Ship Data Recorders: How VDR and S-VDR Systems Work and How to Manage Them After an Incident

This article applies to yachts fitted with a Voyage Data Recorder (VDR) or Simplified Voyage Data Recorder (S-VDR), whether carried as statutory equipment or installed voluntarily.

Carriage and testing requirements depend on vessel type, gross tonnage, build date, passenger status, flag, class, and the applicable yacht-code or SOLAS route. A large yacht should not decide whether its recorder is statutory from length alone. Confirm the vessel-specific position with the flag Administration, class society, statutory certificates, and approved equipment list.

The incident-preservation steps must also follow the vessel SMS and instructions from the master, flag, investigation authority, insurer, and equipment manufacturer. Crew should preserve evidence, not conduct an unauthorised investigation or distribute recorded bridge material.

• Why a VDR is a complete recording system rather than only the orange protective capsule.
• How modern VDR, legacy VDR, and S-VDR installations can differ in recorded inputs and retention time.
• Which routine technical checks reveal missing, stale, unintelligible, or unrecoverable data before an incident.
• What the annual performance test proves and what still remains the yacht's responsibility between tests.
• How to save, copy, document, and hand over VDR data without overwriting or weakening the evidence.

After a grounding or collision, the bridge is busy for good reason. The master is managing the vessel, the bridge team is communicating, engineering may be checking damage or propulsion, and shore management is asking for facts. That is exactly when someone tells the ETO: "Save the VDR."

If that is the first time the technical team has opened the manual, the yacht already has a problem. Different recorders use different save controls, retention periods, download tools, passwords, cables, and playback packages. A well-meaning reboot or a delayed response can allow useful data to be overwritten or make recovery harder.

From an ETO's point of view, the VDR should be treated like any other safety-related data chain. The question is not simply whether the panel shows green. The question is whether the correct sources are being recorded, whether they agree in time, whether the stored data can be recovered, and whether the crew knows how to preserve it under pressure.

The common description is a ship's black box, but that shorthand hides most of the installation. IMO Resolution MSC.333(90) defines the VDR as the complete system, including interfaces to signal sources, processing and encoding, recording media, playback equipment, power supply, and dedicated reserve power.

A typical installation has six working layers:

The VDR does not create independent truth. It records what connected equipment sends to it. If a heading source is wrong, an alarm input is missing, or a bridge microphone is unintelligible, the recorder may preserve that bad or incomplete information perfectly.

VDR and S-VDR are not simply two storage sizes. The distinction comes from the carriage route and the performance standard under which the equipment was installed.

IMO introduced S-VDR carriage for existing cargo ships where retrofitting every signal expected by a full VDR could be impracticable. An S-VDR still preserves information about the vessel's position, movement, physical status, and command and control, but it may not contain the same range of inputs as a full VDR.

The installation date matters as well. IMO Resolution MSC.333(90) applies revised performance standards to VDRs installed on or after 1 July 2014. Older VDRs and S-VDRs may follow earlier standards, including different media and retention arrangements.

This is why the handover should state the recorder type, governing performance standard, date fitted, data-input list, storage duration, and approved download method. The label on the front panel is not enough.

For a revised-standard VDR, MSC.333(90) identifies a broad minimum data set. The actual installation must still be confirmed against its commissioning and annual test records.

Some installations also record watertight or fire-door status, hull openings, rolling motion, wind, hull stress information, and electronic logbook data where required and fitted. The useful approach is not to memorise the list. Keep an approved input register that states what the yacht's recorder is expected to receive and how each input was verified.

Under MSC.333(90), the final recording medium is made up of three parts:

• The fixed recording medium is protected against fire, shock, penetration, and deep-sea pressure. It is intended to survive with the vessel and includes an underwater locating device.
• The float-free recording medium is intended to release after sinking, float, and transmit locating signals so it can be recovered.
• The long-term recording medium is installed in an accessible internal location and provides the longest readily downloadable history.

For revised-standard VDRs, the long-term medium retains at least 30 days, while the fixed and float-free media retain at least 48 hours. Older data may be overwritten. Following loss of the ship's main and emergency electrical supply, the dedicated reserve source is intended to keep bridge-audio recording active for two hours before recording stops automatically.

Those figures must not be applied blindly to older VDRs or S-VDRs. Earlier standards used a minimum 12-hour recording period. The incident response must be based on the installed unit's performance standard and manual, not the retention period remembered from another vessel.

There is another distinction worth making. The save command and the download are not necessarily the same action. A save function may protect an event window from normal overwrite. A download creates an accessible copy. The crew must know which action their unit requires, in what order, and whether the unit continues recording while the process takes place.

The recorder is normally automatic, so it can disappear from daily attention. That is why small checks are valuable.

During routine bridge or technical rounds:

• confirm the VDR panel has no active caution or alarm,
• confirm displayed UTC is plausible,
• check that microphones and their surroundings have not been obstructed or altered,
• confirm the fixed and float-free capsules remain accessible and physically undisturbed,
• record any work on connected navigation, radio, alarm, steering, or propulsion systems,
• escalate recurring interface or storage warnings instead of clearing them repeatedly.

After bridge equipment replacement, software updates, gateway changes, or refit work, verify the affected VDR input. Do not wait for the next annual test. A new radar may display correctly on the bridge while its image feed to the VDR remains disconnected. A replaced gyro can steer the yacht while the recorder continues logging an old or missing heading channel.

