MO-2024-204 Passenger and freight ferry Aratere Grounding Titoki Bay, Picton 21 June 2024

What happened

1. On 21 June 2024, shortly after the Aratere (operated by Interislander) left Picton bound for Wellington, the pilot engaged the autopilot to control the rudders of the ship. A few minutes later the pilot pressed the ‘execute’ button on the autopilot, expecting the autopilot would perform a programmed three degree (°) turn to starboard, as per the passage plan.
2. The ship had already passed that course alteration position, and the autopilot had locked on to the next course alteration position where the programmed turn was a 34° turn to starboard. As a result, upon pressing the execute button, the autopilot initiated the starboard turn, causing the ship to veer out of the channel towards the shore.
3. When the bridge team realised that the ship’s turn to starboard was much greater than expected, they immediately attempted to transfer control of the rudders back to manual steering but were unable to do so.
4. The crew attempted to stop the ship using astern thrust on the main propulsion system. The ship ran aground while slowing down.

Why it happened

1. Spare parts were becoming difficult to source for the Aratere’s original steering control system and manufacturer support was declining. Interislander had chosen to replace the system with another which was considered like-for-like. The ship had been sailing between Wellington and Picton for three weeks following the replacement.
2. Inadequate implementation of Aratere’s safe navigation procedures, including bridge resource management, meant the risk mitigations inherent to those procedures were ineffective. For example, there was no robust shared mental model of the planned passage and use of bridge equipment, bridge team member roles lacked clarity, communication lacked a closed loop structure, and steering commands were not adequately monitored. The master was also distracted to some degree by training duties. As a result, the inadvertent turn to starboard was able to occur.
3. The safety management system included an audit and assessment programme to provide assurance that the safe navigation procedures were implemented, but the audit system itself was not enforced. Hence, Interislander management did not have adequate visibility on the status of its safe navigation procedures in practice and implementation lapses could go unnoticed and unaddressed.
4. Once the crew members realised the error, they were unable to take manual control of the rudders because they were not familiar with critical procedures for the newly installed steering control system that differed from the old system.
5. In particular, a feature of the steering control system was that control of the rudders could not transfer between consoles (for example from the autopilot to manual steering) unless their respective rudder commands were aligned within 2°. Control of the rudders could be forced from track pilot (the track pilot module is a module within an integrated bridge navigation system that includes an electronic chart display and information system, radar, position-indicating systems and sensors (for example, ship speed, rates of turn and water depth)) to the central helmsperson steering console, even without alignment, if the ‘take command’ button was pressed for 5 seconds (s). The crew members were not trained on either of these features.
6. The recent upgrade to the steering control system had introduced safety-critical changes to rudder control procedures that were not identified, nor addressed via training. There was no appointed project manager with overall responsibility from the project’s initiation through to the ship's safe return to service. As a result, the management of change was overlooked and no structured evaluation of differences between the new and old systems was conducted.

What we can learn

1. Any changes to safety-critical equipment, such as steering control systems, should include thorough risk analysis to identify any functional differences or potential changes to procedures, including specific training requirements for users.
2. The benefits of safe navigation procedures can be lost if the procedures are not consistently and fully implemented on all passages.
3. Quality assurance programmes, such as audits and assessments, are an important part of ensuring safety-critical procedures are consistently and fully implemented.
4. The success of safety-critical projects is dependent on a clear scope of responsibility and accountability for the project manager, and a strong management of change process, from the project’s initiation through to a ship's safe return to service.

Who may benefit

1. Ship operators, ship crew, those who operate safety management systems, auditors and regulators, maritime industry bodies, maritime training institutes, and any entities that introduce changes to safety-critical equipment may benefit from the findings and recommendations in this report.

Background

1. The Aratere is part of the Interislander fleet, which is owned and operated by KiwiRail Holdings Limited. The Aratere, had been in service for about 26 years at the time of the accident. Interislander identified that the control system for the steering machinery (the electro-hydraulic system and rudders; the steering control system) required replacement because spare parts were becoming difficult to source and manufacturer support was declining.
2. The purpose of the steering control system was to relay the rudder commands from the navigators on the bridge to the electro-hydraulic steering motors located in the steering room at the stern. This then turned the twin rudders to match the commands from the bridge. The steering control system was also integrated with the vessel’s electronic chart display and information system (ECDIS)  (Electronic Chart Display and Information System is a system that integrates navigational information to assist the crew in maintaining situational awareness and navigational safety) when in all track pilot modes.
3. On the bridge, steering could be controlled from any one of five command consoles (see Figure 3):
   • the port (the left-hand side of the ship looking forward) bridge wing console
   • the starboard (the right-hand side of the ship looking forward) bridge wing console
   • the centre pilot console
   • the central helmsperson (a person who steers a ship) steering console (which contained the wheel)
   • the track pilot module (a module within an integrated bridge navigation system that includes an electronic chart display and information system, radar, position-indicating systems and sensors (for example, ship speed, rates of turn and water depth; incorporating the autopilot).
4. Control of the rudders could be transferred to any one of the five command consoles.
5. In September 2023, Interislander had opted to replace the Aratere’s steering control system with a system produced by Kongsberg (a major supplier of industrial sensors, robotics and digital systems).
6. This involved replacing the controls at each of the command consoles, except for the autopilot. The autopilot was part of the original track pilot integrated bridge navigation system, made by a different manufacturer. The new Kongsberg steering control system was integrated with the track pilot.
7. The steering control system had been installed and commissioned during a ‘wet docking’ (an extended period out of service to conduct maintenance not requiring the ship to be dry-docked) period in Wellington between 11 and 30 May 2024.

1. The Aratere’s safe navigation procedures within its safety management system (SMS) prescribed two critical bridge team roles while navigating in pilotage waters: the pilot and the co-pilot. Only the master or officer of the watch (OOW) (the deck officer assigned to watch keeping and navigation on a ship’s bridge) could be assigned as pilot. The full descriptions of bridge duties for pilot and co-pilot are shown in Appendix 1, and some pertinent points are presented here.
2. The pilot had the con (‘having the con’ means conducting the navigational command of the ship) of the ship, initiated all manoeuvres, and had responsibility for the successful execution of the passage plan.
3. The co-pilot had significant and broad responsibilities, including (but not limited to) monitoring the ship’s position against the passage plan, following up on all manoeuvres and navigation made by the pilot, reviewing all actions taken by the pilot and maintaining awareness of all planned actions, being in charge of operational checklists, and communicating with parties external to the bridge (for example, by VHF radio, or with the engine room).

Narrative

1. After re-entering service following the installation and commission of the new steering control system, Aratere completed 83 inter-island crossings in the subsequent three weeks. Unrelated to the steering control system, the Aratere’s starboard propeller shaft was running on reduced power because of an issue with the gearbox.
2. On 21 June 2024, at 2110 (times are in New Zealand Standard Time (coordinated universal time (UTC) +12 hours) and expressed in 24-hour format) the Aratere completed loading at Picton in preparation for the passage to Wellington with 48 people and freight on board. Two masters (day master and night master) were on board to share the workload. The night master was in command for the departure from Picton while the day master was resting.
3. An additional experienced master (the relieving master - a qualified master who temporarily takes command of a vessel when the regular master is absent) was also on board for refamiliarisation training with the ship, having not sailed on Aratere for some time. Following the refamiliarisation training, they were to relieve the master. Normally the night master would have been the pilot and the OOW would have been the co-pilot. For this departure from Picton, the night master was acting as co-pilot and supervising the relieving master who was acting as pilot.
4. The OOW was on the bridge assisting as required. There were also two deck ratings (skilled seafarers who provide support with navigation, maintenance, security and other shipboard operations) on the bridge, one acting as lookout and the other as helmsperson.
5. Aratere left the berth at 2119. The relieving master was operating the engine controls from the port bridge wing, supervised by the night master. The helmsperson was steering the ship using the central wheel.
6. Once clear of the berth, the relieving master asked the helmsperson to steer 030 degrees (°) true to head for the first waypoint (a coordinate or location along a route, usually where the course changes or a voyage starts or ends) off Mabel Island. Soon after that, they adjusted the course to 028° as Aratere was slightly too starboard of the track. The night master transferred control of the engines to the centre pilot console.
7. The course between the Mabel Island waypoint and the Snout waypoint (programmed into the electronic chart display and information system (ECDIS) as Picton Point) (the next waypoint) was 033° true. This was a small alteration of 3° to starboard (see Figure 4).

