Marine Navigation Redundancy

Redundancy does not mean buying two of everything. It means preventing one failure from removing several critical capabilities at once.

Those are very different objectives, and the difference shows up on a lot of otherwise well-equipped boats. Two multifunction displays on the same electrical circuit, fed by the same GNSS receiver, on the same NMEA backbone, running the same software, are not two navigation systems. They are one navigation system with two screens.

#Think in failure domains

The question that does the work is not "what do I have two of?" It is:

What single event can remove this function?

Run it against each thing you depend on and the answers are uncomfortable:

Then decide whether what remains is acceptable for the passage you are doing. For a harbour day sail the answer is usually yes. For a 1,200 NM coastal passage shorthanded, several of those rows need an answer.

#Position

A workable hierarchy, in descending order of capability and ascending order of independence:

1. Primary network GNSS — the installed antenna or MFD receiver feeding the whole network
2. A second installed GNSS, ideally on a different circuit and a different device
3. A tablet or phone with its own internal GNSS and fully downloaded offline charts
4. A handheld GPS, if carried

Layers three and four are the ones that matter, because they share no failure domain with the boat. They have their own batteries, their own receivers and their own charts.

Backups need offline charts. This is the most common failure in the whole scheme. An app that streams chart tiles is useless 40 NM offshore, and "I have Navionics on my phone" means nothing if the region was never downloaded. Open it and confirm before departure, as the pre-departure checklist insists.

#Heading

Primary: an electronic AHRS or GNSS compass, feeding the autopilot, radar overlay, MARPA and true wind.

Backup: the magnetic compass.

The magnetic compass remains genuinely valuable, and not for sentimental reasons. It requires no software, no network, no electrical power and no satellite data path. It therefore survives a flat battery bank, a backbone fault, a firmware update that reset the source selection, and a lightning event.

This is also why some jurisdictions require one. New South Wales requires a chart and compass on open waters and explicitly notes that a compass is still required where satellite navigation is carried — the redundancy principle written into law, as safety equipment by state discusses.

#Charts

• primary MFD charts, current
• an independent tablet with a different chart product where practical
• appropriate paper or other offline reference for the area

Currentness matters more than medium. An outdated paper chart is still outdated, and a folded 1998 chart in a locker is not a safety system. Conversely, a fully downloaded current vector chart on a charged tablet is a genuinely capable backup.

The deeper caution belongs to marine charts Australia: no medium improves the underlying survey. Zone of Confidence applies to the backup exactly as it applies to the primary.

#Radar

Almost no recreational vessel carries two radars, and almost none should.

The backup for radar is sensor diversity rather than duplication:

• AIS, for cooperating traffic
• a visual and aural lookout, which the AIS 2026: COLREGs in Practice">collision regulations require anyway
• the chart, for what should be there
• depth, as an independent check on position
• thermal imaging, where fitted

Each sees something radar does not, which is the same logic that makes the whole system work — see collision avoidance.

#AIS

If AIS fails, radar and VHF should still work. That holds if they are genuinely separate systems.

It stops holding with an integrated VHF/AIS unit — Garmin's Signal VHF 400, launched May 2026, being the current example. One box, one power feed, one hardware fault, two functions gone. That is a legitimate trade for a cleaner helm, and it should be made deliberately rather than by accident. Similarly, an active antenna splitter means one antenna failure affects both.

#Communications

A strong offshore arrangement, ordered by independence:

• fixed VHF — best range, needs ship's power
• handheld VHF — own battery, survives electrical failure, goes in the grab bag
• EPIRB — purpose-built distress alerting, own battery
• satellite messenger — independent two-way messaging, own battery
• satellite broadband — most capable, least independent

Three of those five keep working after the boat's electrical system does not, and they are the three cheapest. See satellite communications and EPIRBs and safety equipment.

#Power

Power is the most consequential failure domain, because a single feed can remove navigation, communication and steering simultaneously.

Sensible measures:

• critical systems on protected circuits that do not all depend on one fragile feed
• accessible fuses and breakers — a fuse behind a bonded headliner will be diagnosed by guesswork at 0300
• an alternative charging path — solar, a second alternator, a portable generator
• an engine start path that does not depend on the house bank
• the ability to isolate the electronics panel entirely
• handheld devices with their own batteries, stored charged

And a warning: do not add so much complexity that the redundancy system becomes a new source of failures. A transfer arrangement nobody understands, with three switches that must be in the right combination, has replaced one failure mode with several. See marine DC power.

#Autopilot

On a shorthanded boat the pilot is often the hardest-working system aboard, and hand-steering for days is a genuine safety problem rather than an inconvenience.

Possible strategies, and the right one depends entirely on the steering geometry:

• a windvane — the strongest option for a sailing yacht, because it shares no failure domain with the electrical system at all
• a second drive, on a boat with the space and the linkage for it
• a spare motor or actuator, carried and actually fitted once in practice
• a tillerpilot as an emergency alternative on suitable boats
• the emergency tiller, located, tested and reachable

The useful exercise is to ask which single failure would leave you hand-steering for the rest of the passage, then remove that dependency. See autopilots.

#Two scenarios worth thinking through

#Dismasting

Removes masthead VHF, the wind sensor, and any mast-mounted radar — three systems, one event.

A thoughtfully designed boat still retains a handheld VHF, GNSS, depth, independent navigation, engine and emergency steering. That is a bad day rather than an emergency, and the difference was decided at the installation stage.

#Lightning

A large electrical event can damage many interconnected devices at once, including ones that were switched off. Surge paths do not respect a power switch.

The cheap insurance is a tablet with offline charts and a handheld VHF stored disconnected from the vessel's network and power. Physically separate equipment survives an event that takes out everything bonded together.

#Test the backup

A backup is useless if:

• the battery is flat
• the charts were never downloaded for this region
• the subscription expired
• the crew cannot unlock the device
• nobody knows where it is

Every one of those is an administrative failure rather than a technical one, and they are collectively far more common than hardware failure. Which is why the check is physical: open it, confirm the coverage, note the charge.

#Practical hierarchy

Primary — installed MFD, radar, AIS, depth, heading, autopilot.

Secondary — an independent tablet with offline charts, charged, stored disconnected.

Tertiary — phone or handheld GPS.

Non-electronic — magnetic compass, and paper where appropriate.

Communications — handheld VHF plus a registered distress beacon.

#Passage checklist

• charge handhelds and the backup tablet
• open the backup navigation app and confirm offline coverage for the whole route
• test the handheld VHF
• check beacon registration and battery expiry
• verify the primary GNSS and heading sources
• inspect the compass
• carry spare network connectors and fuses where appropriate
• confirm every crew member knows where the grab bag is

#Bottom line

The best backup usually looks nothing like the primary. It is cheaper, simpler, less capable, independently powered, and stored somewhere the event that broke the primary cannot reach.