk analysis for existing ships, hazards were identified by focusing on equipment failures using a system configuration diagram centered on hardware. However, because autonomous ships have differences from existing ships as described above, in order to comprehensively identify hazards for the entire system of autonomous ships, it is necessary to clearly define the tasks handled by each component of the overall system, such as hardware, software, and humans, as well as the exchange of information between components and processes that require human approval.
STAMP/STPA is an analysis method that focuses on the interactions between components and is thought to be suitable for risk analysis in the early stages of designing autonomous ships, but it provides relatively little support for analyzing hazards related to the information held by each component or its internal functions.

Here, Patent Document 1 discloses a software design requirement extraction support method capable of reflecting various non-functional requirements as the basis of design in a design, and a software design requirement determination support method capable of classifying and organizing the extracted design requirements and efficiently determining the design requirements to be adopted. In Patent Document 1, requirements from a customer or the like are classified into functional requirement items and non-functional requirement items and input and recorded, risk items are extracted and recorded for each combination of functional requirement items and architecture characteristic items, all non-functional requirement items are individually compared for each risk item, possibility, tolerance, and countermeasures are extracted and recorded, the countermeasures are classified and organized, important and unimportant countermeasures at the present time are extracted and recorded, the relationships between the important countermeasures are extracted and recorded, and the countermeasures to be adopted are determined.
Patent Document 2 discloses a driving support device having an environment detection unit, a list generation unit, a gaze detection unit, a risk assessment unit, and an output control unit. The environment detection unit detects the environment around a vehicle driven by a driver, the list generation unit generates a hazard list of objects to be hazards based on the detected environment, the gaze detection unit detects the driver's gaze, the risk assessment unit evaluates the risk of the driver's driving for each object included in the hazard list based on the frequency with which the object included in the hazard list is included in the field of view of the driver based on the detected gaze, and the output control unit outputs driving support information corresponding to objects whose assessed risk is equal to or exceeds a threshold.
Furthermore, Patent Document 3 discloses an accident risk diagnosis device that stores driving data, which is data indicating the driving conditions of each of a plurality of vehicles at each date and time, and information regarding past accidents of the plurality of vehicles, extracts from the driving data driving data for a predetermined period before the day of the accident and driving data on the day of the accident, generates training data for each trip, which is the period from the start to the end of the vehicle, based on the extracted driving data, generates an accident risk diagnosis model, which is a machine learning model that diagnoses the accident risk using the training data, inputs feature amounts in the trip of a vehicle that is to be diagnosed for accident risk into the accident risk diagnosis model, diagnoses the accident risk, and transmits the diagnosis results to an on-board unit installed in the vehicle.
Patent Document 4 also discloses a vehicle control system that controls a vehicle equipped with multiple external sensors that acquire external information, multiple vehicle sensors that acquire vehicle information, and map information, and that this vehicle control system includes a definition module that defines a static ODD (Operational Design Domain) based on the vehicle information and the map information and a dynamic ODD based on the external information, and a control module that controls the operation of the vehicle based on the static ODD and dynamic ODD.
Furthermore, Non-Patent Document 1 discloses a case of model-driven development of an airship autonavigation system in which FMEA (Failure Mode and Effects Analysis), a method for analyzing system reliability, is applied to the hardware and software of the airship autonavigation system in the development of the airship autonavigation system using SysML (Systems Modeling Language), a modeling language that extends UML (Unified Modeling Language), to predict possible failures in the airship autonavigation system and identify exceptions that should be considered. It also discloses that brainstorming is conducted with 2 to 4 people when implementing FMEA to prevent oversight of failures.

JP 2003-256205 A International Publication No. 2018/220774 JP 2021-12604 A JP 2021-43896 A

Satoshi Fukuda and 9 others, "Model-Driven Development Using SysML for Airship Autonavigation System Development", Proceedings of the Embedded Systems Symposium 2011, Information Processing Society of Japan, October 20, 2011, pp. 14-1 to 14-8

Patent Documents 1 to 4 and Non-Patent Document 1 do not attempt to operate an autonomous ship by conducting risk analysis, taking into consideration the tasks handled by each component of the overall system, such as hardware, software, and humans, the exchange of information between the components, and processes that require human approval.
Therefore, an object of the present invention is to provide an operation method and operation system for an autonomous ship that can reduce risk and operate the autonomous ship appropriately, as well as a risk analysis method and risk analysis system for an autonomous ship that can appropriately perform risk analysis regarding the autonomous ship.

A method for operating an automatically operated ship corresponding to the method described in claim 1 is a method for operating an automatically operated ship which is operated according to a navigation plan, characterized in that it includes the steps of: an automatic navigation system acquiring the navigation plan; a step of setting a navigation design area in which the automatic navigation system operates normally in a navigation design area confirmation means; a step of an own ship information acquisition means acquiring own ship information of the automatically operated ship; a step of a surrounding information acquisition means acquiring surrounding information; a step of the automatic navigation system formulating a maneuvering plan based on the navigation plan, the own ship information, and the surrounding information, requesting approval of the maneuvering plan from land staff at the land control center, and transmitting the approved maneuvering plan to a presentation means; a step of the ship control system to which the maneuvering plan is transmitted from the presentation means operating the automatically operated ship based on the maneuvering plan; a step of confirming the operation design area based on the own ship information and surrounding information acquired by the operation design area confirmation means; and a step of a judgment/warning means judging whether or not there has been a deviation from the operation design area based on the confirmation result of the operation design area confirmation means, and if there has been a deviation from the operation design area, issuing an alert to land staff and requesting the land staff to judge whether or not to cancel subsequent automatic operation.
According to the present invention described in claim 1, an autonomous ship can be operated appropriately with reduced risks.

The present invention as recited in claim 2 is characterized in that the presentation means presents at least the maneuvering plan and the judgment results of the shore staff to the onboard staff of the autonomous ship for confirmation.
According to the present invention as set forth in claim 2, the safety of operation can be improved by having shipboard staff check the maneuvering plan and the decisions made by the shore staff.

The present invention described in claim 3 is characterized in that the own ship information includes ship status information including the position, direction of travel, and speed of the autonomous ship, cargo status information of cargo on board, and system status information of a ship control system having an actuator.
According to the present invention described in claim 3, a maneuvering plan can be formulated more accurately based on the status of the automatically operated ship itself, and deviations from the operation design domain can be more accurately determined.

The present invention as set forth in claim 4 is characterized in that the state of cargo on board is monitored by an onboard cargo monitoring system, and the ship information acquisition means acquires cargo state information.
According to the present invention as set forth in claim 4, cargo on board can be appropriately managed based on the acquired cargo status information to prevent cargo collapse, etc.

In the present invention as set forth in claim 5, the surrounding information includes meteorological and oceanographic information, obstacle information including other ships or drifting objects, and distance information from land.
According to the present invention described in claim 5, it is possible to more accurately formulate a maneuvering plan based on the surrounding conditions of the autonomous ship, and to more accurately judge deviations from the operation design area.

The present invention as described in claim 6 is characterized in that the weather and sea condition information obtained by the autonomous ship and the wide-area weather and sea condition information obtained separately are processed by a weather and sea condition information providing system and presented as integrated weather and sea condition information.
According to the present invention as set forth in claim 6, the maneuvering plan and the voyage plan can be corrected by referring to the integrated meteorological and oceanographic information.

The present invention as set forth in claim 7 is characterized in that integrated meteorological and oceanographic information is taken into consideration when formulating a ship maneuvering plan in an automatic navigation system.
According to the seventh aspect of the present invention, a more accurate ship maneuvering plan that takes into account the upcoming route can be obtained.

The present invention as described in claim 8 is characterized in that the operation design domain includes water area conditions, environmental conditions, and internal states of the autonomous ship.
According to the present invention as set forth in claim 8, the operation design domain can be set more appropriately.

The present invention as described in claim 9 is characterized in that when the entire operation flow of an automatically operated ship, from the formulation of a maneuvering plan to leaving dock, sailing, and docking, is classified into three operation phases, namely, during planning, during leaving dock, and during sailing, the automatic navigation system includes a planning mode, a docking mode, and a sailing mode as modes of the automatic navigation system corresponding to the three operation phases.
According to the present invention as set forth in claim 9, an automatically operated ship can be operated more appropriately throughout the entire route.

A risk analysis method for an autonomous ship corresponding to the method described in claim 10 is a risk analysis method for an autonomous ship that models an autonomous ship operated according to a voyage plan using an autonomous ship operation method to analyze operational risks, and is characterized by having a component setting step that clarifies functions or roles of an operation design area confirmation means related to the operation design area, an autonomous ship system, an own ship information acquisition means related to own ship information, a surrounding information acquisition means related to surrounding information, and information held by land-based staff and sets them as components, an element relationship setting step that sets the interrelationships between the components, a diagramming step in which a diagramming means expresses the information held by the components, the functions or roles, and the interrelationships between the components as a diagram used to identify operational hazards of the autonomous ship and analyze risks, and a diagram presentation means presents the diagram.
According to the present invention described in claim 10, risk analysis regarding an autonomous ship can be performed appropriately.

