Safety summary

What happened

On 25 March 2019, a suburban passenger train (DW17), operated by Queensland Rail (QR) Citytrain, exceeded its limit of authority by passing signal DP29 at Park Road Station, Brisbane, while it displayed a stop indication. The signal passed at danger (SPAD) occurrence resulted in a near collision with another suburban passenger train (1E65), which was proceeding in the same direction on an adjacent line to a merging conflict point.

The potential of collision was prevented by the actions of a tutor driver in the driving cab of 1E65, and a network control officer who transmitted an emergency stop command after receiving a SPAD alarm. DW17 exceeded its limit of authority by 305 m and stopped 55 m past the conflict point, while 1E65 stopped about 70 m prior to the conflict point. There were no injuries, however DW17 ran through the points, which were set for 1E65, resulting in minor infrastructure damage.

What the ATSB found

After DW17 stopped at Park Road, with the platform departure signal (DP29) displaying a stop indication, the driver did not apply the operator's ‘stopped at a red’ procedure. After receiving the allright signal from station staff indicating station duties were complete, the train’s guard promptly provided the driver with the rightaway signal, even though the departure signal was still displaying a stop indication. The driver then promptly departed the station platform without effectively checking and confirming the departure signal. The actions of the guard and the driver were probably associated with a very high level of expectancy that, after receiving the allright signal and the rightaway respectively, the departure signal was indicating a proceed aspect.

The occurrence involved a new generation rollingstock (NGR) train. In contrast to previous QR suburban passenger trains, where the guard was positioned in the middle, the NGR had the guard positioned at the rear, and station staff provided assistance (if required) to passengers who were boarding or alighting in the middle of the train. The NGR fleet commenced operations in December 2017, and in January 2019 there was a change to procedures that required station staff at suburban stations to provide the allright signal for all NGR services. This significantly increased the frequency that allright signals were provided to guards of NGR trains at suburban stations.

Following this change there were 5 start against signal SPADs involving NGR trains at suburban platforms between March 2019 and March 2020, with a sixth SPAD in April 2021. The investigation found that there were limitations in QR’s application of risk management and change management processes relevant to the introduction of the NGR that increased the risk of a start against signal SPAD. Specifically, multiple processes did not effectively consider the risk of station staff at suburban platforms providing the allright signal for all NGR trains even when the platform departure signal displayed a stop indication, which was in contrast to how allright signals were being provided in practice for all trains at the 3 central business district stations and 2 other designated stations.

At station platforms where a guard could not sight the departure signal, signal aspect indicators (SAIs) were installed. With the introduction of the NGR, with the guard at the rear of the train, a significant number of SAIs had to be installed or moved. The investigation found that QR’s procedures for the installation of SAIs did not provide sufficient guidance to ensure their consistent and conspicuous placement at station platforms. This problem, combined with an SAI’s non-salient indication when the platform departure signal displayed a stop indication, increased the risk that an SAI would not be correctly perceived by a train guard.

Although not a contributing factor, the investigation found that, associated with a late-notice roster change, the guard was probably experiencing a level of fatigue known to adversely influence performance. In addition, QR’s fatigue management processes for Citytrain train crew had limited processes in place to actively identify and manage the risk of restricted sleep opportunity resulting from late-notice roster changes.

What has been done as a result

QR advised that it had reviewed, consulted and implemented a revised Operational Readiness program, which involved simplifying the operational readiness assessment process and integrating safety change management into the assessment criteria for future projects. The ATSB notes that, with regard to the issues associated with the change to the allright procedure, the risk of this specific safety issue has decreased as guards have become more familiar with the location of signal aspect indicators and the new processes at suburban station platforms. This has seen a decrease in the rate of start against signal SPADs in recent times. The ATSB will continue to examine change management issues in current and future investigations.

In addition, QR also issued an important safety notice to rail traffic crew and rostering personnel regarding unplanned shifts and required that rostering personnel complete a checklist when arranging unplanned shifts with less than 12 hours notice prior to the start of the shift. QR also will review its fatigue risk management standard later in 2022.

Safety message

Where there are limited engineering controls to manage SPAD occurrences, it is vital that train drivers and guards routinely apply the procedures designed to minimise the risk of a SPAD. This is particularly important during the station dispatch process, when expectancies and distractions have been demonstrated to have undesired influences on performance.

Rail operators are reminded to apply structured risk management and change management processes. In particular, operators should apply a formal change management process to assess the potential risk of a procedural change before determining that the change is minor in nature. Operators also should ensure they understand the undocumented or informal risk controls that are in place in their operation, and how exactly operational personnel are applying current procedures, prior to introducing changes.

A commonly-overlooked aspect of risk management is the need to consistently monitor and review the health of risk controls, either existing or newly-introduced, through a variety of activities and to continuously look for opportunities to improve the operator’s risk position.

The occurrence

Overview

On 25 March 2019, a suburban passenger train (DW17), operated by Queensland Rail (QR) Citytrain, was en route from Cannon Hill to Northgate, Queensland, on the Cleveland line. The train consisted of ‘new generation rollingstock’ (NGR). It departed Park Road Station while the departure signal (DP29) was displaying a red aspect (or stop indication). The network control officer (NCO) made an emergency call to the driver, who stopped the train.

Events prior to arriving at Park Road Station

DW17 was scheduled to stop at all stations between Cannon Hill and Northgate (Figure 1). It departed Cannon Hill on time at 1201.^[1] The rail traffic crew consisted of a driver and a guard.

Figure 1: Excerpt of Brisbane suburban network showing origin (Cannon Hill) and destination (Northgate) of train DW17

Source: QR, modified by the ATSB

The train travelled towards the city on green signals before encountering a yellow (restricted) aspect in signal LS059, which was located on the approach to Buranda Station (the station prior to Park Road). As it passed over the automatic warning system (AWS)^[2] magnet applicable to the signal, the AWS generated an audible and visible alarm in the driving cab, advising the driver of the restricted signal ahead. The driver acknowledged the alarm by pressing and releasing the AWS button.

After stopping at the Buranda Station platform, the driver placed the brake controller in full service but did not place the direction controller into neutral. This was inconsistent with the operator’s ‘start on a yellow’ procedure (see Citytrain driving procedures). The train departed Buranda on time at 1211:30.

The train then passed signal DP17 (displaying a flashing yellow aspect) and signal DP23 (displaying a single yellow aspect). Prior to passing each signal, the AWS generated a restricted signal alarm in the driving cab and the driver responded accordingly. Signal DP23 was the authority to proceed into platform 2 at Park Road Station. The driver subsequently reported that, based on the previous signal indications, they were expecting a red signal at Park Road Station.

Arrival at Park Road Station

At 1214:00, DW17 passed over the AWS magnet for signal DP 29 (the departure signal for platform 2 at Park Road), and the driver acknowledged the alarm. At that time, DP29 was displaying a red aspect.

At 1214:25, the train stopped at the relevant platform stopping mark at Park Road Station. The driver did not move the direction controller to neutral or apply the park brake, which was inconsistent with the operator’s ‘stopped at a red aspect’ procedure (see Citytrain driving procedure).

Signal DP29 was displaying a stop indication because the NCO had planned to briefly delay DW17 at the platform. This was to allow another suburban passenger train (1E65), which was running late, to proceed in advance of DW17 and pass through the middle road (platform 3) to connect with the down suburban line (Figure 2).

Figure 2: Signal DP29, the middle road and the down suburban line at Park Road Station

The image was taken from the forward-facing camera of DW17 on the day of the occurrence. It shows the down suburban line, which DW17 was traversing, and the red aspect in signal DP29. The middle road was set for the path of 1E65 to run in advance of DW17.

Source: QR, modified by the ATSB

1E65 was scheduled to run all stops between Beenleigh and Ferny Grove. The train departed Beenleigh 5 minutes late at about 1117. It recovered some lost time and arrived at Yeerongpilly Station (4 stations prior to Park Road) at 1207, 3 minutes behind schedule.

At the Yeerongpilly Station platform there was an unplanned driver change. A tutor driver, who was providing a trainee driver with route tuition, seconded the train at the platform and the trainee took over driving duties. At 1214:50, 1E65 came to a stop at platform 3 at Park Road. The platform 3 departure signal (DP27) displayed a green aspect to allow 1E65 to run in advance of DW17.

Signal passed at danger (SPAD)

On platform 2 at Park Road, a station porter aided a passenger in a wheelchair to board DW17. At 1215:02, the porter gave the ‘allright signal’^[3] to the guard to signify platform duties were complete. There was no requirement in the allright process for station staff to check the indication in the departure signal. At that time, signal DP29 was still displaying a red aspect.

As signal DP29 was not visible from a guard’s location at the rear of an NGR train, a signal aspect indicator^[4] (SAI) had been installed on the platform to assist guards with the process of providing ‘rightaway’ signals to drivers (Rightaway signal procedure).

The guard of DW17 stated that, after the train stopped, they stepped from the train onto the platform in accordance with the rightaway procedure. They noticed the porter assist a passenger into the train and then provide the allright signal. The guard said they then checked the SAI and noted that it was illuminated (indicating that DP29 was displaying a proceed indication). They then boarded the train and, at 1215:03, they provided the rightaway signal (2 bells) to the driver.

A review of closed-circuit television (CCTV) footage determined that the SAI was not illuminated and the guard did not step from the train onto the platform at Park Road, although they looked up and down the platform from within the crew compartment at the rear of the train.

On receipt of the rightaway, the driver pressed the doors closed button and waited for the ‘doors open’ tile to extinguish. At 1215:25, the driver applied traction power, and at 1215:27 the train (DW17) departed the platform on the down suburban line (with the departure signal DP29 still displaying a red aspect). The driver subsequently reported that they could not recall checking or sighting the status of signal DP29 prior to departing the station, and they were prompted to depart after receiving the rightaway from the guard.

At about the same time that DW17 departed from platform 2 on the down suburban line, 1E65 departed from platform 3 on the middle road (with the departure signal DP27 displaying a green aspect). The down suburban line and the middle road merged at a point about 250 m past signal DP29.

At 1215:34, the universal traffic control^[5] (UTC) system at the Brisbane rail management centre generated an alarm to the NCO, which stated ‘train DW17 past signal 29 at STOP’. At the same time, the UTC system showed train 1E65 had passed signal DP27. The trains were traveling in the same direction on a collision course.

Response to the SPAD

Initially, the crews of both trains were unaware of the circumstances as they accelerated away from their respective platforms. However, the tutor driver in the driving cab of 1E65 soon became aware that the train on the adjacent track (DW17) had exceeded its authority and there was potential for collision at the merging points. At that time, the speed of 1E65 was 43 km/h. The tutor driver initially directed the trainee driver to apply the brakes to slow the train, but on hearing an emergency stop command over the train radio, the tutor driver directed the trainee to stop the train.

At 1215:43, the NCO transmitted ‘emergency, emergency, emergency’ DW17 stop your train, emergency, emergency, emergency DW17 Park Road stop your train’. The NCO then immediately transmitted a similar message for 1E65, and then transmitted ‘all trains Park Road stop your trains’ twice in succession. All of these messages were transmitted over the ultra high frequency (UHF) open radio network and could be heard by all drivers.

Initially, the driver of DW17 thought the emergency command was for another train, but then noticed the points ahead were set in reverse for the train on the middle road (that is, 1E65) (Figure 3). The driver then recognised that the emergency stop command related to their train, and that they had exceeded their limit of authority by passing signal DP29. At 1215:56, while travelling at 54 km/h, the driver applied the brakes, and the train came to a stop at 1216:08.  

Figure 3: Points set in reverse for the path of 1E65

The image was taken from the forward-facing camera of DW17 immediately prior to the train running through the points that were set for 1E65.

Source: QR, modified by the ATSB

At 1216:10 the crew of 1E65 advised they had stopped their train. At 1216:17, the driver of DW17 also advised that their train was stopped.

DW17 exceeded its limit of authority by about 305 m (about 55 m past the conflict point between the 2 lines); 1E65 stopped about 70 m prior to the conflict point.

The SPAD occurrence resulted in no injuries and only minor damage to rail infrastructure. The damage was due to DW17 running through the points, which were set in reverse to facilitate the movement of 1E65 from the middle road to the down suburban line at Park Road.

As the damaged infrastructure was located under DW17 when it stopped, QR personnel evacuated the passengers from the train under the authority of an all trains block.^[6] The passengers were assisted off the train and escorted along the permanent way back to Park Road Station. 1E65 was authorised to return to platform 3, from where the service continued to the city via the dual gauge line.

__________

1. All time references in this report are in local time (Eastern Standard Time).
2. The AWS is designed to provide an in-cab visual and audible indication of the aspect displayed in the next signal.
3. The allright signal will be provided by the officer in charge or station staff, when they are in attendance, to indicate to rail traffic guard or passenger services staff that station duties have been completed and all persons are clear of the rail traffic. See Allright signal procedure for the EMU business operating model for further information.
4. Where the viewing of a main signal is obstructed from viewing on a platform a signal aspect indicator (SAI) will be fitted to assist the guard when giving rightaway. It provides a white light when the signal is at proceed and no light when the signal is at stop (see Signal aspect indicators for further information).
5. A system unique to QR that assists network control officers safely route and monitor the movement of trains.
6. All trains block: an application at the NCO’s workstation that places signals at stop in the immediate area to prevent train movements.

Context

Train information

DW17 was an electric suburban passenger train operated by Queensland Rail (QR) Citytrain and timetabled to travel between Cannon Hill and Northgate. On departure from Park Road Station, it had 41 passengers on board.

DW17 was a new generation rollingstock (NGR) train, unit number 726. NGR trains consisted of 6 cars with a driving compartment at each end. They were operated with the guard positioned in the rear driving compartment. The trains were 146.7 m long and weighed 260 t.

The train operated as designed and there were no reported or recorded faults that influenced its serviceability. The train was fitted with an event recorder and front-of-train camera. These systems operated effectively during the occurrence sequence, and relevant information from these systems are included in this report where relevant.

Rail crew information

Driver qualifications and experience

The driver of DW17 joined QR in 1963 and gained train driver qualification in 1976 and they had almost 43 years’ service as a train driver.

In 1987, the driver obtained the qualification to operate electric multiple unit (EMU) trains. In January 2018, the driver achieved an additional qualification to operate NGR trains. DW17 was the only NGR train the driver operated on 25 March 2019. They reported having operated NGR trains about 30–40 times since they obtained their qualification and had last operated an NGR train on 23 March.

The driver was route competent^[7] to operate trains throughout the Brisbane suburban rail network and frequently worked passenger trains from Cleveland to the city via Park Road. The driver reported being familiar with the signalling arrangements at Park Road and had traversed through Park Road platform 2 on numerous occasions.

Records supplied by QR showed that the driver was involved in a previous SPAD occurrence at signal SB21 (South Brisbane) on 23 August 2009. On that occasion, the driver did not apply the ‘stopped at a red’ procedure when stopped at the platform departure signal and did not check the departure signal after receiving a false (incorrect) rightaway signal from the guard. The driver’s 2009 SPAD occurrence at signal SB21 showed similarities to that of the SPAD at signal DP29 on 25 March 2019.

Driver medical information and recent work history

The driver underwent a medical assessment (rail category 1 – high-level safety worker) on 11 March 2019 and was assessed as fit for duty. Following the SPAD occurrence on 25 March 2019, the driver undertook a mandatory drug and alcohol test, which produced negative results (that is, no drugs or alcohol detected).

The driver’s duty times for the day of the occurrence (25 March 2019) and previous days are shown in Table 1. They had a day off duty on 16 March, followed by 7 shifts in a row prior to another day off duty on 24 March. They commenced duty on 25 March at 0412. The shifts on 15, 17 and 18 March were also originally designated as days off duty.

Table 1: Day-of-operations duty times for driver over previous 10 days

The driver stated that they obtained 6 hours sleep on the night of 24 March and felt well rested before commencing duty at 0412 on 25 March. They noted that 6 hours sleep was the minimum they needed to function effectively.

The driver operated multiple train services and had 2 meal breaks on the 25 March prior to operating a train from Bowen Hills to Cannon Hill and then commencing the DW17 service from Cannon Hill to Northgate. DW17 was scheduled as their last train service of the day.

Guard qualifications and experience

The guard of DW17 commenced work with QR in 1974 and performed various roles before being appointed to the position of train guard in 1984. In 1990, they transferred to Brisbane (Mayne depot) and thereafter worked as a Citytrain guard up until the SPAD occurrence on 25 March 2019.

The guard became qualified to conduct duties on NGR trains in August 2018. They stated they had conducted operations on NGR trains on numerous occasions, primarily on the Gold Coast line (including through platform 3 at Park Road). However, they had never worked an NGR train on the Cleveland line from Cannon Hill before and had never stopped on platform 2 at Park Road on an NGR train. Accordingly, they had not previously used the signal aspect indicator (SAI) for DP29 before 25 March 2019 (see also Communication of information about the location of the SAIs at Park Road).

Guard medical information and recent work history

The guard underwent a medical assessment (rail category 2 – safety critical worker) on 14 November 2018 and was assessed as fit for duty. Following the SPAD occurrence on 25 March 2019, the driver undertook a mandatory drug and alcohol test, which produced negative results (that is, no drugs or alcohol detected).

The guard’s duty times for the day of the occurrence (25 March 2019) and previous days are shown in Table 2. They had 2 days off duty before commencing duty at 0412 on 25 March.

Table 2: Day-of-operations duty times for the guard over previous 6 days

The guard was originally rostered to commence work at 0900 on 25 March 2019. However, at 2208 on 24 March, a QR roster clerk called the guard to ask if they could start work at 0412. The guard, who was awake at the time, accepted the earlier start time. Soon after that conversation, the guard required more information on the new shift so they called the on-duty roster clerk to gain these details. During these calls, the guard did not advise the roster clerks of any concern with undertaking the changed shift.

The guard recalled waking at 0200 on 25 March. Based on the available evidence, the ATSB concluded that the guard probably had approximately 3.0–3.5 hours’ sleep prior to starting work. The guard recalled feeling normal on the day of the occurrence.

The guard operated the same train services as the driver of DW17 on 25 March, including having 2 meal breaks prior to the occurrence.

Station and signal information

Park Road Station

Park Road is an interchange station for the Gold Coast and Cleveland lines. It is located about 4.3 rail km south-east of Roma Street Station and serves the Brisbane suburb of Woolloongabba. The station has 4 platforms (Figure 4) and caters mainly for medium to high frequency suburban passenger traffic.

Figure 4: Platform configuration at Park Road Station

The image shows the platform configuration at Park Road, relevant signals, and the direction of travel of trains DW17 and 1E65. Source: Google maps, modified by the ATSB

Signal DP29

Signal DP29 was located at the 4.238 km mark.^[8] It was about 5.8 m off the departure end of platform 2 at Park Road and 10 m from the 6-car stopping mark on the platform. Traditionally, signals at or near to the end of platforms were referred to as platform departure signals, although some suburban station platforms (such as at Buranda Station) did not have a departure signal.

Signal DP29 was a 4-aspect colour light signal, capable of displaying green, double yellow, yellow or red aspects and was fitted with light emitting diodes (LEDs). Figure 5 provides information about the function of the different aspects. More generally, the term ‘proceed’ is used to refer to a signal displaying a green, double yellow, single yellow or flashing yellow aspect, and ‘restricted’ is used to refer to a signal displaying a double yellow, single yellow, flashing yellow or red aspect.

Figure 5: Four-aspect colour light signal indications

The image shows the indications displayed by a 4-aspect colour light signal and their authority. At some locations, a flashing yellow aspect is part of the 4-aspect colour light sequencing.    

Source: Queensland Rail (QR)

The signal had an unrestricted sighting distance greater than 100 m, and the designated track speed approaching the signal was 40 km/h. The positioning and sighting of the signal complied with QR standard MD-10-95 (Signalling positioning principles).

QR advised there had been one other recorded SPAD occurrence at signal DP29 since 1996. This occurred in April 2004 and was categorised as a ‘signal restored in face of train’ occurrence, rather than a driver initiated SPAD.

Although signal DP29 was well positioned from a sighting perspective, the driver of DW17 stated they did not see the red aspect in the signal as the train approached and stopped at the platform. The driver said that they had lowered the windscreen blind to reduce sun glare reflecting off the dashboard and this may have restricted the sighting of the signal.

A review of station closed-circuit television (CCTV) footage showed that the blind was in a lowered (but not fully lowered) position on the windscreen as the train entered the station platform. The ATSB re-enacted the occurrence based on information from the driver and evidence from the station CCTV footage. The re-enactment showed that the position of the windscreen blind would not have hindered the driver’s view of the red aspect in the signal (Figure 6).^[9]

Figure 6: A view of signal DP29 from the driver’s seat of an NGR service stopped at the 6-car stopping mark at platform 2 Park Road

The photo, taken from the driver’s seat of an NGR service, shows the red aspect in signal DP29 with the front blind almost fully drawn.

Source: ATSB

In August 2017, an SAI was installed on platform 2 at Park Road Station as part of the introduction of NGR trains (see Location of the SAI on platform 2 at Park Road).

Citytrain driving procedures

Safe driving procedures

The QR suburban rail network had limited engineering or technical controls in place to detect potential or actual SPADs and manage their risk (see ATSB report RO-2018-002).^[10] Consequently QR heavily relied on front line staff to manage risk through their compliance with procedures.

QR procedure MD-11-72 (TSD professional driving – Safe driving) outlined rules for train drivers to apply ‘to mitigate the incidence of Signals Passed at Danger (SPAD) and other adverse operational safety events’. The procedure stated:

Safe Driving focuses on planning, prioritising, communicating and taking appropriate positive actions. The methods of Safe Driving are important defences against the risk of error and are intended to reduce errors and mitigate risk in the event of errors occurring…

The technique shall be incorporated into all aspects of day to day driving, driver training, driver monitoring, assessment, accreditation and reaccreditation programs. The principle of the driving method is based around thinking safety, behaving and acting proactively and positively in all situations which could arise. Safe driving is mandatory.

The procedure included several specific rules to mitigate the risk of SPADs, and those relevant to the 25 March 2019 SPAD occurrence are outlined below.

Approaching yellow aspects

If a train was approaching a signal displaying a double yellow or single yellow aspect, the driver was required to reduce the train speed to (or below) 75% of the designated track speed when passing the signal. When approaching a signal displaying a flashing yellow aspect, the driver was required to pass the signal at a speed no greater than 40 km/h, or the designated track speed, whichever was the lower.

As signal LS059 (prior to Buranda Station) was displaying a single yellow aspect, the train speed was required to be limited to 45 km/h after departing Buranda. However, the train was accelerated to about 57 km/h before traction power was shut off as it approached signal DP17 (which was displaying a flashing yellow aspect). Under braking, the train passed DP17 at 47 km/h (in excess of the 40 km/h limit) and continued to slow to 25 km/h as it passed through a turnout with a 25 km/h speed limit.

Start on a yellow

When the platform departure signal was displaying a single yellow or flashing yellow aspect, then the driver was required to fully apply the train brakes (that is, to the full service position) and place the direction controller into the neutral position. The same action was required if there was no departure signal (such as at the Buranda Station platform) and the signal prior to the platform was displaying a single yellow / flashing yellow aspect.

Evidence from DW17’s event recorder showed that the driver did not fully comply with the ‘start on a yellow’ procedure at the Buranda Station platform; although they applied the train brakes to full service, they did not move the direction controller to the neutral position.

Approaching a red aspect

When approaching a signal displaying a red aspect, the driver was required to apply the ‘20 / 20’ rule. This stated that the driver must reduce the speed of the train to 20 km/h when passing over the AWS magnet (located about 80 m prior to the signal) and target a stopping point 20 m prior to the signal.  

DW17’s event recorder showed that the train speed was moderately above 20 km/h passing over the AWS magnet for signal DP29. However, the driver demonstrated caution when approaching the signal, suggesting they were aware of its indication.

Stopped at a red aspect

When an electric suburban train stopped at a station platform and the departure signal was displaying a red aspect, the driver was required to:

• move the brake controller to the full service position
• place the direction controller into the neutral position
• apply the park brake
• release the driver’s safety control.^[11]

After stopping the train at the Park Road platform, the driver of DW17 placed the brake controller to full service but did not move the direction controller to neutral or apply the park brake.

The driver stated that they were aware of QR’s start on a yellow and stopped at a red procedures and the reasons for the procedures, and agreed that they were a good idea for reducing the risk of a SPAD. The driver also stated that sometimes they followed these procedures, but at other times they tailored their own risk management measures, which they felt confident with, and they had applied this approach successfully over many years as a driver.

Safe driving assurance data

QR commenced a process to review event recorder data to collect data on driver compliance with key SPAD mitigation rules in April 2018 (see ATSB report RO-2018-002). QR advised that data for the periods from September 2018 to March 2019 indicated compliance rates as follows:

• 87% for the 75% rule (approaching a single yellow or double yellow aspect)
• 55% for the start on a yellow rule
• 99% for the 20 / 20 rule
• 92% for the stopped at a red rule.

Risk triggered commentary driving

To assist with reducing the frequency of SPADs, QR introduced risk triggered commentary driving (RTCD) in 2008–2009, and subsequently Citytrain made it a mandatory requirement for its drivers in 2011 for situations where they were approaching restricted signals. QR procedure MD-13-165 (TSD professional driving – risk triggered commentary driving) stated:

At a basic level, RTCD involves RTDs [drivers] acknowledging the aspect of the restricted signal, and intended actions, by speaking aloud. By applying RTCD, RTDs can listen to their thoughts and the subsequent actions they are planning to apply. This allows RTDs to ‘sense check’ what they should do next.

RTCD is required to be applied continuously from the acknowledgement of the restricted audible alarm on the Automatic Warning System (AWS) until the action that must be taken is actually performed…

The driver of DW17 stated that they were applying RTCD ‘to some degree’ during the period leading up to the SPAD occurrence on 25 March 2019. They had noted each of the 3 yellow signals prior to reaching Park Road, but they had not verbalised these signals (or the required actions) out aloud.

Further information regarding QR’s implementation of RTCD is provided in ATSB report RO-2018-002.

QR’s electric suburban train business operating models

Electric multiple unit (EMU) business operating model

In 1979, QR introduced electric multiple units (EMUs) to the Brisbane suburban rail network. The EMUs consisted of 3-car units that worked either as 3-car trains or coupled together as 6-car trains. The 6-car configuration with the guard working from the middle compartment of the train was the preferred business operating model (BOM).

Due to the location of the guard in the middle of the train, station platforms were designed with provisions in the middle of the platform to cater for the needs of passengers who required boarding assistance. It was the guards’ role to assist with passenger boarding / alighting arrangements at suburban station platforms as required.

Allright signal procedure for the EMU business operating model

Under the EMU BOM arrangement, there was no requirement for station staff at a suburban station platform to provide the allright signal to a train guard. However, due to high patronage at Brisbane central business district (CBD) stations (Roma Street, Central and Fortitude Valley), and at 2 designated suburban stations with bus connections on the Sunshine Coast line (Nambour and Gympie North), station staff were required to provide the allright signal for every suburban passenger train at those stations.

QR procedure MD-10-109 (Observance of signals manual) stated that, prior to giving the allright signal, station staff were required to:

            -   make sure … staff have completed all duties associated with the rail traffic

            -   blow whistle or use loudspeaker to warn people to stand clear of the rail traffic

            -   make sure all people are clear of the rail traffic

            -   make sure doors on passenger rail vehicles, not operated by the rail traffic driver, are closed...

Station staff communicated the allright signal to the guard during daylight hours by raising one arm at 45° above shoulder height, and in the hours of darkness by a white light held above shoulder height.

There was no official requirement for station staff to check the aspect indication in the platform departure signal prior to giving the train guard the allright signal.

During the course of the investigation, experienced current and former station staff informed the ATSB that there was a long-standing informal practice at Brisbane CBD stations and at Nambour for station staff to check that the departure signal was at proceed prior to giving the allright signal to the train guard. They recognised that checking the signal was not part of the station staff formal duties; however, the informal practice had been in existence over many years and it had been encouraged by more senior station staff as an additional assurance against false rightaways resulting in SPAD occurrences.

An ATSB investigator visited Central Station and observed station staff checking the departure signals prior to issuing the allright signal.

New generation rollingstock (NGR) business operating model

On 27 June 2017, QR adopted a BOM for the NGR. The configuration of the NGR fleet was different to the existing EMU fleet; NGR trains were permanently coupled 6-car units with no guard’s compartment in the middle of the train. Therefore, the BOM for NGR trains involved the guard working from the rear driving compartment of the 6-car train. In December 2017, NGR trains commenced operations on the Brisbane suburban (Citytrain) rail network.

The location of the guard at the rear of the train posed some challenges for operations, as the boarding point for passengers who required assistance with boarding and alighting remained in the middle of the train (and platform). To overcome these challenges, QR required station staff at all Citytrain stations (CBD and suburban station platforms) to meet every NGR service, where practicable, for the purpose of providing passenger assistance as required.

Allright signal changes for the NGR business operating model

At the time of the NGR being introduced into service, a station customer service (SCS) notice to station staff (SCS employees meeting trains – New generation rollingstock) stated that they were required to provide the allright signal to a guard:

• at the 3 CBD stations (Roma Street, Central, Fortitude Valley) and 2 nominated suburban stations (Nambour and Gympie North)for all services
• at all other suburban stations only when there was an assisted customer activity to complete and the boarding assistance was provided to the customer.

Station staff at suburban stations confirmed that they were trained to provide the allright signal only on the condition that they provided passenger assistance. During training they were told not to check the platform departure signal prior to giving the allright signal as that was not their role. They explained that delivery of the allright signal was an indication to the guard that platform duties were complete, and passengers and staff were clear of the train.

Citytrain’s SCS management also confirmed to the ATSB that, with the introduction of NGR services to the network in December 2017, station staff at suburban stations were only required to give the allright signal for an NGR service and only if they had assisted a passenger on or off the train. There was no requirement to provide the allright signal if passenger assistance was not provided.

Guards stated that initially this change resulted in confusion for them as it was contrary to the allright process at the CBD stations and the other 2 nominated stations, where the allright signal was given for all trains.

A search of train crew training modules (provided by QR) relevant to the NGR BOM identified no documented guidance for train guards relevant to the allright signal from station staff at suburban stations. An important operational notice (ION) (015­­_01_2018) titled NGR – Arrival/Departure Procedures, was disseminated by Citytrain’s train services delivery (TSD) section to train crew in January 2018. This notice stated that the allright signal would only be given at designated stations; however, it did not nominate the designated stations.

Modification of the NGR business operating model

On 10 January 2019, TSD issued another ION to train crew (drivers and guards) to advise that the NGR BOM had been modified. It stated:

In addition to the introduction of the New Generation Rollingstock (NGR), an NGR Business Operating Model (BOM) was introduced to outline the operational requirements for this class of Rollingstock. An agreement has been reached between Train Service Delivery and Station Customer Service (SCS) that SCS staff members will provide the ‘Allright’ signal, as well as one (1) whistle blow, when attending any NGR revenue service.

The ION also provided answers to frequently asked questions, including:^[12]

Are SCS staff required to attend all NGR services at all platforms?

No, there may be circumstances which prevent a member of SCS staff attending to an NGR service. In this instance, the RTG [guard] is responsible for any assisted boarding activities when the platform is unattended and there is an assisted boarding requirement.

Are SCS staff required to give the Allright signal to the RTG, when attending NGR services?

Yes, SCS staff at Suburban stations are required to provide the Allright signal to the RTG when they attend to an NGR service.

Note: This does not affect the requirement for an RTG [guard] to receive the ‘Allright’ signal, for all trains, prior to giving Rightaway at Roma Street (excluding P2, P3 and P10), Central, Fortitude Valley, Nambour and Gympie North…

What information is the SCS staff member providing when they give the ‘Allright’ signal?

When an SCS staff member gives the Allright signal, it advises that they have finished their required platform duties only.

Note: This is not an indication that the departure signal is at proceed. The RTG is responsible for observance of signals prior to giving Rightaway…

On the same day, TSD issued another ION (006_01_2019), which replaced the 2018 notice regarding NGR arrival and departure procedures. It stated that station staff were required to provide the allright signal for an NGR train if they attended the train service.

At the same time, SCS issued an updated communication to station staff, which stated:

SCS employees are required to provide the ‘Allright’ signal to indicate to the RTG that assisted boarding and visual checks have been completed…

-   Suburban stations are only required to provide this indication to the RTG for NGR services to indicate platform duties have been completed.
-   CBD stations are required to provide the ‘Allright’ signal to all services including NGR services...

Station staff at suburban stations confirmed that they were advised of the change.

QR advised that, at the time of the January 2019 change, the NGR deployment was at an advanced stage and the BOM had been continually reviewed. The TSD and SCS sections were trying to clarify the exact requirements for the allright signal to ensure there were no unnecessary delays or impact on on-time running. The notices also updated other aspects of the departure process for personnel.

