Derailment of freight train Y279, Traveston, Queensland, on 23 February 2022

Investigation summary

What happened

On the evening of 22 February 2022, a severe weather system developed over south‑east Queensland and started to affect the Queensland Rail North Coast rail line south of Gympie.

At 2332 on that day, freight train Y279, operated by Aurizon, departed Acacia Ridge in Brisbane for a journey via the North Coast rail line to Stuart Yard, near Townsville. As train Y279 travelled north, the weather system intensified throughout the evening and into the early hours the following day.

On 23 February 2022, at 0232, a signalling system outage between Cooran and Traveston resulted in signal CR25 at Cooran to display a red (stop) indication. Network control informed the driver of Y279 about the outage and told them to stop at Cooran for further instruction. Around the same time, the Queensland Rail environmental monitoring station at Traveston generated a critical flood alarm due to the water level overtopping the rails at the cross‑track drain. Network control personnel were aware of the weather conditions and related signalling system outages and had received reports from rail traffic crew of heavy rainfall and flood water around the track at several locations including Pomona. However, the report of floodwater at Pomona by the driver of Y279 did not occur until after train had passed through the area and arrived at Cooran. Network control personnel were not alerted to the automated critical flood alarm at Traveston, the next location. 

At 0309, network control personnel instructed the driver of Y279 to proceed according to the green indication now displayed on CR25. The driver, aware of the local conditions and the flood‑prone area ahead, continued toward Traveston at reduced speed. At about 0318, while travelling at 33 km/h, the driver noticed an abnormality with the track ahead and placed the automatic brake control handle to the emergency position.

Shortly after, train Y279 derailed, and the lead and trailing locomotives rolled and came to rest on their sides. Three wagons also derailed, with some of the containerised load becoming dislodged from the twist lock mounts. The driver sustained minor injuries during the derailment and rollover.

What the ATSB found

The ATSB found that, when the network control workstation for the Glass House Mountains to Gympie North area was transferred from the Brisbane Operations Centre to the Rail Management Centre, weather-related warning and alarm messages would no longer be directly displayed at the workstation. Instead, the system would broadcast email and text messages to key personnel to promptly alert them of related alarm states on the network. However, this system had not been correctly configured, and entries for key personnel details had been left empty. 

In addition, a procedure required Queensland Rail personnel located at the Fault Coordination Centre to follow up and contact network control if an alarm was not acknowledged in a timely manner. The procedure was ineffective as roles were not clearly defined and personnel at the Fault Coordination Centre were often dealing with many alarms. In this case, the fault shift coordinator on duty became aware of a critical flood alarm at Traveston about 40 minutes after it had activated but believed it should have been addressed by network operations, and it was not within their role to follow‑up on alarms that were the responsibility of network control.

Neither network operations personnel nor rail traffic crew recognised the potential for the weather conditions to affect the safety of the network and rail traffic. In the absence of follow‑up or the broadcast of weather-related alarm messages, network control personnel were not alerted to the floodwaters that had overtopped the track at Traveston. Also, as the track fault had recovered and signal CR25 cleared, network operations personnel were of the understanding that the integrity of the track was safe. Consequently, they authorised the driver of train Y279 to continue toward Traveston according to the indications displayed on the signals. 

The ATSB noted that the Queensland Rail training program did not ensure network operations personnel proactively monitored an adverse weather event or responded to a condition that could present a hazard to train movements. 

The driver knew there was a flood‑prone area ahead. Although they continued at a speed lower than the authorised track speed, they did not see the track washout at a distance sufficient to stop the train. Train Y279 entered the washout and derailed, the locomotives overturned into flood water adjacent to the track. The driver operating train Y279 as a driver‑alone service received minor injuries but was able to respond to the emergency and exit from the overturned locomotive. However, the driver was exposed to several evacuation hazards identified as having the potential to cause harm. The ATSB identified that the emergency exit pathway on the Aurizon 2800 class locomotive did not ensure a prompt escape by rail traffic crew in the event the locomotive overturned. 

It was also determined that the closed‑circuit television footage and rainfall sensor at the Traveston environmental monitoring station were unserviceable at the time of the accident. Queensland Rail did not have an effective means to ensure that network operations personnel were aware of such an unserviceability.

What has been done as a result

Queensland Rail advised that, following the accident, it had implemented comprehensive systemic improvements addressing all the identified deficiencies, including enhanced alarm notification systems, upgraded training programs, improved equipment serviceability protocols, and strengthened operational procedures to manage adverse weather events. Additionally, Queensland Rail advised it had commenced a comprehensive wet weather management second-line assurance activity aligned with the ATSB safety issues. The assurance activity was scheduled for completion by 31 March 2026.

Aurizon also advised it has developed an access and egress compliance strategy to align its locomotive fleet to the Rail Industry Safety and Standards Board Australian Standard AS7522–Access and Egress. Additionally, Aurizon advised it was a development group member for the review of the content of AS7522:2021.

Safety message

This accident highlights the importance of having serviceable environmental monitoring station equipment and for network operations personnel to be promptly and reliably alerted to any hazardous condition detected by the station. Furthermore, training for network control personnel and rail traffic crews must ensure they can effectively identify and consistently assess conditions affecting the network during adverse weather events, especially those impacting the integrity of the rail infrastructure or rollingstock.

It also highlights the importance of equipping locomotive rollingstock with systems to mitigate evacuation hazards that rail traffic crew may encounter following the derailment and rollover of a locomotive. In particular, when operating driver‑only and in remote locations where assistance may not be readily available. 

Summary video

The occurrence

Overview

On 23 February 2022, freight train Y279 was being operated by a single driver on a scheduled service from Acacia Ridge to Stuart Yard in Townsville, Queensland. At about 0318 local time, train Y279 entered a section of track that had been overtopped by floodwater. Both locomotives derailed and rolled onto their sides, several wagons also derailed but remained upright. The driver sustained minor injuries.

Precursor events

On 22 February 2022, a severe weather system developed over south‑east Queensland leading to heavy rainfall and significant floodwater run‑off, especially in the region south of Gympie. The southern part of the Queensland Rail (QR) North Coast Line (Figure 1) was situated in the rain‑affected area. 

At 2332 on the above day freight train Y279, operated by Aurizon, left Acacia Ridge in the Brisbane area to head north along the North Coast Line towards Stuart Yard, in Townsville. Train Y279 was scheduled to follow an earlier train movement, light engine EM99. 

On 23 February 2022, at 0005, as train EM99 travelled between Palmwoods and Woombye, the QR network control officer (NCO) managing the UTC[1] 7 control board at the Rail Management Centre in Brisbane started to receive multiple alarms of track circuit and signal telemetry outages at Woondum, Traveston, and Palmwoods. The outages triggered a signal at Woombye to revert to red (stop) as train EM99 neared.

At 0007, the NCO made an emergency radio call to the driver of EM99 to check if they were affected by the signal that had reverted to red in front of them. The driver advised they did not see the signal change. Additionally, the driver informed the NCO that earlier, while passing through Eudlo, they had observed a significant amount of water running off the Bruce Highway overpass bridge. The driver also noted substantial water was pooled adjacent to the track between Eudlo and Woombye. The NCO acknowledged the report and advised that they would relay the information within the network control centre.

The NCO found the signal at Woombye would not operate for the driver to continue their journey under signal indication. The NCO reported this issue to the train control leader (TCL) and the network shift asset manager, which led to a decision by network control personnel to issue a SW50 form[2] to the driver, permitting their continuation past the red signal. Throughout the rest of the trip to Gympie, the driver of EM99 did not make any further reports related to adverse weather conditions to the NCO. 

Around the time of the signalling system outage at Woombye, train Y279 was passing through the Brisbane area and had not yet reached the southern boundary of the area managed by the UTC 7 control board, which started at Glass House Mountains. The driver of Y279 recalled their trip from Acacia Ridge through the Brisbane area to their arrival at Glass House Mountains was uneventful, with light rain at various points along the way. 

Figure 1: Station locations North Coast Line between Roma Street and Gympie North

Note: The image shows stations and their distance (in track km) from Roma Street Station in Brisbane. Source: Queensland Rail, annotated by the ATSB

Train Y279 movement through the UTC 7 control area

Glass House Mountains to Pomona

At 0124, train Y279 left Glass House Mountains toward Pomona. The driver recalled the rainfall intensity increased as they continued their trip northward. Around the same time, rainfall sensors at the QR environmental monitoring station (EMS), located at Pomona, triggered a warning alarm due to heavy rainfall. The NCO was unaware of the alarm as the UTC 7 workstation did not display alarms or other related weather information from the EMS.

At about 0200, as Y279 approached Eudlo, flood sensors at the Traveston EMS, located further ahead at the 149.280 km point between Cooran and Traveston, triggered a warning alarm as water flowing through a culvert that crossed under the track had risen to around 945 mm below rail height.

At 0208, the signalling system displayed a text message on the UTC 7 workstation, to alert the NCO of a track circuit failure at Cooran. This was followed by receipt of another text message that the signalled block section between Pomona and Cooran had also failed. These failures recovered then reoccurred intermittently for the next 15 minutes with corresponding text messages displayed to the NCO. 

At about 0220, the NCO telephoned the fault shift coordinator (FSC), at the Rail Management Centre to report the recurring signalling‑related events at Cooran. The NCO and FSC discussed the intermittent nature of the signalling events and their potential to delay train Y279. The FSC informed the NCO that maintenance staff were off duty, and a call‑out would be necessary for any attendance before their scheduled shift due to commence at 0600. The NCO opted to monitor the situation for a further 10 to 15 minutes to determine if the signalling would stabilise, negating a call‑out of maintenance staff to investigate.

At 0232, the NCO received a text message of another track circuit failure, this time at Traveston. This was followed by a message that the signalled block section between Cooran and Traveston had failed. Signal CR25 at Cooran, which was displaying a green (proceed) indication reverted to display a red (stop) indication. Around this time, train Y279 was travelling between North Arm and Eumundi and the driver was unaffected by the change to the signal indication ahead. 

At 0236, the Traveston EMS flood sensor triggered a warning alarm, as the water level had risen further to 12 mm below the rail height. About 2 minutes later, the sensor triggered a critical alarm as the water level was recorded to have overtopped the rail by 90 mm. The driver of Y279 recalled the rain was getting heavier, with ‘very heavy’ rain falling at times as they travelled towards Cooroy.

At 0242, as Y279 approached Cooroy, the NCO radioed the driver to inform them a track circuit failure had affected the signalling system between Cooran and Traveston and that an SW50 form may be required for the driver to continue past CR25 at Cooran. The NCO also asked the driver to radio them when they had stopped on the approach to signal CR25.

The driver acknowledged and continued their journey through Cooroy toward Pomona. Around the same time, the Traveston EMS sensor recorded the water level had risen to 193 mm above the rail height, before starting to recede.

At about 0250, the far north controller[3] telephoned the NCO to check on the progress of train Y279. During the conversation, they discussed the rainfall, with the far north controller noting they were aware that 300 mm had fallen at Cooroy. They then asked the NCO about the amount of rainfall at Traveston. The NCO acknowledged an awareness of heavy rain, but they did not know the amount that had fallen at Traveston. The NCO mentioned several track faults at Traveston and indicated that Y279 would need an SW50 to proceed. The far north controller then mentioned they hoped Traveston was not under water, as they could not recall if the location was a low‑lying area. The NCO stated they would inquire with the driver and provide an update on the situation to the far north controller.

Pomona to Cooran

At about 0253, as train Y279 neared Pomona, the driver noted persistent heavy rain and observed water pooled beside the track, nearly reaching the top of the ballast in some areas. The driver recalled they slowed the train and proceeded, noting that the water was lapping the underside of a rail bridge spanning a small creek at the yard entrance. 

The driver proceeded from Pomona toward Cooran. As they neared the Jampot Creek rail bridge, they noted the floodwaters were again pooled against the ballast with water lapping the underside of the rail bridge. After crossing Jampot Creek, the driver continued toward Cooran where they stopped Y279 at signal CR25, as previously requested by the NCO.

At about 0308, the NCO radioed the driver of Y279 to tell them that the track fault at Traveston had recovered, but not to accept the proceed (green) signal indication displayed on CR25. The driver acknowledged the instruction and told the NCO that there was a lot of water around Pomona with the water level in the creek at the southern end of the yard lapping the underside of the bridge and water pooled next to the track was nearly at the top of the ballast. 

The NCO acknowledged the driver’s report and asked them to standby. The NCO later recalled that, at that time, the driver’s report did not raise any concerns with them as the driver did not report that water had overtopped the rail.

The NCO had prepared an SW50 form and obtained approval from the TCL, ready for issue to the driver after their arrival at CR25. As the track fault had recovered and signal CR25 cleared, the NCO and DOC were of the understanding that the integrity of the track was safe. The NCO asked the TCL whether train Y279 should proceed under the SW50 or signal indication. Believing the latter to be the safer option, network control personnel decided not to issue the SW50 form to the driver.

At 0309, the NCO radioed the driver instructing that, once ready, they should proceed according to the signal indications and be vigilant of the signals between Cooran, Traveston and Woondum. The driver acknowledged the instruction and informed the NCO they anticipated there would be floodwaters ahead in the Traveston area. The NCO asked the driver to provide updates throughout the journey. 

Cooran to Traveston

At about 0310, train Y279 passed signal CR25 and proceeded toward Traveston. The driver initially accelerated to a train speed of 27 km/h. The driver then reduced the train speed to 15 km/h upon entering a section of track known for flooding. The driver recalled seeing floodwaters but considered there was not enough to be of concern. 

At about 0315, having passed the area prone to flooding, the driver started to accelerate the train. They recalled it was raining, and visibility was poor, so they opened the side window to get a better view. Soon after, while travelling at 33 km/h the driver noticed an abnormality with the track ahead, which was at around the 149.020 km point (Figure 2).

The derailment of train Y279

At 0318, the driver placed the throttle to idle and the automatic brake control handle to the emergency position. As the locomotive commenced braking, they recalled feeling an initial dip followed by a pitching motion, and ultimately a roll[4] as the locomotive derailed and overturned. The derailment occurred at the 149.067 km mark. The lead locomotive (2811) had travelled approximately 56 m from the point where the driver made the emergency brake application to its final stop. The trailing locomotive (2338) and several wagons also derailed (Figure 2).

