Executive summary

What happened

On 30 December 2020, Aurizon fertiliser freight train 9281, was travelling from Phosphate Hill to Townsville Jetty, Queensland. A short time, after commencing the downhill grade from 119 km towards Sellheim, train 9281 derailed while traversing over a culvert.

What the ATSB found

The investigation found that a series of rainfall events on the 29 December 2020, which included a heavy rain event between 1510 and 1615, compromised the drainage system at the 118.131 km. Water over-topped the track prior to the arrival and subsequent derailment of train 9281.

The corrugated metal pipe, that was an element of the drainage system at the 118.131 km, likely had rainwater throughput restricted. This was restriction was possibly due to sinking, debris from the upstream side blocking the corrugated metal pipe, or collapse of the corrugated metal pipe due to exceeding its service life, or a combination of the three, resulting in the rainwater pooling.

Extensive rainwater pooling resulting in over-topping of the track at the location of the corrugated metal pipe very likely undermined the track infrastructure, such that it could not support the weight of the rolling stock.

What has been done as a result

Following the derailment, Queensland Rail upgraded the culvert with three 900 mm corrugated metal pipes, which significantly improved drainage in the area. Queensland Rail is also considering actions around engineering studies, resilience works, and alternative and predictive weather monitoring.

Safety message

Rail infrastructure managers should ensure their drainage systems are fit for purpose, are clear, open, and in serviceable condition. This will minimise the risk of system inundation and track over‑topping.

The occurrence

Train 9261/9281 was a loaded fertiliser train, operated by Aurizon, travelling from Phosphate Hill to Townsville Jetty on the Mount Isa line in Queensland. The train departed Phosphate Hill as train number 9261 on 28 December 2020, before being renumbered 9281 from Hughenden on 29 December 2020. Both the drivers of train 9281 commenced work in Hughenden at 1815 Eastern Standard Time^[1]on 29 December 2020.

On 29 December, at about 1830, while travelling from Hughenden to Charters Towers, the rail traffic crew of train 9281 were asked by the network control officer to report on the weather conditions. The rail traffic crew reported they had not observed any flooding or adverse conditions on the journey. Prior to the passage of train 9281 from Charters Towers, there were 2 periods of rainfall recorded near the site of the derailment, one in the afternoon, and another in the evening.

On 30 December 2020, at 0016, train 9281 was travelling from Charters Towers towards Sellheim (Figure 1). A short time after commencing the downhill grade from 119 km towards Sellheim, 11 wagons, not including the locomotives and first wagon, derailed while traversing a culvert.^[2] As a result of the derailment, fertiliser was spilt into the waterway and towards a dam on a local property.

Figure 1: Location of the derailment

Source: Geoscience Australia, annotated by the ATSB

Context

Train

The train consisted of 2 locomotives, a 2800 class (2826) leading and a 4000 class (4046) trailing. The train was hauling 35 VFMQ class hopper wagons. The train was 562 m in length and had a trailing mass of 2,754 t and was crewed by 2 rail traffic crew, consisting of a tutor driver and a driver under route tuition.

Washout of track infrastructure

Evidence collected by Queensland Rail at the site of the derailment indicated it was the result of a washout of the track infrastructure. The washout was on the downstream beside a culvert and uncovered an old concrete abutment within the foundation (Figure 2).

Figure 2: Washout location

Source: Queensland Rail, annotated by the ATSB

Weather

The Mount Isa line from Mount Isa to Richmond, which is to the west of Charters Towers, is heavily impacted by adverse weather events during the monsoon season, which can close the line for periods of time. The closures allow water to dissipate from the rail corridor and inspection to be undertaken to ensure the line is fit for service. Areas east of Richmond, towards Townsville, are less impacted by adverse weather events. Queensland rail’s washout records have been kept since 1971 with no occurrence of washout or flooding recorded at the derailment site.

The northern Australian monsoon season generally lasts from December to March. The north Australian wet season encompasses the monsoon months but can extend several months on either side.^[3]

The Bureau of Meteorology (BoM) forecast for Charters Towers on Tuesday, 29 December 2020, issued at 0455:^[4]

Cloudy. Very high (95%) chance of showers, tending to rain. A thunderstorm likely with possible heavy falls. Light winds becoming north-easterly 15 to 20 km/h in the middle of the day then becoming light in the early afternoon.

The BoM record of total rainfall for 29 December 2020, indicated that near the site of the derailment, the intensity of rainfall from a series of rain events was in the range of 25–50 mm over the 24-hour period. (Figure 3).

Figure 3: 29 December 2020 Rainfall Total

Source: Bureau of Meteorology, annotated by the ATSB

The BoM weather station at Charters Towers, located about 8.5 km from the derailment site, recorded 33.2 mm of rain between 1500 on 28 December and 1500 on 29 December. A further 26.8 mm was recorded between 1500 on 29 December and 0900 on 30 December.

Weather radar data recorded a series of rainfall events at the derailment site in the 24 hours preceding the accident. They were during the periods 0105–0305 (light rainfall), 1310–1635 (moderate to heavy rainfall) and 1930–2210 (light rainfall) (Figure 4).

Figure 4: Weather radar rainfall intensity at derailment site over 24 hours

Source: The Weather Chaser, annotated by the ATSB

Queensland Rail weather monitoring systems for the region provided no alarms for flooding, significant rainfall or closed-circuit television camera images, which might have prompted a change in the operational status of the line.

The owner of a property, located about 800 m to the north of the derailment site, recorded about 84 mm of rain. The owner was in Charters Towers at the time, and was notified by their partner, who was at the property, at about 1520 on 29 December, that there was heavy rainfall. The owner stated that it was heavy rain (storm) that was isolated in a small area. The owner had last checked the rain gauge in the morning and noted the 84 mm after returning to the property from Charters Towers at about 1700.

The ATSB noted that there was a period of consistent moderate to heavy rainfall at the derailment site from about 1510­-1615. The 1600 weather radar data depicted a heavy rainfall event over the accident site, which passed between the weather stations at Charters Towers and Mingela (Figure 5).

Figure 5: Weather radar rainfall intensity at derailment site

Source: The Weather Chaser, annotated by the ATSB

A rainfall of 84 mm from 1510–1615 equates to 78 mm/h rainfall intensity.

The BoM Design rainfall data system 2016 provides design rainfall data based on intensity‑frequency-duration, and includes average recurrence intervals, which refer to how often a particular level of rainfall intensity can be expected to occur in years and probabilities. The BoM intensity-frequency-duration data for the derailment location near Charters Towers can be seen in Figure 6.

The 78 mm/h observed was greater than a once in 20-year event (71.9 mm/h), but less than 50‑year event (83.5 mm/h) for the Charters Towers weather station.^[5]

Figure 6: Bureau of Meteorology intensity-frequency-duration chart for Charters Towers

Source: Bureau of Meteorology, http://www.bom.gov.au/water/designRainfalls/revised-ifd/ accessed on 16 May 2022.

Drainage system

Drainage systems are designed to allow flow of water from known water courses under the track infrastructure, through a corrugated metal pipe (CMP) or other free-flow system, without adversely affecting the formation, ballast, sleepers, and rail. The drainage system located at the 118.130 km chainage was of a cross drainage design (Figure 7) with water flowing from a catchment area into longitudinal drains and progressing through a single CMP under the track infrastructure. The CMP was about 3 m below the rail head height (Figure 8).

Figure 7: External and local catchments, including cross drainage

Source: Rail Industry Safety and Standards Board, AS 7637 Hydrology and Hydraulics, Version 1.0, 2014

Figure 8: Drainage system

Source: Queensland Rail, annotated by the ATSB

Catchment area

The catchment area for the drainage system was about 200 m south of the rail corridor. Water flows from the catchment in a northerly direction, through the drainage system under the track infrastructure, and continues into a dam located about 800 m north of the drainage system, and about 180 m east of the home of the property owner.

The catchment area, south of the derailment site, as provided by Queensland Rail in their preliminary hydraulic assessment,^[6] was about 30 ha (300,000 square metres, Figure 9 dotted red line). Within a 30-ha catchment area, this would have produced about 23,400 m³/h, or 6.5 m³/s (based on 78 mm/h).^[7]

Figure 9: Drainage catchment system

Source: Google Earth, annotated by Aurizon and the ATSB

Construction of the culvert

Construction history

A 6 m single span timber bridge was built at the time or soon after original construction of the railway, circa 1882. At a construction date that was unknown by Queensland Rail, a 1.8 m long by 1.4 m high concrete floodway was constructed to replace the timber structure. Sometime between 1965 and 1980, a 1,050 mm CMP was installed at the location to replace the previous concrete floodway. Queensland Rail stated that it was likely constructed in the mid-1970’s.

Corrugated metal pipe

The rainwater from the catchment area was directed to a drainage system, which included a single 1,050 mm diameter by 8 m long CMP, which was of free-flow discharge and designed to be self-cleaning. The water then continued to flow north towards the dam and Gladstone Creek.

Based on the preliminary hydraulic assessment undertaken by Queensland Rail, the design flow rates of the CMP in the drainage system were between about 8 m³/s for a 50-year event and 9.5 m³/s for a 100-year event.

Corrugated metal pipe service life

Queensland Rail reported that the design life and the planned service life of CMPs was 50 years. Evidence provided showed the design life was determined for all CMPs, without consideration of local factors that could reduce the service life.

Service life of a CMP could be affected by pH soil levels, electrolysis and material/fluid passing through pipe, zinc or other coatings, wall thickness and method of installation.

Australian Standard AS/NZS 2041:1998 Appendix C provided guidance on factors that could affect service life assessment, such as:

• pH and resistivity of backfill
• aggressive backfill conditions
• atmospheric corrosion of exposed surfaces
• perforation of metal.

The service life of a CMP could be reasonably predicted based on the environmental conditions discussed above.

CMPs are galvanised using a zinc coating to prevent corrosion. The corrosion resistance provided by the zinc coating is in direct proportion to the coating's thickness. Current galvanising, in accordance with AS/NZS 2041.1:2011, is Z600 (600 g/m² minimum zinc coating mass). Discussions with a manufacturer of CMP’s determined that, mid 1970’s, the CMP probably had galvanised at a Z250 coating^[8](250 g/m² minimum zinc coating mass).

The studies conducted in the United States show that corrugated steel pipe has a life expectancy of 10 years to about 35 years before perforation of the metal occurs.^[9] Combined with the wall thickness, dynamic loads and infrastructure foundations, and backfill soils, the service life of a CMP may be less than the planned design life of the drainage system in its entirety.

Installation

The process for installation of CMPs from the mid-1970s to present day has evolved. There were no Australian rail industry standards in the 1970s for their installation. The Australian rail industry currently use AS/NZS 2041: Buried Corrugated Metal Structures and AS/NZS 2041.2: Buried Corrugated Metal Structures – Part 2: Installation.

During the installation of the new culvert, between 1965 and 1980, which, according to Queensland Rail, was likely in the mid-1970s, a concrete abutment that was part of the old concrete floodway structure, was not removed. Interviews with the Queensland Rail structures planners found that they were unaware that the concrete abutment was in-situ until it was exposed by the washaway and derailment. They noted that the location of the concrete abutment could have inhibited the compaction of the foundation and created a weakened area of earthworks.

Weather effect on corrugated metal pipes

With the cyclic dry-wet weather that occurs across the north of Australia, stressors from the passage of rolling stock would apply different dynamic loads to the drainage system and foundation. During dry weather, the foundation is hardened, and stressors from the dynamic loads would be applied across the foundation with minimal stressors applied to the barrel of the CMP.^[10]

During wet soaking weather, as occurred during December 2020, the foundation becomes more malleable, and with the softening of the soils around the CMP, the stressors would be applied more to the barrel of the CMP as rolling stock traversed over the track. For CMP’s to withstand significant fill loads^[11] and heavy repetitive dynamic loads, an effective soil-structure interaction is necessary. This composite behaviour uses the compressive strength of the culvert wall, with the compressive or bearing strength of the well-compacted soil surrounding the structure. As loads are applied to the culvert, the flexible structure attempts to deflect, with the vertical diameter decreasing and the horizontal diameter increasing.^[12]

Corrugated metal pipes may fail due to rolling stock inducing buckling or crushing of the CMP.  Factors such as overloading, corrosion of the CMP, soil loss from behind the CMP wall, and softening of the soil due to increased moisture content, the soil being washed away from around the CMP during wet periods and aging can contribute to a CMP failure. The soil can also be lost due to over-topping, loss of headwalls, as well as loss of soil through perforations in the culvert, or a combination of those elements.

Structures and track inspection

The Queensland Rail structures’ planners undertake detailed inspections of bridges, culverts, and associated drainage systems. Queensland Rail had 2 structures’ planners who usually undertook these inspections on the Townsville to Mount Isa and Phosphate Hill lines, which were conducted in accordance with the Queensland Rail Civil Engineering Structures Standard (CESS).^[13] The structures’ planners usually inspected about 370 drainage systems per fortnight. On average, the structures planners inspect about 8 drains per hour. Drainage systems with multiple CMP cells, or more defects, took longer to inspect. The planners had undertaken enterprise^[14] training with Queensland Rail and were deemed competent to undertake the tasks.

Detailed inspections

The CESS specified scheduled inspections, including that the Rail Infrastructure Manager shall determine the inspection interval for a structure based on the condition of the structure, the rate of deterioration, and local environmental factors. However, it also specified the intervals between scheduled inspections shall not exceed the maximum intervals specified. The CESS specified that ground level inspections of corrugated and sheet steel pipes, drains and arches were to be conducted at a maximum interval of 2 years.

In addition to the maximum interval, it also stated that:

The Rail Infrastructure Manager is to determine the interval according to the condition of the structure and the prevalence of damp silt and permanent water in the culvert throughout the year and an annual visual inspection just before the start of the wet season to check if the waterway is clear.

A detailed inspection in accordance with Appendix 1J of the CESS^[15] was undertaken between the 111.224 km and the 129.534 km in July 2019. Sections of the CESS have requirements for inspection of drainage systems, including inspection for corrosion of CMPs.

Between 30 March and 29 April 2020, the CMP at the 118.130 km to 118.131 km was identified as scouring and sinking, which was the location of the derailment. A corrective work order further noted that the gabion baskets on the right side were rolling off the CMP. The CMP was also noted as scoured and sinking on the right side, which was clarified by Queensland Rail as the downstream side of the CMP.

The sinking of the CMP would restrict the outflows of any rainwater that would be diverted to the culvert from the local catchment area. If the CMP was restricted, the design flows would be reduced, and rainwater would pool if input flow from the catchment exceeded the output flow. The report of sinking on the northern side indicated that the CMP was sinking on the downstream side, which suggested that the siltage would be at a greater depth at the outlet.

The work order stated the gabions were to be removed and replaced with two 4 m by 1 m by 1 m gabion baskets. This work was given a low priority of 26 weeks, which was in accordance with the CESS. The work order was closed at the time of the derailment, which indicated that the work had been completed. While the replacement of the gabion baskets would alleviate the scouring around the formation, they would not address the sinking of the CMP.

Cleaning and clearing of culverts

Queensland Rail had undertaken cleaning and clearing of their culverts about December 2020 in accordance with CESS Appendix 1J. Their records indicated that culverts were cleaned and the work order was closed on 6 December 2020. There were no dates in their records for individual culverts.

The cleaning and clearing should remove any debris and other objects from the upstream side of the culvert, preventing the foreign material from entering the CMP when rainwater from the catchment area flowed towards the culvert. The area cleaned was restricted to the rail corridor on the upstream side for as far as the structures planner decided was adequate to prevent debris from entering the drainage system. Any material from outside of the rail corridor could still be deposited into the culvert and the CMP during rain events that had enough volume and force to move the debris. If debris entered the CMP, it could become lodged and restrict the flow of water, resulting in a dam-like effect and subsequent pooling of water on the upstream side.

Pooling of rainwater at the culvert and scouring of infrastructure

Photographs provided by Queensland Rail show that there was debris located on the ballast shoulder on the upstream and downstream side of the track and between the rails, which indicated over-topping of the track infrastructure at that location (Figure 10). Water over-topping of the rail would likely create a waterfall effect and scouring on the downstream side of the track infrastructure (Figure 11). The waterfall effect could also cause the gabion baskets on the downstream side to slide over the exit of the CMP, thereby further restricting the outflows from the CMP.

Figure 10: Evidence of debris on ballast shoulder and between rails

Source: Aurizon, annotated by the ATSB

Figure 11: Evidence of scouring on the downstream (outlet) side

Source: Queensland Rail, annotated by the ATSB

Operational information

Track inspection

Queensland Rail managed the railway where the derailment occurred, with the movement of rail traffic controlled from the Queensland Rail Network Control Centre located at Townsville. The section between Charters Towers and Sellheim was inspected by a Queensland Rail road-rail vehicle at about 1000 on 29 December 2020. The track was certified as fit for service. Aurizon ballast train OCB3 travelled across the section from Charters Towers to Sellheim about 1220 on 29 December 2020 and reported no issues.

Event recorder data

The analysis of the event recorder from diesel electric locomotive 2826 was undertaken by the ATSB and found at 00:20:25 (event recorder time, incident time about 00:16) the equalising reservoir (ER) and brake pipe (BP) pressure simultaneously begin to decrease. This was a likely indication that the initial brake application was driver induced as the ER is generally a good proxy for driver BP request.

Track speed at the 118 km was posted as 60 km/h, however, there was a speed restriction of 50 km/h on the section. The approach speed of train 9281 at the derailment point was, based on recorded data, about 38 km/h. The driver applied the brakes at about 37 km/h, following the derailment, and the train travelled a further 137 m before coming to a complete stop.

Operations

During the travel from Hughenden to Charters Towers, the rail traffic crew were requested by the network control officer to observe weather and effects on the rail infrastructure. The rail traffic crew relayed information to the network control officer at several locations on the travel, with no areas of concern observed.

There were no anomalies identified with the train speed, handling, rolling stock condition, or operational performance preceding the derailment.

Queensland Rail’s management of operations in response to the wet weather event was generally in accordance with their existing policies and procedures.

Safety analysis

On 30 December 2020, Aurizon fertiliser freight train 9281, derailed while traversing a culvert to the east of Charters Towers, Queensland. There was no evidence to suggest that any medical or physiological factors affected the driver’s performance leading up to or during the incident, or that the driver’s actions or health contributed to the derailment. This analysis will discuss the localised weather event, over-topping, and undermining of the track infrastructure.

Localised weather event

The ATSB reviewed several sources of evidence for the rainfall on the afternoon of 29 December. A property owner reported that 84 mm was recorded at the property. The phone call to the property owner at 1520 about the heavy rain indicated that rainfall in the vicinity of the derailment site had started earlier than 1520. Weather radar imagery at 1600 (Figure 5) depicted heavy rainfall over the derailment site from a cell that passed between the 2 nearest weather stations of Charters Towers to the west and Mingela to the east. The weather radar time series charts captured moderate to heavy rainfall over the derailment site in the period 1510 to 1615. As this was consistent with the time the property owner received the phone call reporting heavy rain at the property, this was the likely period over which the heaviest rainfall occurred on the afternoon of 29 December.

The weather radar rain rate intensity marker timeseries is a qualitative indicator only, and therefore the actual rainfall in the vicinity of the derailment could not be determined from weather radar imagery. The rainfall at the weather stations of Charters Towers and Mingela were not considered to be reliable indicators for the derailment site as the weather radar imagery depicted a heavy rain cell pass between these stations and over the top of the site. Therefore, the 84 mm of rain reported by the property owner, over a 65-minute period, was the best measurement available.

Corrugated metal pipe failure

Cleaning and clearing inspections of CMP in the area of the derailment was completed on 6 December 2020, which likely included the incident CMP. Therefore, it was likely that the CMP was open and clear at the time of the incident.

Using the period 1510-1615 as the worst-case scenario for the entire 84 mm of rainfall in the gauge, produced an average rainfall intensity of 78 mm/h. Within a 30-ha catchment area, this would have produced about 23,400 m³/h, or 6.5 m³/s, which was less than the CMP design flow rate (of between 8 m³/s and 9.5 m³/s). As such, the drainage system should have been able to manage this flow of rainwater, through an unrestricted CMP.

The inside of the CMP was not photographed or inspected at the derailment site, and no other evidence was provided to verify the condition of the pipe post-derailment. Therefore, while the age of the CMP combined with the wet conditions suggested the possibility of a collapse, it could not be confirmed if a collapse had occurred or if the CMP had become obstructed by debris. However, the maintenance records for the CMP indicated it had been reported as sinking on the northern side (downstream side) and that no rectification work was performed prior to the derailment. Imagery from the upstream end of the CMP post-derailment also indicated a high level of silt build‑up around the inlet (upstream side).

While the amount of sinkage and build-up of silt pre-derailment could not be determined, it would nevertheless have reduced the CMP flow rate to below the design rate. It was therefore likely that the combination of a localised heavy rainfall event and restricted flow through the CMP resulted in the rainwater over-topping the track infrastructure.

Track infrastructure undermined

Prior to the localised heavy rain fall from 1510 on 29 December, the track was twice seen to be serviceable (road-rail track inspection and previous train). However, after the derailment of train 9281, debris in the middle of the track indicated the formation was over-topped by rainwater. This must have occurred in the afternoon of 29 December, after the passage of ballast train OCB3. Extensive pooling resulted in over-topping, very likely resulted in the undermining of the track infrastructure and the subsequent derailment.

Findings

From the evidence available, the following findings are made with respect to the derailment of freight train 9281 on 30 December 2020.

Contributing factors

• A series of rainfall events on the 29 December 2020, which included a heavy rain event between 1510 and 1615, compromised the drainage system at the 118.131 km and water over-topped the track prior to the arrival and subsequent derailment of train 9281.
• The corrugated metal pipe, that was an element of the drainage system at the 118.131 km, likely had rainwater throughput restricted due to sinking, debris from the upstream side blocking the corrugated metal pipe, or collapse of the corrugated metal pipe due to exceeding its service life, or a combination of the 3, resulting in the rainwater pooling.
• Extensive rainwater pooling resulting in over-topping of the track at the location of the corrugated metal pipe very likely undermined the track infrastructure, such that it could not support the weight of the rolling stock.

Safety actions

Safety action by Queensland Rail

Following the derailment, Queensland Rail have completed the following proactive safety actions:

• Upgraded the culvert with three 900 mm corrugated metal pipes, which significantly improved drainage in the area.
• Engaged a contractor to conduct a hydrology study to include the derailment area from Stuart, through Hughenden to Cloncurry, Mount Isa and Flynn to Phosphate hill. This package of works has now been completed.
• Commenced implementation of infrastructure reliance works that will form part of the outcome of the hydrology study. Notwithstanding significant works already completed as part of the last hydrology study including bridge strengthening in a number of locations.
• Identified a further 44 sites for new and upgraded weather monitoring equipment. A business case to request capital expenditure has been progressed. Approval has been given to implement a monitoring system that is currently under trial in the far north. This system provides a level of predictive information based on set points. It collates the data from all current available weather monitoring devices not currently utilised by Queensland Rail e.g. registered farmer rain gauges and also the Bureau of Meteorology. The system then notifies Queensland Rail via text that a specific set point has been hit.
• The condition affecting the network procedure has been reviewed and included the traffic light process to inform the broader business as to how Queensland Rail will be treating the event and train operators’ obligations.
• Implementation of an additional engineering study into flooding to cover previously unassessed areas of Mount Isa Line to include review of engineering basis for bridges and culverts.
• Implementation of infrastructure resilience works.
• Review of alternative weather monitoring technology and consideration of installation of additional weather monitoring stations.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Queensland Rail
• Rail traffic crew of 9281
• Bureau of Meteorology.

References

Ezzeldin I & El Naggar H 2022, ‘Numerical Modelling of Induced Stresses in Buried Corrugated Metal Structures Due to Compaction Efforts’, Transportation Geotechnics (100706), vol. 32.

Haviland JE, Bellair PJ & Morrell VD n.d., Durability of Corrugated Metal Culverts, Bureau of Physical Research, New York State Department of Transportation.

Rail Industry Safety and Standards Board 2014, Hydrology and Hydraulics, Version 1.0, AS 7637:2014.

Standards Australia 2011, Buried Corrugated Metal Structures Part 1: Design methods, Australian/New Zealand Standard AS/NZS 2041.1-2011.

Standards Australia 1998, Buried Corrugated Metal Structures, Australian/New Zealand Standard AS/NZS 2041:1998.

Wysokowski A 2021, Impact of Live Load on Changes of Backfill Properties of Buried Flexible Steel Railway Structure, Retrieved from https://doi.org/10.1007/s40515-021-00204-4.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Aurizon
• rail traffic crew of 9281
• Queensland Rail
• Office of the National Rail Safety Regulator.

Submissions were received from:

• Aurizon
• Queensland Rail
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1.  Eastern Standard Time (CST): Coordinated Universal Time (UTC) + 10 hours.
2.  A load bearing structure that supports the track, which conveys water under the railway or providing access for property owners, but not a bridge structure.
3.  Reference - http://www.bom.gov.au/climate/glossary/monsoon.shtml
4.  Bureau of Meteorology, Severe Thunderstorm Warnings issued for Northern Goldfields and Upper Flinders, 29 December 2020.
5.  The Queensland Rail internal investigation report concluded that between 2130 and midnight on 29 December, approximately 84 mm of rain in a 40-minute period had fallen from an undetected localised rain event. Queensland rail advised this was based on discussion with the landowner. The hydraulic assessment undertaken by Queensland Rail determined the rainfall intensity was about 126 mm/h (based on 84 mm in 40 minutes), which exceeded the average rainfall intensity for a 100-year event. The ATSB notes that both the time of the rainfall, and the duration, differ from evidence provided to the ATSB by the Bureau of Meteorology and the landowner.
6.  Preliminary Hydraulic Assessment – Culvert, Mount Isa Line at 118.13 km.
7.  As noted in footnote 5, the Queensland Rail internal investigation report concluded rainfall at 126 mm/h based on a discussion with the landowner. This would have produced 37,800 m3/h, or 10.5 m3/s.
8.  CMP Manufacturing Pty Ltd.
9.  New Jersey Department of Transportation, Bureau of Research, Corrugated Steel Culvert Pipe Deterioration, Final Report, August 2009.
10.  Wysokowski, A. Impact of Live Load on Changes of Backfill Properties of Buried Flexible Steel Railway Structure. Transp. Infrastruct. Geotech. (2021). https://doi.org/10.1007/s40515-021-00204-4.
11.  An essential element of composite soil-structure pipe and/or culvert systems is the backfilling process, where compaction efforts are applied to newly placed soil layers surrounding flexible CMPs.
12.  Queensland Transport and Main Roads, November 2015, Criteria for Inspection, Life Extension and Rehabilitation of Circular Corrugated Metal Culverts, Rev 2, p14
13.  Queensland Rail, Civil Engineering Structures Standard, MD-10-586, version 6.0, dated 8 June 2020
14.  Training provided internally by an organisation that is not aligned to Australian Industry and Skills Committee accredited training products.
15.  Queensland Rail, Civil Engineering Structures Standard, MD-10-586, version 6.0, dated 8 June 2020, p34

On 11 December 2020, a crew member (from Shandong, China) on Luzon Strait fell into the cargo hold and sustained fatal injuries. The Hong Kong Marine Department, Marine Accident Investigation Section (MAIS), is investigating the accident.

At the request of MAIS, the ATSB assisted with the collection of information relevant to the investigation. To protect any information supplied by MAIS to the ATSB, and the ATSB's investigative work to assist MAIS, the ATSB initiated an investigation under the Transport Safety Investigation Act 2003. The ATSB has now concluded its involvement in the investigation.

The Hong Kong Marine Department, Marine Accident Investigation Section is responsible for and will administer the release of the final investigation report into this accident. Any enquires relating to the investigation should be directed to the Hong Kong Marine Department at mdenquiry@mardep.gov.hk.

Investigation summary

What happened

On 7 December 2020, at about 1155 local time, SCT Logistics train 1MP9 was travelling on the Australian Rail Track Corporation (ARTC) network through Adelaide, South Australia en route to the SCT Logistics Penfield freight facility. 

As the train traversed a slight left curve in the southern approach to the Torrens Road level crossing the driver saw that road traffic was still passing over the crossing about 90 m ahead, and that the level crossing warning equipment had not operated for the approach of the train. The driver initiated an emergency brake application before continuously sounding the locomotive horn, warning road traffic of the train’s approach. Shortly after, the locomotive entered the level crossing and continued to travel a further 260 m before stopping. The trailing freight wagons from the train stopped on the level crossing and blocked the passage of road traffic. There was no collision with road traffic or injury to any person.

What the ATSB found

The ATSB found that, earlier that day members of a subcontracted signal team working on the adjacent Adelaide metropolitan passenger rail network (AMPRN) had undertaken temporary wiring alterations to the control circuits of 2 level crossings to facilitate track tamping work. A late change to the scope of track work required the signal team to undertake additional work to alter the control circuits at another level crossing located at Torrens Road. This scope change placed an increased work demand with short notice on the signal team to implement the pre-approved Torrens Road inspection and test plan procedure. The procedure required the installation of 3 temporary jumper wires, 2 of which were superfluous. The inclusion of avoidable wiring placed an unnecessary task demand on the signal team during the wiring installation stage.

Following the installation stage, the signal team tested the temporary wiring for compliance to the inspection and test plan. The methodology adopted by the signal team did not ensure independence between the installation and testing tasks. This resulted in a wiring error not being corrected and remaining in the Torrens Road level crossing control circuit as a latent condition that could affect the correct operation of the level crossing warning equipment.

The uncorrected wiring error, combined with another signalling system condition that later presented on the AMPRN, resulted in the control input from the ARTC network signalling system not activating the Torrens Road level crossing warning equipment for train 1MP9 as it approached the crossing. 

The ATSB established that the inspection and test plan that was used by the signal team did not include effective test procedures to verify and validate the safety integrity of the level crossing control circuits following the installation of the temporary wiring alterations. The South Australian Public Transport Authority reviewed and approved a package of level crossing inspection and test plans developed by their principal contractor, Acciona, which did not specify any requirement to test the altered wiring following installation. The effectiveness of any testing undertaken to control risk and assure the safety integrity of the rail infrastructure for trains operating on the ARTC network relied solely on the methodology adopted by the subcontracted signal team on the day.

What has been done as a result

Following the incident, Acciona undertook a risk assessment of the level crossing alteration works in consultation with the project stakeholders. New controls associated with works were incorporated into an updated construction work method statement that was subsequently submitted to the South Australian Public Transport Authority for approval. The controls addressed requirements for additional function testing activity and the potential for road closures where wiring alterations were required to facilitate track tamping work.

In December 2020, the Office of the National Rail Safety Regulator (ONRSR) published a notice to rail transport operators highlighting several incidents of the non-operation of level crossings on live lines due to incorrect isolation, and recommended operators ensure the completion of the key tasks specified in the notice.

The Rail Commissioner amended work instructions related to the temporary decommissioning and jumpering of signalling systems. Additionally, the Rail Commissioner worked with the contractor managing the AMPRN to develop improved procedures and forms for use in the temporary alteration of signalling systems.

The ARTC, although not directly involved in the installation of the jumpers at the Torrens Road level crossing, also reviewed and updated several ARTC engineering standards related to the modification of control circuitry of level crossings that were shared between operators. 

Safety message

The correct operation of the active warning equipment installed at level crossings forms the primary engineered risk control for the management of safety at the road-rail interface. A failure of the level crossing warning equipment to operate on the approach of a train introduces significant risk of a collision that may result in fatalities or serious injury to road users, train passengers and crew. 

Any installation or alteration of a signalling system introduces a potential risk to the safety of rail operations that may arise from a design or installation error. To manage the risk, signal designs typically underwent an independent review and approval process and the installed or altered signalling systems were then subjected to various levels of testing, dependent on the complexity of the system change. At a basic level these tests typically involved the certification of the system through the independent verification of the installed wiring followed by the validation of the systems control functions to ensure the safety of rail operations was maintained. 

It is essential that rail transport operators and rail safety workers plan, document, and implement effective testing systems and auditable practices to ensure that new or altered safety‑critical railway infrastructure is rigorously verified and validated to assure the safety integrity of the infrastructure being placed into service.

The occurrence

Overview of the track work

On 2 December 2020, Acciona[1] commenced a program of track work[2] on the South Australian Public Transport Authority (SAPTA) Adelaide metropolitan rail network (AMPRN) as part of the Gawler rail electrification project (GREP). The Acciona worksite was located on the Gawler up line[3] between the 2.7 km mark[4] at North Adelaide Station and the 8.5 km mark at Grand Junction Road, located north of Islington Station (Figure 1 ,detailing the stations within the work area). The Australian Rail Track Corporation (ARTC) interstate rail line ran parallel to the AMPRN through the worksite and was protected by the AMPRN level crossing warning equipment at each road crossing location.

Figure 1: Acciona Gawler rail electrification project worksite

Source: NationalMap, Australian Government, annotated by the ATSB

To facilitate the track tamping work, rail safety workers[5] from Rail Industry Constructions undertook electrical work on the AMPRN signalling system under a subcontract to Acciona. The electrical work involved the removal of track circuit[6] connections from the rails and if required, the installation of temporary jumper wiring to the control circuit of a level crossing that would be affected by the removal.

The Gawler up and down rail lines were closed to scheduled passenger services and the jumper wiring was to prevent the unintended operation of the level crossing flashing lights, gongs and boom barriers due to the track work on the AMPRN. On completion of the track work each day, the signalling system was reinstated to the original state.

The ARTC interstate rail line was open to train services and normal operation of the level crossing warning equipment was to be maintained for a train travelling on that line.

Prior to the arrival of train 1MP9

4 December 2020

On the morning of 4 December 2020, the Rail Industry Constructions rail safety workers comprised a tester in charge (TIC), a signal electrician and 2 trade assistants (signal team). The team attended the daily Acciona pre-work briefing where the TIC spoke with the Acciona possession protection officer (PPO) and other Acciona project representatives to determine the scope of the team’s work for that day. The agreed work involved the removal of connections from the rails and alterations to the Pym Street and Belford Avenue level crossing control circuits.

Following the briefing, the TIC and signal electrician travelled to the Islington relay room, located around 500 m north of the Islington station, and used the pre-approved inspection and test plans (ITPs) to install and test the alterations to the 2 level crossings. On completion of this work, they moved from the relay room to the rail track where, in conjunction with the remainder of the signal team, they removed the required connections from the rails in preparation for the track work to commence. 

At the end of the track work for that day, the signal team reinstated the connections and tested the track circuits. The TIC and signal electrician then went to the Islington relay room to remove the jumpers from the 2 level crossing control circuits before testing the correct operation of the associated warning equipment, as per the respective ITP. 

7 December 2020

On 7 December 2020, at about 0630 local time, the signal team attended the routine Acciona pre-work briefing. The scope of the work for the day was to again remove connections from the rails and alter the Pym Street and Belford Avenue level crossing control circuits. The TIC recalled that during the pre-work brief, the Acciona work group supervisor asked them to remove as many of the connections from the rails that they could toward the Dudley Park station.

The TIC and signal electrician travelled to the Islington relay room to alter the control circuits for the 2 level crossings. At about 0805, the TIC and signal electrician completed work and moved to the track to remove the connections from the rails between the Islington and Dudley Park stations, as they had done on the previous days. 

At about 1020, the signal team completed that work. Shortly after, the work group supervisor asked the TIC if they would also undertake alterations to the Torrens Road level crossing control circuit and remove additional connections from the rails, so that work could continue past Dudley Park station towards Torrens Road.

Although this work was not planned during the pre-work briefing, the TIC stated they felt an obligation to comply with the request and undertake the additional tasks, so the work group could recover from previous delays in their schedule. The TIC felt the signal team was under constant pressure to complete tasks and there was not an understanding from the tamping workgroup of the time needed to undertake the signal works. The TIC stated they agreed to the request on the proviso that the track work up to Dudley Park station be completed so that the signal team could start to reinstate the connections to the rails in preparation for testing the correct operation of the track circuit. 

At about 1032, the TIC telephoned the Acciona PPO to tell them that the track work was progressing well, and the work group would likely reach the Torrens Road level crossing later that day. The TIC also told the PPO they had agreed with the supervisor of the work group to expand the signal team’s scope of work to include the alteration of the Torrens Road level crossing control circuit. The TIC reached agreement with the PPO that they would first undertake the alteration of Torrens Road control circuit, before meeting with them to provide a completed infrastructure booking advice form (IBA).[7]

At about 1045, the TIC told the signal electrician of the change to the scope of work and that they would now install jumpers at Torrens Road, before returning to remove the additional track connections between Dudley Park and Ovingham stations. Shortly after, the TIC and signal electrician arrived at the Torrens Road level crossing and accessed the location case that housed the level crossing control circuit. 

The TIC and signal electrician positioned themselves at the front (Figure 2) and rear (Figure 3) of the location case (Loc 472) respectively to begin installation of the jumpers. The TIC kept the ITP, as was their usual practice, and called instructions to the signal electrician on where to connect the ends of each jumper wire. The ITP circuit diagram required 3 jumper wires to be installed. The TIC marked off the installation of each corresponding connection on the ITP as the work progressed. 

The rear view of location case 472 shows the temporary jumper wiring (red). The installation method for the jumper wiring was intended and meant to make temporary wiring conspicuous from other wiring installed at that location. 

Figure 2: Torrens Road location case (Loc 472) front view

Note: Location case 472 showing signalling control equipment, image modified by ATSB to annotate and remove graffiti tags from exterior of location case. Source: Acciona, annotated by the ATSB

Figure 3: Torrens Road location case (Loc 472) rear view

Source: Acciona, annotated by the ATSB

Following the installation of all the jumpers, the TIC operated the test switch[8] to check the correct operation of the level crossing warning equipment. The warning equipment functioned as the TIC expected. 

The TIC and signal electrician then left the Torrens Road level crossing location. The TIC went to meet the PPO to complete the IBA. The signal electrician went to the track and met with the 2 trades assistants in readiness to remove the electrical connections from the rails. 

At about 1120, the TIC and PPO completed the IBA for the work to the Torrens Road level crossing. Shortly after, the TIC contacted the signal electrician by telephone informing them that the IBA was complete, and they could commence removal of the connections from the rails.

During this work, connections to 572C track located between the Dudley Park and Ovingham stations were removed. The removal of the track connections caused an associated relay in the level crossing control circuit for the Torrens Road level crossing to also de-energise. 

Arrival of train 1MP9 at Torrens Road level crossing

At about 1155, SCT Logistics train 1MP9, travelling on the ARTC rail line, occupied the Torrens Road level crossing southern approach circuit. The ARTC signalling system detected the train and sent a control input to the AMPRN Torrens Road level crossing control circuit to activate the warning equipment. The warning equipment did not activate in response to the ARTC control input. The train, travelling at a speed of 44 km/h continued to approach the Torrens Road level crossing. 

At about 1156, as the train rounded a slight left curve about 90 m before the Torrens Road level crossing, the driver saw that road traffic was still crossing in front of the train and that the warning equipment had not activated. The driver immediately moved the automatic brake handle to the emergency position to apply maximum braking. About 45 m from the crossing the driver started to continuously sound the locomotive horn to warn road traffic of the train’s approach.

Train 1MP9 continued to brake, entered and travelled through the level crossing, narrowly missing a number of road vehicles before the lead locomotive stopped at the 5.25 km mark,[9] about 260 m north of the level crossing. Trailing freight wagons from 1MP9 blocked the Hawker Street and Torrens Road level crossings for the passage of road traffic.

Response to Torrens Road level crossing irregularity

At about 1158, the driver of 1MP9 made an emergency radio call to the ARTC network control officer (NCO) notifying the Torrens Road crossing warning equipment had failed to operate for their train and that there were several near misses with road vehicles as the locomotive passed over the level crossing.[10] The NCO instructed the train crew to remain in situ and wait for the arrival of support personnel to manage safety at the site (Figure 4).

Shortly after the incident, representatives from SAPTA, ARTC, Acciona, the Office of the National Rail Safety Regulator and South Australian Police attended the site. SAPTA representatives coordinated the onsite response, gathered evidence, and commenced an internal investigation. 

Rail vehicles from 1MP9 continued to block the Hawker Street and Torrens Road level crossing until about 1505, when, following agreement with SAPTA representatives, the ARTC NCO issued an authority to the train crew to continue their journey to the SCT Logistics Penfield rail freight centre.

Figure 4: Train 1MP9 at Torrens Road level crossing

Note: Level crossing south-eastern road approach. Source: Rail Commissioner

Context

Personnel information

Train crew

At the time of the incident, train 1MP9 was crewed by 2 drivers. Both drivers held route competencies that were current for the track section travelled. The health assessments of each driver were current, and they had both met the standard prescribed by the National standard for health assessment of rail safety workers without restriction. 

Signal team 

The Rail Industry Construction (RIC) signal team comprised the tester in charge (TIC), a signal electrician and 2 trades assistants. The TIC and signal electrician were rail safety workers, assessed to have the required competencies to undertake the rail safety work on the Adelaide metropolitan passenger rail network (AMPRN) signalling system. The statement of competency record for the TIC and signal electrician identified they had around 55 and 45 years of experience respectively undertaking rail safety work on signalling infrastructure. The experience included previous engagements and the successful completion of similar tasks on both the AMPRN and Australian Rail Track Corporation (ARTC) network signalling infrastructure.

The trades assistants were supervised by the TIC or signal electrician and were not qualified to undertake unsupervised rail safety work on the signalling equipment. Neither trades assistant was directly involved with work to implement the Torrens Road inspection and test plan (ITP).

The signal electrician and TIC underwent health assessments as per the requirements of the National standard for health assessment of rail safety worker as a rail safety worker category 1 and 3 respectively. Although there were anomalies with the TIC’s health assessment category and currency, there was no evidence the TIC or signal electrician health assessment categorisation or any physiological condition present at that time influenced the incident at Torrens Road.

In the week prior, the TIC and signal electrician worked between 8.5 and 12 hours each day on the Gawler rail electrification project (GREP) undertaking the signalling alterations to facilitate the track tamping works (see Appendix A – Fatigue risk management program). These hours were generally consistent with the Acciona fatigue management guidelines (10 to 12 hours per day up to a maximum cumulative total of 60 hours per week).

The Acciona Alliance rail safety management plan outlined the procedures put in place to satisfy the accreditation requirements of the Rail Commissioner[11] (RComm). In particular, the competency, health and fitness, and fatigue management programs applicable to the GREP rail safety workers of Acciona, and subcontractor RIC. For additional information related to each program see Appendix A – GREP safety management system procedures.

Train information

SCT Logistics train 1MP9 comprised locomotives CF4430, CF4410 and CSR002 hauling 46 rail vehicles. The train was 1,773 m in length and had a gross mass of 4,561 tonnes. The train was travelling from Dooen, Victoria to the SCT Logistics Penfield rail freight centre near Adelaide, South Australia. 

Railway infrastructure

The Australian Rail Track Corporation

The ARTC interstate rail line at Torrens Road consisted of a single standard gauge (1,435 mm) rail track. The track was constructed using continuously welded rails secured to concrete sleepers by resilient fasteners and supported on crushed rock ballast.

The signalling system enabled the bi-directional operation of rail traffic. The system incorporated level crossing controls that functioned independently from the signalling system on the adjacent AMPRN. Rail traffic approaching Torrens Road level crossing on the ARTC rail line triggered a level crossing control, which then provided an input to the AMPRN signalling system to activate the level crossing warning equipment, and the road traffic light signals.

South Australian Public Transport Authority 

The AMPRN at Torrens Road consisted of 2 broad gauge (1,600 mm) rail tracks. The tracks were constructed using continuously welded rails secured to concrete sleepers by resilient fasteners and supported on crushed rock ballast.

The Torrens Road level crossing was located on an arterial road near the north-western fringe of the Adelaide central business district. The rail track infrastructure of the AMPRN and ARTC network ran in parallel at that location (Figure 5). 

The configuration of the signalling system for the AMPRN enabled passenger rail traffic to principally travel in either an up or down direction[12] on the respective track. The Torrens Road level crossing control equipment could be configured locally[13] to enable the automatic operation of the warning equipment to facilitate single line bi-directional working (with limited functionality). Prior to the implementation of single line bi-directional working, an alternative method of safe working was required for the management of rail vehicle movements.

All rail tracks were protected by flashing lights, gongs and half boom barriers mounted to mast assemblies. In addition, several mast assemblies were equipped with 3 aspect road traffic light signals. The traffic light signals interfaced with the railway level crossing control system and other road traffic light signals at an adjacent road traffic signalled intersection, located about 100 m to the south-east. The traffic light signals controlled the flow of road traffic to prevent queuing of road vehicles across the rail tracks at the Torrens Road level crossing.

The Torrens Road flashing lights, gongs, half boom barriers, and the associated trackside signalling and communication systems were operated and maintained by the South Australian Passenger Transport Authority (SAPTA) under the rail safety accreditation of the RComm.

Figure 5: Road and rail track layout at Torrens Road level crossing

Source: Google Earth, annotated by the ATSB

Gawler rail electrification project

Overview

The GREP works were managed by the South Australian Department of Infrastructure - Transport project delivery (TPD) and undertaken under the RComm rail safety accreditation. The RComm, SAPTA and TPD were all departments or bodies under the South Australian Department for Infrastructure and Transport (Figure 6). Relevant SAPTA safety management system standards, procedures and work instructions for the AMPRN signalling and communications systems were adopted by TPD to manage the GREP works.