The planned-maintenance system should also record:

• recorder make, model, serial number, and software version,
• applicable IMO performance standard and IEC test standard,
• main and emergency power sources,
• reserve-power and beacon battery expiry dates,
• fixed, float-free, and long-term media locations,
• input and interface register,
• approved save and download instructions,
• location of playback software, connection parts, and credentials,
• annual performance test certificate and open observations,
• authorised service provider and emergency contact.

SOLAS Chapter V requires the VDR system, including its sensors, to undergo an annual performance test by an approved testing or servicing facility. IMO's revised annual-test guidance calls for checks of alarms, reserve-power behaviour, beacon condition, batteries, maintenance records, recording interfaces, float-free arrangements where fitted, and restoration to normal operation.

The report should identify the interfaces tested and whether required data was available through the recording period. That transparency matters. A one-page certificate saying only "passed" is less useful to the yacht than the supporting report showing the tested inputs and observations.

The annual test is a point-in-time verification. It does not prove that every feed remains healthy after later bridge work. Technical crew should read the report, close any observations, and compare it with changes made since the test.

The MAIB investigation into the passenger vessel Hamburg's grounding at Tobermory in 2015 gives a practical example of why familiarisation matters.

Hamburg grounded at 1328, but the ETO was not instructed to save and download the VDR until 1848. It was the first time the ETO had attempted the procedure, and he was unsure whether it had been completed correctly. The vessel's SMS did not require routine VDR downloads for training or audit.

The data was recovered, but the bridge audio was poor and sometimes unintelligible. Music playing on the bridge interfered with the recording. Some recorded data could not be interpreted. MAIB observed that routine review could have exposed those quality problems before the grounding and that regular practice would have made the bridge team more familiar with saving the data.

The lesson for a yacht is straightforward: an annual certificate and a green panel do not prove the evidence is operationally useful. The crew needs a controlled familiarisation process that confirms the save method without altering statutory data or bypassing manufacturer instructions.

Life safety, navigation, damage control, and pollution response come first. VDR preservation should then begin as soon as the master can assign it safely.

1. Establish authority and record the event time

The master should nominate who will preserve the recording and who will contact the flag, investigation authority, management company, insurer, class, or manufacturer. Record the incident time in UTC and local time, along with the best available description of what happened.

Do not delay a required external notification while an internal investigation is being organised. For UK-reportable events, current MAIB guidance requires prompt notification and immediate steps to save VDR data and prevent overwrite. Other flags and coastal States have their own routes.

2. Protect the recording using the approved method

Follow the vessel-specific quick action card and manufacturer instructions. Use the event-save or backup function only if the trained procedure requires it.

Avoid improvisation:

• do not reboot or power-cycle the recorder unless safety or the approved procedure requires it,
• do not remove or open the fixed capsule,
• do not detach the float-free unit,
• do not connect an unknown laptop or USB device,
• do not clear alarms or change configuration before they are photographed and logged,
• do not repeatedly press save controls because the first response was unclear.

If the procedure is uncertain, protect the system from interference and obtain authorised manufacturer or investigation-authority advice immediately. Record the advice, who provided it, and the time.

3. Preserve a defined time window

The requested window should cover enough time before and after the event to show the developing conditions, decisions, system response, and recovery. Do not assume the minimum obvious window is sufficient.

Record:

• incident time and time source,
• requested start and end time,
• recorder time displayed at preservation,
• any known clock discrepancy,
• the storage medium used,
• whether recording continued during the save or download.

4. Create controlled copies

Where the master and relevant authority permit a download, use the approved interface, playback software, and clean media. Preserve the original recording in the VDR. Make a protected master copy and a separate working copy where required.

For each copy, record the filename or media identifier, size, creation time, responsible person, and destination. Generate a cryptographic checksum where the process and receiving authority support it. A checksum does not prove the content is true, but it helps show that a file has not changed between handovers.

5. Preserve the context around the VDR

The recorder is one evidence source. Preserve the current VDR alarms, configuration, annual test certificate, input list, and maintenance history. The master may also direct preservation of connected-system records needed to explain the event, such as ECDIS logs, engineering alarms, CCTV, or bridge-system screenshots.

Do not merge files casually or rename them into a neat narrative. Keep originals read-only, document every copy, and perform analysis on working copies.

6. Control access and handover

Bridge audio and voyage data can contain sensitive operational and personal information. Access should be limited to authorised people. Record every handover using names, roles, date, time, media identifier, purpose, and signatures or equivalent controlled acknowledgement.

The technical team should not circulate clips to crew groups, vendors, owners, or social media. The master and investigating authority decide who receives the material and for what purpose.

A 95m commercially operated yacht touches a harbour structure while manoeuvring. There is no injury, but the master treats the event as potentially reportable and assigns the chief officer to manage notifications. The ETO is asked to preserve the VDR.

The ETO does not start by opening the cabinet. The yacht's quick action card identifies the recorder model, event-save sequence, long-term download interface, authorised laptop, and service contact. The ETO photographs the panel, notes the displayed UTC, activates the approved save function once, and records the confirmation shown by the unit.

The master requests a six-hour window covering the approach, contact, and recovery. Under the approved procedure, the ETO creates a protected master copy and a working copy, records their checksums, and logs the handover to the investigation authority. The VDR remains in service, and no configuration is changed.

During the same process, the team notices that the annual test predates a radar workstation replacement. The event data contains the correct navigation inputs, but one display feed requires verification. That finding is recorded separately and referred to the approved bridge service provider. It is not quietly corrected before the investigator receives the original data.

Use the downloadable YachtByte record or an equivalent controlled SMS form. At minimum, capture: