Introduction: Why MASS Are Often Misunderstood
Compared with other technologically advanced sectors such as mechanical engineering, aeronautics — and even more so the automotive industry — the maritime sector has, for many decades, remained anchored to traditional paradigms, evolving at a significantly slower pace. The reasons are partly objective: ships require systems and equipment of considerable complexity, size and cost, factors that make rapid innovation difficult to implement. However, this delay has also been influenced by cultural elements and by a strong industry tradition that has not always been inclined towards change.
As early as the mid-1950s, the first machinery automation systems began to appear, followed in the early 1970s by automatic pilots. By the mid-1990s, together with the introduction of GPS, some vessels were equipped with early touch-screen radars, rudimentary forms of electronic charting, and interfaces that — at least in theory — could have enabled ships to conduct voyages with a degree of autonomy, including collision and grounding prevention capabilities.
However, these systems were rarely used to their full potential. Limited trust from operators and a cautious investment approach by shipping companies — within a strongly traditional sector — restricted their adoption, consequently slowing both technological development and operational validation.
Over the past 15–20 years, the scenario has changed radically. The maritime industry now appears determined to recover lost ground, and numerous technological innovations, together with increasingly advanced levels of automation, are progressively being implemented on board.
Today, the pace of development is so rapid that regulators struggle to keep up. Terminology and classification associated with these new technologies are often unclear or inconsistently applied, further complicating regulatory development and implementation.
The proliferation of articles that frequently confuse the terms automation and autonomy, or use them inaccurately, contributes to public misunderstanding of the real characteristics, capabilities and even the vulnerabilities of a Maritime Autonomous Surface Ship — commonly referred to by the acronym MASS.
This article aims to clarify some fundamental concepts using official terminology and definitions derived from regulatory bodies and recognised standards, separating media narrative from operational reality.
The IMO Definition of MASS
Although the definitions provided by the IMO may not always fully clarify the distinction between automation and autonomy, it is not possible to disregard them. The starting point must therefore be the terminology contained in the Consolidated Version of the Draft International Code of Safety for Maritime Autonomous Surface Ships (MASS Code) currently under study by IMO.
According to the draft Code:
Maritime Autonomous Surface Ship (MASS): means a ship which, to a varying degree, can operate independent of human interaction.
Automatic: means processes or equipment that, under specified conditions, can function without human control.
Automated functions: means automated processes, parts of the system that may be automated when it is not the ship being considered as one whole.
Autonomous: means processes or equipment in a MASS system which, under certain conditions, are designed and verified to be controlled by automation, without human assistance.
Autonomous functions: are functions (or complete ships) that may operate in complex and open-ended environments with high levels of independence and self-determination. They perceive, learn, reason and respond intelligently and appropriately to unforeseen changes in the environment.
One of the clearest and most important statements in the draft Code, together with the definition of Autonomous Functions above, is the following:
Enhanced automation does not qualify a ship as a Maritime Autonomous Surface Ship (MASS). The main qualifier to distinguish a MASS from a conventional ship is that some or all functions of the ship, as performed by humans, both aboard and ashore, are augmented by advanced automation and remote operations.
Automation vs Autonomy in the Maritime context
The shipping industry is not unfamiliar with formal definitions and classifications of automation. For decades, Classification Societies have issued additional class notations related to automation — some of them highly complex. It must also be acknowledged that Societies even in order to answer to certain market’ requests have sometimes developed ad hoc additional notations to emphasise the distinctive characteristics of particular ships, which has not always reduced confusion.
A few examples from Lloyd’s Register Rules of Classification include:
UMS (Unattended Machinery Spaces): assigned when arrangements allow the ship to operate with machinery spaces unattended.
IP: assigned when propulsion equipment and all essential auxiliary machinery are integrated with the power unit for operation under all normal sea-going and manoeuvring conditions. The system is bridge-controlled and incorporates an emergency means of propulsion in the event of prime mover failure.
IBS (Integrated Bridge System): assigned where an integrated bridge system provides electronic chart display, track planning and automatic track following, centralised navigation information display, and bridge alarm management.
However, even a combination of such notations does not, by any means, indicate that a ship is autonomous.
A ship becomes autonomous — to varying degrees — when it embeds Autonomous Functions. In other words, when at least some automated processes are no longer directly supervised by a human but are overseen by additional advanced automation processes.
It is important to understand that there are different interpretations of autonomy levels. Various regulators and major stakeholders have proposed different frameworks.
