The Autonomous Urban Passenger Ferry milliAmpere2: Design and Testing

Many urban areas feature waterfronts and canals that are underutilized in transportation networks. Currently, urban transportation relies predominantly on roads and bridges, which are easily congested and impose a large environmental footprint. If urban populations are expected to grow sustainably, novel transportation solutions are needed to meet mobility demands. Urban autonomous ferries may provide a solution by expanding urban transportation network capabilities while also utilizing existing resources more efficiently.

In the past decade, autonomous surface vehicles (ASVs) have taken tremendous strides toward implementation in transportation applications across the globe [1]. This includes the urban ferry use case, which has been manifested in research and development platforms like “Roboat” [2] and “milliAmpere1” [3]. Beyond the urban ferry use case, ASVs have been used in research on coastal transportation (e.g., the bulk carrier “MV Yara Birkeland”) [4]), short-sea shipping (e.g., feed carrier “MV Eidsvaag Pioneer” [5]), and inland waterway freight transport (e.g., “Cogge Watertruck Barge” [6] and “Maverick” freight transporters [7]).

Launched in 2021, the “milliAmpere2” (Fig. 1, right) embodies the state-of-the-art in research platforms for autonomous urban passenger ferries. Owned and operated by the Norwegian University of Science and Technology (NTNU) in Trondheim, Norway, the 8.6-m-long “milliAmpere2” is certified for transporting up to 12 pedestrians in urban waterways. The “roll-on, roll-off” (Ro-Ro) design features an open deck with space for individuals traveling with strollers, bicycles, wheelchairs, or other mobility devices. The first public trial operation of the “milliAmpere2” was held in 2022 [8]. Hailed in the media as the “world’s first urban autonomous ferry crossing” [9], the project demonstrated the potential of urban autonomous passenger ferries for enhancing urban mobility.

The ferry’s technical architecture is based on its predecessor: the 5-m-long “milliAmpere1,” which was launched in 2017 [3]. The “milliAmpere1” has provided a research platform on topics as diverse as sensor fusion and situational awareness (SITAW) [10–13], collision avoidance (COLAV) [14–16], navigation and motion control [17–24], risk analysis [25], digital communication [26], and digital twins [27,28]. While the “milliAmpere1” has been successful in investigations of core technical functionality, it was never intended to meet the rigorous standards needed for demonstration in an operational environment. This was the motivation behind its successor: the “milliAmpere2.” Building directly upon research results from the “milliAmpere1,” the aim was to design and build a system prototype for demonstrating autonomous ferry crossings for public use over a 100-m canal in urban Trondheim.

In this paper, the goals of the “milliAmpere2” design and testing are structured around five research questions:

• Research Question 1: What distinct user requirements exist for autonomous urban passenger ferries and how should these user requirements inform the ferry’s design process? (Sec. 2.1)

• Research Question 2: How can the ferry’s propulsion system be powered safely and reliably from a zero-emission energy source? (Sec. 2.2)

• Research Question 3: How can safe and precise collision avoidance be achieved in an urban canal environment using only the situational awareness provided by a multi-sensor target tracking system? (Sec. 2.3.2)

• Research Question 4: What human factors should be accounted for in the design of interactions at the remote operating center (ROC)? (Sec. 2.4)

• Research Question 5: What risks exist for operating an autonomous ferry in an urban canal environment, and how can these risks be accurately identified, assessed, and managed? (Sec. 2.5)

In this paper, the “milliAmpere2” design is presented, which synthesizes the results of the scientific investigation undertaken. Section 2 describes major system components in terms of the five research questions outlined above with a focus on research methodologies and findings. Implications of these findings are then discussed, starting with reflections on how testing validated (or did not validate) expectations and ending with a list of new and outstanding research questions (Sec. 3). Finally, conclusions are drawn, outlining the main contribution of this paper in terms of significant progress toward the research questions defined at the project outset, and a road map for future research is proposed (Sec. 4).

This section presents an overview of “milliAmpere2” design and testing, covering five research questions related to (i) human-centered design (HCD), (ii) batteries and propulsion, (iii) autonomy system, (iv) remote monitoring and control, and (v) risk assessment and safety.

