ECDIS Fundamentals

The chart is not the sea.
The position is not the ship.

Introduction

ECDIS became mandatory across the SOLAS fleet in phases ending in 2018. The transition was presented as an advance. In many respects it was. But the transition also created a generation of watchkeepers for whom the chart is a screen, the position is a symbol, and the relationship between display and reality is assumed rather than interrogated.

The equipment works. Most of the time it works well. The problem is not the technology. The problem is the gap between what ECDIS shows and what the sea actually contains, and the institutional willingness to treat that gap as negligible. It is not negligible. It is where groundings happen.

This article addresses what ECDIS is in operational terms, what it depends on, where it lies, and why the phrase “primary means of navigation” is a regulatory classification — not a statement about the reliability of anything displayed on that screen.

Contents

• 1. What ECDIS Is and Is Not
• 2. ENC and RNC: The Chart Data Distinction That Matters
• 3. Sensor Dependencies: The Chain Behind the Symbol
• 4. GPS Fails Silently
• 5. Gyro, Log, and the Compounding of Small Errors
• 6. AIS and Radar Overlay: Correlation Is Not Confirmation
• 7. The Gap Between Display and Reality
• 8. Common Over-Trust Failures
• 9. Closing Reality

1. What ECDIS Is and Is Not

ECDIS is a type-approved navigation information system. It displays electronic chart data, accepts sensor inputs, and provides route planning and monitoring functions. Under SOLAS V/19.2.10 and the associated Performance Standards (IMO Resolution MSC.232(82)), a type-approved ECDIS operating with up-to-date ENCs and adequate backup can serve as the primary means of navigation, replacing the requirement for paper charts.

That is its regulatory identity.

Operationally, ECDIS is a display system. It does not measure anything. It does not know where the ship is. It receives a position from a GNSS receiver, a heading from a gyrocompass, a speed from a log, and it plots a symbol on a chart constructed from data supplied by a hydrographic office. Every element in that chain is an input, and every input carries uncertainty.

ECDIS does not navigate the ship. It shows a picture assembled from external data. The quality of that picture depends entirely on the quality of what feeds it and the quality of what was surveyed to create the chart underneath.

This distinction matters because the type-approval process and the regulatory language give ECDIS an authority that its data chain does not inherently possess. The system looks authoritative. The screen is crisp. The own-ship symbol sits in clear water. None of that is proof of anything.

2. ENC and RNC: The Chart Data Distinction That Matters

ENCs — Electronic Navigational Charts — are vector datasets produced by national hydrographic offices to the IHO S-57 standard (and progressively S-101 under S-100). They are structured as objects with attributes: a depth sounding is a data object, a buoy is a data object, a traffic separation scheme is a data object. This structure enables ECDIS to query, alarm, and filter. Route checking works because the software can read the chart semantically, not just visually.

RNCs — Raster Navigational Charts — are scanned images of paper charts. They carry no queryable data structure. ECDIS cannot alarm against a hazard it cannot identify as a data object. Operating on RNCs, ECDIS functions as a chart viewer with a GPS position overlay. It does not meet the SOLAS definition for a system that replaces paper charts. An ECDIS operating exclusively on RNCs is operating in RCDS mode and requires a full paper chart outfit as backup.

The practical consequence is absolute. On an ENC, ECDIS can generate a warning when a planned route crosses a safety contour. On an RNC, it cannot. On an ENC, look-ahead alarms function because the system can parse depth areas ahead of the vessel. On an RNC, there is no parsing. There is only an image.

ENC coverage is not universal. Some regions remain covered only by RNCs or have ENCs compiled from old survey data at inadequate scales. The fact that an ENC exists does not mean the underlying survey is recent or thorough. Many ENCs are digitised reproductions of paper charts that were themselves based on lead-line surveys from the nineteenth century. The vector format gives the data a modern appearance. The data itself may be 150 years old.

This is not always obvious to the user. A clean vector chart at a usable scale looks like a reliable chart. It may not be.

3. Sensor Dependencies: The Chain Behind the Symbol

Every element shown on the ECDIS display depends on at least one external sensor. The own-ship symbol depends on GNSS for position and gyro for heading. The vector (COG/SOG) depends on GNSS or log. Radar overlay depends on a radar feed and correct heading alignment. AIS targets depend on the AIS transponder’s reception of other vessels’ broadcasts. Depth indication depends on the echo sounder.