IMO, outside the Code itself, has identified four degrees of autonomy:
Degree One: Ship with automated processes and decision support. Seafarers are on board to operate and control systems. Some operations may be automated and occasionally unsupervised, but seafarers remain ready to take control.
Degree Two: Remotely controlled ship with seafarers on board. The ship is controlled from another location. Seafarers are available on board to take control.
Degree Three: Remotely controlled ship without seafarers on board. Control is exercised from another location; no seafarers are on board.
Degree Four: Fully autonomous ship. The operating system is capable of making decisions and determining actions independently.
Lloyd’s Register proposes seven levels; Bureau Veritas proposes five; other Classification Societies and national authorities have developed their own classifications.
There are also scholars who question the usefulness of autonomy levels and argue that full autonomy may not be relevant for MASS.
In their article “A Criticism of Proposed Levels of Autonomy for MASS”, Ørnulf Jan Rødseth and Lars Andrea Lien argue that autonomy should be considered a binary concept: a ship is either autonomous or it is not, depending on its Operational Envelope.
They explain that automation performs the same function in both cases, but autonomy arises when automation can be trusted to control processes or equipment under specified conditions.
Using the example of a ship’s autopilot:
The autopilot is autonomous with respect to safe sailing when there are no obstacles ahead. Automation can be trusted if there is no foreseeable risk of collision for a sufficient time.
The autopilot is automatic in areas with obstacles. An operator must continuously assess safety and intervene if necessary. Automation cannot be trusted for the full operational scope.
The autopilot may be autonomous in areas with obstacles if connected to an anti-collision radar capable of issuing timely alerts. It can then be trusted until the alert is activated.
One may add that if the radar is a true ARPA system and interfaced with the autopilot, autonomy may extend even to congested traffic situations. However, without integration with electronic charts and echo-sounder data, the autopilot can only be trusted in open waters without grounding risk.
The autopilot performs the same automated function in all cases. The difference lies in whether it can be trusted to operate without human supervision. This is captured in the phrase “under certain conditions”. Autonomy, therefore, is a property that either exists or does not exist; it cannot inherently be graded.
Another argument advanced in the same article — that full autonomy is not particularly relevant for MASS — falls outside the scope of this discussion.
In conclusion:
Automation ≠ Autonomy.
Automation enables autonomy, and in practice the boundary between them may appear blurred.
https://www.researchgate.net/publication/374146421A_Criticism_of_Proposed_Levels_of_Autonomy_for_MASS
Other Important Definitions and Concepts
Operational Design Domain (ODD): A document defining the conditions, control modes and operational modes under which a specific autonomous or remote-operated function is designed to operate.
Operational Envelope (OE): The description of the ship’s operational capabilities and limitations, including ship-specific technical limitations and the scope of human operations.
Fallback State: A predefined safe state entered when autonomous or remote-controlled functions cannot remain within the Operational Envelope.
Override: The act of a human operator superseding the system’s operational authority, regardless of whether the system has deviated from the ODD.
The Operational Envelope in Practice
The Operational Envelope is the set of environmental, technical and operational conditions within which an autonomous ship can operate safely, with or without human intervention.
It includes:
Environmental Conditions : Wind limits /Sea state /Visibility/Current strength/Traffic density/Ice conditions/Temperature ranges
Ship Technical Limits:Maximum safe speed/Manoeuvring capability/Turning rate/Sensor range and limitations/Propulsion and steering reliability
Communication requirements for remote control: Operational Restrictions/Operation limited to predefined areas/Normal operations only/Restrictions in congested waterways/Passing distance limits/Defined fallback modes
Why the Operational Envelope Matters
From a safety perspective, the autonomous system must remain within the OE to ensure safe behaviour.
To simplify we can state that the OE is greater and includes the ODD. If conditions exceed the ODD — for example due to weather or traffic complexity — the ship must still remain within its Operational Envelope. The system must then:
Alert the Remote Operations Centre (ROC) / Transfer control to a human operator /Enter a predefined safe state
Simple Examples :
Example 1 – Low Autonomy (Autopilot Level)
If Sea State ≤ 6, visibility > 1 NM, no traffic within 2 NM, and navigation sensors are available, the ship may operate autonomously.
If these conditions are exceeded, human intervention is required, and the ship remains within the OE.
*Example 2 – Remote-Controlled Autonomous Ship*
If limited to daylight operation, fair weather, restricted coastal areas, full sensor functionality and communication latency below defined thresholds, the ship operates within its OE.
