Jou nal o Physics:
Con e ence Se ies
PAPER • OPEN ACCESS
A Sys ems-Theo e ic app oach o assessing he
sa e y o au onomous inland wa e way essels:
Towa ds he de elopmen o he SeaGua d ool
To ci e his a icle: Kons an inos Louzis
e al
2025
J. Phys.: Con . Se .
3123 012030
View he a icle online o upda es and enhancemen s.
You may also like
Sa e y Assessmen and Expe ience-
Building Scheme Using Simula o s o
Au oma ic Collision A oidance Algo i hm
Ryohei Sawada, Makiko Minami, Keiji Sa o
e al.
-
Concep Design o an Au onomous
Na iga ion Sys em enabling In elligen
B idge Ope a ions
And ea Peco a o, Elisa Pe one,
Emanuele Sansebas iano e al.
-
Enabling an AUTOnomous and FLEXible
hin e land anspo ecosys em: Main
modal shi issues and po en ial anspo
solu ions
K is o e Kloch, Cy il Alias, Hå a d
No dahl e al.
-
This con en was downloaded om IP add ess 129.233.224.227 on 07/11/2025 a 08:55
Con en om his wo k may be used unde he e ms o he C ea i e Commons A ibu ion 4.0 licence. Any u he dis ibu ion
o his wo k mus main ain a ibu ion o he au ho (s) and he i le o he wo k, jou nal ci a ion and DOI.
Published unde licence by IOP Publishing L d
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
1
A Sys ems-Theo e ic app oach o assessing
he sa e y o au onomous inland wa e way
essels: Towa ds he de elopmen o he
SeaGua d ool
Kons an inos Louzis*, Ma ios Koim zoglou, Alexand os Koim zoglou,
Nikolaos P. Ven ikos, Panayio is Siokou os, Lianna Se a eim
School o Na al A chi ec u e and Ma ine Enginee ing, Na ional Technical
Uni e si y o A hens (NTUA), A hens, G eece
*E-mail: [email protected] ua.g
Abs ac . The inc easing in eg a ion o au oma ion in inland wa e way anspo
in oduces sa e y isks due o complex con ol dependencies and cybe -physical
ulne abili ies. T adi ional isk assessmen me hodologies a e limi ed in
add essing such sys emic haza d s, pa icula ly in he con ex o au onomous
ope a ions. This s udy applies he Sys ems-Theo e ic P ocess Analysis (STPA) o
e alua e he sa e y o a concep ual au onomous inland essel de eloped unde he
Ho izon Eu ope AUTOFLEX p ojec . The analysis iden i ies Uns a e Con ol Ac ions
(UCAs), causal scena ios, and sa e y cons ain s, while also in eg a ing
cybe secu i y conside a ions h ough he STPA-Sa eSec amewo k. The esul s
in o m he design o he SeaGua d ool—a eal- ime anomaly de ec ion and sa e y
moni o ing module. The pape demons a es a s uc u ed, in eg a ed
me hodology o enhancing sa e y and cybe - esilience in nex -gene a ion
au onomous inland wa e way sys ems.
1. In oduc ion
Inland Wa e way T anspo ( IWT) is e ol ing h ough inc eased in eg a i on o au oma ion and
au onomy, o e ing gains in ope a ional e iciency and na iga ional p ecision (1). Howe e , hese
ad ances in oduce sys emic sa e y challenges, due o so wa e-d i en con ol, educed human
o e sigh , and cybe -physical dependencies, as shown, e.g., by Spach holz e al. ha inc e asing
le els o au onomy in oduce se e al new haza ds compa ed o con en ional inland essels (2).