1. The night master normally waited until the ship was clear of Mabel Island before engaging the autopilot. When Aratere was about abeam (at right angles to the ship’s heading) of Mabel Island, the night master and relieving master discussed whether to use ‘heading mode’ (the ship will steer the acquired heading) or ‘course mode’ (the ship will steer the acquired heading, but will automatically detect any sideways deviation arising from current and wind, and will adjust the heading to achieve the acquired course) for the autopilot. The autopilot was engaged on the ship’s current heading of 028° in course mode, after which the helmsperson was released from the wheel to stand by on the bridge.
2. From that point onwards the direction of the ship was controlled by the autopilot through the track pilot module.
3. The planned track for the passage to Wellington had been programmed into the track pilot as a series of waypoints joined by the track/course lines. The transition from one course to the next at each waypoint was programmed as an arc with a set radius. A wheel-over point (the point at which a turn is initiated and the rudders are rotated) was displayed before each waypoint (see Figure 4).

1. When in course or track mode (the ship will automatically follow the planned track programmed into the autopilot), the track pilot receives additional information from the ECDIS, such as wheel-over point. However, in course mode the track pilot will not automatically begin the turn. The pilot must push the ‘execute’ button. The track pilot will then apply the required rudder to take the ship around the programmed arc onto the next course. The pilot can make manual adjustments to the course using the course toggle control (see Figure 5).
2. Once the ship has passed a waypoint, the track pilot will automatically lock onto the radius turn for the next waypoint and the next course after achieving the turn.
3. The autopilot was engaged at 2126:01 when the ship was on a heading of 028° (see Figure 6). The relieving master pushed the execute button at about 2126:30 (as detailed by the after-accident technical report provided by the equipment service technician. The Voyage Date Recorder recorded when the command was actioned and the rudder angle changed). However, Aratere had passed the Mabel Island waypoint 36 s earlier, and the track pilot had already automatically locked on to the next substantial turn around the Snout waypoint (see Figure 7).

1. The track pilot applied 9°of initial starboard rudder and began to make a controlled turn as if the ship were making the turn around the Snout waypoint.
2. After 31 s, the night master realised from the ECDIS that Aratere was deviating to starboard of the track towards the shore. The night master immediately instructed the helmsperson to take over steering on the wheel, located on the central helmsperson steering console, and to put the rudder ‘hard over to port’.
3. Figure 7 shows a marked-up screenshot of Aratere’s ECDIS near the time the night master became aware that Aratere was deviating from the planned track. The set course was displayed as 73.8° with a radius turn of 0.43 nautical miles (NM), which was the next turn and course around the Snout waypoint. The ship predictor is a feature that shows the pilot where the ship will be in the immediate future, based on current speed and rate of turn.

1. The helmsperson pressed the ‘takeover’ button on the central helmsperson steering console (the action of the helmsperson pressing the button rather than a qualified officer was performed because the takeover button was located in the helmsperson position) in an attempt to transfer control from the autopilot to hand steering, and then turned the wheel hard to port. However, the transfer of steering command from the track pilot module to the wheel position did not occur and Aratere continued its turn to starboard, still controlled by the autopilot.
2. The OOW rushed to the central helmsperson steering console and pushed the takeover button, but with the same result. The autopilot had applied starboard rudder, but the helmsperson had the wheel set to amidships (a command to align the rudders with the fore and aft centreline of a ship), meaning the rudder commands between the two command consoles were not aligned.
3. The night master also attempted to take control of the rudders at the centre pilot console, but without success.
4. At 2127:43, recognising that the helmsperson did not have control of the steering and seeing that Aratere was already heading towards the shore, the night master put both engine combinators (the lever that controls the speed and direction of the ship’s propulsion systems) at full astern (moving aft or towards the rear of the ship) (41 s after noticing Aratere veering to starboard). Aratere was moving at 13 knots (kt) over the ground at that time.
5. It took 21 s for the port propeller and 38 s for the starboard propeller to begin turning astern, at 2128:04 and 2128:21 respectively (the starboard propeller shaft was running on reduced power because of a gearbox issue).
6. Records show that at 2128:06 the alternative non-follow-up mode of steering (an alternative mode of steering to the follow-up mode, in which the rudder will continue to move in the direction in which the lever is placed until the lever is released, after which the rudder will stay in that position until the lever is moved again) was engaged; this mode used the independent tillers on the centre pilot console. The port rudder moved hard to port (32°) and the starboard rudder moved 13° to port.
7. During this sequence, the night master instructed the OOW to start the ship’s bow thrusters (a propulsion unit mounted in an athwartships (from one side of the ship to another) tunnel near the bow that is used to thrust the bow to port or starboard when manoeuvring) to assist in manoeuvring the ship. The bow thrusters were put into ‘standby’ mode, but due to the startup time only one of the thrusters was providing thrust at the time of the grounding.
8. At 2128:34 Aratere crossed the 10-metre (m) sounding (water depth of 10 m on the chart where the ship would have been clear of the seabed) at about 8 kt. At 2128:46 the speed had dropped to about 1 kt. By 2128:50 the ship had stopped and was aground on a heading of 76.5° (the ship decelerated because of the actions taken by the crew, and also the subsequent friction of the ship on the seabed as it ran aground. The precise time the ship touched the seabed is not determined). 
9. The watertight integrity of the Aratere’s hull was not compromised, but the grounding dented the hull plating of the bulbous bow, and the internal structure sustained damage that required remedial repair before the ship’s return to service. There were no injuries.

Emergency response

1. The Picton Harbourmaster was notified of the accident by a local pilot, soon after the grounding had occurred. The harbourmaster began mobilising a response team to assemble at the Marlborough District Council’s Nautical and Coastal office in Picton.
2. At about 2156, approximately 27 minutes (min) after the vessel had stopped, Interislander notified the Rescue Coordination Centre New Zealand (RCCNZ) that the Aratere had run aground. They noted there was no water ingress and they were waiting for tugs to assist the ship back to berth in Picton. At about the same time, a crew member dialled 111 notifying New Zealand Police, and a response was initiated.
3. By 2315, the master confirmed that there was no immediate threat to life, and the ship was stable. All 48 people on board were well and in good spirits
4. At 2332, RCCNZ and Police agreed that the operation would continue to be led by Police with support from RCCNZ, where required.
5. Meanwhile Maritime New Zealand (Maritime NZ) activated the Maritime Incident Response Team (MIRT) and appointed a national incident controller.
6. By 2351, the decision was made that the safest option was to leave the passengers and crew on board and attempt to refloat the ship at the next high tide, during daylight hours, as the ship was in a relatively stable condition.
7. As a result, Police and RCCNZ de-escalated their operations as there was no immediate threat to life that would require a search and rescue operation.
8. In the following two days, various authorities were involved in overseeing Aratere being refloated using two Picton-based harbour tugs.

Crew information

1. The night master first gained their Master’s Certificate of Competency (CoC) in 1995 and was most recently revalidated in September 2020. They joined Interislander in 2009 and first sailed as master on the Aratere in 2018.
2. The relieving master first joined the Cook Strait inter-island ferry service (Between Wellington in the North Island and Picton in the South Island), that eventually became KiwiRail’s Interislander, in 1970. They were first issued a Master’s CoC in 1995 and began sailing as master of the Aratere in about 2003. After approximately five years working overseas, they returned to Interislander in 2016 to the role of superintendent. They had most recently completed a refamiliarisation of the Aratere as master in about 2020, and revalidated their CoC in March 2023.
3. The second mate OOW was issued a Watchkeeper Deck CoC in January 2021, and had worked at Interislander since April 2023.
4. The crew on the bridge were all aware the steering control system had been replaced.
5. The officers on the bridge were all trained in bridge resource management (BRM).

Ship information

1. Aratere was purpose built in 1998 to operate on the Cook Strait inter-island ferry service. The ship was owned by KiwiRail and operated by its subsidiary under the trading name Interislander. The Aratere was retired from service on 18 August 2025.
2. The Aratere was certified to carry a total of 720 people and could carry both rail and vehicular cargo.
3. The Aratere’s propulsion system was diesel–electric. The system included six diesel-driven generators that powered electric propulsion motors to drive two fixed-pitch propellors via two propellor shafts.
4. The Aratere’s steering was provided by two rudders powered by an electro-hydraulic system. The steering control system included the control panels on the bridge and the cabling down to the steering flat (the compartment at the aft end of a ship that houses the steering gear and associated equipment used to operate the rudder). That system was replaced during wet docking before the accident. The new steering control system was the Kongsberg K-Steering 600 KM SG, which was designed for ships with single or twin rudders and could be integrated with autopilot and dynamic positioning systems (dynamic positioning systems are computer-controlled systems used on ships to maintain their position using propellors and thrusters instead of anchors).
5. Once the Aratere had returned to service after the new steering control system was installed, the crew reported numerous alarms sounding during normal operations. These were reported to shoreside management who were working on the issue. This is discussed in section 3 of the report.