As a by-product of these changes to the dispatch procedures, from January 2019 onwards there was a significant increase in the frequency that allright signals were provided by station staff to train guards working NGR trains at suburban platforms.

Rightaway signal procedure

QR procedure MD-14-38 (Rail traffic crew manual) outlined the procedures for a guard to follow when a suburban passenger train was departing a station. These included:

-  Once the train is stationary, open the cab door and step out onto the platform beyond the yellow line
-  Walk sufficient distance to view the entire train (last door to first door), and departure signal or Signal Aspect Indicator (where provided)
-  Ensure Proceed aspect is illuminated in departure signal or Signal Aspect Indicator
-  Ensure all customers have boarded / alighted safely and provide customer service as required. At specified locations wait until the ‘Allright’ signal is given by station staff…
-  Ensure all people remaining on the platform are clear of the yellow safety line
-  Re-check departure signal / Signal Aspect Indicator displays a proceed aspect (where provided)
-  Return to working cab and give rightaway to rail traffic driver

For NGR trains, the procedures stated:

When a NGR train is arriving at a station, the Rail Traffic Guard (RTG) will observe the external CCTV to confirm that station staff is in attendance and if anyone is waiting in the designated boarding assistance area.

Once stationary, the RTG will ensure that the platform side doors have been released, exit the cab and step onto the platform beyond the yellow line to observe the presence of station staff on the platform - as well as any passengers waiting in the assisted boarding area (In the absence of station staff, the RTG will provide any boarding assistance as required).

-  The RTG will walk to view the Departure Signal or Signal Aspect Indicator (where provided)
-  Ensure Proceed aspect is illuminated in the departure signal or Signal Aspect Indicator
-  Ensure all customers have boarded / alighted safely and provide customer service as required.
-  Ensure all people remaining on the platform are clear of the yellow safety line
-  Re-check Departure Signal / Signal Aspect Indicator to ensure that it continues to display a proceed aspect (where provided)

At designated stations, an Allright signal will be provided by station staff…

As noted above, the circumstances where an allright signal would be provided for NGR trains were advised in IONs.

Regardless of the type of train, if viewing of the departure signal was obstructed, the guard had to ensure the associated signal aspect indicator (SAI) was illuminated (which indicated that the departure signal was not displaying a red aspect).

The guard provided the rightaway signal by bell communication (that is, pressing a button inside the guard’s cab twice, which would annunciate 2 bell sounds in the driver’s cab).

Driver procedure for responding to a rightaway signal

The receipt of ‘two bells’ was a signal to the driver that the guard had given authority to depart the platform. The driver was then required to follow the documented steps in procedure MD-11-282 (TSD professional driving – Train management train units) before moving the train:

-  Check the indication of the departure signal
-  Move the direction controller into the forward position (if not already in the forward position)
-  Press the door closing button
-  Sound the city horn
-  Wait for the ‘doors open’ tile to extinguish
-  “Scan before you go” [re-check the indication in the departure signal]
-  Ensure headlight is on (if applicable)

This procedure was the same for EMU and NGR trains. As already noted in The occurrence, the driver of DW17 advised that they could not recall checking or sighting the status of signal DP29 after receiving the rightaway and prior to departing the platform. They recalled that the rightaway signal (2 bells) from the guard was the prompt to depart the platform. The driver stated that there were no distractions present on the platform or in the driving cab at the time.

The driver of DW17 also noted that they were not aware of the other train at the adjacent platform. They received no advice from the NCO that another train was going to be run ahead of them out of Park Road Station and that they would therefore be stopped at the station for longer than normal. The driver also noted that NCOs were inconsistent in advising drivers of such delays; some NCOs provided the advice whereas others did not.

Start against signal occurrences

Background information

A signal passed at danger (SPAD) is a relatively rare event. For example, during the period from July 2016 to June 2020, there were 119 SPADs on QR’s Citytrain rail network (about 30 SPADs per year). This equated to about 1.91 SPADs per million train km, and a rate of 34,900 red signals approached per SPAD^[13] over the 4 years.

The 119 SPADs included:

• 70 (59%) driver misjudged SPADs (that is, the driver attempted to stop the train but failed to stop before passing the signal)
• 37 (31%) completely missed SPADs (that is, no attempt was made to bring the train to a stop before the signal)
• 6 (5%) start against signal SPADs (that is, a stationary train started at and proceeded beyond the signal)
• 6 (5%) other SPADs (that is, any authority exceeded that is not classifiable under one of the above subcategories).

QR considers ‘completely missed’ and ‘start against signal’ as the most significant SPADs, as generally the drivers involved have continued to operate the train unaware it had exceeded its limit of authority. Such occurrences are problematic on the Citytrain network as, currently, the controls designed to detect such an event have limitations.  

QR’s universal train control (UTC) system provided a SPAD alarm at the network control officer’s (NCO’s) workstation if a train passed a ‘controlled’ signal.^[14] Therefore, the system had the potential to mitigate the consequences of a SPAD by the NCO transmitting an emergency stop command via radio to the driver (as was the case with the 25 March 2019 SPAD at Park Road Station). However, there can be a significant delay between an NCO detecting a SPAD alarm, the NCO providing the stop command to the driver, the driver responding to the stop command and the train coming to a stop. In addition, a small proportion of station departure signals are non-controlled, and therefore will not be associated with a SPAD alarm if there is a start against signal SPAD.

Most start against signal SPADs (such as the 25 March 2019 SPAD) occur when starting from a station platform. Start against signal SPADs occurring at platforms have commonly involved guards providing a false rightaway to a driver (that is, they have provided the rightaway when there was a red aspect in the departure signal). Such SPADs have often been called ‘ding-ding-and-away’ SPADs, referring to the sound of the rightaway signal (2 bells) and an automatic, habitual action of the driver to start departing a station upon hearing the bells.

Start against signal occurrences on non-NGR trains

During the 9-year period from July 2012 to June 2021, Citytrain had 7 start against signal SPADs on non-NGR trains. These occurred from September 2012 to January 2018, with only one since June 2016 (in January 2018).

Database records provided by QR indicated that, for 6 of these SPADs, the guard provided a false rightaway to the driver, and details for the other SPAD did not include details regarding the guard’s action.

The database records also indicated that in some cases the driver did not check the signal after receiving the rightaway and prior to departing the platform, whereas in other cases the driver stated they had checked the signal and thought it was indicating a proceed aspect. In 2 of the cases, the database records indicated that the driver did not follow the stopped at a red procedure, whereas in another case it was noted that the driver did follow the procedure.

Start against signal occurrences on NGR trains

As previously noted, the first NGR train entered service in December 2017, but the procedure of providing an allright signal for each NGR train at each suburban station only commenced in January 2019. Between December 2017 and December 2018, Citytrain had no start against signal SPADs involving NGR trains. In the 18 months after the January 2019 procedure change, there were 5 start against signal SPADs on NGR trains, with another SPAD the following year. These included:

• signal DP29 (Park Road) – 25 March 2019
• signal SE16 (Shorncliffe) – 1 October 2019
• signal EJ38 (Eagle Junction) – 20 November 2019
• signal BH4 (Beenleigh) – 18 March 2020
• signal AP12 (International Airport) – 25 March 2020
• signal SL23 (Springfield Central) – 23 April 2021.

By the time of the first of the 6 SPADs (March 2019), 51 of the 75 NGR trains had entered service, and for the other 5 SPADs most or all of the NGR trains had entered service. However, throughout the period from January 2019 to June 2021, there were still more non-NGR train services on the network than NGR train services. QR advised that during the period from January 2019 to June 2021, non-NGR trains travelled 16.0 million track km per year whereas NGR trains travelled 8.6 million track km per year (35% of the total). In addition, non-NGR trains approached 554,000 red signals per year and NGR trains approached 430,000 red signals per year (44% of the total).

In summary, there was a substantial increase in the rate of start against signal SPADs in the 18-month period following the change of NGR dispatch procedures in January 2019 and all 5 of the SPADs involved NGR trains, which had less operations than non-NGR trains. The rate of start against signal SPADs decreased in the following 12 months with only one occurrence, which involved an NGR train.

Overall, the difference between the rate of start against signal SPADs (per red signals faced) for NGR trains during January 2019 to June 2021 was significantly higher than the rate for non-NGR trains.^[15] In addition, the rate of start against signal SPADs was statistically higher for NGR trains from January 2019 to June 2021 when compared to all suburban trains during the period 2016 to 2018.^[16]

In each of the 6 start against signal SPADs involving NGR trains:

• they occurred on a suburban station platform (where station staff did not routinely provide an allright signal for non-NGR trains)
• station staff provided the allright signal to the guard without checking the status of the departure signal (consistent with the required procedures for station staff at a suburban platform for an NGR train)
• the departure signal was not visible from the rear of the train and therefore the guard was required to check an SAI (rather than the departure signal) prior to giving the rightaway to the driver
• the SAI was not illuminated (because the departure signal was displaying a red aspect)
• the guard provided a false rightaway to the driver
• the driver promptly responded to the rightaway signal (2 bells) and departed when the departure signal was indicating a red aspect.

In some cases, the guard could recall receiving the allright signal from station staff, but could not recall checking the SAI, and in one case the guard had seen the station staff look at the SAI then give the allright signal, which influenced their decision to give the rightaway. In the other cases (including at Park Road), the guard stated they checked the SAI and thought it was illuminated. In 2 cases (including at Park Road), the guard did not leave the train (rear driving compartment) to conduct their tasks. Some of the guards noted that the SPADs occurred in the context of a late departure or waiting for the station staff to attend the train, and that after getting the allright signal they wanted to give the rightaway without delay.

In addition to the Park Road SPAD (where the driver could not recall checking the signal prior to departing the station), 3 of the drivers reported they did not check the signal after receiving the rightaway and prior to departing. One of these drivers stated that they had been distracted by dropping something in the cab, and another stated there was an unusually long dwell time at the station prior to them receiving the rightaway. In the other 2 cases, drivers reported they had looked at the departure signal and believed it was green when they departed.

In 3 of the 6 cases (including at Park Road), the driver did not completely follow QR’s stopped at a red procedure; in particular, they did not apply the park brake after stopping at the signal. In another case, the driver had applied the procedure, but then got distracted by dropping something in the cab (as noted above). In the other 2 cases, the drivers were taking over a train from another driver at a station platform.

Detection and response

In all of the 13 start against signal SPADs from 2012 to 2021, the UTC system detected the train had exceeded its authority, and the NCO issued an emergency call to the driver to stop (although in at least one case, the guard had alerted the driver to the problem and the driver had already started stopping). In 4 cases, the distance passed the signal was estimated to be 200–305 m and in another 6 cases the distance was 100–200 m.

In the case of the Shorncliffe SPAD, the time interval between the train passing the signal and coming to a complete stop was about 30 seconds, and the train stopped 275 m past the signal. In the case of the Park Road SPAD, the time interval was about 34 seconds and the train stopped 305 m past the signal.

False rightaway signals

As far as could be determined, all of the 13 start against signal SPADs on the Citytrain network from July 2012 to June 2021, including the 6 SPADs involving NGR trains since March 2019, were associated with the guard providing a false rightaway to the driver.

One driver involved in a start against signal SPAD on an NGR train advised the ATSB that, in a period of 2 months, they had received 4 or 5 false rightaways from guards on NGR trains, and they noted that the allright signal being provided by station staff had contributed to this situation. In addition, a tutor driver advised the ATSB in 2019 that they and other drivers had noticed a large number of false rightaways being given by guards on NGR trains while the departure signal was at stop, and some of these false rightaways involved very experienced guards.

QR did not specifically require that false rightaway events be reported by train crew under its safety management system (SMS). It advised that guards or drivers could report such an event by email to its SPAD email address or by lodging a worker hazard / incident reporting form. It also advised that it had no reports of a false rightaway being provided since January 2018.

Signal aspect indicators

General information

Within QR’s Citytrain network, signal aspect indicators (SAIs) were provided at station platforms where the train itself or an obstruction blocked the guard’s view of a platform departure signal.

An SAI consisted of multiple light emitting diodes (LEDs), which produced a white light (diagonal line)^[17] on a black background when the platform departure signal was at proceed (that is, displaying a green aspect, double yellow aspect, single yellow aspect or a flashing yellow aspect). When the platform departure signal was displaying a red aspect (stop indication), the SAI was not illuminated (that is, the indicator was blank) (Figure 7). When illuminated, the white diagonal line in the SAI was about 18 cm long.

QR advised that the aspect design of an SAI matched the design principle of colour light signals when there was no signal aspect displayed in the signal head. That is, when the colour light signal is at blackout or blank it signifies the signal is at stop.  

If a guard could not directly view the platform departure signal, they were required to check the SAI during platform dispatch to confirm that the departure signal was at proceed prior to giving the rightaway to the driver.

Figure 7: SAI on platform 2 at Park Road Station in its 2 states – proceed (left) and stop (right)

The image on the left shows the SAI illuminated, therefore the departure signal is at proceed. The image on the right shows no indication in the SAI, therefore the departure signal is at stop.

Source: ATSB

Location of SAIs at station platforms

The placement of signals on the QR network were governed by standard MD-10-95 (Signalling positioning principles). This standard stated that:

-  signals will be positioned to provide optimum sighting and visibility
-  signals will be positioned to provide some measure of commonality of placement
-  signals will be positioned to minimise the distraction to the rail traffic crew by objects or structures in the foreground or background of the rail traffic crew’s line of sight to the signal...

The standard also included a detailed list of requirements for the positioning of signals. The standard did not include any specific guidance regarding the positioning of SAIs.

The standard also stated:

The officer who is responsible for the works requiring the review of signal sighting shall convene a signal sighting committee. The signal sighting committee shall consider operational issues relating to optimal location and visibility and assess sighting and visibility risks associated with the placement of the signal and its proposed positioning using the approved Signal Sighting Checklist.

The Signal sighting checklist (MD-12-349) included a detailed list of questions to consider, which expanded on the requirements in the standard. The questions were applicable to signals, with limited applicability to SAIs.   

QR procedure MD-12-252 (Signal sighting committee) provided guidance for a committee to ‘ensure that all signals, indicators and safeworking signs and boards were positioned so that they afford Rail Traffic Crew adequate sighting and convey a clear and unambiguous indication’.

It was a requirement for the committee to consider issues arising from the position or sighting of signals, indicators, signs and boards when new or altered infrastructure was being designed, after infrastructure changes had been made, after a SPAD had occurred (if sighting was identified as a potential factor), or following a report of sighting issues. The procedure stated:

The position and structure of all signals, indicators, signs and boards shall be considered by a Signal Sighting Committee … which shall consider and decide the safest and most suitable position and structure of each signal and associated equipment.

The Rail Traffic Crew’s sighting distance and viewing distance on the approach to the signal shall be the prime consideration, but regard shall also be given to the signalling arrangements shown on the signalling plan and the present and proposed permissible speed. Signal Sighting Committee decisions shall conform to MD-10-95 Signalling Positioning Principles as a minimum and shall also consider other issues that impact signal sighting/viewing at the location.

The Signal Sighting Committee shall agree on the position of Guards Signal Aspect Indicators and 6 and 3 Car Stopping marks.

In terms of the location of the stopping marks, the procedure stated that the stopping mark signal sighting committee shall ‘ensure the guard can see the departure signal or the Signal Aspect Indicator’.

The procedure stated that the signal sighting committee were required to use the signal sighting checklist to record its considerations. Following the assessment, the committee was required to complete a signal sighting recommendation form identifying any required mitigating actions or recommendations.

SAIs had been installed at some suburban station platforms for a number of years. In preparation for the introduction of the NGR fleet and the changed location of the guard at the rear of the new trains, additional SAIs were installed at numerous locations within the Citytrain network, mainly due to curved platforms.

During interviews, some guards advised the ATSB that SAIs were not installed in consistent positions on suburban station platforms and that this inconsistency in the placement of SAIs, particularly when working NGR trains, made it more difficult to sight the indicators during station dispatch.  

Visits to suburban stations by ATSB investigators also identified inconsistency in the location of SAIs at platforms. They were installed on the side of station buildings, platform shelters or on standalone posts that varied in distance from a guard’s location at the rear of an NGR train. At some locations, SAIs that were not illuminated were hard to sight as the black object (the extinguished lamp plus its mounting board) merged into the background.

Guards reported that the LEDs on an SAI were bright and easy to see. However, some guards also noted that on occasions at some platforms they could be potentially confused with station building lights or reflections, particularly if a guard was not sure of an SAI’s exact location.

Location of the SAI on platform 2 at Park Road

In March 2017, as part of the NGR business operating model, a signal sighting committee convened at Park Road Station and recommended the installation of SAIs on platform 1 and platform 2 (applicable to signal DP29), as well as relocating the SAI on platform 3 and lowering the position of the SAIs on platform 4.

The committee determined that the recommended location of the SAI on platform 2 was consistent with guidelines from MD-10-95. This was recorded in the recommendation form. Subsequently, the recommended location of the SAI was approved.  

In August 2017, the SAI was installed on platform 2 at Park Road Station. The SAI was positioned on a passenger shelter under an awning, adjacent to a platform sign. The location was about 57 m away from the guard’s location at the rear of an NGR train.

ATSB investigators visited Park Road Station to observe the SAI indicator on platform 2. They noted that, when the SAI was illuminated, the white light was reasonably distinct from its background. However, when not illuminated (as shown in Figure 8), the SAI was not distinct from its background as the black indicator face had little contrast with the awning on the platform shelter. In addition, depending on exactly where the train stopped, some thin building posts could partially obstruct the sighting of the SAI. It could also be obstructed by passengers on the platform.

Figure 8: Location of the SAI relative to the location of the guard at Park Road platform 2

The image shows the location of the SAI at platform 2 Park Road Station. Its location on the platform limited the viewing of the indicator from a guard’s perspective, particularly when the indicator was not illuminated (as in this image).

Source: ATSB

Communication of information about the location of the SAIs at Park Road

In August 2017, Citytrain TSD issued an important operational notice (ION) to train crew to disseminate information relating to the new SAIs (including for DP29) and relocated SAIs at Park Road Station. The notice included a map showing the location of the SAIs at the station. Train crew were not required to verify that they had read and understood the information. Similar notices were sent regarding SAIs at other stations that were introduced or modified as a result of the introduction of the NGR fleet.

The ION regarding the Park Road SAIs was emailed to drivers and guards about 4 months prior to the first NGR train in service.

As noted in Guard qualifications and experience, the guard of DW17 had not operated an NGR train via platform 2 at Park Road Station prior to 25 March 2019 (the day of the SPAD). They also noted that they had had not been provided with any specific route familiarisation training regarding the location of the SAI for DP29 at Park Road Station before operating their first NGR train via that platform. However, the guard stated that they had worked traditional type trains (such as EMU trains) through platform 2 and had noted the position of the SAI during those occasions. However, they had never had to use the SAI before because EMU trains stopped with the guard’s compartment in advance of the SAI.

The guard of DW17 stated that when illuminated, the LED lamps of SAIs were quite bright and distinct. They also said that the SAI at Park Road platform 2 was hard to see. As noted in The occurrence, the guard stated that they checked the SAI and noted that it was illuminated (indicating that DP29 was displaying a proceed indication). The guard also stated that they were not aware of the status of the previous signals immediately prior to arriving at Park Road, and were not expecting to be stopped at Park Road (that is, they would have expected the SAI to have been illuminated).

Departure signal indicators used in New South Wales

The New South Wales (NSW) train network uses guards’ indicators, which are equivalent in function to SAIs. The indicators provide a circular LED light, which illuminates when the applicable departure signal is at proceed and are not illuminated when the signal is at stop.

When the indicators were rolled out across the NSW rail system in the late 1990s, they comprised white LED lights. However, the white LEDs were replaced with blue LEDs as fluorescent station lighting had been installed around the same time, and the blue LEDs provided clearer, easier distinction of the guards’ indicators from the fluorescent lights.

Risk management and change management processes

Overview of risk management processes

QR had a policy (MD-11-1337), standard (MD-11-1338), a general risk management procedure (MD-11-1340) and a safety risk management procedure (MD-11-1339), with the 2 procedures being merged in January 2019. It also had developed tools for risk assessments (for both simple and more complex assessments) and requirements for related processes such as change management, assurance and the communication of safety-relevant information.

The QR standard and procedures outlined a risk management process that was consistent with AS/NZS ISO 31000:2009 Risk management – Principles and guidelines. It included the following processes:

• communication and consultation
• establishing the context
• risk assessment (including risk identification, risk analysis and risk evaluation)
• risk treatment
• monitoring and review.

QR’s risk management standard stated:

Before any significant change, project or event occurs or when a significant external change or event is detected, a suitable risk assessment will be conducted in order to ensure all potential risks can, and will, be managed effectively.

Overview of change management processes

The Office of the National Rail Safety Regular (ONRSR) guidance document Preparation of a rail safety management system (January 2013) provided guidance for management of change processes.^[18] It stated:

Different types of change introduce varying degrees of potential risk. The degree of scrutiny required, and the resulting level of detail at each step, should be proportionate to the degree of risk potentially introduced by the change, or the process of implementing the change…

Change within systems frequently has flow on effects to other parts of the system and can have unintended consequences if the effects are not fully identified. The management of change process is expressly intended to ensure that the effects and influences of change are identified and managed…

Accredited operators should have a range of management of change processes that require an increasing level of scrutiny as the potential level of risk associated with the change increases. The safety management system must include procedures for ensuring that changes that may affect the safety of railway operations are identified and managed…

AS 7472:2018 Railway operations – Management of change stated:

For the purpose of rail safety management, change includes anything that has the potential to alter existing risks or introduce new hazards.

As the rail industry implements innovative ideas or new technologies that improve efficiency and safety, it is important the industry demonstrates how it is managing risk with any change including the option of a trial and the transition to permanent application. Change is fundamental to continual improvement. Without change there can be no improvement.

Changes can be made to management, systems, processes, or assets for both new or modified applications. Change should include any change with a potential impact on the organisations safety management system (SMS) or conditions of accreditation…

The Australian standard listed a variety of examples of change, including changes to rolling stock, infrastructure, equipment, work practices, policies or procedures. It also stated:

On becoming aware of a change, the MOC [management of change] methodology detailed in section 3 of this Standard should be followed. The MOC methodology has a number of actions which form a systematic and structured process…

It is important to note all specific actions may not be necessary for simple, low risk changes. RTOs [rail transport operators] shall explore the impact of the change and should scale the MOC process to suit the agreed impact. A change can vary dramatically, from very simple to very complex and the degree of scrutiny required, and the resulting level of detail required at each action should be proportionate to the degree of risk introduced by the change. A change that is assessed as high risk will require more careful planning and risk analysis than a routine change. A simple, low risk change may not require all actions outlined in section 3 to be implemented. The process should stop once the assessment of risks has been undertaken and the change deemed sufficiently low risk to not require further action…

QR’s standard MD-12-219 (Safety change management) set out the organisation’s requirements for managing changes. The scope section stated:

The change management process will provide systems and procedures for ensuring changes that may affect safety are identified and managed, including any risks identified to other internal and external interfaces that may be impacted by the change…

This Standard shall be implemented for change activities undertaken by or on behalf of Queensland Rail with the potential to impact the safety of Queensland Rail’s operations, workers, customers or stakeholders...

Listed examples of changes included changes to physical assets, operating procedures and operating processes. In terms of the change management process, the QR standard stated:

Change management is a complex process that can be undertaken in various ways depending on the type of change, the size of the change and the relevant change theory implemented.

In general, the safety change management process shall:

-  identify if the proposed change has any existing safety implications
-  identify if the change will introduce any new safety and/or human factors risks…

The QR standard outlined the following activities that needed to be completed as part of a change management process:

• assess the change (in terms of the type and nature of the change and its impacts)
• identify stakeholders
• assess the risks
• consult with relevant parties
• review the safety and environment management system (to determine if any changes to the system’s documentation where required)
• identify how the change process will be reviewed
• determine systems assurance requirements (including whether an assurance plan is required and the systems and procedures for ensuring affected workers are fully informed and trained)
• identify resources available to implement and monitor the change
• obtain document approval
• implement the change in accordance with the change plan.

For complex changes with high risk and medium to high business impact, the standard required a documented safety change management plan. For simple low risk changes with low business impact, the standard required the completion of a safety change management checklist.

For some types of infrastructure changes, QR had additional change management standards or procedures. There were no specific change management procedures within train services delivery (TSD) or station customer service (SCS).

Risk process to evaluate NGR business operating models

As noted in previous sections, the first NGR train entered service in December 2017. For the overall implementation of the NGR fleet, QR developed safety change management plans.

As part of these activities, QR utilised its risk management process to identify the most safety-effective business operating model (BOM) for its rail operations. This involved undertaking a risk assessment during June–July 2016.

The objective of the risk assessment was to document and evaluate the risks associated with 2 proposed NGR BOMs – the ‘roaming guard model’ and the ‘guard at rear model’ – and compare them to the current EMU BOM (guard working from the middle of the train). In addition, the process evaluated the effectiveness of the existing risk controls and proposed treatments and provided an informed recommendation on the preferred NGR BOM.

QR’s risk management procedure stated:

Multidisciplinary teams of people that possess subject matter expertise and technical knowledge of the process or system under assessment will participate in the risk assessment. Individuals with the appropriate level of experience, skill and aptitude will facilitate the risk workshops.

A review of the individuals (and their substantive roles at the time) who participated in the NGR BOM risk assessments identified limited personnel with subject matter expertise in the field of train operations. For example, there were no train operations inspectors, tutor drivers or tutor guards involved in the risk assessment process.

Results of assessment of NGR business operating models

In all, the 2016 risk assessment identified 16 operational safety risks (as well as additional customer-related and workplace health and safety risks) to compare the 3 BOMs. One of the identified operational safety risks was:

RTC [rail traffic crew] leaving platform without proceed authority resulting in [start against signal] SPAD.

The risk assessment team identified 5 potential ‘causes’ that could generate the risk of a start against signal SPAD:

• the guard unable to sight signal / SAI
• the guard not verifying signal aspect
• the driver not following safe driving procedures
• a train crew distraction
• an altered workload.

A series of existing controls were then identified, which included:

• guards following procedures for giving the rightaway signal (as well as giving the emergency stop bell and using the emergency brake if required)
• drivers following procedures (such as stopped on a red procedure and observance of signals procedures)
• train crew maintenance of competency (MOC) processes
• route competency (awareness of signal location).

The risk assessments determined that the risk of a SPAD occurrence when departing from a platform under the roaming guard model was high. In contrast, the existing EMU model and guard at rear model was regarded as medium risk. That is, the guard at rear model presented no additional level of risk than the existing EMU BOM for this specific risk.

A series of proposed treatments was also identified for each of the models and for each of the risks. In addition to the existing controls for a start against signal SPAD, these included:

• review location and upgrade of current SAIs and identification of future SAIs
• traincrew notices and safety bulletins (reflect changes to network)
• revision of MOC processes
• introduction of the European Train Control System (ETCS)^[19] or similar system
• workload assessment.

Overall, across all of the identified operational risks, the guard at rear model was evaluated as providing a lower risk level than the roaming guard model, and the guard at rear model was subsequently adopted.

Assessments relating to the allright signal at suburban platforms

Some other identified risks in the 2016 risk assessment were associated with the boarding / alighting of passengers who required assistance. The assessment identified that station staff would need to be actively involved in managing passengers who required assistance for the guard at rear BOM. It was identified that there would be the potential for confusion regarding who was providing assistance (station staff or the guard) and a need for clear delineation of roles, responsibilities and procedures for station staff and guards. The need to develop communication protocols between station staff and guards was also identified as a treatment.

At the time the 2016 risk assessment was completed, the exact nature of the tasks required of station staff and the guard had not been finalised. Nevertheless, it was determined that, under the guard at rear BOM, station staff at suburban platforms would be assisting passengers as, with the guard at the rear of the train, there would be significant delays to on-time running if station staff were not involved in the boarding / alighting process.

Based on the risk assessment documentation, the 2016 NGR risk assessment team did not consider the informal signal checking practices by station staff at Brisbane CBD stations, where the allright signal was not given to the guard unless the departure signal was at proceed. Therefore, the potential risk (or required treatments) associated with the station staff at suburban platforms giving the allright signal while the departure signal was displaying a stop indication were not documented.

As noted in the January 2019 ION, the NGR BOM was modified with the requirement for station staff to provide the allright signal for all NGR trains at suburban stations, significantly increasing the provision of allright signals at station platforms. No risk assessment or safety change management checklist were completed for this change. QR advised that the application of the safety change management standard (MD-12-219) was not considered to be required because the change was minor in nature.

Assessments of signal sighting issues on station platforms

As noted above, one of the proposed risk controls in the 2016 risk assessment was to review the sighting of signals and/or SAIs at station platforms due to possible signal sighting issues with the guard positioned at the rear of the train. As a result, QR conducted a signal sighting review at each station platform within the Brisbane suburban rail network as part of the introduction of the NGR (see Signal aspect indicators).

Processes for communicating safety-relevant information

QR procedure MD-12-826 (TSD communication of notices to rail traffic crew and rail operators) described the methods for communicating operational information to train crew (drivers and guards). The procedure outlined 3 methods of communicating information:

• a critical operational alert (COA), which addressed a hazard / risk that required immediate behavioural change (such as ‘significant changes to the network signalling / signage’)
• an important operational notice (ION), which addressed a hazard risk that required behavioural change though not necessarily immediate change (such as ‘minor network signalling / signage changes’)
• a general operational advice (GOA) for informational purposes (for example, ‘car parking issues’).

After receiving advice of a change or information that could impact TSD, the first step in the process was to undertake (‘when required’) a risk assessment to determine if the operational information to be communicated was critical, important, or general in nature. A subject matter expert was then assigned to draft the notice, which then was reviewed by other personnel and management before being distributed.

If a COA was issued, it was emailed to all train crew and the drivers and guards were required to read and understand the alert, then sign and date it, prior to performing duties relevant to the requirements of the COA. It was also posted to a portal for review by all personnel for 6 months. IONs and GOAs were also distributed by email and posted on the relevant portal, but did not require a process to verify that the drivers and guards had read and understood the contents (although a verification process could be initiated for an ION if required).

As noted in Communication of information about the location of the SAIs at Park Road, an ION regarding the location of SAIs at Park Road Station was distributed to train crew in August 2017. In addition, a January 2019 ION was disseminated to all TSD train crew advising that the allright signal would be administered by station staff for all NGR services. The ATSB requested documentation associated with any risk assessments used to determine this method of communication (that is, the use of an ION). QR advised that risk assessments were not undertaken.

Monitor and review

QR’s risk management standard stated:

Continuous monitoring and review are vital components of an effective risk management process. They may be undertaken as part of a formal periodic process, or performed on an adhoc basis, (e.g. change in policy or change in requirement).

The primary purpose of monitoring and review is to determine whether risks still exist, whether new risks have arisen, whether the likelihood or impact of risks have changed, and to reassess the risk priorities within Queensland Rail’s internal and external context.

Monitoring and review provides important feedback with regard to assurance over the efficiency and effectiveness of controls implemented to treat risks. It enables Queensland Rail to analyse and learn lessons from event successes, failures and near-misses.

QR’s risk management procedures provided additional requirements, including stating that each risk needed to be reviewed at least annually. The January 2019 version of the procedure also stated:

Safety Risks should be reviewed regularly when something occurs that could affect the outcome of the risk, such as:

-  The occurrence of an incident or discovery of a hazard
-  Change to the way things are done (Change Management)
-  Change in legislation or standard that is relevant to the context of the risk

QR’s safety change management standard also noted that:

Monitoring and review arrangements must be introduced immediately following the implementation of the change to ensure all risk controls, including training, have been and remain effective, and the documentation has been updated.

The review of the change shall consider:

-  any new risks that may have eventuated, or pre-existing risks that have changed, after implementation
-  the effectiveness of pre-existing risk controls and additional risk controls added as part of the change.

The level of assurance required for the change shall be assessed in accordance with the requirements of the Assurance Standard MD-12-24 and Assurance Procedure MD-12-27.

QR’s standard (MD-16-24) and procedure (MD-12-27) provided more detailed requirements regarding the planning and conduct of assurance processes to ensure that risk controls and treatments were operating effectively. The extent of the assurance activities was dependent on the level of risk involved.

During the period following the introduction of NGR services, QR conducted various assurance activities associated with managing SPAD risk. However, none of these activities focussed specifically on NGR operations. In addition, the new process for dispatching NGR services from suburban station platforms, which involved a material change where station staff were providing the allright signal to train guards on NGR services, was not examined during an assurance activity.

Following the 25 March 2019 SPAD, QR’s investigation into the SPAD recommended that a second line^[20] assurance activity be undertaken to determine guards’ compliance with rightaway procedures. The assurance activity was undertaken in the first quarter of 2020 and involved conducting 90 observations of SCS staff providing allright signals and guards providing rightaway signals. Results included:

• About half of the observations were conducted at the 3 CBD stations, and most of the observations (53) involved NGR trains.
• The assessment of each guard’s performance was limited to observing whether they exited the cab after arriving at the station and whether they walked beyond the yellow line on the platform before providing the rightaway.
• The proportion of guard observations assessed as being non-compliant was higher for non-NGR trains (13 out of 37) than NGR trains (9 out of 53).
• No problems were noted with the provision of the allright signal by station staff.