Au onomous inland essels a e inc easingly concep ualized as highly in e connec ed Cybe -
Physical Sys ems , CPS, (1), whe e sys em beha iou eme ges no only om ha dwa e and senso s,
bu also om con ol so wa e, communica ion ne wo ks, and eal- ime decision-making
p ocesses. Fu he mo e, he absence o onboa d c ew places g ea e eliance on eedback
accu acy, eal- i me coo dina ion, and sys em in eg i y. This shi s he oc us o haza d
iden i ica ion beyond mechanical ailu e i n o unsa e in e ac ions, deg aded con ol loops, and
iming misma ches. Such phenomena canno be cap u ed by me hods o igina ing om he
eliabili y domain, such as Failu e Mode and E ec s Analysis ( FMEA) and Faul T ee Analysis
(FTA) due o he unde lying linea causali y logic, which ansla es o an in abili y o model
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
2
so wa e aul s o sys em-wide eme gen beha iou inhe en in au onomous sys ems (3).
Fu he mo e, o he haza d iden i ica ion me hods, such as P elimina y Haza d Analysis (PHA)
o en lack a s uc u ed app oach and ail o cap u e in e d ependencies, o cybe secu i y h ea s
(4). O he me hodological challenges ela e o he dependence on pas ailu e d a a o quan i ying
isk, which a e no a ailable o sys ems such as au onomous ships. These cons ain s a e
especially p oblema ic in ea ly design phases, whe e in o ma ion abou sys em a chi ec u e is
limi ed. A no he challenge ha ela es o inc easin g le els o au onomy and CPSs in gene al is ha
cybe secu i y becomes a c i ical di mension o sa e y analysis (5). So wa e-d i en essels a e
ulne able o cybe inciden s ha may d is up con ol logic o eedback signals (6). Fo
au onomous essels, hese challenges equi e isk assessmen app oaches ha accoun o local
ope a ional cons ain s and sys em-le el in e ac ions be ween p hysical and cybe componen s
(see 7).
To o e come hese limi a ions , sys emic app oache s such as he Sys ems-Theo e ic P ocess
Analysis (STPA) ocus on sa e y as an eme ging p ope y om he sys em’s con ol s uc u e
a he han ocusing on he ailu es o indi idual sys em componen s (8). STPA iden i ies Unsa e
Con ol Ac ions (UCAs), hei causal pa hs, and sa e y cons ain s necessa y o p e en losses. In
addi ion, STPA can e ec i ely add ess bo h so wa e ailu es and cybe -secu i y issues (9) and
some ex ensions o he base me hodology ha e been p oposed o add ess he ela ionship
be ween cybe -secu i y and sa e y. Fo example, he STPA-Sa eSec ex ension cap u es in eg i y
and a ailabili y h ea s by linking cybe -a acks o sa e y ou comes (10).
To ensu e sa e au onomous ope a i on o essels na iga ing in Inland Wa e ways (IWW), he
Ho izon Eu ope AUTOFLEX p ojec designs such a essel o con ined wa e ways a he
concep ual le el ha will b e equipped wi h he SeaGua d supe iso y con olle , w hich is being
de eloped wi hin he p ojec and aims o s e e he speci ic needs o au onomous inland wa e way
na iga ion. SeaGua d is in ended o be an online ool ha d e ec s anomalies in e ms o de ia ions
om he sa e sys em s a e (e.g. due o limi ed manoeu ing space and p oximi y o
in as uc u e), assesses he magni ude o he de ia ion in e ms o he isk o comp omising
essel capabili i es, and sugges s easible measu es o con olling isk; see (11) o a desc ip ion
o i s unc ionali ies. The main obj ec i e o his pape is o de e mine equi emen s o he
beha iou o SeaGua d wi h espec o main aining sys em sa e y and cybe secu i y cons ain s.
The me hodology in ol es applying STPA wi h selec ed elemen s om STPA-Sa eSec o he
au onomous ope a i on o he AUTOFLEX essel, o iden i ying UCAs, cons ain s, and loss
scena ios ha include bo h andom ailu es and cybe secu i y- ela ed causes ha can cascade in
sa e y- ela ed losses. The esul s will be used o in o m he d e elopmen o he algo i hms ha
will accomplish he unc ionali ies o SeaGua d.
