The MASS Code's foundational idea is the operating envelope — a bounded description of the conditions under which a given autonomous ship is certified to operate: sea state, visibility, traffic density, link availability, geographic area. Autonomy inside the envelope is authorised; the ship that drifts outside it is supposed to do something defined, not improvise.
The envelope is the certification mechanism — and the exit is the load-bearing scenario. This article unpacks what the code actually requires when the envelope boundary is crossed.
Key findings
- The operating envelope is the MASS Code's central certification mechanism — autonomy is bounded by the conditions it's certified for, not by a general 'autonomy level'. Established
- Envelope exit triggers a defined transition — to remote control, to a degraded autonomy mode, or to a safe state — designed into the ship, not improvised. Established
- The exit is not a failure; it's the system's declared limit announcing itself — the analogue of a railway's 'drive on sight' or an aircraft's flight envelope protection. Maritime-GPT analysis
- The hard open problem is the <em>gradual</em> exit — a slow degradation (sensor drift, weather trending worse) that approaches the boundary without a clean trigger. Maritime-GPT analysis
- Link loss is the sharpest envelope edge: a remotely operated ship that loses its command link exits the envelope instantly, by definition. Established
The envelope as certificate
Traditional ship certification is material: the hull, the machinery, the equipment are what's certified. MASS certification is <em>operational</em>: the envelope is the certified parameter set — the conditions the autonomy was designed and validated for. A ship certified for open-sea autonomy in sea state 4 loses its authorisation in sea state 7 — not because the ship changed, but because the conditions left the validated region. The envelope is the contract between what the system was proven to handle and what it's being asked to do. Established
What exit actually looks like
- <strong>Graceful boundary.</strong> The envelope is defined by measurable parameters — the system detects the approach, alerts the ROC, and hands off or degrades before the boundary, not at it. Established
- <strong>The safe state.</strong> If no takeover is possible, the ship goes to a defined safe state — reduced speed, loiter, hold position, or anchor — chosen so that 'stopped correctly' is always safer than 'moving wrongly'. Established
- <strong>The alerting duty.</strong> Exit triggers a report — to the ROC, to the flag administration, to the operator — because the envelope boundary is a certification event, not just an operational one. Established
- <strong>The gradual case.</strong> The hard engineering problem is the slow approach — conditions trending toward the boundary where the decision of when to exit is itself the judgement call the system must make or escalate. Maritime-GPT analysis
The validation gap
The code requires the envelope and the fallback; it does not yet fully specify how to <em>prove</em> the exit works. Simulation is the obvious tool — inject envelope violations, verify the transition — but 'the simulation showed the ship entered its safe state' is weaker evidence than a real trial, and the real-trial version (deliberately exiting the envelope at sea) is exactly what regulation makes hard to do. This is the experience-building phase's central technical question. Maritime-GPT analysis
What we know
- The envelope is the certified parameter set — autonomy is bounded, not general.
- Exit triggers a designed transition to remote control, degraded autonomy, or safe state.
- Link loss and weather exceedance are the canonical exits.
What we don't
- How to validate envelope exits at scale — simulation vs sea trials.
- The right behaviour for a gradual (not binary) boundary approach.
- What happens in congested water when 'safe state' is itself unsafe.
Being tested
- Simulator-based envelope-exit certification.
- Graceful-degradation standards for autonomous navigation.
- ROC takeover procedures and timing under envelope pressure.
Maritime-GPT analysis
The envelope is the honest part of the MASS Code — it admits autonomy has limits and builds the architecture around declaring them. The weakness is the exit's validation: a designed safe state is only as good as its demonstration, and demonstrating the exit safely is the certification paradox the industry is working through. The ships that will pass are the ones whose envelopes are narrow enough to be certifiable — which is also why the first autonomous fleets will be boring by design. Maritime-GPT analysis
This is a research feature, not operational guidance. Simulation results are reported as simulation; demonstrations are not deployments; company claims are attributed as such. Verify safety-critical decisions against official nautical publications and flag-state requirements.
Sources & evidence
The instrument that defines the operating envelope and exit requirement.
The certification-by-envelope approach vs prescriptive equipment rules.
The command configuration the envelope exit activates.