Being intended for public end users distinguished “milliAmpere2” design requirements from its prototype predecessor, the “milliAmpere1.” A HCD philosophy was therefore adopted to investigate Research Question 1.

The definition of HCD was adopted from that of the International Organization for Standardization (ISO 9241-210:2019), which describes it as “an approach to systems design and development that aims to make interactive systems more usable by focusing on the use of the system and applying human factors/ergonomics and usability knowledge and techniques” [29, p. 2]. The process encompasses four phases in an iterative cycle: (i) understanding and specifying the context of use, (ii) specifying the user requirements, (iii) producing design solutions, and (iv) evaluating the design.

The “context of use” phase started where the “milliAmpere1” left off: with test results that helped define basic design requirements, constraints, and operational scenarios. However, despite providing a solid foundation for technical requirements and constraints, the “milliAmpere1” provided little insight into user requirements for passengers in an operational environment. The first actions for defining the context of use were therefore the completion of field studies involving conventional urban ferries, including systematic observation of passenger behavior (see Refs. [30,31] for details). Moving to the next phase in the process (“specifying the user requirements”), which involved cross-disciplinary workshops, stakeholder engagement, and design reviews, the following list of user requirements was drawn up:

• The deck should provide ample space for 12 passengers, even when each has a bicycle.

• The ferry should be accessible to individuals with walkers, wheelchairs, or other mobility devices.

• The hull should have a symmetric profile to accommodate Ro-Ro loading/offloading.

• The ferry should have minimal lateral resistance in transversal current operation.

• The ferry should be conducive to operation in a well-trafficked, constrained 100-m-wide urban waterway.

The “producing design solutions” phase started with graphical renders (e.g., Fig. 2) and proceeded to scale models that incorporated increasing levels of detail. Following a final design review, the main specifications were drawn up ahead of construction (Table 1). The ferry features a wide mono-hull for maximum stability, with departs from traditional hull forms for vessels of comparable length. Fore and aft hatches enable Ro-Ro loading and unloading. The hull material is aluminum, and its form is characterized by vertical transoms, rounded bilges, and a flat bottom (see the lines plan in Fig. 3). Hull scantlings and freeboard complied with Nordic Boat Standard prescriptions [32]. The topsides feature protective glass bulwarks, an A-frame structure with a top-mounted sensor rig, and an open deck to reduce windage area. Design affordances were mapped to the metaphor of an elevator, with on-demand button functionality enhancing usability and explainability [33].

The “evaluating the design” phase involved a three-week public trial operation of autonomous ferry crossings with a safety operator on board. Public trial operation was first held in 2022. At this time, a survey study was completed to investigate user experience in terms of perceived safety and trustworthiness. Questionnaires were administered to passengers using a convenience sampling protocol before and after use (⁠$N=884$ paired samples). In addition, semi-structured interviews were held with random passengers exiting the ferry (⁠$N=25$⁠). The questionnaires, interview protocol, and dataset are openly available in the DataverseNO repository [34] and described in Ref. [35]. The questionnaire asked passengers to rate perceived safety on a scale of 0–4, where 0 was “very unsafe” and 4 was “very safe” (“How safe did you feel about taking this self-driving ferry?”). Results were divided into four conditions, representing combinations of before/after use and with/without a safety operator (see Sec. 3.1 for details about the safety operator). The results are presented in Fig. 4.

The results indicated that most passengers perceived the ferry as safe even before using it (mean $=$ 3.41, $N=779$⁠). This perception did not change after use (mean $=$ 3.42, $N=778$⁠). However, when passengers were asked to imagine the ferry without a safety operator on board, safety perception changed from a before-use mean score of 3.07 (⁠$N=775$⁠) to an after-use mean score of 3.42 (⁠$N=779$⁠). A Wilcoxon’s signed-rank test showed that this difference was significant (⁠$p<0.001$⁠). After use, passengers reported that their perceptions of safety were indifferent to whether the safety personnel was on board.

