Signal passed at danger involving passenger train TE43, between Fortitude Valley and Bowen Hills, Queensland, on 24 May 2023

Automatic warning system information

QR’s suburban network was fitted with an automatic warning system (AWS). This system consisted of an in‑field magnet on the track and a magnetic receiver linked to a warning system on the rollingstock.

QR Standard MD‑10‑119 Automatic warning system (AWS) operations manual noted that the AWS was designed to:

• provide an in-cab visible and audible indication of the aspect displayed in the next signal
• prompt and warn the rail traffic driver of a RESTRICTED signal aspect displayed in the next signal
• stop the rail traffic if the rail traffic driver fails to acknowledge the AWS alarm of a RESTRICTED signal aspect.

This procedure also stated:

AWS is an advisory system and not a control system. The setting of rail traffic speed remains with the rail traffic driver. The AWS is designed to apply the brake when the rail traffic driver cannot or does not acknowledge a RESTRICTED signal aspect…

When the train’s magnetic receiver passed over the in-field magnet on approach to a signal, the AWS would provide a different alert to the driver for proceed or restricted indications:

• proceed indication: the AWS indicator would display a black visual and sound a short series of beeps. Acknowledgment of the clear to proceed indication was not required by the driver.
• restricted indication: the AWS indicator would display the same yellow and black ‘sunflower’ visual display for both caution and stop indications and sound a louder, continuous buzzing alarm. The driver was required to cancel the alarm by pressing and releasing the acknowledgment button. If the AWS alarm was not acknowledged after 3 seconds, a penalty brake application would occur.

On approach to signals BS07 and CS025, the AWS provided a ‘sunflower’ visual display and a continuous buzzing alarm, which were both cancelled by the driver using the acknowledgement button. During interview, the driver advised that they could not recall acknowledging the AWS for signal CS025, and they could not remember if they were first alerted to the red aspect by the AWS alarm, or visual observation of the signal.

Previous ATSB investigations have identified instances where train drivers have acknowledged the AWS alarm for a red aspect, and subsequently passed the signal at danger (see the section titled Previous occurrences ). 

Signal CS025

Signal CS025 was a 4‑aspect[6] automatic signal located at the 2.545 km mark on the down suburban line, mid‑section between Fortitude Valley Station and Bowen Hills Station (Figure 4). On approach to signal CS025, the mainline speed for this track section was 60 km/h.

Figure 4: Approach to signal CS025 along down suburban line towards Bowen Hills Station

Note that this image shows CS025 with a caution steady yellow aspect. Source: Queensland Rail, annotated by the ATSB

There were 2 track circuits between signal CS025 and the next signal CS027 (CS025CT and CS025DT) (Figure 5). Signal CS025 would display a stop indication when either track circuit CS025CT or CS025DT was detected as occupied. Additionally, if track circuit CS027AT was occupied, after CS025CT and CS025DT had cleared, CS025 would also display a stop indication. 

Figure 5: Track circuits between signal BS07 and ME19 on the down suburban line towards Bowen Hills Station

Source: ATSB, based on signalling arrangement maps and diagrams - not to scale

QR confirmed via simulation that the UTC system would generate a SPAD alarm, and display a SPAD message indication on the NCO’s workstation for signal CS025, if track circuit CS025DT was occupied by another train ahead when signal CS025 was passed at stop (Figure 6). In this simulation track circuit CS027AT, ahead of signal CS027, was unoccupied. 

Figure 6: UTC simulation of train passing CS025 at stop

Source: Queensland Rail, annotated by the ATSB

QR identified that there had been no SPADs recorded at signal CS025 since 2010, and the signal complied with the sighting distance requirements described in QR Standard MD‑10‑95 Signalling positioning principles.

Signal passed at danger (SPAD) warning system

The SPAD warning system consisted of an audible 3‑beep alert tone and a red text dialogue box that appeared on the NCO’s workstation (Figure 6).

The QR manual MD‑14‑37 Network control manual outlined different UTC alarm messages that would be provided to warn the NCO of threats to safeworking. The NCO was required to immediately respond to these messages, unless they assessed that doing so had the potential to increase the hazard.