The present invention as described in claim 11 is characterized in that, when expressing as a diagram in the diagramming step, a class diagram of UML (Unified Modeling Language) is applied to express the information possessed by the components, the functions or roles, and the interrelationships between the components, thereby modeling the autonomous ship and the on-shore control center.
According to the present invention as set forth in claim 11, UML is applied to break down and describe the information held by each component, its function or role, and their interrelationships, and to model the autonomous ship and the onshore control center, thereby facilitating risk analysis.

In a twelfth aspect of the present invention, the diagramming means creates a modeled diagram to be used when performing brainstorming to identify hazards and analyze risks associated with the hazards.
According to the present invention as defined in claim 12, for example, by conducting a brainstorming session by a team of experts, it is possible to accurately analyze risks related to hazards.

The present invention as described in claim 13 is characterized in that the diagramming means generates a worksheet for use in carrying out brainstorming, which lists a system column divided into an autonomous ship and a land control center, and a cause column, a result column, and a countermeasure column in which hazards related to the components to be analyzed and their causes, results, and countermeasures are recorded.
According to the present invention as defined in claim 13, risks relating to hazards can be analyzed with greater accuracy.

The present invention as set forth in claim 14 is characterized in that the diagramming means creates worksheets for three operational phases: when planning the maneuvering of the automatically operated ship, when leaving or arriving at a berth, and when at sea.
According to the present invention as set forth in claim 14, hazards can be analyzed with high accuracy in accordance with the operation phase over the entire route.

The present invention as set forth in claim 15 is characterized in that the diagramming means generates a worksheet including existing defensive measures against hazards, a consequence severity index (SI), a frequency index (FI), and a risk index (RI) calculated from the severity index (SI) and frequency index (FI).
According to the present invention as set forth in claim 15, the magnitude of risk can be evaluated semi-quantitatively using these indices. For example, for a hazard with a large current risk index (RI), additional measures can be considered and the effectiveness of the additional measures can be evaluated by estimating the risk index (RI) after the measures are introduced.

The operation system for an automatically operated ship corresponding to the claim 16 is an operation system for an automatically operated ship operated according to a navigation plan, and is characterized in that it comprises an operation design area confirmation means for confirming the operation design area in which the set automatic operation system operates normally, an automatic operation system for planning operation, an own ship information acquisition means for acquiring own ship information of the automatically operated ship, a surrounding information acquisition means for acquiring surrounding information, a planning means of the automatic operation system for formulating a maneuvering plan based on the navigation plan, own ship information, and surrounding information, and requesting approval of the maneuvering plan from onshore staff at the onshore control center, a presentation means for presenting the approved maneuvering plan to the automatically operated ship, a ship control system for maneuvering the automatically operated ship based on the presented maneuvering plan, and a judgment/warning means for determining whether or not there has been a deviation from the operation design area based on the results of confirming the operation design area based on the acquired own ship information and surrounding information, and if there has been a deviation, alerting onshore staff at the onshore control center and requesting the onshore staff to decide whether or not to cancel subsequent automatic operation.
According to the present invention described in claim 16, an autonomous ship can be operated appropriately with reduced risks.

The present invention as set forth in claim 17 is characterized in that the automatically operated ship is provided with a display means as a presentation means for displaying the maneuvering plan as well as the judgment results of shore staff.
According to the present invention as set forth in claim 17, the safety of operation can be improved by having shipboard staff check the maneuvering plan and the decisions made by the shore staff.

The present invention as described in claim 18 is characterized in that the ship information acquisition means includes a ship status acquisition means for acquiring the position, direction of travel, and speed of the autonomously operated ship, a shipboard cargo status acquisition means for acquiring the status of the cargo on board, and a system status information acquisition means for acquiring the status of the ship control system.
According to the present invention as set forth in claim 18, it is possible to more accurately formulate a maneuvering plan based on the status of the automatically operated ship itself, and to more accurately judge deviations from the operation design domain.

The present invention as set forth in claim 19 is characterized in that it includes an on-board cargo monitoring system that monitors the status of on-board cargo based on the status of on-board cargo acquired by an on-board cargo status acquisition means.
According to the nineteenth aspect of the present invention, cargo on board can be appropriately managed based on the acquired cargo status information to prevent cargo collapse, etc.

The present invention as described in claim 20 is characterized in that the surrounding information acquisition means includes a meteorological and oceanographic condition information acquisition means, an obstacle information acquisition means for detecting other ships and drifting objects, and a distance information acquisition means for acquiring distance information from land.
According to the present invention described in claim 20, it is possible to more accurately formulate a maneuvering plan based on the surrounding conditions of the autonomous ship, and to more accurately judge deviations from the operation design area.

The present invention as described in claim 21 is characterized by comprising a meteorological and oceanographic information providing system that generates integrated meteorological and oceanographic information based on meteorological and oceanographic information acquired by a meteorological and oceanographic information acquisition means and wide-area meteorological and oceanographic information acquired separately.
According to the twenty-first aspect of the present invention, the maneuvering plan and the voyage plan can be corrected by referring to the integrated meteorological and oceanographic information. In addition, in the automatic navigation system, the maneuvering plan can be formulated taking into account the integrated meteorological and oceanographic information, so that a more accurate maneuvering plan that takes into account the upcoming route can be obtained.

The present invention as set forth in claim 22 is characterized in that an automatic navigation system, an operation design area confirmation means, and a judgment/warning means are provided at a land control center.
According to the twenty-second aspect of the present invention, by providing the onshore control center with a function for making higher-level decisions, for example, onshore personnel can quickly grasp various information and make appropriate decisions more easily.

A risk analysis system for an autonomous ship corresponding to the risk analysis method for an autonomous ship described in claim 23 is a risk analysis system for an autonomous ship that executes a risk analysis method for an autonomous ship, and is characterized in that it comprises: an operation design area confirmation means, an autonomous ship, a ship information acquisition means, a surrounding information acquisition means, and information held by land-based staff, a component setting means for setting functions or roles, an element relationship setting means for setting the interrelationships between the components, a diagramming means for expressing the information held by the components, the functions or roles, and the interrelationships between the components as a diagram for identifying operational hazards of the autonomous ship and analyzing risks, and a diagram presentation means for presenting the expressed diagram.
According to the present invention as set forth in claim 23, it is possible to appropriately perform risk analysis regarding the autonomous ship based on the presented charts and graphs.

The twenty-fourth aspect of the present invention is characterized in that the diagramming means creates a diagram by applying a class diagram of UML (Unified Modeling Language) to model the autonomous ship and the land control center.
According to the present invention as set forth in claim 24, UML is applied to break down and describe the information held by each component, its function or role, and their interrelationships, and to model the autonomous ship and on-shore control center, making risk analysis easier.

The present invention as set forth in claim 25 is characterized in that the diagramming means generates a list as a worksheet for identifying and analyzing hazards by a method of repeatedly asking hypothetical questions and extracting deviations from the norm through brainstorming, which list a system column divided into the autonomous ship and the onshore control center, and a cause column, a result column, and a countermeasure column which list hazards related to the components to be analyzed, as well as their causes, results, and countermeasures.
According to the twenty-fifth aspect of the present invention, for example, a team of experts can perform brainstorming based on a worksheet, thereby enabling accurate analysis of risks related to hazards.

The twenty-sixth aspect of the present invention is characterized in that the diagramming means comprises a computer, the input means of the computer functions as the component setting means and the element relationship setting means, and the output means of the computer functions as the diagram presenting means.
According to the twenty-sixth aspect of the present invention, a chart for risk analysis can be presented accurately and quickly by a computer.

The invention as defined in claim 27 is characterized in that the diagram presentation means provides a predefined format of components and interrelationships.
According to the twenty-seventh aspect of the present invention, the components and their interrelationships can be input based on a format, thereby improving the work efficiency.

The present invention as defined in claim 28 is characterized in that the computer, the input means, and the output means are installed in different locations via an information communication network.
According to the present invention as set forth in claim 28 , it is possible to perform risk analysis without completing the entire process from input to output on a single computer, which reduces the burden of introducing a risk analysis system and enables multiple users to use the system via an information and communications network, for example.

The method for operating an autonomous ship of the present invention allows autonomous ships to be operated appropriately while reducing risks.

In addition, if the presentation means presents at least the maneuvering plan and the judgment results of the shore staff to the onboard staff of the autonomous ship for confirmation, the safety of operation can be improved by having the onboard staff confirm the maneuvering plan and the judgment results of the shore staff.

In addition, when the own ship information includes ship status information including the position, heading direction, and speed of the autonomous ship, cargo status information of the cargo on board, and system status information of a ship control system having actuators, it is possible to more accurately formulate a maneuvering plan based on the autonomous ship's own status, and also to more accurately judge deviations from the operational design area.

In addition, when the condition of the cargo on board is monitored by the onboard cargo monitoring system and the ship information acquisition means acquires cargo status information, the cargo on board can be appropriately managed based on the acquired cargo status information to prevent cargo collapse, etc.

In addition, when the surrounding information includes weather and oceanographic information, information on obstacles including other ships or drifting objects, and information on the distance from land, it is possible to more accurately formulate a maneuvering plan based on the surrounding conditions of the autonomous ship, and also to more accurately judge whether to deviate from the operational design area.

In addition, if the weather and ocean information acquired by the autonomous ship and the wide-area weather and ocean information acquired separately are processed by a weather and ocean information provision system and presented as integrated weather and ocean information, the maneuvering plan and voyage plan can be revised based on the integrated weather and ocean information.

