Menu Close

Feedback Loops and Fundamental Flaws in Autonomous Warships

This month, IBM’s Mayflower Autonomous Ship successfully accomplished a 3,500-mile transatlantic journey, gathering ocean knowledge for analysis on air pollution and local weather change. The voyage was a hit: Mayflower‘s sensors and machine-learning systems performed flawlessly. The ship did, however, suffer a problem with electrical power. This was also Mayflower’s second try at a crossing. The first was scuttled by a failed steel coupling on the ship’s generator. Fortunately, fixed monitoring and communications with a shoreside crew recognized these failures earlier than they turned catastrophic.

As the U.S. Navy pivots to autonomous applied sciences for its future hybrid fleet of crewed and uncrewed ships, protection professionals and navy officers (impressed in no small half by the novels Ghost Fleet and 2034) are keenly conscious that each automated system is liable to intrusion. The concentrate on cyber assaults, nonetheless, obscures a extra elementary cyber reliability downside. When computer systems substitute folks in the position of monitoring engineering techniques, figuring out tools failures turns into harder. Leaving these issues unfixed makes vessels fail earlier, and fixing them places ships and folks in danger. In brief, automated techniques can introduce system-wide vulnerability even when no person hacks them.



Uncrewed vessels would require computer systems and inner networks to regulate and monitor hull, mechanical, and electrical techniques. Critically, these techniques — particularly these managing {the electrical} energy technology and cooling — will themselves energy the computer systems and networks monitoring them. Without human operators to determine or repair potential factors of failure early, small issues could compound, triggering suggestions loops. Moreover, uncrewed techniques would require near-real-time off-ship communications for command and management, and for monitoring how tools failures impression the general drive’s readiness. Combined with uncrewed vessels’ anticipated position as ahead sensors, this can make them persistent radiofrequency emitters, exposing them and close by models to enemy surveillance and concentrating on.

Integrating hull, mechanical, and electrical techniques with computerized controls is subsequently an inherent impediment to attaining a high-endurance, hybrid fleet resilient to cyber assaults, one that can have an effect on drive construction, disaster stability, and drive employment. Since uncrewed vessels will most definitely help ahead sensing, mine countermeasures, and anti-submarine warfare, these could also be among the many first capabilities {that a} future fleet loses, even earlier than a battle begins. In addition, since situational consciousness will degrade quicker than the capability to launch missiles for air protection, anti-surface warfare, and land assault, human decision-makers could face stress to expend missiles earlier than they lose the power to make use of them. During crises, this might improve the chance of battle. When conflict has began, it may restrict a commander’s flexibility.

Future Roles for Uncrewed Vessels

Recognizing the vulnerability of concentrated capital ship formations to China’s anti-access, area-denial capabilities, the Navy goals to disperse forces throughout future campaigns, an idea it calls “distributed maritime operations.” The deliberate fleet will encompass smaller, cheaper, and extra quite a few ships and submarines, alongside upgunned legacy platforms, networked to coordinate concentrating on and fires. Uncrewed vessels are integral to this plan.

The Navy’s long-range shipbuilding plan focuses on three classes of uncrewed vessels: giant and medium unmanned floor vessels and extra-large unmanned undersea automobiles. The medium vessel’s major roles might be ahead sensing and command and management, and its giant counterpart will function a missile journal. The extra-large unmanned undersea automobile — the one one whose procurement has been funded up to now — will carry anti-submarine payloads. The Navy can also be contemplating small expendable platforms.

Depending on testing outcomes, industrial base capability, and funds development, the Navy expects to discipline wherever from 81 to 153 unmanned floor vessels and 18 to 50 unmanned subsurface vessels by 2045 (out of a complete drive of 440 to 540 ships). Despite a congressional mandate to contemplate options to the massive unmanned floor vessel, uncrewed vessels function closely in the Navy’s plan to fulfill its drive goal. The regular retirement of air protection, strike, and anti-submarine platforms equivalent to cruisers, guided missile submarines, and the Littoral Combat Ship (with the Constellation-class frigate not getting into service till 2026), leaves few different choices.