UTC SPAD alarm messages were identified as of critical importance, with the highest response requirement by the NCO. The NCO was to:

Investigate cause. Make emergency call to stop offending train. If other trains are present, call all trains in the area(s) to stop. Assess if rail traffic driver is fit to continue, move train to position of safety.

QR procedure MD‑11‑42 Signal passed at danger – module EP1‑13 reflected the above required response by the NCO following receipt of a SPAD alarm.

In this instance, the NCO did not receive a SPAD alarm and was first alerted to the SPAD of train TE43 by the driver’s emergency radio call. 

Signal passed at danger alarm generation principles

The QR manual SR105 SPAD Alarm generation principles defined the criteria used by the UTC system to determine if a SPAD alarm message would be displayed to the NCO.

Section 6.1 of the manual stated:

The UTC Controller Workstation shall generate a ‘Train passed signal at stop’ alarm if all of the following rules are met:

Rule 1       The first track beyond a Limit of authority (LOA)[7] becomes occupied.

Rule 2       There is no train on a track adjacent to the newly occupied track with a proceed authority onto this newly occupied track.

Rule 3       There are one or more trains that can step onto the newly occupied track from an adjacent track which has an LOA facing towards the newly occupied track.

To illustrate the application of the rules, several scenarios were included in the appendices of the manual (Figure 7).

Figure 7: Extract from appendices of SR105 signal passed at danger alarm generation principles manual

Source: Queensland Rail, annotated by the ATSB

The examples showed:

• For C.14, all the track circuits between the automatic signal and the next signal were unoccupied. The automatic signal was assumed to be displaying a proceed indication. When train 1111 passed the automatic signal to occupy the track ahead, no SPAD alarm would be generated.
• For C.15, a track circuit between the automatic signal and the next signal is occupied by train 1109. The automatic signal was assumed to be displaying a stop indication. When train 1111 passed the automatic signal to occupy the track ahead, a SPAD alarm would be generated.
• For C.16, a track circuit ahead of the next signal is occupied by train 1109. The automatic signal was assumed to be displaying a proceed indication. When train 1111 passed the automatic signal to occupy the track ahead, no SPAD alarm would be generated.

Additionally, Section 6.8.1 of the manual noted that:

• Automatic signals are not indicated, and therefore UTC is unaware of whether the signal has a proceed aspect or not. So that SPAD alarms can be generated for automatic signals, UTC will assume that an automatic signal has a proceed aspect when all of the tracks up to the next signal are all clear. The tracks in the overlap[8] (if any) will not be checked.

Section 7 also noted further limitations:

If the replacement track[9] of a signal is already occupied (e.g. by another train, gang or track fault), then a train passing the signal will not be able to be detected, and therefore a SPAD alarm will not be generated.

Due to the possibility of timing issues,[10] the overlap of an automatic signal (if any) will not be checked when determining whether an automatic signal is clear. Consequently, if the overlap of an automatic signal is occupied, then a SPAD alarm will not be generated if a train passes the automatic signal.

Overview of Queensland Rail SPAD risk management

QR maintained a suite of risk registers that identified hazards and related risk controls. The enterprise risk register identified several key risks and controls related to SPAD events including the following: 

• …SEQ [South East Queensland] Operations failing to adequately prevent a rollingstock collision (train to train, train to vehicle, train to person), potentially resulting in one or more fatalities
• …rail traffic separation or route integrity not being maintained on the mainline resulting in train to train, train to person, train to infrastructure, train to object collision or derailment 

These risks were last reviewed on 22 September 2021. Risk controls included:

• ongoing SPAD prevention strategies/programs/campaigns
• focus groups designed to prevent SPADs
• maintenance of worker competencies
• assurance activities
• safeworking audits
• the application of the UTC system.

