ECDIS, AIS and Electronic Navigation

Prerequisites

This lesson covers electronic navigation at the level required of an Officer of the Watch (Unlimited) under STCW Table A-II/1. Before starting you should:

• Be confident with paper chartwork: chart datum, scale, symbols (NP5011), position fixing and plotting a course.
• Have studied the radar and ARPA lesson, including radar overlay and parallel indexing.
• Know the outline of passage planning (appraise, plan, execute, monitor), which the next lesson covers in depth.
• Be working towards the STCW ECDIS course (generic training to IMO Model Course 1.27) required for the certificate. Before you keep a watch on a particular ship you also need type-specific familiarisation for the make and model of ECDIS fitted, as required by the ISM Code and your company.

Learning Objectives

By the end of this lesson you will be able to:

• Distinguish an ECDIS from an ECS, and an ENC from an RNC, and explain what each means for legal carriage and safety.
• Set the safety depth, safety contour, shallow and deep contours correctly for your ship's draught and conditions.
• Describe the main ECDIS alarms and indications, display categories, overscale and scale warnings.
• Carry out a route check and explain its limits.
• Interpret CATZOC and apply it to under-keel clearance and margins of safety.
• Describe GNSS errors, jamming and spoofing, and how to detect them.
• Explain AIS, what it transmits and its limitations.
• Cross-check ECDIS against independent sources and recognise the warning signs of over-reliance, using real accident cases.

ECDIS and ECS

An Electronic Chart Display and Information System (ECDIS) is a navigation system that, with adequate back-up arrangements, can be accepted as meeting the chart carriage requirements of SOLAS Chapter V Regulations 19 and 27. To qualify it must:

• Be type-approved to the IMO performance standards (MSC.232(82) for systems installed from 2009; earlier systems to A.817(19)).
• Use official chart data: ENCs issued by or under the authority of a government-authorised hydrographic office.
• Be kept up to date.
• Have an approved back-up: usually a second independent ECDIS, or an appropriate folio of up-to-date paper charts.

SOLAS V/19.2.10 phased in mandatory ECDIS for most new and existing passenger ships, tankers and cargo ships on international voyages between 2012 and 2018, depending on type and size.

An Electronic Chart System (ECS) is any electronic chart display that does not meet these standards: a plotter, a laptop with navigation software, a pilot's portable unit. It may be a useful aid, but it is never a legal substitute for charts, and a navigator using one must keep the official charts as the primary reference.

The IHO is moving to the S-100 framework (S-101 ENCs, with new layers for things like bathymetric surfaces and under-keel clearance). IMO has adopted revised ECDIS performance standards, MSC.530(106), to allow S-100 ECDIS; check the current dates for when new systems must be S-100 capable. For now, S-57 ENCs remain the standard.

Chart Data: ENC and RNC

The key point for the OOW: in RCDS mode, ECDIS cannot warn you of danger. It is a picture. All the anti-grounding functions depend on vector ENC data.

Usage bands

ENCs are produced in navigational purposes, or usage bands: 1 Overview, 2 General, 3 Coastal, 4 Approach, 5 Harbour, 6 Berthing. Each band has a compilation scale. When you plan, use the largest scale (most detailed) cells available for each part of the route, and make sure they are all licensed, installed and updated.

Display Categories

S-52 groups chart information into three categories:

• Display base: always shown and cannot be removed. Coastline, own ship's safety contour, isolated dangers in safe water, traffic separation schemes, scale and units.
• Standard display: the default when ECDIS is switched on. Display base plus drying line, buoys and beacons, lights, fairways, restricted areas, chart scale boundaries and more.
• All other information: soundings, submarine cables and pipelines, all isolated dangers, magnetic variation, and more.

Spot soundings are not part of the standard display. If you need them (and in coastal waters you do), you must turn them on. Removing chart features to "clean up" the picture is one of the most dangerous habits on modern bridges. Never remove layers you need for the passage, and check the display after anyone else has used the ECDIS.

The display should also normally use the correct day, dusk or night palette. A daylight palette at night destroys night vision; a night palette by day can make low-contrast features nearly invisible.