In addition, if integrated weather and ocean condition information is taken into consideration when formulating a maneuvering plan in an automated navigation system, a more accurate maneuvering plan that takes into account the upcoming route can be obtained.

In addition, if the operational design space includes the water conditions, environmental conditions, and internal conditions of the autonomous ship, the operational design space can be set more appropriately.

In addition, when the entire operation process of an autonomous ship, from the formulation of a maneuvering plan to leaving the berth, sailing, and docking, is classified into three operation phases, namely, during planning, leaving and arriving at the berth, and during sailing, if the autonomous ship operation system modes corresponding to the three operation phases include a planning mode, a docking mode, and a sailing mode, the autonomous ship can be operated more appropriately throughout the entire route.

In addition, the risk analysis method for autonomous ships of the present invention makes it possible to appropriately perform risk analysis regarding autonomous ships.

In addition, when expressing the diagram in the diagram creation step, a class diagram of UML (Unified Modeling Language) is applied to express the information possessed by each component, its functions or roles, and the interrelationships between the components. When modeling an autonomous ship and a land-based control center, UML is applied to break down and describe the information possessed by each component, its functions or roles, and the interrelationships, and the autonomous ship and a land-based control center are modeled, making risk analysis easier.

In addition, when creating a modeled diagram to be used when conducting brainstorming to identify hazards and analyze the risks associated with the hazards, the diagramming means can, for example, conduct brainstorming with a team of experts to accurately analyze the risks associated with the hazards.

In addition, when the diagramming means generates a worksheet for use in carrying out brainstorming that lists a system column divided into the autonomous ship and the onshore control center, and a cause column, a result column, and a countermeasure column that list hazards related to the components being analyzed, as well as their causes, results, and countermeasures, it is possible to more accurately analyze risks related to hazards.

In addition, when the charting means creates worksheets for three operational phases, namely, when planning the maneuvering of an autonomous ship, when leaving or arriving at a berth, and when at sea, it is possible to accurately analyze hazards according to the operational phase throughout the entire route.

In addition, when the diagramming means generates a worksheet including existing defense measures against hazards, the severity index (SI) of the result, the frequency index (FI), and the risk index (RI) calculated from the severity index (SI) and the frequency index (FI), the magnitude of risk can be evaluated semi-quantitatively using these indices. For example, for a hazard with a high current risk index (RI), additional measures can be considered and the effectiveness of the additional measures can be evaluated by estimating the risk index (RI) after the measures are introduced.

In addition, the autonomous ship operation system of the present invention makes it possible to reduce risks and operate the autonomous ship appropriately.

In addition, if an autonomous ship is equipped with a display means for displaying the maneuvering plan as well as the results of decisions made by onshore staff, the safety of operation can be improved by having onboard staff check the maneuvering plan and the results of decisions made by onshore staff.

In addition, when the ship information acquisition means includes a ship status acquisition means for acquiring the position, heading direction, and speed of the autonomous ship, an onboard cargo status acquisition means for acquiring the status of the onboard cargo, and a system status information acquisition means for acquiring the status of the ship control system, it is possible to more accurately formulate a maneuvering plan based on the autonomous ship's own status, and also to more accurately judge deviations from the operation design domain.

In addition, if an onboard cargo monitoring system is provided that monitors the status of onboard cargo based on the status of onboard cargo acquired by the onboard cargo status acquisition means, the onboard cargo can be appropriately managed based on the acquired cargo status information to prevent cargo collapse, etc.

In addition, when the surrounding information acquisition means includes a meteorological and oceanographic information acquisition means, an obstacle information acquisition means for detecting other ships and drifting objects, and a distance information acquisition means for acquiring distance information from land, it is possible to more accurately formulate a maneuvering plan based on the surrounding conditions of the autonomous ship, and also to more accurately judge deviations from the operation design area.

In addition, if a weather and ocean information providing system is provided that generates integrated weather and ocean information based on the weather and ocean information acquired by the weather and ocean information acquisition means and the wide-area weather and ocean information acquired separately, the maneuvering plan and navigation plan can be revised with reference to the integrated weather and ocean information. In addition, in an automated navigation system, a maneuvering plan can be formulated taking into account the integrated weather and ocean information, so a more accurate maneuvering plan that takes into account the upcoming route can be obtained.

In addition, if the land control center is equipped with an automated navigation system, operation design area confirmation means, and judgment/alarm means, equipping the land control center with a higher-level decision-making function will make it easier for land personnel, for example, to quickly grasp various information and make appropriate decisions.

In addition, the risk analysis system for autonomous ships of the present invention makes it possible to appropriately perform risk analysis regarding autonomous ships based on the presented charts and graphs.

In addition, when the diagramming means applies a class diagram of UML (Unified Modeling Language) to model the autonomous ship and the onshore control center and create a diagram, UML is applied to break down and describe the information held by each component, its function or role, and their interrelationships, and the autonomous ship and the onshore control center are modeled, making risk analysis easier.

In addition, when the diagramming means generates a list that includes a system column divided into the autonomous ship and the onshore control center, and a cause column, result column, and countermeasure column that describe hazards related to the components to be analyzed, as well as their causes, results, and countermeasures, as a worksheet for identifying and analyzing hazards by repeatedly brainstorming hypothetical questions to extract deviations from the norm, for example, a team of experts can brainstorm based on the worksheet to accurately analyze risks related to hazards.

In addition, if a computer is provided as the diagramming means, the input means of the computer functions as the component setting means and the element relationship setting means, and the output means of the computer functions as the diagram presentation means, the computer can accurately and quickly present diagrams for risk analysis.

In addition, if the diagram presentation means provides a predetermined format for components and interrelationships, the components and interrelationships can be input based on the format, improving work efficiency.

In addition, if the computer, input means, and output means are installed in separate locations via an information and communication network, risk analysis can be performed without completing the entire process from input to output on a single computer, reducing the burden of introducing a risk analysis system and enabling, for example, multiple users to use the system via an information and communication network.

A configuration diagram of an autonomous ship operation system according to an embodiment of the present invention. A diagram showing how the autonomous ship will be operated A diagram showing an example of the operational design domain Diagram of the risk analysis system for autonomous ships A diagram showing the risk analysis method for the autonomous ship A diagram showing an example of distributed installation of the risk analysis system A diagram showing an example of the created chart (in planning mode) A diagram showing an example of the created chart (in docking and undocking mode) A diagram showing an example of the created chart (in navigation mode) A diagram showing an example of the worksheet A configuration diagram of an autonomous ship navigation system according to another embodiment of the present invention.

This article describes an autonomous ship operation method, risk analysis method, operation system, and risk analysis system according to an embodiment of the present invention.

Fig. 1 is a configuration diagram of an operation system for an autonomous ship according to this embodiment, and Fig. 2 is a diagram showing an operation method for the autonomous ship. In this embodiment, the operation method for the autonomous ship (hereinafter also simply referred to as the "operation method") utilizes the operation system for the autonomous ship shown in Fig. 1 (hereinafter also simply referred to as the "operation system").
The operation system is applied to an autonomous ship 1 that is operated in accordance with a navigation plan, and comprises an operation design area confirmation means 10 that confirms the set operation design area, an autonomous ship 20 that plans the operation of the autonomous ship 1, a ship information acquisition means 30 that acquires ship information about the autonomous ship 1, a surrounding information acquisition means 40 that acquires surrounding information about the autonomous ship 1, a presentation means 50 having a display means 51, a ship control system 60 having actuators 61 for the rudder, engine, etc., a judgment/warning means 70, an onboard cargo monitoring system 80, a weather and ocean condition information provision system 90, a control means 100, and a transmission unit 110.
Of these, the operation design area confirmation means 10, the automatic operation system 20, the judgment/warning means 70, the on-board cargo monitoring system 80, and the weather and oceanographic information system 90 are provided in the land control center 2. In addition, the ship's own information acquisition means 30, the surrounding information acquisition means 40, the presentation means 50, the ship control system 60, the control means 100, and the transmission unit 110 are provided in the automatically operated ship 1. Note that, although the navigation plan is basically a given navigation plan obtained from the operating company, it is also possible for the navigation plan to be formulated by the land control center 2 or the automatically operated ship 1.
Onshore staff 3 are stationed at the onshore control center 2, and onboard staff 4 are stationed on the autonomous ship 1. The onshore staff 3 is the person in charge (the captain) who makes decisions regarding the overall operation, including whether or not to operate the ship, and is responsible for making higher-level decisions such as checking whether the automated functions (tasks) are being executed smoothly and responding to unforeseen circumstances. The onboard staff 4 is, for example, a navigator acting as a shadow personnel, and is responsible for the role (task) of monitoring the status of the onboard operation system, and in the event of an emergency, takes over the functions (tasks) of the operation system by switching to manual operation.

The automatic navigation system 20 includes a planning unit 21. The planning unit 21 formulates a ship maneuvering plan based on the navigation plan, the ship information, and the surrounding information, and transmits the formulated ship maneuvering plan to the presentation unit 50.
The presentation means 50 presents the maneuvering plan formulated by the plan formulation means 21 to the automatically operated ship 1. The presented maneuvering plan is displayed on a display means 51 such as a monitor or a display. The maneuvering plan transmitted to the presentation means 50 is input to the control means 100 after confirmation by the shipboard staff 4, and the control means 100 controls the ship control system 60 based on the maneuvering plan. The ship control system 60 steers the automatically operated ship 1 under the control of the control means 100. In this way, the automatically operated ship 1 is operated.