During the derailment and overturning, the driver was ejected from their seat, fell across the cab to the assistant driver’s side and landed on their back in approximately 300 mm of water that had entered the cab. The driver sustained a head knock, neck, back and rib soreness and had lost their glasses.

At about 0319, the driver radioed the NCO to report the train had derailed, with the lead locomotive laying on its side in floodwaters. The driver stated they were ‘alright’ but ‘a bit shaken up’ and that there would be a ‘fair sort of a mess at the site’. The NCO acknowledged the driver and asked for the kilometrage location of the derailment to arrange emergency assistance.

In the darkness, the driver could not see anything to identify the kilometre location of the train apart from a 60 km/h speed board located ahead on the trackside near the derailment site. Through discussion between the driver and other network control personnel it was determined the derailment occurred ‘on the straight just before Traveston Station’. The condition of the overhead traction supply was unknown, and network control personnel instructed the driver to stay in the locomotive cab until receipt of further advice.

Figure 2: Derailed rail vehicles from train Y279

The image (taken later on the day of the derailment) shows derailed rail vehicles from train Y279, washout and other damage to the track formation. Source: ATSB

Post‑derailment

The network control personnel activated the emergency response procedures, contacted the emergency services and relevant QR staff. The NCO kept regular radio communication with the driver to monitor their wellbeing and to provide them updates on the status of emergency services, and the isolation of the overhead traction system. Mobile telephone services were unavailable at the site of the derailment and effective communication with the driver was reliant solely on the train radio system.

At about 0407, the driver informed the NCO they had sighted flashing lights of emergency service vehicles. The emergency services were unable to access the derailment site due to the extensive flooding.

At about 0505, the driver informed the NCO the main train radio had failed, and they were now using a handheld radio. They also mentioned that floodwaters in the locomotive cab were rising slowly. At about 0552, network control staff contacted the driver to confirm the overhead supply was isolated allowing them to exit the cab if required.

Earlier, the driver had located a handheld torch and retrieved their glasses, mobile phone and other personal belongings that had scattered through the cab during the rollover. They recalled they had climbed onto the train inspector’s seat[5] to escape standing in the floodwaters. The driver also recalled unlatching the external door of the cab, which swung open allowing them to place their bag outside on the side of the locomotive engine hood.

At 0618, emergency services arrived at the locomotive. The driver recalled climbing out of the cab and sitting on the engine hood. Emergency personnel climbed onto the locomotive and after assessing the driver’s condition helped them climb down the locomotive’s bogie.

Ongoing access difficulties due to the floodwaters delayed the driver’s access to ambulance services and medical assessment until about 0755. 

Context

Train crew information

Roles and experience

Train Y279 was crewed as a driver-alone operation (DAO).[6] The driver had a total of 10 years’ experience in driving locomotives on the Mount Isa and north coast lines. The driver held the required rail safety worker competencies to operate train Y279 on the North Coast Line and had several years’ experience driving the track section between Acacia Ridge and Gympie North. 

The driver stated they had not previously experienced any similar adverse weather condition when driving a locomotive on either the Mount Isa or North Coast Line.

The driver had a current heath assessment and met the fitness for duty criteria according to the national standard of health assessment for rail safety workers. After the accident, the driver underwent drug and alcohol testing and returned a zero result to both.

Recent history

On 22 February 2022, the driver arrived at the Acacia Ridge rail yard to begin their first shift after a 10‑day recreational leave period. In accordance with the Aurizon sign‑in procedure, the driver conducted a self‑test for alcohol and, upon receiving a zero reading, signed on for duty at 2305. 

Train information

General

Aurizon intermodal freight train Y279 consisted of locomotives 2811 in the lead and 2338 trailing, hauling 27 wagons loaded with containerised freight, including dangerous goods. These containers were towards the train’s rear. Train Y279 measured 563.4 m in length[7] with a gross weight of 1,695.7 t. 

2800 class locomotive

The lead locomotive was an Aurizon 2800 class CM30‑8 diesel electric locomotive (built by A. Goninan & Co), measuring 20.4 m long, 2.87 m wide and 3.68 m high. The hood‑type locomotive design featured full‑width cabs at both ends. Access to the locomotive was provided via fixed steps on either side of the frame, and exterior walkways ran along both sides of the locomotive.

Access and egress for the No 1 operator's cab was through a rear‑facing door, which opened into a vestibule. Two external doors provided access and egress to the walkways on both sides next to the engine hood. 

The No 2 end operator's cab was accessed through a rear-facing external door that led directly to the walkway on the ‘B’ side of the engine hood only. The locomotive was designed to be operable in either direction from both operator's cabs (Figure 3). At the time of the derailment, the driver was operating the locomotive from the No 2 end. Figure 3 shows the access and egress pathways for the cabs at either end of the locomotive and the layout of the driving positions (driver, assistant driver and train inspector seats).

Figure 3: Top view of the Goninan CM30‑8 diesel electric locomotive

Source: A. Goninan & Co Ltd 1998, annotated by the ATSB

The locomotive windscreens were made of laminated glass and not fitted with release handles to remove the windscreen in the event of an emergency. Aurizon designated the side windows of the cab as the alternate pathway for emergency egress from the enclosed space.

The locomotive incorporated internal and external lighting systems powered by the main battery included access lights and cab lighting to create a safe working environment for operating staff. The cab lighting comprised of several individually switched circuits for overhead lights, timetable lights, gauge lights and panel lights. Three overhead fluorescent lights were fitted in each cab. The lights were operated either from a cab light switch on the driver’s overhead console or a switch on the assistant driver’s console (Figure 4). An eyeball type light and rocker switch were located over the train inspector’s seat.

Figure 4: Driving cab control layout

Illustrations from 2800 class manual showing layout of equipment controls at the driver and assistant driver positions. Source: A. Goninan & Co Ltd 1998, annotated by the ATSB

Meteorological and environmental information

Forecasts and warnings

In the late evening of 22 February 2022 and the early hours of 23 February 2022, the Bureau of Meteorology (BoM) released several severe weather warnings. The warnings indicated the presence of dangerous storms and severe thunderstorms in the region south of Gympie. The warnings highlighted the potential for intense rainfall to result in flash flooding and identified the increasing levels of rivers and creeks, including Six Mile Creek. The BoM weather warnings, along with other information such as radar images, were available to network operations personnel as part of their workstation standard operating environment.

The radar images for the early hours of 23 February 2022, covering the time trains EM99 and Y279 were under the control of the UTC 7 board, showed areas of persistent rainfall in the area south of Gympie (Figure 5).

Figure 5: Excerpts from Brisbane radar rain rate loop on 23 February 2022

Source: Bureau of Meteorology, annotated by the ATSB

Recorded rainfall and water level data

Traveston

The Traveston weather station (040206), operated by the BoM, was located approximately 570 m north‑west of the derailment site. The weather station recorded rainfall data only. During the 24‑hour period between 0900 on 22 February 2022 to 0900 on 23 February 2022 it recorded a total rainfall of 248.4 mm (Figure 6).

Figure 6: Traveston weather station daily rainfall data

Observations of daily rainfall are normally made at 0900 local clock time and recorded the total for the previous 24 hours. Source: Bureau of Meteorology, annotated by the ATSB

Cooran

The BoM Cooran weather station (040782) was located approximately 2,200 m south‑east of the derailment site. The weather station recorded both rainfall and river height data.

For the 24-hour period between 0900 on 22 February 2022 and 0900 on 23 February 2022, a total rainfall of 326 mm was recorded to have fallen. The river height recording for Six Mile Creek recorded rapidly rising water levels with major flooding recorded on the morning of the 23 February 2022 (Figure 7). The river height data reflected the current level, not the accumulated totals over the previous 24 hours as was the rainfall record.

Figure 7: Cooran weather station river height data

Bureau of Meteorology product code IDQ65390. Source: Bureau of Meteorology

Climate statement

The BoM special climate statement[8] noted that, in late February 2022, a high‑pressure system near New Zealand and a series of low‑pressure systems combined to feed a large volume of tropical air over the coastal regions of eastern Australia. The combination of weather systems led to intense rainfall in areas of south‑eastern Queensland and north‑east New South Wales. The area from north of Brisbane towards Gympie was the first affected, with rainfall starting in the late evening of 22 February 2022 and the early hours of 23 February 2022, as indicated in the daily rainfall totals recorded to 0900 on that day (Figure 8).

Figure 8: Bureau of Meteorology daily rainfall totals map, 23 February 2022

Bureau of Meteorology product code IDCKARADT0. Source: Bureau of Meteorology, annotated by the ATSB

Queensland Rail – rail line information

North Coast Line

The Queensland Rail (QR) North Coast rail system extended between Brisbane in the south and Cairns in the north. The system comprised 2 parts: the north, from Rockhampton to Cairns, and the south, from Roma Street Station to Rockhampton. Traveston Station was in the south. The North Coast rail system carried various containerised and bulk freight products. Long distance and high‑speed passenger train services also operated on the system to service the central and North Queensland areas.

The narrow gauge (1,067 mm) track consisted of a mix of nominal 47/50/53/60 kg/m rail fastened to concrete sleepers by resilient clips laid on a formation of crushed rock ballast. The track length between Roma Street Station and Rockhampton was electrified with a 25 kV 50 Hz alternating current (AC) traction system.

Cooran to Traveston section

The configuration of the track from Cooran toward Traveston included a series of left and right curves of varying radius and was generally of falling grades. Approaching the derailment site in the direction of travel of train Y279, the configuration included a left curve of 239 m radius before transitioning to tangent track. The maximum track speed for freight services was 70 km/h.

Derailment location

The track adjacent to the derailment site had a 900 mm diameter concrete pipe installed beneath the track formation at the 149.020 km mark. To the west of the derailment site, 2 x 2,700 mm concrete box culverts were installed beneath the track formation at the 149.280 km mark. The undertrack drains were installed on 4 January 1998 and 6 December 1951. The flow of rainwater run‑off through these drainage systems was generally from the south toward the Six Mile Creek in the north (Figure 9).

Figure 9: Cross‑track drainage systems installed near the derailment site

Source: Google Earth, annotated by the ATSB

The Traveston area was known to be prone to catchment flooding. Historical flood mapping was developed by the Queensland Government to provide a visual representation tool that identified catchments at risk of flooding. The flood hazard overlay map of the catchment around the derailment site identified a flood event risk equivalent to a 1% annual exceedance probability (AEP)[9] (Figure 10).

Figure 10: Excerpt from Queensland Government flood check map 

Illustration of rainwater catchment and basing level flood modelling for 1% AEP event in the vicinity of the derailment site. Source: Queensland Department of Resources, annotated by the ATSB

The QR route map reflected the historical flood mapping and identified the track kilometrages of a flood hazard area at Traveston. These route maps provided geographical operational information useful to QR personnel, including network control and infrastructure teams, and the operational staff from other rolling stock operators that use the network. Primarily, the route maps were used as a training tool to impart competency‑based route knowledge to train drivers, highlighting important information as the key learning point such as the flood‑prone area (Figure 11). Figure 11 also shows the position of signal CR25 and the environmental monitoring system (EMS) at Traveston. 

The driver of train Y279 was aware of the flood‑prone area.

Figure 11: Route map excerpt showing features between Cooran to Traveston

Image shows sections of driver competency-based route knowledge material highlighting key learning points. Image not drawn to scale; some discrepancy between km identifiers may present. Source: Queensland Rail, modified by the ATSB

Civil engineering track and structures standards

The QR Civil Engineering Track Standard (CETS)[10] and Civil Engineering Structures Standard (CESS)[11] specified the minimum engineering safety standards and good practice guidelines for the maintenance of track structures, which included under‑track drainage systems.

The standards specified that they should not be applied retrospectively and acknowledged that there might be areas of existing infrastructure built before the standards were published. In such cases, the standard was to serve as a guideline for managing that track infrastructure. It was the responsibility of the rail infrastructure manager to identify deviations from the standard and manage them accordingly.

The content of the QR standards was aligned to the Rail Industry Safety and Standards Board (RISSB) Code of Practice Volume 4: Track, Civil and Electrical Infrastructure and associated RISSB standards. Where the requirements of a QR standard were less than the minimum requirements of an RISSB standard, further information explaining the variation was provided. The QR CETS identified that requirements related to flooding and Australian standard AS 7637 Hydrology and Hydraulics were addressed within the CESS.[12]

With respect to under-track drainage systems, the CESS provided guidance for monitoring and maintenance actions but was limited for design and construction. For example, the standard did not specify the QR design criteria for the AEP used in designing track drainage systems. Typically, rail infrastructure managers specified the design of major and minor track drainage systems to accommodate an AEP of 1% or 2%. 

QR undertook localised assessments conforming to a series of checklists associated with the civil engineering in‑house design process, design verification, and a drainage and hydrology assessment, which assessed the culvert’s immunity to an exceedance probability. The hydraulic assessments typically estimated the flood levels and calculated the drainage system’s peak discharge capacity for AEP events between 10% and 1%. QR provided records of hydraulic assessments conducted in 2019 and 2021 for selected culverts near Cooran, however, it was unable to provide historical drainage and hydrology assessments for the culverts located at the 149.020 km or 149.280 km marks.

Track inspection procedures

The QR CETS specified the safety standards and good practice guidelines for the construction and maintenance of track owned by QR. The standard provided for the following types of track inspections:

• scheduled patrol
• scheduled general inspection
• scheduled detailed inspection
• unscheduled patrol
• unscheduled general inspection
• unscheduled detailed inspection.

Scheduled patrols were required to be conducted at a maximum interval of every 96 hours. Such patrols involved examining the track and related infrastructure and were usually conducted by a single infrastructure worker driving an on‑track (hi‑rail) vehicle[13] along the track, at a speed not exceeding 40 km/h. Scheduled general inspections and detailed inspections occurred at a maximum interval of 4 months and 4 years respectively. 

The CETS also stated that unscheduled patrols, unscheduled inspections or operational restrictions were to be applied in response to various events. These included ‘heavy rainfall, inundation, floods, washaways and ingress of ground water’.

The records from the QR Enterprise Asset Management System indicated that a scheduled inspection of the waterways and undertrack drainage systems near the derailment site was carried out on 2 February 2022. No remedial actions were specified following the inspection.

There were no unscheduled track patrols or operational restrictions applied in response to the weather event affecting the North Coast Line on the evening of 22 February 2022, nor to the related reports from drivers of heavy rainfall and floodwaters adjacent to the track, particularly the area south of Traveston. 