6. The Aratere’s steering control system (both old and new) controlled the rudder by either ‘follow-up’ or ‘non-follow-up’ steering control modes:

   Follow-up steering control: The crew set a desired rudder angle (e.g. 5° port) using the wheel or control, and the rudder moved to that angle and stopped.

   While in follow-up mode, the new steering control system had two methods for transferring control between the command consoles:

   1. align the rudder commands on both consoles, then press the ‘take command’ button on the console, taking control; or

   2. press and hold the ‘take command’ button on the central helmsperson steering consol for five seconds to force transfer of control from track pilot to the central helmsperson steering console, regardless of alignment.

   Non-follow-up steering control: The steering command was a direction (e.g. port); the rudder continued moving in that direction while the control was held, stopping when the control was either released or the rudder reached its limit.

7. The Aratere’s steering control system included two non-follow-up tillers (the tillers were hand-sized levers) on the centre pilot console, one for each rudder. The tillers were connected directly to the steering system and when activated would override other steering commands. They were an alternative steering control which met the requirements of the maritime rules to establish immediate manual control of the steering in emergency situations.
8. Although neither Interislander nor the crew were aware of the forced control transfer feature until after the accident, post-accident testing by the crew showed that it did not work as expected when transferring control to the bridge wings (the forced control transfer feature did work as expected when transferring control to the central helmsperson steering console, as was attempted during the accident).

Previous occurrences

1. The Commission found that there were two primary safety issues that contributed to the grounding. The first related to insufficient implementation of safe navigation procedures, including bridge resource management, because of a lack of quality assurance of those procedures via audits and assessments. The second related to inadequate project management of a project to replace a safety-critical system, which resulted in a lack of systematic management of change.
2. The Commission has previously made recommendations on safety issues similar to those described in this report; two of those recommendations were to KiwiRail and related to Interislander.

Safe navigation practices and quality assurance

1. Maritime inquiry MO-2011-202 (Transport Accident Investigation Commission, 2016a): A failure in implementation of BRM contributed to the Monte Stello running aground at the entrance to Tory Channel. The Commission recommended that the chief executive of KiwiRail ensure that the BRM policy and procedures outlined in its SMS remain relevant and effective for all crews on all ships in the fleet, all of the time. (see Recommendation 010/16).
2. Maritime inquiry MO-2011-204 (Transport Accident Investigation Commission, 2014): Failure to follow safe navigation procedures, including BRM, contributed to the grounding of the Rena. The Commission recommended that the Rena’s manager, CIEL Shipmanagement S.A., evaluate the effectiveness of its SMS to ensure that the issues identified with that system as applied on board the Rena do not affect other ships within its fleet (see Recommendation 010/14).
3. Maritime inquiry MO-2014-203 (Transport Accident Investigation Commission, 2016c): Weak auditing was linked to non-compliance with safety procedures. The Commission recommended that the operator of the Captain M. J. Souza review its internal auditing procedures to ensure that auditors make realistic assessments based on actual practices observed on board; and seek verification that documented procedures are being followed by the crew and are appropriate for the task. Audit findings should be recorded together with any safety actions taken as a result of the audit (see Recommendation 020/16).
4. Maritime inquiry MO-2018-203 (Transport Accident Investigation Commission, 2019): A failure in BRM contributed to the Leda Maersk running aground. The Commission recommended to the chief executive of Maersk Line A/S that they review the implementation of the company’s SMS across its fleet with respect to navigation and pilotage, and take the necessary steps to ensure a high standard is achieved by all crews on all its ships (see Recommendation 005/19).
5. Maritime inquiry MO-2024-203 (Transport Accident Investigation Commission, 2025b): Poor passage planning and unsafe navigation practices contributed to the grounding of the Chokyo Maru. The Commission recommended that Yugen Kaisha Chokyu take steps to ensure the effectiveness of its safety management practices with respect to voyage planning and navigation, and take steps to ensure the safe navigation of ships in its fleet (see Recommendation 027/25).

Project management/change management

1. Maritime inquiry MO-2013-203 (Transport Accident Investigation Commission, 2016b): After major alterations, one of the passenger and freight ferry Aratere’s propellers fell off while on passage. The Commission recommended that the chief executive of KiwiRail ensure that when KiwiRail makes significant modifications to ships, appropriate oversight is in place. Oversight includes keeping comprehensive records to demonstrate that components are safe and reliable and comply with the appropriate standards (see Recommendation 014/15).
2. Maritime inquiry MO-2015-201 (Transport Accident Investigation Commission, 2017): Insufficient oversight during changes to safety-critical systems contributed to the Kea collision with a wharf. The Commission recommended that Maritime NZ issue guidance and advice to operators and surveyors about the need to take a risk-based approach when determining the level of surveyor oversight required for changes to critical systems, regardless of whether or not the changes are considered major modifications (see Recommendation 026/17).
3. Rail inquiry RO-2017-102 (Transport Accident Investigation Commission, 2018): Inadequate management of change to the signals system led to unsafe system configuration. The Commission recommended that the chief executive of KiwiRail review KiwiRail’s change management processes for modifying existing, and building new, safety-critical systems. KiwiRail should ensure that these change management processes include a full failure-mode-effect analysis and functional testing is performed before the new or modified systems are put into service (see Recommendation 010/18).
4. Maritime inquiry MO-2023-205 (Transport Accident Investigation Commission, 2025a): Inadequate quality assurance and management of change led to the rudder falling off the Archilles Bulker. The Commission recommended that Maritime NZ investigate and submit papers as appropriate to the IMO (through the appropriate subcommittee) to promote standards that ensure sufficient quality assurance for rudder systems throughout the processes of installation, alterations, major repairs and maintenance. (see Recommendation 044/25).

Regulatory structure

1. The IMO is the United Nations’ agency responsible for regulating global maritime safety. Two key IMO conventions are the Safety of Life at Sea (SOLAS) Convention and the Standards of Training, Certification and Watchkeeping for Seafarers (STCW) Convention.
2. The objective of the SOLAS Convention is to specify minimum safety standards for the construction, equipment and operation of ships. The objective of the STCW Convention is to set the minimum global standards for the training and qualifications of seafarers.
3. Signatory countries are obliged to give effect to the SOLAS Convention and STCW Convention through their domestic legislation (see Figure 8).
4. A flag State is the country in which a ship is registered (the Aratere’s flag State was New Zealand). It is responsible for implementing and enforcing all instruments to which it is party on its ships. The flag State audits and issues certification to its ships.
5. The Maritime Transport Act 1994 provides the Minister of Transport with powers to implement IMO instruments by incorporating the requirements contained in those instruments into maritime rules. In practice, this is facilitated by Maritime NZ.

SOLAS Convention

1. The SOLAS Convention is incorporated into New Zealand domestic law through the promulgation of maritime rules.

2. The relevant maritime rules are:

   Maritime Rule Part 23.13 Testing of steering gear (this incorporates SOLAS Chapter V, Regulation 26.4.5)

   (2) The owner and the master of a ship to which this rule applies must ensure that simple operating instructions with a block diagram showing the change-over procedures for remote steering gear control systems and steering gear power units are permanently displayed on the navigating bridge and in the steering gear compartment.

   (3) The master of a ship to which this rule applies must ensure that all ships' officers concerned with the operation or maintenance of steering gear are familiar with the operation of the steering systems fitted on the ship and with the procedures for changing from one system to another.

   (4) The master of a ship to which this rule applies must ensure that in, addition to the routine checks and tests prescribed in rule 23.13(1), emergency steering drills take place at intervals of not more than 3 months to practise emergency steering procedures. These drills must include -

   (a) direct control from within the steering gear compartment; and

   (b) the communications procedure with the navigating bridge; and

   (c) where applicable, the operation of alternative power supplies

   Maritime Rule Part 23.13A Use of heading and/or track control systems (this incorporates SOLAS Chapter V, Regulation 24)

   (1) The master of a passenger ship that is both a New Zealand ship and a SOLAS ship must ensure that, when heading and/or track control systems are in use, it is possible to establish manual control of the ship’s steering immediately in conditions of -

   (a) high traffic density; or

   (b) restricted visibility; or

   (c) all other hazardous navigational situations.

   (2) The master must ensure that a qualified helmsperson is available to the officer in charge of the navigational watch to take over steering control where the conditions listed in subrule (1)(a), (b), or (c) are present.

   (3) The master must ensure that the change over from automatic to manual steering and from manual steering to automatic steering is made -

   (a) by the officer in charge of the navigational watch; or

   (b) under the supervision of the officer in charge of the navigational watch.

International Safety Management Code

1. At the time of the accident, the International Safety Management Code (ISM Code) was a mandatory code included in SOLAS Chapter IX. The ISM Code required ships’ operators to implement an SMS to ensure safe practices. Pertinent sections of the ISM Code are reproduced below:

2. ISM Code Part A, section 7 Shipboard operations:

   The Company should establish procedures, plans and instructions, including checklists as appropriate, for key shipboard operations concerning the safety of the personnel, ship and protection of the environment. The various tasks should be defined and assigned to qualified personnel.