Further examination by the ATSB of the figures contained in the assurance report noted that, for non-NGR trains, all of the observed guard non-compliances occurred at CBD stations (13 out of 28 observations), where station staff always provided the allright signal for all trains and checked the status of the departure signal before doing so (Allright signal procedure for the EMU business operating model). For NGR trains, the rate of observed non compliances was similar for CBD stations (3 out of 16) and suburban stations (6 out of 37).

Incident reporting

QR standard MD-12-210 (Incident, accident and hazard reporting, recording and notification) stated:

All Incidents, Accidents and Hazards are to be reported to enable controls to be identified and implemented to prevent any further occurrence. Workers must be instructed to report all Incidents, Accidents and Hazards to their supervisor for action as soon as possible or prior to the end of the shift.

The standard and associated procedures outlined more specifically the types of events or hazards that were required to be reported. SPADs were required to be reported. However, false rightaway events were not required to be reported.

Drivers and guards directly involved in NGR SPAD occurrences stated that they were unaware of any safety campaign encouraging staff to report incidents associated with the introduction of the new NGR BOM, such as false rightaway events.

Various documentation provided to train crew and SCS personnel with the introduction of the NGR were reviewed by the ATSB. None of these communications specifically required or requested that any particular types of events be reported following the introduction of the NGR fleet.

Maintenance of competency processes

Overview of assessment processes

QR as a rail transport operator was required to ensure that rail safety workers such as drivers and guards were competent. To evaluate competency, drivers and guards on the Citytrain network were required to complete a maintenance of competency (MOC) assessment every 18 months. The MOC included a written assessment and a practical on-track assessment.

The MOC process for a driver involved the driver completing a written assessment (over 1 day) then a practical assessment (over 1 day) with a nominated assessor. The MOC process was undertaken one-on-one; the driver undertook the assessment while the assessor (tutor driver or train operations inspector) administered the activities. The written assessment typically involved nearly 300 questions.

The participant had to achieve 100% on the written assessment before advancing to the on-track practical component. If the driver was unsuccessful in more than 10% of the questions, they would be entitled to one retest (of the whole written assessment), which had to be completed on another day. If they were unsuccessful in some questions (but less than 10%), the participant was required to research the correct answers and then make corrections.

The MOC assessments for a guard followed the same basic process.

In 2018, QR used the MOC process for existing drivers to upgrade their train driving qualifications from Certificate III in train driving to Certificate IV. In all, 252 Citytrain drivers gained the higher level certificate as a result of the successful completion of their written and practical MOC assessments.

Assessors who administered training and assessment for QR had to have vocational competencies at least to the level being delivered and assessed and hold current industry skills relevant to the training and assessment being provided. In accordance with QR’s Registered training organisation specification (MD-13-591), only accredited assessors were permitted to conduct assessments. Assessors were to ensure they followed the principles of assessment and the rules of evidence when conducting assessments.

Previous ATSB investigation

During a recent investigation into a SPAD at Bowen Hills, the ATSB investigated QR’s MOC process for Citytrain drivers in detail.^[21] The investigation identified that, in many cases, drivers achieved perfect or near perfect results in their written MOC assessments. However, it was also identified that in numerous cases answers requiring a detailed response in the written MOC assessment matched word-for-word the answers from the assessor’s marking guide.

Based on this and a range of additional evidence, the ATSB concluded that the following 2 safety issues existed:

• Queensland Rail’s administration of the maintenance of competency (MOC) assessment process provided limited assurance that its Citytrain train drivers met relevant competency requirements. (Safety issue RO-2018-002-SI-01)
• Queensland Rail’s management oversight of the Citytrain driver maintenance of competency (MOC) process did not include planned assurance activities or regular and effective auditing of how the MOC assessments were being conducted, even after there were multiple indications that the process was not being conducted as designed. (Safety issue RO-2018-002-SI-02)

Similar problems were noted in the ATSB report regarding the MOC assessments for guards.

DW17 driver’s maintenance of competency assessments

The driver of DW17’s last 2 MOC assessments were conducted in January 2016 and November 2018. The driver’s MOC assessment in January 2016 recorded 100% on the written component (on their first attempt) and a perfect result on the practical on-track assessment. The written assessment required the driver to respond to 273 questions that varied in complexity from marking the correct answer from a list to writing lengthy responses to technical questions.

The driver’s MOC assessment in November 2018, administered by a different tutor driver, showed similar results to that of their 2016 assessment. On the first attempt of the written assessment, the driver achieved 98.7% (100% after corrections), and the practical on-track assessment resulted in a perfect performance. By successfully completing the MOC assessment in 2018, the driver gained a Certificate IV in Train Driving.

The ATSB compared responses from the driver’s written MOC assessments against answers to questions in the assessor’s MOC marking guides. The results showed that the driver’s written responses in each MOC, for questions requiring a detailed response, were mostly identical or near identical to those in the assessor’s marking guide. In one of the written MOC assessments, an obviously incorrect answer in the marking guide was mirrored in the driver’s response.

The irregularities identified with the driver’s MOC assessments were similar to the findings identified in the ATSB’s previous investigation for other drivers, and indicated that the driver either had access to the assessor’s marking guide or had other assistance during the completion of the MOC assessments.

Following the SPAD occurrence at DP29 in March 2019, the driver participated in a post-incident on-track evaluation,^[22] and a subsequent non-technical skill^[23] (NTS) assessment. These occurred on 8 May 2019. The on-track evaluation found the driver ‘not yet competent’, while the NTS assessment identified deficiencies and recommended areas for improvement in the driver’s use of RTCD and observance of signals, particularly when departing from station platforms. The outcome of the driver’s evaluation and NTS assessment resulted in an operational improvement plan (OIP) that involved coaching and mentoring sessions administered by train operations inspectors (TOIs).^[24]

Records provided by QR showed the driver participated in 17 coaching and mentoring sessions. On 14 occasions, the driver was assessed as ‘not yet competent’. On 28 June 2019, an on-track assessment successfully recorded the driver as competent. In addition, the NTS assessment, based on information collated from the coaching and mentoring session, also considered the driver competent. On 1 July 2019, the driver returned to normal duties.

DW17 guard’s maintenance of competency assessments

QR records showed that the guard of DW17 participated in a MOC process on 11 and 15 October 2018. Prior to the commencement of the written MOC component, the guard had a discussion with an assessor (not the assessor undertaking the MOC assessment) regarding possible language and literacy issues, which could affect their ability to complete the assessment successfully. This assessor recorded:

[the guard] … advised me [their] spelling was not accurate and reading capabilities is of a slow pace with not able to understand the questions correctly nor can [they] pronounce certain words and misunderstands the questions and [they] felt under pressure and stressed…

This information was conveyed to the MOC assessor and relevant training staff, and there was agreement to grant the guard an additional day to complete the written assessment as reasonable adjustment. The guard successfully completed the 207-question written assessment with a result of 96% on their first attempt (100% after corrections).

The assessor who the guard confided in prior to the MOC assessment submitted a ‘Language, literacy and numeracy (LLN) identification checklist’ (MD-14-829) recording the guard’s LLN issues. In addition, the assessor corresponded with the QR training and development section to advise them of the issue. The assessor considered that the guard:

• was unable to successfully complete the training and assessment required for their job
• was unable to read and understand work instruction procedures, or other relevant documentation
• had difficulty reading and/or interpreting diagrams, graphs, plans, flowcharts and similar documents.

On 15 October 2018, while participating in the on-track MOC component, the guard was assessed as ‘not yet competent’ due to a procedural error. A complete retest was scheduled for a later date.

Since the introduction of the MOC process in 2008, there was no previous evidence of recorded disclosure from the guard or assessors relating to the guard having LLN issues. However, records of assessments during that period indicated that the guard had successfully completed the MOC process without special needs assistance. On 24 October 2018, the guard resat the written MOC assessment and achieved 99% on their first attempt, and 100% after corrections. The written assessment showed no evidence that the guard was provided assistance in completing the assessment as a result of having LLN issues. Further review of the assessment identified very few spelling mistakes and there was no additional time required to complete the assessment.

Following the SPAD occurrence at DP29 in March 2019, the guard chose (supported by QR management) to relinquish the position of guard and subsequently took up another position within QR.

Fatigue management

Introduction

During the investigation, the ATSB noted that in the 8 days leading up to the occurrence, the driver had conducted seven shifts that commenced between 0300 and 0537 (see Driver medical information and recent work history). In addition, the ATSB noted that the guard was assigned an early shift on the day of the occurrence, commencing at 0412, with limited advance notice (see Guard medical information and recent work history). Accordingly, the ATSB examined QR’s processes for managing fatigue risk related to these aspects.

Rostering principles and guidelines

QR standard MD-10-178 (Fatigue risk management) prescribed hours-of-work principles for a master (long-term forecast) roster and day-of-operations (actual) roster for different types of rail safety workers. For suburban rail traffic crew, these principles included:

• maximum shift length of 9 hours
• minimum break between shifts of 12 hours
• maximum number of 12 shifts in any 14-day period.

With regard to roster design, the standard also stated:

For a robust hierarchical risk based approach the following should be considered and applied in this order unless not reasonably practicable.

1) Apply the good roster practice guidelines in Appendix 2 to roster development;

2) Where the good roster practice guidelines are not reasonably practicable in the business context, apply a risk based approach determined as SFAIRP [so far as is reasonably practicable] in the specific context that manages risk to a higher level than minimum requirements of this Standard;

3) Apply minimum requirements of this Standard, including checks against FAID [see below], hours of work principles and Enterprise Agreements.

The good roster practice guidelines included (but were not limited to):

• shifts with sign-on-times before 0500 limited to no more than 8 hours
• maximum of 4 consecutive night shifts in a row (defined as starting between 1800–0359)
• maximum of 5 consecutive early shifts (defined as starting between 0400–0600)
• minimum rest period between night shifts of 14 hours
• 2 days rest between a night shift and starting an early shift (that is, minimum 54 hours rest)
• 1 day rest between an early shift and starting a night shift
• avoiding significant adjustments in required sleep (such as transitioning from an early start to a night shift).

In the case of the driver and guard of DW17, their master and day-of-operations rosters for the period leading up to the occurrence complied with the mandatory hours-of-work principles.

With regard to the good roster practice guidelines, the driver had 6 consecutive shifts between 17–23 March that commenced between 0300 and 0537; 4 were classified as early shifts and 2 were classified as night shifts. These shifts did not meet the guidelines associated with rest breaks when transitioning between early shifts and night shifts. If these shifts were all considered to be early shifts, they would not have met the guideline regarding a maximum of 5 early shifts in a row.

In addition, both the driver and the guard conducted shifts of over 8 hours starting before 0500 on multiple occasions in the 14 days prior to the occurrence, including on the day of the occurrence (the driver on 3 shifts and the guard on 4 shifts).

Use of biomathematical models of fatigue

A biomathematical model of fatigue (BMMF) uses algorithms to predict the effect of different patterns of work on measures such as subjective fatigue, sleep or the effectiveness of performing work. Each model uses different types of inputs and produces different types of outputs, and each model is based on many assumptions and has limitations.

In particular, the models are based on group-averaged data, and it is widely agreed that the models are not well suited for predicting a specific individual’s level of fatigue. In addition, none of the models consider all of the factors that can influence fatigue. The models are designed to be only one element of a system for evaluating and comparing work rosters (see Civil Aviation Safety Authority 2014, Dawson and others 2011, Gander and others 2011, Independent Transport Safety Regulator 2010).

QR used the BMMF known as ‘FAID’^[25] to conduct assessments of rosters. FAID has been widely used in the Australian rail and aviation industries since the early 2000s. It uses hours of work (start time and end time) as its inputs, and it produces a score based on an algorithm that considers the effects of the length of the duty periods, time of day of the duty periods, and the amount of work over the previous 7 days (Roach and others 2004). The higher the FAID score, the higher the potential for fatigue.

QR’s fatigue risk management standard stated:

All master and day of operations rosters for Queensland Rail workers performing shift work (including volunteers), must be analysed using … FAID … to ascertain if the rosters provide adequate sleep opportunity. This includes shift changes, shift swaps, extended and unplanned shifts.

The QR standard stated that FAID scores between 0-79 (green zone) were considered broadly acceptable and ‘all reasonable steps should be taken to ensure all rosters fall within this range’. Scores greater than 100 (red zone) were considered to provide an unacceptable sleep opportunity. Scores between 80–100 (yellow zone) were considered ‘acceptable with demonstrable risk assessment’. This meant that:

A documented risk assessment, undertaken in accordance with the Risk Management Framework, must be completed and approved as per the risk management matrix before workers can operate in this zone.

QR advised the ATSB that this did not mean that a specific risk assessment had to be conducted prior to any specific worker being assigned a shift with a FAID score of 80­–100. Rather, for train crew, train services delivery (TSD) had conducted a risk assessment covering all fatigue-related hazards.

In terms of the risk of ‘worker fatigue’, one of the listed causes in the risk assessment was rosters with a FAID score in the yellow zone or outside of the hours of work principles. A number of controls and treatments were listed. These were mostly general in nature, such as MD-10-178 being implemented as the higher safety control, managers and rostering personnel completing fatigue management training, and conducting regular assurance activities on a sample of rosters. There was no requirement for any specific worker with a FAID score in the yellow zone to undergo an assessment prior to commencing work unless the worker had self-identified that they were fatigued or they had been observed to be experiencing signs of fatigue (see also next section).

For the 7 days leading up the occurrence, the guard’s FAID scores were below 80 and on the day of the occurrence the peak score was 40. For the driver, the peak FAID score on the day of the occurrence was 65. However, on both the 22 and 23 March, the driver’s peak scores were above 80 (and for 23 March the score was above 80 for about half of the duty period).

Self assessments of fatigue

QR’s procedures and code of conduct stated that fatigue risk management was a shared responsibility between the operator and rail traffic crew. The fatigue risk management standard stated that rail traffic crew were responsible for taking reasonable steps to ensure they did not present to work fatigued and that they managed non-work factors that could contribute to fatigue.

QR’s standard also required that workers ‘report instances of fatigue to their leader so additional controls can be implemented to manage the risk’. Such reports were required to use QR’s fatigue assessment form.

A critical operational alert issued to train crew in October 2017 advised train crew about a new version of the self-assessment form for train crew. It also stated that train crew were required to:

Using the new self-assessment form, assess whether you are fit to go prior to every shift as is current practice. If you are not fit to go for your entire shift and duties, contact the roster office to discuss your fatigue assessment result. If alternative duties are located and agreed to, or you are booked off, you are required to submit the completed fatigue self-assessment form as per the form instructions on your next shift.

The form included questions regarding the amount of sleep in the previous 24 hours and 48 hours, and the worker’s self-assessment of their level of alertness. If any of these parameters exceeded predetermined thresholds, then either personal risk mitigation strategies were required (if one of the scores was in the yellow zone), the result needed to be discussed with a supervisor, roster officer or train operations inspector and additional controls be specified (if one of the scores was in the red zone) or the worker was deemed not fit for duty (if one of the scores was in the black zone).

In terms of sleep in the previous 24 hours, the form stated that 5 hours or more sleep was in the green risk band, 4 hours was in the yellow band, 3 hours was in the red band and 2 hours was in the black band. In terms of sleep in the previous 48 hours, the form stated values of 12 or more hours, 11 hours, 10 hours and 9 or less hours for the 4 bands respectively.

There was no specific requirement for the driver or guard of DW17 to complete and submit a risk assessment form in the period leading up to the occurrence, and there was no evidence to indicate any forms were completed.

Fatigue management training

Citytrain train crew were required to undertake fatigue awareness training on a regular basis. The contents of the training provided an overview of sources and effects of fatigue, QR’s processes for managing fatigue and some individual fatigue alertness strategies.

In terms of hours of sleep, the course materials noted that less than 6 hours sleep was high risk and 6–8 hours’ sleep was moderate risk. This information was not fully consistent with the latest version of the fatigue assessment form (see previous section).

The course material also provided some information regarding FAID and how it was used by QR. The material noted that all master roster scores had to be below 80 (that is, in the green zone) whereas day-of-operations roster scores could be in the yellow zone.

Late-notice changes to a roster

According to the QR’s fatigue risk management standard, deviations from the mandatory hours-of-work principles could only occur for a day-of-operations roster or for an ‘emergency or unplanned event’. Similarly, rosters with FAID scores of 100 or more could only occur for an emergency or unplanned event. In such events, a fatigue assessment form for the worker was required to be completed and all reasonable steps taken to relieve the worker as soon as possible.

The guard was called at 2208 on the 24 March and asked if they were able to commence their shift on 25 March at 0412 (rather than the previously assigned time of 0900). QR rostering personnel stated that this was not considered an emergency or unplanned event; rather it was a shift vacancy caused by illness to another rail traffic crewmember.

QR rostering personnel noted that they managed the rosters of 2,800 employees (including train crew) and that the need to replace a rostered person at short notice was not unusual. In such cases, their systems would indicate which personnel were available to take the required shift (in terms of personnel who met the hours of work principles) and then they would ensure the selected personnel had a suitable FAID score (that is, 100 or less). If the selected personnel met the requirements, they would be offered the shift change or additional shift. It was not compulsory for the personnel to accept the change, and it was up to the personnel to assess their fitness to undertake the changed duty.

The ATSB requested information relating to any other risk controls used by QR to manage the fatigue risks associated with late-notice roster changes for rail traffic crew. There were no additional procedures for managing such changes. There was no requirement for a worker to complete a fatigue assessment form, unless they perceived themselves to be fatigued, and there was no requirement for rostering personnel to ask the worker about their level of alertness or hours of sleep when arranging a change.

__________

7. Assessed as competent over the route and current to drive the route.
8. Roma Street is the rail km starting point (0.000).
9. The driver’s seat was positioned in its mid-range when evaluating the sighting of the signal in relation to the position of the blind. This recreation did not simulate the driver’s eye height or actual seating position, which were unknown. However, even with the blind almost fully lowered, the signal was able to be sighted from a normal seating position.
10. ATSB RO-2018-002, Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, on 10 January 2018. Available from www.atsb.gov.au.
11. The driver’s safety control (DSC), formerly known as the deadman device, is a system that aims to confirm the presence of the driver at the controls. It requires the driver constantly hold, either by foot pedal or a hand lever, to inhibit the actuation of the device. If the driver becomes incapacitated, losing control of the foot pedal or hand lever, the train will lose brake pipe air and come to a stop. The driver can override the DSC, only while the train is stationary, by placing the brake controller in full service.
12. A separate ION issued to guards at the same time also stated that station staff were required to provide the allright signal if they attended an NGR service.
13. A red signal approached was recorded when the signal was displaying a red aspect when the train passed the previous signal. In some cases, the signal would have changed prior to the train reaching the signal. Therefore, it is likely that the number of red signals approached per SPAD was lower than the figures indicated.
14. Controlled signals: a signal that is, or may be, controlled or operated by a network control officer. They normally display a red aspect.
15. Fisher exact test, p < .01.
16. Fisher exact test, p < .05.
17. The white line was oriented at 45° upwards, left to right. It had a small discontinuity (break in the white line) at the lower left corner. The display was similar to that of a semaphore signal, which indicated proceed with an arm (long board) oriented at 45°. A semaphore signal also indicated stop when the arm was oriented horizontally.
18. ONRSR published an updated guidance document, Guideline: Safety management system in April 2019. Other more recent guidance information is also available on ONRSR’s website.
19. ETCS provides automated train protection and communications-based signalling and is being introduced into the Citytrain network (see ATSB investigation RO-2018-002 for further details).
20. Second line assurance activity: A set of linked assurance processes where the manager responsible for assurance does not have direct control over the processes and activities being assessed.
21. ATSB RO-2018-002, Signal ME45 passed at danger involving suburban passenger train TP43 and near collision with another suburban passenger train, Bowen Hills, Queensland, on 10 January 2018. Available from www.atsb.gov.au
22. The purpose of the post incident on-track evaluation is to assess the driver performance and make recommendations towards an operational improvement plan.
23. Non-technical skills assessment is based on information collated from the SPAD debrief session and post incident on-track evaluation to determine if a psychometric assessment is required as well as guiding development opportunities for the driver’s operational improvement plan.
24. Train operations inspector: a senior train crewmember with operational knowledge, one position level above a tutor driver.
25. FAID was initially known as ‘Fatigue Audit InterDyne’. It was subsequently renamed the Fatigue Analysis Tool by InterDynamics.

Safety analysis

Introduction

On 25 March 2019, a Queensland Rail (QR) Citytrain suburban passenger train (DW17) exceeded its limit of authority by passing signal DP29 at Park Road Station while the signal displayed a red aspect (stop indication). This resulted in a near collision with another QR suburban passenger train (1E65), which had been scheduled to run in advance of DW17 from Park Road Station.

There were no problems associated with the serviceability of the train, and the signalling system functioned as designed. The immediate reason for the signal passed at danger (SPAD) was that the driver did not effectively confirm the signal’s status prior to departing Park Road Station.

Such a ‘start against signal’ SPAD could have had very serious consequences as there were limited risk controls or defences in place on the QR Citytrain rail network to recover from the situation. In this case, the actions of a tutor driver in the driving cab of train 1E65 and a network control officer (NCO) likely prevented a train-to-train collision. Although a collision between 2 trains merging at a set of points would be less serious than some other collision scenarios, it would still have probably led to significant adverse consequences.

The safety analysis will initially discuss the actions of the driver and guard of DW17 and the context of those actions. It will also discuss the process associated with the placement of signal aspect indicators (SAIs) on station platforms with the introduction of the new generation rollingstock (NGR) business operating mode (BOM). In addition, it will consider QR’s risk management and change management processes relevant to the implementation of the NGR BOM and the risk of start against signal SPADs. The analysis will also discuss train crew maintenance of competency (MOC) processes and fatigue management in relation to late-notice roster changes.  

Train crew performance

Checking the departure signal

Train driving is a specialised task that is acquired through comprehensive training and significant experience; it involves conducting routine, frequently-practiced tasks in a largely automatic manner (at a skill-based level) with occasional conscious checks on performance. Accordingly, most of the driver errors associated with SPADs occur at the skill-based level of performance (Gibson 2016), and such errors are generally known as slips or lapses (Reason 1990).

A common factor involved in most start against signal SPADs is expectancy. Expectations based on past experience strongly influence where a person will search for information and what they will search for (Wickens and McCarley 2008), and they also influence the perception of information (Wickens and others 2013). In simple terms, people are more likely to see what they expect to see, and less likely to see what they do not expect to see.

Prior to departing a station platform, a driver is required to check the status of the departure signal after receiving the rightaway signal (2 bells) from the guard. Citytrain train drivers receive more than 100 rightaways a day, and in almost all cases the rightaway is provided when the departure signal is displaying a proceed indication. Accordingly, drivers develop a very strong association between the sound of the rightaway signal and the presence of a proceed indication, and they therefore develop a very high level of expectancy that 2 bells (rightaway) is associated with departing from the platform.  

As noted with a number of start against signal SPADs involving Citytrain drivers, this leads to some situations where drivers, performing their tasks at a skill-based level, receive a rightaway and either do not check the departure signal or check the signal but falsely perceive the signal to be displaying a proceed indication. This automatic or habitual tendency is well known in rail operations (for example, Multer and others 2019, Basacik and others 2008) and has also been demonstrated in experimental research (Haga 1984).

In this case, the driver of DW17 promptly departed the station platform after receiving the rightaway from the guard. The driver subsequently reported that they could not recall checking or sighting the status of signal DP29 prior to departing the station, and they were prompted to depart after receiving the rightaway.

The driver also stated they were expecting the departure signal to be red when they approached the station and their driving on approach to the station was consistent with this expectation. However, there was a longer than normal dwell time at the station, and such situations can disengage or dislocate a driver’s attention (Naweed 2013). It is also likely that, as DW17 was running on time, the driver had a low level of expectancy that the train would be delayed at Park Road to accommodate the passage of another train. They had received no advice from the NCO that they would be held at the station for an extended period (nor were they required to be advised).

Although the driver explained the SPAD as being a product of the signal being blocked by the train cab blinds, the ATSB determined this was not plausible. Furthermore, the implication of the driver’s account is that they consciously departed Park Road Station without checking the signal aspect. Sighting and confirming the aspect of a departure signal is a critical activity for safe train driving, and it is highly unlikely that an experienced train driver would intentionally depart a train station if they were consciously looking for but not able to confirm the signal aspect.

The red aspect in the signal had optimum viewing from within the driving cab of the train when it stopped at the platform, and there were no indications that the driver read through to another signal. In addition, there were no indications of distractions either inside or outside the driving cab at the time.

In summary, after receiving the rightaway signal, the driver promptly departed the station platform without effectively checking and confirming the aspect indication in the departure signal (DP29). Based on the available evidence, it is more likely that they did not check the signal rather than they misperceived the aspect indication. In either case, the driver was conducting their tasks at a skill-based (or automatic) level of performance and had a very high level of expectancy that the signal was indicating a proceed aspect, particularly after receiving the rightaway from the guard.

Application of the ‘stopped at a red’ procedure

A driver checking the status of the departure signal is the last risk control in place to prevent a start against signal SPAD. QR had in place other procedural risk controls that provided protection against the unauthorised departure of a train from a station platform. One key risk control involved drivers applying the ‘stopped at a red’ procedure. This required a driver to use operational interlocks (park brake and direction control settings) after stopping at a red signal to reduce the likelihood of an automatic or reflexive driver response to a false rightaway.

Such operational interlocks are used by many experienced drivers in different operators (Naweed and others 2015), and QR had formalised them into a standard procedure for its drivers. Based on QR data, the procedure had a relatively high compliance rate (92%). The procedure also appears to be effective in reducing the likelihood, but not eliminating, start against signal SPADs, as the compliance rate during such events was much lower. However, it is unclear how many drivers applied the start on a red procedure, received a false rightaway from a guard and then detected the red signal prior to departing a platform. 

In this case, the driver of DW17 did not fully apply the start on a red procedure. Even though the driver was probably aware that the departure signal was displaying a red aspect during their arrival at the station, it is possible that their awareness of the status of the signal decreased soon after stopping at the platform. The driver said that their habit was to only sometimes use the stopped at a red procedure, depending on whether they felt confident in their ability to drive safely at the time. Inconsistent use of such procedures would degrade their effectiveness, and it is noted that the driver had also previously experienced a start against signal SPAD 10 years previously.

In summary, after DW17 stopped at Park Road Station, with the departure signal displaying a red aspect, the driver did not apply the operator's stopped at a red procedure. This probably contributed to them not detecting that the departure signal was displaying a red aspect after receiving the false rightaway from the guard.

Providing the rightaway signal

Another key risk control to minimise the risk of a start against signal SPAD was for guards to check the status of a platform departure signal, via direct observation of the signal (or as in this case the SAI), before providing the rightaway to the driver. The guard was required to check the departure signal or SAI twice; both before and after checking that all passengers had boarded / alighted (or where required after station staff had provided the allright signal). 

Commencing in January 2019, station staff were required to provide the allright signal to the guard for every NGR service (regardless of whether they had to assist a passenger). In line with QR’s platform dispatch procedures, there was no requirement for station staff to check the departure signal prior to issuing the allright signal, and staff at suburban stations were also instructed not to check the departure signal.

In the case of DW17, the guard issued the rightaway to the driver after receiving the allright signal, even though the SAI was not illuminated. The guard stated that they had looked for the SAI after they received the allright signal and they thought that it was illuminated (indicating signal DP29 was at proceed).

The ATSB notes that the guard had significant time prior to receiving the allright signal to sight the SAI. However, after receiving the allright signal they immediately gave the rightaway signal to the driver, which could suggest the allright signal was the guard’s prompt to give rightaway. In addition, the guard did not step onto the platform to perform their tasks. Although the SAI could be sighted from the rear of the train, by not stepping out onto the platform the guard was less likely to be actively engaged in performing their tasks. The extent to which the guard was aware of the location of the SAI to use it effectively was also unclear (see Placement of signal aspect indicators).

Previous research in the UK has identified that guards have reported that they would be less likely to check a departure signal if station staff were involved in the departure process (Basacik and others 2008). In the course of the current investigation, the ATSB identified 5 similar SPAD events involving NGR trains where the guard had issued a false rightaway after receiving the allright signal from station staff. In some of these cases, the guards could not recall checking the SAI whereas in other cases they recalled checking the SAI and perceived it to be illuminated.

Regardless of whether they checked the SAI, it is likely that expectancy had a strong influence on most (if not all) of these guards’ responses. As with drivers, guards are conducting frequently-practised tasks at a skill-based level of performance, and through experience they have developed a very high level of expectancy that, if they are given the allright signal, then a departure signal will be displaying a proceed indication.

This expectancy has developed because:

• Before the introduction of the NGR to the Citytrain network, there was no requirement for station staff at suburban station platforms to provide the allright signal to train guards, other than at the 3 Brisbane CBD stations and 2 designated suburban stations (Gympie North and Nambour). At these stations, guards would always receive the allright signal from station staff, but they only receive it when the platform departure signal displayed a proceed indication. This was due to station staff executing the informal (and undocumented) practice of checking the departure signal was at proceed before providing the allright signal.
• With the introduction of NGR trains in late 2017, station staff at suburban platforms were only required to provide the allright signal if they assisted passengers. This occurred occasionally but not frequently.
• Given the lower levels of intersecting traffic and lower signal density outside of the Brisbane CBD, the likelihood of a red aspect in a departure signal at a suburban station platform was comparatively low.

The change to dispatch procedures in January 2019, which required station staff at suburban stations to issue the allright signal for all NGR trains, significantly increased the number of allright signals guards received each day. Because station staff at suburban platforms did not check the status of the departure signal before issuing an allright signal, this also increased the likelihood that guards would receive an allright signal while the departure signal was displaying a stop indication. As indicated by the SPAD statistics and anecdotal reports, this significantly increased the frequency of false rightaways that led to start against signal SPADs.

Overall, it is unclear whether the guard of DW17 checked the SAI after receiving the allright signal before providing rightaway to the driver. Regardless of whether they checked the SAI or not, the guard probably had a very high level of expectancy that the departure signal was at proceed after being issued the allright signal, as this is what they had previously experienced at Brisbane CBD station platforms. In addition, the guard had no knowledge of the restricted signal sequence encountered by the driver as the train approached and stopped at Park Road. Therefore, they had a low level of expectancy that the train would be delayed at Park Road to accommodate the passage of another train as DW17 was running on time.

Summary

The development of this occurrence required multiple errors by the driver and the guard. Effective safety systems utilise redundant controls to minimise the consequence of individual errors. In the case of start against signal SPADs, the procedural risk controls had redundancy, relying on both the driver and the guard to check the departure signal. In addition, there was a requirement for the driver to use the stopped at a red procedure as another risk control to capture the error of automatically responding to a false rightaway and departing from the platform.    

Nevertheless, this start against signal SPAD (and the other 5 NGR start against signal SPADs) have reinforced the point that procedural (or administrative) risk controls will always be fundamentally limited in their effectiveness compared to well-designed engineering controls for detecting potential or actual SPADs and managing their risk (see also ATSB report RO-2018-002 for further discussion of this topic).

Placement of signal aspect indicators

A signal aspect indicator (SAI) plays an essential role in the platform dispatch process. If the guard cannot sight the departure signal, due to the curvature of the track or obstructions, they need some other indication on the status of the departure signal prior to providing the rightaway signal to the driver. Although SAIs were installed at some station platforms prior to the introduction of the NGR fleet, the guards’ location at the rear on NGR trains meant that SAIs were required to be installed or moved at a considerable number of platforms in the Brisbane suburban network.  

A number of factors can influence how people search for information such as a signal, including knowledge of the signal’s location and the salience of the signal. In simple terms, if people know the exact location where a signal will be provided, then their performance will be better than if they do not know (Wickens and others 2013).

SAIs on platforms in the Citytrain network were not located in consistent positions; they varied in terms of what they were affixed to, and also their distance from the rear of an NGR train. In addition, QR procedures relevant to signal positioning and sighting principles provided limited guidance on the placement of SAIs, other than to state they should be positioned to provide adequate sighting and convey a clear indication. In contrast, the QR procedures and signal sighting checklist provided detailed guidance regarding the placement of signals.

It is understandable that the placement of SAIs involves considering a range of factors and will at times require compromises to be made. Nevertheless, limited consistency in the placement of SAIs presented difficulties to the guards who had to use them. This situation could be mitigated to some extent if guards knew the exact location of each SAI and were experienced with using them. However, when a considerable number of SAIs were installed or moved in a short period for the NGR fleet, it was probably not practical to give each guard detailed familiarisation training. Although guards were advised by notices about changes to the location of SAIs, they still needed to develop experience with using the SAIs to be able to effectively conduct their tasks.