Hazard locations register

The CETS also required the rail infrastructure manager to create and maintain a hazard location register. The register was to itemise the hazards and outline the required actions (such as unscheduled patrols or inspections) at locations where defined events could rapidly reduce the ability of the track to function safely. 

The track and civil hazard location register for the North Coast Line, between Caboolture and Theebine[14] included around 244 entries. These were broadly categorised into track, safe working, structures and severe weather. For severe weather, the primary event was heavy rainfall, which could lead to hazards from flooding, washouts, subsidence or embankment slip. Specifically, there were 13 entries that identified risk associated with heavy rainfall (Table 1).

Table 1: Severe weather-related hazard register entries between Cooran and Traveston

The prescribed action for each entry was:

Monitor weather conditions in the region, Corridor and asset inspection to be carried out before next service. Develop and implement a priority-based plan to commence train operations if required.

The manager track and civil and the rail infrastructure manager were assigned as the risk owner and responsible authority for the required action as described in the CESS and MD‑15‑483 Disaster Management – SEQ region plan (refer to section titled Disaster management plan for south‑east Queensland region).

Queensland Rail network control information

Overview

The QR network was segmented into 3 network control regions, each managed from either the Townsville Operations Centre, Brisbane Operations Centre RC1 or the Rail Management Centre (RMC). The RMC was located at Bowen Hills in Brisbane. The RMC contained 10 universal traffic control (UTC) workstations that each managed defined track sections within the region. 

The UTC 7 workstation managed train movements on the North Coast Line, including between Glass House Mountains and Gympie North, utilising the remote‑controlled signalling system and information obtained from remote monitoring system (RMS) equipment that monitored the signalling and civil infrastructure. 

Prior to 2010, the UTC 7 workstation was part of the RC1 control centre. In January 2010, the workstation function was moved from the RC1 to the Mayne Control Centre (the previous Brisbane area Control Centre). Along with this change, it was decided that warning and critical alarm messages from the environmental monitoring station (EMS) equipment installed at selected locations along the track controlled by the UTC 7 workstation would no longer be displayed on the workstation, as was previously the case at RC1. In November 2015, the Mayne control centre and associated workstations were relocated to the RMC.

QR was unable to locate documents detailing the change management processes, risk assessments, or assurance activities carried out in 2010 for the workstation transfer from RC1 to the Mayne Control Centre. Further, there was no record of the decision to stop displaying warning and critical alarm messages from the EMS equipment on the workstation. QR advised that the decision to exclude these display messages was probably due to network operations controllers’ workload and the EMS equipment’s tendency to produce numerous false alarms at that time.

Documentation was available for the change management and risk assessments related to the shift from the Mayne Control Centre to the RMC in November 2015. However, the documentation mainly addressed staff considerations, and maintaining services and contingency plans for the transition. The functionality of individual workstations, including alarms from the RMS and EMS was not addressed.

Rail Management Centre personnel information

Network operations personnel responsible for the daily operation and safety of train movements in the region managed by the RMC included a network control officer (NCO), train control leader (TCL) and the day of operations coordinator (DOC). A network shift asset manager (NSAM) and fault shift coordinator (FSC) supported the operations personnel through the management of the remote‑control signalling, communications, and other systems and infrastructure assets in the region.

The signalling and communication telemetry systems' status within the 3 network control regions were managed by an associated Fault Coordination Centre (FCC). After operational hours, the systems across all regions were overseen by the FSC at the RMC.

Network control officer

The NCO commenced their shift at the RMC at 2200 on 22 February 2022, attended a pre‑brief and then a handover from the previous controller at about 2300. The NCO had about 1.5 years of experience as a train controller and 4 months qualified on the UTC 7 workstation. The NCO had primary responsibility for the management of train operations within their assigned control area. The NCO noted that, although qualified in the UTC 7 workstation, they stated that they were not aware of any identified hazardous areas or the existence of EMS equipment within the UTC 7 controlled area.

Train control leader

The TCL commenced their shift at the RMC at 2100 on 22 February 2022 and attended a handover with the previous TCL. With approximately 3.5 years of experience as an acting TCL, they provided overarching supervision to the NCOs operating the workstations, including the UTC 7 workstation. The TCL stated they were unaware of the existence of EMS within the UTC 7 control area.

Day of operations coordinator 

The DOC commenced their shift at the RMC at 2100 on 22 February 2022, taking over from the previous DOC following a handover. With approximately 30 years of experience as a train controller at RC1 and RMC they were recently assessed as competent for the DOC role and were acting in the position unsupervised for the second time this shift. The DOC was responsible for overseeing all the daily rail operations within the region. They were familiar with the UTC 7 control area and were aware of the RMS and EMS equipment in the UTC 7 control area from their time as a train controller at RC1. 

Network shift asset manager

The NSAM commenced their shift at the RMC at 2000 on 22 February 2022 and attended a handover with the previous NSAM. The NSAM had approximately 11 years of experience in the role. They stated the primary responsibility of their role was managing network incidents related to signalling, track and overhead power infrastructure. The NSAM was aware of the RMS and EMS equipment, however, stated that the EMS was not an application that they routinely accessed, other than to check rail temperatures. 

Fault shift coordinator

The FSC commenced their shift at 1945 on 22 February 2022 and attended a briefing before taking over the workstation. The FSC had around 19 years of experience in the role. They stated the primary responsibility of their role was the regular monitoring of all telecommunication systems to ensure that any continuous or intermittent faults indicated at their workstation were recorded and acted upon as necessary. The FSC was aware of the RMS and EMS.

Weather monitoring systems

General information

QR implemented a variety of management systems and operational procedures/protocols to assist staff to detect and respond to weather events that may affect the network. Available sources of weather information included:

• My GEO (‘My Emergency Management’ and ‘My Emergency Weather’ applications)
• BoM data
• weather briefings and 3‑day forecast summary
• QR EMS
• condition reports from rail traffic crew operating trains or maintenance personnel undertaking track patrols through an affected area.

My GEO weather applications

The My GEO emergency management and weather applications portal was established to assist network control centres with incident and emergency response on the network. The portal was to enhance efficiency by enabling access to multiple sources of data in one location for use in managing incidents and emergencies, including major weather events.

Network control centre personnel accessing My GEO via the intranet had access to various applications including ’My Emergency Management’ and ‘My Emergency Weather’. The applications provided a range of information through multiple layers that could be turned on or off as required. Each application displayed QR infrastructure overlaid with information including BoM warning services such as:

• rain radar
• radar thunderstorm tracking
• radar thunderstorm track direction
• severe weather and thunderstorm warnings
• flood watch and warning.

Although network control centre personnel had access to the My GEO applications, they reported that they did not use them to ascertain the status of the weather event impacting the signalling system on the North Coast Line during the evening of 22 February 2022 and early hours of 23 February 2022. Personnel noted they found the applications slow and difficult to use and interpret.

Interpreting Bureau of Meteorology data

QR instruction MD-11-171, Interpreting weather information, aimed to enhance the ability of personnel at the network control centres to interpret live weather data. This was to manage the rail network safety during significant severe weather events. The instruction was in line with the QR emergency management standard and complemented various region‑specific plans and procedures for handling weather‑related incidents and emergencies. It included login details for a registered BoM website, which provided tailored real‑time data services, forecasts, MetEye[15] and latest observations, on rainfall and river conditions. 

The instruction offered comprehensive guidance to navigate the relevant web pages to display necessary data. The instruction did not include guidance on how to interpret the data to identify potential hazards specific to the rail network arising from heavy rainfall or other adverse weather events.

Weather briefings and 3‑day forecast summary

The weather forecast summary for Monday 21 February 2022 through to Wednesday 23 February 22 inclusive was circulated to various recipients including network operations personnel at the RMC. The summary provided forecasted information on rainfall, thunderstorm activity, flooding, cyclones, heatwaves, fires, and earthquakes.

The rainfall forecast for Wednesday 23 February 2022 indicated an inland trough would persist over the interior, with a slight to medium chance of showers and thunderstorms, increasing to a medium to high chance in the far north and east, and a high to very high chance about the south‑east. The thunderstorm forecast was sourced from the BoM website and was only applicable from midnight on Sunday 20 February 2022 to midnight on Monday 21 February 2022.

The forecast noted that thunderstorms were possible across the interior, southern and northern areas of Queensland on the Monday with a very slight chance of severe thunderstorm activity through the southern interior (Figure 12).

Figure 12: Excerpt from weather forecast summary

Excerpts from weather forecast summary. Left image shows 1 to 10 mm rainfall forecast in the Traveston area. Right image indicates thunderstorms were possible. Source: Queensland Rail, annotated by the ATSB

The information on flooding did not relate to the area around Traveston. The summary included a caution, noting that conditions could change without warning and recipients were advised to continue monitoring the My GEO application and the BoM website.

Bureau of Meteorology weather warnings

The BoM weather warnings were publicly available from the BoM website. In addition, the warnings were forwarded to the Queensland State Disaster Coordination Centre watch desk (SDCC). The SDCC maintained a significant role in both the preparation and response to a disaster and emergency events in Queensland through coordination with emergency services and other government organisations including QR. 

From the weather event commencing on 22 February 2022, the SDCC disseminated several emergency alert messages and weather warnings issued by local government areas and the BoM. The SDCC sent several BoM weather warnings (Table 2) to the QR emergency preparedness email inbox. However, the inbox was monitored by QR personnel during business hours only. The warning messages were not forwarded internally to the RMC network operations personnel. The BoM information was still available to network operations personnel via the My GEO or BoM website.

Table 2: Excerpts from weather warnings forwarded to Queensland Rail by the State Disaster Coordination Centre 

Network control centre staff observations

The standard operating environment at the various network control centre workstations provided access to BoM information. After encountering issues with the signalling system, the NCO said they checked the BoM website and noted rain passing through, shown in blue shading on the radar image, which they considered typical for the area. Both the TCL and DOC stated they had also reviewed the BoM website, and based on the information available at that time, expected approximately 60 mm of rainfall.

The DOC recalled a weather alert from the BoM, issued in the early hours of Wednesday, 23 February 2022, warning of intense rainfall developing along the south‑east coast and other regions, but they were not sure from the alert when the rainfall was predicted to occur. The NSAM was also aware of heavy rain around Nambour, had checked with station staff, and viewed closed‑circuit television (CCTV) footage, but assessed the rainfall to be within normal expectations for that area.

Throughout the evening of 22 February 2022 and into the early hours of the next day, the network control centre staff monitored the BoM radar images at different times. They shared their observations of rainfall during discussions about the signalling system failures. The staff noted that, without radar images showing colours indicative of heavy rainfall (red or darker), the weather event was not typically recognised as a risk to rail traffic.

Apart from the DOC, no other network operations personnel recalled observing BoM weather warnings.

Queensland Rail asset protection systems

QR operated a trackside RMS and EMS with installations situated at selected sites across the rail network. The RMS equipment gathered data from a range of devices, that included weighbridges, hot bearing detectors, dragging equipment detectors, acoustic bearing monitors, level crossings and wheel impact and load detectors. The devices and data were not designated as vital equipment[16] but were important to the safe movement of rail traffic and equipment faults were generally repaired as a priority.

The EMS equipment gathered data from sensors measuring rainfall, floodwater level and temperature. The devices and data were similarly not designated as vital equipment. The information, although not directly associated with the operation of rail traffic, was important to identify conditions affecting the network that could affect the safety of rail traffic. The EMS equipment faults were, however, generally repaired as a lower priority.

All data from the RMS and EMS was collated and transmitted through the RMSv2 telemetry and Integrated Asset Management Protection System (IAMPS)[17] to the graphic interface applications installed as part of the standard operating environment of selected workstations located at the network control centres.

At the RMC, the following arrangements applied to the network operations personnel in relation to their user profile for accessing the EMS application at their workstation:

• The NCO did not have access.
• The TCL did not have access.
• The DOC did not have access.
• The NSAM had access but was unable to acknowledge alarm messages.
• The FSC had access and was able to acknowledge alarm messages.

There were 4 EMS on the North Coast rail system (south) located at: 

• Caboolture (King John Creek)
• Glass House Mountains (Coonoowrin Creek)
• Pomona
• Traveston.

The Traveston weather station was located adjacent to a cross‑track drainage culvert at the 149.280 km point (Figure 13). 

Figure 13: Location of Traveston wayside environmental monitoring station and cross‑track drains

The image taken later on the day of the derailment shows the relative locations of the derailed train Y279, cross‑track drains and the Traveston weather station. Source: ATSB

The Traveston station recorded rainfall, water level (flood) and temperature data. At the time of the accident, no rainfall data was recorded from the station due to a faulty sensor. As there was no formal procedure in place at the RMC for network control personnel to be notified of such an unserviceability (refer to section titled ATSB investigation (RO‑2018‑007)), QR were unable to determine if personnel were made aware the function was faulty, and that no rainfall data was available from that site. 

Following a user logging into the application, the weather information was accessible via selection of the appropriate tabs. The application functionality also included text displays of warning and alarm messages in response to the detection of a range of defined parameters (Table 3).

Table 3: Weather station (EMS) warning and alarm parameters for rainfall and flooding

In addition to displaying the alarm text messages, the RMSv2/IAMPS functionality disseminated warning and critical alarm messages via email and text messaging to the address and mobile telephones of the alert recipients listed in the RMSv2/IAMPS database.  

For each of the North Coast rail system (south) weather monitoring stations, there were no alert recipients defined within the database to receive the automated warning and critical alarm emails and text messages. On the evening of 22 February 2022 and morning of 23 February 2022, for each warning and critical alarm event generated by the EMS at Traveston and Pomona, the system recorded ‘No valid user to redirect alarm to’.

Functionality testing

The functionality of the RMSv2 was tested by QR when installed at the NSAM workstation during the change from the Mayne Control Centre to the RMC. This testing did not identify the omissions in the database that defined the key operational and infrastructure personnel to receive the warning and critical alarm messages alerting of the adverse conditions affecting the network.

Closed-circuit television footage

The Traveston EMS was also equipped with CCTV for assessing the local conditions at the cross‑track drainage point. However, at the time of the derailment of train Y279, the CCTV camera was not fitted with a memory card and was not operational. QR was unable to determine when or why the memory card was removed or whether network control personnel at the RMC were made aware the equipment was faulty and not available for use. As mentioned above, there was no formal procedure for network control personnel to be notified of an equipment unserviceability.