The questionnaire also asked passengers to rate perceived trust on a scale of 0–4, where 0 was “very little” and 4 was “very much” (“How much do you trust this self-driving ferry?”). The results indicated a high trust score (mean = 3.27) with no difference before/after use.

Recently, there has been significant interest in battery-powered propulsion for zero-emission ships [36]. For long-distance voyages, energy storage requirements are high and therefore demand very large batteries. For shorter-distance use cases like urban ferries, the use of batteries is more attractive, provided that they can be frequently (and rapidly) charged. This, combined with the need for a high-level control system that can manage energy use while maintaining safety and resilience, underpins the investigation of Research Question 2.

The “milliAmpere2” propulsion system was designed to be fully electric, powered by four 48-v banks of valve-regulated lead-acid (VRLA) battery cells. This choice of battery technology was motivated by its relative simplicity and reduced reliance on a safety-critical battery management system. Each battery bank consists of a string of 6-v VRLA cells. The banks are connected into two independent power systems, each powering two azimuth thrusters (Fig. 5). This configuration provides a fully redundant power system, making the ferry resilient against power supply failures. The two independent battery buses are connected in a diagonal configuration to the azimuth thrusters that are located in each corner of the ferry. This allows the dynamic positioning (DP) system to continue to maneuver the ferry using two thrusters even if one of the battery systems should fail. To minimize the risk of a power outage, safety-critical systems are supplied with power from both battery buses via direct current (DC)–DC converters and separate 24-v backup batteries. This includes computers, SITAW sensors, and the DP system. Furthermore, the batteries provide approximately two tonnes of ballast weight to the ferry.

The batteries are charged by four independent battery chargers, which are connected to a 325-v DC bus. This bus is prepared for a future induction charging system consisting of 4$×$ 2.5-kW induction coils, which are yet to be installed at the transom below the Ro-Ro hatches. Currently, the DC bus is supplied from a 32-Amp, 3-phase, 230-v power connector through a diode rectifier bridge.

The propulsion system for “milliAmpere2” consists of four 10-kW azimuth pods positioned near the corners of the ferry (Fig. 5). Each pod is connected to linear actuators, which allow them to rotate 90 deg. This arrangement provides several intended advantages, including fully actuated control, efficient thrust allocation, translation in any direction, and precise yaw rotation. The arrangement also maximizes control in the event that one or two thrusters fail. During slow maneuvering, the pods are oriented at opposing angles pointing 45 deg outwards from the hull’s centerline, and their relative throttles are controlled individually. This configuration minimizes the need for frequent mechanical rotation of the thrusters with corresponding mechanical wear and tear. During design speed maneuvering, the pods are rotated in line with the hull’s centerline for maximum efficiency.

Autonomy, when applied to maritime navigation and control, comes in a range of definitions and taxonomies [37,38]. In this paper, the autonomy system is defined by “Degree 4” autonomy according to the International Maritime Organization (IMO) taxonomy for Maritime Autonomous Surface Ships (MASS) [39]. This specifies that the ferry’s operating system “is able to make decisions and determine actions by itself” (p. 4). In the case where manual intervention is needed, the system falls back to “Degree 3” autonomy, whereby the ferry is “controlled and operated from another location” (see Sec. 2.4 for details about remote operation). In terms of Research Question 3, the primary components of the “milliAmpere2” autonomy are the SITAW and COLAV systems, which function inter-dependently with the ferry’s sensors and DP system. Along with the autonomy system’s overall architecture (Fig. 6), each of its primary components and sub-systems are described in this section.

The “milliAmpere2” operational area consists of an urban canal inside a harbor area. As such, it often has to operate in a maritime traffic scenario characterized by kayaks, small and medium-sized leisure boats, and commercial vessels operating in a constrained and occasionally congested waterway. Therefore, the autonomy system must detect and track a variety of targets and ensure that the collision avoidance algorithms always operate safely and reliably. The SITAW system on board the “milliAmpere2” is based on two lidars, eight electro-optical red, green, blue (RGB) machine vision cameras, four infrared (IR) cameras, and a standard X-band marine radar (Table 2 and Fig. 7). Inputs from these sensors are used, together with data from the real-time kinematic (RTK) global navigation satellite system (GNSS) and the inertial measurement unit (IMU) to generate situational awareness in the autonomy system. These sensors are accurately time-stamped and synchronized using the SenTiBoard [40]. In addition, four ultrasonic sensors mounted near the waterline are used to measure the distance to the quay in the final phase of the docking.