Safety Settings

ECDIS protects the ship only if it knows how much water the ship needs. These settings are made by the navigating officer according to the master's instructions, recorded in the passage plan, and checked at every watch handover.

Safety depth

The safety depth is the depth the ship needs, including allowances:

Safety depth = static draught + squat + UKC allowance (+ other allowances, for example heel, swell, CATZOC)

ECDIS shows spot soundings equal to or shallower than the safety depth in a bold, black style; deeper soundings appear grey. The safety depth does not create any alarm on its own; it is a visual aid.

Safety contour

The safety contour is the contour ECDIS uses to divide safe from unsafe water and to trigger anti-grounding alarms. You enter a value (often the same as the safety depth, or the safety depth less the height of tide you can rely on). If that exact contour does not exist in the ENC, ECDIS selects the next deeper contour available. If no safety contour is entered, the system default is 30 m.

Click to zoom

In the example above:

• Static draught 9.0 m, squat 0.8 m, UKC margin 1.2 m give a safety depth of 11.0 m.
• The ENC in this area has 10 m and 20 m contours but no 11 m contour, so ECDIS uses the 20 m contour as the safety contour.
• Everything inside the 20 m line is now shown in the unsafe shade and will trigger alarms, even though some of it is 15 m deep.
• The isolated 9 m shoal in the "deep" water outside the 20 m line is shallower than the safety depth. ECDIS shows it as an isolated danger symbol in safe water (if enabled in the display) and the sounding in bold.

This jump to the next deeper contour can make ECDIS very conservative in shallow seas, with dozens of alarms. The wrong response is to set a shallower safety contour to "stop the alarms". The right response is to plan carefully, understand which alarms are real, and record why a route crosses the shaded area if it does (for example on a rising tide, with the master's approval).

Shallow and deep contours

With four-colour depth shading, the shallow contour (for example 5 m) and deep contour (for example 30 m) add extra bands so you can see the depth structure at a glance. Two-colour shading shows only safe and unsafe either side of the safety contour.

Tide and the safety contour

The ENC contours are referenced to chart datum (approximately LAT in UK waters). Some ECDIS allow tidal height to be applied dynamically; most do not. If you allow for tide when setting the safety contour, you must be certain of the time window and record it. If the passage is delayed, the setting is no longer safe.

Alarms and Indications

MSC.232(82) separates alarms (audible and visual, needing action) from indications (visual information). The main ones the OOW must know:

The look-ahead zone

Most ECDIS check for dangers using a look-ahead area ahead of the ship, defined by time (for example 6 minutes) or distance and a width. If the look-ahead is too short, the alarm comes too late to stop; if too long, it alarms constantly and is ignored. Set it from the master's standing orders and the ship's stopping and turning ability.

Alarm management

Alarm fatigue is real. Frequent nuisance alarms lead officers to silence, acknowledge without reading, or disable alarms. In several groundings, the audible ECDIS alarm had been turned off. Your company procedures should say which alarms may never be disabled. A good habit: when you acknowledge an alarm, say out loud what it is and what you are doing about it.

Scale and Overscale

ENC data is compiled for a scale. When you zoom in beyond it, ECDIS draws the data larger but it contains no more detail. ECDIS warns you with an overscale indication, usually a pattern of vertical bars over the overscaled area or a notice on the screen.

• Overscale makes the chart look more precise than it is. Gaps between soundings look like clear water.
• Underscale (zoomed out too far) can hide features that only appear on larger-scale cells, and ECDIS will show "larger scale ENC available".
• Anti-grounding alarms are calculated from the data in the cells used, not from what is displayed; but if the best-scale cell is missing or not licensed, the system cannot alarm for dangers it does not have.

During planning, always check the route at the best available scale. During monitoring, use a scale appropriate to the situation, and check the chart scale indication regularly.

Route Planning and the Route Check

On ECDIS, the route is a series of waypoints and legs, each with a cross-track limit (the XTD corridor), turn radius, planned speed and notes. Before the route can be used it should be checked:

1. Automatic route check: ECDIS checks each leg, its XTD corridor and the turn arcs against the safety contour, isolated dangers and areas with special conditions, and lists every problem found.
2. Manual (visual) check: the officer pans along the entire route at the largest scale available, reading every alarm and looking for hazards the automatic check cannot detect.

The automatic route check has limits:

• It only checks data in the ENC cells installed and licensed, at the scale used.
• It uses the safety contour you set; a wrong setting gives a wrong result.
• Some objects (for example certain wrecks or obstructions with unknown depth) may not be checked, depending on the system and settings.
• It does not know about Notices to Mariners not yet applied, temporary and preliminary notices, navigational warnings, or local knowledge.
• It cannot judge whether a passing distance is prudent for the conditions.

The results must be reviewed, each alarm either resolved by changing the route or recorded with the reason it is acceptable, and the route approved by the master. A list of 200 unexamined route check alarms is not a checked route.

CATZOC: Zones of Confidence

Every ENC carries information on the quality of the survey it is based on. In S-57 this is CATZOC (category of zone of confidence), shown on ECDIS as a pattern of stars or "U" when the data quality layer is displayed.

Click to zoom

Large areas of the world's oceans and coasts, including well-used routes, are only zone C or D, and some are surveyed by lead line in the 19th century. A charted 15 m depth in zone C could be 12.25 m (2.0 + 0.75 m uncertainty), and a charted shoal could be 500 m from where it is shown.

How to use CATZOC:

• In planning: display the data quality layer and look at it along the whole route. Increase UKC and passing distances in zones C, D and U.
• In the safety depth: some companies add a CATZOC allowance to the safety depth in poorly surveyed areas.
• In passing distances: a 0.2 nm clearance from a charted danger means little if the danger's position is only accurate to ± 500 m.

In S-101 ENCs CATZOC is replaced by a new Quality of Bathymetric Data attribute, but the principle is the same.

Updates

An ENC is only official if it is up to date. The OOW should be able to check:

• Base cells and updates: ENC updates are issued weekly, in line with Notices to Mariners. The ECDIS shows the edition and update number of each cell and the date of the last update applied.
• Permits and licences: cells not licensed may not display or may show as unavailable.
• Temporary and Preliminary notices (T and P): some hydrographic offices include them in the ENC; others do not. Check how your service handles them.
• Navigational warnings: NAVTEX, NAVAREA and coastal warnings are not in the ENC. They must be plotted manually, often as user-defined objects or manual updates.
• Manual updates must be distinctive on the display, and should be removed when the official update arrives.

Before sailing, record in the passage plan that all cells for the route are installed, licensed and updated to the latest week.

GNSS: Strengths and Errors

ECDIS shows the ship where the position sensor says it is, usually a GPS receiver, often augmented. Global navigation satellite systems include GPS (United States), GLONASS (Russia), Galileo (EU) and BeiDou (China). Multi-constellation receivers combine them.

Sources of error

• Satellite geometry: poor geometry gives a high dilution of precision (HDOP). The receiver may still output a position, but a less accurate one.
• Ionospheric and tropospheric delay: varies with the time of day and solar activity. Dual-frequency receivers and augmentation (SBAS, such as EGNOS, or DGNSS) correct much of it.
• Multipath: signals reflected off the ship's structure, cranes or nearby buildings. Worst alongside or in harbour.
• Antenna position: the ECDIS must know where the GNSS antenna is relative to the conning position (CCRP); wrong offsets displace the ship symbol.
• Datum: the GNSS output must be on WGS84 to match ENCs. Any datum mismatch triggers the "different geodetic datum" alarm.
• Jamming: radio interference that drowns out the satellite signals. The receiver loses the fix and ECDIS should alarm (positioning system failure), although some receivers silently switch to dead reckoning.
• Spoofing: false satellite signals that make the receiver compute a wrong position with apparently normal quality. This is far more dangerous because nothing alarms. Widespread interference and spoofing has been reported in the Eastern Mediterranean, the Black Sea, the Baltic, the Gulf and elsewhere. Check the current navigational warnings for your area.

Signs of GNSS trouble

• Position jumps, or ship symbol moving inland or to an airport.
• Speed over ground suddenly very different from log speed, with no change in conditions.
• Both GNSS receivers drifting together away from radar ranges and bearings (spoofing affects all receivers on the ship).
• AIS targets of other ships appearing in impossible positions or all in one cluster.
• Time errors on the GNSS and on equipment synchronised to it (VDR, GMDSS).

Integrity cross-checks

The fundamental rule, which MGN 315 and the ICS Bridge Procedures Guide both emphasise: never rely on a single source of position. At regular intervals, and always when approaching land:

1. Compare the two GNSS receivers.
2. Radar overlay: check that radar echoes of land and fixed objects sit on the charted features.
3. Radar fix: ranges (and bearings) from charted, radar-conspicuous objects; compare with GNSS.
4. Visual fix: compass bearings of charted objects.
5. Echo sounder: compare the measured depth with the charted depth allowing for tide.
6. Dead reckoning / estimated position from the log and gyro.
7. Parallel index lines, which work independently of any position sensor.

Click to zoom

Read the diagram carefully. The radar measures from the real ship. If the radar echo of the coast and the lighthouse sit 0.3 nm to the west of the charted coast, the land is really 0.3 nm closer to the ship than the ECDIS picture suggests. The ship is not where GNSS says it is. Navigate on the radar fix, open the distance from danger, call the master, and investigate. Remember that a gyro error rotates the whole overlay around own ship; a rotation (echoes misaligned more at the edges than near the centre) points to heading error rather than position error.

AIS

The Automatic Identification System uses VHF data links to exchange identity, position, course and speed between ships and with shore stations. SOLAS V/19.2.4 requires Class A AIS on ships of 300 GT and upwards on international voyages, cargo ships of 500 GT and upwards not on international voyages, and all passenger ships. Smaller craft may carry Class B or nothing at all.

What Class A transmits

Dynamic reports are sent every few seconds when underway (more often at higher speed or when turning) and every 3 minutes at anchor.

Limitations

• Not all vessels carry or use AIS. Small fishing boats, yachts, warships and some ships with the AIS switched off will not appear.
• Data entered by hand is often wrong: navigational status still "at anchor" when underway, wrong draught, old destination.
• Position comes from the other ship's GNSS, with all its errors, and can be spoofed.
• COG and SOG are over the ground, not heading and speed through the water. In a stream, the AIS vector does not show aspect.
• Heading is only transmitted if a gyro is connected; many smaller vessels send none.
• Update rate and VHF range: targets near the edge of range or in a congested area update less often.
• AIS is not a radar target. It shows what the other ship says, not what is there.

Using AIS correctly

• Use AIS to identify ships and to support, not replace, radar plotting and visual bearings.
• The COLREGs do not mention AIS. Rule 7 requires all available means to determine risk of collision, and AIS is one of them, but Rule 7(c) still forbids decisions on scanty information.
• Avoid using VHF, prompted by an AIS name, to agree manoeuvres that conflict with the Rules. Several collisions have followed VHF agreements made with the wrong ship or misunderstood.
• Keep your own AIS data correct at every change of status, draught or destination; check it at handover.
• AIS-SART and AIS man-overboard devices appear as special symbols and must be treated as distress alerts.
• Virtual AIS aids to navigation may mark new wrecks or hazards that have no physical buoy yet.

Over-Reliance: Case Studies

The MAIB and other investigators keep finding the same pattern: a well-equipped bridge, an officer who trusts the screen, and an ECDIS set up so that it cannot warn them.

Ovit, Dover Strait, 2013

The chemical tanker Ovit grounded on the Varne Bank in the Dover Strait. The MAIB found the passage plan had been prepared on ECDIS by an inexperienced officer and the route ran directly across the bank. The route had not been properly checked, the safety settings were inappropriate, and the audible alarm was disabled, so the OOW was not warned as the ship approached the shoal. The bridge team was not using other methods to monitor the ship's position against the danger.

Lessons: check the route visually at the best scale; never disable the audible alarm; monitor with independent methods.