The effectiveness of the respective controls was assessed as ‘substantially effective’ with the hierarchical level primarily identified as ‘administrative’. For each of the risk controls above, the risk score following implementation of the controls was assessed as ‘medium’. The justification for the risk score was respectively: 

• Controls at this level are administrative. Where appropriate GM’s [General Managers] registers identify higher levels of controls where the control owner has accountability/responsibility of the control.
• No higher-level engineering control is currently available to control this risk. Until ETCS [Level 2][11] 
  is fully implemented across the QR SEQ network this safety risk is being controlled by administrative/people control (active supervision) which is inherently partially effective in the absence of the higher engineering control (ETCS).

The TSD Operations SEQ Risk register – Risk 3 Train to train collision included the risk description: ‘risk of train‑to‑train collision resulting in injury or death as a result of a SPAD event’. 

Risk controls included:

• rail traffic crew training
• safe driving techniques
• risk triggered commentary driving (RTCD)
• application of the SPAD risk management standard (MD-10-89)
• SPAD risk management procedure (MD-13-362)
• SPAD risk management instruction (MD-13-446). 

Again, the effectiveness of the controls was assessed as ‘substantially effective’ and the hierarchical level as ‘administrative’. The residual risk score was assessed as ‘medium’. The justification for the risk score was:

Higher order controls are in place but owned by other business areas (e.g. Engineering: Level Crossing protection systems, signalling system & UTC). TSD Operations therefore has not identified any further higher order controls available for implementation by our functional area.

Additionally, a pilot bowtie analysis for QR operations was developed on 1 September 2021. This was intended as an information aid for QR’s safety management system, including the enterprise and operational area risk registers. The bowtie analysis identified risk controls and highlighted those assessed as critical risk controls[12] associated with the prevention of human factors‑related SPADs, including driver distraction. Risk controls listed in the bowtie included:

• Safeworking training standards (MD‑10‑199) – critical risk control
• TSD Professional driving followed by drivers (MD‑11‑72)
• Train safety systems (AWS, ATP, DTC)[13] (MD‑10‑218) – critical risk control
• Automated train protection remove and replace with train safety systems
• QNRP network rules and procedures (MD‑12‑189)
• Safety in yards (MD‑10‑175)
• DTC Alarms in cabs
• UTC SPAD alarm triggering emergency response procedure
• NCO emergency response to SPAD alarm to stop train
• Potential control: Train control radio for emergency comms with driver (workers on track do not have radio)
• Observe signal approach warning (MD‑10‑109) – critical control
• Risk triggered commentary driving (RTCD) (MD‑13‑165)
• Potential control: Rail resource management human factors framework training and competency (RTC and NCO)
• Potential control: ETCS controls train in event of incapacitation

UTC SPAD alarms and the NCO’s emergency response to a SPAD alarm were listed as risk controls in the bowtie analysis. QR did not consider them as critical risk controls, as they were partially effective administrative controls. In contrast, train safety systems (including AWS) were considered a critical risk control.

The QR standard MD‑10‑89 SPAD Risk Management ranked the severity of a SPAD incident to the application of risk controls, based on the Office of the National Rail Safety Regulator (ONRSR) Reporting requirements for notifiable occurrences guideline. Where the rollingstock stopped more than 50 m from the rear of the train ahead by the actions of the driver alone, the severity was ranked as ‘minor’ due to ‘significant escalation of SPAD required before incident could occur’. Additionally, where the rollingstock stopped more than 50 m from rear of the train ahead by the actions of the NCO, the severity was also ranked as ‘minor’ due to ‘significant escalation of SPAD required before incident could occur’. 

In contrast, where the rollingstock stopped less than or equal to 50 m from the rear of the train ahead by the actions of NCO, the severity was ranked as ‘significant’ due to ‘potential incident prevented by recovery action’. 

QR confirmed that training and toolbox talks for NCOs included information about SPAD alarm warning messages not being presented under certain circumstances.

QR advised that the effectiveness of the recovery action provided by the NCO (including the effectiveness of the SPAD alarm warning system), were not risk assessed by QR business or functional areas. 

The QR internal investigation report for this incident did not identify the absence of the SPAD alarm activation for signal CS025.

Previous occurrences

The ATSB has investigated several occurrences that identified the important role of active intervention by the NCO to prevent a further reduction in safety margins once a SPAD had occurred. These investigations all showed that it was possible for the driver to completely miss a signal.