The camera was repaired following the derailment. A review of footage from the operational CCTV found the images obtained during the hours of darkness were blacked out and would provide no discernible detail to a user.

Disaster management plan for south‑east Queensland region

The disaster management plan for the south-east Queensland region[18] outlined the roles and responsibilities within QR in response to a declared disaster and the relationships with key stakeholders such as the SDCC. The plan was primarily targeted toward large scale weather events and contained a series of specific plans to address the events most likely to be experienced across the network, such as severe weather (including heavy torrential rain/strong winds) and flooding (including flash flooding/rising water).

The plans described that, following receipt of advice from the BoM, MyGeo, Emergency Warning Network, Department of Transport and Main Roads,[19] the SDCC or other relevant weather warning systems of an approaching severe storm, heavy torrential rain or high winds, the network control centre was to undertake various preparation/mitigation actions including: 

• consider establishing a watch desk to monitor the approaching weather system
• monitor emergency warnings, threat alerts, media and operational warning systems and advice, for example, the BoM
• monitor creek and river levels and weather conditions in the region
• review flood prediction maps to determine potential impact
• refer to the Train Operations Severe Weather Strategy
• identify potential impacted locations (that is, corridor, stations, depots and locations of vulnerable infrastructure)
• advise rail traffic crews and work crews on the network of the approaching threat
• review train manifest and train diagrams for dangerous goods, hazardous goods, explosives and passenger train services considering the level of risk imposed by the severity of the event
• consider reducing speed limits and/or cancelling traffic where appropriate
• check and monitor functionality and operation of train control systems
• develop plans to manage the risks to train services on or approaching the section/corridor
• discuss potential impacts on train services with stakeholders.

Personnel at the network operations centre were aware of the existence of various warnings and other weather‑related information available on the BoM website. In the absence of a disaster declaration or the provision of information disseminated by the SDDC, network control personnel continued to treat the weather conditions as typical for that area and continued to monitor. A risk event[20] was not identified and the preparation/mitigation actions to respond to the event (such as the initiation of an unscheduled track patrol prior the next train service to inspect the track condition) were not triggered at the network control centre to address the weather‑related hazards between Cooran and Traveston.

Managing wet weather events

Monitoring system alarm response 

Procedure

Alarms from the RMS/EMS equipment were relayed via the RMSv2/IAMPS to the FCC in each region. Procedure MD‑11‑1955 (version 2.0), RMS Alarm Response for Fault Coordination Centres, provided guidance to FSCs on the interpretation and response to the various alarms. 

The procedure indicated that ‘site offline’ alarms, common to all sites, should be acknowledged by the FSC with follow‑up arrangements made during normal working hours. For other alarms the procedure stated:

Only, users who are able to take action and responsibility for the alarms should acknowledge them. The FCC should acknowledge alarms that are obviously system errors or online reports etc. Where Network Control is required to acknowledge the alarms, this is noted in the following text. When in doubt, the FCC should acknowledge the alarm and report the alarm to Network Control if required.

The procedure then outlined the alarms related to level crossings, radio sites, and weather stations, and the required action by the FCC in response. For the weather stations, the alarms included temperature, rainfall and flood. The temperature and rainfall alarms specified the FSC action as:

This alarm is the responsibility of the Network Control Centre, If the alarm is not acknowledged in a timely manner, contact the Network Control Supervisor and advise that an alarm has occurred. Advise that Civil personnel should be contacted to determine the appropriate response to the alarm.

The FSC action in response to a flood alarm was similar but excluded the requirement to inform civil personnel of the flood event. 

With respect to the requirement for the FSC to contact the network control supervisor should an alarm not be acknowledged in a timely manner, QR advised the terminology used in the document was outdated and the appropriate contact was the day of operations controller (DOC).

Training

To support MD-11-1955, overview training on the RMSv2 system was delivered to relevant personnel including the FSC. The training included a responsibilities section detailing ‘who does what’. The section listed the following responsibilities:

• Network control officers (NCO) – action UTC critical alarms
• Train control supervisors (NSAM, DOC) – action RMS/EMS critical alarms.
• Fault Coordination Centre (FSC, signal engineering system support) – action all other alarms and assign faults and maintenance tasks.

The training focused primarily on the RMSv2 hardware, configuration, troubleshooting and available alarms. Alarm information was exclusively focused on alarms from the RMS equipment associated with monitoring the status level crossings. There was no information related to other available RMS alarms or weather-related alarms from the EMS equipment nor was there any reference to the automated email and text messaging feature.

Fault shift coordinator’s understanding of alarm response actions

The FSC on duty at the RMC during the evening of 22 February 2022 and early hours of 23 February 2022, described their role was to monitor and acknowledge alarms resulting from failures in the RMS telecommunication systems, power supplies or sensors. They clarified that acknowledging operational type alarms, which were triggered when conditions exceeded predefined parameters, was not part of their duties and were the responsibility of other system users.

The FSC noted that their workstation screen's alarm field could only display about 30 lines of text, regardless of the number of active alarms. Although the shift on the night of the derailment of Y279 was not particularly busy, they still had to prioritise alarms and fault reports for action as they came in.

They recalled becoming aware of the critical flood alarm at Traveston about 40 minutes after it had been activated. The FSC mentioned that if an alarm in the south‑east Queensland region had not been acknowledged and addressed by the network operations personnel within the preceding 40 minutes, it likely indicated a false indication or that the condition had resolved. Subsequently, they did not follow up the alarm status with network operations personnel.

The critical flood alarm for the Traveston EMS remained active until the relieving FSC acknowledged it following the commencement of their shift at the FCC at about 0800 on the morning of 23 February 2022.

Rail Management Centre storm/severe weather response 

The RMC Storm/Severe Weather Response guidance (MD‑17‑446, version 3.0) was developed for network operations personnel to determine and communicate the response to severe weather events affecting the region. The guidance supported other instructions including part 6 of the QR Network Rules and Procedures (QNRP) (MD‑12‑189) discussed below.

The guidance was directed toward identifying an impending storm/severe weather event that may result in trains (particularly passenger) becoming stranded mid‑section (between platforms). The guidance identified: 

• The Bureau of Meteorology (BOM) will issue a warning via email
• The intensity and direction of the storm / severe weather can then be followed on− ‘Severe Weather Tracker’ on the BOM website for rainfall intensity
• Depending on the intensity of the approaching storm / severe weather event, the RMC may activate the Incident Watch desk
• Distribution of storm warning / information may be provided to internal staff including Rail Traffic Crew (RTC) and Station Staff in the path of/or within the expected affected area(s). CCTV is activated to monitor the station
• Stations predicted to be affected by the event
• Station staff and RTC will monitor the network and report to the RMC (as required) of storms/severe weather approaching their immediate area, its intensity and its present location and anticipated projected path
• RMC may decide to stop trains at station platforms pre-emptively to safeguard trains being stranded mid-section between station platforms….

Conditions affecting the network 

Network Rules and Procedures

The Network Rules and Procedures (QNRP) outlined the safety requirements for all persons who were required to access and perform activities in the network rail corridor managed by QR. The standard was divided into 8 parts addressing the rules and procedures to safely access the track. Part 6 addressed rules and procedures associated with conditions affecting the network. 

The standard defined a condition affecting the network as a situation or condition that affects, or has the potential to affect, the safety of the network. All conditions that affect the network were required to be immediately reported to the appropriate NCO for response.

Where a condition affecting the network was due to flooding or rain, the standard specified:

Rail traffic crew must advise the Network Control Officer of any potential Condition Affecting the Network due to rain or flooding; particularly where the water level is above sleeper level. Rail traffic crew or workers may become aware of flood affected area by:

• unusually heavy rain
• water pooling against the formation or on land adjacent to the railway
• a washout or scouring of ballast or the formation
• poor visibility caused by heavy rain
• high or rising levels in creek waterways
• any other condition that affects or potentially affects the network

If made aware of flood affected track, rail traffic crew must stop the rail traffic and advise Network Control Officer.

Additionally, the standard specified:

Network Control Officer may become aware of flood affected area by:

• reports from the field
• failure of track circuits
• remote monitoring station [EMS] data
• meteorological forecast, observations, warning and alerts.

Network Control Officer must:

• stop the rail traffic
• arrange inspection by Maintenance Representative
• advise the Electric Control Operator the location of any water above sleeper level in electrified areas.

Where a condition affecting the network was due to extreme weather, the standard specified:

The Network Control Officer must be notified of extreme weather conditions that require speed restrictions to be imposed by:

• nominated managers
• Maintenance Representatives
• access user representatives
• advice from the Bureau of Meteorology
• automated devices.

Where notification has been received from other than the Maintenance Representative that necessitates a speed restriction, the Network Control Officer must advise the Maintenance Representative of the notification received.

If the Network Control Officer is not able to contact the Maintenance Representative, rail traffic must be advised to travel at controlled speed until advice is received from the Maintenance Representative.

Issuing advice to Rail Traffic Crew

The Network Control Officer must communicate speed restriction information to affected rail traffic crews and supply the following information 

• the speed restrictions,
• the sections the restriction apply to,
• the hours during which the restrictions apply.

Rail traffic crews will record the instructions on a Written Authority for Rail Traffic form

General operational safety manual 

The General Operational Safety Manual (MD‑10‑107, version 5.2) outlined the instructions and procedures for rail traffic movements and other matters. With regard to adverse conditions affecting the network, it stated:

Where it is required to operate rail traffic in adverse conditions such as:

• heavy rain,
• high wind, or
• reduced visibility… 

and these conditions affect or have the potential to affect the safe operation of rail traffic and people on the network, the rail traffic crew will operate their rail traffic to suit the current conditions and advise Network Control of the conditions

Network Control should consult with rail traffic crew, Track Maintenance Supervisors and any other resources available and determine other factors which may impact on the running of rail traffic.

Where information is available to Network Control that relates to the condition of the network, the Network Control Officer will advise if it is unsafe for rail traffic to travel.

The Network Control Officer will impose such special conditions as may apply when rail traffic travel under adverse conditions and these include but are not limited to:

• continual monitoring
• restricted speed
• increased exchange of information to ensure safety
• updates on changes in weather conditions

Rail Management Centre Control Safety Manual 

The RMC Control Safety Manual (MD‑14‑697, version 8), outlined operational and business processes used at the RMC to comply with the QR safety and environmental management system. With respect to extreme weather events, storms and flooding the instruction required:

When an adverse weather report is received from Rail Traffic Crews or Infrastructure Personnel and the integrity of the network is uncertain:

RMC Control Officer [Network Control Officer] 

After conferring with the NSAM suspend rail traffic on affected section/s 

Resume rail traffic operations on advice of NSAM

• Advise Rail Traffic Crews of any temporary speed restrictions or to report on local conditions
• Monitor adverse weather; and
• Resume normal operations when integrity of network is confirmed.

Network control competency assessment

QR introduced a variety of training programs to manage competencies to ensure network control personnel had the necessary knowledge to safely manage operations on the network. The competencies associated with rail operations and risk management focused on the personnels’ comprehension and implementation of the requirements contained in the applicable standards, procedures, guidance and instructions such as MD‑17‑446, MD‑10‑107 and MD‑12‑189.

An NCO’s understanding was assessed based on initial and ongoing refresher training in specific competencies, including the UTC workstation control areas, network control manuals, safe working systems, and conditions affecting the network.

The assessment titled ‘RMC UTC 7’, evaluated the comprehension of the overall operational requirements for the control area. It included a question on an online wayside detection training package and MD‑14‑36 General Appendix – part 4, focusing on the placement of wayside detection systems [RMS] within the control area and the correct responses to any alarm state. The assessment did not include evaluation of a broader awareness of, and the available information from the weather stations (EMS), which were also situated within the UTC 7 control area.

The assessment titled ‘Conditions affecting the network e‑learning digital storyboard’, evaluated the NCO’s comprehension of standards MD‑10‑107 and MD‑12‑189. Several questions related to the NCO’s action in response to a notification of flooding, rain or extreme weather. The assessment omitted an evaluation of the NCO's understanding that they were to proactively monitor and assess conditions that may affect the network, like flooding, and the protocols within the RMC for responding to adverse weather reports received from rail traffic crews, infrastructure personnel or other sources.

The records of competency showed that the NCO successfully completed a range of competencies including the ‘RMC UTC 7 Board Pack NCO’ and ‘RMC Conditions Affecting Network QNRP NCO’. 

Operations personnel comments on the weather event

Network operations personnel (NCO, TCL, DOC, NSAM and FSC) stated they were aware of the weather event and the repeated telemetry and signalling system outages affecting the passage of trains EM99 and Y279. Network operations personnel each recalled looking at the BoM website at various times during the evening of 22 February 2022 and the early morning of the following day. The NCO, TCL, DOC and NSAM also recalled that none of the environmental conditions observed, or the telemetry and signalling system outages at that time, appeared out of the ordinary for the observed weather conditions in that area. Consequently, the conditions did not raise any significant concern for continued train operations. The NCO, TCL and DOC stated that, although they were monitoring the BoM website and were aware of the information that was available, they had not received training on the interpretation of that information.

The NCO stated the reports from the driver of Y279 of floodwaters adjacent to the track did not raise a concern as they understood there had not been an event where the water had overtopped the track. Additionally, the NCO indicated that reports from train crews are usually subjective as descriptions of local conditions may vary considerably, as one driver may identify conditions were bad, but others identify them as typical. The NCO said, in the absence of an alarm or report of a defined event, they would usually wait for multiple reports from train crews before acting.

Network operational status

The procedures for the management of wet weather operations varied between the RMC, RC1 and Townsville control centres. The regional control centres, RC1 and Townsville, developed a suite of region‑specific hazard registers and control centre procedures, instructions and guidelines for the identification and management of adverse weather conditions. 

The instruction MD-20-53, Regional Network Operational Status, provided users of the regional network greater visibility of unplanned closures or changes to network conditions that were foreseeable, or that may have occurred without warning on the day of operation, such as excessive rainfall/flooding from extreme weather events. The instruction used a traffic light system to identify the network status and operation mode:

• Green – Conditions and forecasts are favourable and changes to network conditions are not expected (business as usual).
• Amber – A heightened level of risk to the network has been identified. Additional steps will be taken to ensure the safety of the network.
• Red – Network closed.

