In the red dust of Western Australia’s Pilbara region, the largest fleet of autonomous heavy vehicles on Earth operates around the clock. Over 1,800 haul trucks — each weighing between 220 and 450 tonnes when loaded — navigate mine sites without human drivers. Rio Tinto, BHP, and Fortescue collectively move billions of tonnes of iron ore per year using these machines, coordinated by centralized autonomy systems operated from control rooms in Perth, over 1,500 kilometers away.
This is not a pilot program. It is the most mature autonomous vehicle deployment on the planet, predating Tesla’s FSD by years. And its safety record is largely invisible to the public.
The incidents nobody talks about
November 2019, Brockman 4 mine. A 125-tonne autonomous haul truck crushed a light vehicle at a Rio Tinto mine site. The light vehicle was in the truck’s path but not detected. The occupants survived, but the incident highlighted a fundamental limitation: autonomous haul trucks have sensor blind spots, particularly for smaller vehicles operating in close proximity. The truck’s perception system did not identify the light vehicle as an obstacle in time to stop [1].
February 2024, Dampier Port. An unmanned AutoHaul train — part of Rio Tinto’s autonomous rail network — derailed near the port facility. Thirty-eight rail cars were destroyed. The derailment occurred on a section of the 1,700-kilometer autonomous rail network that connects Pilbara mines to port facilities. No workers were injured, but the physical destruction was substantial [2].
May 2024, Karratha. An AutoHaul safety override failed during a track maintenance window, allowing an autonomous train to proceed into an occupied work zone. Five maintenance workers were forced to flee the track. The safety interlock system that should have prevented train movement during active maintenance did not function as designed [3].
There is also a widely reported but less well-documented incident in which an autonomous haul truck turned at an intersection that existed in its digital map but had no corresponding physical markings on the ground. The truck followed the map rather than the terrain, a failure mode that reveals the fundamental tension in GPS-and-map-dependent autonomy: the map is not the territory, and when they disagree, a 400-tonne truck follows the map.
The scale of the unmonitored fleet
To understand why these incidents matter, you need to understand the scale. The Pilbara autonomous mining fleet is not a technology demonstration. It is industrial infrastructure operating at a scale that dwarfs every other autonomous vehicle deployment combined.
As of 2025, there are approximately:
- 1,800+ autonomous haul trucks across Pilbara mine sites (Rio Tinto, BHP, Fortescue)
- Autonomous rail covering 1,700+ kilometers of track (Rio Tinto AutoHaul)
- Autonomous drilling rigs operating at multiple sites
- Remote operations centers in Perth controlling vehicles 1,500 km away
For comparison, Waymo operates approximately 700 autonomous vehicles across several US cities, and is considered the world’s leading autonomous vehicle company by fleet size. The Pilbara mining fleet is roughly 2.5 times larger and has been operating for longer — Rio Tinto’s first autonomous haul trucks went operational in 2008.
These vehicles operate in an environment that is, in some ways, simpler than urban roads — no pedestrians, no traffic lights, no cyclists. But in other ways, it is far more demanding: extreme heat (regularly exceeding 45 degrees Celsius), dust storms that degrade sensor performance, haul roads that shift and deteriorate daily, and the constant presence of human workers and light vehicles sharing the same space as 400-tonne machines.
The reporting gap
Here is the core problem: there is no public incident database for autonomous mining vehicles in Australia.
If a Tesla on Autopilot is involved in a fender-bender in California, it appears in NHTSA’s Standing General Order 2021-01 database within days. If a Waymo vehicle clips a bollard, there is a California DMV autonomous vehicle collision report. The data is imperfect, but it exists, and researchers and journalists can access it.
If a 400-tonne autonomous haul truck crushes a light vehicle at a Pilbara mine site, it is reported to the Western Australian Department of Mines, Industry Regulation and Safety (DMIRS) under the Mines Safety and Inspection Act. These reports are not routinely published. They do not appear in a searchable public database. They are not aggregated into trend analyses that the public or researchers can access.
WorkSafe WA investigates serious incidents, but its enforcement actions and investigation reports for autonomous mining incidents are sparse in the public record. The Australian Mining Safety Journal (AMSJ) and industry publications report some incidents, but coverage is inconsistent and dependent on industry sources choosing to disclose [1][3].