At any given time, only a subset of the exteroceptive sensors (radar, lidar, and cameras) may be used. During the trial operation in 2022, the situational awareness was based on radar and lidar only. By contrast, later in the same year, collision avoidance experiments were conducted with only optical cameras as exteroceptive sensors [41].

The ferry is controlled using a DP system in one of two modes: manual or autonomous. In the manual mode, the DP is operated via a control terminal with a touch panel and a joystick. There is also a backup control terminal with the same functionality (see Fig. 6). In the autonomous mode, waypoint references and trajectories are generated in the autonomy computer and communicated to the DP system. If, for any reason, the autonomy system decides that performance is degraded (for example, due to lack of situational awareness data), the system shifts to a minimum risk condition state. In this state, the DP system is in station-keeping mode, halting the transit. During either manual or autonomous mode, there are two emergency stop switches that cut the power to the thrusters while the DP and other systems are unaffected.

The position of the vessel is provided by a dual-antenna GNSS navigation system with RTK corrections. Combined with data from an IMU, this allows the ferry to position itself with centimeter-level accuracy, which is required especially in the docking phase of an autonomous transit. An additional GNSS navigation system is connected to the DP system for redundancy, allowing for station-keeping in case of primary unit failure.

The SITAW system tracks and provides estimates of obstacles in the vicinity of the ferry, which the motion planning system uses to adjust the ferry’s speed to avoid collisions. Using specialized detection pipelines, raw sensor data from the various exteroceptive sensors are processed to extract measurements of other targets in the vicinity of the ferry—typically small leisure crafts or kayaks. These measurements are then combined into a heterogeneous multi-sensor fusion system based on the Integrated Probabilistic Data Association filter [42], which outputs position and velocity estimates for all tracked targets. The use of multiple heterogeneous sensors increases the accuracy of the SITAW system and results in greater robustness due to multiple levels of redundancy in the sensors.

The lidar and radar detection pipelines are based on traditional point-cloud-based processing. Radar spokes from a complete radar scan are aggregated in a global point cloud using data from the navigation system. Map-based filtering is then applied to remove returns from land and floating infrastructure such as docks. The resulting point cloud is then clustered to yield point measurements and shape outlines for targets in the vicinity of the ferry [10]. Similar processing is also applied to the lidar point clouds.

Images from the eight RGB cameras are converted from raw Bayer format to RGB color images in a process known as demosaicing. Corrections are then applied to remove the effects of lens distortion from the image data. A YoloV4-based deep learning detector trained on the “MS COCO” dataset [43] is then used to detect targets within the camera range of the ferry, resulting in a series of bounding boxes in pixel coordinates. These can then be processed into bearing measurements [10] or used for range estimation [44].

Several collision avoidance algorithms have been tested on the “milliAmpere1” predecessor [3]. Of these, the single path velocity planner (SP-VP) algorithm [14] was selected as the most suitable algorithm for the “milliAmpere2” operational area.

The SP-VP algorithm is based on a path-time decomposition where the ferry is constrained to be located on a nominal path. Obstacle estimates from the SITAW system are transformed into the path-time space, and a desired trajectory is generated by finding the shortest path in a graph spanning the path-time space. To ensure collision avoidance, edges intersecting with obstacles are removed, and a cost function motivates the algorithm to follow the nominal path with a desired speed. For more details, see Refs. [3,14].

The requirement of remote monitoring and control intervention places a significant burden on the operator of the “milliAmpere2.” Human factors therefore play a significant role in designing safe and effective technology interactions at the ROC, and their systematic investigation underpins Research Question 4.