If any condition is violated, it transitions to remote control or safe-state procedures.
In conceptual terms, to operate within the ODD, the MASS must have an OE that encompasses the ODD.
If the ODD represents the “machine” capabilities and the OE represents the complete MASS system — machine plus human intervention — then as autonomous capability increases, the difference between ODD and OE decreases.
In a purely theoretical case where no human intervention is ever required, ODD and OE would coincide.
New Risks Introduced by MASS
One of the main drivers behind these developments is to increase the safety of shipping and decrease the number of accidents that can cause significant harm to humans and the environment. According to the European Maritime Safety Agency (EMSA), erroneous human action was found to be the main contributing cause in 65% of all recorded accidents (EMSA 2019) and in 78% of recorded navigational accidents (EMSA 2022). In some studies, the portion of human-caused accidents has been estimated to be even higher (Fan et al. 2018).
To state that removing humans from the loop will immediately decrease the number of incidents is per se an obviously wrong conclusion because it does not take into account the exceedingly high number of incidents and accidents prevented precisely by human decisions and actions. Still, it is possible that over time and under many conditions, autonomous vessels will be safer.
Safer, but with new risks to be considered. We will see that those risks are not only the ones related to navigation, but if for a moment we wish to limit ourselves to navigation, putting aside all other complex systems which are necessary for a MASS, we can make the following considerations.
Traditionally, ship operations have relied on the physical presence of officers on the bridge, maintaining a 24-hour watchkeeping system. Navigational safety has been ensured through human capabilities, employing all available means for lookout and decision-making. However, in this new paradigm, computer vision, lidar, and extra sensors enable ships to be autonomous or controlled either partially or entirely from locations outside the vessel. The degradation of those sensors may cause serious problems to the MASS, and redundancy is not always the solution. The MASS will have to enter remote controlled mode or a DEGRADED STATE.
As we have explained briefly in the previous section, it might happen that some events, despite redundancy of equipment and safeguards, may lead to the vessel operating outside its ODD while still remaining within the Operational Envelope — a condition classified as a DEGRADED STATE. This state is a totally new risk or, better, “hazardous condition” which has to be fully assessed in order for the MASS to remain within the O.E..
Similar events like degradation of sensors might occur in any other systems on board. Multiple breakdowns of equipment might occur, and again redundancy might not be the solution. A simple failure that could be addressed by a crew on board can have serious consequences on unmanned or reduced-crew vessels.
Many studies address failures in communications and cyber risks as the most serious and novel ones.
But so far, the above is still the less “worrying” situation because all the hazards can be identified and the connected risk assessed; control measures and safeguards can be put in place.
The real issue in a complex system such as a MASS is the “unknown unknowns” — in other words, the hazards which we do not know we don’t know. In such a complex system there are risks which we cannot foresee but that can become real.
To this end, the industry has developed new risk assessment techniques such as STPA (System Theoretic Process Analysis) to complement traditional techniques like FTA or HAZOP. The theory behind STPA is that in complex systems, accidents can also be caused by unsafe interactions of system components, even if all of them are perfectly working within their parameters.
To make an example, we can mention the famous accident that happened to a US Navy fighter aircraft years ago. One pilot executed a planned test by aiming at the aircraft in front (as he had been told to do) and firing a dummy missile. Apparently nobody knew that the “smart” software was designed to substitute a different missile if the one that was commanded to be fired was not in a good position. In this case, there was an antenna between the dummy missile and the target, so the software decided to fire a live missile located in a different (better) position instead. What aircraft component(s) failed here?
(Ref. STPA Handbook by Nancy G. Leveson & John P. Thomas, 2018)
Laakso, A., Chaal, M., & Valdez Banda, O. A. (2025). A risk assessment of an autonomous navigation system for a maritime autonomous surface ship. Journal of Marine Engineering & Technology, 24(4), 253–269. https://doi.org/10.1080/20464177.2025.2460268
MASS Human Role
After having provided the basic and more important definitions and having tried to provide as simple as possible explanations of those and of the novel risks introduced by MASS, it is about time to spend some words on the role humans play and probably will play for many years to come in this field.
Differently from other authors, the writer of this article believes that it won’t take decades before seeing an appreciable number of commercial ships well above 500 GT totally or almost totally unmanned crossing the oceans. This doesn’t imply that the end goal of MASS is to eliminate the human; rather, in an attempt to cut costs, make navigation safer, more efficient and more sustainable, the role of the human has to be redefined and relocated.