This means that the most mature autonomous heavy vehicle deployment on Earth is operating with less public safety transparency than a beta-stage robotaxi program in San Francisco.
Why digital maps are not enough
The incident where an autonomous truck turned at a digitally mapped but physically unmarked intersection points to a deeper architectural issue in autonomous mining.
Autonomous haul trucks typically navigate using a combination of high-precision GPS, pre-built digital maps of the mine site, and onboard perception sensors (lidar, radar, cameras). The digital map defines the road network — where trucks can go, where intersections are, where dump points and loading zones exist.
Mine sites are not static environments. Haul roads are built, modified, and decommissioned as mining progresses. Intersections are created and removed. Road surfaces degrade and are regraded. The physical environment changes faster than maps are updated, and the consequence of map-terrain divergence is not a routing error on Google Maps — it is a 400-tonne vehicle executing a turn where no road exists.
This is a world-model fidelity problem. The autonomous system’s internal model of the world (its map) diverges from the actual world, and the system defaults to trusting its model. In urban self-driving, this problem is mitigated by dense perception — cameras and lidar can detect road edges, lane markings, and curbs in real time. In a mine site, where “roads” are often unmarked dirt tracks distinguished from surrounding terrain only by compaction patterns, perception-based validation of the map is much harder.
The safety interlock question
The Karratha incident — where an autonomous train entered an occupied maintenance zone despite safety interlocks — raises a different class of concern.
Safety interlocks are supposed to be the last line of defense. They exist precisely for the scenario where normal operations fail: a track is under maintenance, a zone is occupied, a human is in the path. When the interlock itself fails, there is no remaining barrier between the autonomous system and the humans it is supposed to protect.
In industrial safety engineering, safety-critical interlocks are designed to “fail safe” — if the interlock system itself fails, the default state should prevent dangerous action. A failed interlock should stop the train, not allow it to proceed. If the Karratha interlock failure allowed an autonomous train to enter an occupied zone, the question is whether the failure mode was a “fail-dangerous” condition — one where the interlock’s failure state permitted rather than prevented movement.
Five workers fleeing an approaching autonomous train is not a near-miss. It is a failure of the safety architecture’s most critical component.
What this means for embodied AI safety
The Pilbara autonomous mining fleet represents a future that has already arrived, at scale, largely below the radar of mainstream AI safety discourse. The incidents documented here suggest several patterns relevant to embodied AI safety more broadly:
1. Reporting infrastructure lags deployment by decades. Australia has operated autonomous haul trucks since 2008. As of 2026, there is still no public incident database equivalent to NHTSA’s autonomous vehicle reporting. Eighteen years of operational history, and the safety data is essentially locked in regulatory filing cabinets.
2. The most dangerous autonomous vehicles get the least scrutiny. A 40-tonne autonomous truck gets less public safety oversight than a 2-tonne robotaxi. The severity weighting is inverted: the vehicles with the greatest kinetic energy and the highest consequence of failure operate under the least transparent reporting regime.
3. World-model divergence is a structural risk, not a bug. In dynamic environments where the physical world changes faster than digital maps can be updated, map-terrain divergence is not an edge case. It is a continuous condition that autonomous systems must handle. The question is whether they handle it by defaulting to the map or defaulting to caution.
4. Safety interlocks need the same scrutiny as autonomy systems. When an interlock fails, humans are the crumple zone. The Karratha incident suggests that the reliability of safety-critical interlocks in autonomous mining deserves independent audit — not just by the operators, but by regulators with the technical capacity to evaluate fail-safe design.
The Pilbara is a preview of what happens when autonomous systems scale before safety reporting scales with them. The trucks are running. The data is not.
References
- “Rio Tinto autonomous truck incidents and safety reports.” Australian Mining Safety Journal (AMSJ), various dates. https://www.amsj.com.au
- “Rio Tinto train derailment near Dampier port.” Rolling Stock World, February 2024. https://rollingstockworld.com
- “WorkSafe WA mining incident investigations.” WorkSafe Western Australia, various dates. https://www.commerce.wa.gov.au/worksafe
This analysis is part of the Failure-First Embodied AI research program, which studies how embodied AI systems fail — because failure is not an edge case, it is the primary object of study.