MARIN Mapped the Safety Risks of Remote Controlled Sailing

Rijkswaterstaat commissioned MARIN to work out what can go wrong when an inland vessel is navigated from shore. The result, published in December 2025, is a 99-page exploration of the safety risks of remote controlled sailing. It identifies eleven risk areas, sets out the measures each one requires, and reaches a conclusion the sector needs to read carefully rather than selectively: remote navigation is technically promising, and it is not yet safe to implement without significant safeguards.

The question put to MARIN was deliberately broad. Map the risks of operating an inland vessel remotely, with or without a reduction in crew, and with or without onboard TGAIN support. Then map the measures needed to keep navigation safe and efficient. Legal questions, cost-benefit analysis and the business case were explicitly left outside the scope.

MARIN built the assessment on a Goal Based Task Analysis, combined with its socio-technical model and embedded in the IMO Formal Safety Assessment methodology. In practice that means the researchers took every goal a boatmaster pursues in the wheelhouse and every task that serves it, and projected those onto a shore-based operator instead. The report was reviewed externally by researchers from Aachen University, the Development Centre for Ship Technology and Transport Systems in Duisburg, and the University of Duisburg-Essen.

The choice of perspective matters more than any single finding. MARIN did not assess remote support with a boatmaster sitting behind the levers. It assessed the harder case: an unattended wheelhouse, with navigation commenced from a shore-based Remote Operation Centre. That framing is what surfaces the risks, because every task that a person in the wheelhouse performs without thinking about it has to be reassigned, instrumented or replaced.

A set of guiding assumptions frames the whole report, and they are worth stating plainly because they are also the assumptions we operate under. Responsibility remains with the boatmaster onboard as long as any crew is onboard, and the boatmaster must have both the opportunity and the mandate to take back control at any moment. Both the responsible boatmaster and the Remote Operator hold a certificate of qualification in inland navigation under the European Standard for Qualifications in Inland Navigation, meaning both are trained and experienced enough to navigate from the wheelhouse themselves. Both are assumed fit for duty. And all large inland vessels are assumed to carry Inland AIS and Inland ECDIS in line with ES-TRIN.

The eleven risk areas cover the full task set. Voyage planning delegated to the shore-based operator, which needs structured procedures, accurate information exchange and validation by the boatmaster onboard. Briefing during control handovers, which needs formalised communication protocols. The changeover of control itself, planned and in emergencies, which needs procedures, training and safeguards. Environmental monitoring, from under-keel clearance to traffic, obstacles, weather and vessel position, which needs equipment redundancy and ES-TRIN compliance. Monitoring and control of propulsion and steering, which has to be fully operable from the Remote Operation Centre. And emergency detection, where fire and flooding alarms have to be both visible and actionable from shore, because crew safety depends on it.

One risk sits above the rest. MARIN treats total failure of the data connection between the vessel and the Remote Operation Centre as a critical concern until it is proven otherwise, and draws the operational consequence directly.

This is the sentence that generated the headlines, and it is more precise than the headlines were. MARIN is not saying that remote navigation requires a full crew. It is saying that the connection is the single point of failure, and that until a vessel can safely hold position or track on its own when the link drops, someone competent has to be able to reach the controls. The condition is technical, and it is therefore solvable.

The second finding gets less attention and deserves more. Boatmasters are formally certified. Other crew members are not necessarily trained for the role they end up playing when navigation moves ashore, and the current qualification framework has nothing in between. MARIN recommends researching a secondary qualification standard: a formalised level of training below boatmaster, but sufficient for safe task performance during remote operations.

That recommendation matters for the whole discussion about crew reduction. MARIN notes that tasks limited in complexity or frequency may not require a fully certified boatmaster. If that is true, the constraint on reduced crew operations is not the number of people onboard but what they are qualified and trained to do. A qualification standard is a faster instrument than a technology roadmap.

MARIN does identify opportunities for manning reduction, and is careful to make them conditional. The ability to reduce crew safely depends on the technical capability of the specific vessel and on the presence of fallback procedures. Until autonomous fallback modes are fully developed and validated, a competent operator stays onboard. Read as a whole, the report describes a sequence rather than a verdict: prove the fallback, formalise the procedures, close the qualification gap, and the manning question opens up.

MARIN's guiding assumptions are, almost line for line, the model we run today. The boatmaster onboard keeps responsibility and can take back control at any time; that is what the Seafar Console is for, and why a transfer of control has to be accepted on the vessel rather than claimed from shore. Our Remote Operators hold inland navigation qualifications under ES-QIN, because a shore-based operator who could not sail the vessel from its own wheelhouse is not a substitute for one who can. Connectivity is treated as the critical system it is, which is why Seafar Shield exists as a redundant, cyber-secure networking backbone rather than as a commodity data link. And TGAIN is onboard support for track keeping, not a fallback for a lost connection, which is exactly the distinction MARIN draws.

Where we would push the report further is on evidence. MARIN assesses risk in principle, from task analysis, which is the right method for an exploration. The sector now also has operational data: tens of thousands of hours of remotely supported sailing across the Flemish and Dutch networks, with the handover events, connection statistics and incident record that come with them. The eleven risk areas are the right agenda. The next step is testing each Risk Control Option against what actually happens on the water, and using that to decide which conditions are permanent and which were provisional.

• MARIN, Exploration of safety risks in remote controlled sailing, report no. 35853-1-PaS, version 4.0, November 2025. Commissioned by Rijkswaterstaat. Published as annex 2 by the Dutch government on 16 December 2025.
• European Standard for Qualifications in Inland Navigation (ES-QIN), CESNI.
• European Standard laying down Technical Requirements for Inland Navigation vessels (ES-TRIN), CESNI.