The technology is here, AI is advancing at warp speed, and it won’t be wise to ignore those facts. It is necessary to consider them and leverage the new possibilities, preparing a new generation of seafarers and technicians which will be necessary to run the business. In addition, there are both practical and legal imperatives.
The Principle of Meaningful Human Control (MHC)
There is a compelling legal and ethical argument that autonomous systems, especially those as large and potentially hazardous as ships, must remain under “Meaningful Human Control.” International law, such as UNCLOS, was written with the implicit assumption of a human operator. While it does not ban MASS, it raises critical safety concerns about a vessel operating without direct human oversight. The concept of MHC, borrowed from discussions on autonomous weapons, suggests that a human must always be able to understand, supervise, and make final decisions to ensure compliance with international law.
(Ref. D. Mandrioli – https://hdl.handle.net/2434/1183500)
Handling Complexity and Unforeseen Events
Automation is excellent for routine tasks and known scenarios, but it struggles with the “unknown unknowns” — complex, novel situations that were not anticipated by its programmers. A human operator is essential for stepping in when the automation’s “process model” of the world no longer matches reality. For example, in a complex collision avoidance scenario with multiple non-compliant vessels, a remote operator’s cognitive skills are needed to interpret intent and make a safe decision that a purely rule-based system might miss.
System Safety and Human-System Collaboration
Safety analysis carried out by different scholars using methods like STPA shows that safety in MASS is not just about technical reliability but about the quality of interaction between humans and systems. The human is a critical “controller in the loop,” and their cognitive processes — how they perceive information, understand the situation, and decide on actions — are integral to the overall safety of the operation. Ignoring this human element creates a significant safety gap.
Before delving further into this subject, let’s present two other definitions. The first is somehow official, being stated in the draft MASS Code; the second can be inferred.
Remote Control: Operation of the ship, or its functions, from outside the vessel without interference from personnel on board. This may involve direct actuator control or higher-level functional commands. Remote control may range from simple set-point transmission to full real-time control with virtual feedback.
Remote Supervision: The ship is not controlled but supervised from a remote station.
There is a critical distinction here to grasp, as it defines the very nature of the human’s job.
In Remote Control Mode (RCM – similar to IMO Degree 3): the operator is in a continuous, active control loop. They must constantly receive information from the ship, make decisions, and send commands. This is a high-workload, high-attention task, akin to “flying” the ship by wire from a distance.
In Remote Supervision Mode (RSM – similar to IMO Degree 4): the operator is “out-of-the-loop” during normal operations. Their role shifts from active controller to passive monitor, waiting for the automation to alert them to a problem it cannot handle. This introduces a significant new challenge: the “out-of-the-loop” performance problem. A supervisor who has been monitoring for hours may suffer from boredom and loss of situational awareness. When the alarm sounds, they need precious seconds or minutes to re-orient themselves to the situation, diagnose the problem, and decide on the correct course of action — a transition that is itself a high-risk period for human error.
The human is still necessary in Autonomy mode degrees 1 and 2 as defined by IMO, whose key difference from degrees 3 and 4 is the presence of humans on board and very limited autonomy. But even in those cases, the role of the seafarers differs from the traditional ones.
At level 1 they will have to be confident to let some operations go unsupervised at times. At level 2 they will need to act as the “ultimate fallback”: should the remote connection fail, the communication link be severed, or a situation be too complex for the remote operator to handle, the on-board seafarers are there to take immediate, physical control of the vessel.
(Alamoush, A.S., Ölçer, A.I. Automated and remote engineering, maintenance, and repair in Maritime Autonomous Surface Ships (MASS). J. shipp. trd. 10, 20 (2025). https://doi.org/10.1186/s41072-025-00210-6)
Maintenance and Physical Intervention: A fully autonomous or remotely controlled ship without crew has a major vulnerability: it cannot fix its own problems. A minor technical fault that a crew member could repair in minutes might become a mission-critical failure at sea. The presence of a human on board allows for on-site troubleshooting, maintenance, and repair, ensuring the vessel can complete its voyage and handle emergencies that require a physical presence.
Hybrid Operations and Safety: In the transition period, which according to many authors could last for decades, many ships will operate in a hybrid mode. On-board personnel will be essential for ensuring the safe integration of new autonomous systems with traditional shipboard operations, and for managing safety during port operations, mooring, and other tasks that are difficult to automate completely.