RO-2017-010 Signal ME45 passed at danger, involving suburban passenger train 1A21, Bowen Hills, Queensland, on 26 August 2017[14]

Train 1A21 passed controlled signal ME45 at the northern end of Platform 2 Bowen Hills, and an alarm activated at the QR Rail Management Centre at Mayne. The network control officer overseeing that particular area, broadcast an emergency radio message calling for the driver of 1A21 to stop. Due possibly to distraction, the driver did not apply the applicable procedures relevant to the restricted indication displayed at signal ME25 prior to departing the platform, therefore missing vital information concerning the aspect status of signal ME45. The driver’s attention was likely focussed on peripheral trackside activity as the train approached signal ME45, distracting him from the primary task of observing signal indications.

RO-2018-002 Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, on 10 January 2018[15]

Train TP43 passed controlled signal ME45 at the northern end of Platform 2 Bowen Hills, and an alarm activated at the QR Rail Management Centre at Mayne. After receiving a SPAD alarm, the network control officer broadcast an emergency stop command to the driver of TP43. The train was stopped 220 m past signal ME45, and 126 m prior to a conflict point. At the time that TP43 came to a stop, another suburban passenger train had just cleared the conflict point.

Approaching the first signal (ME45, displaying a red aspect) after departing from Bowen Hills, the driver probably read through to another signal for an adjacent line that was displaying a green aspect, which they incorrectly believed was signal ME45. Although the driver of train TP43 acknowledged the automatic warning system audible alarm, this was almost certainly an automatic response that did not result in an effective check of signal ME45’s aspect indication, resulting in the signal’s red aspect not being detected.

During the investigation, the ATSB identified a safety issue with the AWS (Safety Issue RO‑2018‑002‑SI‑03).[16] This was due to the potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, which reduced the effectiveness of the AWS to prevent SPADs.

QR advised the ATSB of safety action taken, including:

…conducting a whole fleet project to decrease in volume of the AWS audible indication at a proceed signal aspect (green) and increase the volume of the AWS audible indication at a restricted signal aspect, with input from the Principal Human Factors Advisor and Principal Electrical Engineer. The estimated project completion was 30 December 2023.

…projected introduction of the European Train Control System (ETCS) into the Citytrain network as a safety action to manage the risk of SPADs. In April 2019, the Queensland Government announced that the ETCS works package would be delivered by Hitachi Rail STS. As the future operator, Queensland Rail would be responsible for successfully integrating the cross-river rail project and ETCS Level 2 project into its rail network.

On 15 April 2021, the safety issue was closed as partially addressed:

The ATSB notes the safety action to change the auditory volume of the AWS for restricted signals verses green signals, but believes that this will not have a significant impact in reducing the risk of the safety issue as it does not help differentiate red signals from other restricted signals. The ATSB also appreciates that there would be substantial difficulty in redesigning the AWS to provide a clear distinction between the alerts that occur in response to signals with a red aspect compared to other restricted signals. However, the ATSB welcomes the safety action to introduce the European Train Control System (ETCS) and believes that this system will reduce the risk of SPADs where and when it is implemented.

Safety analysis

Introduction

After departing Fortitude Valley Station on the down suburban line, suburban passenger train TE43 passed signal CS025 that was displaying a red stop indication by about 64 m. There were no technical issues associated with the rollingstock, and the signalling system functioned as designed. 

The safety analysis will discuss:

• the immediate reason for the signal passed at danger (SPAD)
• the habituation of acknowledging the automatic warning system (AWS)
• alarms for SPAD occurrences not being displayed to the network control officer (NCO) by the universal traffic control (UTC)
• the effectiveness of current recovery risk controls for signal passed at danger (SPAD) events in risk assessments. 

Driver performance

On departure from Fortitude Valley Station platform 2, a steady yellow aspect was displayed on signal BS07. Application of the safe driving procedures meant the driver was required to travel at a speed not exceeding 45 km/h (75% speed rule) and maintain situational awareness and vigilance through cross checking and the use of risk triggered commentary driving.