In terms of salience, warnings and signals are typically designed to present their most conspicuous state when the system is in its most hazardous state, or at least the most hazardous state is presented in a clear and salient manner. As noted by Wickens and others (2013), the absence of something is harder for people to notice than the presence of something.

In the process of dispatching trains at station platforms, an SAI displays a bright light when the departure signal is at proceed (less hazardous state) and nothing when the departure signal displays a stop indication (most hazardous state). In addition, an SAI that is not illuminated often has a low level of contrast relative to its background and can be hard to detect, particularly if a person does not know exactly where it is located. In such situations, it is possible that a guard, with a high level of expectancy that a departure signal is at proceed, may mistake some other form of light or reflection in their visual field to be an illuminated SAI.

SAIs and similar indicators have been in place in the rail system for a long time, and originally their design was consistent with a fail-safe principle, because if the light failed then it would default to a safe (stop) indication. Redesigning such displays would present its own challenges due to the significant changeover and retraining cost. Nevertheless, positioning them close to the guard who is using them, or modifying their design or the design of their surrounding area to better show their location when not illuminated, would increase their salience and improve performance.

The SAI for DP29 was located 57 m from the location of the guard when working an NGR train. The SAI could be seen from the rear of an NGR train and also from the platform, however there were some obstacles (building infrastructure) on the platform that possibly could partially obstruct its sighting. Whether the SAI could be sighted from the train or the platform, its position was not consistent with optimal viewing for a guard.

The extent to which the guard of DW17 was aware of the exact location of the SAI for signal DP29 is unclear. The guard had received an important operations notice (ION) by email in August 2017 prior to the SPAD, but it is unlikely that they would have recalled this information 19 months later. The guard also stated they had never worked an NGR train through platform 2 at Park Road until the day of the SPAD. Although the guard stated they had previously seen the SAI when working other types of trains through that platform, the extent to which the guard could have promptly and reliably identified its location when it was not illuminated from the rear of an NGR train was difficult to determine.

In summary, QR’s process for the installation of SAIs did not provide sufficient detail to ensure consistent and conspicuous placement of SAIs at station platforms. This problem, combined with an SAI’s non-salient indication when the platform departure signal displayed a stop indication, increased the risk that an SAI would not be correctly perceived by a train guard. The extent to which this problem contributed to the SPAD on 25 March 2019 could not be reliably determined as it is unclear to what extent the guard actually checked the SAI (see Providing the rightaway signal).

Risk management associated with changing the allright signal process

As previously noted, the start of NGR operations in December 2017 resulted in station staff at suburban platforms providing the allright signal more frequently to train guards (that is, when they had assisted a passenger on or off an NGR service). The provision of the allright signal at suburban platforms then significantly increased in January 2019 when the dispatch procedures were changed to require the allright signal to be provided for each NGR service.

The provision of the allright signal played an important role in standardising communications between station staff and train guards of NGR services. However, the increased use of the allright signal at suburban platforms created an unintended hazard due to the way the allright signal was previously provided for all trains at the 3 CBD stations and 2 other designated stations.

More specifically, due to the undocumented practice of station staff providing allright signals at the designated stations only if the departure signal was displaying a proceed indication, guards had a very high level of expectancy that if they received an allright signal the departure signal would be displaying a proceed indication.

Based on the available information, QR did not effectively identify and assess the risk associated with this hazard during the introduction of the NGR, or when it changed the allright signal process in January 2019. Undoubtedly, identifying and assessing risks associated with a change is easier in hindsight during a safety investigation than when the change is occurring. Nevertheless, there were several limitations with processes during the introduction of the NGR BOM and the change to dispatch procedures in January 2019 that reduced QR’s ability to identify and assess the risk. These included:

• Although QR conducted a detailed risk assessment to compare 2 NGR BOMs in mid-2016, the team participating in this assessment did not include personnel with subject matter expertise in train operations (such as train operations inspectors, tutor drivers or tutor guards). This limited expertise would have reduced the team’s appreciation of how allright signals were provided at CBD stations and other designated locations, and reduced the potential for them to identify the use of the allright signal at suburban station platforms as a start against signal risk. Accordingly, there were no treatments recorded to specifically manage this risk.
• No formal risk assessment or change management process was conducted when the dispatch process at suburban platforms for NGR services was modified in January 2019. QR advised that this was because the change was considered minor in nature. It is understandable that personnel may have perceived that the change was actually helping to improve the clarity of communications between station staff and guards and therefore was reducing risk rather than increasing risk. Nonetheless, any changes to tasks or processes can have unintended consequences, particularly if the full context of the task has not been considered. In this case, the change affected how a large number of train dispatch movements at station platforms would be managed, and a more formal evaluation of the risk would have been justifiable.
• Important operational notices (IONs) were issued to train crew at several stages throughout the introduction of the NGR, including before the change to dispatch procedures in January 2019. Although TSD’s procedures required that a risk assessment be done ‘when required’ to establish whether the type of communication was appropriate, no formal assessments were conducted, removing another opportunity to evaluate the situation using a structured approach.
• Although a significant number of SAIs were installed or moved prior to the introduction of the NGR, as far as could be determined the changes at each station were managed as individual projects. There was no apparent consideration of the overall risk of the significant number of SAI changes on the ability of guards to effectively locate all the SAIs.
• No additional incident or event reporting requirements were introduced with the implementation of the NGR fleet. With any major project, it is foreseeable that the introduction of new systems or processes will present unanticipated risks. Accordingly, it is important for there to be processes in place to gather safety information after the change has commenced. More specifically, the introduction of the NGR presented an opportunity for QR to proactively promote its incident reporting systems at a targeted audience to capture safety information that may not have been identified through other activities. For example, there could have been a formal campaign to promote the reporting of any safety-related events associated with the introduction of the NGR, or it could have been more targeted towards specific types of events. It is likely that this approach would have provided QR with information about a significant increase in the number of false rightaways being provided by guards on NGR trains prior to any (or most) of the 6 start against signal SPADs.
• No assurance activities were planned to review SPAD risk or station dispatch procedures associated with the introduction of the NGR fleet. It is understandable that assurance activities need to be planned based on the level of expected risk, but as already noted there is also a need to ensure that unanticipated risks are not present following a change. An integral part of risk management with the introduction of a new system is to continually monitor and review the system’s integrity through the conduct of various assurance activities, such as audits, systematic observations or surveys of involved personnel.

In summary, there were limitations in QR’s application of risk management and change management processes relevant to the introduction of the NGR, which created a vulnerability that increased the risk of a start against signal SPAD. Specifically, multiple processes did not effectively consider the risk of station staff at suburban platforms providing the allright signal for all NGR trains even when the platform departure signal displayed a stop indication, which was in contrast to how allright signals were being applied in practice for all trains at the 3 CBD stations and 2 other designated stations.

Overall, if QR had developed a greater appreciation of the risk associated with increased false rightaways, they could have introduced additional mitigators, particularly prior to the January 2019 change to dispatch procedures. This could have included more extensive communications to guards and drivers, more active monitoring of rightaways (and reporting of false rightaways), and potentially further review of the positioning or salience of SAIs.

Ultimately, it is worth noting that the start against signal SPAD rate on NGR trains decreased within 18 months of the procedure change. This was probably associated with guards becoming more familiar with the differences between allright signal processes at suburban stations compared to the designated stations, guards becoming more familiar with the location of SAIs, and/or drivers becoming more familiar with the increased risk of false rightaways.

Overall, this change process has demonstrated important lessons for all operators about understanding the undocumented or informal risk controls that are in place, and how exactly operational personnel are applying procedures, prior to introducing changes. It has also demonstrated the importance of applying a formal change management process to assess the potential risk of procedural changes before determining that a change is minor in nature.

Application of the maintenance of competency process

Both the driver and guard had undertaken regular maintenance of competency (MOC) assessments, at least every 18 months, in the period leading up to the 25 March 2019. However, irregularities were found with the recent assessments conducted for both the driver and the guard.

In the case of the driver, answers to questions requiring a detailed response matched very closely to answers from the assessor’s marking guide. In addition, no problems were noted with the driver’s performance during practical MOC assessments in 2016 and 2018. However, following the 25 March 2019 SPAD, QR found the driver not competent on 14 occasions while participating in their post-SPAD coaching and mentoring sessions.

Similar, the guard was identified to have language and literacy difficulties in October 2018, which required special assistance in order for them to complete the written MOC assessments. However, there was no record that any special assistance or reasonable adjustment was provided on previous MOC assessments or a subsequent assessment conducted later in the same month, and there was no indication that the guard had any difficulty in completing the written assessments.

Overall, such irregularities were similar to those identified with MOC assessments during a previous ATSB investigation (RO-2018-002), which determined that QR’s administration of the MOC assessment process provided limited assurance that drivers met relevant competency requirements. As outlined in the previous investigation report, QR has taken and is taking steps to address this issue.

As noted in the previous investigation, the ATSB is not suggesting that QR’s Citytrain drivers and guards were not competent; rather, the application of the process for assessing competency had significant limitations in assuring their competency. It is very likely that most of the Citytrain drivers and guards possessed the skills, knowledge and aptitude to demonstrate competency at the time the assessments were conducted.

In this case, with regard to the specific actions of the driver involved in the 25 March SPAD, they knew the requirements of the stopped at a red, start on yellow and other relevant procedures involved in this SPAD. Similarly, the guard knew the requirements of the rightaway procedure. Accordingly, the available evidence indicates that the limitations identified with the application of the MOC process for the driver and guard did not directly contribute to this particular SPAD occurrence.  

Train crew fatigue

Both the driver and guard of DW17 commenced duty on the day of the SPAD at 0412. Such early starts are problematic because people generally go to bed at (or cannot get to sleep until) their normal bedtime and they get less than their normal amount of sleep (Tucker and Folkard 2012). Research has shown that early morning shifts are associated with elevated levels of fatigue risk and higher self-ratings of fatigue compared to day shifts (Sallinen and Hublin 2015). Some researchers have stated early shifts be limited to a maximum of 3 in a row (Tucker and Folkard 2012) whereas others have recommended that rosters with several consecutive early morning starts be avoided where possible (Roach and others 2011).

Most people need at least 7–8 hours of sleep each day to achieve optimum levels of alertness and performance (Watson and others 2015), and research has shown that obtaining less than 5 hours sleep in the previous 24 hours is associated with significant performance decrements (Dawson and McCulloch 2005, Dawson and others 2021), with some research noting that 5–6 hours’ sleep in the previous 24 hours is problematic (Dawson and others 2021, Williamson and others 2011).

In the case of DW17, the driver reported having 6 hours sleep during the night before the SPAD. They had also been on duty for just over 8 hours, slightly longer than the maximum recommended by QR’s rostering guidelines for a shift commencing before 0500. However, given the time of the SPAD (1216), the time the driver had been awake (about 9 hours) and the fact that they had 2 rest breaks during their shift, there was insufficient evidence to conclude that the driver was experiencing a level of fatigue that has been demonstrated to adversely influence performance.

The guard was working the same shift as the driver, however they probably had 3.0–3.5 hours’ sleep during the night before the incident. Irrespective of other factors, this amount of sleep within the previous 24 hours, and the fact that little if any of this sleep would have occurred in the guard’s circadian low, was sufficient evidence to conclude that the guard was probably experiencing a level of fatigue that has been demonstrated to adversely influence performance.

The extent to which the guard’s level of fatigue contributed to them providing a false rightaway signal is difficult to determine. As previously discussed, such errors are commonly associated with high levels of expectancy such that, after receiving the allright signal, the rightaway signal can be provided. There was no specific evidence available to indicate that such errors are commonly associated with fatigue.

Management of roster changes

The guard’s restricted sleep the previous night was associated with a late-notice change to their roster. The guard was originally scheduled to commence duty at 0900, but they were asked if they could commence at 0412.

For a suburban passenger rail transport operator, there is a constant requirement to operate trains 7 days a week and most hours of the day. Rail transport operators will always have a need to manage changes to rosters, and on some occasions, there will be limited time available to organise these changes. However, it is still important that any such changes be managed in a way that minimises fatigue risk.

In the case of QR’s Citytrain train crew, there appeared to be 3 main requirements to be met prior to a driver or guard being offered a shift change to modify their day-of-operations roster:

• The resulting shift(s) complied with the mandatory hours-of work-principles (such as maximum shift length of 9 hours and minimum break between shifts of 12 hours).
• The resulting shift(s) had a FAID score that did not exceed 100.
• The driver or guard did not report that they were feeling fatigued when they accepted the revised shift(s) or prior to commencing the shift(s).

Although important and useful, rosters complying with the hours-of-work principles could still present an elevated risk of fatigue. In addition, depending on the roster pattern, FAID scores less than 100 can be associated with significant levels of fatigue. The Independent Transport Safety Regulator (2010) stated ‘a FAID score of less than 80 does not mean that a work schedule is acceptable or that a person is not impaired at a level that could affect safety’, and the US Federal Railroad Administration (2010) concluded that in some cases FAID scores between 70 and 80 can be associated with ‘extreme fatigue’.

Although a biomathematical model of fatigue (BMMF) score can provide a relative indication of a roster’s potential to provide adequate sleep opportunity (Dawson and others 2011), such models have many limitations and other processes need to be in place to help ensure an adequate sleep opportunity is actually provided. There are many types of roster changes that will result in restricted sleep opportunities that will not result in a FAID score that is problematic or significantly elevated. As noted by Gander and others (2011):

The current generation of bio-mathematical models cannot be used in real time, for example to estimate workers fatigue levels when reviewing roster swaps or deciding which staff will be less fatigued when being asked to carry out overtime…

In terms of self assessments, research indicates that people will generally underestimate their level of fatigue (Battelle Memorial Institute 1998), including underestimating the impact of several days of sleep restriction (Banks and Dinges 2007). Some research has also shown that people overestimate the amount of sleep they obtain (Lauderdale and others 2008, Jackson and others 2018). In addition, most rail transport operators have financial incentives in place for train crew if they accept changes or extensions to their planned shift or accept an additional shift. Concerns about self-reporting fatigue are also commonly perceived amongst train crew in the rail industry (for example, Fitness and Naweed 2017).

In the case of the guard of DW17, the revised start time for the guard’s shift met the hours-of-work principles because the guard had the previous 2 days off duty. In addition, because of the 2 days off duty, the guard’s FAID score was relatively low (40) and would have stayed well below a score of 100 (and even a score of 80) regardless of the start time.  

Nevertheless, given the late-notice roster change, the guard did not have sufficient sleep opportunity prior to commencing their shift. The rostering personnel were asking the guard after 2200 the night before to undertake a shift at 0412, a situation that would almost certainly have resulted in the guard having a restricted sleep opportunity (and at most 4 hours of sleep before commencing duty). This problem was not able to be captured by either the FAID score or the hours-of-work principles.

To cope with the variable start times common in the rail industry, personnel may adjust their sleep patterns to some extent based on an expected roster. It is quite reasonable that the guard, expecting to start work at 0900, would stay up until after 2200. If they were aware, they would be commencing work at 0412, they may have attempted to go to sleep earlier or had a nap in the afternoon (although such actions may not be successful).

In such situations, with late-notice changes resulting in elevated fatigue risk, there is obvious merit for a rail operator to more actively seek assurance that personnel have obtained sufficient sleep prior to accepting the roster change and/or prior to commencing duty. The application of other mitigators, such as limiting the length of the shift, should also be considered. Passively assuming that personnel have conducted an accurate self assessment of their fatigue or alertness level in such situations does not provide assurance that the risk associated with the late-notice change has been adequately managed.

The ATSB investigation also noted that the driver had undertaken 3 additional shifts (to those originally rostered) during the period from 15–18 March 2019, conducted a series of 6 early start (starting between 0400–0600) or very early start (starting between 0300–0359) shifts in a row between 18–23 March, and had a FAID score exceeding 80 in the last 2 of these shifts. This sequence of shifts included several deviations from the operator’s rostering guidelines. In such situations, there would also be considerable merit in a more active approach to ensuring that the driver was assessed as being fit for duty prior to the last 2 shifts rather than passively relying on self assessments.

Findings

From the evidence available, the following findings are made with respect to the signal passed at danger (SPAD) involving suburban passenger train DW17 and the near collision with another passenger train at Park Road Station on 25 March 2019.

Contributing factors

• After train DW17 stopped at Park Road Station, with the departure signal (DP29) displaying a red aspect, the driver did not apply the operator's ‘stopped at a red’ procedure.
• After receiving the 'allright' signal indicating station duties were complete, the guard promptly provided the driver with the 'rightaway' signal, even though the platform departure signal (DP29) was displaying a red aspect (stop) indication. This was probably associated with the guard having a very high level of expectancy that the allright signal indicated the departure signal was at proceed.
• After receiving the ‘rightaway’ signal from the guard, the driver promptly departed the station platform without effectively checking and confirming the aspect indication in the departure signal (DP29). This was probably associated with the driver having a very high level of expectancy that the rightaway signal indicated that the departure signal was at proceed.
• Limitations in Queensland Rail’s application of risk management and change management processes relevant to the introduction of the new generation rollingstock (NGR) increased the risk of a start against signal SPAD (signals passed at danger). Specifically, multiple processes did not effectively consider the risk of station staff at suburban platforms providing the allright signal for all NGR trains even when the platform departure signal displayed a stop indication, which was in contrast to how allright signals were being provided in practice for all trains at the 3 central business district stations and 2 other designated stations. [Safety issue]

Other factors that increased risk

• The maintenance of competency (MOC) assessments undertaken on the driver prior to the signal passed at danger (SPAD) occurrence on 25 March 2019 did not provide assurance that the driver met all relevant competency requirements, including competencies associated with minimising the risk of a SPAD. Anomalies were also identified with the MOC assessments undertaken on the guard.
• Queensland Rail's process for the installation of signal aspect indicators (SAIs) did not provide sufficient detail to ensure consistent and conspicuous placement of SAIs at station platforms. This problem, combined with an SAI’s non-salient indication when the platform departure signal displayed a stop indication, increased the risk that an SAI would not be correctly perceived by a train guard. [Safety issue]
• Due to a late-notice roster change and limited sleep the night before the occurrence, the train guard was probably experiencing a level of fatigue known to adversely influence performance.
• Queensland Rail’s fatigue management processes for Citytrain train crew had limited processes in place to actively identify and manage the risk of restricted sleep opportunity resulting from late-notice roster changes. [Safety issue]

Other findings

• The tutor driver on 1E65 identified the potential collision risk and took prompt action to stop that train prior to the potential collision point with DW17. In addition, after the universal traffic control system generated a SPAD alarm, the network control officer promptly transmitted an emergency stop command to the driver of DW17 and the crew of 1E65 to stop their trains.

Safety issues and actions

Risk management associated with changing allright signal procedures for the NGR

Safety issue number: RO-2019-009-SI-003

Safety issue description: Limitations in Queensland Rail’s application of risk management and change management processes relevant to the introduction of the new generation rollingstock (NGR) increased the risk of a start against signal SPAD (signals passed at danger). Specifically, multiple processes did not effectively consider the risk of station staff at suburban platforms providing the allright signal for all NGR trains even when the platform departure signal displayed a stop indication, which was in contrast to how allright signals were being provided in practice for all trains at the 3 central business district stations and 2 other designated stations.

Placement of signal aspect indicators at station platforms

Safety issue number: RO-2019-009-SI-001

Safety issue description: Queensland Rail's process for the installation of signal aspect indicators (SAIs) did not provide sufficient detail to ensure consistent and conspicuous placement of SAIs at station platforms. This problem, combined with an SAI’s non-salient indication when the platform departure signal displayed a stop indication, increased the risk that an SAI would not be correctly perceived by a train guard.

Management of late-notice roster changes

Safety issue number: RO-2019-009-SI-004

Safety issue description: Queensland Rail’s fatigue management processes for Citytrain train crew had limited processes in place to actively identify and manage the risk of restricted sleep opportunity resulting from late-notice roster changes.

Safety action not associated with an identified safety issue

Additional safety action Queensland Rail

The Queensland Rail (QR) internal safety investigation report into the 25 March 2019 SPAD occurrence at signal DP29 noted the following safety actions:

-  Train Service Delivery has actioned an Operational Improvement Plan for the Rail Traffic Driver
-  Train Service Delivery has actioned a Performance Management Plan for the Rail Traffic Guard
-  Published a lessons learned from the investigation produced by the Investigation Team into the SPAD at DP29 to all Rail Traffic Crew
-  Assurance team to undertake a 2^nd Line Assurance activity to determine Rail Traffic Guard Compliance with Procedure MD-12-38 Rail Traffic Crew Manual (Version 5.0) AEQ 14 Rightaway Procedures – SEQ.

In 2020, QR completed the second line assurance activity. The findings from the investigation were included in the ATSB report (see Monitor and review). Following the assurance activity, an operational notice was sent to train crew regarding compliance with the rightaway procedure.

Glossary

AWS                Automatic warning system

BMMF              Biomathematical model of fatigue

BOM                Business operating model

CBD                 Central business district

COA                 Critical operational alert (a type of TSD communication to train crew)

EMU                Electric multiple unit (a type of electric suburban train)

FAID                Fatigue Audit InterDyne, subsequently named Fatigue Analysis Tool (a type of BMMF)

GOA                 General operational alert (a type of TSD communication to train crew)

ION                  Important operational notice (a type of TSD communication to train crew)

LED                 Light emitting diode

MOC                Maintenance of competency

NCO                Network control officer

NGR                New generation rollingstock (a type of electric suburban train)

QR                   Queensland Rail

RTC                 Rail traffic crew

RTCD               Risk triggered commentary driving

RTD                 Rail traffic driver

RTG                 Rail traffic guard

SAI                   Signal aspect indicator

SCS                 Station customer service (a section within QR Citytrain)

SMS                 Safety management system

SPAD               Signal passed at danger

TSD                 Train services delivery (a section within QR Citytrain)

UTC                 Universal traffic control (system used by train control)

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Queensland Rail
• the driver and guard of DW17
• the train crew of IE65
• other Queensland Rail personnel
• event recorders from trains DW17 and 1E65
• closed-circuit television from trains DW17, 1E65 and from the station platform at Park Road Station.

References

Banks S and Dinges DF (2007), ‘Behavioral and physiological consequences of sleep restriction’, Journal of Clinical Sleep Medicine, 3:519–528.

Basacik D, Read C, Heavisides J, Jones M and Pollard G (2008) A review of passenger train dispatch from stations, Rail Safety and Standards Board, UK, research report T743.

Battelle Memorial Institute (1998) An overview of the scientific literature concerning fatigue, sleep, and the circadian cycle, Report prepared for the Office of the Chief Scientific and Technical Advisor for Human Factors, United States Federal Aviation Administration.

Civil Aviation Safety Authority (2014) Biomathematical fatigue models. Available from www.casa.gov.au.

Dawson D and McCulloch K (2005) ‘Managing fatigue: It’s about sleep’, Sleep Medicine Reviews, 9:365–380.

Dawson D, Noy YI, Härmäc M, Åkerstedtd T and Belenkye G (2011) ‘Modelling fatigue and the use of fatigue models in work settings’, Accident Analysis and Prevention, 43:549–564.

Dawson D, Sprajcer M and Thomas M (2021) ‘How much sleep do you need? A comprehensive review of fatigue related impairment and the capacity to work or drive safely’, Accident Analysis and Prevention, 151:105955.

Federal Railroad Administration (2010) Procedures for Validation and Calibration of Human Fatigue Models: The Fatigue Audit InterDyne Tool, Department of Transportation Technical Report DOT/FRA/ORD-10/14.

Fitness AJ and Naweed A (2017) ‘Causes, consequences and countermeasures to driver fatigue in the rail industry: The train driver perspective’, Applied Ergonomics, 60:12–21.

Gander P, Hartley L, Powell D, Cabon P, Hitchccok E, Mills A and Poplin S (2011) ‘Fatigue risk management: Organizational factors at the regulatory and industry/company level’, Accident Analysis and Prevention, 43:573–590.

Gibson H (2016) Industry human factors SPAD review: Project summary report, Rail Safety and Standards Board, UK.

Haga S (1984) ‘An experimental study of signal vigilance errors in train driving’, Ergonomics, 27:755-765.

Independent Transport Safety Regulator (2010) Transport Safety Alert 34 - Use of biomathematical models in managing risks of human fatigue in the workplace.

Jackson CL, Patel SR, Jackson WB 2nd, Lutsey PL, and Redline S (2018) ‘Agreement between self-reported and objectively measured sleep duration among white, black, Hispanic, and Chinese adults in the United States: Multi-Ethnic Study of Atherosclerosis’, Sleep, 41(6).

Lauderdale DS, Knutson KL, Yan LL, Liu K, and Rathouz PJ (2008) ‘Self-reported and measured sleep duration: how similar are they?’, Epidemiology, 19:838–845.

Multer J, Safar H, Roth E and France M (2019) Why do passenger trains pass stop signals? A systems view, Federal Railroad Administration, Department of Transportation Technical Report DOT/FRA/ORD-19/19.

Naweed A (2013) ‘Psychological factors for driver distraction and inattention in the Australian and New Zealand rail industry’, Accident Analysis and Prevention, 60:193–204.

Naweed A, Rainbird S and Chapman J (2015) ‘Investigating the formal countermeasures and informal strategies used to mitigate SPAD risk in train driving’, Ergonomics, 58:883–896.

Roach GD, Fletcher A and Dawson D (2004) ‘A model to predict work -related fatigue based on hours of work’, Aviation, Space, and Environmental Medicine, 75:61-69.

Roach GD, Sargent S, Darwent D and Dawson D (2012) ‘Duty periods with early start times restrict the amount of sleep obtained by short-haul pilots’, Accident Analysis and Prevention, 45S:22–26.

Sallinen M and Hublin C (2015) ‘Fatigue-inducing factors in transportation operators’, Reviews of Human Factors and Ergonomics, 10:138–173.

Tucker P and Folkard S (2012) Working time, health and safety: A research synthesis paper, Background Report to the International Labour Office for the ILO Tripartite Meeting of Experts on Working time Arrangements, Geneva: International Labour Office.

Watson NF, Badr MS, Belenky G, Bliwise DL, Buxton OM, Buysse D, Dinges DF, Gangwisch J, Grandner MA, Kushida C, Malhotra RK, Martin JL, Patel SR, Quan SF and Tasali E (2015) ‘Recommended amount of sleep for a healthy adult: A joint consensus statement of the American Academy of Sleep Medicine and Sleep Research Society’, Sleep, 38:843-844.

Wickens CD, Hollands JG, Banbury S and Parasuraman R (2013) Engineering psychology and human performance, 4th edition, Pearson Boston, MA.

Wickens CD  McCarley JS (2008) Applied attention theory, CRC Press, Boca Raton, FL.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• the driver and guard of DW17
• Queensland Rail
• the Office of the National Rail Safety Regulator (ONRSR).

Submissions were received from Queensland Rail and ONRSR. The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

On 20 March 2019, the pilot of an Airbus Helicopters AS350B3e, registered VH-SZS (SZS) was performing aerial work on Pernatty Station, South Australia, approximately 60 km east of Woomera Airfield. The task involved helicopter powerline stringing from the Mount Gunson South substation to the Carrapateena mine site, a total distance of 51 km. The stage being conducted on the morning of 20 March was from pole 159 to pole 179, a distance of 4.8 km. Stringing operations continued normally for poles 161, 162 and 163. However, while approaching pole 164, at about 1017, witnesses reported seeing the helicopter collide with the pole and impact terrain near the base of the pole. The pilot, who was the sole occupant, received fatal injuries.

What the ATSB found

The ATSB found that shortly after the pilot was trained in powerline stringing, for unknown reasons they modified the taught stringing methodology. The new methodology placed the helicopter at low level in the vicinity of the powerline poles, increasing the risk of a collision. It also exacerbated the uptake of dust which, in combination with the position of the sun and the rearward attitude of the aircraft likely reduced the pilots’ visibility of pole 164 and their situational awareness of it.

These factors, combined with the short distance and large elevation gain between pole 163 and 164, led to the pilot inadvertently colliding with pole 164. It was also found that the indirect supervision provided to the newly trained pilot was ineffective in identifying that a modified stringing method was being used.

What has been done as a result

The helicopter operator has advised the ATSB that they have made the following changes to their operations manual. The changes relate specifically to the supervision and review of newly authorised pilots in specialist tasks, and includes:

• Mandated and expanded In Command Under Supervision time requirements for pilots as part of initial task training for relevant specialist tasks.
• The introduction of consolidation flight checks at key points for pilots newly authorised in relevant specialist tasks.
• The mandated extension of time that pilots newly authorised in relevant specialist

tasks are mentored by an experienced pilot.

Safety message

This investigation shows that experience alone will not always prevent a pilot from having an accident. In this case the pilot was a very experienced deputy chief pilot with nearly 6,500 flight hours. The ATSB research publication AR-2012-035 provides some insight as to why experience does not always provide a safeguard:

• Experience alone can never compensate for high risk activity.
• Sound decision-making and experience do not necessarily go together.
• Using pilot experience as mitigation for potential operational risks is inadvisable. If the risks are unacceptable for a qualified and competent pilot, there should be no reason for an experienced pilot to accept them.

The investigation also highlights the value of direct supervision of pilots who have recently been trained in a new task.

The occurrence

On 20 March 2019, the pilot of an Airbus Helicopters AS350B3e, registered VH-SZS (SZS) was performing aerial work on Pernatty Station, South Australia, approximately 60 km east of Woomera Airfield (Figure 1).

Figure 1: Accident location

Source: Google Earth, annotated by ATSB.

The helicopter operator (Aeropower) had been contracted to conduct powerline stringing operations (see the section titled Power line stringing methodology) for a new 132 kV electrical transmission line from the Mount Gunson South substation to the Carrapateena mine site (operated by OZ Minerals). The task involved stringing draw wire^[1] and optical ground wire. The total length of the stringing operations, 51 km, was divided into twelve stages that were identified with reference to numbered transmission poles. The stage being conducted on the morning of 20 March was from pole 159 to pole 179, a distance of 4.8 km.

On the morning of the accident the Aeropower pilot and refueller rose at about 0430 Central Daylight‑saving Time.^[2] After breakfast, at about 0630 they attended the first of three morning briefings. The first briefing was run by Ventia, the primary contractor for the powerline operation (see the section titled Operational information). All workers were breath-tested for alcohol during this briefing. After the Ventia briefing, the Aeropower duo then attended the Powerlines Plus (PLP) briefing at about 0700. After the PLP briefing, at about 0730, the refueller drove the pilot to the nearby Carrapateena Airport.

At 0842 the pilot took-off from Carrapateena Airport. After about two minutes of flight, the pilot returned the aircraft to the airport due to what was later described as a warning light in the cockpit. After about seven minutes on the ground, the pilot took-off again and flew to pole 179 (the last pole of the stage) for a radio check with the stringing team ground-crew. The pilot then flew the length of the stage to the start point (pole 159) for a fly-by inspection of the job site. The pilot then flew to the refuelling point, nick-named the ‘Turkey’s nest’, landing at about 0858 (Figure 2). Here the pilot rendezvoused with the refueler and the stringing team for the last pre-start briefing for those workers directly involved with the helicopter operations.

During this meeting the pilot briefed one of the ground crew, supplied by the powerline company, on how to hook-up the draw wire to the helicopter as they had not performed this task previously. The aircraft was also refuelled. Afterward, the stringing team proceeded to their assigned work positions and at about 1000 the pilot took off and proceeded to pole 159 to commence stringing operations.

Figure 2: ADS-B^[3] derived flight data for VH-SZS on 20 March 2019.

Figure 2 Shows the ADS-B flight data for VH-SZS on the day of the accident.

Source: FlightRadar24 and Google Earth, annotated by ATSB.

In preparation for helicopter stringing operations, the draw wire had previously been strung to a pulley on pole 159 using an elevated work platform. Just after 1000, when SZS reached pole 159, ground crew attached the draw wire to a remote hook fitted to the helicopter at the end of a 30 ft longline. SZS then pulled the draw wire out from a Tesmec S.p.A.^[4] (Tesmec) stringing machine and proceeded to pole 160 to clip the draw wire into the pulley. Stringing operations continued normally for poles 161, 162 and 163.

While approaching pole 164 at about 1017, witnesses reported seeing the helicopter collide with the pole and impact terrain near the base of the pole. Several ground crew from the stringing team that were near the helicopter came to assist. They extinguished a small post-impact fire and removed the pilot from the aircraft to a safe distance. A short time later emergency services and paramedics from the mine site attended the scene and confirmed that the pilot, who was the sole occupant, had received fatal injuries.

________

1. The draw wire is thinner (13 mm) and lighter (0.55 kg/m) than the conductor wire (31.5 mm, 1.96 kg/m). After the helicopter strings the draw wire, a ground-based winch is used to pull the conductor wire through.
2. Central Daylight‑saving Time (CDT): Coordinated Universal Time (UTC) +10.5 hours.
3. ADS-B: Automatic Dependent Surveillance–Broadcast is a surveillance technology in which an aircraft determines its position via satellite navigation and periodically broadcasts it, enabling it to be tracked.
4. Tesmec S.p.A. are an Italian manufacturer of stringing machines. In this case, a diesel-powered hydraulic winch/brake, provides tension while the helicopter is drawing wire out and then acts as a winch to pull the final conductor wire back though.