The ROC is linked to the “milliAmpere2” using 4G and 5G communication systems. In addition, there is a proprietary C-band (5.8 GHz) radio system supplied by the manufacturer of the DP system. The ROC is located at the NTNU Shore Control Lab [45,46] at the “Trondheim Maritime Center”: an office building approximately 1.4 km from the ferry service location. A base station on the building’s roof receives and transmits signals necessary for monitoring and control over three private networks. These are: (i) a 5G network for high-capacity data streams, (ii) a backup 4G network, and (iii) a C-band radio network for remote control of the DP system, including streaming of two closed-circuit television (CCTV) sources. Four major network components are linked: (i) base station, (ii) ROC, (iii) “milliAmpere2,” and (iv) data center. The data center hosts a server with 10 Gbps transfer speed to the ROC and allows for storage and encrypted access to operational data. The communication architecture is designed and setup for cyber security using the Architecture Analysis and Design Language to allow for an iterative design process [26].

In 2022, a major experiment was conducted at the ROC that screened important human factors and their associated risks [47,48] (Fig. 8). This experiment was setup based on a digital twin of the “milliAmpere2” using the “Gemini” simulation platform [27,49]. Simulations provided the opportunity to study how remote operators handled safety-critical remote control interventions. Operational scenarios re-created “milliAmpere2” crossings and therefore contributed to the environmental fidelity of the simulation test outcomes. The graphical user interface used in the ROC experiments was based on the design presented in Ref. [50] and featured pan-tilt-zoom cameras for exteroceptive vision. Feedback from experiment participants also revealed that views of wide-angle cameras (e.g., 360-deg cameras) were desired for optimal situation awareness during automatic-to-manual control transitions.

As a starting point for the safety analysis of “milliAmpere2” and investigation of Research Question 5, risks associated with autonomous and remote operation were identified during a preliminary hazard analysis (PHA) [51]. Hazards in this context were defined as “a source of potential harm,” and risk was understood as the product of the likelihood of a hazard (expressed as a frequency or probability) and its consequence of occurrence [52]. However, lacking historical databases or longitudinal field studies for autonomous ferries estimating these likelihoods had to rely on a priori data. The prerequisite likelihoods were therefore captured semi-quantitatively from expert judgment during two rounds of PHA workshops. Frequency categories were defined as “Remote” (⁠$P<0.01$⁠), “Unlikely” (⁠$0.01<P<0.1$⁠), “Expected” (⁠$0.1<P<1$⁠), and “Frequent” (⁠$P>1$⁠), where $P$ represented the frequency in per ship years. Consequence categories were defined as “None” (no injuries), “Minor” (single and/or minor injuries), “Significant” (multiple minor injuries and/or severe injury), “Severe” (single fatality and/or multiple severe injuries), and “Catastrophic” (multiple fatalities and severe injuries).

The resulting risk matrix was used to guide risk reduction measures. A summary of critical hazardous events and their risk reduction measures is shown in Table 3 (see Ref. [51] for a more comprehensive list).

Advanced risk assessment techniques were employed during detailed design. Notably, this included Bayesian networks (BNs). The advantage of using BNs is that they are adaptable to complex system interactions even when the system’s novelty precludes historical data for estimating hazard likelihoods. For example, BN techniques were applied to estimate the collision probability between the “milliAmpere2” and other crossing vessels in the canal [25]. The findings yielded a low predicted collision frequency; however, the model was sensitive to factors with high uncertainty, which included error rates of remote operator intervention. In another study, BNs were used in a human reliability analysis to analyze human error propagation emerging from human-autonomy interactions at the ROC [48]. Causal and probabilistic relationships were modeled between independent performance-shaping factors (PSFs) affecting remote operator errors when completing simulated remote collision avoidance on the “milliAmpere2.” The findings indicated that “Time availability” ranked as the highest-impact PSF, followed by “Task complexity” and “Pre-warning.”

The design of the “milliAmpere2” helped synthesize research outcomes and provided a yardstick by which to measure progress toward the research questions defined at the project’s outset. Discussed here is how testing validated (or did not validate) expectations and how new research questions emerged in the light of the outcomes.