Approaching the next signal (CS025) displaying a red, ‘at danger’ aspect, the driver was required to initiate further positive action to slow the train. If the signal remained at stop, the driver was to further reduce speed to not exceed 20 km/h as the train traversed the AWS magnet (20/20 rule). The driver would then receive, and acknowledge, the AWS alarm before stopping 20 m prior to the signal. 

In this instance, after passing BS07, the driver accelerated train TE43 to 50 km/h before removing traction power and coasting. There was no braking or reduction of train speed as TE45 rounded the curve on the approach to signal CS025. Additionally, there was no reduction in speed as TE43 approached and then traversed the AWS magnet. The first brake application and reduction in train speed occurred just prior to passing signal CS025.

A review of the onboard recorded data found that prior to Fortitude Valley Station, the driver generally reduced train speed in accordance with the safe driving procedures, as they approached and passed each restricted indication. Additionally, the driver also placed the direction controller in neutral at the platform in accordance with the safe driving procedure. The only recorded occasion during the trip where the driver had not applied the speed reduction occurred after the departure from platform 2 at Fortitude Valley Station. 

The driver reported that, after departure from platform 2, they experienced a sudden sneezing fit. Additionally, they were diagnosed with COVID‑19 about 12 hours after the occurrence. They also stated that although they did acknowledge the AWS alarm approaching CS025, they could not recall if it was a conscious or reflex response to the alarm.

Sneezing is a symptom that may be observed in individuals presenting with COVID‑19 or other acute respiratory infections (Australian Centre for Disease Control, 2024). Such a prolonged sneezing reflex, or fit of sneezing while operating a train, could affect the driver’s capacity to effectively control the train during a critical phase approaching a restricted indication, and impair their ability to detect and react to stimuli.

The ATSB concluded that, although the driver was aware the departure signal (BS07) displayed a restrictive indication showing the signal ahead (CS025) was at stop, they likely experienced a degree of impairment arising from the sneezing reflex, which adversely affected the driver’s control of train speed and observance of the signal aspect.

Contributing factor The sneezing fit between signal BS07 and signal CS025 reported by the driver likely impeded their control of the train and observance of the red aspect displayed in CS025. Train TE43 subsequently passed signal CS025 at stop by about 64 m.

Automatic warning system

During the trip between Park Road Station and Fortitude Valley Station, the driver promptly acknowledged multiple AWS alarms (continuous buzzers) from restricted indications, and on one occasion an AWS alert (short series of beeps) from a proceed indication, which the driver was not required to acknowledge. Approaching signal CS025, the driver again acknowledged the AWS alarm for the restricted indication promptly, although they could not remember doing so. 

ATSB investigation report RO‑2018‑002 discussed the effectiveness of AWS alarms, noting that although they reduced the likelihood of SPADs in some situations, the design was fundamentally limited and would not eliminate SPADs. The report also highlighted research indicating a significant number of drivers in many rail networks had reported ‘automatically’ acknowledging an AWS alarm at a restricted signal without recognising it had occurred, particularly in situations where drivers repeatedly encountered signals displaying restricted indications. The report also noted with drivers encountering an increased frequency of restricted indications, they could become conditioned to cancelling the AWS alarm as a habitual or reflex reaction. 

In this instance, the driver recalled that from Park Road Station, the suburban network was operating at near peak capacity. This meant that the driver received and acknowledged many AWS alarms to restricted indications along with proceed indications. This, possibly in conjunction with the impairment arising from the sneezing fit, likely influenced the driver’s action to acknowledge the AWS alarm and not identify the red aspect until it was too late to prevent passing it.

Contributing factor There were frequent automatic warning system (AWS) alarms presented to the driver between Park Road Station and Fortitude Valley Station due to traffic congestion. This likely influenced the driver’s reaction in acknowledging the AWS alert on approach to signal CS025, which cancelled the train’s automatic brake application, while not recognising the red aspect.