The own ship information acquired by the own ship information acquisition means 30 is transmitted to the automatic operation system 20 and the operation design area confirmation means 10 via the transmission unit 110.
The own ship information acquisition means 30 in this embodiment includes ship status acquisition means 31 for acquiring the position, heading direction, and speed of the automatically operated ship 1 as ship status information, onboard cargo status acquisition means 32 for acquiring the status of the onboard cargo as cargo status information of the onboard cargo, and system status information acquisition means 33 for acquiring the status of the ship control system 60 as system status information of the ship control system 60, and the own ship information includes the ship status information, the cargo status information of the onboard cargo, and the system status information of the ship control system 60. By including the ship status information, the cargo status information of the onboard cargo, and the system status information of the ship control system 60 in the own ship information, it is possible to more accurately formulate a maneuvering plan based on the own ship status of the automatically operated ship 1, and also to more accurately judge deviation from the operation design domain.

The surrounding information acquired by the surrounding information acquisition means 40 is transmitted to the automatic operation system 20 and the operation design area confirmation means 10 via the transmission unit 110.
The surrounding information acquisition means 40 in this embodiment includes meteorological and oceanographic information acquisition means 41 for acquiring meteorological and oceanographic information, obstacle information acquisition means 42 for detecting other ships and drifting objects as obstacle information, and distance information acquisition means 43 for acquiring distance information from land, and the surrounding information includes meteorological and oceanographic information, obstacle information, and distance information from land. By including the meteorological and oceanographic information, obstacle information, and distance information from land in the surrounding information, it is possible to more accurately formulate a ship maneuvering plan based on the surrounding conditions of the automatically operated ship 1, and also to more accurately determine deviation from the operation design area.

Among the own ship information acquired by the own ship information acquisition means 30, cargo status information of the on-board cargo is also transmitted to the on-board cargo monitoring system 80 via the transmission unit 110.
The onboard cargo monitoring system 80 monitors the status of the onboard cargo based on the status of the onboard cargo. The onboard cargo monitoring system 80 also presents the acquired information to the shore staff 3 as cargo status information. This makes it possible to appropriately manage the onboard cargo based on the acquired cargo status information and prevent cargo collapse, etc.

Of the surrounding information acquired by the surrounding information acquisition means 40 , the meteorological and oceanographic information is also transmitted to the meteorological and oceanographic information providing system 90 via the transmission unit 110 .
The meteorological and oceanographic information providing system 90 generates integrated meteorological and oceanographic information based on the meteorological and oceanographic information acquired by the meteorological and oceanographic information acquiring means 41 and wide-area meteorological and oceanographic information acquired separately from a contracted party, the Internet, etc. The meteorological and oceanographic information providing system 90 also presents the generated integrated meteorological and oceanographic information to the shore staff 3 and transmits it to the automatic navigation system 20. This allows the maneuvering plan and navigation plan to be revised with reference to the integrated meteorological and oceanographic information. Furthermore, the automatic navigation system 20 can formulate a maneuvering plan taking into account the integrated meteorological and oceanographic information, so that a more accurate maneuvering plan that takes into account the upcoming route can be obtained.

The operational design domain confirmation means 10 monitors whether the automatically operated ship 1 deviates from an operational design domain (ODD) set for normal operation of the automatic operation system 20. The shore staff 3 can use the operational design domain confirmation means 10 to confirm the operational design domain.
The judgment/warning means 70 judges whether the ship has deviated from the operation design area based on the acquired ship information and surrounding information, and if so, issues an alert to the shore staff 3.
The shore staff 3 who receive the warning decide to halt the automatic operation and communicate the decision to the ship staff 4. The ship staff 4 who are informed that the automatic operation has been halted can switch to manual operation to improve the safety of operation.

In ship operation, the functions (tasks) to be performed differ depending on the situation, and even if the same input information is received, the data used as the basis for judgment and the method of deriving a response may differ depending on the situation at the time of reception. For example, the method of response when an obstacle is observed in the vicinity is thought to be different when berthing or unberthing and while sailing.
When such tasks are shared among flight systems, it is necessary to select and use data and derivation methods that are consistent with the situation in which the system is placed. Therefore, in order to organize these conditions, it is preferable to define flight phases according to the flight situation.
The automatic navigation system 20 in this embodiment has a planning mode, a docking/undocking mode, and a navigation mode. These modes correspond to the respective navigation phases when the series of ship maneuvering flows from the formulation of a ship maneuvering plan to docking, navigation, and docking are classified into three operation phases: during planning, during docking/undocking, and during navigation. This allows the automatically navigated ship 1 to be navigated more appropriately throughout the entire route.
"Planned time" refers to the state before departure. "At the time of leaving" refers to the state when the autonomous ship 1 is about to leave the quay where it was moored, and covers the range from the quay to the center of the waterway. "At sea" refers to the state when the autonomous ship 1 has left the quay and is navigating the route until it begins to dock. "At the time of docking" refers to the state when the ship is about to dock at the quay, and covers the range from the center of the waterway to docking at the quay.

The functions (tasks) of the automated navigation system 20 in the planning mode are "correcting the navigation plan" and "mode switching."
Of these, the modification of the voyage plan consists of the following subtasks:
Acquisition of information from the weather and oceanographic information acquisition means 41 Acquisition of the position of the autonomous ship 1 from the ship status acquisition means 31 Integration of information and presentation to the shore staff 3 Modification of a given voyage plan input by the shore staff 3 (when necessary)
- Present the correction results and the intention of the correction to the shore staff 3. - Send the voyage plan after approval by the shore staff 3 and integrated information, etc. to the autonomous ship 1. In addition, mode switching is composed of the following subtasks.
・After approval of the voyage plan, switch to docking/undocking mode ・Present the mode switching information to the shore staff 3 and transmit it to the autonomous ship 1

The functions (tasks) of the automatic navigation system 20 in the docking/undocking mode are "formulation and modification of a ship maneuvering plan for docking/undocking" and "mode switching."
Of these, the formulation and revision of the maneuvering plan for berthing and unberthing consists of the following subtasks:
- Acquiring information from the weather and ocean condition information acquisition means 41 - Acquiring the position of the autonomous ship 1 from the ship status acquisition means 31, acquiring distance information from land from the distance information acquisition means 43, acquiring obstacle information from the obstacle information acquisition means 42, and acquiring control information for the actuator 61 (rudder, engine, etc.) - Integrating information and formulating a maneuvering plan for docking and departing - Calculating the deviation between the maneuvering plan and the actual ship position - Modifying the maneuvering plan for docking and departing based on the results of the above deviation calculation - Presenting the integrated information and the maneuvering plan (initial/revised) for docking and departing to the shore staff 3 - Sending the maneuvering plan for docking and departing after approval by the shore staff 3 and the integrated information, etc. to the autonomous ship 1 In addition, mode switching is composed of the following sub-tasks.
・After confirming completion of unberthing, switch to navigation mode ・Information on mode switching is presented to shore staff 3 and transmitted to autonomous ship 1

The functions (tasks) of the automatic navigation system 20 in the navigation mode are "formulation and revision of maneuvering plans for collision avoidance" and "mode switching."
Of these, the formulation and revision of the maneuvering plan for avoiding collisions consists of the following subtasks:
Acquisition of information from the weather and ocean condition information acquisition means 41 Acquisition of the position of the autonomous ship 1 from the ship status acquisition means 31, acquisition of obstacle information from the obstacle information acquisition means 42, acquisition of control information for the actuators 61 (rudder, engine, etc.) Integration of information and formulation of a maneuvering plan for avoidance Calculation of the deviation between the maneuvering plan and the actual ship position Modification of the maneuvering plan for avoidance based on the calculation result of the deviation Present the integrated information and the maneuvering plan for avoidance (initial/modified) to the shore staff 3
- Transmitting a maneuvering plan for avoidance after approval by the shore staff 3 and integrated information, etc. to the autonomous ship 1. In addition, mode switching is composed of the following subtasks.
After confirming arrival at the destination, switch to docking mode. Present the mode switch information to shore staff 3 and transmit it to the autonomous ship 1.

