A multi-configuration hazard analysis framework for Maritime Autonomous Surface Ships operating in winter conditions

Operating Maritime Autonomous Surface Ships (MASS) in winter environments involves multiple Levels of Autonomy (LoA) and Operational Phases (OP), whose pairings are referred to as system configurations. Existing studies analyze configurations separately, miss cross-configuration dependencies, and repeatedly represent shared safety information. To address this, the study proposes a multi-configuration hazard analysis framework expanding STPA within a Model-Based Systems Engineering (MBSE) environment using the RAAML profile. The primary contribution is a unified modeling environment in which safety elements are embedded directly into the model and configuration stereotypes indicate where each element applies. The framework is demonstrated through a case study of two MASS configurations, at two LoAs within an OP, during an icebreaker assistance operation, including the transfer of control between the automated system and the remote operator. The case study shows that shared components, actors, and activities can be modeled once and reused rather than duplicated, and that identical causal factors propagate differently across configurations. Formalizing STPA outputs into structured models supports traceability across configurations, allowing practitioners to navigate and maintain safety information that would otherwise be held in static documentation. The framework provides a basis to structure hazard analyses of autonomous systems, requiring further validation as winter operations mature.