code_of_practice_V3_2019

Control is typically a combination of high level and low level functions and behaviours, which may be implemented in
separate modules, such as the following examples:
n Sub-second control of a rudder actuator, with a feedback loop in order to control heading in response to
Heading and Rate of Turn (ROT) set points;
n Following a sequence of waypoints by issuing Heading and ROT set points;
n Generating or selecting waypoints, and selecting which route to follow;
n Enabling waypoint-following, or superseding the mission controller with heading and speed set points
calculated by a collision avoidance algorithm.
8.9.2 It should be noted that the MASS’s ability to transmit situational awareness data to an off-board controller has
been covered in the previous Chapter. This, and the ability to receive appropriate and timely commands from the
controller, should be borne in mind in cases where some of these functions are performed remotely.
8.9.3 The control functions, (on-board, remote, or distributed) shall be capable of exerting timely and accurate control
in such a manner as to maintain safety of (1) the platform; (2) surrounding persons, structures, ships; and (3) the
environment.
8.10 EMERGENCY STOP
8.10.1 The MASS should have a defined condition of Emergency Stop, which must be fail safe under conditions where
normal control of the MASS is lost. Under Emergency Stop, propulsion is reduced to a safe level in a timely
manner. In this context:
n “a safe level” means a level at which it is not likely to cause damage either directly or indirectly. It should be
noted that some MASS (e.g. wave propelled) may not have any means of cutting propulsion power to zero.
But in a harbour or sheltered waters the wave propulsive power may reasonably be expected to be a safely
low level;
n “in a timely manner” means within a time that is short enough to ensure that the risk from uncontrolled
propulsive power can be contained before it is likely to cause damage. In open ocean conditions this may be
relaxed, whereas in a docking situation the propulsion may need to be cut more quickly, within seconds or less.
8.10.2 The MASS shall have the ability to be placed in an Emergency Stop condition by a human or automatic controller
or supervisor with access to sufficient Situational Awareness data to be able to determine when an Emergency
Stop command is necessary.
8.10.3 In the case of an automatic operator, the design of that controller or supervisor shall be fail safe, in that it
shall recognise all known unsafe operating conditions with no false negatives and shall react to unknown or
indeterminate safety conditions by invoking Emergency Stop in a timely manner.
8.10.4 On sensing a failure (or disabling, whether deliberate or not) of all data-links which may carry an emergency stop
command, the MASS shall enter a ‘render-safe’ procedure. This should culminate in Emergency Stop. The first action
should be that, if situational awareness has been, and continues to be, fully operational, the MASS should
immediately shape a safe course and adopt a ‘safe speed’ (making appropriate sound and visual signals when
feasible) commensurate with weather conditions, COLREGS and safe navigation at the time of loss of data-link.
This should minimise hazards to the MASS and other vessels, whilst the MASS and the control station resolve the
situation. If the data-link is not re-established after an appropriate grace time, and/or the MASS’s own situational
awareness deems it safe/necessary, the MASS should enter Emergency Stop. Consideration may be made of including
‘dropping anchor’ as part of the render-safe procedure, commensurate with accepted safe navigation practices.
56
MASS UK Industry Conduct Principles and Code of Practice Version 3