3. ISM Code Part A, section 6 Resources and personnel:

   6.5 The Company should establish and maintain procedures for identifying any training which may be required in support of the safety management system and ensure that such training is provided for all personnel concerned.

4. ISM Code Part A, section 12 Company verification review and evaluation:

   12.1 The Company should carry out internal safety audits on board and ashore at intervals not exceeding twelve months to verify whether safety and pollution-prevention activities comply with the safety management system. In exceptional circumstances, this interval may be exceeded by not more than three months.

   12.2 The Company should periodically verify whether all those undertaking delegated ISM-related tasks are acting in conformity with the Company’s responsibilities under the Code.

   12.3 The Company should periodically evaluate the effectiveness of the safety management system in accordance with procedures established by the Company.

5. In New Zealand, Maritime Rule Part 21 references the ISM Code and sets out how it is applied. New Zealand was the flag State and in 2021 Maritime NZ issued a Document of Compliance for Interislander’s SMS.
6. Maritime NZ audited the Safety Management Certificate in 2023 and issued Aratere’s renewed Safety Management Certificate in 2024.

STCW Convention

1. The STCW Code is an annex to the STCW Convention. The Code provides the detailed technical standards and guidance to ensure that seafarers are properly trained and qualified to a consistent standard around the world, to provide for safe shipping operations. The pertinent sections of the STCW Code are:

2. STCW Code, Section A-VIII/2.8.5:

   .5 watchkeeping personnel shall understand functions and operation of installations/equipment, and be familiar with handling them

3. STCW Code, Tables A-II/1 and 2:

   Knowledge of steering control systems, operational procedures and change-over from manual to automatic control and vice versa. Adjustment of controls for optimum performance.

4. Both of these provisions from the STCW Code are incorporated by reference through Maritime Rules 32.98, 32.100, 32.102, 32.104 and 32.106.

Interislander’s safety management system

1. Interislander’s safe navigation policy required that the master refer to various documents, including (but not limited to):

   2.85.1 International Chamber of Shipping’s Bridge procedures guide (Bridge Procedures Guide), which includes sections on BRM, company policies and duties of the OOW.

   2.85.2 The Nautical Institute’s Bridge Team Management: A practical guide (Bridge Team Management), which includes sections on bridge team management, leadership, communication and decision-making, and teamwork. It emphasises the importance of collaboration among bridge team members, fostering a culture of mutual support and shared responsibility.

   2.85.3 The principles of BRM, as described in Bridge Procedures Guide and Bridge Team Management, were included and prescribed within Interislander’s SMS.

2. Pertinent sections of the SMS relating to bridge procedures are given in Appendices 1 and 2.

Introduction

1. The following section analyses the circumstances surrounding the event to identify those factors that increased the likelihood of the event occurring or increased the severity of its outcome. It also examines any safety issues that have the potential to adversely affect future operations.

What happened

1. Spare parts were becoming difficult to source for the Aratere’s original steering control system and manufacturer support was declining. Interislander had chosen to replace the system with another which was considered like-for-like. The ship had been sailing between Wellington and Picton for three weeks following this replacement.
2. On the day of the accident, shortly after the Aratere departed Picton bound for Wellington, the pilot engaged the autopilot to control the rudders of the ship. A few minutes later the pilot pressed the ‘execute’ button on the autopilot with the expectation of the autopilot performing a 3° programmed turn to starboard as per the passage plan.
3. However, the ship had already passed the course alteration position, and the autopilot had locked on to the next course alteration position where the programmed turn was 34° to starboard. As a result, upon pressing the execute button, the autopilot initiated the starboard turn, causing the ship to veer out of the channel towards the shore.
4. Once the bridge team recognised the error, they were unable to stop the turn or take manual control. They were not familiar with subtle changes to key functions of the newly commissioned steering control system.
5. The crew put the propulsion41 into full astern but the vessel did not stop before it ran aground.
6. Inadequate implementation of Aratere’s safe navigation procedures, in particular BRM, meant the risk mitigations inherent in those procedures were ineffective. For example, there was no robust shared mental model of the planned passage, bridge team member roles lacked clarity, communication was ineffective and steering commands were not adequately monitored. The master was also distracted to some degree by training duties.
7. A recent upgrade to the steering control system had introduced safety-critical changes to rudder control procedures that were not identified nor mitigated. The Commission determined there was no project manager with overall responsibility for the project’s initiation through to the ship’s safe return to service. As a result, the management of change was not effective. The crew did not receive adequate training and hence were not aware of the subtle changes to key functions of the new system.
8. The Commission found no evidence that a mechanical failure contributed to the accident. It is virtually certain that the turn to starboard that led to the grounding was caused by how the autopilot was operated, rather than an engineering fault with the steering system.
9. The causes and circumstances around this accident are discussed in the following sections.

SMS assurance

Safety issue 1: The safe navigation bridge procedures described in the operator’s safety management system were not adequately implemented by the bridge team. As a result, the risk mitigations inherent to those safe navigation procedures were absent, which allowed minor hazards to escalate and have serious consequences.

1. The ISM Code recognises that safe navigation depends not just on having clear procedures, but on their consistent application by trained crew, and effective oversight of this. It requires companies to establish safe operating procedures, provide training, and verify implementation through a monitored SMS that systematically manages operational risks.
2. This section examines the extent to which the ship’s SMS procedures for safe navigation applied to the circumstances of this accident, whether they were followed, and whether the company’s assurance processes were sufficient to detect and correct systemic deviations from those procedures.

What were Interislander’s safe navigation procedures?

1. The safe navigation of a ship is dependent on the performance of the bridge team. However, human error is ubiquitous and inevitable (Reason, 1990). That is to say, human error will occur, so a primary driver in a ship’s safety management system is to limit the incidence of dangerous errors, and then trap any errors to contain their damaging effects. Another purpose of the SMS is to identify and manage higher-risk operations.
2. BRM is an industry-recognised methodology and set of techniques which covers all aspects of bridge operations. The key function of BRM is that it engages all available resources, including people, procedures and equipment, to provide safeguards against accidents of the ‘one-person-error’ (a one-person error is a critical failure caused by a single individual without any system checks or safeguards to catch or mitigate it) type.
3. The value of BRM methodology is recognised in the STCW Convention and its requirement for BRM training for watchkeeping officers. The Aratere’s SMS incorporated the practices of BRM, and the officers on the bridge were trained in BRM principles and techniques.

Shared mental model

1. An underlying principle of BRM and capturing errors within teams is the concept of a shared mental model. This concept expects that each member of the team shares the same understanding of the outcomes of a task and the contribution of each member to ensure its success. Thus, if a team member, or some aspect of the process, deviates from the prescribed path, it is more likely that other team members will notice the deviation, challenge and correct the error. A shared mental model is usually established at the team briefing before engaging in the task.
2. The concept of a shared mental model across the bridge team was captured within the Aratere’s SMS: the SMS’s Departure and Post Departure checklist (to be used by the bridge crew) required a bridge team briefing. The checklist prompted the master to brief the bridge team on weather, traffic, deficiencies and propulsion.
3. The International Chamber of Shipping’s Bridge Procedures Guide notes that the briefing should include all members of the bridge team, and they should be made aware of their respective duties and any special instructions or concerns for the planned operation.
4. Although the bridge team had discussed aspects of the impending passage with respect to roles and responsibilities, the master did not conduct a pre-departure briefing sufficient to establish a robust shared mental model of the planned passage, including roles and responsibilities and use of bridge equipment. The core bridge team routinely operated together on familiar routes and might not normally have needed a full briefing. This passage differed from normal, with the presence of an additional team member on the bridge (the relieving master) who was undergoing training, and the reallocation of watchkeeping tasks.
5. As a result, there was uncertainty amongst team members about their roles and responsibilities, leaving some of the risk mitigations inherent in BRM ineffective, as discussed below.
6. One philosophy of BRM is ‘challenge and response’; bridge team members are encouraged to challenge operational decisions at all levels. It is about as likely as not that none of the bridge team members challenged the lack of a rigorous pre-departure briefing because of the crew’s shared familiarity with the operation.

Bridge team roles

1. The SMS prescribed the bridge team roles as master, OOW, quartermaster (helmsperson) and lookout. The OOW was the master’s representative and ‘Their primary responsibility at all times [was] the safe navigation of the ship.’ Their responsibilities continued even if the master was on the bridge. Further, the SMS required that ‘The master will clearly state to the officer on watch when the master is taking over responsibility of the watch.’
2. The relieving master was an experienced master undergoing refamiliarisation training for the Aratere, and they were a member of the bridge team when they departed Picton (discussed below). The SMS provided templates to document the outcome requirements of refamiliarisation, but how that training was conducted was left to the discretion of the master who delivered the training. In this case, the refamiliarisation was limited to vessel handling and bridge operations.