The user-centeredness of the “milliAmpere2” design process gave rise to some of the project’s most innovative aspects. For example, focus on users had the knock-on effect of guiding stakeholder involvement beyond the university campus to include safety regulators, national maritime authorities, local harbor and rescue services, municipal government, and classification societies. The end-user focus also helped define intersecting interests related to product and service development with established industry actors and technology start-ups. This approach reflects a trend in the burgeoning ASV transportation domain that Humphries et al. [53] have termed “intent-based design”—so-called for a project’s intention to confront gaps in current maritime laws and regulations surrounding autonomous vessels. End-user focus on public engagement also signaled an approach to safety assurance reform that Torben et al. [54] have termed “contract-based verification” for its stepwise commitment to formally addressing design and verification challenges for autonomous vessel control systems. The “milliAmpere2” design and testing process therefore reflects a broader trend in ASV system design aimed at reforming regulatory constraints and safety assurance gaps in the wake of technological advances that can have a transformational effect on maritime transportation.

In addition, the HCD methodology applied to the design process helped ground design specifications in user requirements and formally test expectations in terms of users’ perceptions of safety and trustworthiness. The results, which showed that passengers generally trusted the ferry and felt safe using it, aligned with expectations. The results also showed that passengers perceived the ferry without an onboard safety operator as safer after having tried it (Fig. 4). This bodes well for the next phase of operation, which involves the removal of the safety operator and integration of remote monitoring.

The presence of the safety operator was required during trial operation to comply with Norwegian Maritime Authority (NMA) guidelines. According to these guidelines, components related to the autonomy system must yield at least the same safety levels as conventional vessels [55]. The four safety operators employed during the 2022 trial, for example, were required to have the following certifications: Deck Officer Class 5 Pleasure Craft (“D5L”) or higher (see Ref. [56] for details), Standards of Training, Certification, and Watchkeeping for Seafarers (STCW) Basic Training Course (“IMO50”), STCW Crowd and Crisis Management, and Short Range Certificate for operating maritime very-high-frequency radio. The NMA approval process was based on IMO’s circular for approval of innovative technologies in terms of “alternatives and equivalents” (MSC.1/Circ. 1455) [57]. Although the scope of this paper focuses on a use case in Norway, a recent review has shown that most guidelines published by other nations’ maritime authorities and classification societies also bear resemblance to IMO’s “alternative and equivalents” circular [58]. In time, more prescriptive international regulations are expected, which most notably includes IMO’s “MASS Code,” which is anticipated to come into effect in 2028.

Aside from gaining experience with ASV approval for passenger transport, important lessons were learned about the ferry’s technical systems. For example, the battery-driven propulsion system demonstrated reliable powering of the ferry throughout the day with one midday charging break lasting approximately 1 h. This break in service was experienced as disruptive, however, and a planned upgrade will integrate rapid induction charging during docking as an alternative (see Sec. 2.2).

In addition, the trial provided a valuable opportunity to test the autonomy system in a real-world operational environment. Generally, the autonomy system demonstrated good performance, correctly tracking targets and avoiding potential collisions without operator intervention. The COLAV system’s conservative strategy of stopping for all crossing traffic, regardless of IMO’s collision regulation (COLREG) prescriptions, also proved appropriate in a canal populated with recreational boaters and kayakers, not all of whom are familiar with COLREGs, maneuvering in a relatively high current. An examination of the safety operators’ logbooks after the 2022 trial period revealed that manual interventions were needed approximately 25 times during the three-week trial. Given that the aim of the trial was partly to test the autonomy system’s limits, some level of manual intervention had been expected. In this sense, the interventions provided an opportunity to study these limits. One culprit for edge cases entailed false tracks. For example, after one safety operator noted that “the ferry sped up without any apparent reason,” engineers deduced that the SITAW system was tracking the ferry’s own wake, prompting a vain attempt by the COLAV system to avoid it by accelerating. In another instance, the safety operator noted that “floating leaves after a storm were tracked by the ferry, resulting in the ferry stopping.” After consultation and diagnosis, both edge cases were resolved within 24 h of observing them, adding them to the ferry’s repertoire of real-world experience. In this regard, the ferry’s resilience to changing conditions and unexpected situations was partly credited to protocols for managing edge case detection and subsequent software updates.