The function (task) of the meteorological and oceanographic information providing system 90 in each mode is to “acquire and present meteorological and oceanographic information and meteorological and oceanographic forecast information” and is composed of the following subtasks:
Acquisition of meteorological and oceanographic information at the current location of the autonomous ship 1 from the meteorological and oceanographic information acquisition means 41 Acquisition of current meteorological and oceanographic information at waypoints/destination Acquisition of meteorological and oceanographic forecast information for the current location/waypoints/destination Integration and accumulation of information Transmission of information to the autonomous ship 20 Presentation of information to shore staff 3

The function (task) of the operational design area confirmation means 10 and the judgment/warning means 70 in each mode is to “monitor deviation from the operational design area” and is composed of the following subtasks:
- Monitoring the status of each means etc. equipped on the autonomous ship 1 - Comparing the information acquired by each means etc. equipped on the autonomous ship 1 with various condition values of the operational design domain - Issuing an alarm to notify shore staff 3 of deviations from the operational design domain

The function (task) of the shipboard cargo monitoring system 80 in each mode is "monitoring the status of onboard cargo" and is composed of the following subtasks:
・Acquisition of cargo status information for onboard cargo ・Present to shore staff 3

The functions (tasks) of the meteorological and oceanographic information acquisition means 41 in each mode are "acquisition of meteorological and oceanographic information" and "self-diagnosis."
Of these, obtaining meteorological and oceanographic information in each mode consists of the following subtasks:
- Acquisition and integration of meteorological and oceanographic information from the wind direction and speed gauge and wave height gauge - Transmission of various information to the onshore control center 2 Furthermore, self-diagnosis in each mode consists of the following subtasks.
- Diagnosis of the status of the ship and its sensors - Transmission of diagnosis results to the onshore control center 2

The functions (tasks) of the ship status acquisition means 31 in each mode are "acquisition of ship status information" and "self-diagnosis."
Of these, obtaining ship status information in each mode consists of the following subtasks:
- Acquire and integrate information such as the position (ship's position), direction of travel, and speed of the autonomous ship 1 from GPS, gyrocompass, ground/water speed indicator, Doppler sonar, etc. - Transmit ship status information to the land control center 2. Self-diagnosis in each mode is composed of the following subtasks.
- Diagnosis of the status of the ship and its sensors - Transmission of diagnosis results to the onshore control center 2

The functions (tasks) of the onboard cargo status acquisition means 32 in each mode are "acquisition of cargo status information" and "self-diagnosis."
Of these, obtaining cargo status information in each mode consists of the following subtasks:
Acquire cargo status information using cargo monitoring cameras, etc. Transmit cargo status information to the land control center 2. Self-diagnosis in each mode is composed of the following subtasks.
- Diagnosis of the status of the ship and its sensors - Transmission of diagnosis results to the onshore control center 2

The function (task) of the obstacle information acquisition means 42 is "self-diagnosis" in the planning mode, and is "obstacle information acquisition" and "self-diagnosis" in the docking/undocking mode and the navigation mode.
Of these, the acquisition of obstacle information in the docking/undocking mode and the navigation mode consists of the following subtasks:
- Acquisition of information about other ships using the Automatic Identification System (AIS) - Detection of other ships or drifting objects using radar - Detection of other ships or drifting objects using image processing from on-board cameras - Transmission of information to the on-shore control center 2 Furthermore, self-diagnosis in each mode is composed of the following subtasks:
- Diagnosis of the status of the ship and its sensors - Transmission of diagnosis results to the onshore control center 2

The function (task) of the distance information acquisition means 43 is "self-diagnosis" in the planning mode and navigation mode, and is "acquisition of distance information from land" and "self-diagnosis" in the docking and undocking mode.
Of these, obtaining information on the distance to land in docking/undocking mode consists of the following subtasks:
・Obtain distance information from land using LiDAR (Light Detection and Ranging) or distance meter (bow, stern)
- Transmitting information to land control center 2
Furthermore, the self-diagnosis in each mode consists of the following subtasks:
- Diagnosis of the status of the ship and its sensors - Transmission of diagnosis results to the onshore control center 2

The function (task) of the vessel control system 60 is "self-diagnosis" in the planning mode, and is "vessel motion control" and "self-diagnosis" in the docking/undocking mode and the navigation mode.
Of these, the ship motion control in the docking/undocking mode consists of the following subtasks:
- Obtaining maneuvering plans (initial/revised) for docking and departing from the onshore control center 2 - Executing docking and departing maneuvers by controlling the actuators 61 (rudder, engine, etc.) - Obtaining status information of the actuators 61 (rudder, engine, etc.) - Transmitting actuator 61 (rudder, engine, etc.) information to the onshore control center 2 In addition, ship motion control in navigation mode is composed of the following sub-tasks:
- Obtaining an avoidance maneuvering plan (initial/revised) from the onshore control center 2 - Executing avoidance maneuvers by controlling the actuators 61 (rudder, engine, etc.) - Obtaining status information of the actuators 61 (rudder, engine, etc.) - Transmitting actuator 61 (rudder, engine, etc.) information to the onshore control center 2 In addition, self-diagnosis in each mode is composed of the following sub-tasks.
- Diagnosis of the condition of itself and actuators 61 (rudder, engine, etc.) - Transmission of diagnosis results to the land control center 2

The function (task) of the presentation means 50 is "presentation of navigation plans, etc." in the planning mode, "presentation of maneuvering plans, etc. for docking and undocking" in the docking and undocking mode, and "presentation of maneuvering plans, etc. for avoidance" in the navigation mode.
Of these, the presentation of voyage plans, etc., consists of the following subtasks:
- Acquisition of various information such as navigation plans from the onshore control center 2 - Presentation of information to shipboard staff 4 such as shadow personnel In addition, presentation of maneuvering plans for docking and departing is composed of the following subtasks.
- Acquiring various information such as maneuvering plans for docking and undocking from the onshore control center 2 - Presenting information to shipboard staff 4 such as shadow personnel. In addition, the presentation of maneuvering plans for avoidance is composed of the following sub-tasks.
- Acquisition of various information such as maneuvering plans for avoidance from the land control center 2 - Present information to shipboard personnel 4 such as shadow personnel

Next, the operation method will be explained.
As shown in Fig. 2, first, at the land control center 2, the land staff 3 inputs a navigation plan including way points and times to the automatic navigation system 20. As a result, the automatic navigation system 20 acquires a given navigation plan (step S1). The automatic navigation system 20 modifies the navigation plan as necessary based on information acquired from the meteorological and oceanographic information system 90, position information of the automatically operated ship 1, navigation plans of dangerous goods ships, construction information, etc. The given navigation plan or the modified navigation plan approved by the land staff 3 is transmitted from the automatic navigation system 20 to the presentation means 50.
Moreover, various condition values of the operation design domain in which the automatic navigation system 20 operates normally are set in advance in the operation design domain confirmation means 10 (step S2). Here, Fig. 3 is a diagram showing an example of setting the operation design domain. As shown in Fig. 3, it is preferable to set the operation design domain including the water area conditions, environmental conditions, and internal conditions of the automatically navigated ship 1. The water area conditions are conditions related to the navigation area and obstacles, the environmental conditions are conditions related to weather and sea conditions, the time, etc., and the internal conditions are the operating status of equipment required for navigation, the state of the ship's rolling, etc. This allows the operation design domain to be set more appropriately.

Meanwhile, in the autonomous ship 1, the autonomous ship information acquisition means 30 acquires the autonomous ship information of the autonomous ship 1 (step S3), and the peripheral information acquisition means 40 acquires the peripheral information (step S4). The acquired autonomous ship information and peripheral information are transmitted to the autonomous ship system 20, etc. via the transmission unit 110 (step S5).

The automated navigation system 20 formulates a maneuvering plan based on the navigation plan, the ship's own information, and the surrounding information (step S6), and requests approval from the shore staff 3 (step S7). The maneuvering plan that has been approved by the shore staff 3 is transmitted from the automated navigation system 20 to the presentation means 50 (step S8).

The presentation means 50 presents (displays) the maneuvering plan received from the automatic navigation system 20 to the shipboard staff 4 and requests confirmation (step S9).
The maneuvering plan approved by the shipboard staff 4 is transmitted from the presentation means 50 to the control means 100. The ship control system 60 controls the control means 100 based on the maneuvering plan to operate the automatically operating ship 1 (step S10).
The maneuvering plan received from the automatic navigation system 20 is input into the ship control system 60 without confirmation by the ship's staff 4. However, as in this embodiment, the maneuvering plan can be confirmed by the ship's staff 4, and if it is necessary to stop automatic navigation, the maneuvering plan can be switched to manual navigation, thereby improving the safety of navigation.
In the autonomous ship 1 in operation, the ship information acquisition means 30 acquires ship information (step S11), and the surrounding information acquisition means 40 acquires surrounding information (step S12). The acquired ship information and surrounding information are transmitted to the operation design area confirmation means 10, etc. via the transmission unit 110 (step S13).

The operation design area confirmation means 10 confirms whether or not the autonomous ship 1 has deviated from the operation design area based on the received ship information and surrounding information (step S14). In addition, the judgment/warning means 70 issues an alarm to the shore staff 3 when the autonomous ship 1 deviates from the operation design area (step S15).
If it is determined in step S15 that there is no deviation (NO), automatic flight operation continues.
On the other hand, if it is determined in step S15 that deviation has occurred (YES), the determination/warning means 70 issues a warning to the shore staff 3.
The shore staff 3 who received the warning decides on the subsequent operation, such as whether to continue automatic operation or switch to manual operation, and communicates the result of the decision to the ship's staff 4 (step S16). The method of communication is that the shore staff 3 directly communicates the result of the decision to the ship's staff 4 by telephone, VHF, etc.

The autonomous ship 1 is operated based on the judgment result of the shore staff 3. If the judgment result is to cancel the autonomous operation, the ship is operated by manual operation by the ship staff 4 (step S17).
The presentation means 50 may present the received judgment result of the shore staff 3 to the ship staff 4 for confirmation. By having the ship staff 4 confirm the judgment result of the shore staff 3, the safety of the operation can be improved.
Also, an operation method may be considered in which the on-board staff 4 is not stationed on the autonomous ship 1. In this case, for example, if the shore staff 3 determines that the autonomous operation should be stopped, the on-board staff 4 will not manually operate the ship, but instead will transmit the result of the shore staff 3's decision to the ship control system 60 via a control signal, and the ship will be operated by remote control.

