A Systems-Theoretic approach to assessing the safety of autonomous inland waterway vessels: Towards the development of the SeaGuard tool

Journal of Physics: Conference Series PAPER • OPEN ACCESS A Systems-Theoretic approach to assessing the safety of autonomous inland waterway vessels: Towards the development of the SeaGuard tool To cite this article: Konstantinos Louzis et al 2025 J. Phys.: Conf. Ser. 3123 012030 View the article online for updates and enhancements. You may also like Safety Assessment and ExperienceBuilding Scheme Using Simulators for Automatic Collision Avoidance Algorithm Ryohei Sawada, Makiko Minami, Keiji Sato et al. - Concept Design of an Autonomous Navigation System enabling Intelligent Bridge Operations Andrea Pecoraro, Elisa Perrone, Emanuele Sansebastiano et al. - Enabling an AUTOnomous and FLEXible hinterland transport ecosystem: Main modal shift issues and potential transport solutions Kristoffer Kloch, Cyril Alias, Håvard Nordahl et al. - This content was downloaded from IP address 129.233.224.227 on 07/11/2025 at 08:55 Content from this work may be used under the terms of the Creative Commons Attribution 4.0 licence. Any further distribution of this work must maintain attribution to the author(s) and the title of the work, journal citation and DOI. Published under licence by IOP Publishing Ltd ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 1 A Systems-Theoretic approach to assessing the safety of autonomous inland waterway vessels: Towards the development of the SeaGuard tool Konstantinos Louzis*, Marios Koimtzoglou, Alexandros Koimtzoglou, Nikolaos P. Ventikos, Panayiotis Siokouros, Lianna Serafeim School of Naval Architecture and Marine Engineering, National Technical University of Athens (NTUA), Athens, Greece *E-mail: [email protected] Abstract. The increasing integration of automation in inland waterway transport introduces safety risks due to complex control dependencies and cyber-physical vulnerabilities. Traditional risk assessment methodologies are limited in addressing such systemic hazard s, particularly in the context of autonomous operations. This st udy applies the Systems-Theoretic Process Analysis (STPA) to evaluate the safety of a conceptual autonomous inland vessel developed under t he Horizon Europe AUTOFLEX project. The analysis identifies Uns afe Cont rol Actions (UCAs), causal scenarios, and safety const raints, while also integrating cybersecurity considerations through the STPA-SafeSec framework. The results inform the design of the SeaGuard tool—a real-time anomaly detection and safety monitoring module. The paper demonst rates a structured, integrated methodology for enhancing safety and cyber -resilience in next-generation autonomous inland waterway systems. 1. Introduction Inland Waterway Transport ( IWT) is evolving through increased integrati on of automation and autonomy, offering gains in operational efficiency and navigational precision (1). However, these advances introduce systemic safety challenges, due to software-driven control, reduced human oversight, and cyber-physical dependencies, as shown, e.g., by Spachtholz et al. that incre asing levels of autonomy introduce several new hazards compared to conventional inland vessels (2). Autonomous inland vessels are increasingly conceptualized as highly interconnected CyberPhysical Systems , CPS, (1), where system behaviour emerges not only from hardware and sensors, but also from control software, communication networks, and real-time decision-making processes. Furthermore, the absence of onboard crew places greater reliance on feedback accuracy, real-ti me coordination, and system integrity. This shifts the foc us of hazard identification beyond mechanical failure i nto unsafe interactions, degraded control loops, and timing mismatches. Such phenomena cannot be captured by methods originating from the reliability domain, such as Failure Mode and Effects Analysis ( FMEA) and Fault Tree Analysis (FTA) due to the underlying linear causality logic, which translates to an in ability to model ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 2 software faults or system-wide emergent behaviour inherent in autonomous systems (3). Furthermore, other hazard identification methods, such as Preliminary Hazard Analysis (PHA) often lack a structured approach and fail to capture interd ependencies, or cybersecurity threats (4). Other methodological challenges relate to the dependence on past failure d ata for quantifying risk, which are not available for systems such as autonomous ships. These constraints are especially problematic in early design phases, where information about system architecture is limited. A nother challenge that relates to increasin g levels of autonomy and CPSs in general is that cybersecurity becomes a critical di mension of safety analysis (5). Software-driven vessels are vulnerable to cyber incidents that may d isrupt control logic or feedback signals (6). For autonomous vessels, t hese challenges require risk assessment approaches that account for local operational constraints and system-level interactions between p hysical and cyber components (see 7). To overcome these limitations , systemic approache s such as the Systems-Theoretic Process Analysis (STPA) focus on safety as an emerging property from the system’s control structure rather than focusing on the failures of individual system components (8). STPA identifies