Royal Majesty Grounding: GNSS Failure and Automation Bias Lessons for Yacht Bridges

Applicability depends on navigation equipment fitted, ECDIS/chart-carriage status, whether GNSS feeds AIS, VDR, radar overlay, conning displays, owner dashboards or monitoring systems, and whether the event affected safe navigation, grounding risk, collision avoidance, or regulatory reporting.

Royal Majesty is one of the clearest public cases of a navigation system giving a bridge team believable but wrong position information. It is a useful incident for modern yacht teams because the problem was not a blank screen or an obvious equipment shutdown. The GPS receiver continued to output position data after losing valid satellite input, and the integrated bridge system continued to show the ship apparently close to its planned track.

That is the dangerous version of a navigation failure. If the bridge sees no obvious failure, the team may continue to trust the picture even when visual, radar, depth, or navigational-aid evidence says the yacht is somewhere else.

On yachts, the same pattern can appear after a GNSS antenna move, mast refit, NMEA gateway change, ECDIS replacement, antenna splitter fault, bridge network change, owner-dashboard integration, or autopilot/source selection error. Modern glass bridges can make the problem worse if several screens repeat one bad source and create a false sense of agreement.

Royal Majesty was a Panamanian passenger ship on a scheduled voyage from St. George's, Bermuda to Boston, Massachusetts. On 10 June 1995, the vessel was carrying 1,509 passengers and crew.

At about 2225, the ship grounded on Rose and Crown Shoal, about 10 miles east of Nantucket Island, Massachusetts. The NTSB report states that the vessel grounded about 17 miles from where watch officers thought it was. There were no deaths or injuries and no fuel oil spill, but vessel damage and lost revenue were estimated at about $7 million.

The accident happened in clear weather with visibility of at least 10 miles, calm seas, and light winds. The NTSB found that weather, the ship's mechanical condition except for the GPS antenna cable, officers' certificates, drugs, and fatigue were not factors. That makes the incident especially useful: the grounding was not hidden by bad weather or machinery failure. The bridge had multiple opportunities to detect the error.

Royal Majesty departed St. George's on 9 June for the return voyage to Boston. The passage was planned in two broad legs: an open-ocean leg from Bermuda toward the Boston traffic lanes, and a coastal/traffic-lane approach leg.

About 52 minutes after the ship left Bermuda, evidence from the bell log indicated that valid satellite-based GPS data was interrupted. The NTSB concluded that the GPS receiver antenna cable connection had separated enough that the GPS switched to dead-reckoning mode. From then on, the GPS no longer corrected position for the effects of wind, current, or sea.

The problem was that the system still looked usable. The GPS receiver continued to output position data based on dead reckoning from the last valid GPS position. That data was passed to the NACOS 25 autopilot and integrated bridge system. The bridge team therefore continued to see a position picture that appeared to show the ship close to its planned route.

Over time, the effects of wind and sea set the vessel west-southwest and away from its intended track. The track error built over more than 34 hours. The ship was not just slightly off route. By the time of the grounding, the watch team believed the vessel was about 17 miles from its actual position.

After the accident, the GPS antenna and receiver were inspected. The GPS antenna cable had separated from the factory connection at the antenna. The cable showed no sign of physical damage other than separation from the connection.

The installation detail matters. The antenna cable was openly routed on the roof of the bridge. It was not secured or protected from someone tripping over it, kicking it, or otherwise damaging it and the nearby connector. The NTSB concluded that openly routing the GPS antenna cable in an area where someone occasionally walked increased the risk of damage to the cable and related connectors.

Post-accident testing showed that when the antenna cable was separated from the connection, the GPS receiver transmitted dead-reckoning-derived position data instead of satellite-derived position data to the autopilot.

This is directly relevant to yachts. GNSS antenna cables are often routed through masts, arches, radar platforms, hardtops, electronics spaces, or refit-modified areas. If they are exposed, poorly protected, repeatedly painted over, moved during refit, or split to feed several systems, a simple physical issue can become a navigation data issue.

The NTSB found that the Royal Majesty's watch officers did not deliberately cross-check GPS and Loran-C to verify the ship's position. The second officer testified that he relied on GPS position data to plot hourly fixes and considered Loran-C a backup system. It was not his practice to use Loran-C to verify GPS accuracy.

Several cues indicated the vessel was not where the integrated bridge system suggested it was.

Lookouts reported yellow and red lights off the port side. These lights were not expected from the ship's intended position in the traffic lanes. The master later came to the bridge, checked plotted fixes and the map overlay, and saw the vessel apparently within about 200 m of its intended track. The earlier light sightings were not passed to him.

The master later asked whether the BB buoy had been sighted. The second officer said it had, although he later testified that he had not seen it and had relied on the GPS and track picture. After the master left the bridge, a lookout reported blue and white water dead ahead. The second officer acknowledged the report but did not take corrective action.

At about 2220, the vessel unexpectedly sheered. The second officer switched from autopilot to manual steering. The master returned to the bridge, turned on the starboard radar, and saw Nantucket less than 10 miles away. Before corrective action could prevent it, the vessel grounded at 2225.

The NTSB concluded that if the fathometer alarm had been set as the crew said was usual, or if the second officer had displayed fathometer data on the control console, the bridge would have been alerted that the ship was in far shallower water than expected. The report states this could have warned the bridge perhaps as long as 40 minutes before the grounding.

This is a key yacht lesson. When position data is wrong, depth is often one of the strongest independent checks. But depth only helps if it is displayed, alarmed, understood, and compared with the planned passage.

For yachts in coastal pilotage, a depth value that does not match the expected contour should be treated as a navigation cue, not merely an echo-sounder reading.

The NTSB determined that the probable cause of the grounding was the watch officers' overreliance on the automated features of the integrated bridge system, Majesty Cruise Line's failure to ensure that officers were adequately trained in those automated features and their bridge-resource implications, deficiencies in the design and implementation of the integrated bridge system and procedures for its operation, and the second officer's failure to take corrective action after several cues indicated the vessel was off course.

The NTSB also identified contributing factors involving inadequate international training standards for watchstanders on vessels with electronic navigation systems and integrated bridge systems, and inadequate standards for design, installation, and testing of integrated bridge systems.

For YachtByte, the important point is that this was not only a GPS fault. It was a bridge-system, training, procedure, human-factors, cable-installation, alarm-annunciation, and cross-checking failure.

A Valid-Looking Position Can Be Wrong

Modern bridges often display position in a way that feels authoritative. The icon moves, the route line is visible, radar overlay appears aligned, AIS transmits a position, and owner dashboards may show the yacht on a map.

Royal Majesty shows why that can be dangerous. If the underlying source is degraded, estimated, or dead-reckoned, the display can still look normal unless the bridge team understands the status indications and performs independent checks.

Repeated Data Is Not Independent Data

If ECDIS, radar overlay, conning, AIS, VDR, fleet tracking, AV displays, and owner dashboards all use the same GNSS receiver, they are not independent confirmations. They are repeated outputs from one source.

For yacht ETOs and bridge integrators, this means source mapping matters. A bridge may appear to have many displays but only one position source.

Physical Installation Is A Navigation Safety Issue

The GPS antenna cable on Royal Majesty was openly routed where it could be damaged. On yachts, similar risk can arise from exposed mast wiring, refit penetrations, poorly supported antenna cables, deck equipment changes, hardtop work, or electronics installers sharing routes without documenting source dependency.

GNSS cable routing is not cosmetic. It is safety-of-navigation infrastructure.

Bridge Teams Need Failure-Mode Familiarisation

The bridge team needs to know what degraded GNSS looks like on the actual installed equipment. Generic "GPS failure" training is not enough.

Crew should know:

• What the receiver shows in dead-reckoning, estimated, invalid, differential-loss, or sensor-loss modes.
• Whether ECDIS or radar overlay clearly warns of degraded input.
• Whether autopilot or track-control systems reject invalid data or continue using it.
• Which alarm is audible, visual, local, or repeated.
• How to switch sources safely.