ATSB investigation RO‑2018‑002 identified the AWS alarm was also not an effective risk control because it provided the same visual and aural alarm for all restricted indications and that substantially diminished the significance of approaching a stop indication (red aspect). Queensland Rail (QR) undertook several safety actions, including changing the auditory volume of the AWS for restricted indications versus proceed indications. Although this action provided a degree of improvement, it did not differentiate a red aspect from other restricted indications (double yellow, yellow, flashing yellow aspects).

The AWS was the primary engineering risk control used by QR in the suburban network to reduce the likelihood of, or to mitigate the consequences of a SPAD event. However, the AWS system was vulnerable to human error as drivers could acknowledge the alarm and cancel the automated application of a brake penalty, without necessarily considering the next signal ahead was at stop. 

This risk control was less effective than systems like Automatic Train Protection or European Train Control Systems (ETCS), that offered a higher level of automation, such as automatic initiation of a penalty brake application following a SPAD event. In 2021, QR advised that, in addition to improvements to the AWS, work was being undertaken with suppliers to determine an ETCS Level 2 implementation schedule for parts of the QR rail network in South-East Queensland. As of May 2023, the project had progressed to testing ETCS technology on the Shorncliffe Line with compatible rollingstock, but had not been commissioned into operational service.

Contributing factor The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their usefulness. (Safety issue)

Signal passed at danger warning

The UTC signal passed at danger (SPAD) warning functionality was designed to generate a SPAD alarm on the network control officer’s workstation if a train passed a signal aspect displaying a stop indication. However, inherent constraints within the UTC system meant that under certain situations, although an automatic signal displayed a stop indication, no alarm was generated if a SPAD occurred.[17]

In this instance, automatic signal CS025 was displaying a red stop indication when passed by train TE43, and no SPAD alarm was generated at the NCO’s workstation. The track circuit ahead of the next signal CS027 was occupied by train EM03, the reason signal CS025 was at stop. However, signal CS025 was assumed by the UTC to be displaying a proceed indication as the 2 track circuits in between were clear. 

The SPAD alarm generation principles were designed to not check the track ahead of the next signal, to avoid timing issues associated with the operation of the UTC system. This design, while solving a technical problem, prevented notification of certain SPAD events to the NCO. It also compromised the effectiveness of the recovery action provided by the active intervention of the NCO in making an emergency call to the driver to stop their train.

The signal after CS025 (CS027) ahead of train TE43 was also at stop, and the red aspect, coupled with the associated AWS warning, provided protection to the rear of train EM03. However, if the driver had not stopped after passing signal CS025, and continued passed CS027, with EM03 still occupying the track immediately ahead of the signal (CS027AT), again no SPAD alarm would have been produced on the NCO’s workstation. This was also due to a design limitation in function, as the replacement track circuit to signal CS027 (CS025AT) was already occupied by EM03, and the UTC was unable to detect a change in state of the track circuit from unoccupied to occupied.

Other factor that increased risk The universal traffic control (UTC) system did not present a signal passed at danger (SPAD) alarm for signal CS025 to the network control officer, because the conditions required for the UTC to display the alarm were not met. Consequently, mitigation of the safety risk relied on the driver recognising the SPAD and stopping the train.

In this occurrence, the driver of train TE43 recognised that signal CS025 was at stop just before they passed it, stopped the train and made an emergency broadcast, initiating the NCO’s response. Fortunately the inherent constraint resulting in the absence of a SPAD alarm and associated risk mitigation from active intervention by the NCO had no effect on the consequence of this occurrence. However, if the driver had completely missed signal CS025, then automatically acknowledged the next AWS warning and continued past signal CS027 (i.e., multiple SPAD), a SPAD alarm would again not have been generated, if the replacement track was still occupied by train ahead EM03. 

Other finding The driver of train TE43 recognised signal CS025 was at stop just before they passed it, applied emergency braking and made an emergency radio call to network control. The signal after CS025 (CS027) ahead of train TE43 was also at stop. This red aspect, coupled with the associated automatic warning system activation, provided protection to the rear of train EM03. However, if train TE43 had passed signal CS027 with train EM03 occupying the replacement track, a SPAD alarm would also not have been generated by the universal traffic control system.