Context

Pilot information

General information

The pilot held commercial pilot licences for both aeroplanes and helicopters, issued on 17 November 2000 and 20 November 2009 respectively. The pilot was rated for both single‑ and multi-engine fixed wing aircraft, as well as single‑engine helicopters. Design feature endorsements that the pilot held included manual propeller pitch control, tail wheel, gas turbine and retractable undercarriage endorsements. Additionally, the pilot had a low-level endorsement for helicopter sling operations issued on 17 November 2009 and an aeroplane aerobatic endorsement, issued on 8 January 1998. The pilot was also a licenced aircraft maintenance engineer.

A review of the pilot’s Air Maestro^[5] logbook showed that at the time of the accident the pilot had accumulated a total flying experience of approximately 6,370 hours. About 45 of those hours were in the previous 30 days and about 77 hours were in the last 3 months. Most the pilot’s flying experience (5,280 hours) was in helicopters, and the majority of that (4,537 hours) was in the MD500, a single‑engine light utility helicopter. The pilot had 240 hours on the AS350, the same type flown on the day of the accident, with about 49 hours in the last 3 months on that type. The pilot’s licence book indicated that the pilot had last completed a single-engine helicopter flight review on 24 Jan 2019 that was valid for 12 months.

Powerline stringing training

The pilot, who was the deputy chief pilot (DCP) for Aeropower Pty. Ltd., had been with the company since the late 1990s. In that time, the pilot had accrued about 2,400 hours in powerline operations. This included about 1,343 hours in powerline patrol and inspection, 643 hours insulator washing and nearly 400 hours in platform work.

The DCP had observed powerline stringing operations in December 2018, on a job in Wollongong, New South Wales. However, all the DCPs formal powerline stringing training was conducted during the three days of the first tour at Carrapateena.

The training involved the:

• DCP observing the chief pilot (CP) from the ground
• DCP observing in the aircraft
• CP observing the DCP while flying dual
• DCP stringing solo with the CP observing from the ground.

The DCP was deemed satisfactory in all requirements and on 7 February 2019 the CP signed-off the DCP for powerline stringing operations. The training comprised a total 7.2 hours with 1.4 hours of those with the DCP in command. At the time of the accident the pilot had a total of 25 hours experience in powerline stringing.

Medical information

The pilot held a Class 1 Aviation Medical Certificate that was valid until 2 Oct 2019 with no restrictions. The pilot was reported to be very fit and active and displayed normal behaviour on the morning of the flight and was well-rested. He was not reported to be taking any prescription medications and had no reported medical condition that could have affected his ability to operate an aircraft that day.

A post-mortem examination identified no significant background natural disease, which could have contributed to the accident. Toxicological analysis concluded that the toxicology was also non‑contributory to either the accident or cause of death.

Aircraft information

Overview

VH-SZS (SZS) (Figure 3) was an Airbus Helicopters^[6] AS350B3e Écureuil (Squirrel) light utility helicopter manufactured in 2012. The aircraft was a single-engine helicopter with six seats in the basic configuration. The primary structure of the aircraft was constructed of sheet metal, while the canopy, underside access cowling, transmission and engine cowlings were made of composite materials. The cabin area was accessible through four doors, two hinged pilot doors and two sliding rear doors.

Figure 3: Image showing VH-SZS

Figure 3 shows VH-SZS, a single turboshaft‑powered Airbus Helicopters AS350B3e Squirrel.

Source: Supplied

Engine and rotors

The main rotor system comprised of three composite main rotor blades constructed of a fiberglass spar with a composite skin over a foam core. The blades were attached to a composite semi-rigid, bearingless starflex hub. The two-blade tail rotor was also manufactured of composite materials moulded onto a fibreglass spar. The tail rotor was mounted to a lightweight sheet metal tail boom. All flight controls were hydraulically boosted, with hydraulic power supplied by a single hydraulic pump which was belt driven by the engine-to-transmission driveshaft. SZS was powered by a Turbomeca Arriel 2D engine, which was a free turbine^[7] turboshaft engine. The engine was controlled by a dual-channel, full authority digital engine control (FADEC) system.

Engine Data recorder

The aircraft was fitted with a Sensorex Engine Data Recorder (EDR). The EDR was a light recorder that exclusively records data sent by the FADEC system for maintenance purposes. For both FADEC channels, engine parameters and failure flags were recorded. Engine parameters were recorded continuously at a sample rate of 1 second and at a sample rate of 20 ms for a limited duration when a failure occurs.

Maintenance

The helicopter was built in 2012 and operated in New Zealand before being imported to Australia in 2016. A Certificate of Airworthiness inspection was completed 11 March 2016, and the certificate of registration was transferred to the current owner on 13 December 2018. SZS had a current maintenance release, issued on 19 October 2018 which was valid for a period of 150 hours or 12 months, whichever was sooner. At the time of the accident the aircraft had accrued 100.4 hours since the maintenance release. The maintenance release was not in the helicopter, as required, it was located in the pilot’s belongings in the accommodation area.

The helicopter was maintained in accordance with the manufacturer’s documentation. At the time of the accident, there were no known maintenance deficiencies with the helicopter.

Aircraft weight and Balance

A weight and balance was performed on 16 January 2019 with an expiry date of 15 January 2022. Additionally, weight and balance calculations indicated that the aircraft was below maximum take‑off weight and within the centre of gravity limits for the duration of the flight

Mack Pull

To facilitate stringing operations, the helicopter was fitted with a Mack Innovations (Australia) Pty Ltd (Mack Pull) bidirectional line stringing system. The Mack Pull provides a hard point located under the belly and to the side of the aircraft that is designed to carry a standard cargo hook. It assists with aerial work applications that require sideways flight and was specifically designed for power cable stringing work as it helps to keep the cable within the pilots’ field of vision.

A 30 ft longline was attached to the cargo hook on the Mack Pull and a Mechanical Specialties 301 remote hook was attached to the other end of the 30 ft longline. A cockpit mounted load meter gave a visual indication to the pilot of the load placed on the system. The load rating on both the remote hook and the 30 ft longline was 3,000 lbs (1,360 kg).

Flight recorders

The aircraft was not fitted with a flight data recorder or a cockpit voice recorder, nor was either required by regulations.

Meteorological information

Graphical Area Forecasts (GAF)^[8] for the area of operations, as well as aerodrome forecasts (TAF), meteorological aerodrome report (METAR)^[9] and Automatic Weather Station (AWS) reports from Woomera Airfield were obtained from the Bureau of Meteorology. The forecasts (GAF and TAF) predicted no significant weather in the area of operations for the duration of the accident flight.

The METARs for Woomera Airfield (about 60 km west of the accident site) at 0930 indicated that the surface wind was 160° (True) at 9 kt. At 1000 the wind was 170° at 10 kt and at 1030 the wind was 160° at 9 kt. For all times the QNH^[10] was 1015 hPa and the conditions were CAVOK.^[11]

At the time of the accident the Woomera AWS recorded the temperature at 24.4 °C, 8 knots of wind (with maximum gusts of 10 kt) from 166°, and a QNH of 1015.8.

Weather data measured at the Carrapateena mine showed that at 1010 (about 7 minutes before the accident) the temperature was 27.5 °C and the wind was 1.7 kt from 128°. There were no significant changes in those conditions on the morning leading up to the accident.

On-site observations

Observations of the conditions on the day were consistent with the meteorological reports. It was reported that during the last pre-flight briefing the pilot commented that the conditions were good for flying. Other witnesses described the conditions as sunny and a little bit windy. Several witnesses noted both the strength and position of the sun, which was reported to be in the direction that the aircraft was travelling. Geoscience Australia data showed that at the time of the accident the azimuth^[12] of the sun was 65° and its altitude was 35°. The bearing from pole 163 to pole 164 was 49°.

Additionally, the presence of a large amount of dust in the vicinity of the aircraft was noted by several witnesses. This can be seen in Figure 4, which shows a sequence of images of the aircraft traversing from pole 163 to pole 164.

Figure 4: VH-SZS traversing between pole 163 and 164.

Figure 4 shows VH-SZS traversing between pole 163 and 164. Pole 163 is visible in the image, while pole 164 is out of the frame to the right. The direction of travel is from left to right in this image.

Source: Witness

Wreckage and accident site information

Accident site

The accident site was located about 60 km east of Woomera South Australia, on the OZ Minerals Carrapateena mine site (Figure 1). The mine is located on Pernatty Station, a 2,147 km² livestock station about 136 km north of Port Augusta. The start of the stringing stage (pole 159) was about 5 km south-west of Carrapateena Airport and the aircraft had traversed about 1 km to pole 164.

Wreckage examination

Site and wreckage examination did not identify any aircraft defects or anomalies that might have contributed to the accident. Markings on pole 164 (Figure 5) indicated that the helicopter collided with the pole about 17 m above the ground. The main rotor blade (MRB) contacted the pulley mounted on the insulator, the ladder and pole during the accident sequence. The pulley fractured from its mounting bracket and came to rest on the access road, 15 m from the pole. The ladder was struck and bent toward the direction of the pulley, consistent with the direction of rotation of the MRBs. The pole had a number of MRB strikes, which progressed in a downward direction as the helicopter descended (inset in Figure 5).

Figure 5: Impact marks and damage to pole 164.

Source: ATSB

After impacting the pole, the helicopter came to rest on its right side approximately 2 m from the base of the pole (Figure 6). The aircraft had rotated approximately 90° to the left of its direction of travel.

Figure 6: The accident site near pole 164. The direction of travel of the helicopter was from pole 163 to pole 164.

Source: ATSB

The cockpit and fuselage roof were substantially disrupted from impact forces. The tail boom had almost entirely detached at the fuselage junction and fractured forward of the horizontal stabiliser, due to ground impact. Two of the MRBs had separated from the rotor head and came to rest side‑by‑side next to the fuselage. The third blade remained attached and had become entangled around the main rotor gearbox.

The longline, which had separated from the Mack Pull, was found a short distance away toward Pole 163. The draw wire was also found to have separated from the remote hook on the longline. The ATSB recovered a number of components from the accident site for further examination.

Engine

The engine assembly was examined and found to be complete with no evidence of pre-accident defects. All engine plumbing and wiring looms were connected to their respective components. The chip detector and magnetic plugs were examined and found to be clear of particles. The engine fuel and oil filters were examined and found to be clear of contaminants.

Recorded engine data

The engine data recorder (EDR) was shipped to France and downloaded by the of Bureau d’Enquêtes et d’Analyses (BEA). The BEA analysed the data in consultation with the aircraft manufacturer (Airbus Helicopters) and the engine manufacturer (Safran Helicopters Engines). The analysis showed that the engine was performing in a satisfactory manner until contact with the pole, when the EDR recorded a torque overlimit. The BEA report concluded that;

No anomaly was found prior the impact with the ground/pylon.

Fuel

SZS was fully fuelled on the morning of the flight from an intermediate bulk container (IBC), which was owned and maintained by the operator. The amount of Jet A1 taken aboard was 315 litres, which was sufficient to carry out the planned work for that morning.

A fuel sample was taken from the aircraft post-accident and from the IBC. Both series of testing indicated that the fuel was clean and clear of any contaminants.

Instruments and Avionics

The instrument panel fitted to SZS was the basic panel with added turn and slip and glideslope indicators. An air conditioning control panel and hour meter was also installed.

Emergency Locator Transmitter (ELT)

SZS was fitted with a KANNARD 406 AF-H ELT. The ELT, with part number S1822502-02 and serial number LX1100019317, had an expiry date of November 2024. The ELT activated automatically during the accident sequence and was deactivated by an attending police officer.

Flight controls

All flight controls were examined, and control continuity was established for both main and tail rotor systems. A number of control tubes displayed bending damage due to contacting the surrounding structure during the accident sequence.

Mack Pull and longline

An examination of the Mack Pull and cargo hook did not reveal any defects. Company standard practice was to install the longline with a shackle at both ends however, the draw wire did not have a shackle fitted for the connection to the remote hook. The upper end connected to the helicopter hook did have the shackle installed as required.

The remote hook and longline detached from the aircraft cargo hook during the accident and were located a short distance from SZS, drawn backwards by the retracting load of the draw wire. It could not be determined how it unhooked from the Mack Pull cargo hook. After detaching from the Mack Pull, the remote hook struck a large rock, indicated by orange paint transfer from the hooks’ outer cage. The hook then bounced to another location, shown by a ground scar. The draw wire was found detached from the remote hook. On-site testing indicated it was likely the uncoupling of the draw wire occurred during the impact with the rock.

Post impact fire

A small post impact fire occurred at the engine exhaust. Responders used hand-held fire extinguishers to prevent the spread of fire to the airframe. The resulting damage was minimal and did not show evidence of a fire outside of the engine exhaust.

Additional information

Operational information

The pilot, who was the deputy chief pilot (DCP) for Aeropower and the chief pilot (CP) mobilised to Adelaide on 31 January 2019 in preparation for operations at Carrapateena. The intention was that the CP would use this job as an opportunity to train the DCP in powerline stringing operations, then once signed-off, the DCP would complete the rest of the job solo. On 3 February both pilots mobilised to Port August and arrived at Carrapateena on 4 February for an all-stakeholder briefing for the stringing operation. The key stakeholders present were:

• OZ Minerals – the mine site operator
• Ventia – Principal contractor
• ElectraNet – Contracted to build, own, operate and maintain the powerline infrastructure
• Powerlines Plus (PLP) – sub-contracted by Ventia to build the powerline
• Aeropower – contracted by PLP for the helicopter stringing operations.

Later that day the Aeropower pilots were audited by an independent safety auditor contracted by ElectraNet to assess their capability to safely undertake the job. At this point Aeropower were already contracted to do the work. The next day, 5 February, flying operations began.

Summary of stringing operations

Tour 1 of the helicopter powerline stringing operations started on 5 February and continued until 7 February. During these 3 days, stages 5 and 6 were completed. Stage 5 comprised 22 poles while stage 6 comprised 21 poles. Each stage was completed thrice, once for each of the three wires suspended by the poles. At the end of tour 1, on 7 February, the DCP was signed-off on powerline stringing and the CP departed the site.

Stringing for tour 2 started on 18 February and was conducted by the DCP solo, without the CP on-site. Stage 7 (15 poles), was completed on 18 February and stage 8 was completed on 19 February (19 poles). Again, all stages were conducted three times.

Tour 3 stringing operations commenced on 10 March with the 20 poles of stage 4. This was followed the next day with stage 9 (21 poles). Again, all stages were completed three times by the DCP flying solo. Tour 4 started 9 days later, on 20 March. Including the 4 poles strung on the morning of the accident, the pilot had strung 122 poles, all but the last 4 were strung 3 times.

Accident span gradient

The span width between poles 163 and 164 (the accident span) was 174 m, one of the shortest the pilot had undertaken at Carrapateena. Indeed, of the 122 spans that the pilot had strung at Carrapateena, only 4 were shorter than the accident span. In addition, the elevation gain between pole 163 and 164 was 12.86 m. This was the largest elevation gain of any span the pilot had undertaken at Carrapateena. As a result of the span length and elevation gain, the accident span between pole 163 and 164 had the greatest gradient of any span the pilot had conducted at Carrapateena.

Use of load rings

In response to an ATSB investigation (ATSB report 200300011), the Civil Aviation Safety Authority (CASA) airworthiness bulletin AWB 25-006 was issued (and has since been revised). The bulletin applies to all rotorcraft engaged in underslung load / non-human external cargo. It highlights the importance of using a primary load ring and shackle on cargo hooks to prevent both an inadvertent release or a jammed hook.

The Aeropower operations manual was consistent with this regulatory guidance, with sections 9.1.3 and 9.1.4 stating;

9.1.3. DO NOT put a rope of any kind directly onto the cargo hook. It can twist and hang up preventing release if required.

9.1.4. DO use a shackle or primary load ring to attach directly to the hook to ensure smooth release. Make sure it is large enough to fall free without becoming trapped by the dropping tongue of the hook.

On the day of the accident a Powerlines Plus ground staff was assigned to hook up the draw wire to the helicopter. As they had not performed the task before, during the pre-flight briefing, the pilot instructed the ground staff on the procedure. It was reported that the use of a load ring or shackle was not mentioned, and that the instruction given was to connect the draw wire directly to the remote hook. Other ground staff reported never seeing a load ring or shackle between the draw wire and the remote hook at any time during the Carrapateena operations.

Power line stringing methodology

The purpose of powerline stringing is to attach electrical conductor wire to pulleys that are suspended on towers (or poles). Light-weight conductor wire on smaller poles can be strung using an elevated work platform (‘cherry-picker’) and pulled through with a small winch. While heavier gauge wires, such as that used at Carrapateena, necessitates the use of heavy machinery to pull the conductor between towers. Helicopters can also be used for powerline stringing. The advantage of using helicopters are;

• Much faster than pulling a conductor wire with a bulldozer.
• Minimised disruption to ecologically or culturally sensitive land (the Carrapateena site had cultural sensitivities).
• The ability to traverse rugged terrain that would be inaccessible to ground-based heavy machinery.

One of the limitations of using a helicopter is the weight carrying capacity of the aircraft. For jobs that require a heavy conductor wire, a lighter weight draw wire is strung by the helicopter. Then, a fixed position ground-based winch uses the draw wire to pull the heavier conductor wire back through the pulleys.

Taught methodology

Between 5 and 7 February 2019, the DCP received instruction in helicopter powerline stringing methodology. The stringing method taught by the CP had several key features, these included:

• A straight-line flight path is maintained between each pole.
• The helicopter hovers and traverses at an angle of about 90° (sideways) to the path of the wire. This ensures that visibility of both poles in maintained. The strung pole should be visible through the right cockpit door/window and the target pole should be visible through either the left cockpit door/window or the open rear left door (Figure 7).

Figure 7: Orientation of helicopter relative to path of travel during stringing operations.

 Source: Aeropower work instruction AS350 – Mack Pull

• After clipping in the draw wire to the pulley, height is maintained for a short distance to ensure there is enough weight in the line to hold it down on the pulley.
• As the helicopter traverses to the next pole, altitude is gained to a height greater than that of the next pole.
• The helicopter traverses directly over the top of the target pole. Visibility of the pole is maintained by use of aircraft mounted mirrors.
• Once clear on the other side of the pole, the helicopter descends to the height of the target pulley to clip the wire in.
• The process continues until the stage is complete.

Observed methodology

The DCP was deemed competent in the stringing method and signed-off by the CP at the end of tour 1 on 7 February 2019. All subsequent stringing operations were conducted by the DCP solo.

Nothing unusual or untoward was observed regarding the stringing methodology during the two days of flight operations of the second tour. However, the Aeropower refueller, who was experienced in stringing operations, never observed the stringing operations due to the location of the refuelling site. During the third tour a different Aeropower refueller was on-site and took photographs and video of the stringing operations. Some of the key points observed were;

• After clipping in the draw wire to the pulley the helicopter traversed out to the side (left side relative to direction of travel) en-route to the target pole.
• The aircraft did not gain altitude while traversing in-between poles.
• The helicopter pulled the draw wire in a pronounced tail-back attitude, with respect to the direction of the pull (Figure 4).
• Rather than traversing directly over the target pole, the helicopter came back in from the left side and came over and around the pole.

This modified technique continued into tour 4 and was observed by a number of witnesses on the day of the accident. Witnesses stated that the helicopter never came above the height of pole 164 before colliding with it.

ADS-B data (Figure 8) from the day of the accident shows a flight path consistent with what was described by witnesses. The data shows that the aircraft maintained a low altitude between poles. Only once in close proximity to the next pole did the aircraft rise above the height of the pole. The data also shows the aircraft tracking to the left of the direct path and traversing around the pole rather than directly over it.

Figure 8: ADS-B data of the flight path from pole 159 to 164

Source: FlightRadar24 and Google Earth, annotated by ATSB.

Regulatory oversight

Other than the low level and sling operations endorsements, there are no other specific Civil Aviation Safety Authority (CASA) requirements for undertaking powerline stringing operations. Additionally, there are no recommendations or requirements from CASA regarding the training requirements for operators training pilots in powerline stringing. Nor are there any requirements for any supervision post-training. It is up to the individual operators to provide what they determine to be an appropriate syllabus of training and supervision.

The pilot was provided the training required by Aeropower procedures and satisfied all CASA and Aeropower requirements to conduct powerline stringing. Although there was no requirement in Aeropower procedures for post-training supervision, the CP did try to provide indirect supervision after they had left Carrapateena. The CP stated they were in regular contact with the DCP during tours 2 and 3 to check up on how the DCP was going. It was reported that the DCP did not raise any concerns regarding the job or the stringing methodology.

Related occurrences

A review of the ATSB’s national aviation occurrence database revealed only one other occurrence reported to the ATSB in the 20 years between 2000 and 2019 involving helicopter powerline stringing operations. That accident, also involving an Aeropower aircraft, was investigated by the ATSB (Investigation report AO-2008-025). A summary is below.

On 9 April 2008, the crew of a McDonnell Douglas Helicopter Company MD369ER helicopter registered VH-PLU, experienced a substantial loss of engine power while conducting low-level powerline stringing operations. The helicopter impacted the ground and was seriously damaged. The two occupants were seriously injured.

The investigation determined that the pilot in command was operating the helicopter with a fuel tank quantity that did not guarantee continuous operation of the engine at the flight attitudes experienced during the powerline stringing operation.

As a result of the accident, the operator revised its fuel management procedures for powerline stringing operations.

In the same 20-year period Aeropower was involved in the following five accidents that were investigated by the ATSB (this includes AO-2008-025, previously mentioned):

• 200505332: Loss of tail rotor authority – 9 km north of Warwick Queensland, VH-SUV
• AO-2008-025: (Summarised above) Fuel-related event 16 km south-east of Townsville Airport, Queensland 9 April 2008
• AO-2008-078: Wirestrike - McDonnell Douglas 369D, VH-PLJ, 13 km north of Murray Bridge, South Australia, 19 November 2008
• AO-2012-082: Collision with terrain - Schweizer 269C-1 helicopter, VH-LTO, Redcliffe Aerodrome, Queensland, 18 June12
• AO-2016-078: Fuel exhaustion and collision with terrain involving McDonnell Douglas Corporation 369, VH-PLY, 36 km north‑west of Hawker, South Australia, on 17 July 2016

Of note, the wirestrike fatal accident in 2008 (AO-2008-078) involved a pilot that was recently instructed in a new task (platform work – joint-testing). The accident occurred the day after training had completed on the pilot’s first unsupervised joint-testing job. Although experienced, with 3,744.2 total flight hours, at the time of the accident the pilot had a total of about 27 hours on platform work.

The report stated:

Had the chief pilot been able to supervise the task on the day of the occurrence as planned, it was possible that he may have detected one or more of the earlier mid-span transpositions and alerted the crew to the hazard. That would probably have forewarned the crew to anticipate other mid-span transpositions along the line, and increased the likelihood that they would detect the transposition between towers STR0031 and STR0032.

One of the safety factors identified by the investigation was;

There was no direct supervision of the joint-testing operations [Minor Safety issue].

_______

5. Air Maestro is a cloud-based Pilot Management Software which includes an electronic pilot’s logbook.
6. Since the helicopter was manufactured, the type certificate of the helicopter was changed from Eurocopter to Airbus Helicopters.
7. A free-turbine turboshaft is a form of turboshaft or turboprop gas turbine engine where the power is extracted from the exhaust stream of a gas turbine by an independent turbine, downstream of the gas turbine and is not connected to the gas turbine.
8. Bureau of Meteorology.">Following requests from the aviation industry, the Bureau of Meteorology changed the format of Area Forecasts (ARFORs) from text based to graphical on 9 November 2017. The new format is known as a Graphical Area Forecast (GAF). More information regarding GAFs is available from the Bureau of Meteorology.
9. A METAR is a routine report of meteorological conditions at an aerodrome.
10. QNH: the altimeter barometric pressure subscale setting used to indicate the height above mean seal level.
11. Ceiling and visibility okay (CAVOK): visibility, cloud and present weather are better than prescribed conditions. For an aerodrome weather report, those conditions are visibility 10 km or more, no significant cloud below 5,000 ft, no cumulonimbus cloud and no other significant weather.
12. Bearing of celestial body measured clockwise from true north.

Safety analysis

Introduction

While stringing powerlines to the Carrapateena mine about 60km east of Woomera Airfield, South Australia, Airbus Helicopters AS350B3e Écureuil (Squirrel) registered VH-SZS, pulled draw wire towards pole 164. Witnesses observed the aircraft traverse slowly up the gradient of rising terrain towards the pole in a near backwards attitude toward the morning sun and in the presence of substantial dust. As the aircraft approached the pole it was observed to continue to fly in a controlled manner until it collided with the pole and fell to the ground.

Site and wreckage examination did not identify any aircraft defects or anomalies that might have contributed to the accident. The recorded engine data also showed no anomalies with the engine prior the impact with the pole. Additionally, no evidence was found to suggest any medical, fatigue related or physiological issues that would have affected the pilot’s performance on the day of the flight. Therefore, this analysis will focus on the operational and environmental factors that led to an experienced helicopter pilot inadvertently colliding with a known obstacle.

Development of the accident

Altered methodology

The pilot received 7.2 hours of training in helicopter powerline stringing in the 3 days of the first tour between 5 February and 7 February 2019. By the third tour (March 10-11) video and photographs taken of the stringing operations showed that the pilot had altered the methodology from that which was taught. Witnesses on the day of the accident also described the same modified method being used. The new method placed the helicopter at a lower operating height above the ground, in a tail-rear attitude, while tracking out to one side before climbing around the pole.

It is not known when exactly the pilot began altering the stringing method, only that it was in use during the third tour and on the accident day. It is therefore likely that the pilot had successfully strung dozens of poles using the new method before the accident, possibly re-enforcing the validity of the method to the pilot.

Span length

By 20 March, the pilot had strung 122 poles (almost all of which were strung 3 times). The length of these spans varied from 156 m to 351 m. The vast majority (85 per cent) of the spans were between 200‑300 m in length, with the average being about 250 m. The accident span was
174 m, one of the shortest of the 122 the pilot had done. Only 4 spans were shorter, and they were all strung on March 10, 10 days prior to the accident. Additionally, the span immediately prior to the accident was 253 m. The accident span was nearly 80 m shorter than the average span, and 79 m shorter than the penultimate span. Based on the pilot’s previous experience, it is possible the pilot’s expectation was that pole 164 was still some distance away at the time on the collision. Compounding this risk was the gradient of the accident span. With an elevation gain of 12.86 m, the span between poles 163 and 164 had the greatest gradient of any the pilot had flown at Carrapateena.

Visibility of pole 164

A feature of the taught stringing method was that both the recently strung pole and the next target pole are both visible at all times. Maintaining a straight-line path between the poles with the aircraft at 90° (sideways) to the relative track ensures visibility of both poles is maintained. The method also places the aircraft at an altitude higher than the target pole, therefore safeguarding against collision. The pilot’s altered methodology placed the helicopter both at lower altitude and in a pronounced tail-rear attitude.

The low altitude exacerbated the amount of dust in the air around the helicopter. Witnesses described a plume of dust higher than the nearby poles. Although the perspective of observers on the ground may not accurately represent that of the pilot, it is clear from observations and photographs taken on the day (Figure 4), that there was significant dust in the vicinity of the helicopter as it approached pole 164.

Analysis of the sun position and observations made on site indicated that the sun would have been in the general direction of the pilot’s vision of pole 164. Although the pilot was wearing a helmet mounted visor at the time of the accident, sun glare, particularly in combination with dust, may have reduced visibility of the pole.

Additionally, several witnesses, as well as photographs, show that the helicopter was being flown in a near backwards attitude as it traversed towards pole 164. Although it is difficult to determine the exact proportional effect of each element in isolation, it is likely that in combination, the near backwards attitude of the aircraft, significant dust and the position of the sun would have led to a reduction of the pilot’s visibility of pole 164 and the ground. In the absence of visual cues of the pole it is likely that the pilot’s situational awareness of pole 164 was degraded leading to the pilot inadvertently colliding with it.

Supervision

The operator did not have any documented requirements for supervision after the pilot was signed-off for powerline stringing, nor were they required to by regulations. Despite this, after the chief pilot left Carrapateena on 7 February 2019, they were in contact with the deputy chief pilot by telephone several times to check-in and see how the job, and the pilot, were going. Unfortunately, this indirect supervision relied either on the pilot being aware there was a problem with their methodology, or the pilot disclosing that they had intentionally altered the methodology.

The investigation could not determine why the pilot modified the stringing methodology. It is possible it was a result of an unperceived degradation of a newly taught skill, or the intentional modification of the technique. In either case, it is highly likely that ongoing supervision by an experienced powerline stringing operator would have identified the modified methodology and the associated risks.

Findings

From the evidence available, the following findings are made with respect to the Collision with terrain involving Airbus Helicopters AS350B3e, VH-SZS 60 km east of Woomera Airfield, South Australia, on 20 March 2019.

Contributing factors

• The pilot was using a stringing technique that was different to that instructed by the chief pilot. The modified method resulted in the aircraft operating at a lower height above the ground, which led to the pilot colliding with pole 164.
• Due to a combination of the attitude of the aircraft, dust and the position of the sun, it is likely that the pilot lost situational awareness of pole 164, leading to the collision with it.

Other factors that increased risk

• There were no requirements in Aeropower procedures to provide any post-training supervision for powerline operations. What supervision was provided was ineffective in identifying that a modified stringing method was being used by the pilot. [Safety issue]

Safety issues and actions

Safety issue: Aeropower post-training supervision

Safety issue number: AO-2019-015-SI-01

Safety issue description: There were no requirements in Aeropower procedures to provide any post-training supervision for powerline operations. What supervision was provided was ineffective in identifying that a modified stringing method was being used by the pilot.

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Aeropower Pty. Ltd.
• OZ Minerals
• ElectraNet
• Civil Aviation Safety Authority
• South Australian Police Service
• Bureau of Meteorology.
• Airservices Australia
• accident witnesses
• video footage and photographs of the accident flight and other photographs and videos taken on the day of the accident and prior to the accident.
• recorded data from the Engine Data Recorder unit on the aircraft.

References

Aeropower work instruction AP-WI 2653 – Cable Stringing – AS350 – Mack Pull

Aeropower operations manual AP-OM 0610 – Powerline stringing (Electrical pylon cable laying)

ATSB investigation report (200300011)

Civil Aviation Safety Authority (CASA) airworthiness bulletin AWB 25-006

ATSB research publication AR-2012-035

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• Civil Aviation Safety Authority
• Aeropower Pty. Ltd.
• The chief pilot
• OZ Minerals
• Ventia
• Powerlines Plus
• ElectraNet
• BEA

Submissions were received from the Civil Aviation Safety Authority, Aeropower, the chief pilot and OZ Minerals. The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2021 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

On 23 October 2018 a Cessna U206G registered YJ-AL5, was being operated on a charter flight from Tanna Island to Port Vila, Vanuatu, with one pilot and four passengers onboard. While abeam Erromango Island, in cruise at 6,500 ft, the engine failed.

Following unsuccessful attempts to restart the engine, the pilot diverted to Dillon's Bay Airport, on Erromango Island, where the aircraft landed short into trees. The Civil Aviation Authority Vanuatu (CAAV) is conducting an investigation into this occurrence.

As part of its investigation, the CAAV requested technical assistance from the ATSB. The ATSB was asked to oversee the engine examination from the accident aircraft.

To facilitate this request, the ATSB initiated an external investigation under the provisions of the Transport Safety Investigation Act 2003. That work is now complete.

The CAAV is responsible for and will administer the release of the final investigation report into this accident.

Safety summary

What happened

On 13 March 2019, a Robinson R44 helicopter, registered VH-ZWK and operated by Helifarm, was conducting aerial spraying operations at Bool Lagoon, around 20 km south of Naracoorte, South Australia.

While spraying along a drainage channel, the helicopter pilot momentarily forgot about the location of a powerline spanning the channel, as he manoeuvred the helicopter over a bridge. The helicopter collided with the powerline, then crashed into the ground. The helicopter was destroyed, and the pilot sustained minor injuries.

What the ATSB found

The helicopter pilot momentarily lost awareness of the powerline as he manoeuvred over the bridge. Nearby vegetation, which reduced the pilot’s ability to see the power poles and visually identify the powerline, probably reduced the pilot’s ability to maintain this awareness. The operator had a number of policies and procedures to support pilots’ powerline awareness, and it may not be possible to completely mitigate the risk of wirestrike during repeated low-level flying near powerlines.

As a result of this momentary loss of awareness, the helicopter collided with the powerline, which led to a collision with terrain. The bladder-type fuel tank installed in the accident helicopter, as compared to an all-aluminium fuel tank, probably reduced the risk of a post-accident fire.