If any of these inputs degrade, the display degrades. But — and this is the critical operational point — the display does not always show the degradation in a way that commands attention. ECDIS may flag a sensor alarm. Whether the OOW notices, interprets, and acts on that alarm depends on a vigilance model that is, in practice, unreliable.

The system has no way of knowing whether the data it receives is correct. It knows whether data is arriving. That is all. A GPS receiver outputting a position with a 300-metre offset due to atmospheric anomaly or spoofing will feed that offset directly to ECDIS, and the own-ship symbol will sit 300 metres from the ship’s actual position with no alarm, no flag, and no indication that anything is wrong — provided the signal is clean and the integrity check is not exceeded.

ECDIS trusts its inputs. That trust is absolute and unquestioning.

4. GPS Fails Silently

GPS is the dominant position input. In most installations it is the only position input. Differential corrections improve accuracy, but the fundamental dependency remains a satellite constellation operated by a foreign military, delivering signals at power levels so low they are trivially jammed or spoofed.

Jamming is crude. It overwhelms the receiver. The receiver reports no fix. ECDIS alarms. The failure is visible.

Spoofing is not crude. A spoofed signal provides the receiver with a coherent, plausible, false position. The receiver accepts it. ECDIS accepts it. The own-ship symbol moves smoothly to a location the ship does not occupy. No alarm fires. The display looks normal.

Documented spoofing events in the Eastern Mediterranean, the Black Sea, and Chinese coastal waters have placed vessels kilometres from their actual positions. In several cases, multiple ships were shown congregating at the same fictitious point. The anomaly was noticed because the clustering was absurd. In a less obvious scenario — a few hundred metres of offset in a confined channel — the error could be invisible until the hull meets the bottom.

GPS also fails through geometry. Mountainous coastlines, high bridge structures, and urban canyons degrade satellite visibility and introduce multipath errors. These are not rare conditions. They are common conditions in precisely the waters where position accuracy matters most.

The mitigation is independent verification. Radar bearings and ranges to charted objects. Visual bearings. Depth correlation. Techniques that predate GPS by decades. Techniques that are practised less and less because the GPS position is always there, always smooth, and almost always right.

Almost always right is the most dangerous kind of wrong.

5. Gyro, Log, and the Compounding of Small Errors

The gyrocompass provides heading. A heading error rotates everything: the chart orientation if north-up is referenced to the gyro, the radar overlay alignment, and the predicted track vector if it is based on heading and speed through water.

Gyro drift is normally small. But “normally small” is not “zero,” and it is not “always small.” A gyro settling after a large course alteration, a gyro running on a vessel at high latitude, a gyro affected by vibration or power supply instability — these produce errors that are real and that propagate through every system connected to the heading feed.

A one-degree heading error on a radar overlay will displace charted features relative to radar echoes. At close range, this is a fraction of a pixel. At ten miles, it is hundreds of metres. If the watchkeeper is using radar overlay on ECDIS to confirm position, a heading error means the radar picture and the chart picture will misalign, and the instinct will be to trust the chart — because the chart looks clean and the radar echo has noise.

The speed log feeds rate of turn calculations and, where STW is used, dead reckoning backup. A log reading 10% high or low will not trigger an alarm. It will simply make the DR position wrong and the arrival time wrong. On passage this is a nuisance. In pilotage waters, with rate of advance calculations feeding turn planning, it is a hazard.

These are not dramatic failures. They are quiet inaccuracies, each individually survivable, collectively dangerous.

6. AIS and Radar Overlay: Correlation Is Not Confirmation

ECDIS can display AIS targets and radar overlays simultaneously with chart data. The result is a composite picture that looks comprehensive. It is important to understand what it actually represents.

An AIS target is a broadcast from another vessel. It shows the position, heading, and speed that the other vessel’s equipment has computed and transmitted. If that vessel’s GPS is offset, the AIS target is offset. If that vessel’s heading sensor is faulty, the AIS heading is faulty. The data is only as good as the transmitting vessel’s equipment. There is no independent verification.

AIS is also voluntary for many vessel classes, mandatory but non-functional for some, and deliberately switched off by others. An ECDIS display showing three AIS targets in a waterway may be showing three of fifteen vessels actually present. The absence of an AIS symbol is not the absence of a vessel.

Radar overlay on ECDIS depends on accurate heading alignment. If heading is correct, radar echoes should correspond with charted objects. If heading is not correct, they will not, and the discrepancy can be subtle enough to miss at normal watchkeeping zoom levels.