Figure 6: AMPRN rail network and GREP project organisation structure

Source: ATSB

The TPD delivered the GREP works through the principal contractor, Acciona, managing the project alliance safety management plan. Acciona initially engaged subcontractor RIC to undertake works associated with the provision of electrical conduits and pits for the project. Acciona later varied the subcontract with RIC to include the provision of qualified rail safety workers to undertake project work as directed by Acciona. Specifically, the alteration and testing of parts of the level crossing control circuitry, and removal and reinstatement of connections to the rails in the areas affected by the GREP track works. The operation of rail maintenance and construction vehicles used in conjunction with the GREP work site was under the Acciona rail safety accreditation as a rolling stock operator. Acciona was not accredited in South Australia as a rail infrastructure manager (RIM).

The roles, responsibilities, authorities, accountabilities and general safety duties applicable to the various parties involved in the contractual arrangements to deliver a rail project, such as the GREP, were outlined in the Rail Safety National Law – South Australia Act 2012 (RSNL) and associated guideline documents published by the Office of the National Rail Safety Regulator and the Rail Industry Safety and Standards Board.

The RSNL incorporated the principles of shared responsibility and accountability in contractual arrangements and highlighted that the management of rail safety was the shared responsibility of everyone involved in undertaking the required rail safety work. The degree to which a person was accountable for rail safety was dependent on the nature of the risk their activities might pose to rail safety. The management of risks associated with railway operations was therefore predominantly the responsibility of the person best able to control them. 

Additional information related to the RSNL and guidelines for contracting arrangements are contained under Appendix B – Contracting in the rail industry.

Procedures for temporary signalling system alterations

To manage potential risks to rail operations when undertaking temporary wiring alterations to the level crossing control circuits, RIC developed documentation that defined the project scope and responsibilities, work method statements, and the ITP specific to each level crossing location.

Level crossing inspection and test plan approval procedure

On 23 September 2020, representatives of Acciona, TPD and RIC met to establish the procedure that Acciona would follow to submit the draft ITPs, which included the level crossing control circuit schematic drawings to TPD for approval. 

The agreed procedure (Figure 7) required Acciona to submit the draft ITPs for all the affected level crossing locations as a single package. TPD was then to forward the package to SAPTA for review and final approval. Once approved, SAPTA would endorse a network access authority application (NAA) to allow the RIC rail safety workers (the signal team) access to the AMPRN to commence work onsite.

Figure 7: Inspection and test plan approval flowchart

Source: Acciona

During the meeting, TPD identified that the work to isolate (decommission) level crossing functionality was ‘specialised works’ and that the SAPTA procedures for installing temporary wiring, testing, and commissioning activities were to be followed by the signal team. 

Although this requirement was identified during the meeting, neither TPD nor SAPTA provided Acciona or RIC with a copy of the SAPTA work instruction WI-AM-SP-1234 Signalling system temporary decommissioning and jumpering or the SAPTA forms FO-AM-SE-1226 Inspection and test plan template and FO-EM-SE-1226 - Amendment log for their reference or use in the development of the GREP signalling procedures for the specialised works specific to the level crossings (see SAPTA signalling system temporary decommissioning and jumpering work instruction).

To develop the draft ITPs, RIC adapted a SAPTA ITP document sourced from a project RIC had previously undertaken for TPD on the AMPRN. The formatting of the ITP document was generally consistent with the SAPTA form FO-EM-SE-1226 and included sections related to the:

• document and version control
• plan approval and the allocation of roles and authority to implement the plan
• master test plan listing in sequential order the equipment and a description of the required task to be undertaken
• certification by the TIC of the tasks and related testing activity that were complete.

RIC representatives also prepared 2 copies of the relevant control circuit diagrams for each level crossing installation. One copy showed the jumpers (marked up in red) to illustrate the required termination point of each wire in the control circuit. The second copy showed the jumpers (marked up in green) to illustrate the wires that must be removed following completion of the track work for that day. A fresh copy of the ITP and circuit diagram package was produced for each occasion where modification of a level crossing control circuit was necessary.

On 25 September 2020, the RIC representatives[14] who had either produced, checked or approved content, signed off on version 1 of the draft ITP for each of the level crossing installations the GREP track work program would affect. Acciona subsequently submitted copies of the draft ITPs by email as a single package to TPD for forwarding to SAPTA for review and final approval, as per the ‘one review gate process’ in the approval flowchart. 

Signalling work scope procedure

On 15 October 2020, RIC developed the GREP Tamping project signalling methodology document to describe the scope of work for the project, the network access arrangements and the division of responsibilities between Acciona, RIC and SAPTA for managing the affected signalling infrastructure. 

The document specified that RIC would provide suitably competent staff (the signal team), and that prior to the commencement of any site activity, these staff would attend the daily Acciona and PPO pre-work briefings. During the pre-work briefings, RIC staff, in this case the TIC, was required to notify SAPTA maintenance staff and the PPO of the proposed location of work and the tasks to be performed that day. The document also specified that under no circumstances was the signal team to undertake any signalling work until the TIC had an Infrastructure booking advice (IBA) in place with the PPO (see Procedure for implementing an infrastructure booking advice.).

After implementation of the IBA, the scope of work specified the signal team was responsible for:

The disconnection of equipment and installation of temporary bridging [jumpers] to ensure that the level crossings remain working for ARTC trains will be carried out as per the approved ITP’s and recorded in the ITP’s.

On 20 October 2020, the TPD signal site manager approved the content of the signalling methodology document, which specified the signal team was to carry out the instructions contained in the approved ITP. The methodology document also specified that track circuit maintenance record cards and the ITP documents must be completed as each piece of signalling infrastructure was tested and certified and that photographic records were taken of the locations before commencement and on completion of works. 

While the review and approval process for the tamping project signalling methodology document was ongoing, the ITPs referenced in the document were still in draft format, having been forwarded by TPD to SAPTA for review and approval the day prior to the finalisation of the methodology document. 

Approval of draft inspection and test plans

On 22 October 2020, SAPTA responded to TPD requiring amendments to several ITPs that were identified to contain errors.[15] The review found no error or omission in the Torrens Road ITP document or circuit diagrams.

On 26 October 2020, Acciona resubmitted the corrected ITP packages.

On 30 October 2020, the SAPTA again responded highlighting 3 of the packages[16] still contained errors and required Acciona to correct and resubmit. SAPTA advised Acciona that the NAA for the track work would be withheld until the identified errors were corrected and the affected packages resubmitted for approval.

SAPTA communicated the outcome from the review process via a series of emails through TPD to Acciona. There was no record in the emails or respective electronic copies of the ITPs that SAPTA was satisfied the proposed testing arrangements managed risk, were consistent with the requirements of the SAPTA work instruction Signalling system temporary decommissioning and jumpering or that SAPTA had approved (certified) each ITP for use on the AMPRN. However, SAPTA did approve the NAA for the signal team to access the AMPRN and undertake the specialised work on the signalling system in accordance with the ITPs.

Although there were a series of amendments that occurred to some of the ITP documents to correct details related to the termination point of the jumpers, the document control version number and date recorded in the electronic copy of the respective documents remained as version 1 of 25 September 2020. 

RIC subsequently provided the TIC with hard copies of the packages for each level crossing installation affected by the GREP. The package for each level crossing installation comprised a document describing the required plan for completing the inspection and test tasks and 2 copies of the circuit diagram marked up in red and green. None of the packages included a copy of the SAPTA forms FO-EM-SP-312 Signal circuit jumpering decommissioning or FO-EM-SP-313 Amendment log. Dependent on the planned track tamping work for that day, the TIC was then required to select and implement the relevant ITP. 

The hard copy of the ITP documents subsequently issued by RIC for the TIC to implement, contained no record to identify the documents were the final version approved by SAPTA for use on the AMPRN. The TIC later reflected that the practice of issuing ITP documents without records of final certification by the RIM (in this case SAPTA) was unusual, but appeared normal for that particular operator.

Construction work method statement – track works

On 6 November 2020, Acciona released an updated version of the construction work method statement (CWMS) for the tamping and regulating track works on the AMPRN. The CWMS described the resources, processes and methodologies Acciona would use to undertake the track work on the Gawler rail line. The CWMS was developed to identify and control any risk that may arise during the works and document how these would be addressed.

The CWMS recorded that Acciona assumed the policies and procedures within the Acciona management systems were compliant with the requirements of the RComm rail safety accreditation. However, Acciona noted that, although the works were undertaken under the accreditation of the RComm it did not absolve Acciona from its responsibilities under the RSNL.

The CWMS detailed the planned scope of works and arrangements that included the identification of resource requirements, risk assessments, work health and safety, methodology procedures, and inspection and test plans to undertake the tamping and regulating work on the AMPRN. There was no consideration in the CWMS of the subcontracted work to RIC associated with the removal/reinstatement of connections to the rails or modification to the level crossing control circuity.

Although the engagement of RIC to undertake alterations to the signalling system was not specifically identified in the CWMS, the documentation developed by RIC for the identification of resource requirements, risk assessments, work health and safety, methodology procedures, and ITPs were generally consistent with the practice detailed in the CWMS. 

Procedure for the installation of the temporary wiring

On 16 November 2020, RIC submitted a safe work method statement (SWMS)[17] to Acciona detailing how the connection, installation, termination and test and commission tasks were to be performed on the AMPRN signalling infrastructure. The SWMS outlined the worker competencies, site supervision arrangements and associated reference documents (NAA forms, approved tamping project signalling methodology and ITPs) necessary to undertake the work.

The SWMS listed the various steps involved in performing each task, identified the hazards and risk assessed the related controls. The resulting residual risk rating for the various steps was assessed as being either medium or low, dependent on the task. However, the overall risk assessment for the SWMS determined the work activity was high risk.

The potential hazards and associated controls were primarily focused on managing work health and safety implications and not the operational hazards and risk to rail safety that may arise from the modification of vital signalling control systems. 

The SWMS did not address the requirements of the SAPTA work instruction Signalling system temporary decommissioning and jumpering, particularly in relation to managing the potential risk to rail safety for the adjacent ARTC network. There was no record Acciona, TPD, SAPTA or RComm had reviewed and approved the use of the SWMS document for the GREP works.

Procedure for implementing an infrastructure booking advice.

The TPD provided Acciona with a copy of the SAPTA AMPRN Train rules and procedures Volume 4 - Work on track rules and procedures. The document contained instructions to rail safety workers on the requirements and procedures to compile an infrastructure booking advice (IBA) form. The IBA must be used wherever infrastructure was:

• permanently installed or commissioned
• permanently decommissioned or removed
• temporarily removed from service
• returned to service following temporary removal from service.

The procedure provided various options to complete the IBA, one of which allowed the operations controller and rail safety worker to jointly compile the IBA. This allowed completion where the parties were remote from each other. If the rail infrastructure work was within a work site under the control of a PPO, a copy of the IBA was to be provided to the PPO before any equipment was either ‘booked out’ or ‘booked into’ service.

In this instance, the Gawler rail line was closed to rail traffic for the GREP track work and the worksite was under the control of a PPO. Under this arrangement the requirements of the AMPRN train rules were reflected in the GREP Tamping project - signalling methodology procedure, which required the TIC on arrival to contact the PPO and advise of the location of works and tasks to be undertaken. It also specified that no work be commenced unless the TIC had an IBA in place with the PPO. There was no mention in the methodology procedure of a requirement to provide a copy of the completed IBA to the PPO.

The IBA completed following the alterations to the Torrens Road level crossing control circuit recorded that the level crossing warning equipment would be operational by the test switch only for the AMPRN lines (indicating both up and down). This statement was only partially correct since the temporary control circuit modifications, detailed in the ITP, bridged control functions on the AMPRN up line but retained the down line control function. 

The purpose of the IBA document was to communicate and record the intended status of critical rail infrastructure or equipment to the operations controller or PPO controlling the movement of rail traffic, which may be affected by the proposed infrastructure changes. 

The IBA process, as applied to the GREP, considered only the infrastructure and equipment alterations that were planned to be affected by the work, in this instance the AMPRN Gawler rail line level crossing up direction approach. As the ARTC network was not intended to be affected or removed from service, there was no requirement stipulated in the IBA for the TIC or PPO to notify the ARTC network operations controller and advise that an alteration was made to the control circuitry of the level crossing protections shared by the 2 networks.

SAPTA signalling system temporary decommissioning and jumpering work instruction

The SAPTA work instruction Signalling system temporary decommissioning and jumpering specified the processes a qualified SAPTA employee must undertake to temporarily decommission signalling system infrastructure on the AMPRN. Decommissioning included the installation of circuit jumpering and the removal of track circuit connections, the same type of specialised work that SAPTA identified was to be undertaken by RIC for the GREP.

The SAPTA work instruction specified the roles and responsibilities of a SAPTA employee (rail safety worker) undertaking the specialised work as:

• Qualified employees are responsible for ensuring signalling assets are decommissioned using the process below. Qualified employees performing temporary decommissioning and jumpering shall ensure another qualified employee is available on site to verify correct installation of jumpers. Qualified employees shall ensure all documentation associated with temporary decommissioning and jumpering contains complete and accurate information.
• Where temporary jumpering affects adjacent railway (i.e. ARTC), personnel shall ensure the rail transport operator has been made aware of the work being undertaken. Where signalling functions on adjacent lines are required to remain active (i.e. level crossings isolated for AMPRN line but should operate for ARTC movements), the correct operation of those functions shall be verified by the qualified employee performing the decommissioning/jumpering.

Additionally, the instruction detailed the processes a qualified employee was to follow when undertaking either unplanned or planned decommissioning work. Unplanned or ‘emergency work’ covered situations where it was not possible to develop and use a pre-approved ITP, due to the unpredictable nature of the work and the resultant time constraints in responding to the particular emergency. 

In such cases, the qualified employee was to first consult with the operations controller for that particular location to inform them of the signalling infrastructure affected. The qualified employee was then to record any decommissioning or reinstatement work undertaken on the signalling system infrastructure form FO-EM-SP-312 Signal circuit jumpering decommissioning (Figure 8). The qualified employee was required to include detail for the:

• identification of the qualified employee actioning the work including their qualification
• identification of the qualified employee verifying the work including their qualification
• notification to the operations controller of that area and the identification of the equipment to be decommissioned
• description of the proposed task (that is, detailing the circuit functions jumpered and track leads removed)
• verification by another qualified employee.

Figure 8: Example form – SAPTA signal circuit jumpering decommissioning 

Source: South Australian Public Transport Authority

For occasions where the decommissioning works were able to be planned, the work instruction required the:

• correlation of affected signalling circuits prior to the ITP development (to ensure accuracy of the control circuit drawings)
• preparation and certification of an ITP by a qualified employee that recorded any decommissioning or reinstatement work to be undertaken on the signalling system infrastructure
• independent review to check and certify the ITP prior to issue
• inclusion of the form FO-EM-SP-312 Signal circuit jumpering decommissioning
• TIC or qualified employee responsible for executing the plan to take receipt of the ITP
• decommissioning work to be actioned in accordance with the approved ITP for that project or works
• amendment (if required) to the ITP be recorded on form FO-EM-SP-313 Amendment log. Any amendment was to be independently verified.

For planned works, the work instruction required both the development of an ITP form and the inclusion of form FO-EM-SP-313. The format of the ITP and FO-EM-SP-313 form templates included duplicated information related to the required tasks and records to be kept. The work instruction did not specify how the template forms were to be used together when planning work in advance.

In summary, SAPTA required a qualified employee (rail safety worker) undertaking either unplanned or planned decommissioning work to ensure that: 

• another qualified employee was available onsite to verify the correct installation of jumpers 
• all documentation associated with temporary decommissioning and jumpering contained complete and accurate information
• the correct operation of those functions was verified [validated] by the qualified employee performing the decommissioning/jumpering
• where signalling functions on adjacent lines were required to remain active (that is, level crossings isolated for the AMPRN line but should operate for ARTC movements), the correct operation of those functions was to be verified by the qualified employee performing the decommissioning/jumpering.

Industry standards for signalling testing and commissioning plans

Overview

The Rail Industry Safety and Standards Board published standards AS-7717-2016 Signal testing and commissioning and AS-7716-2017-Signal testing process. These standards were to provide rail transport operators,[18] such as the RComm, with a common framework to plan and execute the inspection, testing and commissioning activity for new and altered signalling infrastructure on their respective networks. 

Signal testing and commissioning

Standard AS-7717-2016 defined the range of inspection and test activities necessary for a rail transport operator to certify the safety of the new or modified signalling system before placing it into service. These included the testing activity required following minor works, such as alterations for the installation and removal of temporary jumper wiring to level crossing control circuits. 

Such alterations were to be tested in accordance with the standard considering the type, extent, and risk associated with the particular alterations being made. The nature of the testing and commissioning activities could vary dependent on requirements determined by the accredited rail infrastructure manger,[19] which for the AMPRN and associated GREP works was also the RComm.

The standard stipulated the railway organisation and its management structure together with the planning process and staff competence were each critically important to ensure the railway signalling systems were safe for the operation of trains. The requirements for the planning process included elements such as:

• the production of formal documentation of the required activities and tasks
• the allocation of responsibilities and the personal competencies required to undertake the tasks
• the independence required for people’s involvement among the different parts of the work
• the documentation to be used for the testing and commissioning plans.

The overall objective was the development of a detailed ITP, which documented the processes, work activities, and the controls implemented to achieve the requirements of the standard, using an agreed format. 

For the GREP works, the subcontractor, RIC, identified and undertook the development of the ITPs for each level crossing installation. These plans were then forwarded through Acciona and TPD to SAPTA for approval.

Identification of interfaces outside the commissioning boundaries

Standard AS-7717-2016 also required that before inspection and testing activities commenced at sites containing signalling equipment that was in use, the RIM was to be informed of the extent and program of work. Additionally, consideration should also be given to elements outside of the defined boundaries of the commissioning area. 

For the GREP level crossing works, the TPD and SAPTA were aware of the extent of the works, and inspection and testing activity through the approval of the GREP Tamping Project Signalling Methodology document and the coordination activities through the TPD onsite project manager. 

Interfaces outside the GREP boundaries were managed through the rail-to-rail interface agreement[20] between SAPTA and ARTC. The agreement managed the identified risks to safety that may arise from railway operations carried out by either operator (SAPTA or ARTC) that would affect the other at the shared road-rail interfaces. The agreement included the interface at the Torrens Road level crossing.

The agreement required each operator to provide advance notice to the other, prior to commencing any works likely to materially affect the other operator’s rail network. To address this requirement, Acciona, via TPD, provided ARTC advance notice of the proposed GREP work in the format of a draft train notice.

On 1 December 2020, ARTC published train notice TN2925 advising train crew operating on the ARTC network that tamping works were to be undertaken on the adjacent AMPRN. The notice contained the following information:

• The GREP project will be undertaking tamping and regulating works on the Gawler line between 2.7km to 8.5km (AMPRN km) on both the up and the down track. The works will have no impact on ARTC line and there will be no potential to foul ARTC.
• As part of the works some ballast will be placed inside the corridor North of Ovingham Railway station using the access gate on the ARTC side (at least 3m away from the tracks) and a loader will be intermittently at the stockpile area to load trucks with ballast under TOA [track occupancy authority] between trains.
• The Qualified Rail Safety Worker will be required to take out adjacent line protection TOA [track occupancy authority] ATP [as traffic permits] when operating the Ballast Regulator Side Wing Plough on the Down Main Line.
• The works will have no impact on ARTC Network Services or Operations.
• The Qualified Rail Safety Worker will ensure that communications are made with the Network Controller prior & post work.

The notice indicated that the proposed tamping works would have no impact on the ARTC network nor the potential to obstruct traffic operating on that line.[21] Neither the notice, nor other communication between Acciona, TPD or SAPTA and ARTC identified that temporary alterations would occur to the level crossing control circuity of the shared level crossings in the work area between North Adelaide and Islington, encompassing Torrens Road. 

Requirement for independence of persons undertaking testing activity

The planning and implementation of an effective inspection and test regime was a critical element to reduce risk to rail safety associated with undertaking works on vital signalling control equipment. This required the development of ITPs that must include sufficient tasks to support the verification[22] and validation[23] of any new or altered safety‑related signalling system. The standard required:

These verification and validation processes shall be performed at an appropriate level of independence from the construction and implementation process to be verified and validated. The degree and nature of this independence shall be determined by taking into account at least the following factors:

(a) The risk of errors being perpetuated during the verification and validation process due to there being too close an association between the persons performing the verification and validation and those involved in the construction and implementation process.

(b) The risk imposed on the existing system both by the introduction of the system to be verified and validated and by faults or inconsistencies in that system.

The TIC and signal electrician worked together in undertaking both the installation of the temporary jumper wiring and the verification and validation testing of the level crossing control circuitry. Although, in this instance there was close association between the persons performing the work, the standard allowed this arrangement through placing a higher weighting on competence of organisations rather than independence provided: 

…where independence cannot be achieved other controls should be considered to assure any additional risk due to a lack of independence is controlled. If it is not possible to achieve independence, then approval shall be given by the RIM [rail infrastructure manger] of the alternative control measures that will be used to control the additional risk due to the lack of available competent independent resources

Other than reviewing the draft ITPs, there was no record of SAPTA assessing the competencies of the rail safety workers undertaking the signalling work. Further, there were no alternative control measures implemented to manage the risk due to the limited availability of other competent independent resources to undertake an independent inspection and test activity.

Signal testing process

The second standard, AS 7716-2017 signal testing process, provided greater detail of the types of testing methods and procedures that may be used when commissioning typical signalling apparatus and systems. Emphasis was again placed on the importance of maintaining independence between the performance of the installation and testing activities. Although the standard described the minimum requirements for undertaking inspection and testing activities, it did not diminish the obligation of the verification, validation and test personnel to decide what should be tested and how it should be tested respectively. 

The types of testing methods and procedures were grouped under post‑installation testing, which was to independently verify the new or altered work was built in accordance with the design documentation (in this case the circuit diagram) and secondly, the function testing and validation phase, which proved the new or altered work performed as designed.

Installation testing verified the system was built in accordance with the design required testing include the following:

• detailed circuit testing
• cables testing
• apparatus testing.

System testing and validation included the following:

• [design] function testing
• testing to control tables[24]
• aspect sequence[25] testing
• [design] principles testing.[26]

For the GREP level crossing works, RIC provided the TIC with a pre-approved suite of ITPs to specify the tasks they were required to perform to install/remove temporary jumpers, and for the testing and validation of the altered control circuit to ensure the level crossing warning equipment functioned as the design intended. 