Engineering Reliability in Automated Systems

The Navy’s 2023 long-range naval development plan prioritizes creating dependable hull, mechanical, and electrical techniques for uncrewed vessels. These techniques present the fundamental enabling capabilities (e.g., electrical energy or cooling) for fight techniques like a ship’s radar or inner community. On crewed warships, sailors monitor and fine-tune hull, mechanical, and electrical techniques across the clock. On ships with out folks onboard, computer systems and networks might be anticipated to do the identical.

Given the added layer of computer systems and networking, some observers have warned that uncrewed vessels face an elevated threat of cyber assaults. Malicious actors may compromise vessel {hardware} by way of provide chain vulnerabilities, or by tunneling into satellite tv for pc terminals for off-ship communications. Once in, hackers can transfer laterally inside the ship’s community, probably disrupting navigation and engineering techniques.

But one other threat ensuing from the dependence of uncrewed vessels on computer systems and networking has obtained much less consideration. At essentially the most elementary degree, uncrewed vessels will want propulsion, electrical, and auxiliary techniques to conduct sustained operations at sea. Without folks watching them, these techniques would require computerized monitoring and regulation by way of an inner community and off-ship communications. At the identical time, the community and communications tools will want the outputs of the identical engineering techniques they monitor, particularly electrical energy and cooling. The potential for degradations and failures — tools “casualties” — to consequence in suggestions cycles is critical. Even if a few of these casualties might be resolved remotely, others require corrective upkeep carried out by human operators, whose availability might be extra constrained in disaster or fight than in peacetime.

Graphic by the authors.

First, each inner management networks and safe off-ship communications require dependable, uninterrupted energy sources. A 2021 Office of Naval Research solicitation sought a power-generation system that might use present navy fuels, survive in tough seas, and require no scheduled upkeep for over 4,000 hours. Experimental energy sources like photo voltaic and wind have drawn curiosity, however variable climate situations and battery capability current main hurdles. Other conventional energy sources, equivalent to steam or gasoline generators, are too maintenance-intensive. Based on the necessities and present platforms being examined, diesel engines are the most definitely candidate to drive electrical energy technology in uncrewed vessels.

Diesel engines require day by day monitoring for early indicators of life-cycle-limiting casualties or catastrophic failures. On crewed vessels, secure working parameters are established based mostly on the potential for catastrophic impression. Other parameters, nonetheless, are left unmonitored — both utterly or for lengthy intervals — and seemingly menial duties assist management threat. For instance, listening for irregular noises, or guaranteeing high quality lubricating and gas oils, can stop bigger casualties. The presence of particulates or water in lubricating or gas oil — even at ranges inside parameters — should still be famous by a human observer as an early warning of degraded mechanical techniques.

Second, cooling techniques present both water-based or air-based temperature management to equipment and rooms that home community tools. On uncrewed vessels, there are fewer alternatives to determine mechanical failures in the huge array of pumps, air dealing with models, compressors, and different elements that make up cooling techniques. Opportunities to take motion previous to cascading failures are equally constrained. For occasion, operations in the littorals or in hotter waters usually tend to consequence in clogged sea chests — the place water is ingested via the hull — due to greater densities of sea life and crops in these environments. Whereas watchstanders on crewed vessels can determine differential stress modifications, and then clear sea chests or substitute filters, they can not achieve this on uncrewed vessels.

An array of transducers, cables, and servers allows interactions between these hull, mechanical, and electrical techniques, the inner networks that oversee them, and off-ship communications. Disruptions to energy and cooling, made extra doubtless by much less monitoring and knowledge assortment, will degrade these interactions. Unstable energy can interrupt communication sign paths, and inadequate cooling may cause knowledge loss or {hardware} shutdowns. Additionally, the maritime surroundings imposes the identical bodily pressures on computer systems because it does on low-tech {hardware}. For occasion, a cupboard’s cable connection or circuit card could jostle unfastened in tough seas. Without a watchstander accessible to re-seat the community connection, management over primary engineering techniques or the capability for off-ship communication will degrade accordingly.