Where an identified event or changed condition resulted in an approval to change the network status, additional risk mitigation actions were to be initiated that involved the asset management team, network control and rail traffic crew. Some of the controls that could be implemented are listed below (Table 4).

Table 4: Mitigation controls

Aurizon procedures and guidance to drivers for managing adverse weather conditions

Critical safety alert

On 5 January 2016, following the December 2015 derailment of an Aurizon train near Julia Creek, Queensland, Aurizon issued a safety alert titled Stop! Don’t drive through water. The alert stipulated important information and actions to be taken when driving in wet weather or areas of localised flooding. The information and actions specified for train crew included:

Rail traffic crew must immediately stop and report to the Network control officer:

• Water on the formation and near the ballast
• Any potential track or formation deficiencies
• If the track formation and/or supporting ballast cannot be seen
• Any signs of washouts or scouring on the side of the ballast or formation
• Water in close proximity or around overhead line equipment

Rail traffic crew were to take appropriate steps to protect the safety of their rail traffic and the track by driving to the conditions. If it is not safe to continue, rail traffic crew are to stop and contact the Network control officer and National operations service centre.

The safety alert included the following diagram to clarify the difference between ballast and formation.

Figure 14: Excerpt from Aurizon safety alert showing the difference between ballast and formation

Source: Aurizon

Operation of rail traffic in adverse weather conditions

On 21 November 2017, Aurizon published an enterprise‑wide safety, health and environment guideline.[21] The purpose was to provide guidance to rail traffic crew when operating rail traffic in severe weather conditions. The guidance noted that train crew may encounter severe weather events such as flooding where sound judgement is required by the crew to keep themselves (and the rail traffic they are operating) safe. 

Rail traffic crews were to comply with the reporting protocols detailed in the guide and the reporting/response requirements for a condition affecting the network as mandated by the respective rail infrastructure manager. The guideline also included information to train crew on the observations, actions to take, and train‑handling techniques to be used when faced with a severe weather event. 

When operating on a main line in wet weather (fog, heavy rain, unexpected storms and situations where visibility is reduced) train crew were to: 

…take appropriate steps to protect their safety, the safety of the rail traffic and the track infrastructure by driving to the conditions. RTC[22] should assess the situation and regulate the speed of the rail traffic in accordance with the conditions, and advise the NCO and LRC[23] of their intended action, i.e. they are proceeding at reduced speed because of low visibility. 

If operation of rail traffic in heavy rain is required, the Rail Infrastructure Manager (RIM) will normally monitor any flood indicator alarms and/or water levels and to take whatever action is necessary to ensure safe rail traffic operations (e.g. speed restrictions, track closures etc.). RTC operating rail traffic on the affected line(s) are to adhere to any instructions received and take whatever other action is necessary to ensure their own safety and the safety of the rail traffic they are operating. 

Occasionally, RTC will encounter storms, flash flooding or similar events where advice is not received from the RIM. In these situations, RTC are to observe any water adjacent to the rail infrastructure. Where the water level is such that the sleepers and the supporting ballast is not visible, or there is signs of washouts or scouring on the side of the ballast and/or in the formation (Refer Figure 1,2,&3)[24] the RTC is required to stop the rail traffic and advise the NCO and LRC.

The guidance further stated that, if unsafe conditions were present and the driver decided to stop, they were then not to proceed until the track was inspected by infrastructure maintenance staff and determined suitable for the safe operation of rail traffic, subject to any operational limitations deemed necessary by the infrastructure staff.

Incident safety share

On 7 March 2018, Aurizon issued an ‘incident safety share’ document concerning an incident where a train collided with floodwaters that had overtopped the track at Banyan Creek, Queensland.[25] The document stated that the driver was operating the train under an SW50 form, which required them to travel at a controlled speed due to adverse weather conditions affecting the network. The driver was to inform the NCO if floodwaters were observed rising to track level. 

While reporting the rising floodwater to the NCO, the driver noticed the track ahead at Banyan Creek bridge was submerged. The driver made an emergency brake application, however, the train entered the floodwater, resulting in the locomotive and 3 wagons becoming submerged in about 1 m of water. The safety share emphasised the information and actions to be taken when operating in wet weather or in areas of localised flooding, as published in the critical safety alert from January 2016.

Emergency response guide – Emergency and abnormal situation response for rail traffic crew

On 9 March 2021, Aurizon published an emergency response guide[26] as a basic reference for new train crew in response to abnormal and emergency situations. The guide described an abnormal situation as any deviation from standard operations within the operational area that required monitoring and appropriate action to prevent a more serious incident. 

The list included various abnormal conditions and included severe wet weather events. The guide mandated immediate reporting of each incident to the appointed contact person, depending on the operational area. For instance, a weather event on the North Coast Line would be reported to a QR NCO.

The guidance also provided details on the use of emergency brake application in response to an emergency and urged drivers to consider the procedures for operating rail traffic during adverse weather conditions. Drivers were cautioned against using emergency brakes as it could potentially cause already unstable tracks to shift under the rail traffic, thereby increasing the risk of derailment. Additionally, the guidance specified:

Where Rail Traffic Crew determine an Emergency Brake application is necessary, then the safest option should always be applied.

The requirements to apply an Emergency Brake application, do not diminish Rail Traffic Crews discretion in the method of braking to be applied when operating Rail Traffic in adverse weather conditions.

The guidance included a safety advice notice initially published on 3 April 2018, titled Staying safe on track in adverse weather conditions. This notice cited the guide for the operation of rail traffic in adverse weather conditions, outlining the actions and rail traffic‑management techniques that train crew should employ during severe weather events. It used the incident of the train collision with floodwaters at Banyan Creek as contextual information. Similar to the critical safety alerts and safety share notices, it also contained vital information or actions required based on the safe working method (Direct Traffic Control or Remote‑Controlled Signalling) relevant to the operational area. In Remote‑Controlled Signalling territories (as used between Glass House Mountains and Gympie North), all operating train crews were to follow this guidance:

• if you are operating a rail traffic vehicle and believe at any time that conditions are becoming unsafe - Stop Take Time and Switch On.
• Ask the Network Controller if they can confirm that the track in the section you are travelling into is open and clear of obstructions.
• Again, ask the Network Controller if all infrastructure alarms are functioning and reporting that the track is clear. If the Network Controller is not able to confirm that the track is clear and safe to travel on, stop your vehicle and report the situation to your live run co-ordinator or appropriate leader.
• RTC to read the Guide and familiarise themselves with the observations required, actions to take and rail traffic management techniques to use should they encounter severe weather events during operations.
• If it’s flooded forget it.
• All injuries can be prevented

Emergency situations were defined as any event that had the potential to cause injury or serious damage including a:

• derailment
• signal passed at danger
• fire on a train
• medical emergency
• collision.

Emergency situations on a rail network were to be reported immediately to the NCO. The guide detailed further contacts dependent on the type of situation and location.

Response to emergency situations required rail traffic crew to follow this guidance:

Reporting an any situation you need to ensure that you clearly communicate the following:

• Train Number ID
• Location or Kilometre point
• Situation, initially short and clear
• Any assistance required
• Extra information - could be station name, nearest road or landmark for access and any information to warn or assist next train or emergency services if required.

In any emergency the RTC’s primary responsibility is to protect their own safety and that of any other person followed by safety of the rail traffic they are responsible for

The guide noted that in emergency situations such as a fire on the locomotive or locomotive rollover, access and egress may not be possible by the normal pathways and that:

Alternative exits vary between Locomotive classes and some may be fitted with glass hammers for side windows or release handles for front windscreen removal. In some classes the windscreen is not an alternate exit due to it being laminated with no release handles.

The following diagram (Figure 15) was included to illustrate where the windscreen was not designed as an alternative exit.

Figure 15: Excerpt from Aurizon guideline showing windscreen damage from repeated strikes from the window hammer

Source: Aurizon

Driver training

Rail traffic crews had the potential to be exposed to various hazards during the normal operation of locomotives. Additionally, crews had the potential to be exposed to hazards arising from abnormal or emergency situations. To manage risk, Aurizon provided training to rail traffic crews in the operation of rolling stock (including various locomotive types), safe working systems, route knowledge, response to emergency and abnormal situations as well as other instructions and procedures.

The driver noted that every emergency was different and that travelling as driver-alone in remote areas increased the reliance on communications systems for reassurance of timely response, and that ongoing safety arrangements were actioned in the event of an emergency. The driver, however, could not recall if any specific training was provided in managing emergency situations following a loss of communications. The driver recalled that they had an awareness of the glass hammer but had not received any specific instructions on its use or how to remove the window glass or how to egress the locomotive cab in an emergency.

Accident site information

Following the derailment, the lead and trailing locomotives (2811 and 2388 respectively) rolled and came to rest on their sides to the south of the track formation. Three BEZY wagons (47727, 47707 and 47736) also derailed with some of the containerised load becoming dislodged from the twist lock mounts (Figure 16). Figure 2 also highlights the extensive scouring of the track formation and ballast from the floodwaters overtopping the rail head.

Figure 16: Train Y279 derailment site

Derailment site viewed in an easterly direction. Source: ATSB

Survival aspects

Driver’s egress

The driver, after being ejected from their seat, was standing in darkness on the wall/window on the opposite side of the cab, with floodwaters inundating the cab. The diesel engine had shut down and electrical power was supplied from the locomotive main battery bank only.

The train borne radio equipment remained operational, and the driver maintained emergency communications with network control personnel. When the battery failed, the main train radio was no longer usable. The driver then maintained emergency communication with network control via the handheld 2-way radio, which they had earlier retrieved from within the disarranged cab.

The escape paths available to the driver on the no 2 end of the locomotive were via the rear‑facing external door that provided the only ready access point between the driver cab and external ‘B’ walkway or via the driver side sliding window. Both exits were situated on the upper side of the overturned locomotive cab (Figure 17).

After self-assessing the extent of their injuries, the driver was able to climb on the train inspector’s seat to reach the external door, which they were able to easily open, as the door was hinged to open outward from the cab and toward the engine hood. The door did not need to be latched or propped in the open position. Additionally, the driver side window was in the open position as the driver had opened it just before the derailment. The open window, although at height, provided an alternative escape path from the overturned locomotive cab. The 2800 class locomotive was not fitted with any purpose‑built footholds or climbing arrangements to assist rail traffic crew egress via the alternative pathway or to assist with descending the outside of the locomotive.

Figure 17: Derailed lead locomotive 2811 no 2 end cab

Source: ATSB

The cab was equipped with 2 window‑breaking hammers to facilitate emergency egress should the side windows not slide open, or the opening space was insufficient to provide ready egress. Hammers were fitted to the overhead console above the driver and assistant driver positions. Each hammer was attached by a short tether to the mount (Figure 18).

Figure 18: Window‑breaking hammer installation in locomotive 2811 no 2 end cab

Images obtained following the recovery of locomotive 2811. Detached hammer on driver side occurred post‑recovery. Source: Aurizon, annotated by the ATSB

Locomotive emergency egress standards

Overview

Rolling stock operators, as the risk owner, were to provide for the effective management of safety risks associated with their railway operations through the implementation of a safety management system. The system encompassed the identification of hazards and the assessment of risk, and the implementation of risk control measures to address those risks. Control measures included the application of standards, codes of practice, guidelines and rules that were either developed individually to address the organisations’ unique operations or operational requirements, adopted from RISSB products, or a combination of both.

RISSB was the accredited standards development organisation for the rail industry in Australia. RISSB collaborated with its rail industry members to promote best practices by the provision of a catalogue of publications including standards, codes of practice, guidelines and rules. 

To develop publications, RISSB relied on input from the rail industry to ensure the products best reflected the needs of stakeholders. RISSB sought nominations from rail industry subject matter experts to form development groups, tasked to deliver the products. Standards were developed following an 8‑step process, and in compliance with the requirements of Standards Australia SG‑003: Standards and Other Publications.

RISSB also published a hazard register that was available to member organisations for reference when undertaking their organisation’s risk assessment process. RISSB noted that it did not own the hazards/risks and therefore could not mandate associated controls or actions, as the responsibility was with the relevant organisation using the product.

The RISSB hazard register broadly grouped content under rolling stock, infrastructure and operational related hazards. Further subgrouping defined the source, precursors and related factors. An identified source associated with rolling stock was ‘evacuation hazards’. Several precursors were listed against this source including derailment, track failure, track obstructions or environmental impact. There were 44 related factors (hazardous events/publishable consequences) associated with evacuation hazards including:

• evacuation capacity of exit(s) being inadequate
• no instructions being provided, so persons do not know how to evacuate
• exits being out of reach (for example, overturned vehicle) preventing safe exit
• no exit being available
• being unable to operate exits.

Each of these factors was linked to an evacuation not being successfully initiated or unable to successfully evacuate. Although not listed as an evacuation hazard, RISSB also identified falling from height as a hazard. 

Australian industry standards

Railway rolling stock access and egress 

The purpose of the rolling stock Access and egress (AS 7522:2021) standard was to describe the:

…requirements for access and egress of workers and passengers on locomotives, freight, passenger, and infrastructure maintenance (track machines) rolling stock.

The main purpose of the requirements is to provide safe, efficient, equitable and dignified access and egress, and to minimize risks to passengers and workers associated with access and egress, emergency evacuations, and requirements for people with disabilities.

The scope was expanded from the previous version (AS 7522:2012), to make the standard applicable to existing rolling stock as well as modified and new locomotives, freight, passenger, and infrastructure maintenance rolling stock. Compliance with the standard referenced the 4 types of provisions (requirements, recommendations, permissions and constraints) typically contained within the Australian Standards developed by RISSB.

The adoption of all requirements (identified by the term ‘shall’) was mandatory for claiming full compliance with the standard. Recommendations (identified by the term ‘should’) was a preferred option but did not exclude other possibilities. The standard also stated:

For compliance purposes, where a recommended control is not applied as written in the standard it could be incumbent on the adopter of the standard to demonstrate their actual method of controlling the risk as part of their WHS or Rail Safety National Law obligations. Similarly, it could also be incumbent on an adopter of the standard to demonstrate their method of controlling the risk to contracting entities, or interfacing organisations where the risk may be shared.

RISSB Standards address known hazards within the railway industry. Hazards, and clauses within this Standard that address those hazards, are listed in Appendix B.

