What happened
On a night shift at a Western Australian open-pit mine, autonomous haul trucks were moving mine waste. A control-room operator directed one of them to turn right at an intersection and run a loop so it could be positioned under an excavator on the pit floor. The turn and the loop existed in the autonomous fleet’s control system, the digital map the trucks drive by. They did not exist on the ground in any form a person could see: the intersection was not signposted and not marked, and its intended use had not been communicated to those operating manually controlled vehicles nearby.
A manned water cart was coming the other way. The driver did not know the autonomous truck had been assigned to turn across the road. By the time the driver recognised what was happening and tried to take evasive action, it was too late. The truck, travelling at about 40 km/h, could not stop in time, and the two vehicles collided. The autonomous truck was significantly damaged and the water-cart driver received minor injuries.
Western Australia’s mining safety regulator set out the causes in Significant Incident Report No. 226, approved for release by the State Mining Engineer on 11 August 2015. The direct causes were that the two vehicles’ paths crossed, that the turnaround loop had been released for use in the control system while the matching intersection was not delineated on the ground or its intended use communicated, and that the autonomous truck’s speed and response time meant it could not avoid the collision once the water cart was in its path. The contributing causes were an inadequate process for planning and assigning roads in the control system, and an in-cab awareness system that, on the night, did not leave the water-cart driver fully aware of the truck’s intended path.
What an auditable version would have shown
The question after a collision like this is narrow: what change put the truck on that path, who released it, and what safety checks were tied to that release. The gap was that a road could be made live in the autonomous system without a recorded link to the physical controls (signage, ground marking, crew notification) that make it safe for shared use. An auditable version records each change to the autonomous fleet’s drivable network as a signed event: the road or loop released, who authorised it, and the confirmation that the corresponding ground delineation and crew communication were in place before trucks could use it. With that record, a route released without its safety prerequisites is visible as incomplete before a truck ever drives it, rather than after a water cart is in the way.
Where the gap was
The autonomous system did exactly what it was told. The failure was that what it was told to do had been authorised in software without the conditions that make the action safe in the physical world, and nothing held the one to the other. An autonomous machine sharing ground with people needs a hard constraint: it does not operate a route until that route has been verified safe for mixed traffic and that verification is recorded. A ConstraintGate is that control, refusing or holding an assigned path that has not cleared its physical-safety prerequisites. A ConductRecord preserves the change and its sign-off, so an operator can show that a road was released only after delineation and communication were confirmed, rather than discovering the omission in an incident report. The principle is the same one that governs any autonomous actor: a high-consequence action proceeds only inside conditions that have been verified, and the verification leaves a record.
What governance should have looked like
Autonomous haulage removes the driver, but it does not remove the need to coordinate with the people still on the ground. The lesson of this incident is that the digital permission to drive a path and the physical safety of that path are two different things, and that letting the first run ahead of the second is how an autonomous truck ends up crossing in front of a crewed vehicle that never knew it was coming. The control is to bind the change to its safeguards: no route goes live for autonomous use until its ground marking and crew notification are confirmed, the autonomous system is constrained from operating routes that have not cleared that check, and the whole change is recorded and signed so responsibility is legible afterwards. Those are ordinary change-management disciplines, applied to a machine that will follow an unsafe instruction perfectly.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Mines Safety Significant Incident Report No. 226: Collision between an autonomous haul truck and manned water cart (WorkSafe WA)
- SIR No. 226 full report (WorkSafe WA, PDF)