Muros, Haisborough Sand, 2016

The bulk carrier Muros grounded on Haisborough Sand off the Norfolk coast in December 2016. The MAIB (report 22/2017) found that the second officer had revised the ECDIS route less than three hours before the grounding, and the master never saw or approved it. The revised track crossed the sandbank. A visual check at too small a scale did not show the danger, the warnings generated by the ECDIS check route function were ignored, and the ECDIS alarms had been turned off. The OOW watched the ship cross into shallow water on the display without acting.

Lessons: any route change is a new plan and must be checked at the right scale and approved; route check warnings must be read and resolved; alarms must stay on.

Royal Majesty, Nantucket, 1995

The cruise ship Royal Majesty ran aground on Rose and Crown Shoal off Nantucket after about 34 hours steaming with the GPS antenna cable disconnected. The GPS had switched to dead reckoning mode, showing a small indication the crew did not notice, and the integrated system continued to steer the ship along a planned track that was increasingly wrong. The officers did not cross-check with Loran, radar or visual observations; lookouts' reports of lights that did not match were not acted on.

Lessons: know how your sensors fail; cross-check with independent methods; when what you see out of the window disagrees with the screen, believe the window until proven otherwise.

Common threads

• Safety settings wrong, or alarms disabled.
• No visual or radar cross-check of position.
• Route not checked at the right scale.
• Junior officers using ECDIS without type-specific training.
• A bridge culture where the screen was trusted more than the evidence of the eyes.

Worked Example: Handover on an ECDIS Bridge

You are taking over the 0000 to 0400 watch on a 9.5 m draught bulk carrier approaching the Strait of Dover from the south-west. Your handover check of ECDIS should include:

1. Route: the approved route is loaded and monitored; the next waypoint, wheel-over and course are as briefed.
2. Position source: primary GNSS selected, secondary showing a similar position, no positioning alarms. Radar overlay shows the coast of France matching the chart.
3. Safety settings: safety depth 12.0 m (9.5 m draught, 1.0 m squat at 14 knots, 1.5 m UKC margin per the master's orders). Safety contour set to 12 m, ECDIS using the 20 m contour. Shallow contour 10 m, deep contour 30 m. Look-ahead 6 minutes.
4. Display: standard display plus spot soundings and isolated dangers; night palette; correct scale for the area with no overscale; best-scale cells loaded.
5. Alarms: audible alarm on; XTD 0.3 nm; no unacknowledged alarms.
6. Updates: latest week's updates applied; NAVTEX warnings for the area plotted.
7. Cross-checks due: next radar fix at 0015, then every 15 minutes as per the standing orders, with PI lines set on the X band for the Varne and Colbart banks.

You then check, by a radar range and bearing of a charted light, that the position agrees with the GNSS to within 0.05 nm, and record the fix. Only then do you accept the watch.

Common Mistakes

• Using a shallower safety contour to stop alarms. Fix the plan, not the settings.
• Turning off audible alarms. Many groundings started there.
• Removing layers to declutter. Spot soundings, isolated dangers and cables vanish with them.
• Planning at a small scale. Hazards may only exist on the larger-scale cells.
• Accepting the automatic route check without a visual check. The machine only checks what it knows.
• Ignoring overscale. Zooming in does not add data.
• Relying on a single GNSS receiver. Spoofing can move both receivers together; use radar and visual checks.
• Using AIS vectors for aspect. AIS shows COG and SOG, not heading through the water.
• Assuming RCDS mode protects you. Raster charts give no anti-grounding alarms.
• Not having type-specific training. Each manufacturer's menus are different; the time to learn them is not during an approach.

Summary

• ECDIS is type-approved, uses official up-to-date ENCs and has approved back-up; an ECS is not a legal substitute for charts.
• ENCs give alarms and safety contours; raster charts in RCDS mode do not.
• Safety depth (bold soundings) = draught + squat + UKC allowance. The safety contour uses the next deeper contour available.
• Know the main alarms: safety contour, special areas, XTD, position failure, datum, overscale.
• Route check: automatic plus visual at best scale, each alarm resolved, approved by the master.
• CATZOC tells you how far to trust the chart; zones C and D need larger margins.
• GNSS can be jammed or spoofed; cross-check with radar overlay, radar and visual fixes, echo sounder and PI lines.
• AIS supplements radar but does not replace it; its data may be wrong or missing.
• Real accidents show the same causes: wrong settings, disabled alarms, no cross-checks, too much trust in the screen.