What's been done as a result

The operator has implemented new policies and procedures to increase pilots’ awareness of powerlines during spraying operations, particularly spraying of drains. These include improved maps and other planning documents for drain spraying operations involving flying near powerlines, and increased training of helicopter pilots engaged in these operations.

Safety message

This accident provides another reminder of the dangers posed by powerlines during low-level spraying operations.

The ATSB has released, in association with the Aerial Application Association of Australia (AAAA), an educational booklet, Wirestrikes involving known wires: A manageable aerial agriculture hazard (AR-2011-028). This booklet contains numerous wirestrike accidents and lessons learned from them. The AAAA has now launched its Powerline Safety Program that aims to encourage and facilitate power companies to improve aviation safety. The program includes marking of powerlines by powerline network operators (with a marker in accordance with Australian Standard AS 3891-2) wherever it is requested by a pilot, aviation company or landholder.

As this accident highlights, there may be limits to the extent to which operators can mitigate the risk of wirestrike during repeated low-level operations near powerlines. Helicopter wirestrike protection (WSPS) can provide a last line of defence in the event of a wirestrike. Some aircraft selected for aerial agriculture operations can be configured to include WSPS. However, this technology is not currently available on smaller helicopters such as the R44.

Pilots and operators involved in low-level spraying are also reminded that flight helmets can reduce the risk of serious injury in the event of an accident.

The occurrence

What happened

On 13 March 2019, a Robinson R44 helicopter, registered VH-ZWK and operated by Helifarm, was conducting aerial spraying operations at Bool Lagoon, around 20 km south of Naracoorte, South Australia. The operations involved spraying weeds in Bool Lagoon, then in the drain at the western edge of the lagoon. The pilot was the sole occupant of the helicopter.

At the start of the day, the pilot met with a representative of the client organisation, the operations manager of Helifarm, and the Helifarm ground crew who would be in charge of loading the helicopter with spray. Discussions included reviewing the planned spraying job, maps of the area, and a job safety analysis for the spraying work. The risk of colliding with powerlines was noted during the meeting.

Spraying operations involved loading the helicopter with spraying chemicals from a loader vehicle. The pilot would then conduct spray flights before returning and reloading.

After spraying the lagoon in the morning, the loader was relocated in preparation for the remaining work around the drain. The pilot flew towards the new loading point and, prior to landing, conducted a brief reconnaissance flight around the drain. During this flight, the pilot sighted several hazards, including a weir bridge and a single-wire powerline spanning the drain.

After landing at the new loading site, the pilot rested for around 15 minutes before resuming operations at around 1400 Central Daylight-saving Time (CDT). The pilot then conducted another reconnaissance flight and sprayed two loads of chemicals in the drain area. The pilot passed under the powerline on three occasions during the two spray flights.

The pilot commenced another spray flight at around 1430. The pilot started the spray run from a public road at the eastern end of the drain section, flying west towards the weir bridge and the powerline (Figure 1). The pilot recalled that, as he commenced this run, he reminded himself of the presence of the powerline further along the drain. The pilot turned on the spray nozzles, then looked at the nozzles and spray pressure gauge to confirm the spraying equipment was functioning as expected.

As ZWK flew along the drain, the pilot engaged in a visual scan both inside and outside of the helicopter. This included looking outside at where the helicopter was going, monitoring the track of the helicopter using a satellite track display, and monitoring the spraying equipment. This scan reflected the pilot’s normal practice and he had no particular concerns about the performance of the aircraft or the equipment.

When ZWK was around 50-100 m before the weir bridge, the pilot looked at the spray nozzles, as part of his scanning sequence. When the pilot looked up and outside the helicopter, he noticed that ZWK was slightly lower than intended, in terms of achieving adequate clearance over the bridge.

The pilot manoeuvred the helicopter in order to pass over the weir bridge. The control inputs caused the helicopter to ‘balloon’ over the bridge. The pilot reported that this manoeuvre meant the helicopter was higher than it would otherwise have been as it passed over the weir bridge. The pilot then applied control inputs to move the helicopter back down to the desired altitude. The pilot characterised these control inputs as ‘smooth’, noting that it was his preference and normal practice to not manoeuvre the aircraft aggressively unless necessary.

The pilot reported that it was his plan was to fly over the weir bridge and under the powerline. However, as he adjusted the flight path of ZWK over the bridge, he momentarily forgot about the powerline. The pilot noted that if he had been aware of the powerline at that moment, he would have descended more aggressively.

Figure 1: Accident location

The image shows the track of ZWK, the location of weir bridge, and the location of power infrastructure. 
Source: Google Earth, modified by ATSB

Shortly after passing the weir bridge, ZWK struck the powerline. The helicopter’s ground speed was around 60 kt at the time of impact.

The initial impact occurred around the centre of the front windscreen, just above the helicopter’s headlights. The powerline wire then cut into the helicopter, slowing its forward movement. The wire cut up into the helicopter cabin and the control instruments.

The pilot reported that that he retained some control of the aircraft following the impact, and was able to partially cushion the landing. However, the helicopter landed hard on the bank of the drain. The pilot exited the helicopter with minor injuries. There was no fire, but the helicopter was destroyed (Figure 2).

Figure 2: Helicopter wreckage

The image shows the helicopter wreckage, drainage channel and weir bridge. 
Source: SA police, modified by ATSB

Context

Pilot information

The pilot of ZWK was experienced in agricultural spraying operations at low levels, including using the R44. In the 90 days prior to the accident, the pilot had conducted around 150 hours flying, including 36 hours in an R44.

The pilot had conducted spraying operations in the area previously, including the drain where the accident occurred. The most recent time was around a year before the accident.

The pilot had all required approvals for conducting agricultural spraying operations. The pilot had conducted SpraySafe training, and had current accreditation issued by the Aerial Application Association of Australia.

The pilot did not wear a helmet during flying operations that day. The pilot reported he would typically wear a helmet. However, he was wearing a standalone headset due to problems with the headset in his helmet.

Powerline information

The powerline struck by ZWK was a single-wire earth return (SWER) line, which consisted of a single line of intertwined narrow-gauge steel wires. The powerline spanned 244 m, and the approximate point of contact was 60 m from the nearest power pole. At the approximate point of contact, the powerline was about 8.9 m high, above the edge of the drain bank. There were no markers or other devices installed on the powerline to enhance its visibility, nor was there any requirement to install such devices.

Location information

The drainage channel was about 30 m wide, with a further 10-15 m clear bank on each side before a tree-lined boundary. This tree-lined boundary obscured visibility of the power poles from within the drainage channel (Figure 3). It is likely that this reduced the ability of the pilot to use the power poles as visual cues for the position of the powerline.

The weather the time of the accident was clear, a temperature of about 20 °C, and a light breeze from the north-west. The pilot described the conditions as fine and said that wind had no effect on the handling of the helicopter.

Figure 3: Powerline and drain boundary

Shows powerline in profile view, and vegetation obscuring power pole beyond edge of the drain. 
Source: SA Power Networks. Annotated by ATSB

Helicopter information

The Robinson R44 helicopter is a single-engine, four-seat light helicopter produced by Robinson Helicopter Company.

For this accident, there was no evidence to suggest any defects or anomalies were contributory to the wirestrike.

Helicopter operators who routinely engage in low-level operations can have wirestrike protection systems (WSPS) installed on the helicopter. Helicopter WSPS commonly include cutting blades, which can provide a recovery defence when helicopters come into contact with wires. There was no WSPS installed on ZWK and no commonly available system available for the R44. The nature of these systems is such that their fitment on the outside of an aircraft is not typically possible for smaller helicopters, such as the R44.

R44 helicopters with all-aluminium fuel tanks are susceptible to post-accident fuel leaks increasing the risk of a potentially fatal post-impact fire following a collision with terrain. In 2012, the manufacturer issued a service bulletin requiring R44 helicopters with all-aluminium fuel tanks be retrofitted with bladder-type tanks as soon as practical. The ATSB issued a Safety Advisory Notice on 9 March 2012, advising of the potential dangers of the all-aluminium fuel tank. This followed from ATSB Safety Investigation Loss of control involving Robinson R44 helicopter (AO-2012-021).

ZWK had been fitted with a bladder-type fuel tank.

Helifarm risk management procedures

Helifarm utilised several procedures and other defences in order to manage the risks associated with low-level aerial application flying, particularly risks related to wirestrike. These included a requirement for:

• Pilots engaged in aerial application to have current ‘SpraySafe’ accreditation with the Aerial Application Association of Australia, as well as other licences, ratings and endorsements.
• Pilots to study maps and note the location of wires and other hazards.
• Pilots to conduct reconnaissance flights prior to commencement of operations and prior to any clean up runs.

Helifarm and the pilot associated with this accident had complied with these procedures.

Related occurrences

The ATSB has reviewed trends in wirestrike accidents in several research reports, including Under Reporting of Aviation Wirestrikes (AR-2011-004) and Wire-strike Accidents in General Aviation: Data Analysis 1994 to 2004 (B2005/0055). This research has shown that many wirestrike accidents involve aerial agriculture operations.

The ATSB has also released, in association with the Aerial Agriculture Association of Australia, an educational booklet, Wirestrikes involving known wires: A manageable aerial agriculture hazard (AR-2011-028). This booklet contains numerous wirestrike accidents and lessons learned from them.

Reduced visibility of powerlines due to nearby vegetation has been noted in other wirestrike accident investigations. An investigation of an accident involving a Bell 206B JetRanger found that power poles were obscured by nearby trees, reducing the ability of the pilot to identify the powerline.^[1] Similarly, an investigation of a wirestrike accident involving an Eagle DW1 found that a line of trees obscured vision of power poles.^[2]

__________

1. ATSB Safety Investigation Report AO-2016-027 Collision with terrain involving Bell 206B helicopter VH-WHU near Carmila, Qld. on 25 March 2016
2. ATSB Safety Investigation Report AO-2015-087 Wirestrike involving an Eagle DW1, VH-FHP, 77 km SE of Townsville, QLD on 27 July 2015

Safety analysis

Loss of awareness of powerlines

While the pilot knew about the location of the powerline spanning the drainage channel and had flown under it earlier that day, while manoeuvring over a bridge, he momentarily forgot and lost awareness of the powerline. As a result of this momentary loss of awareness, the pilot unintentionally flew the helicopter into the powerline, resulting in ZWK colliding with terrain.

Immediately before the wirestrike, the pilot’s attention was diverted towards flying and other equipment for the spraying activity. This was normal and required.

Native vegetation near the power poles obscured additional visual cues for the presence of the powerline. The powerline was narrow-gauge and had no markings. Due to the limits of the human eye, powerlines can be very difficult to see, particularly in low level flight.^[3]

Humans have a limited capacity for working memory. Situational requirements to attend and respond to immediate and/or unexpected demands can mean that awareness and memory of other hazards can be lost. Other ATSB published wirestrike occurrence briefs and investigation reports have shown how awareness of powerlines can slip when pilots respond to demands such as unexpected obstacles^[4] and checking a GPS display.^[5]

Flying at low altitudes, particularly around powerlines, means that pilots must contend with many demands on their attention. The nature of low-level operations also means that there are very low margins for recovery from even momentary losses of awareness.

For this accident, once the pilot lost awareness of the powerline as he manoeuvred the helicopter over a bridge, it was difficult for him to regain awareness visually, as there were limited prompts for the position of the powerline.

Defences against wirestrike accidents

The operator’s defences against wirestrike sought to reduce the likelihood of aircraft colliding with powerlines by supporting pilots’ awareness of powerlines. The nature of spraying around powerlines is such that demands on attention are high and the ability to recover from any lapse in awareness is relatively low. It may not be possible to completely mitigate the risk of collision in this context. However, there may be some control measures that might reduce the potential consequence.

WSPS can provide an effective last-line of defence in the event of a wirestrike accident,^[6] reducing the likelihood of a subsequent crash. However, these systems cannot typically be fitted to smaller helicopters, such as the R44. Helmets provide another valuable defence in the event of a crash, reducing the risk of more serious injury.^[7] The ATSB noted in this accident, that the pilot was not wearing a helmet.

R44 Bladder Tank

Although the helicopter in this accident collided with terrain and was destroyed, there was no post impact fire. The helicopter had been fitted with a bladder-type fuel tank, and there was no indication of a fuel leak. The bladder-type fuel tank probably reduced the likelihood of a fuel leak and post-impact fire following the collision.

__________

3. For analysis of the difficulty detecting powerlines in flight, see ATSB Safety Investigation Report AO-2014-068 Wirestrike involving Maule M-5, VH-HOG, 50 km WSW of Casino, NSW on 12 April 2014
4. ATSB Occurrence Brief AB-2018-041 Wirestrike involving Robinson R44, Whitton, NSW, on 24 March 2018
5. ATSB Safety Investigation Report AO-2015-087 Wirestrike involving an Eagle DW1, VH-FHP, 77 km SE of Townsville, QLD on 27 July 2015
6. For an example of the effectiveness of WSPS, see ATSB Occurrence Brief AB-2018-039 Wirestrike involving Bell Helicopter 206L, Pappinbarra, NSW, on 19 March 2018
7. For an example of the effectiveness of flight helmets, see ATSB Safety Investigation Report AO-2017-115 Collision with terrain involving PZL Warszawa-Okecie M-18A Dromader aircraft, VH-WHR, near Emerald Airport, Queensland, on 1 December 2017

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The helicopter pilot momentarily lost awareness of the position of an overhead powerline as he adjusted the track to navigate over a bridge during low-level aerial agriculture flying. It is likely that nearby vegetation contributed to the pilot’s reduced awareness of the powerline.
• The helicopter collided with the overhead powerline, which led to a collision with terrain.
• The installation of a bladder-type fuel tank in the R44 helicopter reduced the risk of a post-impact fire.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety actions in response to this occurrence.

Safety action by Helifarm

Helifarm advised that as a result of this accident, they have implemented the following actions in order to reduce safety risk:

• Discussing the accident in team meetings, in order to increase focus on key hazards and risks.
• Providing pilots conducting future spraying operations at the Bool Lagoon with georeferenced maps of the area.
• Introducing additional company documentation for drain spraying to further document site-specific hazards prior to the start of each job.
• Making human factors training mandatory for pilots conducting aerial application. This training intends to increase pilot awareness in the wire and low-level environment.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2019 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Overview of the investigation

At 0504 Eastern Daylight-Saving Time on Friday 1 March 2019, Pacific National (PN) grain train 5KC3 passed signal 04 26 at stop at Wagga Wagga while on a journey from Ararat, Victoria to Cootamundra, New South Wales. The train continued its journey north, passed another two signals at stop and through a set of points in Wagga Wagga yard. The train was stopped after the Australian Rail Track Corporation (ARTC) Network Controller contacted the train crew by radio and informed them of the signals passed at danger events. The train crew consisted of two persons, driver 1 and driver 2.

Train 4BM9 had departed Bomen and was heading towards Wagga Wagga to cross train 5KC3 when train 5KC3 passed the signals at stop. Train 5KC3 passed the up direction starting signal for the Wagga Wagga to Bomen section and was heading into a potential collision with train 4BM9. The two trains were around 2.5 km apart by the time they were both brought to a stand.

The investigation found that the crew of train 5KC3 did not react to the signal indications within Wagga Wagga yard limits that were set, at first to restrictive indications, and then stop indications. These signals were set to cross train 4BM9 at Wagga Wagga. The reason for the crew of train 5KC3 not responding to the signal indications could not be conclusively determined.

The data logger of the leading locomotive of train 5KC3 indicated the driver was successfully responding to the demands of the vigilance control system.

There was no evidence either of the crew of 5KC3 were affected by any medical or other health episode. Neither of the crew members can recall their journey beyond the southern entrance to Wagga Wagga yard limits until the notification of the signal passed at danger (SPAD) events by the ARTC Network Controller. Both crew members commenced their shifts at about 2000 the previous evening and their recent shifts were not regarded as being outside the normal rostering parameters for the operator.

The reasons for the train crew not responding to the signals may have been determined if the driver’s cab was fitted with an inward-facing camera recording the actions of the train crew. The video may have shown what the train crew were doing leading up to the SPAD. The presence of a camera would not have prevented the SPAD but may have assisted in the post-incident analysis. An audio recording, synchronised with the camera, may have also provided additional information about the train crew’s actions, and possible alarms or sounds inside the cab. Having audio and video recording allows investigators to eliminate potential contributory factors early in the investigation.

The Office of National Rail Safety Regulator (ONRSR) has consulted with key stakeholders regarding a requirement for Australian rail operators to install in-cab audio and video recorders in driver’s compartments. The finalisation of this process would be beneficial to the understanding of in-cab interactions of train crew and may lead to the development of new or improved risk mitigation measures.

Another ATSB investigation, involving a collision between freight trains 7MP5 and 2K66, at Jumperkine, Western Australia, on 24 December 2019, is currently examining vigilance control activation issues. In that investigation, the driver of 7MP5, operated by Pacific National, continued towards Jumperkine, without appearing to undertake any driver control changes that would have reset the vigilance time count. This investigation is expected to be completed in Quarter 4 2021.

The issue of drivers’ being unresponsive to signals while continuing to acknowledge vigilance alerts has been identified in previous rail investigations including Beresfield^[1] and Hurlstone Park.^[2] It may be beneficial if the effectiveness of vigilance control systems is explored as part of a separate safety study, and this is currently being considered by the ATSB.

Reasons for the discontinuation

The contributing factors to this SPAD highlight the need for a positive train control system to provide additional control in the prevention of SPAD events and their subsequent consequences.

In response to the investigation, ARTC has advised their Advanced Train Management System (ATMS) is a project underway that will provide additional protection from the risk of SPAD. The ATMS can detect and intervene when a train is not being managed in accordance with speed and proceed authority instructions.

According to the ARTC, the ATMS provides the following features:

• increased rail capacity, by allowing operations with smaller inter-train distances
• increased safety, through limit of authority and speed limit enforcement and protection for trackside workers
• improved reliability, through better on-time performance
• improved efficiency and flexibility in network use
• reduced operation and maintenance cost for trackside infrastructure
• a modern platform capable of extension to meet future demand.

Based on this information, it was considered unlikely that further investigation would identify any systemic safety issues or additional opportunity for the enhancement of transport safety beyond the introduction of a positive train control system. Consequently, the investigation is discontinued.

__________

1. New South Wales Department of Transport. Independent Inquiry Report, Coal Train Collision, Beresfield, NSW, 23 October 1997.
2. ATSB Rail Investigation (RO-2013-003) Multiple SPAD by freight train 9837, at Hurlstone Park, New South Wales, on 30 January 2013.

Safety summary

What happened

On 16 March 2019, two passengers were seriously injured when the basket of a Kavanagh B‑400 hot‑air balloon tipped over during vehicle-assisted deflation.

Prior to the accident, the balloon, operated as a scenic charter flight, landed without incident at a private property near Coldstream, Victoria.

Due to a lack of wind and the large size of the envelope, the crew elected to use the retrieval vehicle to assist by pulling the envelope over (by the crown line) during the deflation.

During this process, with 16 passengers and the pilot on board, the vehicle assisting inadvertently pulled the basket over, seriously injuring two passengers.

What the ATSB found

The ATSB found that the operator had not conducted a risk assessment around the use of a vehicle to assist in the deflation process. Although not required by regulations, the lack of a risk assessment likely left the operator and crew unaware of the risks associated with the vehicle-assisted deflation, and without appropriate procedures to control those risks. Consequently, a communication breakdown between the pilot and vehicle driver led to the basket tipping, and the passengers were unprepared and not in landing positions during the deflation process - increasing their likelihood of injury.

The ATSB also found that the Civil Aviation Safety Authority had not provided guidance to commercial balloon operators concerning the risks associated with vehicle‑assisted deflation. This likely contributed to the limited awareness commercial operators had of the risks associated with vehicle‑assisted deflation. Further, with substantial growth in the number of large, Australian-registered balloons requiring vehicle-assisted deflation, this is an ongoing safety risk.

What's been done as a result

The operator has updated their procedures to reduce the probability of a communication breakdown during the deflation process and is requiring the pilot to instruct passengers to assume landing positions during any vehicle-assisted deflations.

CASA has indicated they will publish an advisory circular, which will include guidance on deflation of hot air balloon envelopes using a vehicle to assist.

The ATSB has released a safety advisory notice (AO-2019-014-SAN-014) to all commercial balloon operators about the risks associated with vehicle‑assisted deflation, as identified in this report.

Safety message

This investigation highlights that gradual changes to operational procedures, while possibly perceived as inconsequential, have the potential to conceal new or emerging safety risks. A thorough assessment of any introduced changes should identify these new risks and allow their mitigation or reduction to an acceptable level.

This investigation also highlights that an increase in the number of aircraft and occupants (passengers and crew) exposed to a hazard has a compounding effect that, in a relatively brief period, can increase the overall risk significantly.

The occurrence

What happened

On 16 March 2019, at about 0700 Eastern Daylight‑saving Time,^[1] a Kavanagh B‑400 hot‑air balloon, registration VH‑LNB and operated as a scenic charter flight by Picture This Ballooning, was being prepared for departure from a private property near Dixons Creek, Victoria.

The balloon operating crew conducted passenger safety briefings:

• at the meeting point (including equipment that can be carried on board and what to expect during the flight)^[2]
• on the bus during the transit from the meeting point to the launch site (including conditions at the launch site and the inflation procedure), and
• at the launch site prior to the passengers entering the basket.

Prior to take‑off, with the passengers positioned in the basket, the pilot also conducted a safety briefing which included the risks associated with a layover landing in windy conditions, and having all the passengers demonstrate they could correctly assume the landing position.^[3] The two ground crew assisted the pilot by checking the passengers had understood the briefing and could physically adopt the landing position.

At around 0720, after the pilot and ground crew conducted pre‑flight and radio checks, the balloon lifted off with 16 passengers and the pilot on board.

During the flight, the ground crew were in communication with the pilot by radio to coordinate arrival at the planned landing site. At the landing site, prior to the arrival of the balloon, the ground crew launched a pibal^[4] and observed that there was nil wind below 300 ft above ground level. This information was communicated to the pilot.

About 10 minutes prior to landing, the pilot conducted another passenger briefing concerning safety during landing. This included the requirement for the passengers to assume the landing position.

The balloon landed without incident at a private property near Coldstream, Victoria at about 0820, with the passengers all satisfactorily adopting the landing position.

Following the landing, the pilot began to shut down the burner system and waited for the two-ground crew to prepare to deflate the envelope. Due to a lack of wind and the large size of the envelope, the crew elected to use the retrieval vehicle to assist by pulling the envelope over (by the crown line) during the deflation. Then, by radio, the pilot instructed the driver in the vehicle to drive forward. The vehicle started to slowly move forward, at less than walking pace, pulling the envelope. The driver’s vision of the balloon’s basket was obstructed by the collapsing envelope. During this process, the second ground crew member (located next to the basket) and the driver could not see each other.

The pilot then put down the handheld radio to operate the vent line, which required both hands. The envelope began to deflate faster than anticipated and the fabric started to collapse directly on top of the basket and burners. The second ground crew member assisted by lifting the fabric away from the burners and passengers. The pilot picked up the radio and instructed the driver to ‘drive a little bit faster’. The pilot then put the radio back down on the top of one of the fuel tanks and proceeded to operate the vent line and talk with the passengers. The driver proceeded for another 5 to 6 m then started to slow down.

Shortly after, at around 0830 (10 minutes after landing), the basket began to tip (Figure 1). The pilot instructed the passengers to ‘hang on as best they could’ and did not have the opportunity to use the radio to command the driver to stop.

The second ground crew member jumped out of the way of the tipping basket. The pilot’s radio landed at second ground crew member’s feet. The second ground crew member then communicated with the driver to stop and quickly get back to assist.

The driver, unaware of what was happening with the basket, heard unintelligible sounds from the radio and decided to stop the vehicle.

Two of the 16 passengers were seriously injured^[5] when they were propelled out of the basket as it tipped over. One of the passengers sustained two broken ribs and another was knocked unconscious for around 10 minutes.

The pilot and second ground crew member, who had both received first aid training about 8 weeks prior, began administering first aid to the injured passengers and called an ambulance. The driver, also trained in first aid, took control of the injured passengers and continued to administer treatment. Around 15 minutes after the basket tipped, an ambulance arrived, and the injured passengers were taken to Maroondah hospital. Both were discharged later that day.

Figure 1: VH-LNB basket final resting position

Source: Victoria Police. Annotated by ATSB

__________

1. Eastern Daylightsaving Time (EDT): Coordinated Universal Time (UTC) + 11 hours.
2. RACV club in Healesville, Victoria
3. The landing position is designed to reduce the likelihood of injury from a layover or hard landing. Occupants face away from the balloon’s landing direction, holding onto rope holds with their feet flat and knees together but slightly bent.
4. An abbreviation of ‘pilot balloon’, which is a small, helium-filled free balloon with a light that is realised and visually tracked to determine the wind at different altitudes.
5. A serious injury is an injury that requires, or would usually require, admission to hospital within 7 days after the day when the injury is suffered. Transport Safety Investigation Regulations 2003 Part 1.

Context

Balloon deflation

All hot air balloons have a load ring known as a crown ring at the top of the envelope. Attached to the crown ring is a crown line, which is long enough to reach to the balloon’s basket. During envelope deflation, a vent at the top of the balloon is opened progressively to release hot air. To prevent the envelope collapsing on top of the basket in light wind conditions, a force is applied to the crown line to pull the envelope down and away from the basket.

For smaller balloons (generally less than 350,000 ft³), one or two persons can provide enough force by pulling on the crown line and walking away from the basket. For large balloons, the crown line can be attached to the rear of a vehicle that then drives slowly away from the basket pulling the envelope as it deflates.

Crew experience

The pilot obtained a private balloon pilot certificate in 1997 and commercial balloon pilot licence in 2000. At the time of the accident, the pilot had just over 2,000 hours (10 hours in the previous 90 days) as pilot in command.

The ground crew member driving the vehicle during the deflation had around 20 years’ experience as a ground crew member for Picture This Ballooning (PTB). The other ground crew member had been working in this position for the operator for around 4.5 years.

Aircraft information

VH‑LNB was a Kavanagh Balloons B‑400 hot‑air balloon designed and manufactured in Australia with an envelope air capacity of around 400,000 ft³. The balloon was certified to carry up to 22 passengers and the basket had capacity to accommodate 20 passengers within four passenger carrying compartments, and a pilot in the central compartment (Figure 1). Heat was produced by a four‑burner liquefied petroleum gas system.

Meteorological information

The pilot reported reviewing several weather forecasts for the intended flight time, on the night before the flight and again on the morning before the flight. In addition, prior to, and during the flight, the ground crew launched pibals (pilot balloons) to check the prevailing wind speed at different altitudes. This information was communicated to the pilot.

The ATSB obtained weather data from the Bureau of Meteorology for Coldstream Airport (approximately 5 km from the accident site). It included observations recorded at 1‑minute intervals between 0700 and 0900 on 16 March 2019 (at ground level). Across that period, the winds were calm (0 kt) with no gusts.

Organisational information

Picture This Ballooning

Picture This Ballooning (PTB) was a charter balloon operator that had been operating for around 22 years. It had 15 balloons in their fleet, of which 11 were used for passenger charter operations. The operator had two balloons (one Kavanagh B‑350 and a B‑400) with envelope sizes of 350,000 ft³ or more. Sizes below this were less likely to require a vehicle to assist during deflation. PTB began using a vehicle to assist with in the deflation of their two large balloons about 12 months prior to the accident.

Communications procedures

The operator’s Operations manual (OM) contained the following procedure for radio communications:

Communication with retrieve crew will be via UHF radios with mobile phones as back up. Prior to launch the pilot must conduct a UHF radio check with the crew to ensure two-way communication is possible. During flight both parties shall maintain a continuous watch.

The operator’s crew procedures and training manual contained additional information regarding radio failure:

Use of mobile phone as back up

Recognise that the radio is not working if you are not receiving instructions

Pilot has a crew number and vise [sic] versa

Stay near the balloon and do not get too far in front

Try a second radio

It’s not that big a deal so long as you think what the pilot would want you to do.

Although not documented prior to the time of the accident, the process during vehicle‑assisted deflation, as reported by the pilot and the ground crew member driving, was that once the instruction to drive forward was given, the driver would continue until the pilot commanded them to stop.

Following the accident, the pilot identified that putting down the handheld radio and not maintaining communication throughout the entire process was a likely contributor to the accident.

Passenger safety briefings

The operator’s procedures contained in the OM required the pilot in command to conduct passenger briefings:

as to correct inflation procedures

inside basket on landing positions prior to lift off.

The OM also contained the following information regarding briefing of passengers:

Passengers are to be briefed on the ballooning experience in general and safety aspects of ballooning (e.g. the fan, landing positions, exiting the basket, etc). Pilots should make use of the PTB checklists and briefing cards found on board all PTB balloon basket.

Further, the OM contained the following information regarding the positioning of passengers in basket:

A physical demonstration of landing positions by the passengers must be conducted before take-off on each flight.

The pilot and a passenger reported that a safety briefing was conducted, upon arrival at the launch site, primarily regarding the hazards associated with the inflation fans (pre-boarding). Another briefing was conducted in the basket prior to launch (pre-flight) which included passengers demonstrating they could correctly assume landing positions. A final briefing, primarily concerning landing positions, was also conducted by the pilot around 10 minutes prior to landing (pre-landing).

In addition to the safety briefings, the balloon had safety cards on board that also contained safety information including a pictorial representation of the body position when in the landing position (Figure 2).

Figure 2: Picture This Ballooning’s on-board safety briefing cards

Source: Picture This Ballooning

Landing position

The Kavanagh Balloons Flight Manual contained procedures for fast landings, including:

When a high horizontal landing speed is expected, passengers should be made aware that the basket will tip forward and they should take a lower-than-normal landing positions to avoid being thrown out of the basket.

The pilot reported that during the vehicle‑assisted deflation the passengers were not in the landing position.

Crew’s awareness of the risk of tipping during vehicle‑assisted deflation

The pilot reported that at the time of the accident not noticing that there was a problem until the basket began to tip. In addition, while having previously observed baskets tipping due to wind, the pilot had not considered that the deflation vehicle could produce the same outcome. Further, the ground crew member driving the vehicle also reported not expecting anything to go wrong during the deflation process.

Civil Aviation Safety Authority

The Civil Aviation Safety Authority (CASA) is an independent statutory authority with the primary functions of conducting safety regulation of civil air operations in Australia and the operation of Australian aircraft overseas.

Passenger safety briefings

CASA’s Civil Aviation Advisory Publication: Passenger safety information: Guidelines on content and standard of safety information to be provided to passengers by aircraft operators (CAAP 253-02 V2.0), included specific guidance for balloon operators regarding passenger safety briefings during pre‑boarding, pre‑flight, pre‑landing final approach and landing.

The guidance did not contain information regarding passenger safety briefings during the deflation process.

Safety management system

CASA regulations did not require operators of balloon aerial work and charter operations to have a safety management system (SMS).

CASA have proposed Civil Aviation Safety Regulation (CASR) Part 131, which was available as an exposure draft until 30 September 2019, and scheduled to commence on 2 December 2021. Part 131 would have required balloon transport operators (currently charter operations) to have an SMS that is ‘…appropriate for the size, nature and complexity of the operator’s balloon transport operations’. The SMS must include:

…a safety risk management process, including:

(i) Hazard identification processes; and

(ii) Safety risk assessment and mitigation processes

In addition, the proposed Part 131 also contained the requirement for balloon transport operators to have a safety manager with

…sufficient relevant safety management experience to capably lead, manage and set standard to enable the operator to safely implement the operator’s safety management system…

and the responsibility for

…managing the operation of the safety management system including managing corrective, remedial and preventative action in relation to the system…

In a 22 November 2019 update, CASA provided a summary following the consultation period for Part 131:

To provide additional time to consult with industry on the requirements related to safety management systems and training and checking systems, CASA has removed the proposed regulations related to safety management systems (SMS) and training and checking systems for balloon transport operators (including the requirement for the two associated key personnel – the head of training and checking and the safety managers).

Large balloons in Australia

Multiple ground crew and pilots reported to the ATSB that the use of the vehicle‑assisted method is only used for balloons with envelope sizes of 350,000 ft³ or greater (some reported 400,000 ft³ as the minimum size). Balloons with smaller envelope sizes are more likely to be collapsed by hand in low wind conditions.

Figure 3: Number of large VH-registered balloons on 30 June between 2000 and 2019

Source: Civil Aviation Safety Authority

The ATSB conducted an analysis of the trend in the risk associated with vehicle‑assisted deflation. This was based on vehicle-assisted deflation only being used for balloons with a capacity of 350,000 ft³ or greater.

Over the period mid‑2015 to mid‑2019, the number of large balloons registered in Australia increased by around 8-9 more balloons each year (Figure 3).