Risk management of signal passed at danger

QR knew of conditions that would prevent a signal passed at danger (SPAD) alarm being provided to the NCO following a SPAD event. These conditions were noted in SR105 – SPAD Alarm generation principles manual, which included specific limitations applicable to automatic signals.

In this instance, the NCO became aware of the SPAD at signal CS025 after the driver had stopped their train and only because the driver made an emergency call. QR Network control manual identified the signal passed at danger alarm as a critically important control to mitigate the risk from SPADs. Additionally, the QR standard MD‑10‑89 SPAD Risk Management noted the actions of the NCO as a factor that reduced the severity of SPAD incidents once they occurred. The absence of a SPAD alarm message to an NCO, would prevent them from taking any recovery action. 

Additionally, QR had developed a bow tie analysis to assess the risk of a SPAD due to driver distraction. All of the risk controls listed were contingent on the driver performing the correct action, which while they were distracted was unlikely to be effective. The bowtie analysis did identify ‘UTC SPAD alarm triggering emergency response procedure’ and ‘NCO emergency response to SPAD alarm to stop train’ as risk controls. However, it did not recognise that the NCO taking action was dependent up on a SPAD alarm being generated, and the UTC SPAD alarm was not specifically identified as critical risk control.

QR had also undertaken both enterprise and operational area risk assessments that addressed risks to train separation, including SPAD events. The risk assessments did not assess the effectiveness of the recovery action provided by the NCO or consider the SPAD alarm warning limitations inherent to the UTC system. Risk assessments conducted in operational areas referenced other QR functional areas, however these also did not assess the risk further.

The risk control of active intervention by the NCO in response to a SPAD was an administrative control and was not defined as a critical risk control. This was because it could not guarantee all trains in the area would stop. However, previous ATSB investigations noted NCOs had an important role in preventing further reduction in safety margins, once a SPAD had occurred. In other SPAD scenarios where a signal was completely missed by a driver and not self‑reported, the system was reliant upon the NCO receiving and responding to a SPAD alarm (which will not always occur) to prompt the driver to stop the train.

Other factor that increased risk The signal passed at danger (SPAD) alarm for CS025 did not alert the network control officer when train TE43 passed the signal at stop. This was due to inherent constraints of the universal traffic control system, which was not considered in the way Queensland Rail managed the risk of SPADs. (Safety issue)

Findings

ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors.  Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

From the evidence available, the following findings are made with respect to the signal passed at danger involving passenger train TE43 between Fortitude Valley and Bowen Hills, Queensland on 24 May 2023.

Contributing factors

• The sneezing fit between signal BS07 and signal CS025 reported by the driver likely impeded their control of the train and observance of the red aspect displayed in CS025. Train TE43 subsequently passed signal CS025 at stop by about 64 m.
• There were frequent automatic warning system (AWS) alarms presented to the driver between Park Road Station and Fortitude Valley Station due to traffic congestion. This likely influenced the driver’s reaction in acknowledging the AWS alert on approach to signal CS025, which cancelled the train’s automatic brake application, while not recognising the red aspect.
• The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their usefulness. (Safety issue)

Other factors that increased risk

• The universal traffic control (UTC) system did not present a signal passed at danger (SPAD) alarm for signal CS025 to the network control officer, because the conditions required for the UTC to display the alarm were not met. Consequently, mitigation of the safety risk relied on the driver recognising the SPAD and stopping the train.
• The signal passed at danger (SPAD) alarm for CS025 did not alert the network control officer when train TE43 passed the signal at stop. This was due to inherent constraints of the universal traffic control system, which was not considered in the way Queensland Rail managed the risk of SPADs. (Safety issue)

Other finding

• The driver of train TE43 recognised signal CS025 was at stop just before they passed it, applied emergency braking and made an emergency radio call to network control. The signal after CS025 (CS027) ahead of train TE43 was also at stop. This red aspect, coupled with the associated automatic warning system activation, provided protection to the rear of train EM03. However, if train TE43 had passed signal CS027 with train EM03 occupying the replacement track, a SPAD alarm would also not have been generated by the universal traffic control system. 