Torrens Road inspection and test plan

Overview

The Torrens Road ITP document specified the processes approved by the RIM that RIC (TIC and signal electrician) would undertake for the planned temporary decommissioning of critical signalling system infrastructure (see Appendix C – Torrens Road inspection and test plan). The ITP was divided into 3 sections that contained the:

• details for the document version control, plan approval signatures and allocated responsibilities to undertake defined roles
• verification tasks to ensure the sign-off acceptance for the allocated responsibilities and confirmation of safe working and IBA arrangements
• master test certificate tasks to confirm safe working arrangements and the specifications for the sequence of installation and inspection and test activities the TIC was required to coordinate and sign off as completed.

Plan implementation

The verification section of the Torrens Road ITP document required the TIC to ensure documents were attached and details of allocated responsibility completed. The section also required the TIC to confirm that safe working procedures were in place and to ‘take out’ an IBA before commencing work. The latter, in compliance with SAPTA rules, would include direct communication between the TIC and operations controller prior to the commencement of any work to alter signalling infrastructure.

On this occasion, the worksite was under the control of a PPO and there was no direct contact between the TIC and operations controller. The TIC and PPO, however, did not follow either the signalling methodology or IBA procedures, which required the completion of an IBA form prior to the commencement of work. The TIC and PPO instead agreed verbally to complete the jumper installation, before meeting later that morning to complete the IBA. Although the TIC had undertaken several actions to address the various safe working, IBA, and other tasks in the verification section, those tasks were not signed off in the plan document as complete. 

Temporary jumper wiring installation 

The plan detailed the series of tasks to be coordinated by the TIC that related to the temporary jumper installation (Figure 9). 

Figure 9: Master test certificate, section 2 page 1 of the Torrens Road inspection and test plan

Note: Extract of the SAPTA‑approved ITP specifying the required tasks and records to evidence completion of that task. Source: South Australian Passenger Transport Authority, annotated by the ATSB

The ‘jumper install’ section of the plan contained a description of where to terminate each jumper wire and an associated field for the TIC to record the identification number of the jumper together with details of the date, time, and the tester who certified that task was completed. Although the tasks to install the 3 jumpers in the level crossing control circuit were actioned by the TIC, no entry was recorded in the plan to specify the jumper identification number or to certify that task was completed.

The task descriptions in the plan document for the installation of the jumpers (highlighted in red font) reflected the circuit diagram (marked up in red). The circuit diagram showed 3 jumpers positioned in the level crossing control circuit to bypass functions that could be affected by the track tamping works (Figure 10).

Temporary jumper wire ‘A’ bypassed the control function that incorporated the up-direction AMPRN track circuits to the level crossing that were to be disconnected to facilitate the track work. The jumper wires ‘B’ and ‘C’ bypassed control functions associated with the automatic operation of the level crossing warning equipment when configured for single line bi-directional working. 

The TIC stated that, on reflection, only one temporary jumper wire was required. The other 2 jumpers (marked ‘B’ and ‘C’ in Figure 10) were superfluous[27] as they bypassed the single line working function, which was not planned to be in use on 7 December 2020. The single line working function would only be used where single line bi-directional working was instigated under an alternative method of safe working arrangement. This was not the case on 7 December 2020. 

Figure 10: Extract of the SAPTA‑approved Torrens Road inspection and test plan showing approved temporary wiring configuration

Note: Extract of circuit diagram showing the SAPTA‑approved location for the 3 temporary jumper wires. Source: South Australian Passenger Transport Authority, annotated by the ATSB.

The TIC used the circuit diagram when calling instructions to the signal electrician on where to connect the ends of each jumper to the respective relay bases. The signal electrician did not have a copy of the diagram. 

The relay base contained a matrix of termination points arranged in columns marked ‘A’ to ‘D’. The terminations in the ‘D’ column were located on the right side of the relay base. Each column then contained 8 rows of terminations. The base was embossed with markings that corresponded to the relative position of the termination in the matrix, for example ‘D1’ to ‘D8’. Each could connect up to a maximum of 2 wires. In addition to the embossed markings, each wire connected to a respective termination point that was fitted with a numbered colour‑coded sleeve. The colour of the sleeve was dependent on the column, for example, wires in the ‘D’ row were yellow. The sleeves were not fixed to the wire and could be moved along the wire to enable the rail safety worker to view the identification number of the wire if required.

During the installation of the temporary jumper (RIC01*11) between the function 47 1TR - B5 and 47 UpJR ‑ D7 (marked ‘Temporary jumper ‘B’’ in Figure 10), the probe from one end of the jumper was inadvertently placed into 47 UpJR - D6. This was located directly above the intended termination point (47 UpJR ‑ D7) detailed in the ITP and positioned on the bottom row of the relays in the equipment rack (Figure 11). 

Figure 11: Rear of Torrens Road location case showing 47 UpJR control relay

Source: South Australian Passenger Transport Authority, annotated by the ATSB

One end of another jumper was installed to a termination (47 XSR R1) other than that identified in the approved circuit diagram. This was intentional and made under the instruction of the TIC. This amendment was undertaken as access to the nominated termination was impeded due to its physical location in the equipment rack and congestion from the existing wiring. This amendment did not change the intended functionality of the jumper or level crossing control circuit. The TIC subsequently illustrated the amended wiring on the circuit diagram. However, no corresponding amendment record was completed in the plan document to ensure correlation between the plan and circuit diagram.

The unintentional installation of a jumper probe into the 47 UpJR - D6 terminal and intentional termination of a jumper probe into the 47 XSR R1 termination meant the jumper wiring was configured as illustrated in Figure 12. This was inconsistent with the description in the approved plan document and detail shown on the amended circuit diagram.

Figure 12: Extract of the Torrens Road level crossing control circuit showing temporary jumper wires in the ‘as installed’ configuration

Note: Configuration of the temporary jumper wiring recorded by SAPTA during the post-incident onsite investigation. Source: South Australian Department for Infrastructure and Transport, annotated by the ATSB

Temporary jumper wiring testing

Verification

Following the temporary jumper install, there were no post‑installation testing tasks included in the ITP to specify the tests that the TIC was to coordinate to ensure correctness. Such tests were typically required to ensure the ‘as installed’ wiring conformed to the circuit diagram and that the required control functions would still operate the level crossing warning equipment as designed. In this case, the operation of the level crossing warning equipment for trains approaching on the ARTC network.

In the absence of any instruction from SAPTA to specify the testing or methodology required for recording test results, the TIC used their typical method for recording verification testing and marked up the circuit diagram with details to record the installation of each jumper together with its identification number (Figure 13). 

Figure 13: Extract from the Torrens Road inspection and test plan marked up with testing annotations and amended jumper wiring configuration

Note: Extract of the circuit diagram showing the location of the temporary jumper wiring and TIC testing notations as completed on 7 November 2020. Signatures removed to de-identify the involved parties. Source: South Australian Passenger Transport Authority, annotated by the ATSB

The TIC recorded each test activity using a system of symbols to signify the installation and verification of the jumper wire in accordance with the approved circuit diagram. The markings indicated the TIC had certified the completion of a wire count[28] and continuity test[29] for each of the installed jumpers. The TIC also used an asterisk to denote that one end of a jumper was no longer connected at the terminal originally approved.

When marking up the circuit diagram, the TIC did not undertake an independent visual inspection to verify the correct installation of the jumper wiring. The TIC acknowledged that they should have undertaken an independent visual check, but instead had relied on the information provided by the signal electrician, due to their significant experience in undertaking work on signalling systems. The TIC stated that there were limited resources in the signal team and no other member had the qualification required to undertake independent testing. The TIC stated that there was therefore a tendency not to check the work undertaken as rigorously as would be the case for a team member with less experience.

The methodology used by the TIC to verify the ‘as installed’ wiring against the control circuit diagram did not detect the error made in the termination of the jumper wire RIC01*11 into the 47 UpJR - D6 terminal (instead of 47 UpJR – D7) or the transposition of the unique identification numbers for 2 of the jumper wires. 

The TIC stated that the ITP (plan document) was not identified as a commissioning work instruction and, in their mind, it appeared only as a reference document to ensure the circuit diagrams were attached, the PPO was informed and the IBA had been completed. The TIC also noted the level of documentation provided to support their work was minimal in comparison to their experience when undertaking similar tasks with other rail organisations. The TIC stated the information in the ITP document basically reflected information related to the jumper installation and removal that was contained in the circuit diagrams. It did not appear to them as a typical work instruction forming part of a commissioning plan.

Validation

Following the completion of the verification tests, the TIC operated the level crossing test switch (Figure 13) located in an enclosure on the AMPRN location case to validate the correct operation of the level crossing circuit (and warning equipment). The level crossing warning equipment operated as the TIC expected. The TIC recalled that there was no mention in the ITP of testing the functionality of the ARTC level crossing, and that the only validation test specified was the operation of the test switch, following the removal of the temporary jumpers. 

The test of the ARTC approach function required either the operation of the test switch on the ARTC signalling system control box or the interruption by other means of the ARTC approach control function relayed to the AMPRN signalling system. The TIC stated that, in hindsight, when testing the functionality of the level crossing warning equipment, the ARTC test switch should have also been operated to validate the correct operation of that function.

Although the TIC undertook tests to validate the correct operation of the level crossing equipment, the tests did not identify the wiring error. In this instance, another relay function in the control circuit needed to change state for the error to become apparent by the operation of the ARTC test switch or approach control function. 

There was no record on the circuit diagram or plan document to indicate any testing of a control function had occurred (including by the operation of the test switch). The TIC signed off the ITP circuit diagram to certify the temporary jumper installation was completed, and the level crossing warning equipment functioned as expected.

In preparation for the track tamping work to commence, the signal team disconnected connections for the 572C track that caused a 572C T1P relay to de-energise. The change in state of this relay closed contacts A7 and A8. An alternative connection from the control circuit power supply was applied to the 47 XSR function via the incorrectly installed jumper wire RIC01*11 (Figure 14). The false feed subsequently maintained the 47 XSR function in an energised state (level crossing warning equipment inactive), regardless of the configuration of another AMPRN or ARTC control input in the circuit. The level crossing warning equipment would now not operate for train 1MP9 approaching Torrens Road on the ARTC network, or any other AMPRN or ARTC train approaching the level crossing.

Figure 14: Extract of the Torrens Road level crossing control circuit showing the path of false feed 

Note: Red dashed line shows the path of the false feed applied to the Torrens Road level crossing control relay, after 572C T1P relay was de-energised. Source: South Australian Department for Infrastructure and Transport, annotated by the ATSB

Removal

The ITP document also specified tasks related to the ‘jumper removal’, which was to occur following the completion of the track work for that day. The work at Torrens Road had not progressed to a stage where these tasks needed to be actioned.

Associated with the tasks for jumper removal, additional tasks were included for the TIC to action. This included a test for the operation of the level crossing warning equipment with the test switch, to ensure the level crossing operated correctly, before advising the operations controller (in this case PPO) the works were complete. 

The installation or removal of the jumper wiring did not affect the test switch. Operating the test switch only confirmed that the warning equipment would function using the switch. It did not confirm that a train approaching the Torrens Road level crossing on either the AMPRN or ARTC network would activate the warning equipment in the same way.

Summary

In summary, the extent of the testing requirements specified in the Torrens Road ITP following the jumper installation work were consistent with those developed for each of the other level crossings affected by the GREP track works that day (Bedford Road and Pym Street). None of the approved ITPs specified a requirement to:

• verify the temporary jumpers were per the plan description and circuit diagram
• validate the level crossing warning equipment would operate as intended with the temporary jumper wiring, particularly the continued operation of the level crossing warning equipment for trains approaching on the ARTC network.

Additionally, after completing the installation and testing phase, the scope of work for the signalling team on the day included the removal and reinstatement of several track circuit connections that were associated with the AMPRN up approach to the Torrens Road and other level crossings. In the absence of the use of form FO-EM-SP-312Signal circuit jumpering decommissioning, there was no provision made in the ITP documentation for the TIC to record the signal team’s actions associated with the removal, reinstatement or testing of the affected track circuit connections. Although there was no requirement in the ITP documentation, the GREP signalling methodology document specified the track maintenance record card for the affected track circuit must be completed as the equipment was tested and certified. These documents were distributed at various trackside location cases and were separate from the ITP document package developed to record the specialised rail safety work undertaken by the signal team for the GREP.

SAPTA post-incident onsite investigation

An onsite examination by SAPTA found: 

• The ITP used by RIC was not located in the location case as required by SAPTA procedures.
• The ITP document, when provided, was not completed.
• A comparison of the temporary wiring modifications against the ITP circuit diagrams identified the 3 temporary jumper wires were not installed in accordance with the details recorded in the approved circuit diagram.
• One end of a temporary jumper wire was terminated to the wrong point in the circuit.
• The incorrectly terminated temporary jumper wire subsequently provided a circuit, which falsely energised a relay that would have otherwise been de-energised during correct operation of the level crossing. This was determined as the reason for the level crossing warning equipment not activating for the approach of 1MP9 on the adjacent ARTC network.

Safety analysis

Introduction

On 7 December 2020, Specialised Container Transport train 1MP9 was travelling on the Australian Rail Track Corporation (ARTC) network through Adelaide in South Australia. As the train approached the Torrens Road level crossing, the driver saw that road traffic was still passing over the crossing, and that the level crossing warning equipment had not operated for the approach of the train. The driver initiated an emergency brake application before sounding the locomotive horn to alert any road traffic of the train’s approach. Shortly after, the train traversed the level crossing and continued a further 260 m before stopping. 

This analysis will discuss the pre-planned tasks the signal team was required to undertake at short notice. It will then examine the limitations in the methodology adopted by members of the signal team during the installation and subsequent testing to certify the temporary wiring alterations and to ensure the level crossing warning equipment operated correctly. 

Further, limitations in the development and approval processes for the inspection and test plans, and the associated procedures used to manage the specialised safety‑critical work to alter signalling infrastructure, such as the control circuits for level crossings, will also be considered.

Work plan change

On the morning of the incident, the signal team recommenced the planned work activity in support of the tamping works as was agreed during the pre-work briefing for that day. The signal team was familiar with the work as it was repeating an activity to alter the Pym Street and Belford Avenue level crossing control circuits, which it had successfully undertaken over the previous few days. 

The control circuits for these 2 crossings were co-located in the Islington relay room situated at the northern end of the track worksite. This meant the tester in charge (TIC) and signal electrician could sequentially complete the tasks described in the respective inspection and test plans (ITPs) before relocating to the track area to commence the work associated with the removal of electrical connections to the rails. On completion of the track tamping works, the signal team would then reinstate and test the equipment before placing it back into service and signing off. The signal team was typically working 11.5 to 12 hour shifts each day to complete this scope of work involving the 2 level crossings and their associated track circuits.

The TIC had felt the signal team was under constant work pressure from the tamping workgroup to complete its work and that there was not an understanding of the time needed to undertake the signal works both before and after the track works were completed. The signal electrician reflected similar observations to that of the TIC and added that their workload at the commencement of that day was reasonable, but this had increased due to repair of damage to electrical connections caused by the tamping machine earlier that day.

However, the decision to add the third level crossing (at Torrens Road) at short notice and additional track circuit connections within the 12-hour workday requirement and allocated track possession timeframe placed further demands on the signal team. In addition, these tasks were not located near the Islington relay room like the previous works and were instead located toward the opposite end of the worksite. The TIC and signal electrician reported that they were cognisant that this work needed to be progressed as expeditiously as possible, to not further delay the track machine workgroup schedule in continuing its work toward Torrens Road, which had experienced previous delays. To save time, the TIC modified their usual approach to the infrastructure booking advice process (as part of the signalling method procedure), by making arrangements with the possession protection officer by telephone rather than meeting together to complete the advice form. This was likely to reduce the need to travel within the worksite before commencing work to modify the level crossing circuitry. 

Work pressure is defined as degree to which employees feel under pressure to complete work, amount of time to plan and carry out work, and balance of workload (Glendon and Stanton, 2000). Employees who perceive that they are under pressure to increase production may deviate from safety rules that impede their progress, or perform tasks with less care, increasing the likelihood of errors. There is evidence for a link between work demands and accident involvement, where the higher the perception of work demands, the more accidents that occur (Clarke, 2006). Time pressure has also been found to degrade performance, such as task or load shedding, and a trading of accuracy for speed (Staal, 2004).

Together, this indicated that the signal team was experiencing actual or perceived work pressure with the addition of the Torrens Road level crossing, which influenced the deviation from adhering to the requirements outlined in the standard signalling methodology procedure. 

Inspection and test plan – wiring

The ITP reviewed and approved by South Australian Public Transport Authority (SAPTA) required the TIC and signal electrician to install 3 temporary jumper wires to isolate the Adelaide metropolitan passenger rail network (AMPRN) up approach at the Torrens Road level crossing. Post-incident, both the TIC and signal electrician stated the installation could have been simpler, as the circuit alterations to facilitate the track work required the installation of only one of the jumpers, instead of 3.

During the installation of the jumpers, one of the superfluous jumpers was inadvertently installed to an incorrect point in the control circuit. Further, the installation of the second jumper required the TIC to undertake an amendment to the termination point to allow for simpler installation, increasing the complexity of the task. These 2 conditions could have been averted by the identification and removal of unnecessary jumpers from the Torrens Road ITP during the various stages of the review and approval process.

SAPTA required Acciona to submit the draft ITPs for their final review and approval prior to the commencement of work on the AMPRN. While the SAPTA review identified various drafting errors in some of the ITPs (excluding Torrens Road), there was no comment from SAPTA in relation to the inclusion of superfluous wiring. The inclusion of superfluous jumpers was common across the approved ITPs for the level crossings that were altered by the signal team during the track work earlier on that day and over the preceding days. 

On 7 December 2020, each of the Bedford Avenue, Pym Street and Torrens Road ITPs required the signal team to install temporary wiring that bridged the single line working switches. The inclusion of superfluous wiring in the approved ITPs placed an unnecessary task demand on the signal electrician and TIC when performing work associated with the modification and testing of safety‑critical signalling infrastructure. The approved inspection and test plan for the Torrens Road level crossing control circuit included 2 superfluous temporary jumper wires. The inclusion of superfluous wiring both increased complexity of the task and placed unnecessary work demand on the signal electrician and tester in charge to implement the plan.

Temporary jumper wiring installation

After accessing the Torrens Road location case, the TIC and signal electrician positioned themselves on opposite sides of the equipment rack. During the installation, the TIC likely called out to the signal electrician to install the probe of a jumper into terminal D7 of the 47 UpJR. 

The signal electrician did not have a copy of the circuit diagram to reference or cross‑check during the installation process for the jumpers and therefore relied on recalling the verbal instructions provided by the TIC. The signal electrician could however seek clarification from the TIC if they were unsure of the instruction or connection point that was provided. The 47 UpJR control relay was located in the bottom row of the relays installed in the equipment rack (Figure 11).

Together, it was possible that the increased time pressure, method for the installation of the temporary jumper wiring, and familiarity of the task from preceding work all combined to influence the unintentional installation of 47 UpJR into node D6, which was immediately above D7. This meant the jumper installed was not consistent with the approved ITP document and control circuit drawing and introduced a latent condition for the incorrect operation of the level crossing warning equipment.

Verification of signalling works

The Gawler rail electrification project (GREP) Tamping project signalling methodology procedure for planned work required the TIC to undertake and record their work in accordance with the content of the SAPTA‑approved ITP. However, none of the ITPs or other documentation developed for the GREP level crossing work specified a requirement for the TIC to undertake and record an independent verification of the correct installation of temporary jumper wiring. Although the verification task was not specified in the ITPs, the TIC (and signal electrician) had previous experience in commissioning signal system alterations and were cognisant of the need to undertake a verification inspection for the correct installation of the jumpers. 

The independent verification of a control circuit alteration could be satisfied by a variety of arrangements dependent on the availability of suitably qualified resources. At a minimum level, independent verification would require the wiring installation work undertaken by one rail safety worker to be verified (inspected and certified) as correct by another rail safety worker, who held an equivalent or higher competency and was not directly involved with the initial wiring installation work. 

For the work at Torrens Road (and other level crossing installations affected by the GREP work) the qualified resources of the signal team comprised 2 rail safety workers, the signal electrician and TIC. To satisfy the minimum level of independence would typically require the signal electrician to have access to a circuit diagram (construction copy) to carry out and record the installation or removal of each jumper independently from involvement of the TIC. On completion, the TIC, referencing the ITP documentation would then verify and certify the correct installation of the jumpers independently from involvement of the signal electrician.

The methodology adopted by the TIC during the installation of the wiring, where they retained the circuit diagram and called the termination node to the signal electrician before marking the respective wire as installed, essentially combined the installation and verification tasks into a single step. Consequently, there was no independent verification of the installed wiring. This resulted in the wiring error not being detected and remaining in the circuit as a latent condition.

The approach adopted by the signal team was likely influenced by the close working association it had established through the repeated implementation of the ITPs to alter the level crossing control circuits, as well as the completion of other tasks undertaken to facilitate the tack tamping works. The signal electrician and TIC repeatedly completed these specialised works successfully under time pressure over a number of preceding days and likely developed a level of trust in each other’s ability to competently complete the alteration work without error or omission. 

The Rail Industry Safety and Standards Board standard required the planning and implementation of an effective inspection and test regime to reduce risk to rail safety. To achieve this, the standard required the verification and validation process that forms the inspection and test regime to be undertaken with independence between the construction (installation) and testing (commissioning) process. The standard, however, allowed for situations where the independence could not be achieved. In that instance, other controls should be considered and approved by the rail infrastructure manager to control the additional risk. 

Tamping preparation works

After completion of the temporary wiring alterations, the TIC and signal electrician concluded the jumpers were installed correctly and that the warning equipment would continue to function as intended. The signal team then left the Torrens Road level crossing. Following approval from the TIC, the signal electrician and trades assistants then commenced work to remove the required track circuit electrical connections from the rails so the track work could continue.

The removal of the track connections should have had no effect on the correct operation of the Torrens Road level crossing warning equipment. That is, the altered level crossing control circuit would not operate the warning equipment due to the removal of the track circuit connections on the AMPRN, but would still operate either by the use of the test switch or for the passage of a train on the adjacent ARTC network.

In this instance, due to the earlier undetected error in the installation of one of the jumpers, the removal of the track circuit connections for the 572C track resulted in a change of state of the 572C T1P function in the level crossing control circuit. This condition, together with the wiring error, resulted in a wiring connection that provided alternative connection from the control circuit power supply to the 47 XSR control relay. This now prevented the correct operation of the level crossing control circuit and warning equipment. 