The es o his pape is s uc u ed as ollows: Sec ion 2 p o ides a b ie o e iew o ela ed
STPA applica ions in ma i ime sys ems. Sec ion 3 ou lines he me hodology. Sec ion 4 p esen s
esul s ela ed o he beha iou o SeaGua d o main aining he sa e y o he essel o in e es .
The pape concludes wi h a summa y and ou line o he nex esea ch s eps.
2. Backg ound
STPA adop s a sys em-le el pe spec i e, modelling con ol ac ions, eedback loops, and
iden i ying cons ain s o unco e causes ha can lead o unsa e sys em s a es and losses. In he
au onomous ship domain, he e ha e been se e al applica ions o STPA o ocean-going essels,
o en combined wi h o he me hodologies such as Bayesian Ne wo ks (BN).
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
3
W o bel e al. applied STPA o a gene ic a chi ec u e o emo ely con olled me chan essels
ha included he essel, sho e acili ies, he o ganiza ional en i onmen , as well as he
ope a ional en i onmen (12). Gi en he con ol s uc u e unce ain ies ela ed o he ea ly s ages
o de elopmen o his echnology, he au ho s iden i ied ha he ollowing ac o s will be
impo an o ensu ing sa e ope a ion: he eliabili y o he essel’s sys ems, he a ailabili y o he
communica ion be ween he essel and sho e-based acili ies (e.g., o emo e moni o ing), as
well as con ols a he o ganiza ional and egula o y le els . Chaal e al. de eloped a amewo k
o e alua ing Risk Con ol Op ions (RCOs) in he design phase based on haza dous scena ios
iden i ied h ough STPA and a BN o quan i ying he esul ing isk le el (13) . The me hod was
demons a ed in an au onomous seawa e cooling sys em and he au ho s concluded ha es ing
he so wa e con olle unc ionali ies and in eg a ing senso heal h moni o ing a e expec ed o
p o ide signi ican isk educ ion o his sys em. Yang e al. adap ed he con en ional STPA o
iden i y haza dous scena ios ela ed o he ansi ion be ween au onomy le els o au onomous
ma ine sys ems wi h dynamic au onomy (i.e. ha changes du ing ope a ion) and conside ed he
esponsibili y shi s be ween human and machine and how hei p ocess models need o be
changed (14). Sumon e al. used STPA o de e mine he sa es con ol mode (e.g., ully
au onomous, ope a o -assis ed e c.) o an au onomous s hip depending on he ope a i onal phase
(e.g., po app oach, be hing e c.) by compa ing he UCAs and loss scena ios iden i ied o he
con ol s uc u es ha e lec he di e en con ol modes (15).
The li e a u e also includes some examples o inland-speci ic STPA applica ions. Zhang e al.
applied he me hod o a emo ely-con olled model o an inland essel, which also includes an
in eg a ed isk assessmen sys em, and e alua e he e ec i eness o sa e y s a egies in di e en
au onomy le els ( 16). The au ho s conclude ha he emo e-con ol s a ion, he communica ion
be ween ship and sho e, as well as he onboa d i ual cap ain ha e he mos signi ican e ec on
sys em sa e y and ha ha ing some c ew onboa d may educe he o e all isk, compa ed o ully
au onomous ope a i on.
The cascading e ec s o cybe -a acks o sys em sa e y ha e been add essed
me hodologically by ex ending STPA wi h speci ic guidance o iden i y such haza dous scena ios,
such as he wo k by de Souza e al who combine STPA wi h a h ea model o expand he scope o
he iden i ied loss scena ios (17). STPA-Sa eSec expands STPA by linking cybe secu i y h ea s,
such as spoo ed senso inpu s o Denial-o -S e ice (DoS) a acks, o sa e y-c i ical ailu es
h ough he iol a ion o cybe secu i y cons ain s (10). The p ac ical con ibu ions include he
de ini ion o a componen laye ha is associa ed wi h he abs ac con ol s uc u e, and a causal
ac o axonomy speci ic o he cybe secu i y domain o in eg i y (e.g., command injec ion,
measu emen manipula ion e c.) and a ailabili y (e.g., communica ion d op, node o e load e c.)