Red zone

1. Pilotage waters such as the Marlborough Sounds are designated zones with heightened risk, such as narrow channels or congested traffic. These regions need specialised navigation assistance, usually by a licensed marine pilot, to ensure safe navigation. The masters of the Aratere held pilot exemption certificates (PEC) (a PEC is a formal qualification that allows a ship’s master or deck officer to navigate a ship where pilotage is normally compulsory. To be granted a PEC, the applicant must demonstrate detailed knowledge of the local waters, including navigational hazards, traffic schemes, tides and regulations, typically through both written and practical assessments).
2. Interislander recognised the heightened risk and the SMS required that ‘red zone’ was declared in pilotage waters. Bridge protocols within the red zone were prescribed and specifically included various BRM best practices. The crew were expected to use BRM methods during all navigation; the red zone designated higher alertness.
3. The SMS prescribed two critical bridge team roles for operations in the red zone: pilot and co-pilot. Only the master or OOW could be assigned as pilot (see Appendix 1 for full details). In particular:
   • The pilot had the con of the ship (the ‘con of the ship’ refers to the authority and responsibility for directing a ship's movements), initiated all manoeuvres, and had responsibility for the successful execution of the passage plan
   • The co-pilot had significant and broad responsibilities including (but not limited to) to monitor the ship’s position against the passage plan, follow up on all manoeuvres and navigation made by the pilot, review all actions taken by the pilot and keep themselves aware of all planned actions, be in charge of operational checklists, and to execute communications to parties external to the bridge (for example by VHF radio, or to the engine room).
4. Before departure, the master did not declare red zone, however they were starting the passage from within pilotage waters so were already operating under red zone conditions. Typically, the master would establish red zone just before the ship entered Tory Channel and would disestablish it when the ship was again clear of Tory Channel (that is, one round trip into the Marlborough Sounds).
5. Initially the master assigned the role of pilot to the relieving master (the SMS prescription of bridge roles did not recognise the potential need for a master undergoing refamiliarisation training to act as pilot or co-pilot) and, as usual, the role of co-pilot was assigned to the OOW. The master assumed the role of supervisor. However, shortly after departure the master assumed the role of co-pilot and dismissed the OOW to focus on radio calls. The inclusion of the relieving master in a critical role and the change in co-pilot introduced two significant risks that remained unaddressed: ambiguity in the division of roles and responsibilities; and unclear expectations regarding the use of bridge equipment, such as the autopilot. These risks were not addressed in a briefing. The OOW remained occupied with some of their usual departure tasks. Although the safe navigation procedures described the OOW as responsible for safe navigation at all times, the OOW was not directly involved in navigation and remained peripheral to the navigation process because the master had assumed the role of co-pilot.
6. A briefing explicitly outlining the restructured bridge team roles and responsibilities would have provided greater opportunity to highlight the additional workload associated with the dual roles of the night master acting as co-pilot, and to clarify the role of the OOW. The ergonomics (human needs and capabilities) of the bridge layout would likely not allow the OOW easy access to all the pilot’s and co-pilot’s navigational information.
7. The bridge team did not discuss use of bridge equipment, such as the autopilot, before departure. As a result, the night master and relieving master discussed use of the autopilot at the time they were using it rather than executing a plan they had already agreed upon. That interaction, to some degree, provided a distraction from their responsibilities of safe navigation.
8. Bridge Team Management: A Practical Guide (Bridge Team Management: A Practical Guide is one of the guideline manuals referenced in the Aratere’s SMS) notes that ‘With any coaching situation it is essential to maintain supervision of the trainee and provide sufficient feedback on the progress being made.’ The guide also notes that ‘Distraction … can be an indication that situational awareness is beginning to break down.’ If the OOW had been assigned as co-pilot, then the master would have been free to focus on the relieving master’s training and actions. The OOW would have conducted their normal role as co-pilot, which would have allowed greater opportunity to identify the error and take corrective action.
9. Red zone protocols required communications to be limited to critical information and conducted using the BRM method of closed loop communication. Closed loop communication is when a message is sent, repeated back by the receiver, and then confirmed by the sender. This feedback loop ensures the information was heard accurately and prevents misunderstandings (see Appendix 2). The voyage data recorder audio recordings showed limited use of closed loop communications. Although there is no evidence to suggest a misunderstood command contributed to the accident, the less formal approach to communication protocols showed a lack of full implementation of BRM.
10. In addition, if the pilot had stated they were about to engage the autopilot, then the co-pilot would have had greater opportunity to notice that the ship had already passed the waypoint and the autopilot was locked on to the next turn, steering the ship aground. They would also have had better opportunity to notice the greater rudder movement when they were only expecting a small turn.

Why did the policies, procedures and crew training fail to ensure safe navigation?

1. As described above, the safe navigation procedures relevant to this accident were largely part of the principles of BRM and were well articulated within the safe navigation procedures.
2. Oversight to assure that those procedures were effectively implemented was provided for in the SMS, which required internal assessments for safe navigation (including BRM) be conducted annually for each ship in the fleet. An assessment explicitly targeting BRM had been conducted on the Aratere, with a different crew, in December 2023. The assessment report noted the assessors were ‘Overall very pleased with the operation use of BRM on Aratere’. However, the crew interviewed described few, if any, assessments. The designated person ashore (DPA) (the DPA acts as the link between a ship and the company’s shore-based management) described ad hoc external assessments that had been conducted in the past. There was no evidence of recent assessments against safe navigation procedures as prescribed in the SMS.
3. An internal ISM audit from 2022 noted that neither the master’s nor deck officers’ performance appraisals had been completed.
4. Interislander referred to the PEC training plan and proficiency plan as providing assurance of effective implementation of safe navigation practices. However, neither document referred explicitly to safe navigation practices as prescribed in the SMS.
5. The lack of closed loop communications, ineffective pre-departure briefing, unclear assignment of roles and responsibilities to the bridge team, changing of steering modes by the helmsperson rather than a qualified officer and the missed opportunities for training are all indicators of the normalisation of deviation from best practices on the ship. This is further highlighted in Safety issue 2 regarding project management.
6. Assessments and audits are sampling tools and do not capture everything but, when done regularly, they can reveal weaknesses in implementation of procedures. In this case, there was limited evidence of recent assessments or audits of safe navigation practices as described in the SMS, so management had limited insight into whether those practices were being followed. It is likely that if the annual safe navigation assessment programme had been implemented the practices on board the ship would have been more aligned with the procedures prescribed in the SMS.
7. Had the bridge team followed the bridge protocols as described, such as holding a thorough pre-departure briefing (to clarify roles, responsibilities and communication protocols, and develop a shared mental model of pilot actions and co-pilot monitoring actions) it is very likely the unplanned turn to starboard would have been detected earlier or avoided.
8. The lack of audits or an assessment programme for the implementation of safe navigation procedures is another indicator of normalisation away from best practices.
9. In the Commission’s view the safety action taken by Interislander (outlined in section 5 of the report) has addressed the safety issue. Therefore, the Commission has not made a recommendation.

Project management

Safety issue 2: The project to change a safety-critical system on the ship did not provide assurance that safe navigation, as described in the SMS, would be protected. The project focused primarily on installation, with minimal regard for change management more generally, including safety implications and training.

1. It is a requirement under SOLAS, incorporated into Maritime Rules Part 23.13A – Use of heading and/or track control systems, and prescribed in the Aratere’s Standing Orders, that while the ship is under navigation using heading or track control systems (autopilot is a heading or track control system and is distinct from a steering control system) ‘it shall be possible to establish manual control of the ship’s steering immediately’, and ‘a qualified helmsperson is available to the officer in charge of the navigational watch to take over steering control.’
2. However, when the ship began the unplanned turn to starboard under autopilot steering control, the bridge team could not immediately establish manual control of the Aratere’s steering system. They were unsuccessful because they were not aware that the new steering control system required a different procedure from the old system. Testing by Kongsberg and Interislander after the grounding, and by the Commission, found no evidence that a failure of the steering control system itself contributed to the accident.
3. The project to install the new steering control system had focused on its physical installation and did not include a structured evaluation of the risks posed by replacing a safety-critical system. It is virtually certain that a structured evaluation would have identified the differences between the systems and prompted appropriate training for the crew.
4. The following sections describe the safety factors that contributed to this outcome.

Why couldn’t the crew establish immediate manual control?