Unsafe Control Actions (UCAs), their causal paths, and safety constraints necessary to prevent losses. In addition, STPA can effectively address both software failures and cyber-security issues (9) and some extensions to the base methodology have been proposed to add ress the relationship between cyber-securit y and safety. For example, the STPA-SafeSec extension captures integrity and availability threats by linking cyber-attacks to safety outcomes (10). To ensure safe autonomous operati on for vessels navigating in Inland Waterways (IWW), the Horizon Europe AUTOFLEX project designs such a vessel for confined waterways at the conceptual level that will b e equipped with the SeaGuard supervisory controller, w hich is being developed within the project and aims to s erve the specific needs of autonomous inland waterway navigation. SeaGuard is intended to be an online tool t hat d etects anomalies in terms of deviations from the safe system state (e.g. due to limited manoeuvring space and proximity to infrastructure), assesses the magnitude of the deviation in terms of the risk of compromising vessel capabiliti es, and suggests feasible measures for controlling risk; see (11) for a description of its functionalities. The main obj ective of this paper is to determine requirements for the behaviour of SeaGuard with respect to maintaining system safety and cybersecurity constraints. The methodology involves applying STPA with selected elements from STPA-SafeSec to the autonomous operati on of the AUTOFLEX vessel, for identifying UCAs, constraints, and loss scenarios that include both random failures and cybersecurity-related causes that can cascade in safety-related losses. The results will be used to inform the d evelopment of the algorithms that will accomplish the functionalities of SeaGuard. The rest of this paper is structured as follows: Section 2 provides a brief overview of related STPA applications in maritime systems. Section 3 outlines the methodology. Section 4 presents results related to the behaviour of SeaGuard for maintaining the safety of the vessel of interest. The paper concludes with a summary and outline of the next research steps. 2. Background STPA adopts a system-level perspective, modelling control actions, feedback loops, and identifying constraints to uncover causes that can lead to unsafe system states and losses. In the autonomous ship domain, there have been several applications of STPA for ocean-going vessels, often combined with other methodologies such as Bayesian Networks (BN). ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 3 Wro bel et al. applied STPA to a generic architecture of remotely controlled merchant vessels that included the vessel, shore facilities, the organizational environment, as well as the operational environment (12). Given the control structure uncertainties related to the early stages of development of this technology, the authors identified that the following factors will be important for ensuring safe operation: the reliability of the vessel’s systems, the availability of the communication between the vessel and shore-based facilities (e.g., for remote monitoring), as well as controls at the organizational and regulatory levels . Chaal et al. developed a framework for evaluating Risk Control Options (RCOs) in the design phase based on hazardous scenarios identified through STPA and a BN for quanti fying the resulting risk level (13) . The method was demonstrated in an autonomous seawater cooling system and the authors concluded that testing the software cont roller functionalities and integrating sensor health monitoring are expected to provide significant risk reduction for this system. Yang et al. adapted the conventional STPA to identify hazardous scenarios related to the transition between autonomy levels for autonomous marine systems with dynamic autonomy (i.e. that changes during operation) and considered the responsibility shifts between human and machine and how their process models need to be changed (14). Sumon et al. used STPA to determine the safest control mode (e.g., fully autonomous, operator-assisted etc.) for an autonomous s hip depending on the operati onal phase (e.g., port approach, berthing etc.) by comparing the UCAs and loss scenarios identified for the control structures that reflect the different control modes (15). The literature also includes some examples of inland-specific STPA applications. Zhang et al. applied the method to a remotely-controlled model of an inland vessel, which also includes an integrated risk assessment system, and evaluate the effectiveness of safety strategies in different autonomy levels ( 16). The authors conclude that the remote-control station, the communication between ship and shore, as well as the onboard virt ual captain have the most significant effect on system safety and that having some crew onboard may reduce the overall risk, compared to fully autonomous operati on. The cascading effects of cyber-attacks to system safety have been addressed methodologically by extending STPA with specific guidance to identify such hazardous scenarios, such as the work by de Souza et al who combine STPA with a threat model to expand the scope of the identified loss scenarios (17). STPA-SafeSec expands STPA by linking cybersecurity threats, such as spoofed sensor inputs or Denial-of-S ervice (DoS) attacks, to safety-critical failures through t he viol ation