h ea s. Zhou e al. ha e de eloped he STPA-SynSS me hod o add ess he limi a ions o o he
amewo ks, such as he STPA-Sa eSec, and applied o an au onomous ship concep (6). The
me hod adds he iden i ica ion o unc ional equi e men s associa ed o sa e y and cybe secu i y
cons ain s o in o m he con ol s uc u e, a mapping be ween he con ol s uc u e and sys em
componen s o in o m he loss scena ios. Gomola and U ne build on he STPA-SynSS o de elop
he STPA-SW-SAF-SEC app oach, which ex ends he amewo k o conside he e ec o so wa e
ailu es on sys em sa e y along he e ec o in en ional cybe -a acks (9). The au ho s use he
Sys ems Modelling Language (SysML) o a mo e o mal desc ip ion o he sys em a chi ec u e
and how i ope a es and use dynamic and s a ic con ol s uc u es, de i ed om co esponding
sys em ep esen a ions, o handle he complexi y o so wa e ailu es.
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
4
3. Me hodology
This s udy applies he STPA o iden i y po en ial loss scena ios in au onomous inland wa e way
ope a ions, combined wi h elemen s om STPA-Sa eSec, o examine how cybe secu i y h ea s
can lead o sa e y- ela ed ou comes in he con ex o loss scena ios ha eme ge om he iola ion
o sys em-le el sa e y and cybe secu i y cons ain s. The analysis a he componen le el wi h
ha dwa e-le e l mappings p oposed by STPA-Sa eSec i s no used since he sys em o in e es is
being designed a he concep ual and p elimina y s age.
Ou me hodology applies he ollowing ou s eps (see Figu e 1), adap ed om he STPA
Handbook, o iden i y causal pa hs ha may lead o sys em-le el losses (8):
1. Iden i ica ion o un accep able losses, he sys em haza ds ha could lead o hem, and
he sa e y cons ain s equi ed o p e en hose haza d s. Fo example, o he sys em-
le el haza d “ he essel en e s a es ic ed a ea” he associa ed sa e y cons ain can
be exp essed as “ he essel mus a oid es ic ed a eas”. In his s ep, cybe -secu i y
cons ain s a e also iden i ied, as p oposed by STPA-Sa eSec, which can be io la ed
by a acks a ge ing a ailabili y ( e.g. denial-o -se ice a acks e c.) and in eg i y ( e.g.
spoo ing, logic ampe ing e c.).
2. Rep esen a i on o he sys em as a hie a chy o con olle s, ac ua o s, and eedback
mechanisms. Con olle s i ssue commands based on senso inpu s and in e nal logic
o achie e ope a ional goals, while con olled p ocesses espond and p o id e
eedback.
3. Iden i ica ion o UCAs, which a e con ol ac ions ha may lead o sys em-le el
haza d s unde wo s -case en i onmen al condi ions and a e ca ego ized in he
ollowing ou ypes: no p o ided when equi ed; p o ided when inapp op ia e;
issued oo ea ly, oo la e, o in he w ong sequence; applied o oo long o e mina ed
oo soon.
4. Iden i ica ion o Loss Scena ios, whe e he po en ial causes (e.g., deg aded eedback,
so wa e bugs, o e oneous p ocess models) ha can lead o U CAs a e examined.
Loss scena ios can be aced o bo h physical au l s (e.g., GNSS ailu e), which iola e
sa e y cons ain s, and cybe secu i y- ela ed i gge s (e.g., sp oo ed senso inpu s),
which iola e cybe secu i y cons ain s. Fo iden i ying po en ial cybe -a acks, we
ha e used he axonomy p oposed by STPA-Sa eSec.
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
5
Figu e 1. Me hodology o Sa e y and Cybe secu i y Analysis.