1. A key feature of the new Kongsberg steering control system was that command could not transfer between consoles unless their rudder commands were aligned within 2°. For example, if the autopilot had 15° starboard rudder applied, the manual steering control station had to match this within ±2° before pressing the ‘take command’ button; otherwise, transfer would not occur. This differed from the old steering control system, which allowed transfer regardless of alignment between control stations.
2. On the day of the incident, during the unplanned turn, the crew attempted to take control from the autopilot under urgency without aligning the rudder commands. As a result, the control transfer failed and repeated attempts failed for the same reason.
3. The non-follow-up tillers were later engaged and the rudders responded, but in the limited time available the grounding was not averted.

Why was the crew unable to identify and rectify the issue?

1. The crew did not know that misalignment of the rudder commands was inhibiting successful control transfer, and hence they were unable to rectify the issue.
2. Under usual circumstances it was normal practice for the Aratere’s crew to align the controls before transferring control, and so previous attempts to transfer control had been successful. Aligning the controls before transferring control is considered good practice for these reasons:
   • part of good BRM: aligning or synchronising the controls is a standard action that reinforces a clear and shared understanding between users during handover
   • if the steering controls (wheel, tiller or joystick) are not synchronised or aligned with each other when control is transferred, the new station will immediately send its rudder angle to the steering gear, causing an unexpected turn.
3. During interviews, the crew described a previous occurrence of problematic transfer of steering control between steering consoles. This issue was similar to that on the day of the grounding.
4. Some crew described sensory overload and distraction from numerous alarms on the bridge following the ship’s return to service after the steering control system had been replaced (numerous alarms causing distraction was not reported as an issue leading to the accident).
5. The crew reported these concerns to the ship’s shoreside management team who assured the crew the system was safe. They were working to fix the issue, but it was not resolved before the grounding.
6. Another factor that limited the crew’s ability to recognise the cause of the issue was that when they attempted to take control without aligning the rudder controls, the system did not provide sufficient feedback. Effective design requires that visual, auditory or tactile feedback be provided to support situation awareness and alert the driver to critical limitations or failure modes (University of Massachusetts-Amherst, AAA Foundation for Traffic Safety, 2022). In this case, no clear feedback was available to notify the crew that control transfer could not occur because of rudder misalignment. After another incident involving transfer of rudder control, this aspect of the Aratere’s steering control system was modified to provide more feedback.
7. On 3 July 2025, as the Aratere approached the entrance to Tory Channel, the crew experienced another problematic transfer of steering control from autopilot control to manual control, where one rudder remained under the control of the autopilot and the other transferred to manual steering. The approach was aborted and the crew successfully regained control of the rudders. After that incident, Kongsberg recreated the issue and determined that it was related to the need to align the rudder commands within the narrow band of ±2°. In consultation with Interislander, they modified the configuration to allow transfer between consoles with up to ±15° alignment between control consoles, and included feedback of system status on the console screen.
8. The third reason is that the crew had not received training on the differences between the old and new steering control systems and were not aware that the controls needed to be aligned to successfully achieve control transfer. The bridge team had not been made aware of the force takeover feature; similarly, the shoreside management team were not aware of the feature.
9. If the crew had been trained on the need to align controls before transferring command and how to use the force takeover feature, it is very likely they would have been successful in establishing immediate control of the steering system and the unplanned turn to starboard would have been rectified before the grounding.

Why weren’t the crew trained on the new system?

1. The crew were not trained on the procedures of the new steering control system because management of the project to change the system did not include an effective mechanism to evaluate and identify the critical differences between the old and new systems, nor assure adequate training.
2. STCW lays out the requirements of certain training programmes, incorporated by reference via Part 32 of the Maritime Rules. The training programme should:
   • cover system familiarisation
   • highlight the subtle differences between new and old systems
   • cover command-transfer logic and alarm/failure response
   • cover updated bridge procedures
   • include practical drills (SOLAS Convention also requires regular drills with respect to the steering system) or simulations, and a formal assessment with sign-off to confirm all relevant crew members’ competence on the new system.
3. In addition, Maritime Rule 23.13(4) requires that ‘emergency steering drills shall take place at least once every three months in order to practise emergency steering procedures’. Those drills had not been planned nor conducted on the new steering control system in the three weeks before the grounding.
4. Development of such a quality-controlled programme would necessitate structured evaluation of differences between the systems as described above. The following paragraphs describe the gaps in project management that allowed this outcome.
5. Replacing the steering control system on the Aratere was a safety-critical undertaking. It required structured oversight and coordination of the physical installation and the management of change to ensure a safe return to service for the ship. At the heart of such an effort is the project manager, who provides the essential link between technical teams, operational staff, regulatory bodies and ship crew. Critically, the life of the project extends from its initiation through to the ship’s safe return to service, and so too does the role of project manager.
6. Once Interislander had decided to replace the steering control system, an experienced engineering manager was appointed project manager to initiate the project. However, the project manager’s role was limited to establishing the physical installation of the new steering control system. Their role included funding considerations, identifying what steering control system to install, establishing contracts and assuring class approval for the physical installation. There were no explicit terms of reference nor written project scope for the project manager’s role. Once the initial project manager had finished their work, they were no longer actively engaged with the project.
7. Once the physical installation project was underway the (newly appointed) Fleet Operations Manager became involved in managing the Aratere’s return to service. Similar to the initial project manager, the Fleet Operations Manager was primarily concerned with the physical installation and commissioning of the steering control system.
8. Consequently, there was no project manager with oversight of the entire project. Further, project management resources were applied exclusively to the physical installation and commissioning, and risk mitigation associated with changing safety-critical equipment, such as training needs, were not addressed through a structured management of change (MoC) process.
9. It is likely that had the project scope and terms of reference been articulated and an overall project manager appointed, the Aratere would have had a safe return to service and the grounding would not have occurred.

The replacement project did not include a structured evaluation of effect on operations

1. Interislander’s SMS included a chapter prescribing the process for MoC. Its objective was to define formal change management procedures to ensure that controls were in place to avoid or mitigate undesired consequences of the change, and assure safety and operational integrity.
2. The MoC process included identifying any effects the change might have on safety of the ship, operational issues and conflicts, and developing knowledge and training for those who will require it. The MoC process should have been the catalyst for a structured evaluation to identify differences between the new and old steering control systems, to identify Interislander’s desired system configuration, and result in a quality-assured training programme to ensure familiarisation of the crew with the new system.

3. As a part of the initial project manager’s work, they had submitted an electronic MoC form in Interislander’s SMS. The MoC form primarily covered risks related to worksite management, such as working at heights and in confined spaces. However, the initial project manager also included training requirements in the MoC for:

   • manufacturer training for the bridge team on the new operating console and features of the new steering control system

   • technical support training for the engineering team.

4. There was no evidence that the submitted form triggered any follow-up. The electronic MoC system that the project manager used was in its infancy when the steering control replacement project was initiated. This may provide some context around why the MoC form did not trigger a quality-controlled training programme.
5. In addition, although the MoC form identified a requirement for bridge crew training to be delivered by the manufacturer, the contract with the manufacturer did not describe any training requirement and explicitly excluded ‘technical advising or any onsite assistance etc’. There was no evidence the requirement for the manufacturer to deliver training was addressed elsewhere.
6. So, although the project manager had identified the need for training, that requirement for training noted by the initial project manager was not actioned.
7. Interislander’s understanding of the scope of the project likely contributed to the lack of MoC process.The Kongsberg steering control system chosen to replace the old system was a like-for-like replacement for the existing steering control system. Classification societies (American Bureau of Shipping. (2013). ABS-196, Guidance notes on Management of Change for the marine and offshore industries) generally describe like-for-like replacement as the substitution of equipment with items that have equivalent specifications and performance. In particular, this requires that the replacement perform the same function to the same standard as the original. The new steering control system met the description of like-for-like, but that description did not include ‘configuration settings’ (an example of ‘configuration settings’ is the procedure to transfer control of the rudder between steering stations) related to the end-user experience
8. Although the new system was a like-for-like replacement, it came from a different manufacturer, and it had numerous configuration settings that differed from the old system. Interislander was not aware of these differences.
9. MoC processes typically exclude like-for-like replacements. As an example, the American Bureau of Shipping (Guidance notes on Management of Change for the marine and offshore industries, 2013) notes that an MoC programme should disregard changes that constitute a like-for-like replacement, and the same exclusion is made in Interislander’s SMS section on Management of Change.
10. Although replacing the steering control system demonstrably introduced safety-critical risks, the MoC procedures, if followed, arguably did not apply to this project. Interviews showed that the like-for-like aspect of the project manifested as the perception that the new system was identical to the old system from the perspective of user experience. This perception pervaded management thinking, and the quality assurance and safety aspects of project management focused almost solely on the physical installation. The new system could be configured differently from the old system and user experiences would therefore differ, yet there was little evidence that user experience was considered by Interislander throughout the project from design through to acceptance testing.
11. For example, there was significant work done between Interislander, Kongsberg and ship’s classification society to confirm that the new steering control system was compatible with Aratere’s engineering systems and could be safely installed. On the other hand, the crew’s training on the new system was an ad hoc ‘5-minute handover’ from the Kongsberg technician to the master (not the same master as the day of the grounding) during sea trials. That master then passed on their understanding to other crew when opportunity arose. The technician also sailed on board for three passages to assist as needed. The training was not planned or documented, nor was it subject to quality-control processes.
12. There was no evidence that a structured evaluation had been carried out to identify differences between the new and old steering control systems. In fact, the differences between the systems were not identified until post-accident testing.
13. It is important that a structured MoC process is conducted during the initial stages of any significant changes to safety-critical systems, regardless of how the project is perceived.