Check Your Understanding

1. What is the difference between an ECDIS and an ECS?

Answer: An ECDIS is type-approved to the IMO performance standards, uses official, up-to-date ENCs (or RNCs where no ENC exists), and with adequate back-up meets the SOLAS chart carriage requirements. An ECS does not meet these standards and cannot replace official charts; it is only an aid.

1. Your ship has a draught of 10.2 m, expected squat 1.1 m and the master requires a UKC of 1.5 m. The ENC has 10 m, 15 m and 20 m contours. What safety contour will ECDIS use if you enter the safety depth?

Answer: Safety depth = 10.2 + 1.1 + 1.5 = 12.8 m. There is no 12.8 m contour, so ECDIS uses the next deeper contour available: 15 m.

1. Why does a vessel using RNCs in RCDS mode need an appropriate folio of paper charts?

Answer: Because raster charts are just images. ECDIS cannot generate safety contour or anti-grounding alarms or route check results from them, and RCDS mode is only accepted where no ENC is available, with up-to-date paper charts as part of the arrangement.

1. A charted depth of 20 m lies in a CATZOC C area. What is the depth uncertainty and what does it mean for planning?

Answer: ± (2.0 m + 5% of 20 m) = ± 3.0 m. You should plan as if the depth could be 17 m, and remember the position of any feature is accurate only to ± 500 m. Increase UKC and passing distances accordingly.

1. What does the overscale indication tell you, and why does it matter?

Answer: That the chart is being displayed at a larger scale than the data was compiled for. The picture looks more detailed than it is; gaps between soundings may hide dangers and positions are no more accurate than the original scale allows. Change to a better cell if available, or reduce the scale.

1. List four ways of checking that the GNSS position shown on ECDIS is correct.

Answer: Any four of: comparing two independent GNSS receivers; radar overlay matching charted coast and fixed objects; a radar fix from ranges and bearings of charted objects; a visual fix with compass bearings; echo sounder depth compared with charted depth plus tide; dead reckoning or estimated position from log and gyro; parallel index lines.

1. Give three limitations of AIS for collision avoidance.

Answer: Any three of: not all vessels carry or transmit AIS; manually entered data (status, draught) is often wrong; positions depend on the other ship's GNSS and can be spoofed; COG and SOG are over the ground and do not show heading or aspect; heading may not be transmitted; update rates and range vary; it shows what the ship reports, not what is actually there.

1. During a route check the ECDIS lists 37 safety contour alarms along a coastal passage. What should you do?

Answer: Examine each alarm visually at the largest available scale. Where the route genuinely crosses unsafe water, alter the route. Where an alarm is acceptable (for example crossing a contour on a rising tide with sufficient UKC), record the reason in the passage plan and get the master's approval. Never "solve" alarms by making the safety contour shallower.

1. What lesson do the Ovit and Royal Majesty accidents share?

Answer: Both bridge teams trusted the electronic system without independent cross-checks. In Ovit the route over the Varne Bank was not properly checked and the alarm was disabled; in Royal Majesty the GPS had failed to dead reckoning and nobody compared the displayed position with radar, other position-fixing systems or visual observations.

Further Reading

• IMO Resolution MSC.232(82), ECDIS performance standards
• IMO Model Course 1.27, Operational Use of ECDIS
• UKHO NP231, Admiralty Guide to the Practical Use of ENCs
• MGN 315 (M), Keeping a safe navigational watch on merchant vessels
• ICS Bridge Procedures Guide, 6th edition
• SOLAS consolidated edition (IMO), Chapter V Safety of Navigation
• UKHO NP5011, Symbols and Abbreviations used on Admiralty Paper Charts
• A.G. Bole, A. Wall and A. Norris, Radar and ARPA Manual, 3rd ed.