Human Figures and Competence Necessary in the Future
As already said in the New Risks section, documented marine incidents and accidents indicate that a great percentage of them have been caused by human factors, and it is sometimes (wrongly) inferred that removing humans from the chain will make the industry significantly safer.
Human decision-making will be equally — or almost equally — important in MASS shipping, especially in the transition period. But the seafarer will need additional and greatly different competencies from those which are now required.
According to Mehdi Belabyad, Christos Kontovas, Robyn Pyne & Chia-Hun Chang, who carried out a systematic review and a bibliometric analysis of the literature available on this subject at the end of 2024 (as explained in their article available here: https://doi.org/10.1080/03088839.2025.2475177), the “seafarer” of the future will look very different from today’s. Their research points to a new professional who blends traditional maritime knowledge with advanced digital and analytical skills. Several recent studies have worked to create a framework for these future competencies.
They identified 11 competencies, listed below in order of importance (inferred by the number of studies on each):
Digital
Communication & Collaboration
Automation and System
Leadership
Maritime Expertise
Decision Making and problem solving
Critical thinking
Engineer
Adaptability and Flexibility
Safety Management
Remote Marine Operations
These in turn group 33 specific skills. Let’s examine only a few of these.
Digital Competencies: Future seafarers will need cybersecurity knowledge at different levels to deal with the risks derived from the increased connectivity discussed earlier. They will also need the capability to process and understand the massive quantity of data produced by MASS systems. Another obvious digital skill required will be cloud computing, given the large use of cloud-based data storage and processing.
Communication & Collaboration play a key role in autonomous vessels, odd as it might seem at first glance. This is due to the presence of teams possibly hundreds or thousands of kilometres apart who manage different aspects of the MASS. Interpersonal skills — the capability to build trust among them and to maintain clear communications — will be obviously important to manage MASS safely and efficiently. In addition, there are already communication systems in place that use AI to simplify and make more efficient the communications among the different involved parties, including authorities. Seafarers need to be able to use such systems based on LLMs.
Automation & System (on board and ashore): there will be a large and increasing number of automated functions and processes spanning navigation, propulsion, cargo handling, etc., to operate, supervise, troubleshoot and fix. It will require the capability to decode alarm alerts, assess the gravity and react.
Maritime Expertise & Remote and Marine Operations: It will be necessary for the seafarer to be able to monitor and maintain the MASS operating within its parameters. It is foreseeable that on board there will also be AI robots to supervise, for example, mooring and cargo handling but also engine room operations. While currently MASS have started to operate on specific routes/corridors, for many years to come MASS will operate in the same waters as traditional ships without strict separations. This may generate manoeuvring interpretation problems and legal issues. All of the above also requires robust traditional marine skills and knowledge of traditional rules and regulations.
Critical thinking will be an extremely important skill. Seafarers should be able to assess the reliability of the enormous quantity of data produced and be able to distinguish between reality and its representation. Electronic applications and devices build a very complex and very credible representation of the environment around the operator, which sometimes — due to sensor/system malfunction or malicious intervention (a hacker) — does not coincide with reality. We have already had an example of this with the introduction of ECDIS. The symbol of the vessel on the ECDIS screen remains only a symbol. Watching it moving on the planned course without any ships entering the CPA limits is a very reassuring virtual reality, which can be (and has been) misleading in many cases — for example, when the GPS does not work correctly and the symbol shifts from being a real-time accurate position to an estimated one, or when there are ships without AIS in the vicinity that are not visible on the ECDIS screen (when not integrated with the radar).
Engineering: There will be a need for electronic and electrical engineering expertise to understand the theoretical aspects of interconnected sensors and data networks, but also more operational skills to control, supervise and repair the large number of instruments. Still, the seafarer will have to maintain his mechanical knowledge of systems like steering gears, propulsion, power generation, etc.
Adaptability & Flexibility: The speed at which new systems develop is very high. Seafarers will need to adapt to these changes and be extremely flexible and highly motivated to continue learning.
The research therefore emphasizes that we cannot simply abandon the old for the new. There is a strong argument that future MASS operators should first obtain traditional seafaring qualifications to gain an intuitive understanding of the sea, the ship’s behaviour, and the maritime environment, before specializing in remote and autonomous systems. Training frameworks will need to evolve from the current STCW code to include these new competencies, moving towards a model of creating Suitably Qualified and Experienced Personnel (SQEP) for this new domain.