Shore-enabled survey: who decides, and who carries the assurance

The vessel is no longer where command sits

Writing in Marine Technology News, Carsten Haagensen, President of Data Services at Ocean Infinity, makes an argument worth taking seriously at the management level: autonomy is not the removal of people from operations, it is the move from vessel-centred to shore-enabled operations. In the company’s coastal surveillance work in the Middle East, multiple vessels operate at once under the oversight of an onshore control centre, with operators monitoring activity and intervening when required. On lean-crewed survey work for major energy companies, activity that once put more specialists offshore is now supported from the Remote Operations Centre (ROC): remote payload control, remote ocean bottom node deployment, remote marine mammal observation, and onshore data quality control and processing.

A key consideration for anyone running a survey function is the shift from vessel-centred to shore-enabled operations. Uncrewed does not mean unattended. That reframes the management problem entirely. The question stops being “how many fewer people offshore” and becomes “which competences move ashore, who holds the decision rights when the deck is empty, and who carries the assurance for the integrity of the data and the safety of the operation.” Those are engineering-organisation questions, and they do not answer themselves by buying autonomous platforms.

Why lifting the offshore org chart ashore does not work

The conventional offshore model concentrates authority in one place, where key personnel share situational awareness and can settle decisions quickly. Command is co-located with the work. Most functions, faced with a move to remote operations, quietly try to reproduce that chart ashore – same boxes, same reporting lines, new postcode. It fails for four reasons.

First, latency and link integrity. Physical co-location gave you deterministic, zero-latency communication. A shore link does not. Decision authority has to be defined around the state of the link, not around the assumption that it is always there.

Second, span of control. One operator watching several assets is the economic case for the model, but it directly attacks the single most valuable thing the offshore chart provided – undivided attention during critical phases. A one-to-many arrangement that is safe in transit is not safe during simultaneous node deployment and recovery.

Third, the question of who is master. Under emerging regulatory frameworks for autonomous and remotely operated ships, the “remote operator” carries defined responsibilities, but the mapping between that role and the traditional master’s authority is not something you inherit. You have to write it down.

Fourth, competence assurance has historically been anchored to physical presence and logged sea time. An empty deck breaks the implicit assumption that the person carrying the decision has recently felt the operation under their feet.

Skip the explicit redesign and decision rights default to whoever is most insistent on the comms channel at the moment of stress. That is the actual failure mode, and it is an organisational one.

Redrawing decision rights for an empty deck

For a shore-enabled operation, it is crucial to clearly define decision-making authority to separate routine execution from critical decisions. We would structure it around four distinct authorities.

• Mission execution. The remote operator runs the plan, monitors the assets, and handles the routine. This is the high-volume, lower-consequence work that automation is meant to absorb, freeing attention for the exceptions.
• Deviation and data acceptance. Any departure from the approved procedure, and any decision to accept or reject data against specification, sits with a named survey authority – typically the onshore survey lead or data QC lead. Acceptance is judged against a stated standard: for hydrographic deliverables, the relevant order of IHO S-44 (Edition 6); for geophysical and construction survey, the client specification and IOGP guidance (e.g., IOGP Report 373-18-1). The person holding this authority owns the audit trail for the integrity decision.
• Abort and fail-safe. The response to loss of link, positioning failure, or collision risk must be pre-engineered and pre-authorised, not improvised. Define the fail-safe states – hold position, transit to a safe waypoint, controlled shutdown of sources – and make them automatic on defined triggers. A human who has to decide the fail-safe in the moment the link drops is a human who has arrived too late.
• Environmental stop. Remote marine mammal observation only works if the observer ashore holds unambiguous authority to halt acoustic sources, in line with the applicable mitigation regime (for UK waters, JNCC guidance). Authority delegated in name but overridable by operational pressure is not authority.

Two interfaces deserve particular attention. The first is the handover. Shore-enabled operations invite a follow-the-sun roster across geographies, and every operator-to-operator handover is a point where situational awareness leaks. Treat handover as a formal, checklisted transfer of a defined system state, and measure its defect rate. The second is the contractual boundary. When the ROC coordinates assets and specialists who sit inside different contracts – the operator, the survey house, an ROV provider – the authority to stop or redirect work has to be agreed before mobilisation, not discovered during an incident. The governance problems that arise when separately contracted parties share the same operation do not disappear when the deck goes empty; they move ashore and often become harder to see.