This condition was not present at the time the TIC and signal electrician tested (validated) the correct operation of the level crossing warning equipment by using the level crossing test switch. Therefore, the TIC and signal electrician, having left the Torrens Road level crossing after completing the installation and test tasks, would not have been aware the level crossing would now not operate either by the selection of the test switch or the passage of a train on the adjacent ARTC network. 

As the alternative connection condition was not present during the time the TIC undertook the validation testing, the detection and correction of the wiring error was therefore solely reliant on the effectiveness of the verification testing that was undertaken following the installation of the temporary jumper wiring.

Inspection and test plan – testing

For the GREP level crossing works, Rail Industry Constructions (RIC) developed a package of ITP documents through copying the format of ITPs that RIC had used for projects previously undertaken on the AMPRN signalling system. Other than stipulating the ITPs were to be submitted for approval, SAPTA provided no specification or guidance to define the minimum content that RIC was to follow during the drafting and later application of the ITP documents.

The ITPs subsequently developed by RIC reflected the content of various pre-populated fields that described generalised tasks to confirm details of plan references, responsibilities and authorities, safe working, and communication arrangements. A sequence of tasks was added to the master test certificate section that reflected information contained in the circuit diagrams for the temporary jumper wiring installation or removal tasks. RIC only specified a test of the signalling system integrity (by operation of the test switch) would occur after the removal of the jumpers. 

The RISSB signalling testing process standards described the types of testing and methods for testing typical signalling apparatus and systems that form part of a signalling system. A key objective of a test activity was to provide assurance the new or altered signalling system conformed with defined functional requirements, such as maintaining the operation of level crossing warning equipment for trains operating on the ARTC network. The ITP provided a template to document the equipment to be altered, and the planned sequence of tasks including an effective auditable process for the verification and validation of the safety integrity of the altered signalling system to meet the defined functional requirements. 

The ITPs subsequently developed by RIC for the GREP level crossing control circuit alterations were tailored toward a checklist addressing administrative tasks. Therefore, the ITPs did not include sufficient detail to form an effective and auditable test procedure to verify and validate the safety integrity of level crossing control circuits following the installation of the temporary jumper wiring.

Inspection and test plan checking/approval process – testing

On 25 September 2020, RIC representatives endorsed the draft ITPs for each level crossing location that would be affected by the GREP track tamping work. The ITPs were subsequently submitted to SAPTA for review and approval to verify that the specifications contained in the ITPs were appropriate for application on the AMPRN. 

The review identified errors in several of the ITPs, which SAPTA returned to RIC for correction. The errors related to an inconsistency between the task description in the plan document and the related marked up circuit diagram. SAPTA identified no errors in the positioning of the various temporary jumper wires as marked-up on the control circuit diagrams.

In reviewing the proposed wiring alterations, SAPTA did not provide any feedback to RIC on the inclusion of the superfluous jumpers to inhibit control functions that were not necessary to achieve the objective. That is, to prevent the unnecessary operation of the level crossing warning equipment during the track work. The SAPTA acceptance of the extra wiring alterations both unnecessarily increased the workload on the signal team and introduced a potential risk to safety that may arise from an undetected error during the installation works.

A SAPTA‑qualified employee undertaking similar works must undertake the planned temporary decommissioning of signalling system infrastructure in accordance with the SAPTA work instruction Signalling system temporary decommissioning and jumpering. The instruction required the qualified employee implement a pre-approved ITP for the works. The work instruction emphasised to the SAPTA‑qualified employee their responsibility to ensure there was independence in the verification testing of the installed wiring. Additionally, where there were adjacent rail lines, the employee was to validate the correct operation of the signalling functions on that line to ensure they remained active following the completion of the alteration work. In this instance, the level crossing control functions were isolated for AMPRN but were to continue operating for trains on the adjacent ARTC network. 

A key objective of the SAPTA review and approval process was to ensure the ITP procedures developed by subcontractors (RIC) for implementation by the signal team on the AMPRN were, at a minimum, consistent with SAPTA procedures and/or included methods that provided improved risk control. The SAPTA review did not identify the omission of specific inspection and test tasks to ensure there was independent verification that the jumpering was correctly installed, and that the ARTC control function to operate the level crossing warning equipment for a train approaching on the ARTC network was validated. Consequently, the effectiveness of the tests to control risk and assure the safety integrity of the rail infrastructure for trains operating on the ARTC network relied solely on the methodology adopted by a subcontracted signal team on the day.

Validation of signalling works

The Rail Industry Safety and Standards Board standard for signal testing processes required the TIC to complete tests to verify the installed wiring alteration conformed to the control circuit diagrams and then confirm that the requirements of the alteration were fulfilled. In this instance, the requirements, although not specified in the ITP, were the correct operation of the level crossing warning equipment via the manual operation of the AMPRN test switch and the automatic operation for a train approaching the Torrens Road level crossing on the ARTC network.

The TIC stated that, on completion of the jumper installation, they did validate the correct operation of the level crossing warning equipment via the manual operation of the AMPRN test switch. Although the level crossing warning equipment did function as the TIC expected, this was not an effective inspection and test method to prove the ARTC approach control function would operate the warning equipment. While the test proved the AMPRN test switch function operated the level crossing warning equipment it did not prove the ARTC control function would similarly operate the warning equipment. 

To prove the ARTC control function required the TIC to manually select the ARTC test switch (located on a separate ARTC location case) or interrupt by other means the ARTC approach control function relayed from the ARTC to the AMPRN signalling system. The validation testing conducted in this manner by the TIC would, in this instance, not identify the incorrect installation of the jumper unless a further condition related to the 572C T1P function was present at the time the validation testing occurred.

Findings

From the evidence available, the following findings are made with respect to the level crossing irregularity involving freight train 1MP9 that occurred on 7 December 2020 at Torrens Road level crossing, Ovingham, South Australia.

Contributing factors

• A late change to the planned scope of track tamping work on the day of the incident placed additional work demand with short notice on the signal team to implement the Torrens Road inspection and test plan.
• The inspection and test plan for the Torrens Road level crossing control circuit included 2 superfluous temporary jumper wires. The inclusion of superfluous wiring both increased complexity of the task and placed unnecessary work demand on the signal electrician and tester in charge to implement the plan.
• The signal electrician inadvertently installed one end of a superfluous temporary jumper wire to an incorrect terminal within the control circuit of the Torrens Road level crossing warning equipment. The installation error meant the jumper was not consistent with the approved control circuit.
• The methodology adopted by the signal team when implementing the Torrens Road inspection and test plan did not ensure independence between the installation and verification tasks. This resulted in the wiring error not being corrected and remaining in the Torrens Road control circuit, potentially affecting the correct operation of the level crossing warning equipment.

Other factors that increased risk

• The inspection and test methodology used by the signal team to validate the operation of the level crossing warning equipment via the operation of the Adelaide Metropolitan Passenger Rail Network level crossing test switch did not prove the Australian Rail Track Corporation level crossing control function would operate the warning equipment.
• Rail Industry Constructions developed a package of inspection and test plans that did not include effective and auditable test procedures to verify and validate the safety integrity of level crossing control circuits following the installation of the temporary jumper wiring.
• The South Australian Passenger Transport Authority approved a package of inspection and test plan procedures that did not specify any requirement for testing to verify and validate the safety integrity of the altered level crossing control circuits. The effectiveness of inspection and test plan process to control risk and provide assurance the signalling system functioned safety for trains operating on the Australian Rail Track Corporation network relied solely on the methodology adopted by the subcontracted signal team. (Safety issue)

Other findings

• The later disconnection of electrical connections to the rails on the Adelaide metropolitan passenger rail network caused a false feed to the level crossing control relay via the incorrectly installed temporary jumper wire. This false feed prevented the correct operation of the level crossing warning equipment for a train approaching on the Australian Rail Track Corporation network.

Safety issues and actions

Inspection and test plan checking/approval process - testing

Safety issue number: RO-2020-021-SI-03 

Safety issue description: The South Australian Passenger Transport Authority approved a package of inspection and test plan procedures that did not specify any requirement for tests to verify and validate the safety integrity of the altered level crossing control circuits. The effectiveness of inspection and test plan procedure to control risk and provide assurance the signalling system functioned safety for trains operating on the ARTC network relied solely on the methodology adopted by the subcontracted signal team on the day.

Safety action not associated with an identified safety issue

Additional safety action by Acciona

Following the incident, Acciona undertook corrective action to:

• Update the methodology to increase the level of controls for the activity. This may include additional function testing and road closures when jumpering-out was required for tamping/regulating.
• Investigate the modification of level crossing control circuits to allow isolation of the level crossing without the installation of temporary jumper wiring. This action was considered a long-term solution to be considered by the South Australian Department for Infrastructure and Transport.

A complete risk assessment has been undertaken in consultation with Omada Rail Systems and the project team. The controls that came out from the risk assessment have been discussed with both Australian Rail Track Corporation and South Australian Department of Infrastructure - Transport project delivery in formal meetings and have been accepted by them.

Additional safety action by the Office of the National Rail Safety Regulator

On 16 December 2020, the Office of the National Rail Safety Regulator (ONRSR) published a Notice to Rail Transport Operators - Safety alert RSA-2020-001 in relation to several incidents of non-operation of level crossings on live lines due to incorrect isolation. 

Each identified case (including Torrens Road) involved level crossings with multiple lines with more than one rail infrastructure manager and required the partial isolation of the crossing for some lines while leaving adjacent lines operational. However, the crossings were mistakenly isolated for the operational lines and workers were unaware of the mistake until the passage of trains through the unprotected crossing. ONRSR noted there was a significant risk to rail safety and reminded rail transport operators to ensure the completion of the key tasks outlined in the alert.

Additional safety action by the Australian Rail Track Corporation:

The ARTC undertook the following safety action related to several ARTC engineering standards in response to the level crossing incident at Torrens Road:

1) Reviewed and updated standard ESC-21-01 – Inspection and Testing of Signalling – Roles, Responsibilities and Authorities (Updated and published Sep 2021)

• Clarified the roles and responsibilities for inspection and testing including TIC (Tester in Charge) responsibilities for shared level crossings.

2) Reviewed and updated standard ESM-24-01 - Bridging and false feeding signalling circuits. (Updated and published in Nov 2021)

• Reviewed and updated requirements for bridging and false feeding signalling circuits and included a separate section for bridging on the shared level crossings

3) Reviewed and updated standard ESD-03-01 Level Crossing Design (Updated and published in Oct 2022)

• Aligned with AS Standard AS7658 and guidance for shared level crossings.

Glossary

Sources and submissions

Sources of information

The sources of information during the investigation included:

• South Australian Public Transport Authority
• Acciona
• Australian Rail Track Corporation
• SCT Logistics
• Rail Industry Constructions
• the train crew
• the tester in charge and signal electrician
• recorded data from 1MP9. 

References

Battelle Memorial Institute. (1998). An overview of the scientific literature concerning fatigue, sleep, and the circadian cycle. Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.

Clarke, S. (1999). Perceptions of organizational safety: implications of the development of safety culture. Journal of Organizational Behaviour, 20, 185-198.

Glendon, A.I. & Stanton, N.A. (2000). Perspectives on safety culture. Safety Science, 34, 193‑214.

National Transport Commission. (2017). National standard for health assessment of rail safety workers. https://www.ntc.gov.au/codes-and-guidelines/national-standard-health-assessment-rail-safety-workers

Office National Rail Safety Regulator. (2020). General safety duties under RSNL – ‘Upstream’ duty holders. https://nraspricms01.blob.core.windows.net/assets/documents/Factsheet/Review-Placeholder-website.pdf

Office National Rail Safety Regulator. (2020). ONRSR Guideline - Identifying rail safety work under the RSNL (version 2.0). https://www.onrsr.com.au/publications/fact-sheets-guidelines-and-policies/guidelines

Office of the Rail Safety Regulator. (2020). Notice to Rail Transport Operators – Safety Alert Rail Safety Alert No. RSA-2020-001.

Rail Safety National Law (South Australia) Act 2012. https://www.onrsr.com.au/publications/rail-safety-national-law-related-legislation

Rail Industry Safety and Standards Board. (2017). Contracting in the rail industry (version 1). https://www.rissb.com.au/products/guideline-contracting-in-the-rail-industry/

Rail Industry Safety and Standards Board. (2017). Australian Standard AS-7716-2017 - Signal testing process (version 1). https://www.rissb.com.au/products/as-7716-signalling-testing-process/#:~:text=The%20main%20purpose%20of%20this,systems%2C%20in%20Australian%20railway%20corridors.

Rail Industry Safety and Standards Board. (2016). Australian Standard AS-7717-2016 - Signal testing and commissioning (version 1). https://www.rissb.com.au/products/as-7717-signal-testing-commissioning/

Staal, M.A. (2004). Stress, cognition, and human performance: a literature review and conceptual framework. Moffett Field: The National Aeronautics and Space Administration.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Acciona
• Australian Rail Track Corporation
• South Australian Public Transport Authority
• Office of the National Rail Safety Regulator
• Rail Industry Constructions
• SCT Logistics
• the signal team
• the train crew.

Submissions were received from:

• Acciona
• Australian Rail Track Corporation
• South Australian Public Transport Authority
• Office of the National Rail Safety Regulator.

Appendices

Appendix A – GREP safety management system procedures

Acciona competency management program

The Acciona procedure LLE1002 Attachment 2 – Training of rail workers required all employees and subcontractors accessing the Adelaide metropolitan passenger rail network (AMPRN) rail corridor to have a basic level of competency, such as track safety awareness. Acciona managed this competency together with other task‑related competencies, such as safe working and track vehicle operation through the requirements of the contractor and rail industry worker cards. 

For specialist engineering competencies, such as those associated with signal installation and testing, the Acciona procedure allowed the recognition of another accredited rail operator’s statement of competency (SOC) as evidence the worker was competent. This recognition was dependent on whether the details of the engineering work undertaken were related to the required Gawler rail electrification project (GREP) tasks, and if the SOC was still current. 

GREP signalling team statement of competency

Acciona recognised the Australian Rail Track Corporation (ARTC) SOC and associated work experience log as evidence of the competencies attained by the tester in charge (TIC) and signal electrician. The respective SOCs detailed their current employer, work role, ARTC certified competencies, health assessment status and the inductions completed. Each SOC was current, with an expiry date of May 2024 and December 2022 for the TIC and signal electrician respectively.

The SOCs specifically related to ARTC’s assessment of their competence and compliance with the ARTC network standards, procedures, practices and instructions when undertaking related rail safety work on that organisation’s network. ARTC stipulated that the SOC assessment was not transferrable for use on another rail network without further review and assessment by the rail transport operator (RTO) responsible for that network, in this instance the RComm.

The SOC document included a requirement for the individual to maintain a work experience log in accordance with the ARTC competency standards, and to make that record available for any future competency review. The work experience log was a critical element in ARTC establishing the ongoing experience of signalling staff through demonstration that the person had moved from the training level to a level that permitted the independent performance of signalling tasks. The log recorded details in chronological order of the various projects undertaken, timeframes, the specific tasks performed, equipment types worked on and the supervisor’s assessments of the individual’s performance in undertaking that work. 

The log for the TIC recorded a range of projects undertaken on various rail networks throughout Australia including the AMPRN. Project entries recorded the TIC had worked on AMPRN projects since October 2010. The work typically involved coordination of the installation, testing and commissioning of modifications to signalling control circuity and interlocking systems. The Rail Industry Constructions (RIC) supervisor’s observations of the TIC’s work level standard performing those tasks was recorded as excellent, completed on time and to schedule, and that all documentation was completed to the applicable standards. 

The latest project entry for the TIC undertaking signalling work on the AMPRN was the performance of signal support activities during September and November 2020 for track tamping works in the Adelaide yard area. There was no entry against this project recording the supervisor’s observation of the TIC’s work level standard.

The log for the signal electrician similarly recorded a range of projects undertaken on the ARTC and AMPRN networks. Project entries recorded the signal electrician had worked on AMPRN projects since September 2016. The latest project entry for the signal electrician undertaking work on the AMPRN was December 2020 during which the signal electrician undertook the following project tasks associated with the GREP level crossing works:

• analysis of designed plans
• bridge [jumper] out level crossings
• removing track leads and install
• certifying track circuits.

The RIC supervisor’s observation of the signal electricians work level standard for those tasks was recorded as excellent, completed on time and to schedule.

Both the TIC and signal electrician’s SOCs included the caveat the assessment was not transferrable to another rail network without further review and assessment by the RTO responsible for that network. Although there was no evidence provided of any review or assessment by RComm, SAPTA or South Australian Department of Infrastructure – Transport project delivery (TPD) prior to the commencement of the GREP works, the work experience logs contained evidence the TIC and signal electrician were assessed as having competently undertaken similar installation and testing tasks for other projects on the AMPRN signalling system.

SAPTA investigation – post‑incident competency assessment

The SAPTA internal investigation report into the incident at Torrens Road on 7 December 2020 identified that between July 2017 and January 2020, 3 incidents occurred involving the RIC rail safety workers (TIC and signal electrician) when undertaking signalling project works. The report noted that as a result, SAPTA notified RIC that the competencies held by the workers enabling them to work on the AMPRN were to be suspended, pending re-assessment by SAPTA.

The SAPTA report further noted there was no evidence of a formal response from RIC to the notification or that information of the suspension was communicated by SAPTA to TPD, as the project manager for the GREP. At the date of the Torrens Road incident, the RIC staff involved were not listed in the SAPTA/TPD signalling engineering statement of competency folder and had not completed the competency re-assessment process to permit work on the AMPRN, as SAPTA had required.

The competency status for the RIC rail safety workers was inconsistent between Acciona (assessed as competent) and the SAPTA (requiring re-assessment). The ATSB noted the work experience records available to Acciona indicated the signal electrician and TIC were assessed to have competently undertaken project work including similar installation and testing tasks on the AMPRN signalling infrastructure between July 2017 and January 2020. The records contained no notation related to the incidents identified in the SAPTA investigation report.

Acciona health and fitness management program

The Acciona Alliance work health and safety management plan referred to the National Standard for Health Assessment of Rail Safety Workers as a key guideline relevant to the management of worker health and safety during construction activity. The standard set out the health assessment criteria, including the frequency applicable to rail safety workers in each of the 4 defined categories. The 4 categories were based on the level of risk associated with the rail safety workers role. Categories 1 and 2 applied to safety critical work/workers and categories 3 and 4 to non-safety critical work/workers.

The Acciona Rail safety management plan - Rail operations management plan and LLE1001 Attachment 3, Medical standards and rail safety workers specified Acciona rail safety workers were to hold a health assessment category that was dependent on the role/task that worker was to perform. Acciona additionally required all workers to hold an Australasian Railway Association (ARA) rail industry worker card. The ARA rail industry worker card held rail compliance information related to the individual worker, including health assessment category held.

The ARA process required the rail industry worker’s employer to maintain the worker’s details, job roles, competencies, and health assessment information within the ARA system. This information was then available for a project administrator to access and assess against the criteria for the role the rail industry worker was to undertake for that project. 

For the GREP, the card provided Acciona project administration a source of information to verify the worker’s suitability for the intended role. The Acciona procedure for subcontractors specified the health category required for each rail safety worker role for the GREP (Table 1). The table did not include the roles of TIC, signal electrician or trade assistant that were performed by the subcontracted RIC rail safety workers. The absence of a specific rail safety worker role for the TIC and signal electrician indicated they were assessed as a construction worker, requiring a Category 3 health assessment to undertake rail safety work on the signalling system. 

Table 1: GREP Rail industry worker health requirements

Rail Commissioner health and fitness management program

The RComm procedures used a rail safety worker checklist to determine the health assessment category applicable to a SAPTA rail safety worker who undertook work on the AMPRN infrastructure or rolling stock. The checklist determined firstly if the work activities were rail safety work and secondly defined the minimum health assessment category level applicable to that rail safety worker. 

The RComm assessment for the position of signal maintenance fitter (signal electrician) undertaking work on rail infrastructure identified the following work activities:

• Signalling (and signalling operations), receiving or relaying communications or any other activity which is capable of controlling or affecting the movement of rolling stock.
• Maintaining, repairing, modifying, monitoring, inspecting or testing – rolling stock or rail infrastructure.
• Work on or about rail infrastructure in relation to the design, construction, repair, modification maintenance, monitoring, upgrading, inspection or testing of rail infrastructure or associated works or equipment, including checking that the rail infrastructure is working properly before being used (excluding persons engaged in office-based design work).
• Installation or maintenance of – telecommunications system relating to or used in connection with rail infrastructure or the means of supplying electricity directly to rail infrastructure or to any rolling stock using rail infrastructure or to telecommunications systems.
• Work involving certification as to the safety of rail infrastructure or rolling stock or any part of a component of rail infrastructure or rolling stock.
• Work involving the development, management or monitoring of safe working systems for railways.

Undertaking any of the above work activities identified the signal maintenance fitter (signal electrician) as a rail safety worker.

The second stage of the assessment applied a series of tests to determine if the worker was a safety‑critical worker and the category of health assessment applicable (Figure 15). The RComm assessment identified the position of signal maintenance fitter as a safety‑critical worker who required a category 1 health assessment. 

The activities undertaken by the TIC were generally the same as those of the signal maintenance fitter described above. SAPTA did not have a rail safety worker checklist specifically for the position of TIC and advised it assessed all rail safety workers under training work on the AMPRN signalling infrastructure as safety critical workers, requiring a category 1 health assessment. 

Figure 15: Rail safety worker health category assessment flowchart

Source: Rail Commissioner

Acciona/RIC signalling team health assessments

Although the required health assessment category for the project role of TIC or signal electrician was not specified in Acciona procedures, the signal electrician held a current health assessment for a rail safety worker category 1 (safety‑critical worker) with no restrictions and the TIC had held a rail safety worker category 3 (non-safety‑critical worker) assessment with no restrictions. 

However, the category 3 assessment for the TIC expired on 31 August 2020, around 3 months prior to the incident at Torrens Road. The TIC later advised the ATSB they had renewed their category 3 health assessment on 5 February 2021, with no restrictions.

The work on the AMPRN signalling system undertaken by the TIC and signal electrician as part of the GREP works was safety‑critical work and if undertaken by a RComm/SAPTA rail safety worker would require a category 1 health assessment for both the TIC and signal electrician. There was no evidence that the RComm, SAPTA or TPD reviewed the suitability of the health assessments of the RIC rail safety workers (particularly the TIC), as applied by Acciona for the GREP works, to determine if the RComm requirements/expectation for rail safety workers undertaking safety‑critical work on the AMRRN were satisfied. 

Fatigue risk management program

Fatigue can have a range of influences on performance, such as decreased short-term memory, slowed reaction time, decreased work efficiency, reduced motivational drive, increased variability in work performance, and increased errors of omission (Battelle Memorial Institute, 1998). Due to these negative effects on cognitive performance, fatigue is a factor that increases the risk of transport accidents.