Owner Dashboards Must Not Become Authority

Owner, guest, AV, and management dashboards are often fed from bridge data. They should be read-only and clearly secondary. If a bridge source becomes wrong, these systems may repeat the wrong position outside the bridge and create pressure or confusion.

The yacht should never treat an owner app, AV display, or fleet dashboard as evidence that the bridge position is valid unless the source and timestamp are understood.

1. Build A Position Source Matrix

Document every position source and every system it feeds:

• GNSS receiver 1.
• GNSS receiver 2.
• AIS internal GNSS.
• ECDIS input.
• Radar overlay input.
• VDR input.
• Autopilot or track-control input.
• Conning display input.
• Owner dashboard or AV display feed.
• Fleet tracking feed.

This matrix should show which sources are truly independent and which systems only repeat the same data.

2. Train On Degraded Modes

Bridge familiarisation should include the actual receiver and display status for:

• GNSS unavailable.
• Dead-reckoning mode.
• Estimated position.
• Invalid NMEA status.
• Loss of differential correction.
• Sensor mismatch.
• Source changeover.

The bridge team should not discover these indications during a coastal transit.

3. Require Independent Position Checks

During pilotage, coastal transit, restricted waters, or traffic-lane approaches, require deliberate cross-checks:

• Radar ranges and bearings.
• Visual bearings.
• Depth against expected contour.
• AIS and traffic context.
• Manual fix where appropriate.
• Independent receiver comparison.
• Planned buoy, light, or landmark sightings.

If an expected mark is not sighted, that is a finding, not something to explain away because the GPS says the vessel is on track.

4. Protect Navigation Antenna Cabling

After newbuild, refit, or electronics work:

• Inspect GNSS antenna cable routing.
• Avoid exposed routes where people can step, kick, paint, snag, or crush the cable.
• Secure and protect connectors.
• Label antennas and cable routes.
• Record any splitter or gateway changes.
• Test sensor failure modes after work.

5. Make Depth A Live Cross-Check

Depth should be part of passage monitoring. Alarms and displays should be set to the context, not left at a generic value.

For yachts:

• Compare depth to expected charted depth.
• Set shallow-water alarms for the passage.
• Display depth on the bridge where the watchkeeper can see it.
• Treat unexpected depth changes as navigation cues.

6. Audit Integrated Bridge Failure Modes

Ask the bridge supplier or integrator:

• What happens if GNSS 1 outputs invalid data?
• Does ECDIS alarm?
• Does radar overlay alarm?
• Does AIS continue transmitting?
• Does autopilot or track control reject the input?
• Does VDR record the source status?
• Can the bridge compare two position sources?
• Are invalid NMEA status bits passed through or ignored?

If a yacht has a GNSS conflict, grounding, near grounding, or unexplained track deviation, preserve:

• ECDIS playback, route plan, safety contour, cross-track settings, and alarms.
• GNSS receiver logs and screenshots.
• Antenna, cable, splitter, and connector photos.
• Radar screenshots or recorded radar images.
• AIS transmitted-position history.
• VDR data and bridge audio where fitted.
• Depth log and echo sounder settings.
• Manual fixes, bridge notebook, and chart annotations.
• CCTV showing bridge activity where lawful and relevant.
• Network diagram showing navigation data distribution.
• Vendor changes before the event.

Do not let a refit contractor or electronics vendor "fix" the GNSS path before the evidence is captured unless immediate safety requires it.

Corrective actions should address both the technical fault and the bridge process.

Useful actions:

• Repair or replace damaged GNSS antenna/cable/connectors.
• Add cable protection and route documentation.
• Update source matrix.
• Add independent source comparison where practical.
• Train bridge crew on degraded-source modes.
• Revise passage-monitoring procedure.
• Require depth/radar/visual checks in pilotage.
• Audit owner dashboard and AV feeds for non-authoritative labelling.
• Test invalid-source behaviour after bridge upgrades.