On competence, the uncomfortable truth is that sea time still matters. A remote operator making a real-time call about a degrading operation needs the tacit knowledge that only comes from having stood the equivalent watch offshore. Competence frameworks need a remote-operations addendum covering loss-of-link drills, alarm-state recognition, multi-asset situational awareness, and handover discipline. The competence lessons drawn out in our reading of BSEE Alert 524 for survey and positioning crews apply with more force ashore, not less, because the physical cues that used to backstop a thin competence assessment are gone.

What it costs and what it buys

Establishing a Remote Operations Centre (ROC) involves significant initial investment and requires more than just a room with screens. It requires diverse and redundant communications paths, sufficient satellite bandwidth for the payload and telemetry loads, a cyber-security posture appropriate to remotely controlling marine assets, and a physical and procedural environment designed for sustained watchkeeping. Alarm systems must be engineered to a recognised standard because a one-to-many operation floods an operator with alarms far faster than a single-vessel online cabin ever did, and an operator in alarm overload is an operator who will miss the one that matters. Add simulator-based training, dual-running during the transition while the old and new models coexist, and the rewrite of procedures and competence documents. None of this is cheap, and pretending otherwise sets the business case up to disappoint.

The return is more than headcount. The clearest gain is exposure: fewer people offshore and fewer transits means a materially smaller HSE risk footprint, which reads directly into the safety-management case and into the personnel-on-board figures that drive so much offshore cost and risk. The second gain is the ability to apply scarce senior expertise across several operations at once – one experienced geophysicist performing quality control on multiple jobs from shore rather than being consumed by a single vessel. The third, and the most underrated, is retention. Shore-based roles with a normal roster and a life at home widen the recruiting pool and hold onto experienced people who would otherwise leave rotational offshore work. In a market where the value of a survey business is increasingly its people rather than its steel, that matters, a point we have made about what actually creates scale in the offshore survey market.

Implementation: what to build, and the early signals it is going wrong

Treat the transition as a controlled qualification programme, not a switch. The following steps and metrics give a function head something testable inside their own organisation.

1. Write the decision-rights matrix before the first remote mission. For every consequential decision – deviation, data rejection, abort, environmental stop – name the role that holds it and the standard it is judged against. Review it with the client and any separately contracted parties. Treat an unassigned decision as a mobilisation stopper.

2. Engineer and drill the loss-of-link response. Define the fail-safe states and the triggers, then prove them in trials before live work. Measure loss-of-link events per operating hour and, more importantly, mean time to a confirmed safe state. A rising time-to-safe-state is your earliest warning that the model is outrunning its safeguards.

3. Set span of control from workload analysis, not from the commercial model. A defensible starting rule is one operator per asset during deployment, recovery and other critical phases, relaxing to one-to-many only in transit and steady-state acquisition. Revisit it whenever the alarm load per operator-hour exceeds the manageable level.

4. Make data acceptance auditable. Every acceptance or rejection against IHO S-44 order or the client geophysical specification should generate a record naming the decision-maker and the basis. Track first-time-right acceptance rate as a quality KPI and the proportion of missions completed with zero undocumented deviations.

5. Build a remote-operations competence addendum onto the existing framework. Require documented sea-time grounding for anyone holding real-time authority, plus periodic loss-of-link and degraded-operation simulator assessment. Do not let the ROC become a place where competence quietly decays because the physical consequences feel distant.

6. Formalise handover. A checklisted transfer of defined system state, with a measured handover-defect rate feeding your continual-improvement loop under ISO 9001:2015.

Decisions being made on the loudest voice on the channel rather than by the assigned authority. Deviations that appear in the data but not in the record. Alarm loads climbing without a corresponding review of span of control. And competence assessments that have quietly become paperwork exercises because no one ashore has recent, felt experience of the operation they are signing off. Each of these is an organisational failure long before it becomes an incident, and each is visible to a function head who is looking for it.

Shifting from vessel-centred to shore-enabled operations represents a different operating model. But the hard part was never the autonomous platform. It is the assurance case – who is competent to decide what, who carries it when the deck is empty, and what happens when that person is unavailable. Get that right and the technology delivers. Leave it implicit and the empty deck simply moves the risk somewhere harder to see.

---

Based on: Operating Without People at Sea Doesn’t Mean Operating Without People