Finally, off-ship communications should happen over safe channels. That requires loading time-limited cryptographic units: repeatedly altering digital keys that encrypt or decrypt transmitted data. Although cryptographic units that “roll keys” (deactivate the outdated encryption and substitute it with a brand new one) robotically are beneath growth, if a brand new key fails verification or masses incorrectly in an uncrewed system, troubleshooting must happen remotely. While over-the-air cryptographic updates are viable, the engineering reliability issues recognized earlier recommend that interruptions requiring a brand new cryptographic key load, equivalent to an influence shift, are more likely to happen extra incessantly on uncrewed vessels.

Impacts on Force Structure, Crisis Stability, and Force Employment

For each crewed and uncrewed platforms, survivability diminishes the longer a vessel is at sea, as tools suffers from routine wear-and-tear or harm. If a vessel operates in a degraded state, the probability {that a} casualty will worsen or cascade to different techniques will increase. Since a fleet operates as a crew, warships should periodically notify supervising models of kit casualties that might have an effect on the general drive’s mission-readiness. Adversaries can exploit these electromagnetic emissions to find and goal a ship.

Because crewed vessels can restore some casualties at sea, they’ll often forestall each cascading casualties and off-ship reporting. Hence, even when each uncrewed and crewed vessels possess tools of comparable high quality, and undergo the identical casualties, the survivability of uncrewed vessels decays extra steeply over time. All else held equal, their techniques fail or they produce exploitable radiofrequency emissions earlier than crewed vessels do.

Since uncrewed vessels are extra suited to some roles than others, these reliability points won’t be evenly distributed throughout a future fleet’s mission areas. Given the present state of the expertise and ahead projections, it’s doubtless that uncrewed vessels will in the end help ahead sensing, mine countermeasures, and anti-submarine warfare. If Congress’ skepticism resolves, they could additionally function adjunct missile magazines. Based on the foregoing, we advise implications for drive construction, disaster stability, and drive employment.

Structuring the Force

Force planners assume that, even with out battle harm, some platforms will fail on account of design flaws, poor workmanship, tough seas, collision, and corrosion. Each successive lack of a platform degrades the warfare space to which it’s assigned. And due to part uniformity or widespread structure throughout platforms, some failures could have an effect on a number of models assigned to the identical space.

While failure charges are more likely to be greater for uncrewed than crewed vessels throughout routine operations, they are going to be even larger throughout hostilities. Attrition might be highest for essentially the most frequent emitters: uncrewed vessels which are radiating both as a result of their position, or their engineering monitoring and casualty reporting, requires it. The uncrewed mission areas, subsequently — ahead sensing, mine warfare, and anti-submarine warfare — are subsequently extra more likely to lose capability earlier than the crewed mission areas do.

This means that, in a future hybrid fleet, crewed vessels might want to retain some residual capability for these roles assigned to uncrewed vessels, particularly these integral to protection of the high-value models (equivalent to anti-submarine warfare). In addition, optimum manning on the remaining crewed platforms will rely on whether or not they function inside or past the uncrewed vessels’ line of sight. Concepts of operations for within-line-of-sight missions must specify the situations beneath which crewed platforms ought to service failing uncrewed vessels and permit for the extra manning required to take action.

Losing Sensors Before Missiles

Force composition can have an effect on incentives for preemption earlier than battle begins. Scholarly work based mostly on unmanned plane means that they may also help states keep away from escalation, as a result of the lack of a drone is much less extreme than lack of human life . But uncrewed ships introduce a novel issue into maritime warfare: the disaggregation of capabilities. In the missile period, the development in naval warfare has been to combination capabilities on multi-mission platforms. Large and medium unmanned floor vessels, nonetheless, are particularly designed to separate taking pictures from sensing.