What opportunities were available to identify the risk posed by replacing the steering control system?

1. The initial project manager engaged an external contractor to manage the physical installation of cabling and other physical components of the steering control system while the ship was in wet dock. During the course of their work, the external contractor referenced the steering control system’s generic manual that was supplied with the equipment. The manual did not include ship-specific information or user instructions and so they recommended to Interislander that a ship-specific manual be provided.
2. By that stage there was no single project manager accountable for the project overall, and the recommendation was not actioned. The need for a ship-specific manual was identified again after the grounding, and Kongsberg developed and provided a simplified ship-specific manual for Interislander.
3. Before the grounding some of the crew had spent time attempting to familiarise themselves with the new system, including referencing the generic manual. However, as noted above, the manual did not set out specific procedures for the steering control system that was installed on Aratere, and so the crew remained unaware of the critical differences between the new and old systems.
4. Had the ship-specific manual been made available to the crew before the ship’s return to service it is very likely the crew would have identified the differences and promulgated that information to the relevant people.
5. Another opportunity to identify the differences between the steering control systems was during the sea trials conducted before the ship re-entered service.
6. The purpose of sea trials is to verify completed work and identify any faults before returning the ship to service. In particular, after replacing the steering control system, trials were held to confirm the new system functioned as expected under real operating conditions.
7. There were two aspects to the sea trials: Kongsberg’s testing of their newly installed equipment; and Interislander’s testing of the ship and crew familiarisation before re-entering service.
8. An exhaustive sea trials plan should be prepared and approved before sea trials, with appropriate quality-control and assurance processes in place. In particular, the sea trials process should test all the functions and the crew’s familiarity with the steering control system, such as command transfer between consoles and the forced takeover feature. Typically, a ship’s shoreside management would be involved in developing a sea trials plan, attend the sea trials and provide management acceptance.
9. Shoreside management did not provide a plan for the sea trial. Before the sea trials, the master on board at the time developed their own plan based on their previous experience of such work. The sea trials included a comprehensive test regime of the steering control system aligned with Kongsberg’s checklist, but did not include the crew demonstrating familiarity while testing all the functions of the system.
10. If Interislander’s sea trials plan had been developed as part of a structured MoC process it is very likely the differences would have been identified, either during development of the plan or its execution.
11. Interislander underestimated the significance of replacing the steering control system and did not address the safety-critical project with the due diligence it deserved. The lack of scope and terms of reference for project management meant the gap in accountability was not evident. Consequently, project management was limited to the physical appropriation and installation of the steering control system itself, with no project manager accountable for the overall success of the project.
12. In the Commission’s view the safety action taken by Interislander (outlined in section 5 of the report) has addressed the safety issue. Therefore, the Commission has not made a recommendation.

Emergency response

1. Responding to a grounded SOLAS-classed ship generally requires a complex and multifaceted operation, involving actions from multiple stakeholders, for a successful outcome. Priority is given to preservation of life and safety of those on board. Additional measures are taken to protect the environment and if possible, safely refloat the ship.
2. Following the grounding of Aratare, Police served as the lead agency for the emergency response, with support from RCCNZ. During this time, Maritime NZ activated its MIRT to provide a national level of oversight and support for the response and recovery of the ship.
3. Once it was established that all people on board were safe and not requiring rescue, the emergency response was de-escalated. Before de-escalation it was agreed that Maritime NZ would serve as the lead agency working towards the recovery of the ship, utilising the MIRT.
4. The Marlborough District Council (MDC) was responsible for leading and managing a potential oil-spill response with support from Maritime NZ’s National Response Team. Additionally, MDC was responsible for maintaining the safe navigation of the regional waters.
5. When the emergency response was de-escalated, MDC was unaware there had been a handover of lead agency responsibilities. As such, it was unclear which agency was responsible for the ongoing grounding and recovery aspects of the operation. Both aspects required input from the MDC oil-spill response team and were key elements for ensuring safe navigation and security.
6. The MDC media team first learned that Maritime NZ was managing the incident through media reports. The MDC Harbourmaster then made an inquiry through Maritime NZ’s National On-Scene Commander and later established contact with the MIRT Controller at 0825 on 22 June 2024.
7. While this did not affect the overall outcome of the response, it created confusion in an already complex environment. The condition of a grounded ship has the potential to deteriorate at any moment. It is important that all key stakeholders understand who is in control at any given time, should they need to act with urgency.
8. During a handover of lead agency responsibilities, information is exchanged providing the new lead agency with accurate situational awareness. For this to be effective it requires input from all key stakeholders. Additionally, it is important that the new lead agency ensure that all stakeholders are aware of the change in leadership and immediately establish a line of communication.

1. The Commission found no evidence that a mechanical failure contributed to the accident. It is virtually certain that the turn to starboard that led to the grounding was caused by how the autopilot was operated, rather than an engineering fault with the steering system.
2. Once the crew realised the ship was deviating from the passage plan, they acted immediately and decisively in an attempt to regain control.
3. The safe navigation practices, including BRM as prescribed in the SMS, were not fully implemented by the bridge team. As a result, the defences in place to prevent the inadvertent turn to starboard were not effective.
4. The Aratere’s shoreside management lacked adequate visibility, and therefore assurance, of the crew’s implementation of safe navigation practices, because the safe navigation audit programme had not been properly implemented.
5. It is about as likely as not that none of the bridge team members challenged the lack of rigorous pre-departure briefing because of their shared familiarity with the operation.
6. Had the bridge team followed the bridge protocols as described, such as holding a thorough briefing to clarify roles, responsibilities and communication protocols, and develop a shared mental model of pilot actions and co-pilot monitoring actions, it is very likely the unplanned turn to starboard would have been detected earlier or avoided.
7. It is likely that if the annual safe navigation assessment programme had been implemented the practices on board the ship would have been more aligned with the procedures prescribed in the SMS.
8. If the crew had been trained on the need to align controls before transferring command and on how to use the force takeover feature, it is very likely they would have been successful in establishing immediate control of the steering system and the unplanned turn to starboard would have been rectified before the grounding.
9. It is likely that had the project scope and terms of reference been articulated and an overall project manager appointed, the Aratere would have had a safe return to service and the grounding would not have occurred.
10. Interislander’s understanding of the scope of the project likely contributed to the lack of MoC process.
11. Had a ship-specific manual for the steering control system been made available to the crew before the ship’s return to service, it is very likely they would have identified the differences and promulgated that information to relevant people.
12. The project to install the new steering control system had focused on its physical installation and did not include a structured evaluation of the risks posed by replacing a safety-critical system. It is virtually certain that a structured evaluation would have identified the differences between the systems and prompted appropriate training for the crew.
13. If Interislander’s sea trials plan had been developed as a part of a structured management of change process it is very likely the differences would have been identified, either during development of the plan or its execution.

General

1. Safety issues are an output from the Commission’s analysis. They may not always relate to factors directly contributing to the accident or incident. They typically describe a system problem that could adversely affect future transport safety.
2. Safety issues may be addressed by safety actions taken by a participant; otherwise the Commission may issue a recommendation to address the issue.

Safety issue 1: The safe navigation bridge procedures described in the operator’s safety management system were not adequately implemented by the bridge team. As a result, the risk mitigations inherent to those safe navigation procedures were absent, which allowed minor hazards to escalate and have serious consequences.

1. On 31 October 2024, KiwiRail publicly announced a list of improvements Interislander would implement as a result of the Aratere grounding (Interislander is implementing improvements in wake of grounding, 2024). With respect to BRM it would:

   Introduce navigation assessments

   Introduce annual navigation assessments, carried out by trained assessors, to identify opportunities to improve and verify that good navigation practices, including Bridge Resource Management (BRM)/Maritime Resource Management (MRM), are in use consistently across the fleet.

   Safety Management System (SMS) to be updated to reflect Interislander’s BRM/MRM expectations.

   Review Safety Management System

   SMS should be reviewed and aligned with industry good practice (noting that the ISM Code itself is presently under review in the IMO).