4. Resul s
This sec ion desc ibes he esul s om he implemen a ion o he me hodology ou lined in
Chap e 3 o he concep ual au onomous inland wa e way essel de eloped wi hin he con ex o
he AUTOFLEX p ojec .
The AUTOFLEX essel is designed o ca y con aine ized ca go au onomously (i.e. wi hou
c ew onboa d and em o ely moni o ed) in con ined inland wa e ways (see 18). In e ms o
p opulsion, he essel i s ully elec ic, equipped wi h wo azimu h h us e s, powe ed by
con aine ized ba e y packs ha include an in eg a ed i e supp ession sys em. Fo na iga ion,
he essel elies on so wa e con olle s ha a e p o ided wi h da a used om senso s, including
AIS, Rada , LiDAR, and in a ed came as. The ope a ional con ex conside ed o he analysis is
na iga ion du ing ansi and po app oach.
4.1 De ine he Pu pose o he Analysis
This s ep i den i ies unaccep able losses in he AUTOFL EX ope a ional con ex , he haza dous
condi ions ha could lead o he losses, and he sa e y cons ain s equi ed o p e en such
haza d s (see Figu e 2).
The iden i ied losses and associa ed sys em-le el haza ds ha e been based on he
pa icula i ies a ec i ng he sa e y o inland na iga ion, which include n a ow-channel geome ies
(i.e. limi ed manoeu ing space), seasonal dep h a ia ions, p oximi y o in as uc u e, such as
b idges and locks, as well as high essel a ic densi y ha also includes ec ea ional use s (see
19). In his con ex , he analysis p esen ed in his pape conside s losses ela ed o human li e, he
ca go, he essel and in as uc u e, and loss o essel con ol. These losses ha e been associa ed
wi h sys em-le el haza ds ha ela e o i e h ea ening he ca go and he s uc u al in eg i y o
he essel, unsa e dis ance o o he essels and obs acles, na iga ion wi hin es ic ed (i.e. “no-
go”) a eas, he powe dis ibu ion among essel subsys ems, and unau ho ized access o essel
con ol sys ems.
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
6
Figu e 2. Mapping be ween losses ( ed), sys em-le el haza ds (o ange), and sa e y cons ain s (g een).
The sys em-le el haza ds ha e been associa ed wi h s a e y cons ain s ha need o be
main ained, as shown in Figu e 2, as well as he ollowing cybe secu i y cons ain s, which p o ec
he con olle s’ in e nal logic agains co up ed inpu (in eg i y equi emen ) and missing o
un imely eedback (a ailabili y equi emen ):
• CSTR-I-1: The in eg i y o all inpu da a mus be alida ed p io o issuing con ol
ac ions.
• CSTR-A-1: All i npu da a mus be a ailable a he ime equi ed o issuing con ol
ac ions.
4.2 Modelling he Sys em’s Con ol S uc u e
The AUTOFLEX essel can be conside ed as a cybe -physical sys em, which in eg a es mul iple
subsys ems ha in e ac h ough eedback loops. The main con olle s and hei espons ibili ies
a e shown in Table 1.
Table 1. Iden i ied con olle s and hei esponsibili ies in he con ol s uc u e.
Con olle
Responsibili y
Requi ed eedback
SeaCon ol
Issues na iga ion commands o pa h
planning and collision a oidance
Fused senso in o ma ion om he
si ua ional awa eness sys em SeaSigh
and cu en speed and heading om
he Au oPilo
Au oPilo
Execu es na iga ion commands
p o ided by SeaCon ol
Speed and heading om he p opulsion
and manoeu ing sys em.
SeaGua d
Moni o s sys em s a e and in e enes
when anomalies a e de ec ed (e.g.,
adjus ing powe dis ibu ion, ac i a ing
i e supp ession, o s opping he
essel)
In o ma ion om all con olle s
ega ding sys em s a us
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
7
Con olle
Responsibili y
Requi ed eedback
Remo e
Ope a ions Cen e
(ROC)
P o ides emo e moni o ing and
supe iso y con ol i equi ed
In o ma ion om all con olle s
ega ding sys em s a us
Ene gy
Managemen
Sys em (EMS)
Ensu es con inuous and su icien
powe deli e y
In o ma ion abou powe consump ion
onboa d he essel
Eme gency
Sys ems
Ala m sys em o de ec ing c i ical
onboa d condi ions, e.g. i e de ec ion
In o ma ion om empe a u e senso s
The con ol s uc u e shown in Figu e 3 p o ides he ounda ion o iden i ying UCAs in he
ollowing sec ion.
Figu e 3. Con ol S uc u e o he AUTOFLEX Vessel (solid lines indica e Con ol Ac ions,
dashed lines indica e Feedbac k).
ICMASS-ISSS-2025
Jou nal o Physics: Con e ence Se ies 3123 (2025) 012030
IOP Publishing
doi:10.1088/1742-6596/3123/1/012030
8
4.3 Iden i ica ion o Unsa e Con ol Ac ions (UCAs)
In o al, 36 U CAs we e iden i ied o all con olle s ha ha e been included in he con ol s uc u e
shown in Figu e 3. Table 2 lis s selec ed UCAs o he con ol ac i ons SeaGua d is esponsible o .
Each UCA is associa ed wi h he haza d(s) i may lead o, based on he con ex and iming o he
ac ion.
Table 2. Unsa e Con ol Ac ions (UCAs) o SeaGua d.
Con ol Ac ion
UCA Type
Desc ip ion
1.1 Adjus powe
dis ibu ion
P o ided when no
equi ed
Adjus s powe when subsys ems a e al eady s able,
des abilizing con ol unc ions [H1, H3, H4]
1.2 Ac i a e
supp ession
sys em
No p o ided
Does no ac i a e he i e supp ession sys em upon i e
de ec ion, allowing i o sp ead [H2]
1.3 Ac i a e
supp ession
sys em
Applied oo long/
s opped oo soon
Disables he i e supp ession sys em be o e he i e is ully
esol ed, allowing i o ekindle and sp ead [H2]
1.4 O e ide
Au oPilo
Inco ec iming
Reduces speed oo la e when he essel is on a collision
cou se wi h an obs acle o ano he essel wi hou lea ing
enough ime o a oid he collision [H3]
1.5 O e ide
Au oPilo
No p o ided
Does no s op he essel when app oaching a low-clea ance
b idge [H3]
The ollowing cons ain s ha e been iden i ied o SeaGua d o a oid execu in g con ol
ac ions in an unsa e way:
• C1: SeaGua d mus adjus powe dis ibu ion o sa e y-c i ical subsys ems
immedia ely a e e i ying powe is insu icien [UCA1.1].
• C2: SeaGua d mus ac i a e he i e supp ession sys em immedia ely a e a i e has
been de ec ed and he p esence o i e has been e i ied [UCA1.2].
• C3: SeaGua d mus disable he i e supp ession sys em a e e i ying ha he i e
has been success ully ex inguished [UCA1.3].
• C4: SeaGua d mus educe essel speed a e e i ying ha he essel is on a collision
cou se, has non-ze o speed, and SeaCon ol is no ul illing i s esponsibili y o
ini ia ing collision a oidance manoeu es, o a magni ude and a a ime ha mi iga es
he se e i y o he collision o inc eases he likelihood o a oiding i [UCA1.4].
• C5: SeaGua d mus s op he essel a e e i ying ha he essel is app oaching a low-
clea ance b idge, and SeaCon ol is no ul illing i s esponsibili y o a oiding he
collision wi h he b idge, a a ime ha mi iga es he se e i y o he collision o
inc eases he likelihood o a oidi ng i [UCA1.5].
4.4 Iden i ica ion o Loss Scena ios
The causal ac o s ha ha e been id en i ied in he loss scena ios a e ela ed o he p ocess model
o SeaGua d, andom aul s, and cybe -a acks ha iola e he i n eg i y and a ailabili y