Given this trend, it is likely that the use of vehicles to assist during deflation will continue to increase over the period 2020–2022. In addition, the average size of these balloons (350,000 ft³ or greater) has also increased and accordingly, the average number of passengers per larger balloon flight has also increased.^[6] It follows then, that, the number of passengers potentially exposed to injury associated with vehicle‑assisted deflation per flight will also probably increase.

Related occurrences

A review of the ATSB occurrence database found the following ground handling occurrences involving the use of a vehicle to assist in the deflation process:

Occurrence 201600589

At 0700 on 22 April 2016, the pilot of a Kavanagh Balloons B‑425 was seriously injured when the basket tipped during a vehicle‑assisted deflation. During the deflation, the pilot dropped the radio resulting in a communication breakdown with the driver of the vehicle. The pilot was then unable to command the driver to stop, resulting in the vehicle driving too far, causing the basket to tip. At the time of the accident, there was probably only one passenger still on board the balloon.

Following that occurrence, the operator involved implemented new procedures intended to reduce the likelihood and consequences of a communication breakdown during vehicle‑assisted deflation. This included the following information:

Communication needs to be very clear not only on the radio but visually as well. This is where the second crew member is vitally important, if for whatever reason radio comms are lost between the PIC [pilot in command] and vehicle this crew member needs to be able to convey information between basket and vehicle. Whilst anyone is pulling over an envelope, please limit radio transmissions in other balloons and retrieve vehicles, multiple people using the same channel will cause cancelling of transmissions, PIC and driver only to use radio during the pull-down procedure with the vehicle driver “reading back” instructions, this ensures the information is correct and understood. If multiple balloons are about to begin collapsing their envelopes using mobile phones is preferred to ensure continuous communication. Discuss hand signals between crew members before commencing procedure and if at any-time communication either visual or verbal is lost STOP and wait until comms are restored.

The new procedure also contained information intended to reduce the consequence of a similar accident:

While collapsing envelope the pilot is to remain inside basket and passengers are to adopt landing positions.

Occurrence 201809492

At 0630 on 31 December 2018, a passenger on board a Kavanagh Balloons B‑400 sustained a minor injury when the basket tipped during a vehicle‑assisted deflation. During the deflation, radio interference resulted in a communication breakdown between the pilot and the driver of the vehicle. The driver was unable to hear the pilot’s command to stop, resulting in the vehicle driving too far, causing the basket to tip. At the time of the occurrence there were 18 passengers on board the balloon.

__________

6. Generally, the larger a balloon’s envelope size the more passengers the balloon can carry. Balloon with envelope sizes of 450,000 ft³ or greater are more likely to carry 20 or more passengers.

Safety analysis

This analysis will discuss how and why the basket tipped over during the vehicle‑assisted deflation and the effect of the passengers not being in the landing position. The risk management of vehicle-assisted deflation will also be analysed from both the balloon operator’s perspective and the commercial balloon industry and regulator more broadly.

Communication breakdown and procedures

During the vehicle-assisted deflation, the driver did not have vision of the basket and the pilot (in the basket) put the hand-held radio down. Subsequently, the pilot was unable to pick up the radio in time to order the driver to stop the vehicle when it became apparent that the basket would tip. In addition, the second ground crew member was not in a position to effectively communicate with the driver during the deflation. The scenario collectively meant that no one could quickly communicate with the driver to prevent the basket tipping.

Picture This Ballooning (PTB) did not have specific procedures for vehicle-assisted deflation or communicating during the process. The general loss of communication (radio failure) procedure was not suitable during vehicle‑assisted deflation because there was no time in which to access an alternative means of communication in the event of a communication breakdown.

The normal communication practice for vehicle-assisted deflation was for the driver to continue until the pilot instructed them to stop. However, the pilot could have a very short time to instruct the driver to stop if they approached the point where the basket tips. This would require continuous radio communication between the pilot and the driver, which was lost when the pilot put down the radio to open the vent. While the communications procedure in the company’s operations manual required pilot and ground crew to ‘maintain a continuous watch’ during flight, it did not stipulate the same during deflation. However, if the pilot needed two hands to open the vent, an alternative means of communicating with the driver was required.

The vehicle-assisted deflation process did not effectively utilise the second ground crew member and that person was not required to be in a position to be able to communicate with the driver by an alternative means such as shouting or signalling.

The pilot and ground crew did not use standard communication phraseology during the vehicle‑assisted deflation. The lack of standard phraseology can increase the likelihood of miscommunication or delayed actions.

Use of passenger landing position

The landing position was designed to reduce the likelihood and severity of injury during layover landings. ATSB analysis concluded that the injury profile of passengers within a basket that tips during a vehicle‑assisted deflation would be similar to when a basket tips during a fast landing.

PTB did not have specific passenger positioning procedures for vehicle-assisted deflation, nor was there a specific passenger briefing for this process. In addition, the pilot was unaware there was a risk of the basket tipping, and accordingly, did not instruct the passengers to assume the landing position during the vehicle‑assisted deflation. As such, most of the passengers were not in the landing position during the deflation and were thus exposed to a greater risk of injury when the basket tipped.

Awareness of tipping risk

The pilot and ground crew was unaware that there was a risk of the basket tipping during the vehicle‑assisted deflation. A greater awareness of the risks associated with vehicle‑assisted deflation would likely have prompted greater vigilance during the process and thus a reduced probability of the basket tipping. Further, the pilot would have been more likely to brief passengers on the risk and instruct on use of the landing position.

Operator’s safety risk management processes

Before the accident, the operator had not conducted a safety risk assessment of deflation techniques, nor were they required to by current regulations or their own management processes and practices. As a result, the operator had not properly considered the risks of vehicle-assisted deflation and so had not considered writing specific safety procedures to ensure it was done safely and the crew was aware of the risks.

Following a similar accident, another operator working under similar conditions developed a new procedure for deflation. This included measures to reduce the likelihood of a communication breakdown^[7] during vehicle‑assisted deflation and having passengers in the landing position during the process. This further indicates that if a risk assessment had been conducted by PTB, it is probable they would have identified communication breakdown and the risk of injury to passengers (if the basket tipped) as key operational risks requiring mitigation.

CASA guidance material

Guidance material produced by CASA did not contain information regarding passenger safety briefings during the deflation process.

Prior to the subject event, there had been two related accidents with similar contributing factors. More generally, the ATSB found limited awareness of any risks associated with vehicle‑assisted deflation in the commercial ballooning industry. It is likely that if guidance material had been issued by CASA on the risks associated with vehicle‑assisted deflation, it would have increased awareness of the associated risks with operators introducing large balloons to their charter operations.

As balloon charter operators are not presently required by regulation to have a safety management system (SMS), there was, and remains, a lower likelihood of these operators conducting risk assessments for changes in operations. Given another operator involved in a similar accident reported that they had not conducted a formal risk assessment of vehicle‑assisted deflation prior to the accident, guidance material from CASA could have drawn attention to the risks for these operators.

With the increase in the numbers of larger balloons registered in Australia, it is expected that the use of the vehicle-assisted deflation practice will similarly increase and will likely be used by a greater number of operators over time. Further, with larger envelope and basket capacities comes an increase in the numbers of passengers exposed to injury risk in the event of a basket tipping during a vehicle-assisted deflation. As such, this guidance will be important for helping educate other operators as they move to larger balloon operations in the future.

__________

7. Driver ‘reading back’ pilot’s instructions; use of mobile phones if radio interference is anticipated; second ground crew member to stand in a position visible to both pilot and the driver; and, if visual of verbal communications is lost, the driver is to stop and wait until communication are restored.

Findings

From the evidence available, the following findings are made with respect to the ground handling event involving a Kavanagh B‑400 balloon, registered VH-LNB, near Coldstream, Victoria on 16 March 2019. Two passengers were seriously injured when, during deflation, the balloon’s basket was inadvertently tipped by the vehicle assisting with deflation of the envelope. These findings should not be read as apportioning blame or liability to any particular organisation or individual.

Safety issues, or system problems, are highlighted in bold to emphasise their importance. A safety issue is an event or condition that increases safety risk and (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time.

Contributing factors

• The pilot put down the handheld radio to operate the vent line, and the second ground crew member was not in an observable position for the driver, which led to a communications breakdown and limited their opportunity to promptly command the driver to stop to avoid the basket tipping.
• The majority of the passengers were not in the landing position when the basket tipped, increasing their probability for injury.
• Picture This Ballooning did not have any procedures for conducting vehicle‑assisted deflation. [Safety issue]
• The pilot and ground crew were unaware of the risk of the basket tipping from the vehicle pulling the envelope during vehicle-assisted deflation.
• Picture This Ballooning's safety risk management processes and practices were not sufficient to facilitate the identification of key operational risks associated with vehicle‑assisted deflation. [Safety issue]

Other factors that increased risk

• The Civil Aviation Safety Authority provided no guidance for operators concerning the risks associated with vehicle‑assisted deflation. [Safety issue]

Safety issues and actions

The safety issues identified during this investigation are listed in the Findings and Safety issues and actions sections of this report. The Australian Transport Safety Bureau (ATSB) expects that all safety issues identified by the investigation should be addressed by the relevant organisation(s). In addressing those issues, the ATSB prefers to encourage relevant organisation(s) to proactively initiate safety action, rather than to issue formal safety recommendations or safety advisory notices.

Depending on the level of risk of the safety issue, the extent of corrective action taken by the relevant organisation, or the desirability of directing a broad safety message to the aviation industry, the ATSB may issue safety recommendations or safety advisory notices as part of the final report.

All of the directly involved parties were provided with a draft report and invited to provide submissions. As part of that process, each organisation was asked to communicate what safety actions, if any, they had carried out or were planning to carry out in relation to each safety issue relevant to their organisation.

Descriptions of each safety issue, and any associated safety recommendations, are detailed below. Click the link to read the full safety issue description, including the issue status and any safety action/s taken. Safety issues and actions are updated on this website when safety issue owners provide further information concerning the implementation of safety action.

Vehicle-assisted deflation procedures

Safety issue number: AO-2019-014-SI-02

Safety issue description: Picture This Ballooning did not have any procedures for conducting vehicle-assisted deflation.

Risk management processes

Safety issue number: AO-2019-014-SI-01

Safety issue description: Picture This Ballooning's safety risk management processes and practices were not sufficient to facilitate the identification of key operational risks associated with vehicle-assisted deflation.

Guidance on vehicle-assisted deflation risks

Safety issue number: AO-2019-014-SI-03

Safety issue description: The Civil Aviation Safety Authority provided no guidance for operators concerning the risks associated with vehicle‑assisted deflation.

Additional safety actions

ATSB safety advisory notice to all commercial balloon operators

Safety Advisory Notice number: AO-2019-014-SAN-014

To accompany this report and encourage proactive safety action, the ATSB has released a safety advisory notice to all commercial balloon operators informing them of the risks associated with vehicle‑assisted deflation.

The ATSB advises all commercial balloon operators utilising vehicle‑assisted deflation methods to review their current operational practices in light of the findings in the ATSB investigation report AO-2019-014 with the aim of mitigating the risks associated with the procedure. This review should be conducted with emphasis on:

• reducing the risks associated with a communications breakdown between the pilot and vehicle driver, and
• include a review of the positioning of occupants within the basket to minimise the likelihood of injury if the basket tips during the vehicle‑assisted deflation.

Future study proposed by Picture This Ballooning

Action number: AO-2019-014-NSA-015

Picture This Ballooning has informed the ATSB that, at the earliest practical date, they intend to study the forces present during the vehicle‑assisted deflation process and to pass these results to other commercial ballooning operators.

Sources and submissions

Sources of information

The sources of information during the investigation included:

• Picture This Ballooning
• The Civil Aviation Safety Authority
• The Bureau of Meteorology
• Witnesses
• Victoria Police.

Submissions

Under Part 4, Division 2 (Investigation Reports), Section 26 of the Transport Safety Investigation Act 2003 (the Act), the Australian Transport Safety Bureau (ATSB) may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. Section 26 (1) (a) of the Act allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to Picture This Ballooning and the Civil Aviation Safety Authority.

Submissions were received from Picture This Ballooning and the Civil Aviation Safety Authority. There submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Safety summary

What happened

At about 0931 Eastern Daylight-saving Time on 25 February 2019, Train TD 6591, an empty Comeng passenger train operated by Metro Trains Melbourne (MTM) collided with the end of line protection (buffer stop) at Newport siding, Victoria. The collision damaged the buffer stop and the front of the train. The leading carriage (333M) derailed, and the train driver (the only person on board) was hospitalised with minor injuries.

What the ATSB found

Recorded data showed that the driver applied the brakes 1.5 seconds prior to impact, which was after the train had passed the required stopping point. There were no driver inputs in the preceding 25 seconds, although no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. While the train was equipped with a safety system (a pilot valve as part of the master controller) that was designed to apply the brakes in situations such as driver incapacitation, it was not activated to apply the brakes during the sequence of events. The recorded data indicated that sufficient pressure was maintained on the pilot valve (master controller). The driver may have been incapacitated for a period of time before the collision, however, the ATSB could not determine any details of incapacitation including duration and cause.

Although it was not identified as a contributory factor due to a day off prior to the accident, as a result of rostered work it is likely the train driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident (but not on the day of the accident).

Safety message

This investigation highlights the importance of train safety systems to protect against driver error and incapacitation. In addition, drivers should maintain their health and fitness for work to reduce the likelihood of driver incapacitation, including adequate nutrition and hydration as well as consideration of the potential impact of fatigue. The ATSB SafetyWatch information on fatigue provides resources and guidance.

The occurrence

What happened

On 25 February 2019, Train TD 6591, a six-car Comeng passenger train, operated by Metro Trains Melbourne (MTM), travelled from Flinders Street Station to Newport Station, Victoria, where all passengers disembarked. The driver commanded the train to depart the station once receiving an indication that the train was empty, with the intention to stable^[1] it at Newport siding, 810 m from the station. CCTV footage showed the train transiting to the siding with the driver visible and appearing alert.

While approaching the stabling location, for about 25 seconds from 0930:35 Eastern Daylight-saving Time,^[2] there were no recorded inputs from the driver. At about 0931, the train collided with the end of line protection (buffer stop) and derailed. Recorded data showed a brake application about 1.5 seconds prior to impact, which was after the train had passed the required stopping point. The collision resulted in substantial damage to the front of the train and the buffer stop, and the driver was hospitalised with minor injuries (Figure 1).

Figure 1: Front of Comeng train TD 6591, showing collision with buffer stop and derailment

Source: ONRSR, annotated by the ATSB

The train driver reported losing consciousness for an unknown period of time. The last thing that the driver could remember was noticing the track points were set correctly on entering the siding, with the next memory being after the collision.

Train driver

The driver had been driving MTM trains and based out of Newport for over 3 years, was suitably qualified and held a Category 1 medical (assessed as fit for duty unconditional in accordance with the medical standards contained in the National Standard for Health Assessment of Rail Safety Workers). Following the collision, the driver was tested for drugs and alcohol and returned a negative result for both.

The driver was admitted to hospital due to injuries sustained and examined by medical professionals. The driver reported that after extensive testing the medical professionals categorised the incapacitation as a vasovagal syncope (a common faint), possibly due to dehydration and lack of nutrition. The driver reported having a coffee and a banana but no water on the morning of the accident. The maximum temperature on the day was recorded to be above 30 °C, and the driver reported that the drivers cab was warm prior to the loss of consciousness and that there was no way to control the temperature as it was pre-set through the train. The driver also reported that the sun felt hot coming through the window.

Train controls and pilot valve

The brake controller (Figure 2) commanded the train’s pneumatic brakes through driver inputs.

The train was also equipped with a pilot valve system which was designed as a fail-safe mechanism such that the brakes would apply if there was no pressure applied by the driver (such as from incapacitation). When the pilot valve was ‘opened’ the brake pipe pressure would release and the brakes would apply. In order to keep the pilot valve ‘closed’, pressure was required to be maintained by the driver through either a foot pedal or hand controller. The hand controller for the pilot valve (hand pilot valve) formed part of the master controller (Figure 2).

The driver was using the hand pilot valve at the time of the accident. The hand pilot valve required a minimum downward pressure of 0.6–1 kg be maintained on the master controller handle to keep the valve in a closed position, preventing the brakes from applying.

Post-accident testing of the train’s braking system and hand pilot valve found no faults that would have contributed to a failure to stop.

Figure 2: Comeng driver’s cab of 333M, showing location of the brake controller, and combined master controller with hand pilot valve

Source: MTM, annotated by ATSB

Logged data

Each driving cab of the train was fitted with a Vigilance Control Event Recorder System (VICERS) data logger that recorded the speed, acceleration and operational status of the driving controls. The data logger from the leading cab (333M) was reviewed as it was the active cab and also the first carriage to impact the buffer stop. The logged data showed the following:

• The train’s speed was maintained below 15 km/h during the stabling operation and the driver used several brake and throttle modulations to do so.
• Driver inputs stopped at 0930:35 and there were no further inputs for about 25 seconds, with a brake application at 0931:00
• The brake application about 1.5 seconds prior to impact (at 0931:00) was consistent with an emergency brake application commanded by movement of the brake controller.
• There was no recorded change of state of the pilot valve system until impact.

Additional safety systems

The train was equipped with two additional safety systems to assist in protecting against driver error and incapacitation: a trip-lever and a task-based vigilance system.

Trip-lever

A trip-lever would initiate emergency braking if the train passed a signal requiring the train to stop. In this accident, the train was entering a siding and did not pass any signals requiring the train to stop. Therefore, there was no requirement for the trip-lever to activate the brakes.

Task-based vigilance system

The task-based vigilance system monitored driver control inputs and if there were no inputs for a certain amount of time, a warning would sound. If the driver did not respond to that warning, the brakes would apply. The timer would reset when certain tasks were performed, such as operation of the master controller or brake controller.

At the time of the accident, due to the train’s speed, the system was operating on a 45-second interval. The 25-second time period which elapsed without driver inputs was therefore too short to activate the system.

Fatigue

The driver’s rosters for the three months prior to the accident and reported 72-hour history were reviewed as part of a fatigue analysis, which included the use of biomathematical modelling. The roster was input into two biomathematical modelling software programs, FAST^[3] and FAID.^[4] Biomathematical modelling forecasts the effects of circadian rhythms and sleep on performance, but cannot determine fatigue (or predict errors caused by fatigue) due to individual and situational circumstances.

Both models’ outputs indicated that the predicted levels of fatigue on the day of the accident were not in a range known to have a significant impact on performance. This was likely due to the driver having a day off work two days prior, which would have impacted the biomathematical modelling outputs.^[5] However, in the week preceding the accident, before the day off, both biomathematical modelling outputs predicted that the driver was likely experiencing levels of fatigue shown to have an effect on performance.

Safety analysis

The driver may have been incapacitated in the period prior to the accident and therefore temporarily lost awareness of the driving task, leading to the train not stopping at the designated stopping point as the driver did not apply the brakes in sufficient time. While it is possible the driver was incapacitated in the period before the collision, due to limited and conflicting evidence the cause, duration and presence of incapacitation could not be determined. Although dehydration was raised as a possible reason for why the driver may have fainted, the available evidence could not confirm this. In addition, although the logged data showed no driver inputs for 25 seconds followed by a brake application, the duration of any incapacitation could not be confirmed as no driver inputs other than a final brake application to stop the train were required during that period as the train was maintaining the required speed. However, the recorded brake application occurred after the train had passed the required stopping point (and therefore was not effective in stopping the train).

The pilot valve was part of the overall train safety system, including the trip-lever and vigilance system. In this situation, the pilot valve was the only aspect of the safety system that could have activated and applied the brakes to protect against driver incapacitation. The hand pilot valve required minimal pressure to prevent the brakes from applying. It is very likely that adequate pressure was maintained on the pilot valve (master controller) during the period when no driver inputs were made, and therefore this part of the safety system was not triggered to activate the brakes and stop the train.

The driver’s rosters for the previous three months were reviewed through a fatigue analysis, including the use of biomathematical modelling software. This analysis indicated, due to the number of rostered days worked and the timing of shifts, the driver was likely experiencing a level of cumulative fatigue known to have an effect on performance in the week preceding the accident, before the day off. However, aspects such as the time of day, the driver’s 72-hour history including a day off work, and the driver reporting being very alert, suggests that fatigue was a not contributing factor in this accident.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• The driver did not apply the brakes at the required time to stop the train, nor did the pilot valve brake activate, resulting in the train colliding with the buffer stop and derailing.
• Due to rostered work it is likely the driver experienced levels of fatigue known to have an effect on performance during the week prior to the accident, but not on the day of the accident.
• The ATSB could not confirm the presence or length of any driver incapacitation before the accident.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

__________

1. To leave rail traffic unattended and secured, usually in a siding.
2. Eastern Daylight-saving Time (EDT) was Coordinated Universal Time (UTC) + 11 hours.
3. Fatigue Avoidance Scheduling Tool (FAST®). FAST predicts fatigue based on actual sleep and work schedules, and critical event scenarios using a model of human fatigue and circadian variation in cognitive performance and alertness.
4. Fatigue Audit Interdyne (FAID) Quantum. FAID predicts sleep opportunity, and as a proxy, estimates fatigue due to work-related causes.
5. For FAID, a recovery value is assigned depending on the length of non-work periods and the time of day that they occur.

Overview of the investigation

On 12 February 2018, the ATSB commenced an investigation into a loss of tractive effort on train 8466 at Ardglen, New South Wales (NSW), which occurred on 10 February 2019.

Train 8466, operated by Qube Logistics, was planned to transport mineral concentrate from Cobar, NSW, to Port Waratah, NSW. During the journey, 10 wagons were added. This required the addition of another locomotive, which was attached at Werris Creek.

The train departed Werris Creek with three diesel-electric locomotives (QBX005, QBX004 and QBX001) hauling 61 wagons with a total length of 961 m. The train crew consisted of two drivers.

After pausing briefly at Chilcotts Creek, the train made its way up the 1 in 40 grade to the Ardglen Tunnel, until its speed dropped and it came to a stop near the distant signal on the approach to Ardglen. The driver inspected the locomotives but did not identify any problems.

The driver restarted the train, but soon after locomotive QBX001 began to perform erratically, intermittently losing tractive effort. The locomotive began to provide tractive effort again, and the train accelerated to 18 km/h and entered the northern portal of the tunnel at 11 km/h.

About 2 minutes after entering the tunnel, locomotive QBX005 derated to produce no tractive effort, and within another minute, the other two locomotives also derated to produce no tractive effort. The tunnel was filled with exhaust smoke, which entered the lead locomotive QBX005’s operating cab and reduced the drivers’ visibility.

When the driver sensed the train was moving again, he assumed the locomotives were producing tractive effort, but the train was actually rolling backwards towards the northern portal of the tunnel. When the train approached the tunnel’s exit, the driver realised the problem and made a full service brake application. The second driver made an emergency call to train control, who advised the track behind the train was clear and the points were set correctly to protect the train movement. Ultimately, the train rolled back a total distance of 982 m. Although this was an unplanned event, communications between the train crew and train control at all stages ensured protection was in place.

As part of its investigation, the ATSB interviewed the drivers, reviewed the train’s event recorder data and obtained loading records for the train and other trains used by the operator. The ATSB also obtained and reviewed the operator’s investigation report on the occurrence.

Based on this information, it was identified that:

• The train’s initial documentation, prepared by the train crew, indicated that the 61 wagons weighed 4,636 t (76 t per wagon). A subsequent calculation by personnel in the operator’s customer service centre, and entered into the operator’s transport management system prior to the train’s departure, was 4,392 t (72 t per wagon). This latter weight was erroneous, and after the occurrence the actual weight was determined to be 4,608 t. However, the operator reported that the locomotive capability for the planned route was 5,148 t (1,716 t per locomotive), in excess of the actual weight.
• The locomotives were manufactured in 2015. Locomotive QBX001 had previously experienced derating issues due to its exhaust sensor not operating consistently to deliver accurate temperature readings to the locomotive management system. It had recently been repaired and certified by an external contractor, which involved a temporary repair of a wiring harness. However, during the occurrence sequence, the locomotive continued to experience intermittent faults with the exhaust sensor.
• Ardglen Tunnel had no exhaust or gas ventilation or artificial illumination. When in the tunnel, exhaust gases from the locomotives surrounded the locomotive bodies and were forced forward of the locomotives, resulting in the ingestion of exhaust gases into the locomotives’ engine air intakes.
• There was no requirement for an operator to carry oxygen self-rescue units in the lead locomotive of a train passing through the Ardglen Tunnel, although such units were required for operating through the Ulan Tunnel (which the train normally operated through). Such oxygen self-rescue units were on board locomotive QBX001, but the crew had not transferred them to the lead locomotive QBX005 (nor were they required to do so).
• The driver was presented with ambiguous and incomplete information when the three engines derated. He saw that the lead locomotive had derated, but there was no visual indication that both the trailing locomotives had derated, and no audible indication that the trailing locomotives derated. While in the tunnel, the driver sighted the speed indicator consistently displaying a speed above 0 km/h, but the indicator did not differentiate between forward and reverse speed.
• The operator identified several proposed actions to improve the safety of its operations.

ATSB comment

Based on a review of the available evidence, the ATSB considered it was unlikely that further investigation would identify any systemic safety issues. Consequently, the ATSB has discontinued this investigation.

The evidence collected during this investigation remains available to be used in future investigations or safety studies. The ATSB will also monitor for any similar occurrences that may indicate a need to undertake a further safety investigation.

Safety summary

What happened

On 21 January 2019, freight train 6BM9 was to travel from a logistics terminal in Barnawartha in northern Victoria to Altona, in Melbourne. The train consisted of two locomotives and 31 freight wagons. The train departed Barnawartha at about 1400 and travelled in a south-westerly direction through Wangaratta, Benalla and Euroa.

At 1530, the train passed through Creighton travelling at about 100 km/h. About 0.5 km after crossing Creighton Siding Road, the leading bogie of the third-last wagon derailed. The wagon derailed a short distance before a rail bridge. The train was brought to a stop with minor damage to the wagon and track, and no injuries.

What the ATSB found

The ATSB found that the wagon probably derailed as a result of the lateral misalignment of the track. The track misalignment was not evident to the locomotive crew when the train entered the location and developed under the dynamic loading of the train.

The track misalignment was probably primarily the result of track lateral instability. A mud hole at the derailment location had resulted in poor ballast support of sleepers, reducing the track’s resistance to movement. A combination of this degraded support and compressive forces within the rails created conditions for track instability. The longitudinal compressive forces were due to the hot conditions of that day, and possibly localised low stress-free-temperatures in the rails near the rail bridge.

The Australian Rail Track Corporation’s (ARTC) systems for managing track lateral stability did not lead to the location being managed as a special location potentially vulnerable to instability. Although the reduced ballast profile at the mud hole had been identified and monitored in accordance with the ARTC code of practice, more significant levels of response were available to manage the risk of instability. These included repair or imposing a temporary speed restriction when temperatures reached a predetermined limit.

What has been done as a result

ARTC advised that its Track Stability Management Plan (TSMP) for the section containing Creighton has been reviewed. As a result, the 2019/20 TSMP included Stress Free Temperature testing at several sites, and 13 sites were identified as special locations for the monitoring of track stability, including the Creighton derailment site.

ATSB has made a safety recommendation for ARTC to review its systems for the identification and management of track vulnerable to instability, considering the findings of this report.

Safety message

It is important for rail infrastructure managers to have systems in place to identify track sections vulnerable to lateral instability during the summer period.

The occurrence

Events prior to the derailment

On the afternoon of 18 January 2019, SCT Logistics container service 6BM9 departed Bromelton in Queensland to travel to Altona in suburban Melbourne, Victoria (Figure 1). The train consisted of two locomotives hauling 18 wagons.

Figure 1: Intended route of train 6BM9 from Bromelton, Queensland to Altona, Victoria

Source: Google earth annotated by Chief Investigator, Transport Safety (Victoria)

The train arrived at Taree, New South Wales (NSW) at 0324 on Saturday 19 January, where there was a change of crew. The train then travelled to Leightonfield, for another crew change at about 1210 the same day. The next crew change was at Wagga Wagga at 1950, also on the same day. The next stage of the journey, between Wagga Wagga in NSW and Barnawartha in Victoria, was also uneventful, the train arriving just after midnight on 20 January.

Due to capacity constraints at its final destination in Melbourne, the train was held at the SCT Logistics terminal in Barnawartha for about 38 hours. During this stop, 13 wagons were added to the consist to give a total of 31. The train crew for the next leg joined the train on 21 January at about 1230. The train was inspected, and departed Barnawartha at about 1400.

The derailment

The train travelled in a south-west direction through Wangaratta, Benalla and Euroa. It was handling as expected out of Euroa, and crested Creighton Bank at a speed of about 95 km/h. On the downgrade following the crest, the train’s speed increased to about 108 km/h.^[1] The driver progressively reduced the throttle setting from Notch 8 to Notch 2 before crossing Creighton Siding Road at a speed of about 102 km/h. The train then crossed two short bridges before a wagon derailed immediately ahead of a third bridge at about 1540. The crew reported that they had not noticed any track irregularities prior to the derailment.

The driver stated that he saw a plume of dust towards the rear of the train in the rear view mirror and he also observed a loss of brake pipe (BP) pressure. The End-of-Train device (EOT)^[2] registered a reduction in BP pressure, followed by a reduction of pressure in the locomotive electronic air brake (EAB)^[3] system.

The train came to a stop with the lead locomotive just past the 141 km post. After stopping, the crew initiated an emergency call to network control. One of the crew then inspected the train and identified that the leading bogie of the third-last wagon (CTQY 666T) had derailed (Figure 2).

Figure 2: Derailed bogie of wagon CQTY 666T

Source: Australian Rail Track Corporation (ARTC).

Observations following derailment

Immediately following the derailment and prior to the drop in temperatures that evening, the track at the derailment location was inspected by the rail infrastructure manager, the Australian Rail Track Corporation (ARTC). The track exhibited a significant lateral misalignment (Figure 3).

Figure 3: Track misalignment photographed at 1710 on 21 January, after derailment

Source: Australian Rail Track Corporation

This photograph was taken soon after the derailment in temperatures similar to those existing at the time of the derailment, and prior to the track cooling overnight. It shows a significant track misalignment ahead of the rail bridge.

__________

1. Train speeds provided are as recorded on the data logger from locomotive SCT004
2. End-of-Train device measures brake pipe pressure on the last wagon and displays it on the driver’s console.
3. Electronic Air Brake (cab controls)

Context

Track information

Track location

Creighton is located in the rural municipality of the Strathbogie Shire Council in north central Victoria, about 143 rail-km from Melbourne (Figure 4).

Figure 4: Track between Violet Town and Avenel, indicating incident location Creighton

Source: e-way street directory, Melway 2017, annotated by Chief Investigator, Transport Safety (Victoria)

This rail corridor extends between Melbourne and Wodonga in northern Victoria and is part of the interstate standard-gauge^[4] rail connection between Melbourne and Sydney. Since July 1998, the standard-gauge network in Victoria has been managed by the Australian Rail Track Corporation (ARTC).^[5]

The corridor continues to receive significant investment. The North East Line Upgrade^[6] project commenced planning in 2018, started works in 2019 and is due for completion in 2021. The scope of the project includes the removal of mud holes, drainage improvements, replacement of ballast and resurfacing including packing and compacting of ballast.

The standard-gauge track on the north east corridor has a history of mud hole formation and rough ride. In 2011, the ATSB conducted an investigation to examine the safety of rail operations on the Melbourne to Sydney line.^[7] ATSB found that train forces on a weakened formation, as well as the effects of highly fouled ballast, poor drainage and heavy rainfall during 2010 and 2011, contributed to the development of mud-holes and poor vertical alignment on this corridor.

Typical track construction

The structure of a track consists of a number of components, including the rail, sleepers, ballast and the formation (Figure 5).

Figure 5: Track structure

Source: Chief Investigator, Transport Safety (Victoria)

The formation is the earthworks upon which the ballast is laid and typically consists of the sub-grade (earth fill on top of the natural earth) and a capping layer of compacted material that provides a sealing layer to the sub-grade. The ballast covers the capping and distributes the loads to the formation while also providing the necessary support to the sleepers to maintain track geometry under vertical, lateral and longitudinal loads. Sleepers and their fastenings support and locate the rail.

Track at Creighton

There were two parallel, standard-gauge bi-directional tracks at Creighton—an east and west track. The incident train was travelling towards Melbourne on the east track. The maximum permitted speed for this line segment was 130 km/h and there were no temporary speed restrictions in force at this location, nor had any speed restrictions been imposed due to heat. The authorised speed for the class of train that derailed was 115 km/h.^[8]

The east track through Creighton was constructed using 60 kg/m Continuous Welded Rail (CWR)^[9] affixed to 250 mm deep concrete sleepers using Pandrol ‘fastclip’ resilient fasteners. Concrete sleepers were at a nominal spacing of 667 mm.^[10] Construction standards specified ballast at a depth of 250 mm and a shoulder width of 300 mm.^[11] The standard stated that the ballast shoulder height be determined by the sleeper design.

