Final Report


What happened

On 11 August 2016, track maintenance was to be undertaken east of Ballarat Railway Station. To protect the work group, three sets of points within the work area were remotely Blocked to prevent them being operated from the train control system (TCS). However, the points unexpectedly operated when a route was set by the train controller for a train to travel from Wendouree to Ballarat Station. There were no injuries or equipment damage.

What the ATSB found

The ATSB found that the train controller had placed a Block on the three sets of points, but these ‘Blocks’ were ineffective due to design errors within the TCS. Train control for the location had been moved from Ballarat to the Melbourne control centre about three months earlier and the new configuration lacked full points-Blocking functionality.

The ATSB found that the software written to provide the points-Blocking functionality within the TCS did not include coding for points that lay outside the selected route but within its overlap. The Wendouree-to-Ballarat route-setting required three sets of points in the overlap to be in a defined position. The absence of Blocking software for the overlap meant that these points were not Blocked and were able to be remotely moved when the route request was executed by the TCS. It was also found that neither Factory- nor Site-Acceptance testing of the new system considered this scenario. As a result, the deficiency was not identified at this early stage.

The system configuration for the relocated train control was uncommon for the Victorian regional network. It placed reliance on the TCS to perform the points-Blocking function rather than also providing an additional level of defence to the interlocking.

What's been done as a result

V/Line have issued instructions for track workers to isolate points prior to undertaking work on them.

The TCS software designer, UGL Pty Limited, have updated their instructions for software development and testing of unit-lever interlockings, to specifically require overlaps to be included in the Blocking functionality.

Safety message

It is critical that system designers ensure that the functionality and performance requirements needed to meet all operational scenarios are incorporated within the design. It is also important that effective check and test processes are developed to fully validate system functionality.

Ballarat Railway Station, Victoria
Ballarat Railway Station, VictoriaSource: ATSB



Safety analysis


Safety actions


Sources and submissions