Safety issues and actions

Central to the ATSB’s investigation of transport safety matters is the early identification of safety issues. The ATSB expects relevant organisations will address all safety issues an investigation identifies.  Depending on the level of risk of a safety issue, the extent of corrective action taken by the relevant organisation(s), or the desirability of directing a broad safety message to the Rail industry, the ATSB may issue a formal safety recommendation or safety advisory notice as part of the final report. All of the directly involved parties are invited to provide submissions to this draft report. As part of that process, each organisation is asked to communicate what safety actions, if any, they have carried out or are planning to carry out in relation to each safety issue relevant to their organisation.  The initial public version of these safety issues and actions will be provided separately on the ATSB website on release of the final investigation report, to facilitate monitoring by interested parties. Where relevant, the safety issues and actions will be updated on the ATSB website after the release of the final report as further information about safety action comes to hand.

Automatic warning system alert limitations

Safety issue number: RO-2023-004-SI-02

Safety issue description: The automatic warning system (AWS) provided the same audible alarm and visual indication to a driver on the approach to all restricted indications. The potential for habituation, and the absence of a higher priority alert when approaching a signal displaying a red aspect, reduced the effectiveness of the AWS to prevent signals passed at danger (SPADs). This placed substantial reliance on procedural or administrative controls to prevent SPADs, which are fundamentally limited in their usefulness.

Signals passed at danger risk management

Safety issue number: RO-2023-004-SI-01

Safety issue description: The signal passed at danger (SPAD) alarm for CS025 did not alert the network control officer when train TE43 passed the signal at stop. This was due to inherent constraints of the universal traffic control system, which was not considered in the way Queensland Rail managed the risk of SPADs.

Safety recommendation to Queensland Rail

The ATSB makes a formal safety recommendation, either during or at the end of an investigation, based on the level of risk associated with a safety issue and the extent of corrective action already undertaken. Rather than being prescriptive about the form of corrective action to be taken, the recommendation focuses on the safety issue of concern. It is a matter for the responsible organisation to assess the costs and benefits of any particular method of addressing a safety issue.

Safety recommendation number: RO-2023-004-SR-01

Safety recommendation description: The Australian Transport Safety Bureau recommends that Queensland Rail reviews the risk associated with a signal passed at danger (SPAD) in circumstances where the inherent constraints of the universal traffic control system do not alert the network control officer and the driver does not self‑report, and any additional risk controls that may be appropriate for the current signalling system.

Glossary

AWS	Automatic warning system
ETCS	European train control system
IMU	Interurban multiple unit
LOA	Limit of authority
NCO	Network control officer
QR	Queensland Rail
RTCD	Risk triggered commentary driving
RTO	Rail transport operator. Encompassed both rail infrastructure managers (track, signalling etc.) and rolling stock operators (locomotives, wagons etc.).
SEQ	Southeast Queensland operations
SMU	Suburban multiple unit
SPAD	Signal passed at danger (also known as a proceed authority exceedance)
TSD	Train service and delivery operations
UTC	Universal traffic control system

Sources and submissions

Sources of information

The sources of information during the investigation included:

• the train driver of TE43
• Queensland Rail

References

RISSB AS 7711:2018 Signalling Principles: Train control systems standard

RISSB Glossary of Terms

Australian Centre for Disease Control 2024, Coronavirus Disease 2019 (COVID-19): CDNA National Guidelines for Public Health Units. https://www.health.gov.au/sites/default/files/2024-06/coronavirus-covid-19-cdna-national-guidelines-for-public-health-units_0.pdf

Office of the National Rail Safety Regulator's Reporting Requirements for Notifiable Occurrences Guideline. Version 2. https://www.onrsr.com.au/operator-essentials/reporting-requirements/notifiable-occurrences

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• the train driver of TE43
• Queensland Rail
• Office of the National Rail Safety Regulator
• Queensland Government Department of Transport and Main Roads.

Submissions were received from:

• Queensland Rail
• Office of the National Rail Safety Regulator
• Queensland Government Department of Transport and Main Roads.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.