Creighton Siding Road is located 143.276 rail-km from Melbourne.^[12] Travelling towards Melbourne, there were seven rail bridges over a relatively short distance. They were located at 142.944 km, 142.852 km, 142.710 km, 141.827 km, 141.505 km, 141.161 km and 140.880 km (Figure 6). The derailment occurred a short distance before the bridge at 142.710 km, and the train came to a stop just prior to the bridge at 140.880 km.

Figure 6: Incident track section

Source: Pass Assets, Public Transport Victoria, Annotated by Chief Investigator, Transport Safety (Victoria)

Rail bridge construction

The point of derailment was between the short rail bridges at 142.852 km and at 142.710 km. Both bridges were transom bridges, with timber sleepers fixed to I-beam girders supported at each end by concrete abutments. Rails were secured to sleepers with Trak-Lok type fastenings that had a design toe load of approximately 9 kN for each fitting. The rail bridge at 142.710 km was about 7.4 m long and in good condition (Figure 7).

Post-incident track inspection

An examination of the track following the derailment identified misaligned track up to the 142.710 km rail bridge and associated lateral displacement of sleepers. Significant ballast fouling was observed from 16 to 27 m before the rail bridge. The most severe fouling and loss of ballast profile was from about 20 to 24 m prior to the rail bridge (Figure 7). A dip in the track through this mud hole location was observed.

Site evidence indicated that the initial derailment was of a single wheelset that had derailed to the left of the track before the bridge at 142.710 km. The point of mount of the left-hand wheel and the drop-off points of both wheels could not be determined with certainty. There was some indication of the right-hand wheel having dropped inside the right rail about 10 m before the rail bridge. There was further evidence indicating that the second wheelset (of the same bogie) derailed prior to the next bridge at 141.827 km.

Figure 7: Mud hole and track buckle on east track before bridge located at 142.710 km.

Source: Chief Investigator, Transport Safety (Victoria)

This photograph was taken in the early morning of the day following the derailment. The rails had contracted in the cooler overnight temperatures and the magnitude of the track misalignment had reduced from its peak. The photograph shows the heavy fouling of the ballast about 20-24 m ahead of a short rail bridge.

At the location of the mud hole there was severe contamination of the ballast and a loss of ballast between sleepers, and at sleeper ends (Figure 8).

Figure 8: Mud hole at the derailment location

Source: Chief Investigator, Transport Safety (Victoria)

Post-derailment rail stress free temperature measurements

Following the derailment, ARTC reinstated the track during cooler temperatures, and without the need to cut rail. Following track restoration, the stress free temperature (SFT) of each rail was measured by ARTC.^[13] Measurements were made at 142.760 km on the evening of 23 January 2019, with rail temperatures at about 23°C. The ARTC measurements estimated an SFT in the Up rail (left rail looking towards Melbourne) of 34°C, and an SFT in the Down rail of 36°C. It is not known the extent to which stress in each rail may have been equalised along their length as a result of the derailment and the subsequent restoration works.

Pre-derailment track inspections

Track patrols and inspections

The ARTC Track and Civil Code of Practice detailed the requirements for track patrols, general inspections and detailed inspections.^[14]

ARTC undertook track patrols every 7 days or as specified in their Track Maintenance Plan (TMP). These patrols were typically performed from road-rail vehicles. Unscheduled inspections were also carried out in response to ‘defined or abnormal events’ and included those required at special locations where defects were more likely.^[15]

ARTC conducted a range of other general and detailed track inspections to monitor the condition of track infrastructure, ranging in frequency from 6 to 24 months. ARTC standards specified that the general inspection of track stability be conducted as temperatures started to increase after the cold season, normally the end of August, and as close as possible to, or in conjunction with, the ballast general inspection.

Inspection outcomes

Previous inspections had identified the presence of the mud hole on the Creighton (Down) side of the 142.710 km rail bridge, and this was recorded within the ARTC’s Routine Maintenance – Defect Work Orders. Defect Work Orders for at least the previous two years indicated that the mud hole was monitored fortnightly but no remediation was undertaken.^[16] The same inspection finding and response was made in all prior inspections with the report closed-out on the maintenance management system with the note ‘remove mud hole, PO^[17], supervisor, excavator, tamp, undercutter bar 36 tonne ballast’. The most recent track patrol inspection at the location prior to the derailment was conducted by road-rail vehicle on 14 January 2019.

There were no other specific findings or outstanding actions identified from previous general or detailed inspections at this location.

Track geometry

Track geometry was measured every four months using the ‘AK-Car’^[18] to assess geometry against maintenance standards. Parameters measured included track gauge, cant, twist and rail vertical and lateral variation.

The most recent geometry measurements at the derailment location were made on 10 October 2018. The TOP^[19] recorded by the AK car in the vicinity of the mud hole just before the bridge at 142.710 km indicated rapid changes in TOP measurement but was within permitted tolerance. As there was no exceedance of standards, no outstanding actions were recorded. The deviation in LINE^[20] recorded by the AK car was no more than 5 mm in the vicinity of the mud hole, and was within permitted tolerance.

Management of lateral stability of track

Introduction

A track buckle occurs when the longitudinal expansion of rails in hot conditions leads to high compressive forces, and the track structure is unable to prevent the track from moving laterally to relieve the stresses developed within the rails. Managing the lateral stability of track therefore involves both the management of rail stress, and the design and maintenance of track support structures including ballast.

Management of rail stress

Continuously Welded Rail (CWR)

The ARTC code of practice for Track Lateral Stability specified a rail stress-free temperature (SFT) of 38°C in track with CWR. The SFT is the temperature at which there are no temperature induced stresses in the rail.^[21] An SFT is chosen to minimise the potential for track buckle (in hot conditions) and for a rail break (in cold conditions). The SFT of a rail can change over time if there is longitudinal creep of the rail. CWR affixed to concrete sleepers using resilient fasteners has an enhanced ability to resist longitudinal creep forces.^[22]

Rail fastenings

Rail fasteners generate a toe load on the rail flange, providing resistance to longitudinal movement, and to rail roll and lateral shift. High toe loads mean that rail and sleeper are more likely to act as a single assembly.^[23] The resilient fastenings used on track at this location were Pandrol ‘fastclip’.^[24] For concrete-sleepered track, the ARTC standard required a minimum designed toe load per rail seat (two fastening clips per rail seat) of 15 kN for track with axle loads not exceeding 25 t. Although toe load is related to longitudinal creep resistance, there is no direct and consistent relationship.

Monitoring of rail stress free temperature

ARTC track standards specified that rail creep monitoring and control measures would not usually be necessary at locations with CWR with concrete sleepers and resilient fastenings.^[25] The standard noted that this arrangement was known to provide good resistance to longitudinal rail movements, but that ‘practices for the measurement of rail creep should be considered and take into account the influence of fixed points in the track’. ^[26] There were no creep monitoring facilities through the Creighton location.

Changes in a rail SFT are not easily observed in CWR.^[27] ARTC did not check SFT in CWR affixed to concrete sleepers unless it was identified during detailed inspection that the SFT may have lowered. In such cases, ARTC measured rail SFT using VERSE testing.^[28] This testing involved unfastening 30 m of rail and lifting the rail by hydraulic jack. By measuring the lifting force and height, and the rail temperature at the time of the measurement, it was possible to estimate the temperature of the rail at which it would be stress free (the SFT). The ARTC Track Stability Management Plan for the Sydney to Craigieburn corridor for the 2018-2019 high temperature season did not require the SFT of rail to be measured through the Creighton location.

Ballast requirements for lateral resistance

Ballast performs a critical function in maintaining track stability. The ARTC standard^[29] for ballast specified the required ballast profile, and the required corrective action should the profile be diminished (Table 1). Pictorial definitions of the reduced ballast profile are provided at Appendix A.

Table 1: ARTC Ballast Profile Condition - Response Codes

The data was for track with concrete sleepers and curvature >400 m radius, and freight line speed of 115 km/h.

Source: ARTC

The response code table notes^[30] state that ‘in concrete sleepers the responses apply where height and width deficiencies occur over 10 m or greater.

Standard for special locations

ARTC procedures for managing track stability stated that a location that has an increased risk of track stability were defined as a special location.^[31] Further, special locations are defined as areas:^[32]

• potentially vulnerable to instability
• with a history of instability, or
• where the SFT is ‘suspect’.

These procedures stated that special locations may require rectification work or more detailed inspections prior to the high temperature season and typically, special locations may include:

• track sections with a history of lateral instability or pull-apart failures
• bunching points
• areas with non-conforming ballast profile
• sites with localised initiators (e.g. mud holes).

The procedures specified that sites required to be monitored as special locations shall be determined and are to be recorded in the Asset Management System (AMS) and a register attached to the Track Stability Management Plan (TSMP).

Track Stability Management Plan

The Track Stability Management Plan (TSMP) was designed to be regularly updated and included actions to be undertaken to manage track lateral stability in accordance with ARTC standards and procedures.

The TSMP covering the Creighton location applied to defined sections of concrete-sleepered track between approximately 30 and 200 rail-km from Melbourne. It was last updated (prior to the derailment) on 24 September 2018,^[33] and was endorsed by the Corridor Manager Sydney to Craigieburn. The plan included results of Stress Free Temperature (SFT) measurements since the previous plan review, and a schedule of planned SFT measurements. There were no ‘previous’ or scheduled SFT measurements at the derailment location.

The plan noted that after establishment of concrete sleepers between 200.614 and 99.305 km in 2016, inspections had indicated that there had been little or no evidence of creep. Creep measurements were no longer taken and SFT measurements were taken in locations identified during track inspections.

The plan detailed ‘Buckling Resistance Management’ and the requirement to define locations with ballast deficiencies that required temporary speed restrictions when forecast temperatures reached or exceeded 38°C.^[34] There were no such locations identified within the plan.

The plan included a special locations register, although there were no locations listed on the plan provided.

Track buckling predictor

In 2017, ARTC published a document^[35] on the use of a predictor model to assist with the prediction of instability by estimating the rail temperature at which the track was likely to buckle.

The ARTC buckling predictor was based on the Schramm^[36] and Bartlett^[37] models developed in the 1960s. The Schramm model is an empirical model based on field data whereas the Bartlett had a combined empirical and theoretical basis. The output of the predictor model was an estimate the temperature of the rail at which the track may buckle.

The train

Locomotive crew

The drivers for this sector were suitably qualified and had been assessed as medically fit.

Locomotives and wagons

SCT Logistics container service 6BM9 from Barnawartha consisted of two locomotives SCT004, SCT012 and 31 wagons. The first 25 wagons were carrying containerised goods. Wagons 26 to 29 each carried two empty containers, while wagon 30 carried one empty container. The last wagon was not carrying any containers. The train was about 991 metres long and had a trailing tonnage of 2072 t.

The derailed wagon CQTY666T (wagon 29) was a two-slot container flat wagon loaded with two empty containers, each weighing about 2.28 t (Figure 9).

Figure 9: Derailed wagon CQTY 666T

Source: Advisian, Worley Parsons Group.

The wagon was travelling with its B-end leading with the lead bogie CAYE 6300 derailing. The wagon was fitted with AAR 2E, three-piece ride control bogies of nominal capacity 23 tonne axle load. The bogies were fitted with Stucki type constant contact side bearers and conventional AAR 4:1 brake rigging.

Post-incident inspection of wagon

Post-incident inspection of the wagon and the bogies revealed minimal wheel tread wear with moderate operational spalling damage. The light to moderate bolster gibb contact indicated either extended operation on poor track or bogie hunting.

Components of the friction wedge system such as wear plates, friction wedges and bolster pockets were all partially worn, while the wedges and side frame column wear plates were in good condition. The most likely cause of this wear would be inadequate attention to friction wedge pockets in the bolster at overhaul (Figure 10).

Figure 10: Bogie components

Source: Advisian, Worley Parsons Group, annotated by Chief Investigator, Transport Safety (Victoria).

Weather conditions

Around the time of the derailment, the temperature at Shepparton was approximately 38 °C. Shepparton is about 39 km from Creighton and it is probable that conditions at Creighton were similar. From 19 January, the Bureau of Meteorology had forecast a maximum temperature of 39 °C for Shepparton on 21 January 2019.

__________

4. 1435 mm gauge.
5. ARTC is incorporated under the Corporations Act, with all shares owned by the Commonwealth of Australia,
6. Managed by ARTC.
7. RO-2011-015 – Safety of rail operations on the interstate rail line between Melbourne and Sydney
8. Individual trains may be limited in speed depending on their class, rolling stock classification and other criteria.
9. Rail lengths welded end-to-end into strings greater than 400 m.
10. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Sleepers and fastenings, Section 2, Version 2.0.
11. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Ballast, Section 4, Version 2.4.
12. All chainage figures used in this report are based on the asset records maintained by Public Transport of Victoria. There are small differences between these figures and those used by ARTC.
13. Using VERSE system
14. ARTC, Track Patrol, Front of Train, General and Detailed Inspections ETE-00-02
15. Ibid.
16. The mud hole location is identified at ARTC chainage 142.688 – 142.700, that varies slightly from asset system chainages. This mud hole is the same mud hole as that identified on site immediately prior to the point of derailment.
17. Protection Officer.
18. The AK car is a track inspection vehicle also known as a track recording car used to test several geometric parameters of the track without obstructing normal railroad operations. The cars use a variety of sensors, measuring systems, and data management systems to create a profile of the track being inspected.
19. TOP is the up or down variation (vertical) from the mean alignment of the rail and is measured by the AK car.
20. LINE is the variation on a horizontal plane from the mean alignment of the rail and is measured by the AK car.
21. At the SFT, if a small section of rail was removed, the gap would remain constant. It would neither close nor widen unless the rail temperature was to change.
22. Australian Railway Infrastructure standard AS7639:2013 Track Structure & Support.
23. Nafis Ahmad, Shah Sanjar & Mandal, Nirmal & Chattopadhyay, Gopinath & Powell, J. & Micenko, P. (2011). Improvement of rail creep data to measure the stress state of a tangent continuously welded rail (CWR) track
24. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Resilient Rail fastenings for medium Duty Concrete Sleepers – Design ETD-02-02.
25. Fastenings that exert a toe load on the rail foot inhibiting creep.
26. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Track Lateral Stability, Section 6, Version 2.5.
27. By comparison, in jointed track the expansion and contraction of rail can be observed and simple measurements taken at joints to estimate the stress condition of the rail at temperature extremes.
28. VERSE is a proprietary device used for non-destructively measuring the Stress Free Temperature in rail, and is marketed by Pandrol Australia Pty Ltd.
29. ARTC Engineering (Track & Civil) Code of Practice, Section 4 Ballast, 5 September 2012
30. Australian Rail Track Corporation, Engineering (Track & Civil), Code of Practice, Ballast, Section 4 - Note 2 to tables 4.3, 4.4 and 4.5.
31. Australian Rail Track Corporation, Managing Track Stability, ETM-06-08, Version 1.1.
32. Australian Rail Track Corporation, Managing Track Stability, ETM-06-08, Version 1.1, Section 3.8.
33. Seymour Track Stability Management Plan
34. In accordance with ARTC Code of Practice – Section 4
35. Track Buckling Predictor ETI-06-06, Version 1.0, 16 March 2017.
36. Schramm, G. (Trans. Lange, H.). Permanent Way Technique and Permanent Way Economy. 1st Edition. 1961.
37. Bartlett, D.L.(1960) The Stability of Long Welded Rails, Civil Eng. and Public Works Review Vol. 55, No. 649, 1033-1035, NO. 650, 1170-1171, No. 651, 1299-1303, No. 653, 1591-1593.

Safety analysis

Lateral Track Stability

When rail temperatures exceed the stress free temperature (SFT) of continuously welded rail (CWR), the rail will be in longitudinal compression. This scenario occurs regularly over the summer period. In this instance, the ambient air temperature was around 38°C. Rail, particularly when exposed to direct sunlight, reaches temperatures considerably higher than the ambient. In this instance, the rail temperature was probably of the order of 57°C.^[38] This rail temperature is about 20°C above the nominal design SFT^[39] and so rails would have been in a state of longitudinal compression in the environmental conditions at the time of the derailment.

Under such conditions, maintaining track stability relies on rail fastenings and track support, including ballast, to resist the forces acting to laterally misalign (buckle) the rails. Ahead of the rail bridge at 142.710 km, there was a mud hole and a loss of ballast profile around sleepers. This reduced resistance to track lateral movement and increased the potential for track instability at this location.

Site evidence was also consistent with a loss of track stability through this location. Deformed track formed an ‘S’ buckle that ended at the rail bridge. The bridge had probably acted as a fixed point.

Inspection of the derailed bogie did not identify defects or out-of-tolerance items, although there was some evidence of bogie hunting. The locomotive driver did not observe the misalignment ahead of the train, meaning the buckle developed under the dynamic loading of train 6BM9. It is possible that bogie behaviours influenced the magnitude of the load on the track. The wagon that derailed was carrying empty containers, probably making it more vulnerable to flange-climb derailment than the loaded wagons earlier in the consist.

Consequences

In this case, one bogie on the freight train derailed, resulting in minor track damage. However, had the bogie of train 6BM9 not derailed on the misalignment that had formed under the train, the XPT passenger service travelling from Sydney to Melbourne may have encountered the track misalignment. It was expected to pass through the location about 80 minutes after the derailment, at 1650.

Factors contributing to track instability

Methodology

In 2017 ARTC published a model for predicting the temperature at which track in a given condition may buckle. The prediction tool was based on older models developed by Bartlett and Schramm.

For this investigation, the part of the ARTC prediction tool that draws on the Bartlett model has been used to examine the potential for track buckle at the Creighton derailment location. Bartlett attempted to quantify the relative importance of rail, fastenings and ballast and developed a quasi-theoretical model.^[40] It is recognised that the model provides an indication only of buckling temperature and sensitivity to key parameters, rather than definitive prediction. The sensitivity to buckling of three parameters are considered; ballast profile, the amplitude of a lateral defect acting as a buckle initiator, and the stress free temperature of the rails.

For modelling using the ARTC buckling predictor, a number of parameters were fixed based on the conditions at site, and with some assumptions (Table 2).

Table 2: Input parameters used in predictor model

Sensitivity to reduced ballast profile

The potential influence of a loss of ballast profile on the predicted track buckling temperature was examined for a range of ballast shoulder widths,^[45] and model predictions made for different values of initial misalignment, and rail stress free temperature (Table 3).

Table 3: Variables used in modelling sensitivity to ballast profile

The predicted buckling temperatures for a range of scenarios was compared to the estimated rail temperature at the time of the incident. The results of the prediction model indicate that at ballast shoulder widths of under 100 mm, track misalignment was plausible, particularly in the presence of a higher initial misalignment and/or lower rail stress-free-temperatures (Figure 11).

Figure 11: The influence of ballast shoulder on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Local misalignment acting as buckle initiator

Ballast through the mud hole was significantly degraded. The potential impact of such a loss of support was two-fold. It resulted in a loss of lateral resistance to track buckle, and also the potential for the development of a lateral ‘initiator’ for track buckling. The most recent track geometry measurement was taken in October 2018, and indicated no lateral defects over 5 mm. However, the measurement was taken prior to the summer period before the derailment. The development within the mud hole of a buckle initiator of increased amplitude either over time, during the passage of other trains prior to train 6BM9, or under train 6BM9, are all possible scenarios. The sensitivity to the magnitude of an initial misalignment was modelled for a range of rail stress free temperatures and a fixed ballast shoulder width of less than 100 mm (Table 4).

Table 4: Variables used in modelling sensitivity to ballast profile

The predicted buckling temperatures for a range of scenarios was compared to the estimated rail temperature at the time of the incident. The results of the predictor model indicate that the magnitude of the buckling initiator is a significant factor in the predicted magnitude of the lateral buckling force and the potential for a heat-induced buckle. The model suggests that with an initial lateral misalignment of over 10 mm, track buckle was plausible, particularly in the presence of lower rail stress-free-temperatures (Figure 12).

Figure 12: The influence of rail misalignment on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Variation of stress-free-temperature over a track section

The SFT of a rail can change over time, either by the rail moving through its fastenings or the track (rail with sleepers) creeping longitudinally. Research has found that SFT can vary considerably over a section of track, particularly near track features such as turnouts, crossings and bridges.

Esveld^[46] reported on research commissioned by the International Union of Railways (UIC) to improve knowledge of forces in CWR track. This work included conducting simultaneous day and night measurements of longitudinal and lateral rail displacements, longitudinal forces in rails as well as temperature of rails in straight-line sections, sharp curves, turnouts and adjoining zones.

Figure 42 from this research (reproduced as Figure 13) shows the longitudinal distribution of stresses (shown as Neutral Rail Temperature (NRT) or SFT as used in this report) measured simultaneously across a 350 m section of tangent track through a complete day-night cycle. Esveld showed that for the rail section studied, the average SFT was approximately 33°C but the actual SFT varied along the length of rail due to two effects. Firstly a variation of about 7°C with a change in actual rail temperature as rail cools and heats during a 24 hour period and secondly, a variation from 27 to 40°C along the length of the rail during the hottest part of the day (in each case disregarding the readings at the extremities of the test section). Therefore, understanding the distribution of stress as well as the variation with ambient temperature is important to understand the risk of buckling.

Figure 13: Typical short-term track response on the straight section of CWR track when the lateral movements reach a few millimetres.

Source: C Esveld (1998) Improved Knowledge of CWR Track, ERRI Committee D202 paper on study commissioned by the International Union of Railways (UIC.

The ARTC standard for installing CWR on concrete sleepers specified an SFT of 38 ± 5 °C. Following this incident, the rails were unfastened, straightened and the SFT of each rail estimated using VERSE testing. The measurements were taken approximately midway between the bridges bounding the section of track in which the derailment occurred. There was not a large difference between the two rails, with their estimated SFT being 35 ± 1 °C.

This instance presented an unusual scenario with bridges at end of a section of about 140 m in length. The extent to which there may have been localised creep towards the bridge at 142.710 km prior to the derailment cannot be ascertained or estimated. By way of example, a localised additional compression of 2 mm over a 20 m length of rail equates to a reduction of about 8°C in the rail’s SFT. This in turn would have the effect of heightening the likelihood of track instability.

Using the ARTC predictor tool, the sensitivity to a localised reduction in rail SFT was predicted for a range of initial lateral misalignments (initiators) and a fixed ballast shoulder width of less than 100 mm (Table 5).

Table 5: Variables used in modelling sensitivity to rail stress free temperature

A localised reduction of SFT of 5-10°C on the measured post-incident 35 °C ‘average’ for the section (to an SFT of 25-30°C) would have resulted in heightened likelihood of track buckle, particularly in the presence of an initial lateral misalignment of more than 10 mm (Figure 14).

Figure 14: The influence of rail SFT on predicted track buckling temperature

Source: Model information and tools published by ARTC, with input data by Chief Investigator, Transport Safety (Vic)

Summary

It is not feasible to determine the extent to which each facet of the track condition contributed to its instability and vulnerability to misalignment under loading from rail traffic. However, it can be concluded that a reduced ballast profile through the location contributed to track instability either through a broad loss of lateral resistance, or a localised loss of resistance that resulted in an increased value of initial misalignment (buckling initiator).

Any localised reduction in SFT in the rails abutting the rail bridge would also have increased the likelihood of a track buckle forming at this location.

Management of lateral stability at mud-holes

Standards for managing stability

Track ballast

To support management of track stability, ARTC specified maintenance requirements for track ballast, and associated response measures for reduced ballast shoulders. Maintenance records indicate that the mud hole was being monitored (response code A6) and the mud hole listed on the Routine Maintenance – Defect Work Orders. This response was probably in compliance with the ARTC code of practice that specified response codes for a shoulder deficiency over at least 10 m. While the localised ballast profile deficiency in the more severely contaminated area was probably consistent with the profile identified for an A5 or A4 response, this deficiency did not extend the 10 m required by the Code to trigger such a response.

Special locations and treatment

ARTC procedures for managing track stability categorised locations that had an increased risk of track instability as special locations. This potentially included sites with localised initiators like mud holes. The mud hole at Creighton had been identified by ARTC but had not been categorised as a special location. The procedures did not provide clear guidance to field staff on facets of ballast condition within a mud hole that might trigger its designation as a special location. Such criteria may have included mud hole severity, length or proximity to a fixed point that may heighten the track’s vulnerability to lateral instability.

Special locations required rectification work or more detailed inspections prior to the high temperature season. As the Creighton location was not identified as a special location, it was not remedied in line with the special location process.

Track Stability Management Plan

The Track Stability Management Plan (TSMP) was designed to be regularly updated and included actions to be undertaken to manage track lateral stability in accordance with ARTC standards and procedures. The plan detailed ‘Buckling Resistance Management’ and the requirement to define locations with ballast deficiencies that required temporary speed restrictions when forecast temperatures reached or exceeded 38°C.^[47] There were no such locations identified within the plan for the 170 km section that included Creighton.

The plan noted that after establishment of concrete sleepers in 2016, inspections had indicated that there had been little or no evidence of creep. Creep measurements were no longer taken by ARTC and therefore the evidence base for this commentary within the TSMP is unclear.

SFT measurements were taken at locations identified as those where SFT may have been compromised. Evidence suggests identified locations were mostly those areas that had been affected by track disturbance. The criteria for the selection of other sites for SFT testing, that had no clear trigger such as disturbance or compromised geometry, were not clearly defined.

Rail stress management

In those areas on this corridor with established concrete-sleepered CWR track, ARTC did not have a program of network-wide monitoring of rail stress. This maintenance policy appears based on the position that this type of track construction was less likely to creep, and lead to variation in rail SFT of a magnitude that would trigger track buckle or rail breaks. Monitoring of variation in SFT was limited to those sites identified by inspection or following track disturbance, typically from maintenance activity.

The regime established by ARTC for the management of rail stress may not identify all locations in the network with potentially problematic variation in SFT. It could not be established whether the suite of standards and procedures used by ARTC to manage rail SFT, and its implications on track stability, adequately managed this risk.

__________

38. Rail temperatures may be fifty per cent more than ambient. Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010. In this instance the rail was exposed to direct solar radiation.
39. The nominal SFT of rail on this corridor was 38 ± 5 °C.
40. ARTC document ETI0606T-01 Track Buckling Predictor, version 1.0, 16 March 2017, Technical notes.
41. This value is set by the predictor model.
42. A nominal figure has been used consistent with the Schramm model set value of 10m.
43. The model specified options for a factor of 0.1 (Smooth riding wagon), 0.2 (Slightly hunting wagon), 0.3 (Moderately hunting wagon) or 0.4 (Badly hunting wagon). The factor 0.3 was used for all modelling based on the wagon inspection that suggested some hunting behaviour.
44. The model provides a range of 0 and 250000 for tonnes of traffic since resurfacing. This is a measure of interlocking and support of the ballast, and accounts for recent disturbance. Given the fouling and degradation of ballast in the vicinity of mud holes, a nominal, intermediate tonnage value of 100,000 has been has been used to minimise the impact of use of extreme values for this parameter.
45. The width of ballast shoulders at the end of sleepers.
46. Esveld C, Improved Knowledge of CWR Track retrieved 22 September 2020. D202_Paris_98.PDF (esveld.com)
47. In accordance with ARTC Code of Practice – Section 4

Findings

From the evidence available, the following findings are made with respect to derailment of freight train 6BM9.

Contributing factors

• A mud hole and the associated loss of ballast resulted in a reduction in track lateral resistance at the derailment location.
• There were significant longitudinal compressive forces in the rails at the derailment location due to the hot conditions of the day and possibly localised reduction in rail SFT leading into a rail bridge.
• The combination of reduced track lateral resistance and longitudinal compression within the rails was sufficient for the track to misalign under the dynamic loading of train 6BM9, and for one wagon to derail.
• The loss of ballast profile at the derailment location probably required a more significant level of response than being monitored, such as a temporary speed restriction or repair.
• The ARTC systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability. [Safety issue]

Other findings

• ARTC systems for monitoring rail stress free temperature (SFT) in concrete-sleepered CWR track probably did not identify all locations that have SFT outside the Code of Practice guidelines.

Safety issues and actions

Management of track lateral stability 

Safety Issue Number: RO-2019-003-SI-01 

Safety issue description: The ARTC systems for managing track lateral stability did not lead to the location being managed as a location potentially vulnerable to instability.

Response by Australian Rail Track Corporation

The ARTC advised that this location was not deemed to be a special location. The process for identifying special locations, targets locations susceptible to incorrect SFT and instability.

Safety recommendation description: The Australian Transport Safety Bureau recommends that the Australian Rail Track Corporation reviews its processes and criteria for identifying and managing track locations vulnerable to lateral instability, considering the findings of this investigation report.

Additional safety action by Australian Rail Track Corporation

ARTC advised that their Track Stability Management Plan (TSMP) for the 30–200 km section had been reviewed by its internal audit team. As part of the 2019/20 TSMP, 10 sites had been subject to VERSE (Stress Free Temperature) testing, and 13 sites identified as special locations for the monitoring of track stability. This included the Creighton derailment site.

General details

Train details

Sources and submissions

Sources of information

The sources of information during the investigation included the:

• Australian Rail Track Corporation
• SCT Logistics
• Locomotive drivers
• Recorded data from locomotive data loggers.

References

Nafis Ahmad, Shah Sanjar & Mandal, Nirmal & Chattopadhyay, Gopinath & Powell, J. & Micenko, P. (2011). Improvement of rail creep data to measure the stress state of a tangent continuously welded rail (CWR) track.

Schramm, G. (Trans. Lange, H.). Permanent Way Technique and Permanent Way Economy. 1st Edition. 1961.

Bartlett, D.L.(1960) The Stability of Long Welded Rails, Civil Eng. and Public Works Review Vol. 55, No. 649, 1033-1035, NO. 650, 1170-1171, No. 651, 1299-1303, No. 653, 1591-1593.

Wu Y., Munro P., Rasul M.G., Khan M.M.K., A review of Recent Developments in Rail Temperature Prediction for use in Buckling Studies, RTSA Conference on Railway Engineering, Wellington, 2010. In this instance the rail was exposed to direct solar radiation.

Esveld C, Improved Knowledge of CWR Track www.esveld.com/Download/TUD/D202_Paris_98. PDF retrieved 22 September 2020.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

Submissions were received from:

• Australian Rail Track Corporation
• SCT Logistics
• Office of the National Rail Safety Regulator.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Appendices

Appendix A – ARTC pictorial definitions of reduced ballast profile

Source: ARTC Engineering (Track & Civil) Code of Practice Section 4 Ballast

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through: identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. Terminology An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information  Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2020 Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.

Overview of the investigation

At 0325 Eastern Daylight-savings Time on 6 February 2019, a Pacific National loaded coal train, MR280, travelling from Moolarben to Kooragang Coal Terminal, derailed near Baerami on the Ulan branch line on the Hunter Valley Network. All wheels of the leading bogie of the 88th wagon derailed and travelled in a derailed state for approximately 1.83 km. As the derailed train reached the points of the Baerami crossing loop, another five wagons derailed and three wagons rolled on their side, narrowly missing a stationary empty coal train UL369.

The Australian Rail Track Corporation was the rail infrastructure manager for the Ulan branch line.

ATSB’s preliminary evidence collection revealed:

• There were known track defects constituting a complete track formation failure in the section of track at the point of mount and in the region approaching the derailment site. Post derailment track measurements confirmed there was a failure of the track formation at the site of the derailment.
• These defects were not treated in accordance with the ARTC’s code of practice, and they deteriorated more rapidly than expected and consequently contributed to the derailment.
• The multiple defects acted in a compounding manner but were treated in isolation. ARTC’s code of practice allowed for consideration of multiple defects and the compounding effect and required more stringent action to be taken accordingly.
• It is likely ineffective track drainage in the area of the derailment contributed to the loss of track formation.
• Prior to the derailment, track workers that inspected the section of track where the derailment occurred had identified a defect that they did not report into the asset management system, contrary to the requirements of the system.
• The last train to successfully traverse the section of track was WG949, and the train crew identified rough riding. However, an inconsistent application of the read-back element of network rule ANGE 204 (Reporting and Responding to Conditions Affecting the Network) likely resulted in the rough riding report not being acted upon.
• Train management of MR280 was consistent with operating procedures and the condition of the rolling stock did not contribute to this derailment.

Reasons for the discontinuation

The ATSB considered the contributing factors to the derailment were a result of individual actions, where personnel had not executed the intent of the ARTC code of practice and/or had not followed procedures as required.

In response to the incident, the ARTC took safety action, including:

• implemented a daily ‘known conditions review’ meeting at all provisioning centres so that call outs, TCR’s and known conditions could be frequently reviewed with other current information and ensure appropriate controls were in place for the management of defects
• issued a communication to key operational staff to reiterate the requirements and their responsibilities under network rule ANGE 206.

Based on this information, the ATSB considered it was very unlikely that further investigation would identify any systemic safety issues or identify opportunity for the enhancement of transport safety. Consequently, the ATSB has discontinued this investigation.