Accordingly, uncrewed vessels’ reliability issues may have a disproportionately larger impression on a hybrid fleet’s sensor capability (offered by medium unmanned floor vessels) than on its capability to launch missiles for air protection, anti-surface warfare, and land assault (offered by crewed destroyers or giant unmanned floor vessels). Medium unmanned floor vessels might be answerable for discovering and fixing targets, and, given the reliability issues recognized right here, will doubtless decline in mission-readiness extra quickly than the crewed vessels that might be answerable for launching missiles.

This presents heightened escalation dangers. Diminished situational consciousness can elevate a ship or drive’s sense of its personal vulnerability, decreasing the self-defense threshold in ambiguous situations, or rising incentives for preemption. If the mission-readiness of uncrewed property declines quicker than that of crewed vessels, human decision-makers could face the stress to “attack effectively first” — or put crewed vessels at larger threat to perform the identical missions — earlier than situational consciousness and defensive capability attain unacceptably low ranges.

Use It or Lose It

Once a battle has began, the upper attrition charges of uncrewed platforms may also depress the ratio of sensors to shooters. As the amount and high quality of incoming sensor knowledge diminishes, human decision-makers could face stress to expend missiles earlier than the widespread operational image degrades additional. This may consequence in firing at lower than splendid targets, and prematurely depleting magazines. Fifth-generation plane, unmanned aerial automobiles, or space-based property can substitute sensor capability from failing uncrewed vessels, however the floor fleet must compete with different parts of the joint drive for these property.

The disparate results of uncrewed vessels’ reliability issues throughout warfare areas additionally presents a dilemma for drive safety. If uncrewed vessels undergo engineering failures, then are bodily captured and exploited, adversaries may penetrate fleet networks and threaten a number of models. At the identical time, if uncrewed vessels talk to warn ships in firm of impending failure, they may give away the situation of close by models. Hence, uncrewed vessels should be far sufficient from crewed models to keep away from exposing the latter’s location by way of electromagnetic emissions, however shut sufficient that they are often repaired, recovered, or scuttled to stop seize and exploitation if and when their hull, mechanical, and electrical techniques fail.


The success of distributed maritime operations will rely on strong networks amongst vessels that keep steady propulsion, energy, and cooling. But present plans to attain this structure relaxation on an aspirational model of uncrewed vessel expertise. Even with ongoing — and well-funded — land-based testing necessities geared toward resolving reliability issues in automated techniques, among the drawbacks related to eradicating folks from ships are more likely to stay long-term options of the Navy’s future hybrid fleet.

Crewed warships will thus have to repair uncrewed vessels, step in to fill their roles, or face robust selections to make use of weapons techniques with incomplete data. The aspirational imaginative and prescient of uncrewed applied sciences thus makes crewed vessels extra essential, on the identical time that it forces their untimely retirement. And that is maybe essentially the most harmful suggestions loop of all.


Correction: An earlier model of this text twice referred to “negative feedback loops,” in the colloquial sense of “feedback loops that negatively affect the system’s functioning.” To keep away from confusion with the technical that means in which damaging suggestions loops restore a system to regular functioning, the phrase “negative” has been dropped from these two cases. 

Jonathan Panter is a Ph.D. candidate in the Department of Political Science at Columbia University. His analysis examines naval organizational practices and disaster administration. Prior to attending Columbia, he served as a floor warfare officer in the U.S. Navy.

Johnathan Falcone is an active-duty floor warfare officer in the U.S. Navy, serving as chief engineer aboard a littoral fight ship. He is a graduate of Princeton University’s School of Public and International Affairs and Yale University.

The authors thank Ian Sundstrom, Anand Jantzen, and convention individuals on the Cyber and Innovation Policy Institute of the U.S. Naval War College for help with earlier drafts of this text. The authors’ opinions don’t replicate the official stance of the U.S. Navy.

Image: U.S. Navy