In this way, by using the navigation system or navigation method of the present invention, the autonomous ship 1 can be operated appropriately with reduced risk.
In addition, by providing the higher-level decision-making functions, namely the automated navigation system 20, the operation design area confirmation means 10, and the judgment/warning means 70, in the onshore control center 2 rather than in the autonomous ship 1, it becomes easier for onshore staff 3, for example, to quickly grasp various information, etc. and make appropriate decisions.

Next, a risk analysis method and a risk analysis system will be described.
FIG. 4 is a configuration diagram of a risk analysis system for an autonomous ship, FIG. 5 is a diagram showing a risk analysis method for an autonomous ship, and FIG. 6 is a diagram showing an example of distributed installation of the risk analysis system.
The risk analysis system for an autonomous ship (hereinafter also simply referred to as the "risk analysis system") executes a risk analysis method for an autonomous ship (hereinafter also simply referred to as the "risk analysis method"). The risk analysis method models an autonomous ship 1 that is operated according to a voyage plan based on an autonomous ship operation method, and analyzes operational risks.

The risk analysis system includes a component setting means 211, an element relationship setting means 212, a diagramming means 200, and a diagram presentation means 220, and analyzes the operational risks of the autonomous ship 1 based on the presented diagrams.
In this embodiment, a computer is provided as diagramming means 200, input means 210 such as a mouse and keyboard provided in the computer 200 function as component setting means 211 and element relationship setting means 212, and output means provided in the computer 200 function as diagram presentation means 220. This allows accurate and rapid presentation of diagrams for risk analysis.
In risk analysis targeting the autonomous ship 1, it is necessary to perform a comprehensive analysis by regarding software, hardware, and humans as part of the overall system. Therefore, the navigation system located at the onshore control center 2 and the autonomous ship 1, and the humans located at each location, i.e., the captain and other onshore staff 3 and shadow personnel and other shipboard staff 4, are all modeled by regarding them as parts (components) of the overall system.

First, a plurality of components are extracted, and the component setting means 211 is used to set the information held and the function or role for each of the extracted components (component setting step S21). The components extracted in this embodiment are the operation design area confirmation means 10 related to the operation design area, the automatic operation system 20, the ship information acquisition means 30 related to the ship information, the surrounding information acquisition means 40 related to the surrounding information, and the shore staff 3.
Next, the element relationship setting means 212 is used to set interrelationships between the elements (element relationship setting step S22).
In the element relationship setting step S22, it is preferable to provide a predetermined format for the elements and their interrelationships by the diagram presentation means 220. In this case, the operating company or the like can input the elements and their interrelationships based on the provided format, thereby improving the work efficiency.
It is also preferable to store information held by components, examples of setting functions or roles, examples of setting interrelationships between components, and examples of risk analysis of the autonomous ship in the storage means 240 provided in the computer 200, and present these examples to the operating company, etc. that is going to perform the component setting step S21 or the element relationship setting step S22, by the diagram presentation means 220. In this case, the operating company, etc. can input the necessary information and conceive the concept of the autonomous ship 1 while referring to the presented examples, thereby improving work efficiency.

Next, the diagramming means 200 expresses the information held by the components, the functions or roles, and the interrelationships between the components as a diagram (diagramming step S23).
Modeling in this embodiment is performed using a class diagram, which is one of the static models among diagrams in the Unified Modeling Language (UML), which is a standardized software modeling method, and is performed in the following procedure. Note that Table 1 below shows an example of the information held by components in modeling the autonomous ship 1 and their functions or roles.
1) Using the diagramming means 200, the names of the components that function in each operation phase (means or systems used in that operation phase, and people who have a role in that operation phase) extracted by the component setting means 211 are entered in the upper part of Table 1.
2) Using the diagramming means 200, organize the functions (tasks) or roles that each extracted component is responsible for in the corresponding operation phase, and list them in bullet points in the lower section of Table 1.
3) Using the diagramming means 200, the retained information required for each component to execute its function (task) is itemized in the middle section of Table 1.
4) Perform steps 1) to 3) for all components, and use the diagramming means 200 to represent interactions such as sending and receiving information with arrows so that the relationships between the components can be understood. Write the content of the action and the information being input and output close to the arrows.

In this way, when expressing as a diagram in diagram creation step S23, a UML class diagram is applied to express the information possessed by the components, the functions or roles, and the interrelationships between the components, and by modeling the autonomous ship 1 and the onshore control center 2, UML is applied to break down and describe the information possessed by each component, its functions or roles, and the interrelationships, and the autonomous ship 1 and the onshore control center 2 are modeled, making risk analysis easier. Note that, taking into consideration that the functions (tasks) of each component change depending on the operation phase, models are also created for each operation phase.

Figures 7 to 9 show examples of the created diagrams, with Figure 7 being for planning, Figure 8 being for leaving and arriving at berthing, and Figure 9 being for during the voyage. The navigation system, the shore staff 3, and the shipboard staff 4 are regarded as components of the overall system and modeled.
For means etc. that are not used in each operation phase, only the function of diagnosing whether there are any abnormalities in the means etc. themselves or in the sensors or actuators 61 connected to the means etc., and transmitting the diagnosis results to the land control center 2 is listed as a function (task) for that operation phase.
7 to 9, components shown in white boxes represent devices such as means, sensors, and actuators 61, while components shown in grey boxes represent humans. Elements not shown in boxes (operating companies, other ships, port radio, etc.) are not subject to risk analysis. In addition, sensors and actuators 61 are described in a simplified manner. Among the functions (tasks) of each component, simple data transmission and reception is omitted in the boxes, and is represented by adding the transmitted and received information next to the arrows of the interactions between the components.

The diagram presentation means 220 presents the diagram generated by the diagramming means 200 via a display unit 230 such as a monitor or display equipped in the computer. The operating company etc. analyzes operational risks of the autonomously operated ship 1 based on the presented diagram (risk analysis step S24).
In the risk analysis step S24, it is preferable to perform brainstorming by repeatedly asking hypothetical questions using diagrams of the modeled autonomous ship 1 and the onshore control center 2, identify hazards (risk factors), and analyze the risks associated with the hazards. In this way, for example, by performing brainstorming by a team of experts, the risks associated with the hazards can be analyzed with high accuracy.

FIG. 10 is a diagram showing an example of a worksheet.
The diagramming facility 200 generates worksheets for identifying and analyzing hazards by iterative brainstorming of what-if questions to extract deviations from the norm.
When conducting brainstorming, it is preferable to use a worksheet that lists the system column for describing the system to be analyzed, and the cause column, result column, and countermeasure column for describing the hazards, their causes, results, and countermeasures related to the components to be analyzed. This allows for more accurate analysis of hazard-related risks.
In this embodiment, hazards of a virtual autonomous ship 1 are identified by using a Structured What IF Technique (SWIFT) worksheet as shown in Fig. 10 while referring to models for each navigation phase. By creating worksheets for three navigation phases, namely, when planning the maneuvering of the autonomous ship 1, when leaving or arriving at a berthing location, and during the voyage, it is possible to accurately analyze hazards according to the navigation phase throughout the entire route.
For the classification of the analysis, the entire system is divided into the land control center 2 and the autonomous ship 1, each of which is entered in the "System" column, and the components belonging to each are entered in the "Sub-system" column. In the "Phase" column, either planning time, docking or leaving berthing, or during the voyage is entered, and worksheets are created for each operation phase for all components. Using the diagramming means 200, hazards related to the components to be analyzed and their causes, results, and countermeasures are compiled in a list on each worksheet.
In this embodiment, the existing defense measures for each hazard, the consequence severity index (SI), frequency index (FI), and risk index (RI) are further recorded in the worksheet. The risk index (RI) is estimated using the consequence severity index (SI) and frequency index (FI). This allows the magnitude of risk to be evaluated semi-quantitatively using these indices. For example, for a hazard with a high current risk index (RI), additional measures can be considered and the effectiveness of the additional measures can be evaluated by estimating the risk index (RI) after the measures are introduced.

SWIFT is one of the conventional hazard identification methods, which uses a worksheet to repeatedly ask "what if" questions and extract deviations from normal operations through brainstorming by a team of experts (HAZID (Hazard Identification) meeting). It has the advantage that it can be widely applied from the early development stage to the detailed design stage, and that it can calculate a risk index (RI) by assuming the outcome of a hazard, and can semi-quantitatively evaluate the magnitude of risk.
The inventors have been devising ways to perform SWIFT comprehensively for a long time, and have found that, particularly in large-scale systems, by defining the components of the system and the relationships between the elements with a level of detail and amount of information suitable for analysis from the perspective of risk analysis of the entire system, it is possible to promote sharing of awareness among participating experts, even in cases such as HAZID meetings.
SWIFT does not have a set method for creating and using system configuration diagrams, and participants are free to use whatever clues they like for brainstorming. In conventional systems where hardware plays a large role, the focus of analysis has been on using system configuration diagrams that focus on the hardware, and on considering the impact of possible failure modes for each component, such as FMEA (Failure Mode and Effects Analysis). However, when software and humans are included in the analysis, the traditional use of system configuration diagrams alone is insufficient in promoting understanding of the system as a whole.
In contrast, in the present embodiment, by creating modeled diagrams using UML class diagrams and referring to these diagrams during analysis, it is possible to consider failure modes for the functions of each component and the transmission and reception of information, even in systems in which software and humans play a large role.
As a method of brainstorming, it is also possible to use a technique such as HAZOP (HAZard and OPerability studies) instead of SWIFT.