The hazardous events/publishable consequences controlled by the standard (listed in Appendix B of the standard) were related to train fire and slips, trips or falls. None of the listed hazardous events related to the evacuation hazards from locomotives or passenger rolling stock.

The section titled Emergency evacuation contained requirements and recommendations relevant to locomotive, freight, passenger and infrastructure maintenance rolling stock. For locomotives, several requirements were stated including:

Enclosed cabs of rolling stock shall be fitted with sufficient emergency exits to provide escape paths to the vehicle exterior when the vehicle is upright and when overturned on the side.

In the previous version (2012), when discussing egress from new and modified rolling stock, the standard stated that:

A suitable solution is for emergency exit windows on each side and another emergency exit either in the front or rear of the compartment.

This reference was removed from the 2021 version of the standard.

For passenger rolling stock, the section titled Emergency exits recommended emergency exit windows should have a built-in lever, handle or other similar device allowing the window to be removed without the need for tools. Commentary identified a breakout type exit using a hammer was satisfactory due to the hammer being an integral part of the window. The section also included a requirement that:

Emergency exit performance shall be verified in a type test.

There was no requirement in the standard to verify the performance of the emergency exit from a locomotive cab. 

RISSB identified evacuation hazards applicable to train crew egressing from an overturned locomotive in an emergency. Aurizon could not provide a risk assessment or other documentation that evaluated the effectiveness of the emergency exit arrangements provided in the 2800 class locomotive in foreseeable circumstances such as a rollover. 

Lighting and visibility 

The purpose of the Lighting and Visibility (AS 7531:2015) standard was to describe the requirements for lighting and rolling stock visibility. The scope was applicable to new and existing locomotive, freight, passenger and infrastructure maintenance rolling stock. The adoption of requirements and recommendations was the same as other RISSB rolling stock standards if claiming compliance.

The standard defined the requirements for normal and emergency interior lighting. For emergency interior lighting, the standard stated:

Spaces (cabins, rooms, vestibules, aisles etc.) on locomotives, passenger rolling stock, and infrastructure maintenance rolling stock where people may be enclosed in during operation, shall have emergency lighting.

Emergency lighting was defined as:

Lighting, powered from a separate source (e.g. battery) to the vehicle's main power source, providing illumination for evacuation purposes.

Several additional emergency lighting requirements were specified, however, they were only applicable to new and modified locomotives, and not existing locomotives.

The hazardous events/publishable consequences (listed in Appendix A of the standard) controlled by the standard were related to poor visibility of train and work health and safety hazards due to inadequate illumination. One of the listed hazardous events related to an evacuation hazard arising from an inability to locate exits and being unable to reach an exit safely or unable to successfully evacuate.

After the accident, on 21 December 2023, RISSB published AS 7531:2023, Rolling stock lighting and visibility, superseding AS 7531:2015. The objective was similar to the previous version. Notably, the scope was amended to be applicable to new and modified self‑propelled locomotive, freight, passenger, road rail vehicles and infrastructure maintenance rolling stock. Reference to ‘existing’ rolling stock was deleted. Like the previous version of the standard, hazardous events controlled by the standard were listed (Appendix A of the standard). However, none of the listed events related to hazardous events associated with an emergency evacuation.

Aurizon rolling stock standards

General

Aurizon developed a catalogue of rolling stock standards to address the organisation’s unique operations and risk management programs. The standards detailed the requirements to attain the desired performance and to manage hazards that might arise during operation of the rolling stock. The standards referenced related documents including the Australian industry standards published by RISSB.

The requirements to manage hazards that rail traffic crew may be exposed to when egressing a locomotive in an emergency were contained in several Aurizon standards including:

• 07-STD-003-RSK Emergency equipment carried in rolling stock
• 07-STD-004-RSK Rolling stock interior environment
• 07-STD-007-RSK Rolling stock cab layout
• 07-STD-009-RSK Rolling stock structural requirements
• 07-STD-013-RSK Rolling stock fire performance. 

Emergency equipment carried in rolling stock 07‑STD‑003‑RSK

Aurizon standard 07-STD-003-RSK, published with an effective date of 3 October 2017, defined the key requirements for the emergency equipment that must be carried to manage risk in the event of an accident, obstruction or mechanical failure involving rolling stock. The equipment was to facilitate the provision of protection for the train when stopped on the track, first aid, fire suppression and evacuation. 

The standard included a list of required safety equipment and included flags, audible track warning devices, signal lamp, hand torch, wheel chocks and clips, and specifications of the equipment. For example, the hand torch was specified as an electric waterproof torch capable to maintaining one candela of white light continuously for 5 hours.

For an evacuation, the requirements specified:

On existing rolling stock, a window breaking hammer shall be accessible for every worker occupied glassed area that does not have emergency access to the outside of the vehicle as per AS 7522, Railway Rolling Stock, Access and Egress.

At the time of publication of the Aurizon standard, AS 7522:2012 Railway Rolling Stock Access and Egress – Part 1 Locomotive Rolling Stock, was current. This standard was superseded, and the 2021 version was current at the time of the derailment of train Y279.The construction of the 2800 class locomotives occurred prior to the publication of both 07‑STD‑003‑RSK and AS 7522:2021.

The lead locomotive of train Y279 (2811) was fitted with window‑breaking hammers for the train crew to access the outside of the vehicle in an emergency. 

Rolling stock interior environment 07‑STD‑004‑RSK

Aurizon standard 07-STD-004-RSK defined the interior environment requirements for locomotives related to noise, vibration, air quality and non‑ionising radiation, and magnetic fields. Under the heading ‘air quality’, the standard identified:

Interior lighting systems shall comply with applicable parts and sections of AS 7531 Railway Rolling Stock - Lighting and Rolling Stock Visibility.

Standard 07-STD-004-RSK was published with an effective date of 3 October 2017. At the time of publication, AS 7531:2015 Lighting and Visibility, was current.

The construction of the 2800 class locomotives occurred prior to the publication of 07‑STD‑004‑RSK and AS 7531:2015. Spaces within Aurizon locomotive 2811 were not fitted with emergency lighting or a back‑up power supply in the event of a main battery failure.

Rolling stock cab layout 07‑STD‑007‑RSK

Aurizon standard 07-STD-007-RSK defined the cab layout requirements to ensure that crew were able to safely control a train and the minimisation of risk of injury during a collision or derailment. To minimise risk of injury, surfaces or objects likely to be impacted by cab occupants were to be:

• free of sharp corners, edges or projections
• non rigid and capable of absorbing energy due to bodily impact
• made from materials that avoid production of sharp edges, projections or other features that could cause injury.

Additionally, cab furniture, equipment and fixtures were to be secured and loose items such as equipment boxes and driving crews’ luggage, stowed when not in use to prevent them becoming a hazard under collision or derailment conditions.

The standard did not consider the minimisation of risk of injury subsequent to a collision or derailment that might arise from train crews’ exposure to evacuation hazards.

Rolling stock structural requirements 07‑STD‑009‑RSK

Key requirements of standard 07‑STD‑009‑RSK were for the structure and attachments of rolling stock to withstand normal train forces and the minimisation of risk of injury during a collision and derailment. In a derailment, the locomotive was, as far as practicable, to remain coupled, upright and resist jack‑knifing. In the event of a rollover onto its side, the cab structure design was to maximise protection to the train crew by:

…..supporting the weight of the locomotive (including the bogies) in the situation when the locomotive is resting on its side without exceeding the critical design stress in the main supporting members, assuming the locomotive is supported on the edge of the underframe and at the cantrail of the cab.

Rolling stock fire performance 07‑STD‑013‑RSK

Aurizon standard 07-STD-013-RSK, published with an effective date of 3 October 2016, described that fire safety performance of rolling stock was not solely determined by the fire resistance of materials used but included vehicle design, occupant response, ease of evacuation, and detection and suppression. The standard applied to existing rolling stock that was proposed to be operated under changed conditions, that was to be modified, and any new rolling stock introduced into operation. A key goal of the standard was to assist staff and emergency service operations in response to a fire.

The vehicle design methods considered fire prevention, suppression/retardation and the protection of people. For the protection of people, the standard detailed 25 requirements including:

• Exit design to have adequate capacity to evacuate all persons onboard within a suitable time….
• Adequate normal and emergency lighting levels be provided - refer AS 7531.1 Railway Rolling Stock - Lighting and Rolling Stock Visibility – Locomotive Rolling Stock and AS 2293.3, Emergency Escape Lighting and Exit Signs for Buildings - Emergency Escape Luminaries and Exit Signs
• Emergency lighting to be provided along exit paths and at all emergency exits.
• Back-up power supplies to have adequate capacity to provide required power output for suitable period of time.
• Assist staff and emergency service operations
• Provide emergency exits accessible from outside the vehicle for use by emergency service personnel to gain entry to the vehicle
• Communication systems to have back-up power supply.

Existing locomotives that complied with recognised national and international rolling stock fire standards (such as AS 5062, Fire Protection for Mobile and Transportable Equipment) were deemed to comply with the standard, subject to certain qualifications contained in the appendix. The qualification related to the provision of emergency lighting stated:

Emergency lighting to comply with the requirements of 07‑STD‑004‑RSK, Rolling Stock Interior Environment, instead of the prescribed requirements

There were no qualifications related to emergency exits or backup power supplies for emergency lighting or communication systems. 

Standard 07-STD-013-RSK included a reference to the superseded Australian standard AS 7531.1. The content of AS 7531.1 had been consolidated into standard AS 7531:2015 Lighting and Visibility, which was the current standard at that time.

Similar occurrences

The ATSB has investigated several occurrences, and despite the uniqueness of each case, involving various rail infrastructure managers and rolling stock operators, common safety issues were identified. These pertained to the management of adverse weather conditions and the associated hazards to rail traffic crews, from the derailment and rollover of locomotives.

ATSB investigation (RO‑2015‑028)

On 27 December 2015, Aurizon train 9T92 derailed on the Mount Isa rail line near Julia Creek, Queensland, after entering a section of track where floodwaters had overtopped the track and scoured the ballast and formation.[27] The Mount Isa railway was managed by QR. The investigation identified several findings including:

• The QR General Operational Safety Manual (MD‑10‑107) contained insufficient guidance to rail traffic crews to ensure the timely identification and management of a potential hazard from a weather event that might affect the safe progress of the train.
• The QR network rules, procedures and safety manual provided insufficient guidance to network operations personnel to identify the magnitude of the potential hazard from a weather event or define a response to the adverse conditions.

QR advised of several proactive safety actions including the issue of safety alerts to rail traffic crews, (including third party operators, such as Aurizon) if water was observed at or above the bottom of the ballast and the correct reporting of information relating to weather to network control. The second alert provided additional guidance for network control on decision‑making relating to extreme weather. Additionally, QR was looking at methods of upskilling knowledge for relevant personnel relating to the use and interpretation of meteorological information. 

Further, QR also indicated that several actions were undertaken to verify the effectiveness of its systems and processes, and where practicable, to reduce the likelihood of recurrence. These actions included:

A review of the management of extreme weather events to assess the effectiveness of Queensland Rail’s preparation for and response to extreme weather events including flooding and extreme heat. The review examined control of train movements, communication between Queensland Rail and third-party operators, training of key personnel in preparation for extreme weather events and the actions of key personnel during six selected events between 2015 and 2016 across regional and metropolitan areas. For the majority of events reviewed, there was clear and concise communication between all interfaces which contributed to early identification of events and potential issues, as well as ensuring that remedial actions were taken in a timely manner

The investigation also identified that the Aurizon emergency egress arrangements for rail crew from the 2800 class locomotive were not effective in all foreseeable circumstances. In response, Aurizon advised that it continued to reassess the emergency evacuation procedures, locomotive windscreens and secondary communication options/opportunities.

ATSB investigation (RO‑2018‑007)

On 7 March 2018, Aurizon freight train 6792 entered floodwaters that had overtopped the Little Banyan Creek rail bridge.[28] A condition affecting the network (CAN) was declared due to wet weather requiring the train crew to operate at a controlled speed for a significant part of the journey. The train rounded a curve prior to the Little Banyan Creek rail bridge at a speed significantly more than the controlled speed, and the train entered the floodwater. The crew were not injured, but there was some damage to the rolling stock caused by immersion in water. The investigation identified several findings including:

• The network control officer and regional transit manager on duty in the period leading up to the occurrence were not aware that the Little Banyan Creek water level sensor was out of service. Consequently, they expected to be alerted to any problem by a flood alarm, and did not actively search for additional information about the water level at the bridge prior to train 6792 arriving.
• QR did not have an effective means of ensuring that, during situations such as a CAN, network control personnel were aware of the relevant weather monitoring systems that were unserviceable. QR advised of proactive safety actions including:
• The provision of overview screens to provide an overview of weather information negating the need to search through multiple screens and menus on smaller screens at individual workstations to check different systems and alarms.
• Implementation of a formal procedure in their regional control centres (RC1 and Townsville) to manage EMS alarms by the Fault Coordination Centre, with the control centre to be notified. Repair of EMS faults classified at attendance (high priority) with response occurring as soon as practically possible or the control centre notified if the fault cannot be repaired.
• The NCO must proactively monitor resources, for example, BoM sites, cameras, RMS, EMS, rail traffic crews or any other means available for the safe management of the network.

QR did not have procedures that required network control personnel to actively search for information about track conditions ahead of a train during situations such as a CAN, when conditions had the realistic potential to have deteriorated since the last patrol or train had run over the relevant sections. QR advised of proactive safety actions including:

• Conducting a risk assessment of safe working rules and procedures to ensure they adequately manage the risk of a CAN.
• Review of the MD-18-20 Condition affecting the Network Management Procedure, ensuring that the documentation was clear in relation to the expectations on NCOs to proactively monitor the network.
• To address the concerns with NCOs actively searching for information about track conditions ahead of a train, a training package was developed and delivered to regional transit managers and NCOs for CAN events and the use of weather monitoring systems for proactive train monitoring. Additionally, as a part of their training packages, including their maintenance of competency training, NCOs are now required to complete a scenario that requires them to manage a CAN event.
• Introduced MD-20-53 Instruction – Regional Network Operational Status, which further supports the management of a CAN.

Safety analysis

Introduction

On 23 February 2022, at about 0318 local time, freight train Y279, operated by a single driver, entered a section of track that had been overtopped by floodwater. Both locomotives derailed and rolled onto their sides into floodwater, several wagons also derailed but remained upright. The driver sustained minor injuries.

This analysis will discuss the weather event and factors that limited the effectiveness of arrangements at the Rail Management Centre to alert network control personnel to a condition affecting the safety of the network prior to authorising a train to proceed. It will then discuss other factors identified during the investigation that increased safety risk to the rail traffic crew following the derailment and rollover of a locomotive.

Adverse conditions affecting the network

In the late evening of 22 February 2022, and into the early hours of the next day, a significant weather event affected the southern part of the Queensland Rail (QR) North Coast Line in south‑east Queensland. The accompanying heavy to intense rainfall caused rainwater run‑off and the rapid rise in water levels, including at Six Mile Creek. Flooding also occurred in the low‑lying areas of the track between Cooran and Traveston. The volume of floodwater at Traveston, as recorded by the environmental monitoring station (EMS), exceeded the designed discharge capacity of the cross‑track drainage systems at the 149.020 and 149.280 km marks and pooled against the track formation. The water level rose rapidly, overtopped the rails, eroding the track formation and ballast. This undermined the rails and sleepers to the extent the structural integrity of the track was compromised.

As the driver approached the affected area of track, heavy rainfall hitting the locomotive windscreen and other ambient conditions likely impeded their clear vision of the track area ahead. Despite travelling at a speed (33 km/h) lower than the maximum permitted track speed limit (60 km/h) for the area, the driver did not see the affected track at a distance that was sufficient for them to stop the train before it entered the washout. The track was unable to support the weight of the rolling stock as it passed over the affected area and the resultant deformation of the track initiated the derailment of train Y279.

Proceed authorisation

Network control personnel at the Rail Management Centre (RMC) were aware of the adverse weather conditions and associated signalling system outages that had affected the control area including track circuit failures at Traveston that resulted in signal CR25 at Cooran displaying a stop (red) indication. The driver of train Y279 was also aware of the adverse weather and had reported observations of the conditions to network control. 

Both QR and Aurizon had implemented rules, procedures and guidelines to manage the risk to rail operations that may arise from an adverse weather event. The QR network rules and procedures (MD‑12‑189) specifically addressed the operation of rail traffic in flood areas. The rule specified conditions that would alert either rail traffic crew or the network control officer (NCO) to the existence of a flooded area. When either party became aware of a flood‑affected area, the rule required rail traffic to be stopped. 

The network control personnel on duty did not associate any of the weather conditions or temporary signalling fault with the potential for flooding of the track. In the absence of information (including alarms) from the environmental monitoring station, they were unaware of the high rainfall or that floodwaters had overtopped the track in the section ahead of signal CR25.

On the belief that the clearance of signal CR25 to a proceed (green) indication confirmed the integrity of the track formation, and that it was generally safer for the train to proceed under signal indication than a written proceed authority (SW50), they instructed the driver of Y279 to accept the signal indication and proceed toward Traveston. The instruction to the driver to proceed in accordance with the signal indications meant the driver was authorised to travel up to the maximum speed permitted for that track section.

The signalling system provided a range of functions that included detection of rail vehicles, setting and proving of routes and the display of signal indications to rail traffic crew. Assurance of the integrity of the ballast or track formation supporting the rails was not a function of the signalling system. 

The Aurizon procedures, critical safety alerts and safety shares each provided rail traffic crew with guidance on weather events that were hazardous to rail traffic. Generally, rail traffic crew were to take appropriate steps to protect the safety of the train and themselves, and if they believed conditions were unsafe to continue, they were to stop and report to the NCO. 

If the water level meant the sleepers and the supporting ballast were not visible, or there were signs of washout or scouring of the ballast or formation, the decision to stop was easily justified by the rail traffic crew. Other conditions described in the guidance were less quantified such as ‘water on the formation and near the ballast’, ‘water in close proximity or around overhead line equipment’ or ‘potential track for formation deficiencies’. In those cases, the driver may be less likely to stop the train and report. Other than encountering overtopped or scoured track formation, rail traffic crews were to apply their judgement and drive to the conditions when proceeding, such as driving at a reduced speed to keep themselves and the rail traffic safe.

Rail traffic crews were also advised that, in addition to their actions, the rail infrastructure manager (in this instance QR) would monitor flood indicator alarms and take appropriate action should a condition affecting the network occur. The rail traffic crew were then to follow any instruction provided by the NCO. 

It was possible that the driver of train Y279 was concerned of the risk of flooding but had an expectation that the rail infrastructure manager was also monitoring conditions and would provide instruction if required. Similarly, it was possible that the NCO was waiting for further advice from the driver on the conditions at Traveston. Despite this, having received the instruction to accept the indication displayed on signal CR25, the driver of train Y279 decided to proceed at reduced speed.

Change management plans – network control

When the universal traffic control (UTC) 7 control area (encompassing Traveston) was moved from the Brisbane Operations Centre RC1 to the Mayne Control Centre in 2010, a decision was made to remove the display of warning and critical alarm text messages generated by the EMS from the NCO’s workstation. This change meant the NCO would no longer directly receive any weather-related warning or critical alarm messages for their control area. Instead, the fault shift coordinator was responsible for monitoring and responding to these messages in accordance with QR procedure MD‑11‑1955. This arrangement differed from what was in place at the Brisbane Operations Centre - RC1, and this remained unchanged when the Mayne Control Centre later transitioned to the RMC in 2015.

QR could not find a documented change management plan, risk assessment, or assurance activity for the transition of the UTC 7 board between control centres that explained the reason for this variance or assessed the potential risk to rail operations from removing the direct display of warning and alarm messages to the NCO. Additionally, there was no available information assessing whether the administrative procedure MD‑11‑1955 would provide a timely alert to network operations personnel, particularly the NCO, of a warning or critical alarm. Although functionality was available to automatically broadcast an email and text message to defined users of the warning or critical alarm, the user information fields within the remote monitoring system V2 (RMSv2) and integrated asset management protection system (IAMPS) databases were not populated to enable this functionality for any EMS in the UTC 7 control area. QR could not find any record of why the database was not updated to include network operations staff as alert recipients during the change or why the omission was not subsequently identified.

It was unclear whether the absence of the user information for network control personnel within the database was intentional or an error. However, the omission of user information for relevant network control personnel prevented an automated broadcast of warning and critical alarm messages to alert multiple users of the existence of a hazardous condition affecting the network. Rather, the arrangements implemented at the RMC relied solely on administrative procedures providing a timely alert to the NCO.

Environmental monitoring station alarm notification system ineffective

Weather-related warnings and critical alarm messages from the RMSv2/IAMPS were accessible at the network shift asset manager (NSAM) and fault shift coordinator (FSC) workstations within the RMC and Fault Coordination Centre (FCC) respectively. Despite being the only role with access to the application in the network control area, the NSAM's user profile did not allow them to acknowledge weather-related alarms. In addition, there was no procedural requirement for the NSAM to actively monitor the application for adverse weather conditions or alarm messages during their normal duties or when storm activity was forecast. This was consistent with the NSAM’s comments, where they stated that they did not routinely access the system. Therefore, unless the NSAM opened the application and selected a specific feature or were alerted by another means, they were unlikely to be aware of any weather-related alarms.

The FSC was tasked with monitoring and actioning alarms displayed at their workstation. All faults, warning or critical alarm messages, including weather related alarms were displayed as lines of text. According to alarm response procedure MD‑11‑1955, applicable to the control centre, the FSC was to acknowledge and action specific alarms (for example, level crossing, sensor, power supply, or telemetry failure). For other alarms, the procedure stipulated that only the responsible user(s) capable of actioning the alarm should acknowledge them. Weather-related alarms such as temperature, rainfall, and flooding were designated as the responsibility of the network control centre, with the NSAM being the only position at the RMC with access to the system.

If uncertain about the responsible party or if an alarm was not acknowledged promptly, the FSC was to acknowledge the alarm and contact the network control supervisor [day of operations coordinator] to report the event. The procedure identified network control as the responsible party to act on the alarm implying the FSC should intervene if the alarm was not acknowledged in a timely manner. The term ‘timely manner’ was not defined, but it was likely intended that alarms be acknowledged promptly.

RMSv2 training indicated that FSC responsibilities included signal engineering system support, actioning all other alarms displayed at their workstation, and assigning fault repair and maintenance tasks accordingly. If this responsibility was meant to encompass actioning weather_‑related alarms, it appeared in conflict with the alarm response procedure, which indicated this was the role of the network control centre (NSAM). Therefore, the response procedure and associated RMSv2 system training contained conflicting and ambiguous information regarding which role was responsible to actively monitor and respond promptly to weather-related alarms. 

Furthermore, the response procedure and RMSv2 system training did not include any reference to the automated email and text messaging feature designed to automatically broadcast weather‑related warnings and critical alarm messages to defined users. It was unclear whether the FSC, NSAM, train control leader, or day of operations coordinator roles would have been included in the database for the prompt receipt of the automated messages.

In summary, while network control centre operations personnel were primarily responsible for actioning EMS alarms, only the NSAM position had access to the system that displayed the alarm. However, there was no requirement for the NSAM to routinely access or monitor the system for flood alarms, but they did not have the permissions to acknowledge them. The FSC position did have the permissions but would likely only acknowledge the alarm if not done so promptly. In this case, the FSC had observed the alarm for Traveston (about 10 minutes prior to the derailment) but believed it was not their responsibility to action in the first instance and would likely to have already been addressed by operations personnel. Given this, and in the absence of an automated email and text message, the NCO responsible for the safe passage of Y279 was not aware of the significance of the weather event and authorised the train to proceed toward Traveston. 

Alarm follow-up

The QR alarm response procedure indicated that warning and critical alarms for temperature, rainfall, or flood exceedances from an EMS were the responsibility of the network control centre. This was likely as network control personnel, such as the NCO or train control leader, were best positioned to act promptly to manage the risk to rail traffic. The FSC was only to intervene if an alarm was not acknowledged in a timely manner or if the FSC doubted that the alarm was being addressed.

These preconditions were likely to result in delays in the FSC's response or lead to alarms being overlooked among other messages at their workstation. The FSC was the only user with permission to acknowledge an alarm from an EMS sensor. The FSC would therefore need to be involved at some point, if only to clear an EMS-related alarm text message from their workstation text field. In this instance, the alarm was not acknowledged by the FSC and remained active until cleared by the relieving FSC.

The FSC had to perform various tasks at the FCC, meaning they might not always be at their workstation to monitor weather-related warnings and alarms. The FSC became aware of a critical flood alarm at Traveston about 40 minutes after it activated, which coincided with the derailment of train Y279. The FSC likely did not know the location of train Y279 and considered an alarm active for that length of time as either already actioned by network control personnel. Statements from the FSC about when they noticed the alarm implied that, even if they had contacted network control personnel, the timing would not have been sufficient to alert the NCO to stop the train and prevent the derailment.

If the FSC had been aware of the critical flood alarm earlier that morning, the discrepancy between the intended response in the procedure and their understanding of their responsibilities meant they were unlikely to have informed network control personnel of the warning or critical alarm messages.

Environmental monitoring station sensors

Traveston was one of several flood-prone locations on the North Coast Line identified by QR. This location had an EMS that could provide real-time recordings of rainfall, floodwater levels, and temperature. It also had closed-circuit television (CCTV) to give remote visual access for assessing local conditions at the cross-track drainage point.

Accessing CCTV footage was part of the RMC's guideline for responding to storm or severe weather events. However, the Traveston EMS rainfall sensor and CCTV camera were unserviceable at the time of the derailment.

Despite this, the absence of the rainfall sensor and CCTV was not an impediment to network control personnel identifying potential weather-related hazards to rail traffic. There was enough information from the flood sensor and other sources to alert network control personnel to conditions affecting the network and the potential hazards they posed to rail traffic safety.

The asset protection systems, including the EMS, provided network control personnel with ready access to real-time weather information when needed. It was crucial to maintain these systems in a serviceable condition and ensure their availability to network control personnel. If equipment failed or there was a delay in repairing the system, it was equally important to keep network control informed of the equipment's operational status. 

The ATSB investigation RO-2018-007 found there was no process to ensure network control personnel knew which environmental monitoring or CCTV systems were unserviceable. QR implemented various proactive safety actions in response to these findings, however, they were applied only to the regional control centres (RC1 and Townsville). No similar arrangements were evident within the RMC. Therefore, the network control personnel at the RMC were not aware that the Traveston rainfall sensor and CCTV were not serviceable at the time of the derailment.

Competency training to identify condition affecting network ineffective

The QR worker competency program trained network operational personnel in the relevant network control procedures, network rules, and general operating instructions through a series of initial and ongoing courses. Regular assessments verified the personnel’s understanding and application of these procedures, rules and instructions.

Effectively identifying and responding to conditions affecting the network was an essential part of the required competencies. For conditions caused by flooding or rain, the competencies included how personnel would become aware of adverse condition and the actions they should take in response. Alerts for network operations personnel could come from train crew, the Bureau of Meteorology (BoM), equipment failure or remote monitoring system (RMS) data. 

The RMS related training and assessment provided an overview of available information and assessed their understanding of the required responses. However, no training included an overview of the EMS equipment, the possible alarm states, and their impact on safety. Several network operations personnel were not aware of the EMS equipment installed in the UTC 7 control area or the related weather information available through the RMSv2/IAMPS application on selected workstations. 

Network operations personnel were also instructed that they may be alerted to conditions affecting the network through interrogating information published by the BoM. While aware of the instruction on the use of the BoM website, several personnel stated they had not received any training on how to interpret the information to recognise conditions that may be hazardous to rail traffic. On the evening of 22 February 2022 and into the early hours of the following day, several network operations personnel viewed information displayed on the BoM website. None of them considered the weather information particularly unusual for that location or time of year, or that the conditions posed and immediate risk to the operation of rail traffic.

Despite adverse weather conditions, BoM information (including severe weather warnings), reports from rail traffic crew of heavy rainfall and flooding, repeated signalling equipment and power supply failures, and known flood‑prone areas, a condition affecting the network was not recognised. Believing the signalling system would assure track integrity network control personnel authorised the driver of train Y279 to proceed past signal CR25 based on the displayed (green) indication.

Therefore, the training in the network control procedures, rules, and general operating instructions did not help the network operations personnel identify and evaluate the magnitude of the weather event or the conditions affecting the network that could pose a risk to rail traffic. 