The Acciona procedure LLE617 Fitness health and hygiene described the process for managing fatigue and mental health. The procedure applied to direct employees and subcontractors. The procedure involved establishing project rules for the hours of work, arrangements for providing suitable welfare facilities, and the identification and risk assessment of tasks where fatigue could lead to mistakes that could result in the fatal injury of any person. Controls to manage fatigue related risk were then included in the safe work method statement for the associated task.

The Acciona project rules stipulated the maximum hours of work must not exceed the normal shift hours of 10–12 hours maximum per day, up to a cumulative total of 60 hours per week. The procedure allowed for working extended hours in situations where the type of work, track possession length or other circumstances, such as emergency works may arise. In such cases the requirement to work extended hours was to be approved and the guidelines described in the procedure applied to manage the hours worked.

RIC signal team

The signal team’s work hours were not determined from a set roster pattern but were governed by the requirements of the project’s daily schedule or the progress of a particular task on that day. The team typically commenced work onsite at around 0600 and worked to the completion of the tasks commenced that day. 

In the week prior to the incident, the TIC and signal electrician recorded workdays of between 8.5 and 12 hours each day undertaking the signalling alterations to facilitate the track tamping works (Table 2). On one occasion, the signal electrician exceeded the 12-hour daily limit by 30 minutes. The reason for this or whether approval was sought/granted to work the extra time could not be established. 

Table 2: Signal team hours of work

The signal electrician had worked 11 days consecutively before taking the 2 days off over the weekend prior to the incident. On commencing work on the day of the incident, the signal electrician self-rated their fatigue level as 4 out of 7 (a little tired, and not at their peak).[30] The signal electrician felt that they tended to be like that after a while on the big jobs. 

The TIC had worked on each of 5 days prior to the incident. On 6 December 2020, the TIC undertook office-based work preparing plans and tools required for the coming week’s work. The TIC recalled obtaining poor sleep quality over the 3 nights of the weekend prior to the incident. On commencing work on the day of the incident, the TIC self-rated their fatigue level as 3 out of 7 (Okay, somewhat fresh). 

Both the TIC and signal electrician stated they were aware of the need to individually manage fatigue levels, but also felt obliged to work toward meeting the project targets. Neither the TIC nor signal electrician had been provided with site‑specific training in the policies or procedures related to the management of fatigue during the GREP works.

Appendix B – Contracting in the rail industry

ONRSR guidelines

The Office of the National Rail Safety Regulator (ONRSR) published a range of fact sheets, guidelines and policies to provide the rail industry with key information on specific rail safety issues and legislative, regulatory and technical matters associated with the administration by ONRSR. These documents included information to duty holders about their duties and related obligations under the Rail Safety National Law (RSNL) when undertaking major projects involving contractor management.

The fact sheet General safety duties under the Rail Safety National Law – ‘upstream’ duty holders emphasised the RSNL embedded the principles of shared responsibility across a range of entities, including rail transport operators, rail safety workers and other persons such as designers, manufacturers and suppliers. ONRSR categorised some entities as ‘upstream’ as there would be greater scope for those entities to remove foreseeable hazards than a ‘downstream’ duty holder. 

ONRSR noted upstream duty holders generally did not require accreditation for the activities they undertook. However, they still had a responsibility (general safety duty) to ensure they undertook their activities safely and in a way that did not affect the safety of the railway operations, themselves or others. The level and nature of the responsibility was dependent on the nature of the risks, and the capacity of the duty holder to control, eliminate or mitigate those risks. 

RISSB guideline contracting in the rail industry

To supplement the ONRSR publications the Rail Industry Safety and Standards Board published the Accreditation and safety management systems guideline – contracting in the rail industry. The purpose of the guideline was to assist rail transport operators in understanding their responsibilities under the RSNL for engaging contractors to carry out rail operations and for contractors to gain an understanding of what is expected of them when they were engaged to carry out rail operations and specific rail safety work.

The guideline reflected the RSNL and ONRSR fact sheet in highlighting the principle of shared responsibility and accountability (general safety duty) to effectively manage rail safety when engaged in rail safety work, such as the design, commissioning or modification of rail infrastructure. 

The guideline also noted the RSNL takes the principle of shared responsibility and strengthens its application by prescribing that:

• a duty under this Law cannot be transferred to another person
• a person can have more than one duty under this Law by being in more than one class of duty holder
• more than one person can concurrently have the same duty under this Law and each duty holder must comply with that duty to the standard required by this Law even if another duty holder has the same duty.

GREP arrangements

The South Australian Department for Infrastructure and Transport (DIT) encompassed the Rail Commissioner (RComm), the South Australian Passenger Transport Authority (SAPTA) and Transport project delivery (TPD). The RComm was the accredited rail infrastructure manager and rolling stock operator for the AMPRN. SAPTA managed the provision of passenger rolling stock operations and maintenance, train control functions and railway infrastructure maintenance under the RComm accreditation. The TPD, with a degree of involvement by SAPTA, managed the delivery of projects for the AMPRN, also under the RComm accreditation. 

The TPD was the contract principal for the GREP that was undertaken by principal contractor Acciona in accordance with the Gawler rail electrification project alliance rail safety management plan (RSMP). The RSMP detailed how the alliance would meet the accreditation requirements of the RComm and general safety duties under the RSNL:

The purpose of the Rail Safety Management Plan is to describe the approach the Alliance will take (with the Constructor NOP [Acciona] being the Principal contractor), with WSP and Siemens [subcontractors] to manage the Gawler Rail Electrification Project Alliance. This Rail Safety Management Plan is focused on how the Project will comply with the safety requirements when carrying out railway activities, including survey, design, construction, commissioning, use, inspection, installation, modification, maintenance, repair, cleaning, decommissioning of rail infrastructure and the operation of rollingstock on the Adelaide Metropolitan Passenger Rail Network (AMPRN).

The Rail Safety Management Plan identifies how the Alliance delivery will meet the Rail Commissioner’s Rail Accreditation Requirements as a Rail Transport Operator. This is essential in order that the Rail Commissioner can fulfil its obligations under Rail Safety National Law and Regulations. The Principal will be relying upon the professed expertise of the Constructor NOP in Rail Safety to fulfil the Rail Commissioner’s obligations pursuant to the Rail Safety National Law.

The RSMP later detailed the arrangements for rail safety management:

In all cases the Rail Commissioner’s accreditation systems and processes will apply unless granted a waiver by the Rail Commissioner’s representative/s. The Rail Commissioner’s engineering standards, for the most part, reflect Australian Standards and Rail Industry Safety Standards Board (RISSB) documentation. As a contractor working under the Rail Commissioner’s accreditation, the Alliance will construct and carry out activities and reporting to the higher level whilst ensuring the Rail Commissioner’s accreditation is met.

The SAPTA final investigation report found that TPD and Acciona did not:

…have effective processes in place to provide assurance that the rail safety obligations of the Rail Commissioner's accreditation were being met by contractors and sub-contractors.

The statements in the alliance RSMP, SAPTA investigation and ONRSR fact sheet imply the RComm was a ‘downstream’ duty holder. The remaining entities, SAPTA, TPD, Acciona, RIC and the rail safety workers of the signal maintenance team were then upstream duty holders sharing responsibility for the rail safety duties associated with the development of safety management system procedures, work instructions and plans and approval processes to manage the specialised rail safety work required to alter the level crossings (including Torrens Road) as part of the GREP works.

Appendix C – Torrens Road inspection and test plan

Source: South Australian Public Transport Authority, image modified by the ATSB to deidentify signatories

Source: South Australian Passenger Transport Authority

Source: South Australian Passenger Transport Authority

Source: South Australian Passenger Transport Authority

Source: South Australian Passenger Transport Authority

Source: South Australian Passenger Transport Authority

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Executive summary

What happened

At about 0825 (local time) on 4 December 2020, Pacific National (PN) freight train 3PM7 was passing through Werribee, about 32 km from Melbourne. The train was travelling from Perth (Western Australia) to Melbourne (Victoria) on the Australian Rail Track Corporation (ARTC) standard gauge network. 

When the train approached the level crossing at Werribee Street, the crossing’s protection equipment did not operate. However, road traffic signals that were linked to rail systems did operate to stop road vehicles. The train continued through Werribee Station with its crew under the impression that road traffic at Werribee Street had been appropriately stopped.

The next level crossing encountered by train 3PM7 was at Cherry Street which was located about 940 m east of the Werribee Street level crossing. When the train approached the level crossing, the crossing’s protection equipment also did not operate, and the train’s crew observed road vehicles crossing ahead. In response, the crew made an emergency brake application and sounded the horn. The train entered the crossing travelling at approximately 48 km/h, with motor vehicles clearing the crossing less than 2 s before the train’s arrival. 

What the ATSB found

The non-operation of the level crossing equipment occurred during signalling works associated with the removal of the level crossings at Werribee and Cherry Streets by the Western Program Alliance (WPA). Metro Trains Melbourne (MTM) was the accredited infrastructure manager for the level crossings and a member of WPA. 

With a track occupation scheduled to run from 29 November to 7 December, the broad gauge lines were closed to rail traffic while signalling circuits were being rewired, tested and commissioned. During these broad gauge works, the standard gauge line was to continue to operate normally. To facilitate the operation of the 2 level crossings for the standard gauge traffic, required control circuits were isolated from broad gauge systems being modified.

It was found that the failure of the Werribee Street and Cherry Street level crossings was due to the isolation arrangements being disrupted. This occurred at about 0800 on the morning of the incident (4 December) when function testers replaced 2 fuses that had been disconnected as part of the isolation arrangement. The testers were not familiar with the isolation arrangement. Reinstatement of fuses was not unusual in their role of function testing completed circuits.

Relevant events prior to 4 December included:

• The isolation design was changed on 27 November and involved the powering down of the Werribee relay room. The isolation arrangements also required the removal of 2 fuses and the installation of temporary (jumper) wires to facilitate a false power feed to the Werribee Street and Cherry Street crossing control circuits. 
• When installing the isolation arrangements on the night of 29–30 November, the fuses to be removed and secured were instead folded out with one end remaining in the fuse holder. This made the fuses vulnerable to reinstatement.
• Power to the Werribee relay room was returned on 2 December with temporary jumper wires for the isolation retained. In this condition, reinstatement of the fuses would result in the level crossing circuits being energised and prevent operation of the level crossing equipment.

There were several safety factors identified with regard the late change to the isolation arrangements. Critically, the changed level crossing isolation arrangements were not reflected in planning and program documentation, nor effectively disseminated to all those potentially affected by the change. An earlier internal audit of this project also identified instances of scope changes not being documented.

The ATSB also found that:

• Road traffic management was an available risk control that was not used for normal standard gauge rail traffic during testing. 
• There were opportunities for the updated isolation design to incorporate additional risk controls to reduce the likelihood of premature replacement of removed fuses.
• Although approved by MTM, the isolation and reinstatement plans were not reviewed in accordance with MTM design approval processes. 

Other identified safety issues requiring consideration are:

• MTM standards and procedures did not specifically address requirements associated with fuse removal and securement in safety critical scenarios. 
• Contrary to the requirements of relevant standards and procedures, there was probably no independent check of the installed isolation arrangements. An earlier internal audit of this project also identified instances of testers in charge checking their own work.

What has been done as a result

The Western Program Alliance and Alliance member Metro Trains Melbourne (MTM) have taken several safety actions that should address identified safety issues in testing and commissioning practices and assurance. Safety actions include the update of assurance frameworks and associated procedures, and awareness initiatives. 

As an active participant of Victoria’s Signalling Strategy Taskforce (SST), MTM is contributing to the development of consistent signalling practices and enhanced competency frameworks. The work of the SST has the potential to provide an industry-wide framework for, and contribute to, addressing safety issues like those identified in this investigation.

Safety message

This occurrence highlights the importance of considering the implications of late design changes, updating plans and programs, and ensuring all affected parties have a clear understanding of the implications for their work activities. This is particularly the case in complex projects that involve consortia, contractors, sub-contractors, and the responsible rail infrastructure manager.

The occurrence

Overview

At about 0825 (local time) on 4 December 2020, Pacific National freight train 3PM7 operating on the Australian Rail Track Corporation (ARTC) standard gauge network was travelling through Werribee towards Melbourne.[1] The train was to pass through level crossings at Werribee Street and Cherry Street which were located either side of Werribee Railway Station (Figure 1). For the passage of train 3PM7, the level crossing protection equipment at both Werribee and Cherry Street level crossings did not activate. 

Figure 1: Location of Werribee Street and Cherry Street level crossings

Source: eWay Electronic Melway Street Directory – 2017 Edition, annotated by the Office Chief Investigator (OCI)

Events prior to the non-operation of level crossing protection

Level crossing removal 

As part of the Level Crossing Removal Project (LXRP) for Melbourne, works had commenced to remove the Werribee and Cherry Street level crossings which serviced standard and broad gauge rail traffic.[2] The Werribee Street crossing was to be replaced with a rail flyover, and the Cherry Street level crossing was to be closed and a road overpass constructed to its east.

The LXRP in Werribee was being delivered by the Western Program Alliance (WPA) which included the network operator Metro Trains Melbourne (MTM). MTM was also the responsible rail infrastructure manager for the operation of the 2 level crossings. Several contractors and subcontractors were involved in signalling works associated with this removal project.

By November 2020, progress on infrastructure works meant that broad gauge tracks were only operational east of and up to Werribee Railway Station. This meant that only the standard gauge track was operational through the Werribee Street level crossing (west of the station) whereas both standard gauge and broad gauge tracks remained operational at Cherry Street.

Signalling works from 29 November 2020

Modification of the signalling systems at Werribee included extensive re-wiring of circuits in the Werribee relay room and their testing. The works, testing and commissioning were scheduled to take place from 29 November to 7 December. For this period, trains would not operate on the broad gauge lines,[3] while the single standard gauge track would remain operational. The level crossings at Werribee Street and Cherry Street were to remain operational for standard gauge rail traffic only. 

The Testing and Commissioning Plan (TCP) for the 29 November to 7 December works was finalised as issued for construction (IFC) on 4 November. The TCP provided the methodology for level crossing isolation. 

Subsequently, there was a change to the isolation strategy and an alternative isolation plan developed which included the powering down of the Werribee relay room. This change was made after the risk of circuits being undesirably energised in the relay room during the re-wiring works was identified. The new isolation arrangements were prepared by signalling contractor Active Railway Signalling (ARS) and isolation and reinstatement plans approved by MTM on 27 November. 

The alternative isolation arrangements involved the cutting of the power supply to the relay room while providing an alternative power supply, referred to as a ‘false feed’, to circuits required for the operation of level crossing equipment for the passage of standard gauge traffic. The TCP was not updated to reflect the new isolation arrangements. 

Implementation of isolation

On the night of 29 November, the Werribee relay room was powered down[4] and the temporary circuit configuration installed. Fuses 9C2 and 9C4 were disconnected by them being rotated through 90° (Figure 2) and temporary jumper wires were installed (Figure 3). In total there were 4 jumper wires installed in the Werribee relay room, and 3 in location cases near the level crossings.

Figure 2: The probable state of fuses removed on the night of 29 November

Source: MTM, taken on the morning of 4 December prior to the incident, annotated by OCI

Figure 3: One of the jumper wires installed in the Werribee relay room on 29 November

The jumper wire shown in this figure was identified as ‘number 2’. Personal details on the wire label have been redacted.

Source: MTM, taken on 4 December 2020, annotated by OCI. 

Reinstatement of power to the Werribee relay room

The changeover[5] of circuits in the Werribee relay room was noted in the commissioning log[6] as complete and ready for testers on the morning of 2 December. The entry for the completion of the changeover was not annotated with a time, however, log entries either side were made at 0500 and 0700 suggesting that the changeover completion was between these times. It was reported that power to the relay room was also restored on the morning of 2 December, although this was not recorded in the logs. 

The temporary isolation arrangements put in place on 29 November to facilitate the operation of level crossing equipment for standard gauge trains were not removed when the power was restored to the relay room following the changeover of circuits. The temporary jumper wires and disconnected fuses 9C2 and 9C4 remained as they were.

Signalling circuit function testing in the Werribee relay room

Signalling circuit function testing commenced in the Werribee relay room on 2 December and continued during the (12-hour) day shifts and (12-hour) night shifts between 2 and 4 December. The teams undertaking testing were independent of, and not involved with, the isolation installed on the night of 29 November. At the commencement of function testing, the program was behind schedule and the commissioning was unlikely to be completed by 7 December. 

On 4 December, the day shift test team commenced at 0700. Soon after, a standard gauge train 5AM5 travelled through Werribee and the level crossing protection at both Cherry and Werribee Streets operated normally. 

The function tests involved the replacement of fuses as required to complete circuits for testing. This was normal practice. At about 0800 and following discussions with others in the project regarding the need to progress the testing of all circuits, the lead tester instructed one of the team to reinstate fuses 9C2 and 9C4 (Figure 4). The testers were not aware that several temporary jumper wires had been installed as part of the level crossing isolation arrangements. 

Figure 4: Fuses 9C2 and 9C4 replaced in Werribee relay room

Source: MTM, taken on 4 December after the incident, annotated by OCI

With the jumper wires still in place, control relays remained energised when the fuses were replaced, inhibiting the operation of the level crossing equipment at both Werribee and Cherry Street level crossings.[7] 

The passage of train 3PM7 through Werribee

Passage through Werribee Street level crossing

At about 0825 on 4 December, train 3PM7 approached the Werribee Street level crossing travelling at about 50 km/h. The train was detected by rail control systems, but the level crossing equipment did not operate. However, road traffic signals on Werribee Street, which were interfaced with the train detection system, did operate and stopped road traffic. 

The crew of train 3PM7 reported sighting traffic management staff at the Werribee Street level crossing and acknowledged their presence by an application of the train horn. Although the traffic management staff were present, they were not actively engaged in managing traffic at that time.

Passage through Cherry Street level crossing

Shortly after, train 3PM7 approached the Cherry Street level crossing travelling at about 52 km/h. The train crew observed that road vehicles were crossing, and that the crossing protection had not activated. In response, the crew made an emergency brake application and sounded the train horn several times. The train entered the crossing travelling at about 48 km/h. The lead locomotive came to a stand about 200 m past the crossing.

CCTV equipment installed at Werribee Railway Station showed motor vehicles crossing on Cherry Street ahead of train 3PM7 (Figure 5). It is estimated that the cars probably cleared the path of the train less than 2 s before the train occupied the crossing (Figure 6).

Figure 5: CCTV images showing road vehicles on Cherry Street as train approaches

Source: MTM, annotated by OCI

Figure 6: CCTV image showing the locomotive entering the level crossing

Source: MTM, annotated by OCI

Post incident management

In immediate response to the incident, the level crossings were secured with traffic management and (after being notified) ARTC train control applied a signal block to prevent standard gauge rail traffic from entering the section. 

On inspection within the Werribee relay room, an MTM infrastructure team identified that fuses in positions 9C2 and 9C4 had been reinstated with temporary jumper wires still in place. The fuses were removed and secured, the crossing systems tested and the ARTC signal block removed later on 4 December to allow the resumption of standard gauge services. 

For the remainder of the works, level crossing keepers[8] were put in place at the Werribee Street and Cherry Street level crossings to ensure level crossing operations. 

Context

The train and actions by crew

Train 3PM7 was a Perth to Melbourne intermodal freight service operated by Pacific National (PN) on the Australian Rail Track Corporation (ARTC) standard gauge network. The train consisted of 2 locomotives and 26 wagons, was approximately 1.4 km long, and had a crew of 2. 

Approaching the Werribee Street level crossing, the crew were controlling train speed at about 50 km/h and within the 60 km/h permitted speed. The horn was sounded about 400 m from the Werribee Street crossing and near the crossing to acknowledge track workers.

Records indicate that approaching the Cherry Street level crossing, the train was travelling at a speed of about 52 km/h, still within the permitted speed. Then, in response to the crew detecting cars on the crossing, an emergency brake application was made by the crew when the train was about 150 m from the crossing. The speed of the train commenced to slow and entered the level crossing travelling at about 48 km/h. Records indicate the train horn was sounded by the crew several times on the approach to the Cherry Street level crossing in response to road vehicles continuing to cross. 

There was no evidence to suggest that train handling contributed to this event.

Infrastructure

Location

The Werribee Street and Cherry Street level crossings were on the Werribee line of the Melbourne metropolitan rail network and located either side of Werribee Railway Station which was about 32 rail-km from Southern Cross Station in Melbourne (Figure 7). Rail lines through the location included 2 broad gauge lines and a parallel single bi-directional standard gauge line.[9]

Figure 7: Location of Werribee Railway Station to the west of Melbourne

Not all railway stations on the Werribee line are shown in this figure.

Source: Department of Transport, annotated by OCI

Infrastructure management

Metro Trains Melbourne (MTM) was the rail infrastructure manager (RIM) of the broad gauge lines through Werribee and ARTC was the RIM of the standard gauge line. MTM was the responsible RIM for the level crossing equipment and control systems for the Werribee and Cherry Street level crossings.

Werribee Street Level crossing

The Werribee Street level crossing was located about 680 m on the down side (away from Melbourne) of Werribee Railway Station.[10]The road crossing was equipped with active protection that included flashing lights, audible warning (bells) and half-boom barriers, and an active pedestrian crossing was to its east. The railway crossing systems were also interfaced with traffic control systems (traffic signals) to assist the management of road traffic through the level crossing.

At the time of the occurrence, the rail flyover that would replace the level crossing had been constructed and new broad gauge tracks had been installed. Standard gauge traffic was still operating through the level crossing (Figure 8).

Figure 8: Aerial view of Werribee Street level crossing and rail flyover in December 2020

Source: nearmap on 12 December 2020, annotated by OCI

Cherry Street level crossing

The Cherry Street level crossing was located about 215 m¹⁰ on the up side (towards Melbourne) of Werribee Railway Station. The road crossing was equipped with active protection that included flashing lights, audible warning (bells) and half-boom barriers (cover photo). Unlike the arrangements at Werribee Street, there were no road traffic lights (interfaced with the railway systems) installed for road vehicles approaching the Cherry Street level crossing.

On the day of the occurrence, the layout of the Cherry Street level crossing included 2 broad gauge lines and a single bi-directional standard gauge line crossing Cherry Street (Figure 9).

Figure 9: Aerial view of Cherry Street level crossing in December 2020

Source: nearmap on 12 December 2020, annotated by OCI

Level crossing control

Both crossings were within the Werribee signal interlocking area. The operation of the active protection for the 2 level crossings involved train detection and signal interlocking functions.[11] Control circuitry was in trackside location cases (at each crossing) and the Werribee relay room located on the Werribee Railway Station platform (Figure 10).