Radar also shows things that are not on the chart — vessels, weather, sea clutter. And charts show things that are not on the radar — depths, regulated areas, recommended tracks. The overlay creates the impression of a unified picture. It is two separate, independently fallible data streams placed on top of each other. Alignment is not truth. Correlation is not confirmation. Both can be wrong simultaneously.

7. The Gap Between Display and Reality

The most consequential misunderstanding about ECDIS is the assumption that the chart represents the sea. It does not. The chart represents a historical record of survey data, processed through cartographic generalisation, compiled into a digital format, and rendered on a screen.

Survey coverage is uneven. In well-trafficked European and North American waters, modern multibeam surveys provide dense, accurate depth data. In large parts of the Pacific, Indian Ocean, Southeast Asian archipelagos, and polar waters, the most recent survey may have been conducted by a vessel using a single-beam echo sounder — or a lead line — decades or centuries ago. The IHO’s own data quality indicators (ZOC — Zone of Confidence, now CATZOC) encode this uncertainty, but they are displayed as small metadata symbols that most watchkeepers never interrogate.

CATZOC category D means the data is low quality, with position and depth uncertainties that may exceed 500 metres and may not include all significant features. CATZOC U means the quality is unassessed. These categories are common. They are common on charts that are actively used for passage planning and execution.

The chart may also lag reality. Wrecks appear after the last chart update. Sand banks shift. Buoys are moved, withdrawn, or off-station. A Notice to Mariners updates the data — eventually. Between the event and the update, the chart shows a world that no longer exists.

ECDIS displays confidence. Confidence is not accuracy.

The screen resolution compounds the problem. At a given display scale, small features may be suppressed or generalised. A rock awash may be a single pixel at passage planning scale and invisible at smaller scales. Zooming out removes information without warning that it has been removed. The display looks complete at every scale. It is not.

8. Common Over-Trust Failures

Accident investigation reports from MAIB, ATSB, BSU, and others identify recurring failure patterns involving ECDIS. They are not failures of the equipment. They are failures of the human interaction with the equipment.

Safety contour set incorrectly. The safety contour is the single most important alarm parameter in ECDIS. If set to the wrong depth — or left at the factory default — the system will not warn of shallow water relevant to the vessel’s draught. This has caused groundings. It continues to cause groundings.

Alarms suppressed or ignored. ECDIS generates a high volume of alerts during coastal passages. The response, documented repeatedly, is to acknowledge without reading or to reduce alarm parameters until the alerts stop. The system is then monitoring nothing. It is displaying a picture. Nothing more.

Over-reliance on the own-ship symbol for position. The own-ship symbol is a GPS-derived plot. If it is the only position reference used, there is no independent check. Radar position fixing, visual bearings, and echo sounder correlation against charted depths are independent checks. When these are abandoned because the ECDIS picture “looks right,” the vessel is one sensor failure away from grounding with no warning.

Passage plan not checked at large scale. A route drawn at small scale may cross hazards visible only at large scale. ECDIS route check functions exist but are only as effective as the safety parameters set and the willingness to review the results in detail. A green “route OK” indication does not mean the route is safe. It means the route does not violate the parameters currently entered. If the parameters are wrong, the indication is meaningless.

Assumption that the chart is the ground truth. When a radar echo appears where the chart shows deep water, the correct response is suspicion of the chart, not dismissal of the echo. The opposite response — trusting the chart over the radar — has been cited in multiple grounding reports. The chart is a model. The radar is seeing something. The something is real. The chart may not be.

Failure to monitor CATZOC. Operating in CATZOC D or U waters at speed, at night, with full confidence in the displayed depths is not cautious navigation. It is hope. The system does not force the user to acknowledge survey quality. The user must seek it out. Most do not.

9. Closing Reality

ECDIS is approved as the primary means of navigation. That is a regulatory statement. It means a flag state and a classification society have accepted that the equipment, its installation, and its chart data meet a standard. It does not mean the position shown is correct. It does not mean the chart beneath that position reflects the current state of the seabed. It does not mean the alarms will catch the danger. It does not mean the sensor chain is healthy at this moment.

“Primary means of navigation” is a legal designation. It tells the auditor which system to check. It tells the watchkeeper nothing about the reliability of what that system is currently displaying.

Position must be verified independently. Chart data must be treated as uncertain until proven otherwise. Sensor inputs must be cross-checked. Alarms must be set properly and responded to properly. The display must be questioned, not trusted.

A quiet ECDIS screen is not a safe ship. It is a picture of one.