of cybersecurity const raints (10). The practical contributions include the definition of a component layer that is associated with the abstract control structure, and a causal factor taxonomy specific to the cybersecurity domain for integrity (e.g., command injection, measurement manipulation etc.) and availability (e.g., communication drop, node overload etc.) threats. Zhou et al. have developed the STPA-SynSS method to address the limitations of other frameworks, such as t he STPA-SafeSec, and applied to an autonomous ship concept (6). The method adds the identification of functional require ments associated to safety and cybersecurity constraints to inform the control structure, a mapping between the cont rol structure and system components to inform the loss scenarios. Gomola and Utne build on the STPA-SynSS to develop the STPA-SW-SAF-SEC approach, which extends the framework to consider the effect of software failures on system safety along the effect of intentional cyber-attacks (9). The authors use the Systems Modelling Language (SysML) for a more formal description of the system architecture and how it operates and use dynamic and static control structures, derived from corresponding system representations, to handle the complexity of software failures. ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 4 3. Methodology This study applies the STPA to identify potential loss scenarios in autonomous inland waterway operations, combined with elements from STPA-SafeSec, to examine how cybersecurity t hreats can lead to safety-related outcomes in the context of loss scenarios that emerge from the violation of system-level safety and cybersecurity constraints. The analysis at the component level with hardware-leve l mappings p roposed by STPA-SafeSec i s not used since the system of interest is being designed at the conceptual and preliminary stage. Our methodology applies the following four steps (see Figure 1), adapted from the STPA Handbook, to identify causal paths that may lead to system-level losses (8): 1. Identification of un acceptable losses, the system hazards that could lead to them, and the safety constraints required to prevent those hazard s. For example, for the systemlevel hazard “the vessel enters a restricted area” the associated safety constraint can be expressed as “the vessel must avoid restricted areas”. In this step, cyber-security constraints are also identified, as proposed by STPA-SafeSec, which can be vio lated by att acks targeting availability ( e.g. denial-of-service attacks etc.) and integrity ( e.g. spoofing, logic tampering etc.). 2. Representati on of the system as a hierarchy of controllers, actuators, and feedback mechanisms. Controllers i ssue commands based on sensor inputs and in ternal logic to achieve operational goals, while controlled processes respond and provid e feedback. 3. Identification of UCAs, which are control actions that may lead to system-level hazard s under worst-case environmental conditions and are categorized in the following four types: not provided when required; provided when inappropriate; issued too early, too late, or in the w rong sequence; applied for too long or terminated too soon. 4. Identification of Loss Scenarios, where the potential causes (e.g., degraded feedback, software bugs, or erroneous process models) that can lead to U CAs are examined. Loss scenarios can be traced to both physical fau lts (e.g., GNSS failure), which violate safety constraints, and cybersecurity-related tri ggers (e.g., sp oofed sensor inputs), which violate cybersecurity const raints. For identi fying potential cyber -attacks, we have used the taxonomy proposed by STPA-SafeSec. ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 5 Figure 1. Methodology for Safety and Cybersecurity Analysis. 4. Results This section describes the results from the implementation of t he methodology outlined in Chapter 3 to the conceptual autonomous inland waterway vessel developed within the context of the AUTOFLEX project. The AUTOFLEX vessel is designed to carry containerized cargo autonomously (i.e. without crew onboard and rem otely monitored) in confined inland waterways (see 18). In terms of propulsion, the vessel i s fully electric, equipped with two azimuth thrusters, powered by containerized battery packs that include an integrated fire suppression system. For navigation, the vessel relies on software controllers that are provided with data fused from sensors, including AIS, Radar, LiDAR, and infrared cameras. The operational context considered for the analysis is navigation during transit and port approach. 4.1 Define the Purpose of the Analysis This step i dentifies unacceptable losses in the AUTOFL EX operational context, the hazardous conditions that could lead to the losses, and the safety constraints required to prevent such hazard s (see Figure 2). The identi fied losses and associated system-level hazards have been based on the particularities affecti ng the safety of inland navigation, which include n arrow-channel geometries (i.e. limited manoeuvring space), seasonal depth variations, proximity to infrastructure, such as bridges and locks, as well as high vessel traffic density that also includes recreational users (see 19). In this context, t he analysis presented in this paper considers losses related to human life, the cargo, the vessel and infrastructure, and loss of vessel control. These losses have been associated with system-level hazards that relate to fire threatening the cargo and the structural integrity of the vessel, unsafe distance to other vessels and obstacles, navigation within restricted (i.e. “nogo”) areas, the power distribution among vessel subsystems, and unauthorized access to vessel control systems. ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 6 Figure 2. Mapping between losses (red), system-level hazards (orange), and safety constraints (green). The system-level hazards have been associated wi th s afety constraints that need to be maintained, as shown in Figure 2, as well as the following cybersecurity constraints, which protect the controllers’ internal logic against corrupted input (integrity requirement) and missing or untimely feedback (availability requirement): • CSTR-I-1: The integrity of all input data must be validated prior to issuing control actions. • CSTR-A-1: All i nput data must be available at the time required for issuing control actions. 4.2 Modelling the System’s Control Structure The AUTOFLEX vessel can be considered as a cyber-physical system, which integrates multiple subsystems that interact through feedback loops. The main controllers and their respons ibilities are shown in Table 1. Table 1. Identified controllers and their responsibilities in the control structure. Controller Responsibility Required feedback SeaControl Issues navigation commands for path planning and collision avoidance Fused sensor information from the situational awareness system SeaSight and current speed and heading from the AutoPilot AutoPilot Executes navigation commands provided by SeaControl Speed and heading from the propulsion and manoeuvring system. SeaGuard Monitors system state and intervenes when anomalies are detected (e.g., adjusting power distribution, activating fire suppression, or stopping the vessel) Information from all controllers regarding system status ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 7 Controller Responsibility Required feedback Remote Operations Centre (ROC) Provides remote monitoring and supervisory control if required Information from all controllers regarding system status Energy Management System (EMS) Ensures continuous and sufficient power delivery Information about power consumption onboard the vessel Emergency Systems Alarm system for detecting critical onboard conditions, e.g. fire detection Information from temperature sensors The control structure shown in Figure 3 p rovides the foundation for identifying UCAs in the following section. Figure 3. Control Structure of the AUTOFLEX Vessel (solid lines indicate Control Actions, dashed lines indicate Feedbac k). ICMASS-ISSS-2025 Journal of Physics: Conference Series 3123 (2025) 012030 IOP Publishing doi:10.1088/1742-6596/3123/1/012030 8 4.3 Identification of Unsafe Control Actions (UCAs) In total, 36 U CAs were identified for all cont rollers t hat have been included in the control structure shown in Figure 3. Table 2 lists selected UCAs for the control acti ons SeaGuard is responsible for. Each UCA is associated with the hazard(s) it may lead to, based on the context and timing of the action. Table 2. Unsafe Control Actions (UCAs) for SeaGuard. Control Action UCA Type Description 1.1 Adjust power distribution Provided when not required Adjusts power when subsystems are already stable, destabilizing control functions [H1, H3, H4] 1.2 Activate suppression system Not provided Does not activate the fire suppression system upon fire detection, allowing it to spread [H2] 1.3 Activate suppression system Applied too long/ stopped too soon Disables the fire suppression system before the fire is fully resolved, allowing it to rekindle and spread [H2] 1.4 Override AutoPilot Incorrect timing Reduces speed too late when the vessel is on a collision course with an obstacle or another vessel without leaving enough time to avoid the collision [H3] 1.5 Override AutoPilot Not provided Does not stop the vessel when approaching a low-clearance bridge [H3] The following constraints have been identified for SeaGuard to avoid executin g control actions in an unsafe way: • C1: SeaGuard must adjust power distribution to safety-critical subsystems immediately after verifying power is insufficient [UCA1.1]. • C2: SeaGuard must activate the fire suppression system immediately after a fire has been detected and the presence of fire has been verified [UCA1.2]. • C3: SeaGuard must disable the fi re suppression system after verifying t hat the fire has been successfully extinguished [UCA1.3]. • C4: SeaGuard must reduce vessel speed after verifying that the vessel is on a collision course, has non-zero speed, and SeaControl is not fulfilling its responsibility of initiating collision avoidance manoeuvres, to a magnitude and at a time that mitigates the severity of the collision or increases the likelihood of avoiding it [UCA1.4]. • C5: SeaGuard must stop the vessel after verifying that the vessel is approaching a lowclearance bridge, and SeaControl is not fulfilling its responsibility of avoiding the collision with the bridge, at a time that mitigates the severity of the collision or increases the likelihood of avoidi ng it [UCA1.5]. 4.4 Identification of Loss Scenarios The causal factors that have been id entified in the loss scenarios are related to the process model of SeaGuard, random faults, and cyber-attacks that violate the i ntegrity and availability