2. In addition, Interislander engaged Kongsberg to produce a ship-specific user manual, which was provided to crew.
3. On 18 December 2025, Interislander advised the Commission it had:
   • undertaken a review of its BRM procedures and practices
   • developed and issued a revised BRM training programme for Bridge Teams
   • progressed in ensuring bridge crew have completed the revised training.
4. On 24 March 2026, Interislander advised the Commission it had:
   • Updated navigation assessments: to identify opportunities to improve and verify that good navigation practices, including Bridge Resource Management (BRM)/Maritime Resource Management (MRM), are in use consistently across the fleet. The updated navigation assessment programme now includes on-board BRM assessments of bridge crews, and is being undertaken across the fleet by independent third party, Voyager Marine.
   • The Safety Management System (SMS) has been updated to reflect Interislander’s BRM/MRM expectations for the fleet. The Bridge Manual has been updated to ensure standard bridge practice across the fleet. In addition, and to ensure good BRM practices are in use consistently, a new Bridge Management, Ships Handling and Contingency planning course was developed in conjunction with the NZ Maritime School. Training and assessment is well underway, and all bridge crew are expected to have completed the course by end of October 2026. One day refresher training will be undertaken on a 36 months cadence.
   • Additionally: The Safety Management System has been reviewed by an independent third party having regard to industry good practice (noting that the ISM Code itself is presently under review in the IMO). All recommendations and findings from that review have been entered in ORA and the actions assigned.
   • KiwiRail engaged Kongsberg to produce a customised, ship-specific user manual for Aratere, which was provided to crew. Bridge equipment manuals were also updated. Training was conducted and Control verifications of the steering control system were undertaken. A Safety Bulletin on the hazards and use of trackpiliot and autopilot systems was issued.
5. The Commission considers this safety action has addressed the safety issue. Therefore, the Commission has not made a recommendation.

Safety issue 2: The project to change a safety-critical system on the ship did not provide assurance that safe navigation, as described in the SMS, would be protected. The project focused primarily on installation, with minimal regard for change management more generally, including safety implications and training.

1. On 31 October 2024, KiwiRail publicly announced a list of improvements it would implement as a result of the Aratere grounding (Interislander is implementing improvements in wake of grounding, 2024). With respect to risk management and change management:

   Review risk management

   Steering gear is critical equipment, the sudden operational failure of which can lead to a hazardous situation such as a grounding. The risk management process should be reviewed and aligned with industry good practice, not only health and safety guidelines.

   Review Management of Change process

   Interislander's Management of Change (MoC) process should be reviewed and brought into line with industry good practice.

2. On 24 March 2026, Interislander advised the Commission it had:

   Undertaken a review of Interislander's Management of Change (MoC) process and alignment with enterprise change management process. As part of the SMS review referred to above the (MoC) process was reviewed against good industry good practice, and updated. Additionally, and prior to the incident, Interislander had established a Technical Advisory Group (TAG), to review asset performance, operational standards, technical advances and management of change proposals, including of safety-critical systems and equipment.

3. The Commission considers this safety action has addressed the safety issue. Therefore, the Commission has not made a recommendation.

General

1. The Commission issues recommendations to address safety issues found in its investigations. Recommendations may be addressed to organisations or people, and can relate to safety issues found within an organisation or within the wider transport system that could contribute to future transport accidents and incidents.
2. In the interests of transport safety, it is important that recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

New recommendations

1. In the Commission’s view the safety action taken has addressed both of the safety issues. Therefore, the Commission has not made any recommendations.

1. The benefits of safe navigation procedures can be lost if they are not consistently and vigorously applied on all passages.
2. Clarification of bridge crew roles and responsibilities before departure is an important part of ensuring a safe passage.
3. Assessments and audits are sampling tools and do not capture everything, but when done regularly, they can reveal weaknesses in implementation of procedures.
4. Proactive shoreside support of safe navigation procedures and practices, such as audits and assessments, is critical to achieving consistency on board.
5. Replacing a safety-critical system requires structured oversight and coordination, of both the physical installation and the management of change, to ensure a ship’s safe return to service.
6. The success of safety-critical projects is dependent on clear scope of responsibility and accountability for project managers.
7. A safe and effective emergency response depends on coordinated stakeholders and clear, continuous communication throughout. After a handover of lead agency responsibilities, the new lead agency should immediately establish communication with key stakeholders to make them aware of the change in leadership. This helps ensure that all stakeholders understand who is in control at any given time and allows for relevant information to be exchanged, providing the new lead agency with accurate situational awareness.

1. On 22 June 2024, Maritime NZ notified the Commission of the occurrence. The Commission subsequently opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an Investigator-in-Charge.
2. The Commission issued a protection order under Section 12 of the Transport Accident Investigation Commission Act 1990 to preserve and protect the voyage data recorder and the various components of Aratere’s steering system.
3. On 22 June 2024, three investigators travelled to Picton to gather information, staying there until 25 June. On 27 June, two of the investigators returned to Picton to gather information, staying until 29 June.
4. On 28 August 2024, the Commission approved a draft interim factual report for circulation to four interested parties for their comments.
5. Three interested parties provided detailed submissions, and one interested party did not provide a submission. Any changes as a result of the submissions have been included in the final report.
6. On 25 September 2024, the Commission approved the final interim factual report for publication.
7. On 30 October 2025, the Commission approved a draft report for circulation to eight interested parties under S14(5) of the Transport Accident Investigation Commission Act 1990, and to two parties under S14B(2) of the Transport Accident Investigation Commission Act 1990 for their comment.
8. The Commission received eight responses, all of which were submissions. Two interested parties did not respond. The Commission considered all submissions and any changes as a result of these submissions have been included in the final report.
9. On 29April 2026, the Commission approved the final report for publication.

American Bureau of Shipping. (2013). ABS-196, Guidance notes on Management of Change for the marine and offshore industries.

International Chamber of Shipping. (2022). Bridge procedures Guide Sixth Edition. International Maritime Organization. (2004). International Convention for the Safety of Life at

Sea, Chapter V, Regulation 24 - Use of heading and/or track control systems.

KiwiRail. (2024). Interislander is implementing improvements in wake of grounding. Retrieved from https://www.kiwirail.co.nz/media/interislander-is-implementing-improvements-in-wake-of-grounding/

Reason, J. (1990). Human error. Cambridge University Press.

The Nautical Institute. (1993). Bridge Team Management A Practical Guide

Transport Accident Investigation Commission. (2014). MO-2011-204 Container ship MV Rena grounding on Astrolabe Reef, 5 October 2011. Retrieved from https://www.taic.org.nz/inquiry/mo-2011-204

Transport Accident Investigation Commission. (2016a). MO-2011-202 Roll-on-roll-off passenger ferry Monte Stello, contact with rock, Tory Channel, Marlborough Sounds, 4 May 2011. Retrieved from https://www.taic.org.nz/inquiry/mo-2011-202

Transport Accident Investigation Commission. (2016b). MO-2013-203 DEV Aratere, fracture of starboard propeller shaft, resulting in loss of starboard propeller, Cook Strait, 5 November 2013. Retrieved from https://www.taic.org.nz/inquiry/mo-2013-203

Transport Accident Investigation Commission. (2016c). MO-2014-203 Fatal injury, Purse seine fishing vessel, Captain M. J. Souza, 24 August 2014. Retrieved from https://www.taic.org.nz/inquiry/mo-2014-203

Transport Accident Investigation Commission. (2017). MO-2015-201 Passenger ferry Kea, collision with Victoria Wharf, Devonport, 17 February 2015. Retrieved from https://www.taic.org.nz/inquiry/mo-2015-201

Transport Accident Investigation Commission. (2018). RO-2017-102 Signalling irregularity, Wellington Railway Station, 3 April 2017. Retrieved from https://www.taic.org.nz/inquiry/ro-2017-102

Transport Accident Investigation Commission. (2019). MO-2018-203 Grounding of container ship Leda Maersk, Otago Lower Harbour, 10 June 2018. Retrieved from https://www.taic.org.nz/inquiry/mo-2018-203

Transport Accident Investigation Commission. (2025a). MO-2023-205 Bulk carrier, Achilles Bulker, Loss of rudder, Off the Port of Tauranga, 24 July 2023. Retrieved from https://www.taic.org.nz/inquiry/mo-2023-205

Transport Accident Investigation Commission. (2025b). MO-2024-203 Fishing vessel, Chokyu Maru No.68, grounding, Hauraki Gulf, 16 April 2024. Retrieved from https://www.taic.org.nz/inquiry/mo-2024-203

University of Massachusetts-Amherst, AAA Foundation for Traffic Safety. (2022). Human-Machine Interfaces and vehicle automation: a review of the literature and recommendations for system design, feedback, and alerts. AAA Foundation for Traffic Safety, SAFER-SIM.