After the success of the 2022 public trial, the “milliAmpere2” will continue to provide a test platform for research and development. Three important areas for future work have been identified: (i) human-autonomy teaming (HAT), (ii) remote operation, and (iii) interactions with passengers, traffic, and remote operators.

Currently, the “milliAmpere2” cannot operate without a safety operator due to both technical and regulatory constraints. In the future, by contrast, it is expected that a remote safety operator can perform their duties just as safely from an ROC as from on board. According to the IMO, this will entail an autonomy characterized by transitions between “Degree 4” (“fully autonomous”) and “Degree 3” (“remote operation with no seafarers on board”) autonomy [39]. This duality of autonomy levels raises important questions. How can SITAW be seamlessly transferred from machine to human? Likewise, how can it be transferred back again? These questions underscore a major research gap. Future work must identify and explain the mechanisms behind HAT in the context of shared SITAW for safety-critical autonomous maritime operations.

The safety operator represented a stopgap in “milliAmpere2” development and points to several outstanding research questions. As a temporary measure to reduce risk during public trial operation, the safety operator’s presence also served to highlight what is missing from the final design iteration. Specifically, an important knowledge gap concerns the knowledge, understanding, and proficiencies (KUPs) required on the part of operators who will work at the ROC when the safety operator is no longer needed on board. This knowledge gap should not be overlooked. The IMO, in their scoping report on MASS regulations, concluded that the definition of the “remote operator designated as seafarer” was among the most “high-priority issues” concerning regulatory gaps [39, p. 9]. IMO’s anticipated “MASS Code” will likely address remote operator KUPs in much the same way that IMO’s STCW Code does for navigators aboard conventional ships.

A related research gap encompasses risk assessment techniques for modeling human-autonomy interactions in the ASV ecosystem. Although advanced methods like BNs shone light on interactions that are difficult to model for novel systems like the “milliAmpere2,” there is still a lack of empirical data that limits model accuracy. More data will help construct better modeling predictions, and data collected in operational environments will play an important role in supplementing simulation data collected thus far.

User experience, trust, and acceptance of autonomous vehicles are active areas of research interest [59]. The survey study conducted in 2022 among “milliAmpere2” passengers indicates that users perceived the ferry as safe even if the safety operator should be moved to an ROC. Taken at face value, this appears to be an auspicious result, especially in light of the transition to remote operations underway. However, there are two important limitations to consider. The first of these involves the demographic distribution of respondents, which was skewed toward younger age groups. Specifically, the age group 20–29 years contained 10% more respondents relative to the local population (see Ref. [35] for details). Considering that age is an important factor affecting how people experience technology, the skewed sample may have introduced a positive bias in the results. The second limitation involves the survey method. The safety operator was on board during all crossings, meaning that questions probing safety and trustworthiness without a safety operator on board hinged on passengers’ own imagination of this condition. Future survey studies on user experience should therefore be corrected for sample age demographics and validated during operations without a safety operator on board. As autonomous ferries mature into a service, we can expect future studies to examine the user experience of autonomous ferries. Recent work like that of Ref. [60] illustrates this trend, which showed that information display interfaces can significantly enhance user experience on the “milliAmpere2” when displaying basic information like current location and intended path.

Future work on autonomous ferries must also examine the mechanisms behind interactions with other traffic. Some work has already demonstrated the viability of light and sound signals as media for communication to surrounding traffic [33]. Maneuvers executed by an ASV also constitute an important yet overlooked tacit communication mechanism. Rule 8 of the COLREGs explicitly states that a stand-on vessel in an encounter situation should show intention to change course in “ample time and with due regard to good seamanship.” Although compliance with the COLREGs has seen much progress in recent years (e.g., Ref. [61]), Rule 8 represents an important research gap toward safe interactions between ASVs and other maritime traffic.

Finally, results from simulated remote operations of the “milliAmpere2” highlight outstanding challenges of the “one-to-many” format of operations, where one operator will ostensibly be responsible for multiple vessels at the one time (in the tests reported in Sec. 2.4.2, operators monitored up to three virtual “milliAmpere2” ferries). Results also highlighted the importance of designing decision support systems that keep the operator “in-the-loop” ahead of control transitions during fleet operations. Transitioning to remote operations is not expected to be trivial. The strategy adopted for future “milliAmpere2” work is to transition incrementally, starting with moving the safety operator to a “local operating center” (LOC). The LOC will consist of a mobile enclosure on the quay with space for two operators and a full line-of-sight to the ferry crossing. The LOC will be equipped to monitor the ferry systems and control the ferry’s DP system remotely. Systematic design and testing of the LOC are expected to contribute to bridging research gaps in the transition toward fleet operation from an ROC.

As a growing international community rallies around autonomous maritime technology, methodologies for testing and verification are becoming increasingly important. In this context, the “milliAmpere2” represents both a research platform and a case study. As a research platform, it demonstrates technological advances made in the wake of its nuts-and-bolts predecessor, the “milliAmpere1.” As a case study, it demonstrates advances at the policy level by involving a range of stakeholders at the crossroads of maritime regulation and industry. It follows that if the “milliAmpere1” has demonstrated advances in maritime autonomy, then its more user-oriented successor outlines the reform needed for maritime laws, regulations, and safety assurance to enact those technological advances in an operational environment. The “milliAmpere2” stands as an example of how a pioneering project can contribute to bringing about this reform through stakeholder engagement and building technology acceptance and trust in the public. The “milliAmpere2” design and testing rallied effort around five research questions covering topics as diverse as human-centered design, batteries and propulsion, autonomous navigation and control, remote monitoring and control, and risk assessment. The main contribution of this paper therefore constitutes the significant advances made toward these research questions, whose outcomes are synthesized in the “milliAmpere2” design and testing.

The authors gratefully acknowledge NTNU’s AVIT program that funded the construction of the “milliAmpere2” and NTNU’s Autoferry project that funded research and testing. The authors acknowledge the invaluable contributions of Zeabuz AS, who delivered and maintained the autonomy system, as well as Marine Technologies, Inc., who delivered the DP system, and Innovation JBA AS, who provided engineering services during tendering and construction. The authors are also indebted to those who funded the 2022 public trial of the “milliAmpere2,” which included Trondheim Municipality, NTNU Strategic Research Areas (NTNU Oceans, NTNU Digital, NTNU Energy, NTNU Sustainability), and the Norwegian Research Council through the projects aFerry (grant number 296694), SFI AutoShip (309230), and MIDAS (331921). Finally, the authors extend their gratitude to the passionate students and staff at NTNU who made the “milliAmpere2” project possible.

There are no conflicts of interest.

The datasets generated and supporting the findings of this article are obtainable from the corresponding author upon reasonable request.

$CB$ =

block coefficient

AADL =

architecture analysis and design language

ASV =

autonomous surface vehicle

BMS =

battery management system

BN =

Bayesian network

CCTV =

closed-circuit television

COLAV =

collision avoidance

COLREG =

collision regulation

DC =

direct current

DP =

dynamic positioning

DSS =

decision support system

GNSS =

global navigation satellite system

GPS =

global positioning system

GUI =

graphical user interface

HAT =

human-autonomy teaming

HCD =

human-centered design

HRA =

human reliability analysis

IDPA =

Integrated Probabilistic Data Association

IMO =

International Maritime Organization

IMU =

inertial measurement unit

IR =

infrared

ISO =

International Organization for Standardization

KUP =

knowledge, understanding, and proficiency

LOA =

length overall

LOC =

local operation center

MASS =

Maritime Autonomous Surface Ship

NMA =

Norwegian Maritime Authority

NTNU =

Norwegian University of Science and Technology

OOTW =

officer of the watch

PHA =

preliminary hazard analysis

PSF =

performance-shaping factor

PTZ =

pan, tilt, zoom

RGB =

red, green, blue

ROC =

remote operation center

RTK =

real-time kinematic

Ro-Ro =

roll-on, roll-off

SITAW =

situational awareness

SP-VP =

single path velocity planner

SRC =

Short Range Certificate

STCW =

Standards of Training, Certification, and Watchkeeping for Seafarers

VHF =

very high frequency

VRLA =

valve-regulated lead-acid