Figure 10: Aerial view of Werribee Railway Station and relay room

Source: nearmap on 12 December 2020, annotated by OCI

Systems were designed so that energised control relays prevented the activation of level crossing equipment. Following the detection of an approaching train, the relays would be de-energised, activating the protection equipment. This design configuration was failsafe in that a loss of power to the control system would result in relays becoming de-energised and level crossing protection systems activating. 

A Rail Interface Control Unit (RICU) was also installed at the Werribee Street level crossing to manage the interface functions between the railway crossing system and road traffic control system. The RICU was operational at the time of the incident and on detection of the approaching train by the rail systems, nearby road traffic signals were triggered to stop traffic. This arrangement was not in place at Cherry Street.

Level crossing removal project

Administration

In 2015 the Victorian State government established the Level Crossing Removal Authority (LXRA), an administrative office within the then Department of Economic Development, Jobs, Transport and Resources (DEDJTR). LXRA was responsible for the Level Crossing Removal Project (LXRP). In 2019, administrative responsibility associated with the LXRP was transferred to the Major Transport Infrastructure Authority (MTIA), an administrative office within the Department of Transport (DoT). MTIA used an alliance contracting model and grouped level crossing sites for contracting to program alliances.

Western Program Alliance (WPA)

WPA was one of the 4 alliances established by MTIA to deliver the LXRP. The alliance comprised McConnell Dowell as the principal contractor, Arup and Mott Macdonald as design partners, and Metro Trains Melbourne (MTM) as the rail infrastructure manager. In February 2020, WPA was contracted to remove level crossings at Old Geelong Road in Hoppers Crossing, and Cherry Street and Werribee Street in Werribee.

Stage 3 works at Werribee

To facilitate the removal of the level crossings at Werribee, the infrastructure changes were delivered in 4 main stages. The signalling cabling assets were confirmed during the first stage. Stage 2 comprised civil and structural enabling works, the removal of decommissioned equipment to the west of Werribee station, and interlocking changes. Stage 3 included the commissioning of the broad gauge flyover west of Werribee Station, the installation and commissioning of a new axle counter[12] configuration and the reconfiguration of the Werribee relay signal interlocking. Broad gauge train movements west of Werribee were scheduled to return after testing and commissioning of the new system.

John Holland Group (JHG) and Active Railway Signalling (ARS) were subcontracted to undertake the signalling works associated with stage 3 of the project. Traffic Diversions Group (TDG) was contracted to implement the road traffic management plan. 

Metro Trains Melbourne (MTM)

As the accredited RIM,[13] MTM was responsible for ensuring that the design, construction, and commissioning of rail infrastructure was carried out in a way that ensured safety of railway operations. MTM was also listed as being responsible for signalling design within the WPA design and engineering management plan (WPA 2020d).

Works commencing 29 November 2020 

Background

In mid-2020, Werribee Railway Station became a terminus for broad gauge trains, allowing construction works to the west of the station. Construction, testing and certification works from September to December would bring the new broad gauge signalling layout, which incorporated the elevated section (the rail flyover) over Werribee Street, into service. 

Activities scheduled between 29 November to 7 December included extensive re-wiring of broad gauge circuits in the Werribee relay room, and testing and commissioning works. To enable these works, the project implemented a track occupation[14] and broad gauge trains were terminated at Laverton, about 10 km to the east of Werribee. This meant there would be no broad gauge traffic in Werribee during the occupation from 29 November to 7 December. 

The bi-directional standard gauge line through Werribee was not part of the occupation and remained operational. It was planned that the level crossings at Werribee Street and Cherry Street were to be operational for standard gauge rail traffic for the duration of the broad gauge track occupation.

WPA management plans and guides

WPA produced a commissioning management plan (WPA 2020b) which described the framework for the pre-commissioning and commissioning activities. The WPA also developed a works guide (WPA 2020e) which, along with other track and civil works, described the high-level signalling tasks to be undertaken. It also stipulated that working shifts were to be back-to-back 12-hour shifts from 1900 on 29 November to 0700 on 7 December. 

Test and commissioning plan

The Alliance produced a test and commissioning plan (TCP) (WPA 2020c) for the works to be undertaken between 29 November and 7 December. The plan was approved by the project’s management and issued for construction (IFC) on 4 November. The purpose of the document was to ensure that required testing and commissioning activities were identified and planned. The TCP outlined the structure of the test and commissioning team (Appendix A) which included the following key personnel:

• The Tester in Charge (TIC): The TIC was an ARS employee. They were scheduled to work the 0700 to 1900 day shifts. They prepared the TCP issued on 4 November and were responsible for the satisfactory completion of system testing and commissioning requirements in readiness for service.  
• The Shift Tester in Charge, also referred to as the Alternate Tester in Charge (ATIC): The ATIC was contracted from HJW Signalling Services Pty Ltd and was scheduled to work the 1900 to 0700 night shifts. They oversaw testing and commissioning activities during the night shifts. 
• Testers and test assistants: Testers were contracted workers from Lineside Signalling, Dragon Rail and ARS. They were responsible for testing the function of circuits.
• The Principles Tester (PT): The PT was employed by MTM and was responsible for confirming that the newly installed system operated in accordance with the relevant signalling principles and safeworking rules and regulations. 

Consistent with the MTM standard for testing and commissioning of safety related railway signalling systems (MTM 2018a), the TCP stated that management and testers involved in the works should attend a pre-commissioning briefing. An invitation to a signalling pre-commissioning meeting (with draft TCP attached) was issued by WPA on 22 October 2020 and the meeting was held on 12 November. ARTC was included in the distribution of the TCP. The briefing was not attended by several personnel either because they did not receive the invitation or they chose not to attend. This briefing was held prior to the changes made to the level crossing isolation arrangements.

Level crossing isolation design changes

Isolation plan specified in TCP issued for construction

The testing and commissioning methodology section of the TCP issued for construction (IFC) on 4 November advised that the ARTC standard gauge line would remain operational. The TCP referred to a drawing for the isolation of Cherry Street level crossing which specified an isolation methodology consistent with that used for previous stages of the project. This isolation design did not require powering down of the relay room, did not specify the removal of any fuses, and required 1 temporary jumper wire. Testing work instructions in the TCP were also consistent with these arrangements.

Isolation design changes

About 3 weeks after the finalisation of the TCP, the decision was made to power down the Werribee relay room for the re-wiring works due to concerns that circuits may be undesirably energised during the works. As a result, an updated isolation arrangement was required.

On 25 November, the TIC instructed the ARS design team to develop a temporary feed arrangement for the isolation of the Cherry Street and Werribee Street level crossings. An alternative supply, referred to as a ‘false feed’, would power the control circuits required for the operation of level crossing equipment for the passage of standard gauge traffic. 

The design was completed by ARS on 27 November. A simplified representation of the design concept for the Cherry Street level crossing isolation and power feed is shown in Figure 11.

Figure 11: Simplified representation of isolation for the Cherry Street level crossing

Image shows a simplified representation of the level crossing circuits for Cherry Street level crossing. Temporary jumper wire number 1 was put in place to bypass the broad gauge approach and signal interlocking circuits for Cherry Street level crossing. Temporary jumper wire number 2 was put in place to accommodate the planned shutdown of the relay room power supply.

Source: ATSB and OCI.

Temporary jumper wires were installed to isolate the broad gauge train detection circuits from the level crossing control circuits (label 1). During the planned shutdown of power to the relay room, the temporary jumper wire also allowed an alternative power supply (from the level crossing location case) via the control relay in the relay room to the repeater relay at the location case (label 2). The temporary modification required the removal of the power supply to the relay room by the removal of a fuse (label 3) and opening the relay room power supply circuit breaker (label 4).[15]

The isolation plan included instructions to switch circuit breakers off and provided details of temporary wiring changes and fuse removal. Construction notes on the isolation drawings included the instructions ‘install temporary purple jumper wire with green tape in the vicinity of the end of the wire’ and ‘fuses to be removed and secured’ in relation to fuse bay locations 9C2 and 9C4 (Figure 12). 

Figure 12: Construction note extract from isolation plan

Source: ARS, extract by OCI

A second set of drawings (reinstatement plan) contained instructions for the reinstatement of power to the relay room. The drawings included instructions for circuit breakers to be switched back on, fuses to be reinstalled, and temporary jumper wires to be removed. 

Approval of design changes

In accordance with the requirements of its safety management system, MTM had developed an engineering management system framework (MTM 2019a), a design assurance procedure (MTM 2019b) and a signalling design technical review procedure (MTM 2017). The signalling design technical review procedure defined requirements and responsibilities of contractors and required that design documents applicable to works on MTM signalling infrastructure be submitted to MTM for technical review. Any signalling equipment that was required to be isolated, false fed[16] or removed during project work was to be checked and verified by the contractor and details provided to the MTM Engineering Design Review Group (EDRG) for review.[17] 

The revised isolation arrangements were sent by ARS to MTM for review and approval at 1838 on 27 November. Confirmation of approval by the MTM representative of WPA was sent to the contractor an hour later. This design was not issued to the MTM EDRG for review.

Management of the isolation design change

Procedures, guidelines and management plans

The MTM Design Assurance Procedure (MTM 2019b) applied to all MTM’s infrastructure and projects. This procedure defined a design change as a change occurring post-IFC and described the structure of a Design and Engineering Management Plan (DEMP) or Design Management Plan used to detail how the design change would be managed.

The TCP (section 6.5) noted that the process for the issue of design modifications may alter depending on project and contractors’ internal processes and the process being used for each project should be recorded within the design management plan.

The WPA Design and Engineering Management Plan existed as two documents, one referred to works at Werribee (WPA 2020d), the other was a program wide plan (WPA 2019). The purpose of a design change notification (DCN) referenced in the program wide plan was to provide stakeholders with a summary of the scope of a design change made to IFC documentation. The plan stated that a DCN resulting from a design change and the design change register (DCR) would be issued to the Level Crossing Review Group (LXRG) which would review the DCN. The program wide plan also stated that all temporary work that had the potential to impact train operations and/or have safety implications were required to be reviewed by the MTM LXRG. 

Dissemination and notification of isolation design change

DCNs were recorded in the DCR for the LXRP at Werribee. Between 20 August 2020 and 4 December 2020, 19 DCNs were recorded in the register, for all infrastructure types. However, the change to the isolation arrangements in the relay room approved on 27 November was not included in the DCR and the TCP was not reissued following the change to the isolation arrangements. There was no record of communication with the LXRG concerning the design change for isolation of the level crossing.

Design changes made following the occurrence

Following the non-operation of the level crossing equipment on 4 December 2020, a design modification was made to the isolation arrangements. The design modification, dated 14 December,[18] included the addition of construction note #3 which required the wires connecting the temporary jumpers to the fuse holder to be removed, sleeved and secured (Figure 13). This modification strengthened the arrangement in that reinsertion of the fuses (alone) would not complete the electrical circuit. 

Figure 13: Extract from design modification drawing, post incident

Source: ARS, extract by OCI

Implementation of isolation arrangements

Werribee relay room environment

At the time of the isolation, access restrictions associated with the COVID-19 pandemic were in place. The WPA Pandemic and Readiness response plan (WPA 2020a) required all buildings on site to have signage at the entry point displaying the maximum capacity for each building in accordance with a 4 m² per person rule. This applied to the Werribee relay room and probably limited free access to the room during isolation activities.

At the time of the isolation, there were several technicians from the John Holland Group inside the room undertaking electrical work. The ATIC was also present at the relay room.

Installation of isolation arrangements on 29 November 

The commissioning log recorded that the broad gauge track occupation started at 2100 on 29 November. The MTM level crossing disarrangement form showed that, as planned, the Werribee Street level crossing for broad gauge services was confirmed non-operational at 2220, and the Cherry Street broad gauge crossing non-operational at 2348. These times were consistent with entries in the commissioning log. The log also recorded that the Werribee relay room power was isolated at 0135 on 30 November 2020.

The isolation drawings and construction notes[19] required certain circuit breakers to be switched off, temporary jumper wires to be installed, other wires to be disconnected and sleeved and select fuses to be removed and secured. Based on available evidence, fuses 9C2 and 9C4 were not completely removed but were instead folded out (turned 90 degrees) with one end remaining in the holder. No specific instructions existed in the MTM specification for signalling supply, construction, and installation (MTM 2018b) on the method of securing a fuse bay to reduce the risk of premature reinstatement.[20]

The purple temporary jumper wires were installed broadly in accordance with the isolation drawings, excepting for the colour of identifying labels. White tape was used to label the wires instead of green as specified in the isolation drawings. The labels identified the designated number of the temporary jumper wire (in accordance with the isolation drawing) and the name of the installer as being the ATIC. The ATIC also annotated the isolation drawings, marking off the installation of each jumper wire and the removal of fuses. The ATIC had also added the annotation of ‘tested ok’ and signed the work instruction as having checked the work. 

Several temporary jumper wire installations were recorded on the isolation drawings and in the test strap register which were inconsistent with the identification of the installer on jumper wire labels.[21] An ARS testing assistant, a cadet railway signalling engineer[22] under the supervision of the ATIC, signed the test strap register and the isolation drawing as the installer of the temporary jumper wires in the Werribee relay room when they had only installed the jumper wire at the Cherry Street location case. 

Level crossing event during isolation

At about 2320 on 29 November during the application of the isolation, a freight train on the standard gauge line crossed the Cherry Street level crossing without activating the level crossing protection equipment. Traffic control was requested to stop road vehicles passing through the level crossing shortly before the train arrived. It was reported by the ATIC that this event may have distracted those involved in the isolation activities.

Testing

MTM engineering standards for testing and commissioning

The standard for testing and commissioning of safety related railway signalling systems (VRIOG 2008) was initially developed through the collaboration of members of the Victorian Rail Industry Operators’ Group[23] (VRIOG) and was adopted by the MTM as part of its engineering standard for testing and commissioning of safety related railway signalling systems (MTM 2018a). The practices specified in the standard applied to the testing and commissioning phases of new and modified railway signalling systems. 

The standard stated that the objective of the testing and commissioning of new or modified signalling systems, including where disconnected wiring may be reconnected, was to ensure that, before the systems were used for the control of train operations, the systems were to satisfy all specified requirements, safe working standards and any application‑specific requirements. 

Other sections of the standard pertinent to this investigation included:

• Independence – The standard specified the independence required of persons involved across different parts of the work.
• Pre-commissioning meeting – The standard required a pre-commissioning meeting to be held where key personnel involved in the commissioning works were briefed and a project scope, work sites and responsibilities were identified, and a test plan provided. This meeting was required to be separate from any occupation/safeworking or other discipline‑specific meeting associated with the project.
• Testing strategy – The standard required that a written statement of the proposed testing methodology be prepared, along with proposed layout and anticipated testing content in consultation with other involved parties at an early stage of the project. The standard required that the statement was kept up to date throughout the project development. Amongst other items, the testing strategy was to include:
  • creation of a preliminary testing program that included personnel resources 
  • a program of suitable and achievable work packages for individual testers to undertake any training needs
  • the limits of the testing, including responsibilities, interfaces (equipment interfaces, area interfaces, project interfaces), and stage work requirements 
  • identification of hazards, risks and control measures 
  • train operation and safe working arrangements.
• Operational requirements – The standard stated that if train running was unavoidable, any testing that was going to disrupt the train running should be carefully planned and completed in the time available. All hazards during testing and commissioning were required to be identified and appropriate contingency plans put in place. 
• Testing procedures – These were to provide details of the tests that were required to be carried out and included:
  • insulation resistance tests[24]
  • continuity tests[25]
  • wire counts[26]
  • null counts[27]
  • strap and function tests[28]

The standard provided instruction on the installation and removal of wires and advised that new wires should be stripped and crimped, continuity tested and then insulated and secured. The standard stated testing should not commence until all yellowed wires had been disconnected and removed. Yellowed wires were those wires that the design requires to be removed during a signalling changeover and are marked in yellow on the circuit diagram.

Other relevant standards

The Rail Industry Safety and Standards Board (RISSB) Australian Standard for signal testing and commissioning, AS 7717 (Standards Australia 2016), stated that:

… before certification function testing is commenced, testers shall ensure that circuit wiring testing is complete, that the circuit wiring is secured against interference, and that the approved final circuit wiring diagrams are correctly certified as bell continuity tested, wire counted, and insulation tested. 

Testing specified in the TCP

The testing regime outlined in the TCP described tests ‘broadly in the required sequence to be completed and some activities may be completed in parallel with others.’[29] In order of activity, these were:

• insulation (megger) testing 
• continuity (bell) testing
• wire / null count testing
• strap and function testing
• through testing.

Although the testing summary in the body of the TCP was consistent with AS 7717 and the MTM engineering standard, with the wire and null count testing listed for completion prior to strap and function testing, the detailed testing program differed. The detailed program in document WPA‑program v22 for 29/11-07/12 Occupation scheduled the strap and function testing before the wire and null counts (Figure 14). 

Figure 14: Extract from ‘WPA-program v22 for 29/11-07/12 occupation’ 

Source: ARS, annotated by OCI.

Implementation of testing from 2 December

Restoration of power to the relay room on 2 December

A detailed occupation program (WPA 2020g) was issued on 27 November which indicated that testing in the Werribee relay room was scheduled to start on the morning of 30 November. However, owing to a delay, the Werribee relay room was not available to testers until the morning of 2 December. Entry 38 (of that morning) in the commissioning log recorded that the Werribee relay room changeover was completed and included the comment ‘ready for testers’. Although no specific time was recorded against this entry in the log, evidence suggests it was probably made between 0500 and 0700. 

Power was restored to the relay room on the morning of 2 December to allow function testing although there was no record of this activity in the commissioning log. When power was restored to the relay room, it is very likely that technicians did not refer to the reinstatement plans. Isolation arrangements remained in place. Fuses 9C2 and 9C4 remained disconnected and a total of 7 temporary jumper wires remained in place, 4 in the relay room, one in the Cherry Street level crossing location case, and 2 in the Werribee Street level crossing location case.

Function testing

The commissioning log recorded that function testing in the relay room was conducted later on 2 December and continued into 3 December, during day and night shifts. Testing was undertaken by teams independent of those involved in the isolation of the relay room. 

Function testers reported ‘finding wires in the wrong spots’. The TCP required that wire and null count testing occur prior to the strap and function testing. Had testing occurred in the order required of the TCP it is probable that incorrectly positioned wires would have been identified and repositioned prior to the strap and function testing.

Testing of signalling circuits in the Werribee relay room required that fuses be restored to their normal positions. The function tester leading the testing team that started work on the morning of 4 December instructed one of their team members to reinstate the fuses. This was reported to have occurred following discussions between project team members where it was decided that all fuses should be reinstated. This was probably intended to expedite function testing due to testing and commissioning being behind schedule. 

As the temporary jumper wires used for the isolation were still in place, the reinstatement of the fuses and power being restored to the relay room meant the crossing control relays for both the Werribee Street and Cherry Street level crossings were inadvertently permanently powered.

Testing with redundant wiring and bare ends

The MTM standard for signalling installation (MTM 2018b) required that decommissioned signalling wiring should be removed immediately or should have its ends cut off, sleeved, tagged, and shall be removed prior to final testing and commissioning of any new works. The Australian Standard for Signalling testing process (Standards Australia 2017), though not mandatory, also stated that testing should not commence until all wires for removal have been disconnected and removed.

On 3 July 2020, the WPA submitted a request for information to MTM asking whether a standard waiver would be required from July to December 2020 to tag, cut, and sleeve redundant circuit ends while Werribee was being configured as a terminal station. MTM confirmed that a waiver was not required for the temporary retention of redundant equipment and that WPA’s proposal to remove all redundant equipment and wiring during the 29 November to 7 December occupation was acceptable. The project did not request a waiver nor had permission been given to conduct testing while bare ends were present on redundant wiring in the Werribee relay room.

For the December testing and commissioning activities, the TCP (section 6.5) referenced the need to remove redundant wiring from the Werribee relay room. Wires requiring removal were to be identified with yellow tape. The TCP stated that testing should not commence until all yellow wires[30] and equipment had been fully disconnected and permanently removed. However, the TCP also stated that yellow wires could remain subject to the approval of the MTM Head of Engineering Signalling and if the redundant wiring was not removed, it should be made safe using blind crimps[31] or terminated. 

On 2 December, the principles tester (after attending the Werribee relay room) contacted the TIC by email, stating that principles testing[32] could not be started while there were wires with bare ends present which produced a risk of stray wires causing energisation of circuits. The principles tester advised that ‘unrecovered redundant wiring needed to be removed, and if not they needed to be made safe’. The commissioning log recorded that sleeving of wires to protect bare ends was not completed until 1400 on 3 December. The redundant wires were made safe prior to the level crossing occurrence on 4 December.

The timings recorded in the commissioning log, along with interview evidence indicates that function testing was conducted while bare ends were present. This was contrary to the TCP and continuation of function testing while redundant wiring was being made safe was probably influenced by schedule pressures. 

Road traffic management

Applicable documents

Requirements and strategies for the management of road traffic risks were mentioned in several standards, guidelines and project documents. The following is a summary of those references:

• MTM standard for testing and commissioning (MTM 2018a) stated that all hazards during testing and commissioning were required to be identified and appropriate contingency plans put in place. 
• The Level Crossing Removal Project – Western Program Alliance Works Guide (WPA 2020e) stated that traffic management personnel would be in place between 29 November 2020 and 7 December 2020 at level crossings, including Werribee Street and Cherry Street, for ‘monitoring the traffic ….’
• The WPA Works Guide (WPA 2020e) also contained a section titled ‘Road Closures/Traffic Management’. For the period between the night shift of 29 November and the night shift of 1 December, the Works Guide required traffic management at Cherry Street to ‘Stop all lanes intermittently to allow Hi-Rail Access’.[33]For the period between the day shift of 3 December and the night shift of 6 December, the guide required traffic management at Cherry Street to ‘Stop traffic over level crossing intermittently to allow for principles testing & test trains’.[34]
• The TCP did not mandate traffic management outside of the times that test trains were planned. The occupation notice (MTM 2020a) attached to the works guide that captured the area of the Cherry Street level crossing gave no specific instructions for the protection of level crossings.
• The original isolation drawings issued for construction but subsequently superseded included a requirement for ‘crossing to be protected by traffic management and safe working at all times’. This requirement was removed from the revised isolation drawings that were approved on 27 November.
• A daily train notice was issued for the standard gauge which advised of works adjacent to the ARTC rail corridor. This notice was included in the works guide (WPA 2020e), the purpose of which was to outline the details of the broad gauge track occupation for 29 November to 7 December. The daily train notice did not make reference to traffic protection or operation of the level crossings for the ARTC standard gauge line. 

