An ECDIS rarely fails by breaking. It fails quietly, doing exactly what a misconfigured setting told it to do, while the screen looks reassuringly normal.
Several ships have grounded with a fully working ECDIS glowing on the bridge, the route plotted, the position updating, the equipment doing everything asked of it. The danger in modern electronic navigation is not the box; it is the settings, the data, and the human in front of it. These are the errors that recur in casualty reports, and the habits that prevent them.
At a Glance
Why ECDIS Errors Are So Dangerous
The trouble with a silent failure is that nothing announces it. A paper chart that is wrong is obviously wrong, but an ECDIS configured badly still draws a clean, confident picture, and an over-trusting watchkeeper sees confirmation rather than a problem.
The safeguards built into an ECDIS, the anti-grounding alarm, the route check, the isolated-danger detection, only work if they are switched on and set up correctly. When they are not, the system gives a false sense of security that can be worse than having no electronic aid at all. Almost every error below shares that signature: the equipment was capable, but its protection had been quietly removed.
The Safety Contour Set Wrong
This is the error that has put ships on the ground more than any other. The safety contour is the boundary the ECDIS uses to divide water that is deep enough for your ship from water that is not, shading the unsafe side blue, and it is what drives the anti-grounding alarm and isolated-danger warnings.
It must be set from your own ship: your draft plus the under-keel clearance you require, with allowance for tide and squat. The recurring mistake is leaving it at the manufacturer’s default value of 30 m, which bears no relation to a particular ship and quietly defeats the protection.
The cost of that mistake is on the record. The CFL Performer in 2008 and the Ovit in 2013 both grounded with their safety contour sitting at the 30 m default while drawing far less water, the bridge teams unaware that the figure meant nothing for their vessels. A wrong contour either buries the real danger in a meaningless wash of blue or, set too shallow, lets a genuine shoal read as safe white water. Either way, the boundary that should have warned them did not.
Safety Depth and the Reliability of the Survey
Closely related is the safety depth, the value that controls which individual soundings the ECDIS highlights as too shallow, again set from your draft and clearance rather than left at a default. Soundings shallower than it are emphasized so they cannot be missed at a glance.
There is a subtler trap beneath the numbers themselves. Much of the depth data on an ENC comes from surveys that may be decades old, and the CATZOC, or category zone of confidence, tells you how much to trust it, across six bands of accuracy. Where the zone of confidence is poor, the charted depth may be out by a meter or more, so a prudent under-keel margin has to absorb that uncertainty as well as tide and squat.
Hidden Dangers: Scale, SCAMIN, and Display Mode
An ECDIS will happily let you navigate at a scale far smaller than the chart was compiled for, and doing so is a documented path to grounding. Always work from the largest-scale ENC available for the area, and heed the over-scale indicator that warns when you have zoomed in beyond the data.
Two display behaviors compound the risk. SCAMIN, the scale-minimum attribute, hides certain features when you zoom out, so a danger visible at a large scale can simply disappear from a small-scale view, which is part of how the Muros came to grief checking its route on a small-scale picture in 2016. The chart’s display mode matters just as much: the Base and Standard views deliberately omit information, and some shoal soundings do not appear in Standard at all, so a route must always be inspected in the full “All” or “Other” display before it is trusted.
Disabled or Ignored Alarms
Alarms only protect a bridge that listens to them. A persistent error is the deliberate silencing of the audible alarm or the guard zone, sometimes through the system’s own software settings, which is precisely what removed the last line of defense aboard the Muros.
The quieter version is alarm fatigue. When an ECDIS produces a stream of low-value alerts, watchkeepers learn to acknowledge them reflexively, without reading what each one says, and the route-monitoring and anti-grounding alarms that matter get cleared with the rest. Placement plays a part too: in one grounding the ECDIS was angled so the officer had to turn away from his lookout to see it, and its audible alarm was not even connected, so the warning it generated was never seen or heard.
Over-Reliance and the Missing Cross-Check
The most human error of all is to stop navigating and start watching a screen. ECDIS invites a kind of fixation, a confidence that the magenta line and the moving ship symbol are the whole truth, when they are only one source among several.
A good watchkeeper still cross-checks the ECDIS position against radar, visual bearings, and the look of the water, and treats a disagreement as a question rather than a nuisance. It also helps to remember what ECDIS is not: it is a planning and monitoring aid, not a collision-avoidance system, and officers who navigated by its vector lines instead of applying the COLREGs have collided in clear sight of each other.
Out-of-Date Charts, Software, and Bad Inputs
An ECDIS is only as good as what you feed it. ENCs must be kept corrected to the latest notices, the system’s own software must be maintained to current IHO standards to avoid known display anomalies, and an expired chart-support certificate is a real Port State Control finding, not a paperwork nicety.
The sensors feeding the system deserve the same suspicion. A GPS position can jump or drift, a manual position offset can be left applied by accident, and a datum mismatch can place the ship meters from where it really is, so the inputs need watching as carefully as the chart. The principle is the old one: garbage in, garbage out, drawn very convincingly on a bright display.
The Common Thread: Settings, Not the System
Read the casualty reports together and the same lesson surfaces every time. The equipment worked; the people had not set it up, kept it current, or cross-checked it, and a certificate on the wall is not the same as competence at the keyboard.
The defenses are unglamorous and entirely within your control. Set the safety contour and safety depth from your own ship, check the route and read the warnings it raises, inspect it at a proper scale in full display mode, keep the alarms live, and never let the screen replace the rest of your navigation. Used that way, ECDIS is the safeguard it was meant to be; used carelessly, it is a very convincing way to run aground.
Frequently Asked Questions
These are the questions officers and cadets ask most about common ECDIS errors, from the deadliest setting to why trained crews still get caught out. Here are the short answers.
What is the most common ECDIS error?
Leaving the safety contour at the manufacturer’s default value, commonly 30 m, instead of setting it from the ship’s own draft and under-keel clearance. Because the safety contour drives the anti-grounding alarm and the safe-water shading, getting it wrong removes the very protection the system is meant to provide, and it has been a factor in several groundings.
Why do ships still ground with a working ECDIS?
Because the failures are almost always in the setup and the human use, not the hardware. A badly configured ECDIS still draws a clean, confident picture, so an over-trusting watchkeeper sees reassurance rather than danger, especially when alarms have been silenced, the route was not properly checked, or the display is at the wrong scale.
What is SCAMIN in ECDIS?
SCAMIN, or scale minimum, is a chart attribute that hides certain features when you zoom out below a set scale. It keeps a small-scale display from becoming cluttered, but it means a danger visible at a large scale can disappear from a small-scale view, so routes should always be checked at the largest appropriate scale.
Is ECDIS a collision-avoidance system?
No. ECDIS is a planning and position-monitoring aid, not a system for avoiding collisions. Vessels have collided because watchkeepers trusted ECDIS vector lines instead of applying the COLREGs and cross-checking radar and visual information, which remain the basis of collision avoidance.
How do you avoid ECDIS errors?
Set the safety contour and safety depth from your own ship, run and heed the route check, navigate at a suitable scale in full display mode, keep the alarms enabled, keep charts and software up to date, and cross-check the position against radar and visual bearings. In short, treat the ECDIS as one tool among several and stay the thinking navigator behind it.