A remotely operated ship is a distributed system: the hull and the bridge are in different places, connected by satellite. The MASS Code formalises the Remote Operations Centre as the shore-side command point — and in doing so makes the communications link a load-bearing structural element of the ship, not a convenience. Lose the link and the ship must degrade gracefully, because the alternative is a 200-metre vessel with no one at the wheel.
The connectivity requirement is the quiet hard problem inside MASS — bandwidth, latency, redundancy, coverage and the cyber exposure of the link itself.
Key findings
- The ROC is a MASS-defined facility — the shore-side node that commands, monitors or supervises the ship; the link to it is a certified system component. Established
- Link loss is the designed-for failure: the ship must transition to onboard autonomy or a safe state, not hang waiting for reconnection. Established
- Satellite coverage, weather attenuation and bandwidth caps are operational constraints, not edge cases — the ROC's command capacity is bounded by them. Established
- The comms link is also the cyber attack surface — the channel an intruder would most like to own. UR E26/E27 connectivity requirements apply directly. Established
- ROC economics push toward one operator supervising many ships — which makes the link's reliability and the operator's attention the two binding constraints. Maritime-GPT analysis
The link as a certified component
In a manned ship, comms failure is an inconvenience; in a remotely operated ship it's a structural failure. The MASS Code therefore treats connectivity as part of the system being certified — the ship must be demonstrated to remain safe through the defined degradation of its link, which means the autonomy must be capable of the whole envelope alone for the duration of an outage, or the ship must reach a safe state before the link is needed again. Established
The bandwidth reality
Real remote operation needs sensor telemetry, video, audio, and command backhaul — a bandwidth and latency profile satellite links provide only partially, and only at cost. LEO constellations (Starlink and competitors) have changed the economics — better bandwidth, lower latency — but the ocean remains coverage-sparse and weather-sensitive, and a channel that can carry a video feed in good conditions may not carry it in the storm when it's needed most. The link is provisioned for the worst case, not the average. Established
The ROC's two bindings
- <strong>The link binding.</strong> The ROC's effective command capacity is a function of link reliability — one operator to one ship on a good link is feasible; one to many only works if each ship's autonomy is trustworthy for the intervals between check-ins. Maritime-GPT analysis
- <strong>The attention binding.</strong> Even with a perfect link, the ROC operator supervising N ships has N-supervision attention — the human-factors literature on vigilance applies to shore-side watchkeeping exactly as it does aboard. Maritime-GPT analysis
- <strong>The cyber binding.</strong> The link is the channel an attacker most wants — spoof it, jam it, or infiltrate the ROC itself. The connectivity requirement is simultaneously the cyber requirement. Established
What the code demands of the link
The code's expectation is bounded redundancy: diverse comms paths (no single point of failure), defined degradation behaviour (what the ship does at 50% bandwidth, at 0%), and the ROC's ability to detect link degradation before it's a casualty. The technical standards are emerging through the experience-building phase — the requirement is the destination, the implementation is the open question. Established
What we know
- Connectivity is a certified system component, not infrastructure the ship happens to use.
- Link loss must trigger a defined safe degradation, not a hang.
- The comms link is the primary cyber-attack surface of remote operation.
What we don't
- Proven redundancy architectures that survive both link loss and cyber attack.
- How many ships one ROC operator can safely supervise on real links.
- Whether LEO coverage is good enough for the worst-case requirement.
Being tested
- Multi-bearer comms with automatic failover.
- ROC operator-to-ship supervision ratios.
- Link-degradation detection and automatic envelope-narrowing.
Maritime-GPT analysis
The connectivity requirement is where MASS meets physics: a ship that needs a link to be safe is only as safe as the link — and the link is a satellite signal over an ocean. The engineering answer is to design the autonomy to survive the link's absence, which is exactly the autonomy the code's envelope concept is built around. The link isn't a feature of the ship; it's a constraint the autonomy must be certified against. Maritime-GPT analysis
This is a research feature, not operational guidance. Simulation results are reported as simulation; demonstrations are not deployments; company claims are attributed as such. Verify safety-critical decisions against official nautical publications and flag-state requirements.
Sources & evidence
The instrument defining the ROC and connectivity requirement.