Implementation

The provision of traffic management at Werribee Street and Cherry Street was subcontracted to Traffic Diversions Group (TDG). A traffic guidance scheme produced by TDG (TDG 2020) for the occupation showed the provision of traffic controller staff at both crossing locations, for both directions of traffic. 

Traffic management staff are reported to have been available at level crossings if needed for broad gauge movements but were not actively managing traffic for normal standard gauge rail traffic. Level crossing protection was expected to operate normally for standard gauge trains.

Interview evidence indicates there were differences in opinion amongst project personnel on implementation of road traffic management and a lack of clarity on managing the risks during testing. ARTC, the RIM for the standard gauge track, was not consulted by WPA or MTM in the implementation of traffic management as a risk control during testing.

MTM audit of the project in October 2020

Audit of signalling testing and commissioning works

MTM was responsible for ensuring the safety of railway operations during projects for which MTM was the accredited RIM. As part of its assurance program, MTM conducted an internal audit of testing and commissioning (T&C) activities on the Werribee project in October 2020 due to the number of incidents associated with T&C works performed in the field.[35]

The audit report (MTM 2020c) was published by MTM on 20 November 2020. The purpose of the audit was to determine the extent of MTM’s conformity with the requirements of the signalling works in TCPs. This project was selected as an audit subject as MTM had identified several new projects which were to be delivered by the Western Program Alliance (of which MTM was a member). Findings (and corrective actions as applicable) relevant to this investigation included:

• Evidence provided by the project team was not sufficient to demonstrate that changes in scope during testing and commissioning works were evaluated ‘by the relevant people’[36] to determine potential consequences. In addition, it was found that scope change details were not formally recorded in the commissioning log. The finding was categorised high priority and agreed corrective action[37] (by 23 December) required TIC to ensure that any changes in scope were clearly identified, assessed and documented, and the potential consequences documented. Assuring conformity of changes with current standards was also identified in agreed corrective action. 
• There were instances of a TIC certifying their own work at a commissioning in August 2020. The finding was categorised as medium priority and an agreed corrective action date of 15 December was specified.
• Some staff were not attending pre-commissioning meetings. No specific corrective action specified for this finding. 

The audit recommended communication of the findings to all project managers, signalling project managers, testers in charge and principles testers to share learnings from the audit and to prevent recurrence of similar findings in future works. The TIC at the time of the incident in December 2020 was included in the audit report dissemination list. 

Previous similar occurrence

Level crossing irregularity North Geelong, Victoria in 2019

The most recent example of a level crossing irregularity during infrastructure project works in Victoria involved the standard gauge passenger train 3MA8 at North Geelong, Victoria, on 8 January 2019 (ATSB 2020). The protection equipment did not activate for the passage of the train through the Thompson Road level crossing. In preparation for stage 1 track work, only the broad and dual gauge[38] tracks at the Thompson Road level crossing were to be isolated. The level crossing protections for the adjacent standard-gauge track were to remain active until stage 2 works at a later date. However, the signalling tester, having been provided with the isolation drawings for stages 1 and 2 as a single pack by the TIC, mistakenly isolated the level crossing for stage 2 work, in addition to stage 1. 

VicTrack, through their contractor UGL Engineering Limited, did not provide the TIC or signalling testers with specific instructions detailing the scope of work to be conducted at each stage of the project, but rather, only provided packaged isolation drawings for the entire project. The absence of these specific instructions increased the risk of the works being incorrectly implemented.

Safety analysis

Introduction

For the passage of train 3PM7 through Werribee on the morning of 4 December 2020, the level crossing equipment at Werribee Street and Cherry Street did not operate to stop road traffic. This led to a near-collision between train 3PM7 and road vehicles at the Cherry Street level crossing. The analysis discusses:

• The non-operation of the level crossing equipment
• Installation of isolation arrangements on 29 November
• The reinstatement of power and testing from 2 December
• Isolation design change processes and communication
• Testing protocols
• Traffic management.

The non-operation of level crossing equipment

In preparation for works on broad gauge systems, temporary isolation arrangements were established on the night of 29 November to facilitate the operation of the Werribee Street and Cherry Street level crossings for standard gauge rail traffic. The isolation included the cutting of power to the Werribee relay room, the removal of fuses 9C2 and 9C4, the disconnection of wires and the addition of temporary jumper wires in the relay room and in location cases near the level crossings. Implementation of the plans was successful in achieving activation of level crossing equipment for standard gauge traffic while works were undertaken on the broad gauge systems.

Following the completion of circuit changeover works on 2 December, power was restored to the Werribee relay room in preparation for testing. The temporary isolation arrangements that had been installed to facilitate level crossing operation for standard gauge trains, including the temporary jumper wires, remained in place.

When the fuses at positions 9C2 and 9C4 were reinserted by the testing team on the morning of 4 December with the temporary wiring still in position, operation of level crossing protection equipment at Werribee Street and Cherry Street was inhibited by the unintended permanent powering of the crossing control relays. Testers were not aware of the isolation arrangements and that their action would affect the operation of the level crossings.

Installation of isolation arrangements on 29 November

Removal of fuses 9C2 and 9C4

The isolation installation was not fully consistent with the isolation plans. Fuses were not removed and secured as described in construction notes. When implementing the temporary isolation arrangements on the night of 29 November, one end of each of the fuses in positions 9C2 and 9C4 were turned out from their holders rather than being removed and secured as described in design drawings. Although this achieved the objective of disconnecting the circuits, it left the circuits vulnerable to re-connection.

The practice of turning a fuse outward in its holder (to facilitate its disconnection) without implementing other control measures carries risk, in this instance a safety critical risk. MTM guidelines were not specific regarding the work practices required of the removal of fuses in safety critical scenarios and the application of risk controls either through more robust design and/or more robust practices to secure fuses and block fuse holders. 

Jumper wire labels

Construction notes on the isolation drawings provided the following instruction: ‘install temporary purple jumper wire with green tape in the vicinity of the end of the wire’. However, white tape was used as labelling on the jumper wires rather than the green as specified. This was a deviation from the isolation plans, although unlikely to have been noticed by testers who were not familiar with the isolation plan drawings.

Independent check of isolation arrangements

The principle of independent inspection and testing of new and altered work, including the design and/or installation of a vital circuit, requires that no person undertakes and then certifies their own work when that work produces a safety critical outcome.[39] 

It is likely that the ATIC undertook parts of the isolation works and then verified that those same works had been completed in accordance with the isolation plans. This absence of independent checking of some works was consistent with the findings of the MTM audit of this project 2 months earlier which found instances of TICs certifying their own work.

Also, documentation recording the name of the person who had installed the temporary jumper wires in the Werribee relay room was signed (as installed) by a person who was not physically present in the relay room and had not installed the wires. This was probably to ensure documentation met the independence requirements. 

Other factors

Other factors that may have influenced the installation and checking of isolation arrangements that night were considered, including project resourcing, access restrictions due to the COVID-19 pandemic, the presence of several other workers in the relay room, the passage of a standard gauge train at about 2320 during isolation implementation, and fatigue of involved personnel. Although one or more of these factors may have impacted isolation activities, there was insufficient evidence to conclude that any of these factors had significantly influenced the installation.

Project pressures to complete the testing and commissioning within the window of the track occupation probably did heighten the potential for error, particularly in the context of late changes to the isolation arrangements and limited dissemination of information on the changes to potentially affected parties. 

Reinstatement of power on 2 December 

Broad gauge works in the Werribee relay room were considered ready for testing on the morning of 2 December and power was restored to the relay room that morning. The arrangements specified in the isolation plans, including the positioning of jumper wires, were retained.

The investigation did not identify any evidence that the reinstatement plan was consulted by technicians when power was restored. The plan addressed the restoration of power to the relay room and the removal of the temporary isolation arrangements. 

There was also no provision in the reinstatement plans for the isolation (that included powering down of the relay room) to be replaced with a simplified isolation when power was restored to the relay room. It is probable that the reinstatement sequence, which included restoration of power for testing, was not fully considered in the design or the programming of testing and commissioning activities from 2 December to completion.

Isolation change processes and communication

Change to design

To facilitate powering down of the Werribee relay room while maintaining level crossing operation for standard gauge traffic, the TIC requested the ARS design team to develop a new isolation design. Isolation and reinstatement plans were developed, and the isolation plan implemented. The design achieved the desired function although it was vulnerable to the replacement of fuses with jumper wires still in position.

On the isolation plan, construction notes stated that fuses in fuse bays 9C2 and 9C4 were to be ‘removed and secured’. The risk associated with inadvertent reinsertion of fuses could have been reduced with more explicit construction notes pertaining to the labelling and protection of fuse bays, and/or the disconnection and sleeving of fuse holder terminal wires. A design modification made to the isolation plans after the event on 4 December specified disconnection of the terminal wires. 

Design change approval

The signalling design technical review procedure contained specific requirements in relation to isolations and false feeds. Project works requiring any signalling equipment to be isolated, false fed or removed required an isolation/re-instatement design package which was required to be checked, verified by the contractor, and issued to the MTM Engineering Design Review Group (EDRG) for review. The isolation and reinstatement plans approved by MTM on 27 November 2020 were not reviewed by the EDRG or the MTM Level Crossing Review Group (LXRG). Review may have led to more robust plans.

Documenting change

Test and Commissioning Plan

Standard AS 7717 (Standards Australia 2016) recognised that on occasion, there may be a need to vary from the Test and Commissioning Plan (TCP). The standard stated that the TCP should ‘remain flexible enough to allow changes in direction when problems arise’ and ‘should be kept up to date throughout the project development’.

The change to the isolation strategy was made after the TCP was issued for construction on 4 November 2020, and before the occupation that commenced on 29 November. The TCP was not updated and reissued to reflect the change to the isolation arrangements and did not detail any planned strategy for the return of power to the relay room, a partial implementation of the reinstatement plan. The risk that the design change would impact signal testing was not documented by the TIC and was probably not assessed.

Registration of change

The change to the isolation arrangements in the relay room was not included in the register of design change notifications (DCN). Inclusion of project changes in the register was important for ensuring the change was captured by MTM’s scope of accreditation and providing additional opportunities for MTM to monitor the change. 

Incorporating change into program and work instructions

Excepting for the design drawing package, the change was not incorporated into program documentation. The reinstatement plan had been developed by ARS but the implementation schedule was not clearly documented in the work program and there was no evidence of consideration of how the reinstatement plan would practically be implemented when power was to be restored to the relay room for testing. An MTM audit of this project 2 months earlier also found instances of changes in scope not being assessed and documented.

The TCP did not contain instruction regarding the reinstatement of power to the relay room. The TCP lacked the relevant instruction because the IFC version was released on 4 November before the need to power down and repower the relay room had been realised.

Communicating change

Several key staff including the testing team working in the Werribee relay room on 4 December were not aware of the change to the isolation strategy and the temporary configuration. 

Along with the change not being included in the register of DCNs, an initial change impact assessment was not undertaken. There was no record that interface with stakeholders who would be impacted by the change, such as testers, had been considered.

Pre-commissioning briefings

Several key personnel did not attend the pre-commissioning meeting held on 12 November, either by choice or because they did not receive an invitation. Although this had no impact on this event, the importance of attendance of critical staff at briefings is reflected in the MTM engineering standard for testing and commissioning of safety related railway signalling systems (MTM 2018a) and was a requirement of the TCP. Key staff not attending pre-commissioning meetings was also a finding of the internal MTM audit report released on 20 November, shortly before the incident.

Testing protocols

Context

Function testing commenced on the morning of 2 December and involved teams on day and night shifts. Testers were independent of installation works, had not been involved in the installation of isolation arrangements and were not briefed on the isolation design which differed from recent crossing removal projects undertaken by WPA. The leader of the testing team on the morning of 4 December was not aware of the isolation configuration implemented during the works and stated that the temporary purple jumper wires installed during the isolation were in addition to other purple wires installed in the relay room.

Reinstatement of fuses was required for function testing, and it was therefore not uncommon for testers to reinstate turned fuses. Practices amongst testers were reported to vary, some taking a systematic circuit-by-circuit approach to restoring circuits, others a batched approached. On 4 December and following conversations with a member of the project team, testers reinstated fuses (9C2 and 9C4) which had been turned out as part of the isolation design. The reinstatement of fuses was not considered unusual practice for testers although this team was influenced by the advice of others within the project, and probably by pressures associated with the testing and commissioning being behind schedule.

Order of testing

Signal testing comprised the following 3 main elements, each of which should be undertaken by independent teams: 

• verification, during which installed relays and wiring are visually compared to the detailed design documents. This ensures circuits do not include any contact, terminal, or wires not shown in the circuit diagram. This is generally satisfied by conducting a ‘continuity test’, a ‘wire count’ and a ‘null count’ test.
• functional testing, undertaken by functional testers, during which the electrical operation of installed relays and wiring is checked against the detailed design documents. 
• principles testing, undertaken by principles testers using their knowledge of signalling principles.

The testing summary included within the main body of the TCP was consistent with this process and the MTM engineering standard for testing and commissioning of safety related railway signalling systems (MTM 2018a) which required circuit tests to be undertaken before the functionality of the signalling was tested.

Programmed and implemented testing varied from this approach. The function testing was conducted prior to the verification element being completed. Probably because the verification had not been completed, the testing team reported ‘finding wires in the wrong spots’ when they commenced function testing. The likelihood of wires being found incorrectly installed during function testing would probably have been reduced if the wire and null count testing had been concluded before strap and function testing. Undertaking function testing prior to verifying that the installed circuits were consistent with the drawings also increased the risk of an unintentional false feed being applied to affect working circuits. This risk was not directly associated with the non‑operation of the level crossings in this instance.

Redundant wiring and bare ends

Although the installation of the new signalling had been completed by the morning of 2 December, the removal of redundant wiring had not, and wiring with bare ends presenting a hazard was not reported as resolved until 1400 on 3 December. Function testing was conducted in the Werribee relay room while there were bare ends present. This was in contradiction to MTM’s procedures and Australian Standards for signal testing and increased the risk of erroneous signal testing results. This risk was not associated with the non-operation of the level crossings in this instance.

Traffic management as risk control

The isolation design drawings issued with the IFC version of the TCP on 4 November contained the instruction ‘Crossing to be protected by traffic management and safe working at all times’. However, this instruction was not present on the isolation drawings that were approved on 27 November. During testing, traffic management was limited to the protection of road rail vehicle movements on the broad gauge tracks as part of occupation works, and to mitigate circumstances where traffic might be caught queueing over the crossing. Traffic management was also to be used for test trains on the broad gauge lines.

The commissioning works for the level crossing removal project took place adjacent to the operational standard gauge railway managed by ARTC. Level crossing activation control equipment was located in the same relay room where signal function testing was being undertaken, and the risk of this testing affecting the safety of the operating railway was not sufficiently controlled. Traffic management for the passage of standard gauge rail traffic was an available, but unused, risk control during testing and commissioning activities. ARTC was not consulted on the use of traffic management as a risk control.

After the 4 December wrong side failure, level crossing keepers who could activate level crossing operation in the instance of a system failure were posted to the level crossings for the remainder of the testing and commissioning activities. 

Findings

From the evidence available, the following findings are made with respect to level crossing irregularities involving freight train 3PM7 at Werribee, Victoria on 4 December 2020.

Contributing factors

• Changed level crossing isolation arrangements were not effectively reflected in program documentation, nor effectively disseminated to all those potentially affected. An earlier internal audit of the project also identified instances of scope changes not being documented. (Safety issue)
• When installing isolation arrangements on the night of 29–30 November, fuses to be removed and secured were instead probably folded out with one end remaining in the fuse holder. This made the fuses vulnerable to inadvertent reinstatement.
• Power to the Werribee relay room was returned on 2 December with temporary jumper wires for the isolation retained. There was no evidence of reference being made by technicians to the reinstatement plan and the vulnerability of the isolation arrangements was probably not appreciated.
• Fuses disconnected for the isolation were reinstated by testers on the morning of 4 December with the temporary wiring for the isolation still in position. With circuits in this configuration, operation of the level crossing equipment at Werribee and Cherry Streets was inhibited.

Other factors that increased risk

Isolation and reinstatement

• Metro Trains Melbourne standards and procedures did not specifically address requirements associated with fuse removal and securement in safety critical scenarios. (Safety issue) 
• There was probably no independent check of the isolation arrangements installed on the night of 29 November. An earlier internal audit of the project also identified instances of testers in charge checking their own work. (Safety issue) 

The change to isolation design

• There were opportunities for the updated isolation design to incorporate additional risk controls to reduce the likelihood of inadvertent replacement of removed fuses.
• Although approved by MTM, the isolation and reinstatement plans that included false feed arrangements were not reviewed in accordance with MTM design approval processes. 
• The change to the isolation design was not documented with a design change notification.

Other risk controls

• Road traffic management was an available risk control but not used during function testing. This became more critical following the reinstatement of power to the Werribee relay room. 
• Testing did not follow the order identified in the MTM engineering standard and the body of the Test and Commissioning Plan.
• Contrary to standards and procedure, function testing was conducted while there were signalling wire bare ends present on redundant wiring in the Werribee relay room. 
• Several staff critical to the testing program did not attend the pre-commissioning meeting for the testing and commissioning activities between 29 November and 7 December. An earlier internal audit of the project identified previous instances of this practice.

Other findings

• Records for the installation of temporary jumper wires in the relay room were signed-off as being completed by a worker who did not undertake the installation. 

Safety issues and actions

Change management

Safety issue number: RO-2020-020-SI-01

Safety issue description: Changed level crossing isolation arrangements were not effectively reflected in program documentation, nor effectively disseminated to all those potentially affected. An earlier internal audit of the project also identified instances of scope changes not being documented.

Guidelines for fuse removal

Safety issue number: RO-2020-020-SI-02

Safety issue description: Metro Trains Melbourne standards and procedures did not specifically address requirements associated with fuse removal and securement in safety critical scenarios. 

Independent checking of works

Safety issue number: RO-2020-020-SI-03

Safety issue description: There was probably no independent check of the isolation arrangements installed on the night of 29 November. An earlier internal audit of the project also reported instances of testers in charge checking their own work. 

Additional safety actions

Proactive safety action taken by the Australian Rail Track Corporation

Safety actions taken by the Australian Rail Track Corporation (ARTC) in response to this level crossing irregularity and a similar irregularity in Adelaide on 7 December 2020 include:

• Executive engagement with adjoining rail infrastructure managers on interim risk control measures at the shared active level crossings
• Updates to ARTC’s standard for bridging or false feeding signalling circuits including the ARTC requirement for bridging on the shared active level crossings
• The introduction of additional protocols for shared rail corridors and improvements to the rail/rail interface agreement with Metro Trains Melbourne, including communications.

Other relevant safety initiatives

Victoria’s Signalling Strategy Taskforce

The Signalling Strategy Taskforce (SST) was established in June 2021 as a specialist advisory group of the Office of the Director General within Victoria’s Major Transport Infrastructure Authority (MTIA). The MTIA was replaced by the Victorian Infrastructure Delivery Authority (VIDA) in April 2024.

The SST was established to address systemic issues affecting the efficient and effective delivery of signalling works required to support Victoria’s rail projects. VIDA advised that an objective of the SST is to identify and implement changes to practices, processes and methods of engagement to address key vulnerabilities identified as impacting signalling project delivery.

The SST is focused on delivering improvements in several areas of signalling planning, support and delivery. Of relevance to the circumstances of this occurrence are:

• The development of a uniform, objectively assessed, signalling competency attainment and recognition system, particularly in the areas of signalling design, testing and commissioning, that supports skills development and portability, including alignment with other national and internationally recognised schemes.
• The updating and unifying of Victoria’s railway signalling standards and related guidance material to prepare for and support the application of modern signalling and signalling control systems, as well as to reduce ambiguity and uncertainty.

ATSB comment

The successful implementation of the activities of the SST within VIDA should provide a framework for, and contribute to, addressing the safety issues identified in this investigation.

Glossary

Sources and submissions

Sources of information 

The sources of information during the investigation included:

• Metro Trains Melbourne
• Western Program Alliance
• Active Railway Signalling
• Pacific National
• CCTV footage from Werribee

References

ATSB (Australian Transport Safety Bureau) (2020) Rail Occurrence Investigation Report RO‑2019-002 Level crossing irregularity involving passenger train 3MA8, North Geelong, Victoria, on 8 January 2019, Australia.

MTM (Metro Trains Melbourne) (2017) Signalling Design Technical Review Procedure, L1‑CHE‑PRO-035 -Version 2.

MTM (Metro Trains Melbourne) (2018a) Testing and commissioning of safety related railway signalling systems - engineering standard L1-CHE-STD-073, version 1.

MTM (Metro Trains Melbourne) (2018b) MTM L1-CHE-STD-070, Specification for signalling supply, construction and installation, version 1.

MTM (Metro Trains Melbourne) (2019a) Engineering Management System Framework, L1_CHE‑MAN-001 –Version 1.

MTM (Metro Trains Melbourne) (2019b) Design Assurance Procedure, 
L1-CHE-PRO-045–Version 1.

MTM (Metro Trains Melbourne) (2020a) Absolute Occupation Notice, 2101/2020.

MTM (Metro Trains Melbourne) (2020c) Internal Audit Independent Inspection Report, Western Program Alliance (WPA), Testing & Commissioning Compliance (WPA), 2 & 7 October 2020.

Standards Australia (2016) Signal testing and commissioning (AS 7717-2016), Rail Industry Safety and Standards Board (RISSB).

Standards Australia (2017) Signalling testing process (AS7716:2017), Rail Industry Safety and Standards Board (RISSB).

VRIOG (Victorian Rail Industry Operators’ Group) (2008) Testing and commissioning of safety related railway signalling systems, 012.5 revision A Issue Date: 11/12/2008.

WPA (Western Program Alliance) (2019) Design and engineering management plan WSP‑000‑WPA-PLN-XPN-0019.

WPA (Western Program Alliance) (2020a) Pandemic and readiness response plan, 2792‑0000‑OHS-PLN-0003.

WPA (Western Program Alliance) (2020b) Commissioning management plan, WPS‑000‑WPA‑PLN-XPM-0003, revision 5

WPA (Western Program Alliance) (2020c) Test and commissioning plan, 
WSP-050-C-WPA-PLN-09- WER-GSG-0003 Revision: 0 (IFC).

WPA (Western Program Alliance) (2020d) Design and engineering management plan, WSP‑030‑WPA-PLN-XPM-0019, revision 3. 

WPA (Western Program Alliance) (2020e) Works guide, LXRP-WPA-WES: 29 Nov to 7 Dec 2020.

WPA (Western Program Alliance) (2020g) Occupation plan WPA-WES DEC OCCO, version 22, date of issue 26/11/2020

Appendices

Appendix A – Organisation structure as specified in TCP

Source: WPA project TCP adapted by OCI

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2024 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.