Without clear exceedance criteria for weather events (including high wind, temperature, rainfall intensity and flooding) and clear go/no go instructions, there was likely variability in how conditions were handled between QR network control centres and personnel. The ATSB investigation RO‑2015-028 similarly found the network rules, procedures and safety manual provided inconsistent guidance for identifying the magnitude of the potential hazards from weather events.

Emergency egress

After derailing, the locomotive came to rest on its left side in the direction of travel, and in rising flood waters. The driver was ejected from their seat, fell to the assistant driver side, sustained minor injuries and lost their glasses. The disarrangement of equipment within the cab and the sudden darkness hindered the driver’s ability to assess their situation, locate their glasses, safety equipment (torch, handheld radio), or if necessary, exit the cab promptly. Crewing the train as driver-alone operation meant the driver had no other crew to assist in alerting network control of the emergency, assessing/treating injury, or egress from the overturned locomotive cab.

The driver managed to alert the NCO of the emergency using the train borne radio system, which remained operational but powered solely by the locomotive's main battery post-rollover. The radio functioned until the battery failed. Backup communication was available via a handheld 2-way radio, which the driver was able to locate and found serviceable following the derailment and rollover, allowing them to maintain welfare checks with train control. There was no mobile telephone coverage at the derailment location.

The locomotive cab was not fitted with an emergency lighting system. The overhead lighting, which had switched off during the derailment, could be operated by switches on the assistant driver’s side or the driver’s overhead console, neither of which were likely easily identifiable due to the lack of illumination. As the locomotive rested on its left side, only the switch on the assistant driver’s console was readily accessible to the driver. Powered solely by the main battery, it was unknown if the cab lights were serviceable or if the driver attempted to use them. However, after the driver located their hand-held torch, they were able to find their glasses, handheld 2-way radio, and further assessed their situation.

After the overhead traction system had been isolated, the driver, who was ambulatory, climbed onto the inspectors’ seat to access and open the rear-facing door leading to the walkway on the ‘B’ end side of the engine hood, enabling evacuation from the cab. The driver of train Y279 faced several conditions that matched the evacuation hazards identified in the Rail Industry Safety and Standards Board (RISSB) hazard register, increasing the risk of injury before emergency services arrived.

Collision survivability – locomotive

Emergency equipment

The Aurizon rollingstock standards cross referenced relevant standards published by RISSB. Aurizon standards were developed in-house to address hazards specifically applicable to the Aurizon operations and rollingstock fleet (including locomotives). The RISSB standards were developed to broadly address rollingstock related hazards across multiple rail transport operators. As the standards were developed by Aurizon and RISSB independently, variance between the version dates of the standards was likely.

Additionally, for older locomotive classes such as the 2800, which was constructed prior to the published date of a referenced RISSB standard, variance between the existing locomotive construction or equipment fit out and the requirements of the standard may also arise. Variances were typically addressed through the scope of RISSB standards being applicable only to new or modified locomotives.

Both the Aurizon standard for rolling stock fire performance and interior environment referred to requirements contained in the RISSB lighting and rolling stock visibility standard. To protect people, the Aurizon fire performance standard specified rolling stock was to have adequate capacity to evacuate within a suitable time, adequate normal and emergency lighting (with reference to AS 7531) and back-up power supplies with adequate capacity. The back-up power supplies applied to both lighting and communications systems. As there was no distinction between the communication systems fitted to locomotive or passenger rolling stock, this indicated that the train borne radio communication system should have a back-up power supply in the event of a main battery failure.

The scope of standard AS 7531 applied to existing locomotives and included requirements for spaces (cabins, rooms, vestibules, aisles) to be fitted with emergency lighting. This was specifically to address the RISSB identified hazard of the inability to locate exits (unable to reach exit safety - unable to successfully evacuate). The Aurizon 2800 class locomotive, including 2811, was not fitted with an emergency lighting system or back-up power supplies. Rail traffic crew (including driver-alone operations) responding to an emergency during the hours of darkness were then reliant on locating, in the disarranged cab of an overturned locomotive, a hand-held torch carried as part rollingstock emergency equipment.

Similarly, in the event of damage to the train borne radio or failure of the main battery, rail traffic crew were also reliant on locating a serviceable 2-way radio or mobile telephone, if issued to the locomotive and mobile service was available, to notify network control of an emergency and for welfare communications.

Egress pathways

Locomotive 2811 was being operated from the No 2 end when it overturned. The laminated windscreens in the 2800 class locomotive did not have release handles, so the driver could only access and exit through the rear-facing door leading to the walkway on the ‘B’ side of the engine hood (primary pathway) or the driver’s side window (alternative pathway). Both these pathways were on the high side of the overturned 2.87m wide locomotive cab.

The driver, who was ambulatory, climbed on the inspector’s seat to reach the rear-facing door. In this instance, the derailment and rollover did not distort the door and frame, and since the door was hinged at the engine hood side, it opened easily without the need for further restraint. 

If the rear-facing door could not be opened, the driver could use the alternative pathway through the driver’s side window. The driver had already slid open the window before the derailment and rollover, so the use of the glass hammer would not have been necessary. 

The rigidity of the side window glass and frame to withstand the forces applied by a rail traffic crew member using this pathway was unknown. Additionally, should the driver (and other crew) be required use the glass hammer to break and remove the window glass above their head, their pathway would likely be difficult due to the hammer being fixed by a short tether, the necessity to climb, the layout of the console, and other fixtures within the cab. As the 2800 class locomotive cab did not have any footholds or climbing arrangements to aid rail traffic crew egress via the alternative pathway, this potentially increased their exposure to known evacuation hazards. This was particularly relevant to driver-alone operations where no other train crew were available to provide immediate assistance to egress the locomotive cab in an emergency. 

Once the crew had exited to the high side of the locomotive, they had to descend to the surrounding ground level. Like the above, there were no external footholds or climbing arrangements to assist in descending from the locomotive. Unless emergency services were present with a ladder, the crew would likely need to climb down onto the locomotive bogie if attached. In this case, the driver was assisted to climb down onto the bogie. Alternatively, they would have to jump approximately 3 m to the ground level, exposing them to the additional hazard of falling from height. This hazard, although listed in the RISSB hazard register, was not associated with an evacuation hazard from a locomotive.

If the locomotive had rolled onto the right side in the direction of travel, the driver could have used the rear-facing door on the low side of the locomotive or the assistant driver’s side window, on the high side. Egress via the rear-facing door, if not obstructed by floodwater, debris or wreckage required the door, which is typically of heavy construction, to be latched/propped open during egress. The driver would have also faced hazards from the pathway being underneath damaged or potentially unstable rolling stock.

Similar evacuation hazards occurred if locomotive 2811 was operated from the No 1 end when it overturned. The primary access and egress pathway to the cab was via 2 external doors into a central vestibule, then a central door into the rear of the cab. The alternative pathway was via the side windows. The effectiveness of these egress pathways depended on which side the locomotive came to rest. On the left side in the direction of travel, the hinge of the door between the cab and central vestibule was on the upper side, meaning the door would likely need to be latched/propped open. After entering the vestibule, the crew then had to access the void between the external doors and latch/prop open the upper external door before climbing onto the upper side of the locomotive engine hood. The lower external door, once unlatched, would likely remain open, but egress via the lower external door to the underside of rolling stock exposed the crew to additional hazards.

If resting on the right side in the direction of travel, the central vestibule door would likely remain open. On entering the vestibule, the crew would likely encounter the scenario described above. The crew, using the alternative pathway via a side window, would likely encounter a similar scenario to that described for the No 2 end.

The driver of train Y279 noted that every emergency was different and was aware of the glass hammers in the locomotive cabs but had not received any specific instruction on its use, how to remove the glass from above their head or how to egress safely from the cab in an emergency. The Aurizon emergency response guide identified that, following locomotive rollover, access and egress may not be possible by the normal pathways and that alternative egress arrangements varied between locomotive classes, with some fitted with glass hammers for side windows or release handles for front windscreen removal. 

The Aurizon standard 07‑STD‑003‑RSK required a window breaking hammer be accessible for every worker occupied glassed area that did not have emergency access to the outside of the vehicle. For a driver to exit from an overturned locomotive that did not have emergency access, such as the 2800 class, they either slid open a side window or used the hammer that was fixed by a short tether to smash and remove glass, at height and overhead. 

The effectiveness of these emergency exit arrangements had not been assessed and verified to determine if the foreseeable scenarios such as those involving injury, varying physical attributes, mobility and availability of immediate assistance, as in driver-alone operations, were adequate.

Similarly, the ATSB investigation RO-2015-028, found the Aurizon emergency egress arrangements for rail crew from the 2800 class locomotive were not effective in all foreseeable circumstances. Aurizon was to continue reassessing the emergency evacuation procedures, windscreens, and secondary communication opportunities/options appliable to the locomotive fleet. 

A collision or derailment can result in structural damage to the cab and/or result in the locomotive rolling onto its side. This can impede the egress routes normally used to access the cab. Situations where rolling stock has overturned present an increased exposure of rail traffic crew to hazards particularly at night in remote areas, and in this case, also with rising flood waters. Exposure is increased when operating the locomotive in the driver-alone configuration, where no immediate support is readily available to assist a potentially injured driver to egress from an overturned locomotive.

Findings

From the evidence available, the following findings are made with respect to the Derailment involving freight train Y279 near Traveston, Queensland, on 23 February 2022.

Contributing factors

• A localised heavy rainfall event near Traveston resulted in floodwater run-off that exceeded the capacity of the cross-track drainage system.
• Floodwaters that overtopped the track scoured areas of the ballast and formation. The scouring compromised the capacity of the track to support the weight of a train passing over the affected area.
• Ambient environmental conditions during the approach to Traveston impeded the driver's visibility of the track ahead. The driver sighted the scoured track area at a distance that was insufficient to stop the train before it entered the affected area and subsequently derailed.
• While operations staff knew adverse weather in the area had affected the signalling system, they were not aware that floodwaters from heavy rainfall had overtopped the track. On the belief the clearance of signal CR25 confirmed the integrity of the track formation, they instructed the driver of Y279 to accept the signal indication and proceed toward Traveston.
• The Queensland Rail change management processes implemented in 2010 and in 2015 to transfer the universal traffic control board for area 7 (Glass House Mountains to Gympie North) between control centres did not ensure that the system to alert operations staff at the Rail Management Centre of an adverse weather-related event would effectively manage the related risk to rail operations.
• The Queensland Rail alarm response procedure and automated messaging system used at the Rail Management Centre were ineffective in providing network operations staff timely notification of alarms from the environmental monitoring stations in the Glass House Mountains to Gympie North control area. (Safety issue)

Other factors that increased risk

• At about the time of the derailment, the fault shift coordinator had become aware of a critical flood alarm at Traveston that had activated about 40 minutes prior but believed it was not within their role to follow up on alarms that were the responsibility of network control.
• The Traveston environmental monitoring station rainfall sensor and closed-circuit television camera were unserviceable at the time of the derailment.
• Queensland Rail did not have an effective means to ensure that operations staff at the Rail Management Centre were aware that environmental monitoring station sensors were unserviceable. (Safety issue)
• The Queensland Rail training program did not ensure personnel at the Rail Management Centre proactively monitored an adverse weather event or responded to reports and other information of a condition that could present a hazard to train movements. Subsequently, the network operations personnel relied on the clearance of a signal to determine the integrity of the track through a known flood‑prone area. (Safety issue)
• After derailing, the locomotive came to rest on its side in floodwaters. The driver was in darkness and unable to readily locate safety equipment.
• The emergency exit pathway through a side window, and the emergency equipment available in the enclosed cab of an Aurizon 2800 class locomotive were inadequate to ensure a prompt escape by crew and potentially limited access by emergency services in the event of a locomotive overturning. This increased the risk of injury to the crew from known evacuation hazards. (Safety issue)

Safety issues and actions

Environmental monitoring station alarm notification system ineffective

Safety issue number: RO-2022-003-SI-01

Safety issue description: The Queensland Rail alarm response procedure and automated messaging system used at the Rail Management Centre were ineffective in providing network operations staff timely notification of alarms from the environmental monitoring stations in the Glass House Mountains to Gympie North control area.

Competency training to identify condition affecting the network ineffective

Safety issue number: RO-2022-003-SI-02

Safety issue description: The Queensland Rail training program did not ensure personnel at the Rail Management Centre proactively monitored an adverse weather event or responded to reports and other information of a condition that could present a hazard to train movements. Subsequently, the network operations personnel relied on the clearance of a signal to determine the integrity of the track through a known flood‑prone area.

Environmental monitoring station equipment serviceability

Safety issue number: RO-2022-003-SI-03

Safety issue description: Queensland Rail did not have an effective means to ensure that operations staff at the Rail Management Centre were aware that environmental management station sensors were unserviceable.

Collision survivability – locomotive

Safety issue number: RO-2022-003-SI-04

Safety issue description: The emergency exit pathway through a side window, and the emergency equipment available in the enclosed cab of an Aurizon 2800 class locomotive were inadequate to ensure a prompt escape by crew and potentially limited access by emergency services in the event of a locomotive overturning. This increased the risk of injury to the crew from known evacuation hazards.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• rail traffic crew of train Y279
• network operations personnel
• Queensland Rail
• Aurizon
• recorded data from train Y279
• recorded data and voice communications from Queensland Rail - Rail Management Centre
• Bureau of Meteorology
• Rail Industry Safety and Standards Board.

References

Bureau of Meteorology. (2022). Special Climate Statement 76 – Extreme rainfall and flooding in south-eastern Queensland and eastern New South Wales. http://www.bom.gov.au/climate/current/statements/scs76.pdf?20220525

National Transport Commission. (2017). National standard for health assessment of rail safety workers. https://www.ntc.gov.au/codes-and-guidelines/national-standard-health-assessment-rail-safety-workers

Rail Industry Safety and Standards Board, (2012). Australian Standard AS 7522:2012 – Railway Rolling Stock Access and Egress – Part 1 Locomotive Rolling Stock. 

Rail Industry Safety and Standards Board. (2023). Australian Standard AS 7531:2023 – Lighting and Visibility,

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• rail traffic crew of train Y279
• network operations personnel
• Queensland Rail
• Aurizon
• Office of the National Rail Safety Regulator.

Submissions were received from:

• Queensland Rail
• Aurizon
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.