The analysis targets of this embodiment include hardware, software, and humans as components of the overall system, and for hardware, hazards resulting from equipment malfunctions and the like exist, as in conventional risk analysis. For software, on the other hand, it is necessary to consider the presence of undiscovered bugs, hazards resulting from specifications not meeting requirements, and hazards related to cybersecurity. In addition, as interactions with humans, hazards arising from unintended usage by developers should also be considered for both hardware and software.
Furthermore, hazards related to situational awareness, such as mode errors, assumptions, and communication errors, are also important issues that must be considered during analysis in both software and humans.
Humans and software make decisions and take actions according to the situation, but sometimes they perceive the situation as different from the reality. In addition, in a system that includes multiple humans and software, information shared between these components may be used in different ways.
A mode error refers to a problem that occurs when, for a situation to be assumed, such as an operation phase, mode switching information should be held as a common precondition between components when transmitting information, but because this precondition does not match, the information is not appropriately processed at the transmission destination, and such a situation needs to be consciously extracted as a hazard. Also, in an operation method or operation system for an autonomous ship 1 that assumes a fallback by a human, such as the subject of analysis in this embodiment, it is also necessary to consider hazards that may occur when transitioning from an operation design domain to a domain where fallback is required.

This section describes the hazards identified during each operational phase, including planning, berthing, and at sea, along with examples of their causes, consequences, and possible countermeasures. When a hazard has multiple causes or when a hazard has multiple consequences, it lists them all in a summarized form to the extent possible.
(1) Hazards during planning As an example, the hazards identified for the automated navigation system 20 (planned mode) of the land control center 2, their causes, consequences and possible countermeasures are as follows:
<Hazard>
An inappropriate voyage plan is approved by the captain or other shore personnel 3.
<Cause>
- Input error of warning information by shore staff 3 (automated navigation system 20 corrects the voyage plan based on the incorrect information)
- Insufficient confirmation and misjudgment by shore staff 3 - Difficulty in understanding the revised voyage plan presented by the automated navigation system 20 (leading to misunderstanding by shore staff 3)
<Results>
・Construction works or ships carrying dangerous materials that were not taken into account during the voyage may be encountered, forcing a detour or other measures to be taken, resulting in delays in operation.
・There is a delay in noticing construction work or encounters with dangerous cargo ships that were not taken into account during planning, resulting in entry into the construction area or a collision with a dangerous cargo ship, etc.
<Measures>
- Warning information from the operating company will be transmitted to shore staff 3 and shipboard staff 4, so that shipboard staff 4 will become aware of any inappropriate voyage plans.

(2) Hazards when docking and undocking As an example, the hazards identified with respect to the on-board ship information acquisition means 30, their causes, consequences and possible countermeasures are as follows:
<Hazard>
Incorrect position information of the autonomous ship 1 (own ship position information) is transmitted to the autonomous ship system 20 (docking/undocking mode).
<Cause>
・Anomalies in sensors such as GPS ・Spoofing of GPS information (impersonation, substitution of incorrect information)
・Abnormality in the function of receiving information from sensors ・Abnormality in the function of transmitting to the automatic navigation system 20 ・Abnormality in the ship-to-shore communication equipment ・Spoofing of the ship's own position information transmitted to the shore <Results>
- A docking or undocking plan is made based on incorrect ship position information, resulting in a collision with a quay or other object.
<Measures>
- By confirming the position of the autonomous ship 1 using multiple sensors (including distance meters from land), an algorithm is developed that can ignore abnormal position information.

(3) Hazards during navigation As an example, the hazards identified for the automated navigation system 20 (navigation mode) of the onshore control center 2, their causes, consequences and possible countermeasures are as follows:
<Hazard>
An inappropriate maneuvering plan is sent to the vessel control system 60.
<Cause>
- The occurrence of discrepancies with the information held by the automatic navigation system 20 due to deterioration over time of the control performance of the automatic navigation ship 1, etc. - Errors in the input information of the position of the automatic navigation ship 1 or obstacle information - Abnormalities in the ship-to-shore communication equipment - Spoofing of the maneuvering plan transmitted to the ship control system 60
<Results>
- Unreasonable maneuvering commands that exceed the control capabilities of the autonomous ship 1 could cause damage to the rudder or engine.
- Failing to avoid obstacles such as other ships or drifting debris, resulting in a collision.
<Measures>
- Regularly check the control performance of the autonomous ship 1 and update the information held by the autonomous navigation system 20.
- Prevent input information errors by improving the reliability and redundancy of sensors, onboard systems, and ship-to-shore communications.

As in this embodiment, by modeling the system configuration by applying a UML class diagram to the autonomous ship 1 and using the model to identify hazards with SWIFT, it is possible to identify hazards related to human-software interaction (human approval) and the transmission and reception of information. Furthermore, in addition to equipment malfunctions and the like that have been dealt with in conventional risk analysis, it is possible to extract causes of these hazards such as errors in human input into the software, insufficient confirmation, errors in judgment, and problems with the human-machine interface of the automation system (misleading methods of presenting information) as the causes of these hazards.
In addition, STAMP/STPA can also be applied to the risk analysis step. STAMP/STPA is suitable for risk analysis of the autonomous ship 1 due to its methodological feature of analyzing hazards hidden in interactions between system components. When STAMP/STPA is applied to risk analysis, a worksheet for STAMP/STPA is used.

In this way, by using the risk analysis system or risk analysis method of the present invention, risk analysis regarding the autonomous ship 1 can be appropriately performed based on the presented diagrams.

In the example shown in FIG. 6, company A, company B, organization C such as a research institute, and a host computer 201 are connected via an information and communications network.
Company A and Company B are equipped with terminal computers 202 such as laptop computers, and the terminal computers 202 have input means 210 functioning as component setting means 211 and element relationship setting means 212, a display unit 230, as well as an output unit 205 that outputs setting information set by the component setting means 211 and element relationship setting means 212, and a communication unit 203 used for communication via an information and communication network.
A host computer 201 such as a server functions as a diagramming means 200. The host computer 201 also has an output means (diagram presentation means) 220, a display unit 230, a storage means 240, and a communication unit 203 used for communication via an information and communication network. An input unit 204 such as a mouse and a keyboard is also connected.
In addition, the output from the output means (diagram presentation means) 220 can be sent back to the input means 210 to which at least the setting information was input via an information and communication network, and the display unit 230 of the terminal computer 202 can function as the output means (diagram presentation means) 220.
Furthermore, the host computer 201, input means 210, and output means (diagram presentation means) 220 can be combined in any desired manner and connected via an information communication network.
In this way, the risk analysis system can install the computer 200, the input means 210, and the output means 220 in separate locations via an information and communication network. This makes it possible to perform risk analysis without completing the entire process from input to output on a single computer, reducing the burden of introducing the risk analysis system and enabling, for example, multiple users to use the system via an information and communication network.

Next, a navigation system for an autonomous ship according to another embodiment of the present invention will be described. Note that the same functional components as those in the above embodiment will be denoted by the same reference numerals and will not be described.
FIG. 11 is a diagram showing an operating system according to this embodiment.
In this embodiment, the autonomous ship 1 is also provided with an operation design area confirmation means 10, an autonomous operation system 20, a judgment/warning means 70, an on-board cargo monitoring system 80, and a weather and oceanographic information system 90. In this case, a shore staff member 3 located in a shore control center 2 accesses the operation system through a communication line.
In addition, the various means and systems that make up the operation system can be arranged in any manner other than that shown in Figure 1 or Figure 11, except for those functions that are essential for the land control center 2 and the autonomous ship 1.
In addition, the autonomous ship operation method, risk analysis method, and risk analysis system in the above-mentioned embodiments can be similarly applied to the operation system of this embodiment and operation systems of other installation configurations.

By applying this invention, it is possible to operate an autonomous ship safely and appropriately, and to properly analyze the operational risks of an autonomous ship. Furthermore, while the present invention is primarily intended for application to autonomous ships, it can also be applied to other autonomously operated moving objects, in which case the technical expressions used in this invention should be interpreted as expressions appropriate to that moving object.

REFERENCE SIGNS LIST 1 Autonomous ship 2 Land control center 3 Land staff 4 Onboard staff 10 Operation design area confirmation means 20 Autonomous ship operation system 21 Planning means 30 Own ship information acquisition means 31 Ship status acquisition means 32 Onboard cargo status acquisition means 33 System status information acquisition means 40 Surrounding information acquisition means 41 Weather and ocean condition information acquisition means 42 Obstacle information acquisition means 43 Distance information acquisition means 50 Presentation means 51 Display means 60 Ship control system 61 Actuator 70 Judgment/alarm means 80 Onboard cargo monitoring system 90 Weather and ocean condition information provision system 200 Charting means (computer)
210 Input means 211 Element setting means 212 Element relationship setting means 220 Diagram presentation means (output means)
240 Storage means S21 Component setting step S22 Element relationship setting step S23 Diagramming step S24 Risk analysis step

Claims (28)

A method for operating an autonomous ship according to a navigation plan, comprising:
An automated navigation system acquires the voyage plan;
A step of setting a flight design domain in which the automatic flight operation system normally operates in a flight design domain confirmation means;
A step in which a ship information acquisition means acquires ship information of the autonomously operated ship;
A step in which a surrounding information acquisition means acquires surrounding information;
a step of the automated navigation system formulating a maneuvering plan based on the navigation plan, the ship information, and the surrounding information, requesting approval of the maneuvering plan from a land-based staff member of a land-based control center, and transmitting the approved maneuvering plan to a presentation means;
a ship control system to which the maneuvering plan is transmitted from the presentation means causes the automatically operated ship to operate based on the maneuvering plan;
A step of confirming the operation design area based on the ship information and the surrounding information acquired by an operation design area confirmation means;
A method for operating an autonomous ship, comprising a step in which a judgment/warning means judges whether the ship has deviated from the operational design area based on the confirmation results of the operational design area confirmation means, and if the ship has deviated from the operational design area, issues a warning to the shore staff and requests the shore staff to decide whether or not to cancel subsequent autonomous operation. The method for operating an autonomous ship as described in claim 1, characterized in that the presentation means presents at least the maneuvering plan and the judgment results of the shore staff to the onboard staff of the autonomous ship for confirmation. The method for operating an autonomous ship according to claim 1 or 2, characterized in that the ship information includes ship status information including the position, heading, and speed of the autonomous ship, cargo status information of cargo on board, and system status information of a ship control system having an actuator. The method for operating an autonomous ship described in claim 3, characterized in that the status of the onboard cargo is monitored by an onboard cargo monitoring system, and the ship information acquisition means acquires the cargo status information. The method for operating an autonomous ship according to any one of claims 1 to 4, characterized in that the surrounding information includes meteorological and oceanographic information, information on obstacles including other ships or drifting objects, and information on the distance from land. The method for operating an autonomous ship described in claim 5, characterized in that the weather and ocean condition information acquired by the autonomous ship and wide-area weather and ocean condition information acquired separately are processed by a weather and ocean condition information providing system and presented as integrated weather and ocean condition information. The method for operating an autonomous ship described in claim 6, characterized in that the integrated meteorological and oceanographic information is taken into consideration when formulating the maneuvering plan in the autonomous ship operation system. The method for operating an autonomous ship according to any one of claims 1 to 7, characterized in that the operation design domain includes water area conditions, environmental conditions, and internal conditions of the autonomous ship. The method for operating an autonomous ship according to any one of claims 1 to 8, characterized in that the autonomous ship operation system includes a planning mode, a docking mode, and a navigation mode as modes of the autonomous ship operation system corresponding to the three operation phases when the series of operations from the formulation of a maneuvering plan of the autonomous ship to docking, sailing, and docking are classified into three operation phases: during planning, during docking, and during sailing. A risk analysis method for an autonomous ship, which models an autonomous ship operated according to a voyage plan by the autonomous ship operation method according to any one of claims 1 to 9, and analyzes operational risks,
a component setting step of clarifying the functions or roles of the operation design area confirmation means related to the operation design area, the automatic operation system, the ship information acquisition means related to the ship information, the surrounding information acquisition means related to the surrounding information, and the information held by the shore staff, and setting them as components;
An element relationship setting step of setting interrelationships between the elements;
a diagramming step in which a diagramming means expresses the retained information of the components, the functions or roles, and the interrelationships between the components as a diagram used to identify operational hazards of the autonomous ship and analyze risks;
A risk analysis method for an autonomous ship, comprising a step of presenting the chart by a chart presentation means. The risk analysis method for an autonomous ship described in claim 10, characterized in that, in expressing the diagram in the diagramming step, a class diagram of UML (Unified Modeling Language) is applied to express the information held by the components, the functions or roles, and the interrelationships between the components, and to model the autonomous ship and the land control center. The risk analysis method for an autonomous ship described in claim 11, characterized in that the diagramming means creates the modeled diagram for use in performing brainstorming to identify the hazards and analyze the risks associated with the hazards. The risk analysis method for an autonomous ship described in claim 12, characterized in that the diagramming means generates a worksheet for use in carrying out the brainstorming, which lists a system column divided into the autonomous ship and the onshore control center, and a cause column, a result column, and a countermeasure column that list the hazards, their causes, results, and countermeasures related to the components to be analyzed. The risk analysis method for an autonomous ship described in claim 13, characterized in that the diagramming means creates the worksheets for three operational phases: when planning the operation of the autonomous ship, when docking or leaving the berthing area, and when at sea. The risk analysis method for an autonomous ship according to claim 13 or 14, characterized in that the diagramming means generates the worksheet including existing defense measures against the hazard, a consequence severity index (SI), a frequency index (FI), and a risk index (RI) calculated from the severity index (SI) and the frequency index (FI). An operation system for an autonomous ship operated according to a navigation plan, comprising: a navigation design area confirmation means for confirming a navigation design area in which the set autonomous ship operates normally; the autonomous ship that plans navigation; an own ship information acquisition means for acquiring own ship information of the autonomous ship; a surrounding information acquisition means for acquiring surrounding information; a planning means of the autonomous ship that formulates a maneuvering plan based on the navigation plan, the own ship information, and the surrounding information, and requests approval of the maneuvering plan from a land-based staff member of a land-based control center; a presentation means for presenting the approved maneuvering plan to the autonomous ship; a ship control system that steers the autonomous ship based on the presented maneuvering plan; and a judgment/warning means for determining whether the autonomous ship has deviated from the navigation design area based on the results of confirming the navigation design area based on the acquired own ship information and surrounding information, and, if so, for issuing an alert to the land-based staff member of the land-based control center and requesting the land-based staff member to decide whether to discontinue subsequent autonomous operation. The autonomous ship navigation system according to claim 16, characterized in that the autonomous ship is provided with a display means for displaying the maneuvering plan as well as the results of the shore staff's judgment as the presentation means. The autonomous ship navigation system according to claim 16 or 17, characterized in that the ship information acquisition means includes a ship status acquisition means for acquiring the position, heading direction, and speed of the autonomous ship, a ship cargo status acquisition means for acquiring the status of the onboard cargo, and a system status information acquisition means for acquiring the status of the ship control system. The autonomous ship operation system according to claim 18, further comprising an on-board cargo monitoring system that monitors the on-board cargo status based on the on-board cargo status acquired by the on-board cargo status acquisition means. The autonomous ship navigation system according to any one of claims 16 to 19, characterized in that the surrounding information acquisition means includes a meteorological and oceanographic information acquisition means, an obstacle information acquisition means for detecting other ships and drifting objects, and a distance information acquisition means for acquiring distance information from land. The operating system for an autonomous ship as described in claim 20 is characterized in that it is provided with a weather and ocean information providing system that generates integrated weather and ocean information based on the weather and ocean information acquired by the weather and ocean information acquisition means and wide-area weather and ocean information acquired separately. The autonomous ship navigation system according to any one of claims 16 to 21, characterized in that the autonomous ship navigation system, the navigation design area confirmation means, and the judgment/warning means are provided at the land control center. A risk analysis system for an autonomous ship that executes the risk analysis method for an autonomous ship according to any one of claims 10 to 15, comprising: an element setting means for setting the operation design domain confirmation means, the autonomous ship, the ship information acquisition means, the surrounding information acquisition means, and the information held by the shore staff as the elements, and functions or roles; an element relationship setting means for setting the interrelationships between the elements; a diagramming means for expressing the information held by the elements, the functions or roles, and the interrelationships between the elements as a diagram for identifying operational hazards of the autonomous ship and analyzing risks; and a diagram presentation means for presenting the expressed diagram. A risk analysis system for an autonomous ship, comprising: an element setting means for setting the functions or roles of the elements, the self-ship information acquisition means, the surrounding information acquisition means, and the information held by the shore staff as the elements, and functions or roles of the elements, and the interrelationships between the elements as a diagram for identifying operational hazards of the autonomous ship and analyzing risks; and a diagram presentation means for presenting the expressed diagram. The risk analysis system for an autonomous ship described in claim 23, characterized in that the diagramming means applies a class diagram of UML (Unified Modeling Language) to model the autonomous ship and the land control center and create a diagram. The risk analysis system for an autonomous ship described in claim 24, characterized in that the diagramming means generates a list that compiles a system column divided into the autonomous ship and the onshore control center, and a cause column, a result column, and a countermeasure column that describe the hazards, their causes, results, and countermeasures related to the components to be analyzed, as a worksheet for identifying and analyzing hazards by repeatedly brainstorming hypothetical questions to extract deviations from the norm. The risk analysis system for an autonomous ship according to any one of claims 23 to 25, characterized in that the diagramming means comprises a computer, the input means of the computer functions as the component setting means and the element relationship setting means, and the output means of the computer functions as the diagram presentation means. The risk analysis system for an autonomous ship according to any one of claims 23 to 26, characterized in that the diagram presentation means provides a predetermined format for the components and the interrelationships. A risk analysis system for an autonomous ship as described in claim 26, or claim 27 which cites claim 26, characterized in that the computer, the input means, and the output means are installed in different locations via an information and communication network.